Binding method, system and device and storage medium

Abstract

The invention provides a binding method, system and device and a storage medium, and the binding method is applied to a device end, and comprises the steps: broadcasting the attribute information of the device end; the discovery request is monitored so as to respond to the discovery request, address information of the device side is sent, the discovery request is generated and sent by the application program of the user side responding to the attribute information, and the device side and the user side are located in the same local area network; binding information is obtained, and the binding information is generated and sent by the application program response address information of the user side; transmitting the address information and the binding information to a cloud server side, so that the cloud server side verifies whether the equipment side can be bound by the application program or not; after a verification result returned by the cloud server side is received, if the verification result represents that the device side can be bound by the application program, authentication information is generated and sent to the application program to complete binding between the application program and the device side, and the authentication information is used for achieving interaction between the application program and the device side.

Description

Technical Field

[0001] The present disclosure relates to the technical field of device binding, and in particular to a binding method, system, device and storage medium. Background Art

[0002] With the popularization of IoT devices, users have higher and higher requirements for the intelligent application of IoT devices. At present, IoT devices can be bound through applications so that users can control and manage IoT devices through applications.

[0003] Currently, the binding between applications and IoT devices is achieved through technical means such as Bluetooth and Wi-Fi. However, during the binding process, users are required to perform multiple manual operations, such as starting the Bluetooth scanning function of the electronic device to which the application belongs, manually entering the configuration information of the bound device, etc. The operation is cumbersome and it is easy for manual configuration errors to result in a situation where binding cannot be performed. Moreover, during the binding process through technical means such as Bluetooth and Wi-Fi, it is easy to be attacked by man-in-the-middle and replay attacks, resulting in low security between the electronic device to which the application belongs and the IoT device.

[0004] Therefore, there is an urgent need for a method for binding an application program of an electronic device with an IoT device. Summary of the invention

[0005] In view of this, the purpose of the embodiments of the present disclosure is to provide a binding method, system, device and storage medium for solving the problems of cumbersome operation and low security when binding the application of electronic devices with IoT devices.

[0006] On the one hand, an embodiment of the present disclosure provides a binding method, which is applied to a device, and includes:

[0007] Broadcasting attribute information of the device end;

[0008] Listening to a discovery request, responding to the discovery request, and sending the address information of the device end, wherein the discovery request is generated and sent by the application of the user end in response to the attribute information, and the device end and the user end are located in the same local area network;

[0009] Obtaining binding information, wherein the binding information is generated and sent by the application program at the user end in response to the address information;

[0010] Transmitting the address information and the binding information to a cloud service end so that the cloud service end verifies whether the device end can be bound by the application;

[0011] After receiving the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound by the application end, authentication information is generated and sent to the application end to complete the binding between the application end and the device end, wherein the authentication information is used to realize the interaction between the application end and the device end.

[0012] In a possible implementation manner, after transmitting the address information and the binding information to the cloud service end, the method includes:

[0013] Receiving an encrypted ciphertext transmitted by the cloud server, wherein the encrypted ciphertext is generated by the cloud server based on the address information;

[0014] Decrypting the encrypted ciphertext to obtain the information to be verified;

[0015] The information to be verified is returned to the cloud service end so that the cloud service end verifies the information to be verified.

[0016] In a possible implementation, generating authentication information and sending it to the application includes:

[0017] Generate a first credential based on the port information included in the attribute information, and send the first credential to the application, wherein the first credential is used to call the port on the device end;

[0018] Based on the user identity information of the user end, a second credential is generated and sent to the application, wherein the second credential is used by the device end to verify the user identity information, and the user identity information is obtained by the cloud service end from the binding information and returned to the device end.

[0019] In a possible implementation manner, while receiving the verification result returned by the cloud service end, the method further includes:

[0020] Receiving a third credential returned by the cloud server, wherein the third credential indicates that the device has permission to access the cloud server;

[0021] In the case where the third credential is invalid, retransmitting the address information and the binding information to the cloud server so that the cloud server regenerates the third credential;

[0022] Receive and store the third credential regenerated by the cloud service end.

[0023] On the other hand, the embodiment of the present disclosure proposes another binding method, which is applied to the cloud service end, including:

[0024] Receiving address information of the device and binding information from the device, wherein the binding information is generated by an application program of a user;

[0025] Based on the address information, verify the device end, and based on the binding information, verify the user end;

[0026] If both the device end and the user end pass the verification, generating a verification result;

[0027] The verification result is returned to the device side, so that the device side can complete the binding with the application program of the user side based on the verification result.

[0028] In a possible implementation, verifying the device end based on the address information includes:

[0029] Extracting the device ID from the address information;

[0030] Find the corresponding device public key based on the device ID;

[0031] Based on the IP address in the address information, transmitting the encrypted ciphertext generated based on the device public key to the device end;

[0032] Receiving information to be verified returned by the device, where the information to be verified is obtained by the device decrypting the encrypted ciphertext;

[0033] Verify the information to be verified to determine whether the device has passed the verification.

[0034] In a possible implementation manner, after extracting the device ID in the address information, the method further includes:

[0035] Based on the device ID, query the binding status of the device end;

[0036] When the binding state of the device is bound, generating prompt information, and transmitting the prompt information to the user terminal;

[0037] When the binding state of the device end is unbound, the encrypted ciphertext is generated based on the device public key.

[0038] In a possible implementation manner, when both the device end and the user end pass the verification, the method further includes:

[0039] Update the binding status of the device.

[0040] In a possible implementation, verifying the user terminal based on the binding information includes:

[0041] Extracting a fourth credential included in the binding information, wherein the fourth credential is generated by the cloud service end and sent to the user end when logging into the application;

[0042] The fourth credential is parsed to determine whether the user identity information included in the binding information is verified.

[0043] In a possible implementation manner, when both the device end and the user end pass the verification, the method further includes:

[0044] Generate a third credential based on the device ID included in the address information, wherein the third credential indicates that the device has the authority to access the cloud service end;

[0045] Based on the IP address in the address information, the third credential is sent to the device end.

[0046] In a possible implementation manner, when both the device end and the user end pass the verification, the method further includes:

[0047] The user identity information is returned to the device end so that the device end generates authentication information, wherein the authentication information is used to implement interaction between the application and the device end.

