Method and device for configuring equipment

Abstract

Provided are a method and apparatus for configuring a device, the method comprising: a first device verifies a root authentication center certificate RCAC of a second device through a certificate center, the certificate center being able to determine the legality of the RCAC, the method in the embodiments of the present application being able to improve the security in a network configuration process.

Description

Method and apparatus for configuring equipment Technical Field

[0001] The present application relates to the field of communication technology, and more specifically, to a method and apparatus for configuring a device. Background Art

[0002] With the widespread application of fabrics, users have increasingly higher requirements for the functions of fabrics. Therefore, how to improve the functions of fabrics to enhance user experience has become a technical problem that needs to be solved urgently.

[0003] Summary of the Invention

[0004] The present application provides a method and apparatus for configuring a device. The following describes various aspects of the embodiments of the present application.

[0005] In a first aspect, a method for configuring a device is provided, comprising: a first device verifies a root certification center certificate RCAC of a second device through a certificate center, wherein the certificate center is capable of determining the legitimacy of the RCAC.

[0006] In a second aspect, a method for configuring a device is provided, including: a second device receives ninth information sent by a first device, the ninth information being used to request a root certification center certificate RCAC of the second device; the second device sends tenth information to the first device, the tenth information being used to indicate the RCAC.

[0007] According to a third aspect, a device for configuring a device is provided, comprising: a verification unit for verifying a root certification center certificate RCAC of a second device through a certificate center, wherein the certificate center is capable of determining the legitimacy of the RCAC.

[0008] In a fourth aspect, a device for configuring a device is provided, comprising: a receiving unit for receiving ninth information sent by a first device, wherein the ninth information is used to request a root certification center certificate RCAC of the device; and a sending unit for sending tenth information to the first device, wherein the tenth information is used to indicate the RCAC.

[0009] In a fifth aspect, an apparatus for configuring a device is provided, comprising a memory and a processor, wherein the memory is used to store a program, and the processor is used to call the program in the memory to execute the method described in the first aspect.

[0010] In a sixth aspect, an apparatus for configuring a device is provided, comprising a memory and a processor, wherein the memory is used to store a program, and the processor is used to call the program in the memory to execute the method described in the second aspect.

[0011] In a seventh aspect, an apparatus for configuring a device is provided, comprising a processor for calling a program from a memory to execute the method described in the first aspect.

[0012] In an eighth aspect, an apparatus for configuring a device is provided, comprising a processor for calling a program from a memory to execute the method described in the second aspect.

[0013] In a ninth aspect, a chip is provided, comprising a processor for calling a program from a memory so that a device equipped with the chip executes the method described in the first aspect.

[0014] In a tenth aspect, a chip is provided, comprising a processor for calling a program from a memory so that a device equipped with the chip executes the method described in the second aspect.

[0015] In an eleventh aspect, a computer-readable storage medium is provided, on which a program is stored, wherein the program enables a computer to execute the method described in the first aspect.

[0016] In a twelfth aspect, a computer-readable storage medium is provided, on which a program is stored, wherein the program enables a computer to execute the method described in the second aspect.

[0017] In a thirteenth aspect, a computer program product is provided, comprising a program, wherein the program enables a computer to execute the method described in the first aspect.

[0018] In a fourteenth aspect, a computer program product is provided, comprising a program, wherein the program enables a computer to execute the method described in the second aspect.

[0019] In a fifteenth aspect, a computer program is provided, which enables a computer to execute the method described in the first aspect.

[0020] In a sixteenth aspect, a computer program is provided, which enables a computer to execute the method described in the second aspect.

[0021] In an embodiment of the present application, the first device can verify the root certification center certificate RCAC of the second device through the certificate center, thereby reducing the risk of attack during the configuration process and avoiding the problem of sensitive data leakage of the ecological platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] FIG1 is an example diagram of an application scenario of an embodiment of the present application.

[0023] FIG2 is a schematic flow chart of a method for configuring a device in an embodiment of the present application.

[0024] FIG3 is a schematic flowchart of a method for configuring a device provided in one embodiment of the present application.

[0025] FIG4 is a schematic flowchart of a method for configuring a device provided in another embodiment of the present application.

[0026] FIG5 is a schematic flowchart of a method for configuring a device provided in yet another embodiment of the present application.

[0027] FIG6 is a schematic flowchart of a method for configuring a device provided in yet another embodiment of the present application.

[0028] FIG7 is a schematic structural diagram of an apparatus for configuring a device according to an embodiment of the present application.

[0029] FIG8 is a schematic structural diagram of an apparatus for configuring a device according to another embodiment of the present application.

[0030] FIG9 is a schematic structural diagram of a device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The technical solution in this application will be described below with reference to the accompanying drawings.

[0032] FIG1 is an example diagram of an application scenario 100 according to an embodiment of the present application. Application scenario 100 may include a network 110, with a terminal device 112 and a terminal device 130 located within (or within the coverage area of) network 110. Terminal device 112 may communicate data with terminal device 130. Terminal device 112 may be a management device for network 110, and terminal device 112 may configure terminal device 130 to network 110 (i.e., establish a connection with network 110).

[0033] Optionally, after configuring terminal device 130 in network 110, terminal device 130 may be further configured in other networks. For example, application scenario 100 may also include network 120, and terminal device 122 and terminal device 130 are located in (within the coverage area of) network 120. It can be seen that terminal device 130 can be located in both network 110 and network 120. Terminal device 122 can transmit data with terminal device 130. Terminal device 122 may be a management device for network 120, and terminal device 122 may configure terminal device 130 in network 120 (i.e., establish a connection with network 120).

[0034] Networks 110 and 120 can provide services to terminal devices within their coverage areas, such as establishing network connections with terminal devices within their coverage areas and enabling data transmission between multiple terminal devices within their coverage areas. Networks 110 and 120 can be fabric networks. Networks 110 and 120 can be referred to as ecological networks or ecological platforms.

[0035] FIG1 exemplarily shows two networks and three terminal devices. Optionally, the application scenario 100 may include more or fewer networks or terminal devices, and the embodiments of the present application are not limited thereto. It should be understood that the embodiments of the present application are not limited to the system architecture shown in FIG1 , and the technical solutions of the embodiments of the present application can be applied to various system architectures, and the embodiments of the present application are not limited thereto.

[0036] The terminal device 112 or the terminal device 122 in the embodiments of the present application may also be referred to as a management device, a user device, etc. Optionally, the terminal device 112 may be a device with administrator privileges in the network 110 (i.e., a management device), and the terminal device 122 may also be a device with administrator privileges in the network 120. The terminal device 112 or the terminal device 122 may be a mobile phone, a tablet computer (Pad), a laptop computer, a PDA, a wearable device, etc.

[0037] The terminal device 130 in the embodiments of the present application may also be referred to as a node device, user device, etc. The terminal device 130 may be a lighting device, a door lock, a blind, a television, a heating and air conditioning system, a security sensor and controller, a gateway, or the like. The terminal device 130 may establish connections with the network 110 and the network 120 and perform data transmission with the terminal device 112 in the network 110 and the terminal device 122 in the network 120.

[0038] In Figure 1 , if terminal device 112 does not establish a connection with any network before configuring terminal device 130 to network 110, then the process of terminal device 112 configuring terminal device 130 to network 110 can be referred to as the initial network configuration. When terminal device 122 configures terminal device 130 to network 120, if terminal device 130 has already established a connection with network 110, then the process of terminal device 122 configuring terminal device 130 to network 120 can be referred to as the secondary network configuration. It should be noted that the term "secondary network configuration" does not specifically refer to the second network configuration; all non-initial network configurations other than the initial network configuration can be referred to as secondary network configuration. The secondary network configuration process is described below in conjunction with Figure 2 .