[0048] On the other hand, the embodiment of the present disclosure provides a binding system, including a user end and a device end, and a cloud service end located in the same local area network;

[0049] The device end broadcasts the attribute information of the device end;

[0050] The user terminal responds to the attribute information through an application program to generate a discovery request;

[0051] After monitoring the discovery request, the device responds to the discovery request and sends the address information of the device to the user end;

[0052] The user terminal generates binding information in response to the address information through an application, and sends the binding information to the device terminal;

[0053] The device transmits the address information and the binding information to the cloud service end;

[0054] The cloud service end verifies the device end based on the address information, and verifies the user end based on the binding information, obtains a verification result, and returns the verification result to the device end;

[0055] After the device receives the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound to the application, authentication information is generated and sent to the application to complete the binding between the application and the device end; wherein the authentication information is used to realize the interaction between the application and the device end.

[0056] On the other hand, an embodiment of the present disclosure provides a computer program product storing a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0057] On the other hand, an embodiment of the present disclosure provides a storage medium, wherein the storage medium carries one or more computer programs, and the one or more computer programs implement the steps of the above method when executed by a processor.

[0058] In the disclosed embodiment, the device side can automatically broadcast the attribute information of the device side, so that the application on the user side responds to the attribute information and returns a discovery request; thereafter, the device side automatically responds to the discovery request and sends the address information of the device side, so that the application on the user side responds to the address information and sends binding information to start the binding between the application on the user side and the device, without requiring excessive user operations, with a high degree of automation and improved convenience. In addition, the disclosed embodiment receives and verifies the address information and binding information transmitted by the device side through the cloud service side to perform security verification with the user side and the device side. Through a more sound and flexible binding mechanism, the security of the user side, the device side, and the binding process between the user side and the device side is effectively improved, and it is also convenient for the subsequent user side to centrally manage and remotely maintain the device side through the cloud service side, which helps to improve management efficiency.

[0059] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the present disclosure or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0061] Figure 1 A flowchart of a binding method provided by the present disclosure is shown;

[0062] Figure 2 A flowchart showing another binding method provided by the present disclosure is shown;

[0063] Figure 3 A flowchart showing another binding method provided by the present disclosure is shown;

[0064] Figure 4 A flowchart showing another binding method provided by the present disclosure is shown;

[0065] Figure 5 A flowchart showing a method for binding provided by the present disclosure in which a cloud service end verifies a device end based on address information is shown;

[0066] Figure 6 A flowchart showing a method for binding provided by the present disclosure in which a cloud service end verifies a user end based on binding information;

[0067] Figure 7 A flowchart showing binding by the binding system provided by the present disclosure is shown;

[0068] Figure 8 A schematic diagram of the structure of a computer device provided by the present disclosure is shown. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the present disclosure clearer, the technical solution of the present disclosure will be clearly and completely described below in conjunction with the drawings of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the described embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0070] Unless otherwise defined, the technical terms or scientific terms used in the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0071] In order to keep the following description of the present disclosure clear and concise, the present disclosure omits detailed descriptions of well-known functions and well-known components.

[0072] The binding method provided by the present disclosure can be applied to a variety of scenarios. For example, in a smart home scenario, a user terminal (including but not limited to a user's mobile phone, tablet computer or laptop computer) binds a device terminal (including but not limited to speakers, refrigerators, air conditioners, etc.) through a specific application program to control and manage speakers, refrigerators, air conditioners, etc.; in another example, in a conference scenario, a user terminal (including but not limited to a user's mobile phone, tablet computer or laptop computer) binds a device terminal (including but not limited to a projector, printer, etc.) through a certain application program to control a projector to display conference content and a printer to print conference materials, etc. That is, the binding method disclosed in the present disclosure can be applied to the binding between a user terminal and a device terminal, and does not require excessive user operations, has a high degree of automation, and can also improve the security of the user terminal, the device terminal, and the binding process between the user terminal and the device terminal.

[0073] On the one hand, the embodiment of the present disclosure provides a binding method. As an example, Figure 1 A flowchart of a binding method provided by an embodiment of the present disclosure is shown, and the binding method is applied to a device side. Figure 1 The specific steps of the binding method shown may include S101-S105.

[0074] S101, broadcasting device attribute information.

[0075] As an example, after the device is connected to a local area network, it automatically broadcasts the attribute information of the device, which may include the device name, service type, service domain, and service port of the device, and the device name, service type, and service port are all set before leaving the factory.

[0076] Optionally, the disclosed embodiment sets the local area network to follow the Multicast Domain Name System (MDNS), so that devices in the local area network can discover and access each other through device names. Based on the MDNS protocol, after the device end accesses the local area network, the device end's attribute information is broadcast.

[0077] As another example, the embodiments of the present disclosure may also perform pre-settings for the device end. For example, after the device end is connected to any local area network, it is set to broadcast the attribute information of the device end so that other devices in the local area network can obtain the attribute information of the device end.

[0078] S102, listening to a discovery request, responding to the discovery request, and sending the address information of the device side, wherein the discovery request is generated and sent by an application program of the user side in response to attribute information, and the device side and the user side are located in the same local area network.

[0079] Optionally, after broadcasting the attribute information, the device side monitors the information sent by other devices in real time to monitor the discovery request. The discovery request is generated and sent by the user-side application in response to the attribute information. For example, based on the MDNS protocol, the user-side application scans the information broadcast in the local area network in real time or periodically. After scanning the attribute information broadcast by the device side, it responds to the attribute information to generate a discovery request and sends the discovery request. Here, since the attribute information does not contain the address information of the device side, the user side can also send the discovery request in the form of a broadcast. It should be noted that the scanning of the information broadcast in the local area network by the user-side application and the broadcasting of the device-side attribute information by the device side can be performed simultaneously, and there is no set order for the two steps.

[0080] Here, the device end and the user end are located in the same local area network, so that the user end can scan the attribute information of the device end and the device end can monitor the discovery request of the user end.

[0081] After listening to the discovery request, the device responds to the discovery request and sends the address information of the device to the user. Optionally, the application of the user can send the discovery request in the form of broadcast, and send the network address of the user at the same time as sending the discovery request, so that the device can respond to the discovery request of the user based on the network address. The network address can include a physical address (such as a MAC address) and / or a logical address (such as an IP address).

[0082] The address information includes the device ID and IP address of the device.

[0083] S103, obtaining binding information, wherein the binding information is generated and sent by an application program at the user end in response to the address information.