[0039] In Figure 2, management device A is a configurator in Ecosystem A and has administrator privileges in Ecosystem A. Management device B is a configurator in Ecosystem B and has administrator privileges in Ecosystem B. The user device has established a connection with Ecosystem A. Ecosystem A and Ecosystem B can correspond to different ecosystem vendors. For example, Ecosystem A can correspond to Google's Ecosystem A, and Ecosystem B can correspond to Xiaomi's Ecosystem B.

[0040] As shown in FIG2 , method 200 may include the following steps:

[0041] S201: A user starts a configuration mode of a user device.

[0042] For example, the user may input an operation instruction to the management device A to start a related application (APP) in the management device A and enable the APP to enter a configuration mode (of the user device).

[0043] S202: Management device A generates a configuration token OT.

[0044] For example, the APP in the management device A may generate an Onboarding Token (OT). In the subsequent steps of the method 200 , all actions performed by the management device A may be performed by the APP of the management device A.

[0045] S203: Management device A sends a configuration start instruction to the user equipment.

[0046] The instruction may carry the configuration token generated in S202 .

[0047] S204: The user equipment enters a configuration discovery mode.

[0048] S205: The user equipment sends a response message to the management device A.

[0049] S206: Management device A sends a configuration token to management device B.

[0050] For example, management device A may send the configuration token generated in S202 to management device B via email, voice, or the like.

[0051] S207: Management device B discovers the user equipment.

[0052] S208: The management device B uses the configuration token to establish a secure connection with the user device.

[0053] The secure connection may be a password authenticated session establishment (PASE) connection.

[0054] S209: Management device B authenticates the certification declaration (CD) of the user device.

[0055] S210: Management device B creates an identifier for ecological network B.

[0056] For example, if the ecological network B has not been used in the home network, the management device B creates a network identifier (fabricID) for the ecological network B.

[0057] S211: The user device sends a certificate signing request (CSR) to the management device B.

[0058] For example, the user device may be a desk lamp (bulb), and the user device may send a certificate request CSR.bulb to the management device B.

[0059] S212: Management device B sends the network identifier and CSR to a certification authority (CA).

[0060] CA can refer to the authentication center (or certificate issuing center) corresponding to ecological network B. Management device B can send CSR.bulb and fabricID to CA to request device certificate.

[0061] S213: CA sends the device certificate to management device B.

[0062] The device certificate may refer to the device certificate corresponding to the ecological network B. The CA may send B.OC.bulb (device certificate) to the management device B.

[0063] S214: Management device B configures the user equipment.

[0064] Management device B can configure the device certificate B.OC.bulb and access control permission ACL.Bulb.B.APP1 to the user device (bulb).

[0065] In the above method 200, the device certificate corresponding to the ecological network B may be determined based on the root certificate authority certificate (RCAC) of the ecological manufacturer corresponding to the ecological network B. The RCAC may include multiple formats.

[0066] For example, the format of RCAC in the X.509 standard can be as follows:

[0067]

[0068]

[0069] For another example, the RCAC Matter TLV format can be as follows:

[0070]

[0071] From the network configuration process in Figure 2 above, it can be seen that Ecosystem A (management device A) masters the network configuration password of the user device (such as a configuration token, etc.) and shares it with management device B in Ecosystem B. When management device B establishes a PASE connection with the user device, Ecosystem A (management device A) can launch a man-in-the-middle attack to eavesdrop on the communication between management device B and the user device and obtain the secret data of Ecosystem B. For example, management device A can create a virtual intermediate device and modify the network configuration password and related data sent to management device B so that management device B establishes a connection with the intermediate device (instead of the user device). Furthermore, a connection can be established between the intermediate device and the user device. In this way, management device A can eavesdrop on the communication between management device B and the user device and obtain the secret data of Ecosystem B. Therefore, the existing secondary network configuration process is at risk of being attacked, and the problem of sensitive data leakage of the ecological platform may occur.

[0072] In order to solve one or more of the above technical problems, the present application proposes a method and apparatus for configuring a device, which can improve the security of the network configuration process. The embodiments of the present application are described in detail below with reference to Figures 3 to 6.

[0073] FIG3 is a schematic flow chart of a method for configuring a device according to an embodiment of the present application. The method 300 shown in FIG3 may include step S310, which is as follows:

[0074] S310: The first device verifies the RCAC of the second device through a certificate center.

[0075] The first device may be a management device (such as a commissioner) in a network (such as ecosystem B). The second device may be a user device.

[0076] The certificate center can determine the legitimacy of the RCAC. Optionally, the certificate center can be a blockchain, a cloud, an authentication center (such as the authentication center in Figure 2), or other servers. For example, the certificate center can be a distributed compliance ledger (DCL). The RCACs of various ecosystem vendors can be stored in a common certificate center. The certificate center can take security measures to ensure that the RCACs it stores can only be queried and cannot be tampered with. In subsequent embodiments, the storage method of RCAC in the certificate center will be described in conjunction with Tables 1 to 6.

[0077] In some embodiments, before step S310, method 300 may further include step S320, which is as follows:

[0078] S320: The first device determines whether the current configuration is a secondary network distribution.

[0079] Optionally, if the current configuration is secondary network distribution, the first device may perform step S310 above. If the RCAC of the second device is verified to be legitimate in step S310 above, secondary network distribution is performed on the second device. This can reduce the risk of attacks during the configuration process and improve the security of the network configuration process.

[0080] For example, the first device may determine whether the current configuration is the secondary network distribution; if the current configuration is the secondary network distribution, the first device may verify the RCAC of the second device through the certificate center.

[0081] In this application, there are several ways to determine whether the current configuration is a secondary distribution network, as follows:

[0082] Method 1: Determine whether the current configuration is a secondary network configuration based on whether the second device has been configured with a weaving network.

[0083] For example, the first device can send the fifth information to the second device, and the fifth information can be used to request the weaving network identifier of the second device; if the second device has been configured with a weaving network, the second device can send the sixth information to the first device; if the second device is not configured with a weaving network, the second device may not send the sixth information to the first device; accordingly, if the first device receives the sixth information sent by the second device, the first device can determine that the current configuration is the secondary network distribution; if the first device does not receive the sixth information sent by the second device, the first device can determine that the current configuration is the first network distribution; wherein, the sixth information can be used to indicate the weaving network identifier.

[0084] Alternatively, when receiving the fifth information, the second device may send the sixth information to the first device regardless of whether the woven network is configured. In this case, the second device may indicate different return values ​​through the sixth information to indicate whether the woven network has been configured.

[0085] Before sending the sixth information, the second device can use the first private key to sign the weaving network identifier (or return value) carried by the sixth information to obtain identification information. Accordingly, after the first device receives the sixth information, the first device can use the first public key to verify the identification information to obtain the weaving network identifier in the identification information. The first public key can correspond to the first private key.

[0086] Method 2: Determine whether the current configuration is a secondary network distribution according to the first attribute value of the second device.

[0087] For example, the first device may send seventh information to the second device, which may be used to request the first attribute value of the second device. After receiving the seventh information, the second device may send eighth information to the first device, which may be used to indicate the first attribute value. The first device may determine whether the current network configuration is secondary network configuration based on the value of the first attribute. For example, if the first attribute value is non-zero, the first device may determine that the current configuration is secondary network configuration; if the first attribute value is zero, the first device may determine that the current configuration is initial network configuration.

[0088] Before sending the eighth information, the second device may use the second private key to sign the first attribute value to obtain the attribute information. Accordingly, after receiving the eighth information, the first device may use the second public key to verify the attribute information to obtain the first attribute value in the attribute information. The second public key may correspond to the second private key.

[0089] Before step S310, the first device may obtain the RCAC of the second device. For example, before step S310, the method 300 may further include steps S330 and S340, as follows:

[0090] S330: The first device sends ninth information to the second device.

[0091] The ninth information may be used to request RCAC of the second device.

[0092] S340: The second device sends tenth information to the first device.

[0093] The tenth information may be used to indicate the RCAC of the second device.

[0094] Before S340, the second device may also use the third private key to sign the RCAC to obtain RCAC information. In this case, the tenth information may include the RCAC information.

[0095] Accordingly, after receiving the tenth information, the first device may verify the RCAC information using the third public key to determine that the RCAC information includes the RCAC.

[0096] After obtaining the RCAC of the second device, the first device can verify the RCAC of the second device through the certificate center. For example, the first device can verify the RCAC of the second device through the RCAC stored in the certificate center.

[0097] In the embodiment of the present application, the first device can verify the RCAC of the second device through various methods, as follows:

[0098] Method 1: Determine whether to configure the second device based on the RCAC of the second device.

[0099] The first device may look up the RCAC in the certificate center.

[0100] The certificate center may include a third syntax, which may include a vendor syntax and / or a syntax constructed for recording RCAC. The third syntax may include a field for recording RCAC. In other words, the certificate center may include a database corresponding to the third syntax. The database may be defined based on a data structure of the third syntax, and the RCAC of each ecosystem vendor may be stored in the field for recording RCAC in the database.

[0101] For example, an RCAC schema can be added to the DCL. The RCAC schema is used to store the root CA certificate of the ecosystem vendor. The structure of the RCAC schema can be shown in Table 1 below.

[0102] Table 1 Structure of RCAC grammar

[0103] NameTypeConstraintConformanceMutableTrustRootCertificatestringallMNo

[0104] Alternatively, a TrustRootCertificate field may be added to the vendor syntax of the DCL. The vendor syntax and the added TrustRootCertificate field may be as shown in Table 2 below.

[0105] Table 2 Structure of vendor syntax

[0106] NameTypeConstraintConformanceMutableVendorIDvendor-idallMNoVendorNamestringmax 128MYesCompanyLegalNamestringmax 256MYesCompanyPreferredNamestringmax 256OYesVendorLandingPageUrlstringmax 256OYesTrustRootCertificatestringallOYes

[0107] For example, as shown in Table 1 and Table 2 above, the first device may search for the RCAC of the second device in the RCAC syntax or the manufacturer syntax (or in a database corresponding to the syntax).

[0108] If the certificate center does not include RCAC, the first device can determine that the second device is bound to an illegal ecological platform.

[0109] Alternatively, if the certificate center does not include RCAC, the first device may output a first message that may be used to inquire the user whether to continue configuring the second device. Further, if the user instructs to continue configuring the second device, the first device may trigger the configuration process of the second device.

[0110] If the certificate center includes RCAC, the first device can trigger the configuration process of the second device.

[0111] The above embodiment will be described in detail below with reference to FIG4 . As shown in FIG4 , the method 400 includes steps S401 to S408 , which are specifically as follows:

[0112] S401: The configurator discovers a user equipment and establishes a PASE connection with the user equipment.

[0113] S402: The configurator configures basic information of the user equipment.

[0114] For example, the time of the user device, the area where the user device is located, etc.

[0115] S403: The configurator authenticates the legitimacy of the user device.

[0116] The above S401 to S403 can refer to the existing technology and will not be described in detail here.

[0117] S404: The configurator determines whether the current configuration is a secondary network configuration.

[0118] The configurator can determine whether the user equipment has been configured with Fabric. If so, it determines that the current configuration is secondary network configuration.

[0119] S405: The configurator obtains the RCAC of the user equipment.

[0120] The configurator can read the RCAC configured on the user device.

[0121] S406, the configurator searches for RCAC in the DCL.

[0122] The configurator may connect to the DCL and search the DCL for the RCAC obtained from the user device.

[0123] S407: The configurator does not find the RCAC in the DCL.

[0124] If the RCAC is not found in the DCL, the configurator may prompt the user that the user device may be bound to an illegal ecological platform and ask the user whether to continue configuring the user device.

[0125] S408: The configurator configures the user equipment.

[0126] If the user agrees to continue configuration, the configurator can initiate a CSR request to configure the NOC for the user device.

[0127] Alternatively, the configurator finds the RCAC in the DCL, and the configurator may initiate a CSR request to configure the NOC for the user equipment.

[0128] In some embodiments, if the certificate center includes RCAC, the first device may further verify the RCAC of the second device through a manufacturer identifier corresponding to the RCAC in the certificate center.

[0129] For example, if the certificate center includes RCAC, the first device can search for the manufacturer identifier corresponding to the RCAC in the certificate center; the first device can also obtain the manufacturer identifier of the second device; further, the first device can compare the manufacturer identifier of the second device (that is, the manufacturer identifier corresponding to the RCAC of the second device) with the manufacturer identifier corresponding to the RCAC (found in the certificate center), and verify the RCAC of the second device (or verify the manufacturer identifier corresponding to the RCAC of the second device) based on the comparison result.

[0130] The certificate center may include a fourth syntax, the fourth syntax including a manufacturer syntax and / or a syntax constructed for recording RCAC, the fourth syntax including a field for recording RCAC and a field for recording a manufacturer identifier. In other words, the certificate center may include a database corresponding to the fourth syntax, the database may be defined based on a data structure of the fourth syntax, the RCAC of the second device may be stored in a field for recording RCAC in the database, and the manufacturer identifier corresponding to the RCAC of each ecosystem manufacturer may be stored in a field for recording the manufacturer identifier in the database.

[0131] For example, a field for storing the vendor identifier corresponding to the RCAC (such as a VendorID field) may be added to the RCAC syntax in Table 1. The structure of the modified RCAC syntax may be as shown in Table 3 below.

[0132] Table 3 Structure of RCAC grammar

[0133] NameTypeConstraintConformanceMutableVendorIDvendor-idallMNoTrustRootCertificatestringallMNo

[0134] For example, as shown in Table 3 above, the first device may search for the vendor identifier corresponding to the RCAC in the RCAC syntax (or in a database corresponding to the syntax). Alternatively, as shown in Table 2 above, the first device may search for the vendor identifier corresponding to the RCAC (e.g., the VendorID field) in the vendor syntax (or in a database corresponding to the syntax).

[0135] Optionally, if the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC in the certificate center, the first device may determine that the second device is bound to an illegal ecological platform.

[0136] Furthermore, if the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC in the certificate center, the first device may also output a second message, which may be used to inquire the user whether to continue configuring the second device. Furthermore, if the user instructs to continue configuring the second device, the first device may trigger the configuration process of the second device.

[0137] If the manufacturer identifier of the second device matches the manufacturer identifier of the RCAC, the first device can trigger the configuration process of the second device. For example, the first device can initiate a certificate signing request (CSR) to configure a node operational certificate (NOC) for the second device.

[0138] The above embodiment will be described in detail below with reference to FIG5 . As shown in FIG5 , the method 500 includes steps S501 to S511 , which are specifically as follows:

[0139] S501: The configurator discovers a user equipment and establishes a PASE connection with the user equipment.

[0140] S502: The configurator configures basic information of the user equipment.

[0141] For example, the time of the user device, the area where the user device is located, etc.

[0142] S503: The configurator authenticates the legitimacy of the user equipment.

[0143] The above S501 to S503 can refer to the existing technology and will not be repeated here.

[0144] S504: The configurator determines whether the current configuration is a secondary network configuration.

[0145] The configurator can determine whether the user equipment has been configured with Fabric. If so, it determines that the current configuration is secondary network configuration.

[0146] S505: The configurator obtains the RCAC of the user equipment.

[0147] The configurator can read the RCAC configured on the user device.

[0148] S506, the configurator searches for RCAC in the DCL.

[0149] The configurator may connect to the DCL and search the DCL for the RCAC obtained from the user device.

[0150] S507: The configurator does not find the RCAC in the DCL.

[0151] If the RCAC is not found in the DCL, the configurator may prompt the user that the user device may be bound to an illegal ecological platform and ask the user whether to continue configuring the user device.

[0152] If the user agrees to continue configuration, the configurator can initiate a CSR request to configure the NOC for the user device.

[0153] Alternatively, the configurator finds the RCAC in the DCL and then executes S508 .

[0154] S508: The configurator obtains the manufacturer identification (VID) of the user equipment.