[0084] In one example, after the device sends the address information of the device to the user, the application of the user receives and responds to the address information, that is, generates a binding information, and returns the binding information to the device according to the IP address in the address information. The binding information includes the user identity information corresponding to the application of the user and the binding request, and the binding request is that the application wants to bind the device. Of course, the binding information can also include other information of the application of the user, such as the identification information of the application, the user port corresponding to the application, and the credentials for verifying the user identity information.

[0085] After sending the address information to the user end, the device end monitors in real time whether the binding information returned by the application program on the user end is received, so as to obtain the binding information in time.

[0086] Optionally, there is a scenario where multiple devices and users join the same local area network at the same time, that is, the user can scan the attribute information broadcast by each device and generate a corresponding discovery request for each attribute information. In order to ensure that the device bound to the user's application is the device that the user wants to bind, the application receives the address information sent by the device in response to the discovery request in real time after sending all discovery requests, and determines the number of received address information. If multiple address information is received, a device list is generated and displayed, and the user is prompted to determine the device he wants to bind based on the device list. The device list may include device name, service type, and device ID, etc.

[0087] After the user determines the device to be bound based on the device list, the application generates binding information based on the device and returns the binding information to the device according to the IP address in the address information of the device.

[0088] For example, multiple users' Bluetooth headsets are connected to the same local area network at the same time, and multiple Bluetooth headsets broadcast attribute information respectively, and the attribute information at least includes the name, service type, service domain and service port of the Bluetooth headset. After scanning the attribute information of multiple Bluetooth headsets, user A's mobile phone generates a discovery request for each attribute information so that each Bluetooth headset can receive the discovery request. Afterwards, each Bluetooth headset responds to the monitored discovery request and sends address information, and the address information at least includes the ID and IP address of the Bluetooth headset. User A's mobile phone receives the address information sent by the Bluetooth headset through the application. When the received address information is multiple, a Bluetooth headset list is generated and displayed through user A's mobile phone. User A determines his own Bluetooth headset based on the Bluetooth headset list, and then the application generates binding information based on the Bluetooth headset determined by the user, and returns the binding information to the Bluetooth headset determined by the user according to the IP address corresponding to the Bluetooth headset determined by the user.

[0089] S104, transmitting the address information and the binding information to the cloud server, so that the cloud server verifies whether the device can be bound to the application.

[0090] The cloud server and the device are connected via a network, and of course, the cloud server and the user are also connected via a network. Based on this, after receiving the binding information, the device transmits the address information and the binding information to the cloud server, so that the cloud server verifies whether the device can be bound by the application.

[0091] Optionally, after receiving the address information and binding information transmitted by the device, the cloud service end verifies the application and the device end based on the address information and the binding information respectively, obtains corresponding verification results, and then returns the verification results to the device end.

[0092] The verification results include whether the application and / or the device have passed the verification or whether both the application and the device have failed the verification. If the verification result is that both the application and the device have passed the verification, it means that the device can be bound to the application. If the application or the device has passed the verification or both the application and the device have failed the verification, it means that the device cannot be bound to the application.

[0093] S105, after receiving the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound by the application end, authentication information is generated and sent to the application end to complete the binding between the application end and the device end, wherein the authentication information is used to realize the interaction between the application end and the device end.

[0094] Optionally, after receiving the verification result returned by the cloud service end, if the device end determines that the verification result indicates that the device end can be bound by the application, it generates authentication information and sends it to the application end. The authentication information is used to implement the interaction between the application end and the device end, for example, to implement the application end to call the port of the device end, to implement the device end to authenticate the user identity information corresponding to the application end, to determine whether the application has access rights, etc.

[0095] After the authentication information is generated on the device and sent to the application, the binding between the application and the device is completed. That is, the user can access, control and manage the device through the application.

[0096] Accordingly, after receiving the authentication information, the user-side application ensures that the binding with the device is completed. At this time, a binding result is generated and displayed on the user-side display screen to prompt the user that the application and the device have been bound through the displayed binding result.

[0097] In the above binding method disclosed in the embodiment of the present disclosure, there is no need for the user to perform too many operations manually. When the device side and the user side are in the same local area network, the automatic binding between the application on the user side and the device side can be achieved according to the above steps. The automation level is high, which greatly improves the user experience. At the same time, it also avoids the problem of misoperation resulting in the inability to complete the binding due to excessive manual operations by the user. In addition, in the process of binding between the application on the user side and the device side, the cloud service side performs security verification on the application on the user side and the device side, which not only improves the security of the user side, the device side, and the binding process between the user side and the device side, but also facilitates the cloud service side to centrally manage and subsequently maintain the user side and the device side, thereby improving management efficiency and maintenance efficiency.

[0098] In another example, after transmitting the address information and binding information to the cloud service end, the device end can execute Figure 2 The steps in the flowchart of another binding method are shown to complete the verification of the device by the cloud service end. Figure 2 It can be seen that the specific steps include S201-S203.

[0099] S201, receiving encrypted ciphertext transmitted by a cloud server, wherein the encrypted ciphertext is generated by the cloud server based on address information.

[0100] S202, decrypt the encrypted ciphertext to obtain the information to be verified.

[0101] S203, returning the information to be verified to the cloud server, so that the cloud server verifies the information to be verified.

[0102] In another example, after the device transmits the address information and binding information to the cloud server, the cloud server verifies the user based on the binding information, specifically verifying whether the user identity information corresponding to the application has the authority to bind to the device; at the same time, the server also verifies the device based on the address information to verify whether the device has the authority to bind to the user's application.

[0103] Optionally, for the device side, the server generates a corresponding encrypted ciphertext based on the address information of the device side, and transmits the encrypted ciphertext to the device side based on the IP address in the address information. Here, the encrypted ciphertext can be generated based on one or more of a public-private key pair, a random number, and a timestamp.

[0104] After receiving the encrypted ciphertext transmitted by the cloud server, the device decrypts the encrypted ciphertext to obtain the information to be verified, and then returns the information to be verified to the cloud server so that the cloud server can verify the information to be verified. Among them, the device and the cloud server store a shared key for generating and parsing encrypted ciphertext. Verifying the device through the cloud server effectively avoids the attacker's malicious forging of devices that can be bound to the user's application, such as virtual devices, and thus avoids the problem of data leakage on the user side due to the application binding to malicious forged devices, which ensures the security of the user's data.

[0105] As one example, after determining that the verification result indicates that the device can be bound to the application, the device generates a first credential based on the port information included in the attribute information, wherein the first credential is used to call the port of the device, and the port information may include one or more of the port number, port type, the protocol followed by the port, and the purpose of the port.

[0106] Furthermore, after generating the first credential, the device sends the first credential to the application so that the application can call the port corresponding to the port information based on the first credential to achieve access, control and management of the device. For example, the first credential is a token, that is, the device generates a token based on the port information according to the encryption mechanism, and sends the token to the application of the user. After that, when the user communicates with the device based on the application, the application sends the communication information (such as access request, control instruction, etc.) and the token to the device at the same time to call the port of the device to achieve communication with the device. Correspondingly, after receiving the token, the device determines that the program has the authority to call the port, and then receives the communication information sent by the application through the port. Optionally, the encryption mechanism can be set to any one of symmetric encryption, asymmetric encryption, key exchange, message digest, electronic signature, certificate and PKI.

[0107] In another example, after determining that the verification result indicates that the device can be bound to the application, the device generates a second credential based on the user identity information of the user, and sends the second credential to the application. At the same time, the user identity information is associated with the second credential corresponding to it. Here, the second credential can also be a Token generated based on the user identity information of the user, or a JSON WebToken (JWT) generated based on the user identity information of the user. Compared with Token, JWT has higher security, but the embodiments of the present disclosure do not specifically limit this, as long as the device can verify the user identity information through the second credential. Among them, the user identity information is obtained by the cloud service end from the binding information and returned to the device end.

[0108] Taking the second credential as JWT as an example, after receiving the user identity information returned by the cloud service end, the device end generates a JWT based on the user identity information using a public key, and stores the private key used to verify the JWT, associates the private key with the user identity information corresponding to the JWT, and transmits the JWT to the application on the user end. Later, when the user communicates with the device end based on the application, the application sends the communication information, the token used to call the port on the device end, and the JWT to the device end at the same time. Accordingly, after receiving the token, the device end determines that the program has the authority to call the port, and then receives the communication information and JWT sent by the application through the port, and verifies the JWT, specifically by finding the private key associated with the user identity information corresponding to the application, and using the private key to verify the JWT. If the verification is successful, it responds to the communication information, thereby achieving communication with the user end.

[0109] In another example, upon receiving the verification result returned by the cloud service end, the device end may execute Figure 3 The steps in the flowchart of another binding method are shown to ensure that the device has the right to access the cloud service. Figure 3 It can be seen that the specific steps include S301-S303.

[0110] S301, receiving a third credential returned by the cloud server, wherein the third credential indicates that the device has permission to access the cloud server.

[0111] S302, when the third credential is invalid, retransmit the address information and the binding information to the cloud server so that the cloud server regenerates the third credential.

[0112] S303, receiving and storing the third credential regenerated by the cloud server.

[0113] Optionally, after the cloud service verifies that the device can be bound by the application, a third credential is generated for the device and returned to the device, the third credential indicating that the device has the authority to access the cloud service. The third credential may be a Token or JWT, etc.

[0114] When receiving the verification result returned by the cloud server, the third credential returned by the cloud server is received. The cloud server may send the third credential after sending the verification result, or may send the verification result and the third credential at the same time, which is not specifically limited in the embodiments of the present disclosure.

[0115] After receiving the third credential, the device can apply to the cloud service end for access to the data, files, etc. that it wants to access based on the third credential.

[0116] In order to ensure the security of data, files, etc. on the cloud server, the third credential can be set with a validity period. For example, the third credential can include information such as a timestamp. This will prevent devices that no longer have access rights from accessing the cloud server when the third credential becomes invalid, thereby improving the security of data, files, etc. on the cloud server to a certain extent.

[0117] On the other hand, the embodiment of the present disclosure provides another binding method. As an example, Figure 4 A flowchart of another binding method provided by an embodiment of the present disclosure is shown, and the binding method is applied to a cloud service end. Figure 4 The specific steps of the binding method shown may include S401-S404.

[0118] S401, receiving address information of a device and binding information from a device, wherein the binding information is generated by an application program of a user terminal.

[0119] Optionally, the cloud service end receives various information from the device end and the user end in real time, such as requests, binding information, query instructions, address information, etc.

[0120] As one example, after receiving the binding information sent by the application on the user side, the device side receives the address information of the device side and the binding information from the device side, that is, the binding information is generated by an application on the user side and is generated by the user side after obtaining the address information of the device side, wherein the user side and the device side are located in the same local area network.

[0121] S402, verifying the device end based on the address information, and verifying the user end based on the binding information.

[0122] As an example, after receiving the address information and binding information, the cloud service verifies the device based on the address information to prevent attackers from maliciously forging devices that can be bound to the user's application, thereby avoiding data leakage on the user side and ensuring the security of the user's data.

[0123] In addition, after receiving the address information and binding information, the cloud server also verifies the user based on the binding information to verify whether the user's application has the authority to bind to the device, preventing attackers from maliciously binding the device and causing device information leakage, thereby ensuring the security of the device data.

[0124] S403: When both the device end and the user end pass the verification, a verification result is generated.

[0125] In one example, after the cloud service end verifies the device end and the user end respectively, if both the device end and the user end pass the verification, a verification result is generated. Of course, a verification result can also be generated when the device end or the user end passes the verification or when both the device end and the user end fail the verification. This embodiment of the disclosure does not specifically limit this.

[0126] S404, returning the verification result to the device side, so that the device side can complete the binding with the application program of the user side based on the verification result.

[0127] After generating the verification result, the cloud service returns the verification result to the device, so that the device can complete the binding with the application on the user side based on the verification result. As one example, after receiving the verification result indicating that the device can be bound by the application, the device generates authentication information and sends it to the application to complete the binding between the application and the device.

[0128] In the process of binding between the application on the user side and the device side, the disclosed embodiment performs security verification on the application on the user side and the device side through the cloud service side, which not only improves the security of the user side, the device side and the binding process between the user side and the device side, but also facilitates the cloud service side to perform centralized management and subsequent maintenance of the user side and the device side, thereby improving management efficiency and maintenance efficiency.

[0129] As one example, Figure 5 A flow chart showing the cloud service end verifying the device end based on the address information is shown, wherein the specific steps may include S501-S505.