[0155] S509: The configurator searches the DCL for the manufacturer ID corresponding to the RCAC.

[0156] S510: The configurator compares the VID of the user equipment with the manufacturer identifier corresponding to the RCAC (found in the DCL) to see if they are consistent.

[0157] If the VID of the user device is inconsistent with the manufacturer identifier corresponding to the RCAC (found in the DCL), the configurator can prompt the user device that it may be bound to an illegal ecological platform and ask the user whether to continue configuring the user device.

[0158] S511: The configurator configures the user equipment.

[0159] If the user agrees to continue configuration, the configurator can initiate a CSR request to configure the NOC for the user device.

[0160] Alternatively, if the VID of the user equipment is consistent with the manufacturer identifier corresponding to the RCAC (found in the DCL), the configurator may initiate a CSR request to configure the NOC for the user equipment.

[0161] Method 2: Determine whether to configure the second device according to the RCAC identifier of the second device.

[0162] The first device may determine the identification of the RCAC. For example, the first device may read the identification of the RCAC from the RCAC of the second device.

[0163] Optionally, the identifier of the RCAC may include at least one of the following: the subject of the RCAC (subject field), the public key of the RCAC, and the subject key identifier of the RCAC (subject key identifier).

[0164] The first device may look up the identification of the RCAC in the certificate center.

[0165] The certificate center may include a first syntax, and the first syntax may include a field for recording the RCAC identifier. In other words, the certificate center may include a database corresponding to the first syntax, and the identifiers of the RCACs of the various eco-vendors may be stored in the field for recording the RCAC identifier in the database.

[0166] For example, when the RCAC identifier is a subject field, an RCACSubject field may be added to the vendor syntax of the DCL, as shown in Table 4 below.

[0167] Table 4 Structure of vendor syntax

[0168] NameTypeConstraintConformanceMutableVendorIDvendor-idallMNoVendorNamestringmax 128MYesCompanyLegalNamestringmax 256MYesCompanyPreferredNamestringmax 256OYesVendorLandingPageUrlstringmax 256OYesRCACSubjectstringallOYes

[0169] When the RCAC identifier is a public key, an RCACPubKey field may also be added to the DCL vendor syntax, as shown in Table 5 below.

[0170] Table 5 Structure of vendor syntax

[0171] NameTypeConstraintConformanceMutableVendorIDvendor-idallMNoVendorNamestringmax 128MYesCompanyLegalNamestringmax 256MYesCompanyPreferredNamestringmax 256OYesVendorLandingPageUrlstringmax 256OYesRCACPubKeystring65OYes

[0172] When the RCAC identifier is a subject key identifier, an RCACSubjectKeyID field may be added to the vendor syntax of the DCL, as shown in Table 6 below.

[0173] Table 6 Structure of vendor syntax

[0174] NameTypeConstraintConformanceMutableVendorIDvendor-idallMNoVendorNamestringmax 128MYesCompanyLegalNamestringmax 256MYesCompanyPreferredNamestringmax 256OYesVendorLandingPageUrlstringmax 256OYesRCACSubjectKeyIDstringallOYes

[0175] For example, as shown in Tables 4 to 6 above, the first device may search for the identifier of RCAC in the manufacturer's grammar (or in a database corresponding to the grammar).

[0176] If the certificate center does not include the RCAC logo, the first device can determine that the second device is bound to an illegal ecological platform.

[0177] Furthermore, if the certificate center does not include the RCAC identifier, the first device may output a third message, which may be used to inquire the user whether to continue configuring the second device. Furthermore, if the user instructs to continue configuring the second device, the first device may trigger the configuration process of the second device.

[0178] If the certificate center includes the RCAC identifier, the first device may trigger the configuration process of the second device.

[0179] In some embodiments, if the certificate center includes an identifier of the RCAC, the first device may further verify the RCAC of the second device through a manufacturer identifier corresponding to the identifier of the RCAC in the certificate center.

[0180] For example, if the certificate center includes the RCAC identifier, the first device can search for the manufacturer identifier corresponding to the RCAC identifier in the certificate center; the first device can obtain the manufacturer identifier of the second device; further, the first device can compare the manufacturer identifier of the second device with the manufacturer identifier corresponding to the RCAC identifier (found in the certificate center), and verify the RCAC of the second device (or verify the manufacturer identifier corresponding to the RCAC identifier of the second device) based on the comparison result.

[0181] The certificate center may include a second syntax, which may include a field for recording the RCAC identifier and a field for recording the manufacturer identifier. In other words, the certificate center may include a database corresponding to the second syntax, which may be defined based on the data structure of the second syntax. The identifier of each eco-vendor's RCAC may be stored in the field for recording the RCAC identifier in the database, and the manufacturer identifier corresponding to the identifier of each eco-vendor's RCAC may be stored in the field for recording the manufacturer identifier in the database.

[0182] For example, the vendor identifier corresponding to the RCAC identifier may be stored in a field for recording the vendor identifier (e.g., the VendorID field) in Tables 4 to 6. For example, as shown in Tables 4 to 6, the first device may search for the vendor identifier corresponding to the RCAC identifier in the RCAC syntax (or in a database corresponding to the syntax).

[0183] Optionally, if the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the identifier of the RCAC in the certificate center, the first device may determine that the second device is bound to an illegal ecological platform.

[0184] Furthermore, if the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC identifier, the first device may further output a fourth message, which may be used to inquire the user whether to continue configuring the second device. Furthermore, if the user instructs to continue configuring the second device, the first device may trigger the configuration process of the second device.

[0185] If the manufacturer identifier of the second device matches the manufacturer identifier corresponding to the RCAC identifier, the first device can trigger the configuration process of the second device. For example, the first device can initiate a certificate signing request (CSR) request to configure a node operational certificate (NOC) for the second device.

[0186] The above embodiment will be described in detail below with reference to FIG6 . As shown in FIG6 , the method 600 includes steps S601 to S612 , which are specifically as follows:

[0187] S601: The configurator discovers a user equipment and establishes a PASE connection with the user equipment.

[0188] S602: The configurator configures basic information of the user equipment.

[0189] For example, the time of the user device, the area where the user device is located, etc.

[0190] S603: The configurator authenticates the legitimacy of the user equipment.

[0191] The above S601 to S603 can refer to the existing technology and will not be described in detail here.

[0192] S604: The configurator determines whether the current configuration is a secondary network configuration.

[0193] The configurator can determine whether the user equipment has been configured with Fabric. If so, it determines that the current configuration is secondary network configuration.

[0194] S605: The configurator obtains the RCAC of the user equipment.

[0195] The configurator can read the RCAC configured on the user device.

[0196] S606: The configurator obtains the identifier of the RCAC.

[0197] The configurator may extract the identity of the RCAC from the RCAC.

[0198] S607: The configurator searches for the identifier of the RCAC in the DCL.

[0199] The configurator may connect to the DCL and search the DCL for the identifier of the RCAC obtained from the user device.

[0200] S608: The configurator does not find the identifier of the RCAC in the DCL.

[0201] If the RCAC identifier is not found in the DCL, the configurator may prompt the user that the user device may be bound to an illegal ecological platform and ask the user whether to continue configuring the user device.

[0202] If the user agrees to continue configuration, the configurator can initiate a CSR request to configure the NOC for the user device.

[0203] Alternatively, the configurator finds the identifier of the RCAC in the DCL and then executes S609.

[0204] S609: The configurator obtains the manufacturer identification (VID) of the user equipment.

[0205] S610: The configurator searches the DCL for the manufacturer ID corresponding to the RCAC.

[0206] S611: The configurator compares the VID of the user equipment with the manufacturer identifier corresponding to the RCAC (found in the DCL) to see if they are consistent.

[0207] If the VID of the user device is inconsistent with the manufacturer identifier corresponding to the RCAC (found in the DCL), the configurator can prompt the user device that it may be bound to an illegal ecological platform and ask the user whether to continue configuring the user device.