[0130] S501, extracting the device ID from the address information.

[0131] S502: Search for a corresponding device public key based on the device ID.

[0132] S503, based on the IP address in the address information, transmit the encrypted ciphertext generated based on the device public key to the device end.

[0133] S504, receiving the information to be verified returned by the device, where the information to be verified is obtained by decrypting the encrypted ciphertext by the device.

[0134] S505: Verify the information to be verified to determine whether the device has passed the verification.

[0135] As one example, after receiving the address information of the device, the cloud service extracts the device ID of the device from the address information. Here, the device ID is set before the device leaves the factory, and the device ID uniquely corresponds to one device.

[0136] After obtaining the device ID of the device, the corresponding device public key is searched based on the device ID, and the encrypted ciphertext is generated based on the device public key. For example, a random string is generated, and the random string is encrypted using the device public key to obtain the encrypted ciphertext. The device public key is generated by the cloud service end for the device before the device leaves the factory, and a device private key corresponding to the device public key is also generated.

[0137] Furthermore, the IP address in the address information is extracted, wherein the IP address is generated based on the IP protocol after the device end accesses the local area network, and the IP address also uniquely corresponds to one device end.

[0138] After the encrypted ciphertext is generated, the encrypted ciphertext is transmitted to the device end based on the IP address in the address information. Optionally, a timestamp can be attached when the encrypted ciphertext is transmitted to the device end to enhance the security of the encrypted ciphertext and avoid the problem of low security caused by malicious decryption of the encrypted ciphertext.

[0139] The device private key corresponding to the device public key is stored on the device side. After the device side receives the encrypted ciphertext transmitted by the cloud service side, it uses the device private key to decrypt the encrypted ciphertext to obtain the information to be verified, and returns the information to be verified to the cloud service side. Correspondingly, the information to be verified includes at least a random string. Of course, when a timestamp is received, the information to be verified also includes time information and / or the electronic signature of the device side, where the electronic signature of the device side is also stored on the cloud service side before the device side leaves the factory.

[0140] The cloud service end receives the information to be verified returned by the device end, and verifies the information to be verified to determine whether the device end has passed the verification. Optionally, in the case where the cloud service end does not send a timestamp to the device end, verify whether the random string included in the information to be verified is the same as the random string used to generate the encrypted ciphertext; in the case where the cloud service end sends a timestamp to the device end, in addition to verifying whether the random string included in the information to be verified is the same as the random string used to generate the encrypted ciphertext, it is also necessary to verify whether the electronic signature included in the information to be verified is the electronic signature corresponding to the device end, and verify whether the verification time information included in the information to be verified is consistent with the time information corresponding to the time stamp when the timestamp was generated.

[0141] Among them, when the cloud server does not send a timestamp to the device, if the random string included in the information to be verified is the same as the random string used to generate the encrypted ciphertext, it is determined that the device has passed the verification, that is, the device has the authority to bind to the user's application, and also determines that the device has the authority allowed by the cloud server to be accessed.

[0142] As another example, in order to ensure the security and uniqueness of the device, it can also be set that the device can only be bound to one application of the same type. Based on this, after extracting the device ID in the address information, the cloud service query the binding status of the device based on the device ID. Among them, the cloud service stores the binding status of each device and updates the binding status of each device in real time. The binding status includes bound and unbound. Optionally, the binding status can be represented by an identification code. For example, when the identification code is A, the binding status of the device is represented as bound; when the identification code is B, the binding status of the device is represented as unbound. It is worth noting that the use of identification codes to represent the binding status is only one example, and setting the identification code to English letters is also only an example. The embodiments of the present disclosure do not make specific limitations on this. Those skilled in the art should only know that the use of other forms to represent the binding status or the use of Arabic numerals, icons, etc. as identification codes all fall within the scope of protection of the present disclosure.

[0143] When the binding status of the device is queried and it is determined that the binding status of the device is bound, it indicates that the device cannot be bound by the application, and a prompt message is generated and transmitted to the user. The prompt message is used to prompt the user with the following information: the user's application fails to bind the device, and the reason for the failure is that the device is bound.

[0144] When the binding status of the device is queried and it is determined that the binding status of the device is unbound, an encrypted ciphertext is generated based on the device public key, and then the above steps of verifying the device are performed.

[0145] Here, based on the binding status of the device, it is determined whether the device cannot be bound by the application or whether the above-mentioned steps of verifying the device are performed. This can avoid the problem of low security on the device, low security on the user side, and low user experience caused by the same device being simultaneously bound to applications on different user sides. This effectively ensures the security of the device and user side as well as the user experience.

[0146] Furthermore, when both the device and the user have passed the verification, that is, the cloud service determines that the device can be bound to the application, and generates a verification result and returns it to the device so that the device responds to the verification result to complete the binding between the application and the device, the binding status of the device is updated based on the device ID of the device.

[0147] As one example, Figure 6 A flow chart showing the cloud service end verifying the user end based on the binding information is shown, wherein the specific steps may include S601-S602.

[0148] S601, extracting a fourth credential included in the binding information, wherein the fourth credential is generated by the cloud service end and sent to the user end when logging into the application.

[0149] S602: Parse the fourth credential to determine whether the user identity information included in the binding information passes verification.

[0150] As one example, after receiving the binding information, the cloud server extracts the fourth credential included in the binding information. Optionally, the fourth credential is generated by the cloud server and sent to the user when logging into the application. The fourth credential is used by the cloud server to verify the identity information corresponding to the application of the user.

[0151] Optionally, taking the fourth credential as JWT as an example, when the user logs in to the application for the first time through the user end, the cloud server generates a JWT based on the user identity information corresponding to the application, and stores the private key used to verify the JWT in association with the user identity information, and sends the JWT to the user end so that the user end stores the JWT. When the application on the user end interacts with the cloud server end (such as the user accesses the cloud server end through the application end or requests data from the cloud server end, etc.), the request and user identity information are sent to the cloud server end while also sending the JWT. After receiving the request, user identity information and JWT sent by the application on the user end, the cloud server end uses the user identity information to find the corresponding private key, and uses the private key to verify the JWT. If the JWT passes the verification, the cloud server end responds to the request.

[0152] In the disclosed embodiment, after the cloud service end extracts the fourth credential from the binding information, it searches for the corresponding private key based on the user identity information included in the binding information, and uses the private key to parse the extracted fourth credential. If the parsing is successful, it indicates that the user identity information included in the binding information has passed the verification. In this way, it can ensure to a certain extent that the user end is a secure end, thereby ensuring the security of the device end bound to the application on the user end.

[0153] In another example, when both the device and the user are verified, the cloud server can also generate a third credential based on the device ID included in the address information, wherein the third credential indicates that the device has the authority to access the cloud server, wherein the device can interact with the cloud server based on the third credential, such as accessing the cloud server or requesting data from the cloud server, etc. The third credential can be a Token or JWT, etc.

[0154] Afterwards, based on the IP address in the address information, the third credential is sent to the device side. Optionally, the cloud service side may send the third credential after sending the verification result, or may send the verification result and the third credential at the same time.

[0155] As another example, when both the device and the user are verified, the cloud service may also return the user identity information to the device so that the device generates authentication information, wherein the authentication information is used to implement interaction between the application and the device.

[0156] On the other hand, the embodiment of the present disclosure further provides a binding system. Since the principle of solving the problem by the binding system in the embodiment of the present disclosure is similar to the above-mentioned binding method of the present disclosure, the implementation of the binding system can refer to the implementation of the method, and the repeated parts will not be repeated.

[0157] Optionally, the binding system includes a user end and a device end, and a cloud service end located in the same local area network;

[0158] The device end broadcasts the attribute information of the device end;

[0159] The user terminal responds to the attribute information through an application program to generate a discovery request;

[0160] After monitoring the discovery request, the device responds to the discovery request and sends the address information of the device to the user end;

[0161] The user terminal generates binding information in response to the address information through an application, and sends the binding information to the device terminal;

[0162] The device transmits the address information and the binding information to the cloud service end;

[0163] The cloud service end verifies the device end based on the address information, and verifies the user end based on the binding information, obtains a verification result, and returns the verification result to the device end;

[0164] After the device receives the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound to the application, authentication information is generated and sent to the application to complete the binding between the application and the device end; wherein the authentication information is used to realize the interaction between the application and the device end.

[0165] As an example, Figure 7 FIG. 1 shows a flow chart of binding performed by a binding system provided by an embodiment of the present disclosure. Figure 7 , the specific binding process includes:

[0166] After the device is connected to a local area network, it automatically broadcasts the attribute information of the device.

[0167] The user end scans the information broadcasted in the local area network through the application according to the scanning cycle or in real time. After the user end scans the attribute information broadcasted by the device end through the application, it responds to the attribute information, generates and sends a discovery request, and sends the network address of the user end. It should be noted that after the user end accesses a local area network, its application can be started (such as background start) and starts to scan the information broadcasted in the local area network according to the scanning cycle or in real time. Figure 7 There is a sequence between the step of "automatically broadcasting the attribute information of the device side" on the device side and the step of "scanning the information broadcast in the local area network through the application according to the scanning cycle or in real time" on the user side, but in actual application, the order of the two steps is not limited.

[0168] After broadcasting the attribute information, the device starts its own monitoring function to monitor the information returned by other devices. After monitoring the discovery request, it responds to the discovery request and sends the address information of the device to the user, that is, the device ID and IP address of the device to the user.

[0169] After receiving the address information sent by the device through the application, the user side further determines the number of received address information. Here, Figure 7 The binding process shown in the figure is explained by taking the case where the user receives multiple address information as an example. That is to say, when the application on the user side determines that the received address information is multiple, it generates a device list and displays it, and prompts the user to determine the device to be bound based on the device list. After the user determines the device to be bound based on the device list, the application generates binding information in response to the address information of the device determined by the user, and returns the binding information to the device according to the IP address corresponding to the device.

[0170] After receiving the binding information returned by the user, the device transmits the address information and binding information to the cloud server.

[0171] After receiving the address information and binding information transmitted by the device, the cloud service verifies the device based on the address information and verifies the user based on the binding information, thereby obtaining the verification result. Figure 7 The step of "authenticating the device based on the address information" and the step of "authenticating the user based on the binding information" are expressed in sequence, but in actual applications, the two steps are not limited in sequence and can be performed simultaneously.

[0172] In an example, when the cloud service end verifies the device end based on the address information, it extracts the device ID in the address information, searches for the corresponding device public key based on the device ID, and determines the binding status of the device end based on the device ID. That is, if the binding status of the device end is bound, the cloud service end generates a prompt message "Failed to bind the device end, the reason for the failure is that the device end is bound" and sends it to the application on the user end. Of course, the content of the prompt message can be adjusted according to actual needs, and the embodiment of the present disclosure does not specifically limit this. If the binding status of the device end is unbound, the cloud service end generates an encrypted ciphertext based on the device public key corresponding to the device ID, and then transmits the encrypted ciphertext generated based on the device public key to the device end based on the IP address in the address information.

[0173] After the device receives the encrypted ciphertext transmitted by the cloud server, it uses the shared key to decrypt the encrypted ciphertext, obtains the information to be verified, and returns the information to be verified to the cloud server.

[0174] After the cloud service receives the information to be verified returned by the device, it verifies the information to be verified. If it fails to pass the verification, it generates a prompt message "Binding the device failed, the reason for the failure is that the device failed to pass the verification" and sends it to the application on the user side. Of course, the content of the prompt message can also be adjusted according to actual needs.

[0175] When the cloud server verifies the user based on the binding information, it extracts the first JWT included in the binding information, wherein the first JWT is generated by the cloud server and sent to the user when logging into the application, and the cloud server stores the private key corresponding to the first JWT. Afterwards, the first JWT is parsed using the private key to determine whether the user identity information included in the binding information has passed the verification. If the user identity information has not passed the verification, a prompt message "The binding device has failed, and the reason for the failure is that the user identity information has not passed the verification" is generated and sent to the application on the user side.

[0176] When both the user identity information and the device are verified, the cloud service generates a corresponding verification result, which indicates that the device can be bound to the application. Then, the verification result is returned to the device, and the user identity information is also returned to the device.

[0177] After receiving the verification result returned by the cloud service, the device generates a Token based on the port information included in the attribute information, and generates a second JWT based on the user identity information of the user, and sends the Token and the second JWT to the user application. The Token is used by the application to call the port of the device, and the second JWT is used by the device to verify the user identity information. Thus, the binding between the application and the device is completed, and then the application can interact with the device based on the Token and the second JWT.