[0208] S612: The configurator configures the user equipment.

[0209] If the user agrees to continue configuration, the configurator can initiate a CSR request to configure the NOC for the user device.

[0210] Alternatively, if the VID of the user equipment is consistent with the manufacturer identifier corresponding to the RCAC (found in the DCL), the configurator may initiate a CSR request to configure the NOC for the user equipment.

[0211] In an embodiment of the present application, the first device can verify the root certification center certificate RCAC of the second device through the certificate center, thereby reducing the risk of attack during the configuration process and avoiding the problem of sensitive data leakage of the ecological platform.

[0212] The method embodiment of the present application is described in detail above in conjunction with Figures 1 to 6 , and the device embodiment of the present application is described in detail below in conjunction with Figures 7 to 9 . It should be understood that the description of the method embodiment corresponds to the description of the device embodiment, and therefore, for portions not described in detail, reference can be made to the above method embodiment.

[0213] FIG7 is a schematic structural diagram of an apparatus for configuring a device according to an embodiment of the present application. As shown in FIG7 , the apparatus 700 includes a verification unit 710, which is specifically as follows:

[0214] The verification unit 710 is configured to verify the root certification center certificate RCAC of the second device through a certificate center, where the certificate center is capable of determining the legitimacy of the RCAC.

[0215] Optionally, the apparatus 700 further includes a determination unit 720 for determining whether the current configuration is a secondary distribution network; wherein the verification unit 710 is specifically configured to verify the RCAC of the second device through the certificate center when the current configuration is a secondary distribution network.

[0216] Optionally, the verification unit 710 is specifically configured to verify the RCAC of the second device through the RCAC stored in the certificate center.

[0217] Optionally, the verification unit 710 is specifically configured to: search for the RCAC in the certificate center; if the certificate center does not include the RCAC, determine that the second device is bound to an illegal ecological platform.

[0218] Optionally, the verification unit 710 is also used to: if the certificate center does not include the RCAC, output first information, and the first information is used to ask the user whether to continue configuring the second device; the device 700 also includes a trigger unit 730, which is used to: trigger the configuration process of the second device when the user instructs to continue configuring the second device.

[0219] Optionally, the apparatus 700 further includes a triggering unit 730, configured to trigger a configuration process of the second device if the certificate center includes the RCAC.

[0220] Optionally, the verification unit 710 is further configured to: if the certificate center includes the RCAC, verify the RCAC of the second device through a manufacturer identifier corresponding to the RCAC in the certificate center.

[0221] Optionally, the verification unit 710 is specifically used to: search for the manufacturer identifier of the RCAC in the certificate center; if the certificate center includes the RCAC, and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC in the certificate center, it is determined that the second device is bound to an illegal ecological platform.

[0222] Optionally, the device 700 also includes an output unit 740, which is used to: if the certificate center includes the RCAC and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC in the certificate center, then output second information, and the second information is used to ask the user whether to continue configuring the second device; the device 700 also includes a trigger unit 730, which is used to: trigger the configuration process of the second device when the user instructs to continue configuring the second device.

[0223] Optionally, the apparatus 700 further includes a triggering unit 730 configured to trigger a configuration process of the second device if the certificate center includes the RCAC and the manufacturer identifier of the second device is consistent with the manufacturer identifier corresponding to the RCAC.

[0224] Optionally, the verification unit 710 is specifically configured to verify the RCAC of the second device through an identifier of the RCAC stored in the certificate center.

[0225] Optionally, the verification unit 710 is specifically used to: search for the identifier of the RCAC in the certificate center; if the certificate center does not include the identifier of the RCAC, determine that the second device is bound to an illegal ecological platform.

[0226] Optionally, the device 700 also includes an output unit 740, which is used to: if the certificate center does not include the RCAC identifier, output third information, and the third information is used to ask the user whether to continue configuring the second device; the device 700 also includes a trigger unit 730, which is used to: trigger the configuration process of the second device when the user instructs to continue configuring the second device.

[0227] Optionally, the apparatus 700 further includes a triggering unit 730, configured to trigger a configuration process of the second device if the certificate center includes an identifier of the RCAC.

[0228] Optionally, the verification unit 710 is further configured to: if the certificate center includes the identifier of the RCAC, verify the RCAC of the second device through a manufacturer identifier corresponding to the identifier of the RCAC in the certificate center.

[0229] Optionally, the verification unit 710 is specifically used to: search for the manufacturer identifier corresponding to the RCAC identifier in the certificate center; if the certificate center includes the RCAC identifier, and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC identifier, it is determined that the second device is bound to an illegal ecological platform.

[0230] Optionally, the device 700 also includes an output unit 740, which is used to: if the certificate center includes the identifier of the RCAC and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the identifier of the RCAC, then output fourth information, and the fourth information is used to ask the user whether to continue configuring the second device; the device 700 also includes a trigger unit 730, which is used to: trigger the configuration process of the second device when the user instructs to continue configuring the second device.

[0231] Optionally, the apparatus 700 further includes a triggering unit 730 configured to trigger a configuration process of the second device if the certificate center includes the identifier of the RCAC and the manufacturer identifier of the second device is consistent with the manufacturer identifier corresponding to the identifier of the RCAC.

[0232] Optionally, the certificate center includes a first syntax, and the first syntax includes a field for recording the identifier of the RCAC; the verification unit 710 is specifically used to: search for the identifier of the RCAC in the first syntax.

[0233] Optionally, the certificate center includes a second syntax, which includes a field for recording the RCAC identifier and a field for recording the manufacturer identifier; the verification unit 710 is specifically used to: search the second syntax for the manufacturer identifier corresponding to the RCAC.

[0234] Optionally, the identification of the RCAC includes at least one of the following: the subject of the RCAC, the public key of the RCAC, and the subject key identification of the RCAC.

[0235] Optionally, the device 700 also includes a sending unit 750, which is used to: send fifth information to the second device, and the fifth information is used to request the weaving network identifier of the second device; the determination unit 720 is specifically used to: if the device receives the sixth information sent by the second device, determine that the current configuration is the secondary network distribution; if the device does not receive the sixth information sent by the second device, determine that the current configuration is the first network distribution; wherein the sixth information is used to indicate the weaving network identifier.

[0236] Optionally, the sixth information includes identification information, which is obtained by signing with a first private key. The verification unit 710 is also used to: verify the identification information using a first public key to obtain the weaving network identification in the identification information, and the first public key corresponds to the first private key.

[0237] Optionally, the device 700 also includes a sending unit 750 and a receiving unit 760, the sending unit 750 is used to: send seventh information to the second device, the seventh information is used to request the first attribute value of the second device; the receiving unit 760 is used to: receive eighth information sent by the second device, the eighth information is used to indicate the first attribute value; the determination unit is specifically used to: if the first attribute value is a non-zero value, determine that the current configuration is a secondary network configuration; if the first attribute value is zero, determine that the current configuration is a first network configuration.

[0238] Optionally, the eighth information includes attribute information, which is obtained by signing with a second private key. The verification unit 710 is also used to: verify the attribute information using a second public key to obtain the first attribute value in the attribute information, and the second public key corresponds to the second private key.

[0239] Optionally, the device 700 also includes a sending unit 750 and a receiving unit 760, the sending unit 750 is used to: send ninth information to the second device, the ninth information is used to request RCAC of the second device; the receiving unit 760 is used to: receive tenth information sent by the second device, the tenth information is used to indicate the RCAC.

[0240] Optionally, the tenth information includes RCAC information, which is obtained by signing with a third private key. The verification unit 710 is also used to: verify the RCAC information using a third public key to determine that the RCAC information includes the RCAC, and the third public key corresponds to the third private key.

[0241] Optionally, the certificate center includes a third grammar, the third grammar includes a manufacturer grammar and / or a grammar constructed for recording RCAC, and the third grammar includes a field for recording RCAC; the verification unit 710 is specifically used to: search for the RCAC in the third grammar.