[0178] When both the device and the user are verified, the cloud server generates a third JWT based on the device ID included in the address information, and sends the third JWT to the device based on the IP address in the address information. The third JWT indicates that the device has the authority to access the cloud server, so that the device can access the cloud server later.

[0179] In the disclosed embodiment, the device side can automatically broadcast the attribute information of the device side, so that the application on the user side responds to the attribute information and returns the discovery request; after that, the device side automatically responds to the discovery request and sends the address information of the device side, so that the application on the user side responds to the address information and sends the binding information to start the binding between the application on the user side and the device, without requiring too much operation by the user, and with a high degree of automation. In addition, the disclosed embodiment receives and verifies the address information and binding information transmitted by the device side through the cloud service side to perform security verification on the user side and the device side, effectively improving the security of the user side, the device side, and the binding process between the user side and the device side.

[0180] On the other hand, an embodiment of the present disclosure further provides a computer program product, which stores a computer program. When the computer program is executed by a processor, the method provided by any embodiment of the present disclosure is implemented, including the following steps S11 to S15 and S16 to S19:

[0181] S11, broadcasting attribute information of the device end;

[0182] S12, listening to a discovery request, and sending the address information of the device end in response to the discovery request, wherein the discovery request is generated and sent by the application of the user end in response to the attribute information, and the device end and the user end are located in the same local area network;

[0183] S13, obtaining binding information, wherein the binding information is generated and sent by the application program of the user terminal in response to the address information;

[0184] S14, transmitting the address information and the binding information to a cloud service end, so that the cloud service end verifies whether the device end can be bound by the application;

[0185] S15, after receiving the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound by the application end, authentication information is generated and sent to the application end to complete the binding between the application end and the device end, wherein the authentication information is used to realize the interaction between the application end and the device end.

[0186] S16, receiving address information of the device and binding information from the device, wherein the binding information is generated by an application program of a user terminal;

[0187] S17, verifying the device end based on the address information, and verifying the user end based on the binding information;

[0188] S18, generating a verification result when both the device end and the user end pass the verification;

[0189] S19, returning the verification result to the device side, so that the device side can complete the binding with the application program of the user side based on the verification result.

[0190] On the other hand, an embodiment of the present disclosure further provides a storage medium, which carries one or more computer programs. When the one or more computer programs are executed by a processor, the method provided in any embodiment of the present application is implemented, including the following steps S21 to S25 and S26 to S29:

[0191] S21, broadcasting attribute information of the device end;

[0192] S22, listening to a discovery request, and sending the address information of the device end in response to the discovery request, wherein the discovery request is generated and sent by the application of the user end in response to the attribute information, and the device end and the user end are located in the same local area network;

[0193] S23, obtaining binding information, wherein the binding information is generated and sent by the application program of the user terminal in response to the address information;

[0194] S24, transmitting the address information and the binding information to a cloud service end, so that the cloud service end verifies whether the device end can be bound to the application;

[0195] S25. After receiving the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound by the application end, authentication information is generated and sent to the application end to complete the binding between the application end and the device end, wherein the authentication information is used to realize the interaction between the application end and the device end.

[0196] S26, receiving address information of the device and binding information from the device, wherein the binding information is generated by an application program of a user terminal;

[0197] S27, verifying the device end based on the address information, and verifying the user end based on the binding information;

[0198] S28, generating a verification result when both the device end and the user end pass the verification;

[0199] S29, returning the verification result to the device side, so that the device side can complete the binding with the application program of the user side based on the verification result.

[0200] On the other hand, the embodiment of the present disclosure further provides a computer device, the structural diagram of which can be as follows: Figure 8 As shown, at least a memory 801 and a processor 802 are included, the memory 801 stores a computer program, and the processor 802 implements the method provided by any embodiment of the present invention when executing the computer program on the memory 801. Exemplarily, the computer program steps of the computer device are as follows S31 to S35 and S36 to S39:

[0201] S31, broadcasting the attribute information of the device end;

[0202] S32, listening to a discovery request, and sending the address information of the device end in response to the discovery request, wherein the discovery request is generated and sent by the application of the user end in response to the attribute information, and the device end and the user end are located in the same local area network;

[0203] S33, obtaining binding information, wherein the binding information is generated and sent by the application program of the user terminal in response to the address information;

[0204] S34, transmitting the address information and the binding information to a cloud service end, so that the cloud service end verifies whether the device end can be bound to the application;

[0205] S35, after receiving the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound by the application end, authentication information is generated and sent to the application end to complete the binding between the application end and the device end, wherein the authentication information is used to realize the interaction between the application end and the device end.

[0206] S36, receiving address information of the device and binding information from the device, wherein the binding information is generated by an application program of a user terminal;

[0207] S37, verifying the device end based on the address information, and verifying the user end based on the binding information;

[0208] S38, generating a verification result when both the device end and the user end pass the verification;

[0209] S39, returning the verification result to the device side, so that the device side can complete the binding with the application program of the user side based on the verification result.

[0210] In the disclosed embodiment, the device side can automatically broadcast the attribute information of the device side, so that the application on the user side responds to the attribute information and returns the discovery request; after that, the device side automatically responds to the discovery request and sends the address information of the device side, so that the application on the user side responds to the address information and sends the binding information to start the binding between the application on the user side and the device, without requiring too much operation by the user, and with a high degree of automation. In addition, the disclosed embodiment receives and verifies the address information and binding information transmitted by the device side through the cloud service side to perform security verification on the user side and the device side, effectively improving the security of the user side, the device side, and the binding process between the user side and the device side.

[0211] Optionally, in this embodiment, the above-mentioned storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk. Optionally, in this embodiment, the processor executes the method steps recorded in the above-mentioned embodiment according to the program code stored in the storage medium. Optionally, the specific examples in this embodiment can refer to the examples described in the above-mentioned embodiment and the optional implementation mode, and this embodiment will not be repeated here. Obviously, it should be understood by those skilled in the art that the above-mentioned modules or steps of the present disclosure can be implemented with a general computing device, which can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. Optionally, they can be implemented with executable program codes of computing devices, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that here, or they can be made into individual integrated circuit modules respectively, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the present disclosure is not limited to any specific combination of hardware and software.

[0212] In addition, although exemplary embodiments have been described herein, the scope includes any and all embodiments based on the present disclosure with equivalent elements, modifications, omissions, combinations (e.g., various embodiments intersecting schemes), adaptations or changes. The elements in the claims will be interpreted broadly based on the language adopted in the claims, and are not limited to the examples described in this specification or during the implementation of the present disclosure, and the examples will be interpreted as non-exclusive. Therefore, this specification and examples are intended to be considered as examples only, and the true scope and spirit are indicated by the following claims and the full scope of their equivalents.

[0213] The above description is intended to be illustrative rather than restrictive. For example, the above examples (or one or more of them) can be used in combination with each other. For example, a person of ordinary skill in the art can use other embodiments when reading the above description. In addition, in the above-mentioned specific embodiments, various features can be grouped together to simplify the present disclosure. This should not be interpreted as an intention that a disclosed feature that is not required to be protected is necessary for any claim. On the contrary, the subject matter of the present disclosure may be less than all the features of a specific disclosed embodiment. Thus, the following claims are incorporated into the specific embodiments as examples or embodiments, wherein each claim is independently used as a separate embodiment, and it is considered that these embodiments can be combined with each other in various combinations or arrangements. The scope of the present disclosure should be determined with reference to the attached claims and the full scope of equivalent forms granted by these claims.

[0214] Multiple embodiments of the present disclosure are described in detail above, but the present disclosure is not limited to these specific embodiments. Those skilled in the art can make various variations and modifications to the embodiments based on the concepts of the present disclosure, and these variations and modifications should all fall within the scope of protection required by the present disclosure.

Claims

1. A binding method, characterized in that: Applied to the device side, including: Broadcasting attribute information of the device end; Listening to a discovery request, responding to the discovery request, and sending the address information of the device end, wherein the discovery request is generated and sent by the application of the user end in response to the attribute information, and the device end and the user end are located in the same local area network; Obtaining binding information, wherein the binding information is generated and sent by the application program at the user end in response to the address information; Transmitting the address information and the binding information to a cloud service end so that the cloud service end verifies whether the device end can be bound by the application; After receiving the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound by the application end, authentication information is generated and sent to the application end to complete the binding between the application end and the device end, wherein the authentication information is used to realize the interaction between the application end and the device end.

2. The binding method according to claim 1, characterized in that: After transmitting the address information and the binding information to the cloud service end, it includes: Receiving an encrypted ciphertext transmitted by the cloud server, wherein the encrypted ciphertext is generated by the cloud server based on the address information; Decrypting the encrypted ciphertext to obtain information to be verified; The information to be verified is returned to the cloud service end so that the cloud service end verifies the information to be verified.

3. The binding method according to claim 1, characterized in that: Generate authentication information and send it to the application, including: Generate a first credential based on the port information included in the attribute information, and send the first credential to the application, wherein the first credential is used to call the port on the device end; Based on the user identity information of the user end, a second credential is generated and sent to the application, wherein the second credential is used by the device end to verify the user identity information, and the user identity information is obtained by the cloud service end from the binding information and returned to the device end.

4. The binding method according to claim 1, characterized in that: When receiving the verification result returned by the cloud service end, the method further includes: Receiving a third credential returned by the cloud server, wherein the third credential indicates that the device has permission to access the cloud server; In the case where the third credential is invalid, retransmitting the address information and the binding information to the cloud server so that the cloud server regenerates the third credential; Receive and store the third credential regenerated by the cloud service end.

5. A binding method, characterized in that: Applied to cloud servers, including: Receiving address information of the device and binding information from the device, wherein the binding information is generated by an application program of a user; Based on the address information, verify the device end, and based on the binding information, verify the user end; If both the device end and the user end pass the verification, generating a verification result; The verification result is returned to the device side, so that the device side can complete the binding with the application program of the user side based on the verification result.

6. The binding method according to claim 5, characterized in that: Based on the address information, verifying the device end includes: Extracting the device ID from the address information; Find the corresponding device public key based on the device ID; Based on the IP address in the address information, transmitting the encrypted ciphertext generated based on the device public key to the device end; Receiving information to be verified returned by the device, where the information to be verified is obtained by the device decrypting the encrypted ciphertext; Verify the information to be verified to determine whether the device has passed the verification.

7. The binding method according to claim 6, characterized in that: After extracting the device ID in the address information, the method further includes: Based on the device ID, query the binding status of the device end; When the binding state of the device is bound, generating prompt information, and transmitting the prompt information to the user terminal; When the binding state of the device end is unbound, the encrypted ciphertext is generated based on the device public key.

8. The binding method according to claim 7, characterized in that: In the case that both the device end and the user end pass the verification, the method further includes: Update the binding status of the device.

9. The binding method according to claim 5, characterized in that: Based on the binding information, verifying the user terminal includes: Extracting a fourth credential included in the binding information, wherein the fourth credential is generated by the cloud service end and sent to the user end when logging into the application; The fourth credential is parsed to determine whether the user identity information included in the binding information is verified.

10. The binding method according to claim 9, characterized in that: In the case that both the device end and the user end pass the verification, the method further includes: Generate a third credential based on the device ID included in the address information, wherein the third credential indicates that the device has the authority to access the cloud service end; Based on the IP address in the address information, the third credential is sent to the device end.

11. The binding method according to claim 9, characterized in that: In the case that both the device end and the user end pass the verification, the method further includes: The user identity information is returned to the device end so that the device end generates authentication information, wherein the authentication information is used to implement interaction between the application and the device end.

12. A binding system, characterized in that: Including the user side and device side, as well as the cloud service side, located in the same local area network; The device end broadcasts the attribute information of the device end; The user terminal responds to the attribute information through an application program to generate a discovery request; After monitoring the discovery request, the device responds to the discovery request and sends the address information of the device to the user end; The user terminal generates binding information in response to the address information through an application, and sends the binding information to the device terminal; The device transmits the address information and the binding information to the cloud service end; The cloud service end verifies the device end based on the address information, and verifies the user end based on the binding information, obtains a verification result, and returns the verification result to the device end; After the device receives the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound to the application, authentication information is generated and sent to the application to complete the binding between the application and the device end; wherein the authentication information is used to realize the interaction between the application and the device end.

13. A computer program product storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 and 5 to 11 are implemented.

14. A storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by a processor, the steps of the method according to any one of claims 1 to 4 and 5 to 11 are implemented.

Images