[0242] Optionally, the certificate center includes a fourth grammar, the fourth grammar includes a manufacturer grammar and / or a grammar constructed for recording RCAC, the fourth grammar includes a field for recording RCAC and a field for recording the manufacturer identifier; the verification unit 710 is specifically used to: search for the manufacturer identifier corresponding to the RCAC in the fourth grammar.

[0243] FIG8 is a schematic structural diagram of an apparatus for configuring a device according to an embodiment of the present application. The apparatus 800 for configuring a device in FIG8 includes a receiving unit 810 and a sending unit 820, specifically as follows:

[0244] A receiving unit 810 is configured to receive ninth information sent by the first device, where the ninth information is used to request a root certification center certificate RCAC of the apparatus;

[0245] The sending unit 820 is configured to send tenth information to the first device, where the tenth information is used to indicate the RCAC.

[0246] Optionally, the tenth information includes RCAC information, and the apparatus 800 further includes a signing unit 830 configured to: use a third private key to sign the RCAC to obtain the RCAC information.

[0247] Optionally, the receiving unit 810 is further used to: receive fifth information sent by the first device, the fifth information being used to request the weaving network identifier of the device; the sending unit 820 is further used to: if the device has been configured with a weaving network, send sixth information to the first device, the sixth information being used to indicate the weaving network identifier.

[0248] Optionally, the sixth information includes identification information, and the apparatus 800 further includes a signing unit 830 configured to: use a first private key to sign the weaving network identification to obtain the identification information.

[0249] Optionally, the receiving unit 810 is further used to: receive seventh information sent by the first device, the seventh information being used to request the first attribute value of the apparatus; the sending unit 820 is further used to: send eighth information to the first device, the eighth information being used to indicate the first attribute value.

[0250] Optionally, the eighth information includes attribute information, and the apparatus 800 further includes a signing unit 830 configured to: use a second private key to sign the first attribute value to obtain the attribute information.

[0251] FIG9 is a schematic block diagram of an apparatus provided in one embodiment of the present application. The dashed lines in FIG9 indicate that the unit or module is optional. Apparatus 900 may be used to implement the method described in the above method embodiment. Apparatus 900 may be a chip or a device configured with a device.

[0252] The device 900 may include one or more processors 910. The processor 910 may support the device 900 to implement the method described in the method embodiment above. The processor 910 may be a general-purpose processor or a special-purpose processor. For example, the processor may be a central processing unit (CPU). Alternatively, the processor may be another general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0253] The apparatus 900 may further include one or more memories 920. The memories 920 store programs that can be executed by the processor 910, causing the processor 910 to perform the methods described in the above method embodiments. The memories 920 may be independent of the processor 910 or integrated into the processor 910.

[0254] The apparatus 900 may further include a transceiver 930. The processor 910 may communicate with other devices or chips via the transceiver 930. For example, the processor 910 may transmit and receive data with other devices or chips via the transceiver 930.

[0255] The present invention also provides a computer-readable storage medium for storing a program. The computer-readable storage medium can be applied to the apparatus for configuring the device provided in the present invention, and the program causes a computer to execute the method performed by the apparatus for configuring the device in each embodiment of the present invention.

[0256] The present application also provides a computer program product. The computer program product includes a program. The computer program product can be applied to the apparatus for configuring a device provided in the present application, and the program causes a computer to execute the method performed by the apparatus for configuring a device in each embodiment of the present application.

[0257] The present application also provides a computer program that can be applied to the apparatus for configuring a device provided in the present application, and enables a computer to execute the method performed by the apparatus for configuring a device in each embodiment of the present application.

[0258] It should be understood that in the embodiments of the present application, "B corresponding to A" means that B is associated with A and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B based solely on A, but B can also be determined based on A and / or other information.

[0259] It should be understood that the term "and / or" in this document simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0260] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0261] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0262] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of the solution of this embodiment according to actual needs.

[0263] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0264] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be read by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0265] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for configuring a device, characterized in that: include: The first device verifies the root certification center certificate RCAC of the second device through a certificate center, and the certificate center is able to determine the legitimacy of the RCAC.

2. The method according to claim 1, characterized in that The method further comprises: The first device determines whether the current configuration is a secondary distribution network; The first device verifies the root certification center certificate RCAC of the second device through the certificate center, including: In the case where the current configuration is a secondary distribution network, the first device verifies the RCAC of the second device through the certificate center.

3. The method according to claim 1 or 2, characterized in that The first device verifies the root certification center certificate RCAC of the second device through the certificate center, including: The first device verifies the RCAC of the second device through the RCAC stored in the certificate center.

4. The method according to claim 3, characterized in that The first device verifies the RCAC of the second device by using the RCAC stored in the certificate center, including: The first device searches for the RCAC in the certificate center; If the certificate center does not include the RCAC, the first device determines that the second device is bound to an illegal ecological platform.

5. The method according to claim 4, characterized in that The method further comprises: If the certificate center does not include the RCAC, the first device outputs a first message, where the first message is used to inquire the user whether to continue configuring the second device; When the user instructs to continue configuring the second device, the first device triggers the configuration process of the second device.

6. The method according to claim 4 or 5, characterized in that The method further comprises: If the certificate center includes the RCAC, the first device triggers the configuration process of the second device.

7. The method according to claim 4 or 5, characterized in that The method further comprises: If the certificate center includes the RCAC, the first device verifies the RCAC of the second device through the manufacturer identifier corresponding to the RCAC in the certificate center.

8. The method according to claim 7, characterized in that The first device verifies the RCAC of the second device by using the manufacturer identifier corresponding to the RCAC in the certificate center, including: The first device searches the certificate center for the manufacturer identifier of the RCAC; If the certificate center includes the RCAC, and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC in the certificate center, the first device determines that the second device is bound to an illegal ecological platform.

9. The method according to claim 8, characterized in that The method further comprises: If the certificate center includes the RCAC and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC in the certificate center, the first device outputs a second message, where the second message is used to inquire the user whether to continue configuring the second device; When the user instructs to continue configuring the second device, the first device triggers the configuration process of the second device.

10. The method according to claim 8 or 9, characterized in that The method further comprises: If the certificate center includes the RCAC and the manufacturer identifier of the second device is consistent with the manufacturer identifier corresponding to the RCAC, the first device triggers the configuration process of the second device.

11. The method according to claim 1 or 2, characterized in that The first device verifies the root certification center certificate RCAC of the second device through the certificate center, including: The first device verifies the RCAC of the second device through the identifier of the RCAC stored in the certificate center.

12. The method according to claim 11, characterized in that The first device verifies the RCAC of the second device by using the identifier of the RCAC stored in the certificate center, including: The first device searches for the identifier of the RCAC in the certificate center; If the certificate center does not include the identifier of the RCAC, the first device determines that the second device is bound to an illegal ecological platform.

13. The method according to claim 12, characterized in that The method further comprises: If the certificate center does not include the identifier of the RCAC, the first device outputs third information, where the third information is used to inquire the user whether to continue configuring the second device; When the user instructs to continue configuring the second device, the first device triggers the configuration process of the second device.

14. The method according to claim 12 or 13, characterized in that The method further comprises: If the certificate center includes the identifier of the RCAC, the first device triggers the configuration process of the second device.

15. The method according to claim 12 or 13, characterized in that The method further comprises: If the certificate center includes the identifier of the RCAC, the first device verifies the RCAC of the second device through the manufacturer identifier corresponding to the identifier of the RCAC in the certificate center.

16. The method according to claim 15, characterized in that The first device verifies the RCAC of the second device by using the manufacturer identifier corresponding to the identifier of the RCAC in the certificate center, including: The first device searches the certificate center for a manufacturer identifier corresponding to the identifier of the RCAC; If the certificate center includes the identifier of the RCAC, and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the identifier of the RCAC, the first device determines that the second device is bound to an illegal ecological platform.

17. The method according to claim 16, characterized in that The method further comprises: If the certificate center includes the identifier of the RCAC and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the identifier of the RCAC, the first device outputs fourth information, wherein the fourth information is used to inquire the user whether to continue configuring the second device; When the user instructs to continue configuring the second device, the first device triggers the configuration process of the second device.

18. The method according to claim 16 or 17, characterized in that The method further comprises: If the certificate center includes the identifier of the RCAC, and the manufacturer identifier of the second device is consistent with the manufacturer identifier corresponding to the identifier of the RCAC, the first device triggers the configuration process of the second device.

19. The method according to any one of claims 12 to 18, characterized in that The certificate center includes a first syntax including a field for recording an identification of the RCAC; The first device searches for the identifier of the RCAC in the certificate center, including: The first device searches the first syntax for the identification of the RCAC.

20. The method according to any one of claims 15 to 19, characterized in that The certificate center includes a second grammar, wherein the second grammar includes a field for recording an identification of the RCAC and a field for recording a manufacturer identification; The first device searches the certificate center for the manufacturer identifier corresponding to the RCAC, including: The first device searches the second syntax for the manufacturer identifier corresponding to the RCAC.

21. The method according to any one of claims 11 to 20, characterized in that The RCAC logo includes at least one of the following: The subject of the RCAC, the public key of the RCAC and the subject key identifier of the RCAC.

22. The method according to claim 2, characterized in that The first device determines whether the current configuration is a secondary network distribution, including: The first device sends fifth information to the second device, where the fifth information is used to request a weaving network identifier of the second device; If the first device receives the sixth information sent by the second device, the first device determines that the current configuration is the secondary distribution network; If the first device does not receive the sixth information sent by the second device, the first device determines that the current configuration is the first network configuration; The sixth information is used to indicate the weaving network identifier.

23. The method according to claim 22, characterized in that The sixth information includes identification information, where the identification information is obtained by signing with the first private key. The method further includes: The first device verifies the identification information using a first public key to obtain the weaving network identifier in the identification information, where the first public key corresponds to the first private key.

24. The method according to claim 2, characterized in that The first device determines whether the current configuration is a secondary network distribution, including: The first device sends seventh information to the second device, where the seventh information is used to request a first attribute value of the second device; The first device receives eighth information sent by the second device, where the eighth information is used to indicate the first attribute value; If the first attribute value is a non-zero value, the first device determines that the current configuration is a secondary distribution network; If the first attribute value is zero, the first device determines that the current configuration is the first network configuration.

25. The method according to claim 24, characterized in that The eighth information includes attribute information, and the attribute information is obtained by signing with the second private key. The method further includes: The first device verifies the attribute information using a second public key to obtain the first attribute value in the attribute information, where the second public key corresponds to the second private key.

26. The method according to any one of claims 1 to 25, characterized in that The method further comprises: The first device sends ninth information to the second device, where the ninth information is used to request RCAC of the second device; The first device receives tenth information sent by the second device, where the tenth information is used to indicate the RCAC.

27. The method according to claim 26, characterized in that The tenth information includes RCAC information, and the RCAC information is obtained by signing with a third private key. The method further includes: The first device verifies the RCAC information using a third public key to determine that the RCAC information includes the RCAC, and the third public key corresponds to the third private key.

28. The method according to any one of claims 4 to 10, characterized in that The certificate center includes a third grammar, the third grammar includes a manufacturer grammar and / or a grammar constructed for recording RCAC, and the third grammar includes a field for recording RCAC; The first device searches for the RCAC in the certificate center, including: The first device looks up the RCAC in the third grammar.

29. The method according to any one of claims 8 to 10, characterized in that The certificate center includes a fourth grammar, the fourth grammar includes a manufacturer grammar and / or a grammar constructed for recording RCAC, the fourth grammar includes a field for recording RCAC and a field for recording a manufacturer identifier; The first device searches the certificate center for the manufacturer identifier corresponding to the RCAC, including: The first device searches the fourth syntax for a manufacturer identifier corresponding to the RCAC.

30. A method for configuring a device, characterized in that: include: The second device receives ninth information sent by the first device, where the ninth information is used to request a root certification center certificate RCAC of the second device; The second device sends tenth information to the first device, where the tenth information is used to indicate the RCAC.

31. The method according to claim 30, wherein The tenth information includes RCAC information, and the method further includes: The second device signs the RCAC using a third private key to obtain the RCAC information.

32. The method according to claim 30 or 31, characterized in that The method further comprises: The second device receives fifth information sent by the first device, where the fifth information is used to request a weaving network identifier of the second device; If the second device has configured a weaving network, the second device sends sixth information to the first device, where the sixth information is used to indicate the weaving network identifier.

33. The method according to claim 32, characterized in that The sixth information includes identification information, and the method further includes: The second device signs the weaving network identifier using the first private key to obtain the identifier information.

34. The method according to claim 30 or 31, characterized in that The method further comprises: The second device receives seventh information sent by the first device, where the seventh information is used to request the first attribute value of the second device; The second device sends eighth information to the first device, where the eighth information is used to indicate the first attribute value.

35. The method according to claim 34, wherein The eighth information includes attribute information, and the method further includes: The second device signs the first attribute value using a second private key to obtain the attribute information.

36. An apparatus for configuring a device, characterized in that: include: The verification unit is used to verify the root certification center certificate RCAC of the second device through a certificate center, and the certificate center can determine the legitimacy of the RCAC.

37. The device according to claim 36, characterized in that The apparatus further includes a determining unit configured to determine whether the current configuration is a secondary network distribution; wherein the verifying unit is specifically configured to verify the RCAC of the second device through the certificate center when the current configuration is a secondary network distribution.

38. The device according to claim 36 or 37, characterized in that The verification unit is specifically configured to verify the RCAC of the second device through the RCAC stored in the certificate center.

39. The device according to claim 38, characterized in that The verification unit is specifically used to: search for the RCAC in the certificate center; if the certificate center does not include the RCAC, determine that the second device is bound to an illegal ecological platform.

40. The device according to claim 39, characterized in that The verification unit is further configured to: if the certificate center does not include the RCAC, output first information, wherein the first information is used to inquire the user whether to continue to configure the second device; the apparatus further includes a triggering unit, which is configured to: if the user instructs to continue to configure the second device, Triggering a configuration process of the second device.

41. The device according to claim 39 or 40, characterized in that The apparatus further includes a triggering unit configured to trigger a configuration process of the second device if the certificate center includes the RCAC.

42. The device according to claim 39 or 40, characterized in that The verification unit is further configured to: if the certificate center includes the RCAC, verify the RCAC of the second device through the manufacturer identifier corresponding to the RCAC in the certificate center.

43. The device according to claim 42, characterized in that The verification unit is specifically used to: search for the manufacturer identifier of the RCAC in the certificate center; if the certificate center includes the RCAC, and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC in the certificate center, it is determined that the second device is bound to an illegal ecological platform.

44. The device according to claim 43, characterized in that The device further comprises an output unit, configured to: If the certificate center includes the RCAC and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC in the certificate center, a second information is output, and the second information is used to ask the user whether to continue configuring the second device; the device also includes a triggering unit, which is used to: trigger the configuration process of the second device when the user instructs to continue configuring the second device.

45. The device according to claim 43 or 44, characterized in that The apparatus further includes a triggering unit configured to trigger a configuration process of the second device if the certificate center includes the RCAC and the manufacturer identifier of the second device is consistent with the manufacturer identifier corresponding to the RCAC.

46. ​​The device according to claim 36 or 37, characterized in that The verification unit is specifically configured to verify the RCAC of the second device through the identifier of the RCAC stored in the certificate center.

47. The device according to claim 46, characterized in that The verification unit is specifically used to: search for the identifier of the RCAC in the certificate center; if the certificate center does not include the identifier of the RCAC, determine that the second device is bound to an illegal ecological platform.

48. The device according to claim 47, characterized in that The device also includes an output unit, which is used to: output third information if the certificate center does not include the RCAC identifier, and the third information is used to ask the user whether to continue configuring the second device; the device also includes a triggering unit, which is used to: trigger the configuration process of the second device when the user instructs to continue configuring the second device.

49. The device according to claim 47 or 48, characterized in that The apparatus further includes a triggering unit configured to trigger a configuration process of the second device if the certificate center includes an identifier of the RCAC.

50. The device according to claim 47 or 48, characterized in that The verification unit is further configured to: if the certificate center includes the identifier of the RCAC, verify the RCAC of the second device through the manufacturer identifier corresponding to the identifier of the RCAC in the certificate center.

51. The device according to claim 50, characterized in that The verification unit is specifically used to: search for the manufacturer identifier corresponding to the RCAC identifier in the certificate center; if the certificate center includes the RCAC identifier, and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the RCAC identifier, it is determined that the second device is bound to an illegal ecological platform.

52. The device according to claim 51, characterized in that The device also includes an output unit, which is used to: if the certificate center includes the identifier of the RCAC and the manufacturer identifier of the second device is inconsistent with the manufacturer identifier corresponding to the identifier of the RCAC, then output fourth information, and the fourth information is used to ask the user whether to continue configuring the second device; the device also includes a triggering unit, which is used to: trigger the configuration process of the second device when the user instructs to continue configuring the second device.

53. The device according to claim 51 or 52, characterized in that The apparatus further includes a triggering unit configured to trigger a configuration process of the second device if the certificate center includes the identifier of the RCAC and the manufacturer identifier of the second device is consistent with the manufacturer identifier corresponding to the identifier of the RCAC.

54. The device according to any one of claims 47 to 53, characterized in that The certificate center includes a first grammar, and the first grammar includes a field for recording the identifier of the RCAC; the verification unit is specifically used to: search for the identifier of the RCAC in the first grammar.

55. The device according to any one of claims 50 to 54, characterized in that The certificate center includes a second grammar, which includes a field for recording the RCAC identifier and a field for recording the manufacturer identifier; the verification unit is specifically used to: search the second grammar for the manufacturer identifier corresponding to the RCAC.

56. The device according to any one of claims 46 to 55, characterized in that The identification of the RCAC includes at least one of the following: the subject of the RCAC, the public key of the RCAC, and the subject key identification of the RCAC.

57. The device according to claim 37, characterized in that The device also includes a sending unit, which is used to: send fifth information to the second device, where the fifth information is used to request a weaving network identifier of the second device; the determining unit is specifically used to: if the device receives sixth information sent by the second device, determine that the current configuration is a secondary network distribution; if the device does not receive the sixth information sent by the second device, determine that the current configuration is a primary network distribution; wherein the sixth information is used to indicate the weaving network identifier.

58. The device according to claim 57, characterized in that The sixth information includes identification information, which is obtained by signing with a first private key. The verification unit is further used to: verify the identification information using a first public key to obtain the weaving network identification in the identification information, and the first public key corresponds to the first private key.

59. The device according to claim 37, characterized in that The apparatus further includes a sending unit and a receiving unit, wherein the sending unit is configured to send seventh information to the second device, wherein the seventh information is used to request a first attribute value of the second device; the receiving unit is configured to receive eighth information sent by the second device, wherein the eighth information is used to indicate the first attribute value; and the determining unit is specifically configured to determine that the current configuration is a secondary network configuration if the first attribute value is a non-zero value; and determine that the current configuration is a primary network configuration if the first attribute value is zero.

60. The device according to claim 59, characterized in that The eighth information includes attribute information, which is obtained by signing with a second private key. The verification unit is also used to: verify the attribute information using a second public key to obtain the first attribute value in the attribute information, and the second public key corresponds to the second private key.

61. The device according to any one of claims 36 to 60, characterized in that The apparatus further includes a sending unit and a receiving unit, wherein the sending unit is configured to send ninth information to the second device, wherein the ninth information is used to request RCAC of the second device; and the receiving unit is configured to receive tenth information sent by the second device, wherein the tenth information is used to indicate the RCAC.

62. The device according to claim 61, characterized in that The tenth information includes RCAC information, which is obtained by signing with a third private key. The verification unit is also used to: verify the RCAC information using a third public key to determine that the RCAC information includes the RCAC, and the third public key corresponds to the third private key.

63. The device according to any one of claims 39 to 45, characterized in that The certificate center includes a third grammar, which includes a manufacturer grammar and / or a grammar constructed for recording RCAC, and the third grammar includes a field for recording RCAC; the verification unit is specifically used to: search for the RCAC in the third grammar.

64. The device according to any one of claims 43 to 45, characterized in that The certificate center includes a fourth grammar, which includes a manufacturer grammar and / or a grammar constructed for recording RCAC, and the fourth grammar includes a field for recording RCAC and a field for recording the manufacturer identifier; the verification unit is specifically used to: search for the manufacturer identifier corresponding to the RCAC in the fourth grammar.

65. An apparatus for configuring a device, characterized in that: include: a receiving unit, configured to receive ninth information sent by the first device, wherein the ninth information is used to request a root certification center certificate RCAC of the apparatus; A sending unit is used to send tenth information to the first device, where the tenth information is used to indicate the RCAC.

66. The device according to claim 65, characterized in that The tenth information includes RCAC information, and the device further includes a signing unit, which is used to: use a third private key to sign the RCAC to obtain the RCAC information.

67. The device according to claim 65 or 66, characterized in that The receiving unit is further configured to receive fifth information sent by the first device, the fifth information being used to request a weaving network identifier of the apparatus; and the sending unit is further configured to send sixth information to the first device if the apparatus has been configured with a weaving network, the sixth information being used to indicate the weaving network identifier.

68. The device according to claim 67, characterized in that The sixth information includes identification information, and the device further includes a signing unit configured to: use a first private key to sign the braided network identifier to obtain the identification information.

69. The device according to claim 65 or 66, characterized in that The receiving unit is further configured to receive seventh information sent by the first device, the seventh information being used to request a first attribute value of the apparatus; and the sending unit is further configured to send eighth information to the first device, the eighth information being used to indicate the first attribute value.

70. The device according to claim 69, characterized in that The eighth information includes attribute information, and the device further includes a signing unit, which is used to: use a second private key to sign the first attribute value to obtain the attribute information.

71. An apparatus for configuring a device, characterized in that: The system comprises a memory and a processor, wherein the memory is used to store a program, and the processor is used to call the program in the memory to execute the method according to any one of claims 1 to 29.

72. An apparatus for configuring a device, characterized in that: The system comprises a memory and a processor, wherein the memory is used to store a program, and the processor is used to call the program in the memory to execute the method according to any one of claims 30 to 35.

73. An apparatus for configuring a device, characterized in that: The device comprises a processor configured to call a program from a memory to execute the method according to any one of claims 1 to 29.

74. An apparatus for configuring a device, characterized in that: The device comprises a processor configured to call a program from a memory to execute the method according to any one of claims 30 to 35.

75. A chip, characterized in that The device comprises a processor configured to call a program from a memory so that a device equipped with the chip executes the method according to any one of claims 1 to 29.

76. A chip, characterized in that The device comprises a processor configured to call a program from a memory so that a device equipped with the chip executes the method according to any one of claims 30 to 35.

77. A computer-readable storage medium, characterized in that A program is stored thereon, the program causing a computer to execute the method according to any one of claims 1 to 29.

78. A computer-readable storage medium, characterized in that A program is stored thereon, the program causing a computer to execute the method according to any one of claims 30 to 35.

79. A computer program product, characterized in that The method comprises a program for causing a computer to execute the method according to any one of claims 1 to 29.

80. A computer program product, characterized in that A program is included, the program causing a computer to execute the method according to any one of claims 30 to 35.

81. A computer program, characterized in that The computer program causes a computer to execute the method according to any one of claims 1 to 29.

82. A computer program, characterized in that The computer program causes a computer to execute the method according to any one of claims 30 to 35.

Images