A binding method, system, device, and storage medium

Abstract

The disclosure provides a binding method, system, device and storage medium. The binding method is applied to a device end and includes the following steps: broadcasting attribute information of the device end; listening to a discovery request and sending address information of the device end in response to the discovery request, wherein the discovery request is generated and sent by an application program of a user end in response to the attribute information, the device end and the user end are located in the same local area network; obtaining binding information, wherein the binding information is generated and sent by the application program of the user end in response to the address information; transmitting the address information and the binding information to a cloud server end to enable the cloud server end to verify whether the device end can be bound by the application program; and after receiving a verification result returned by the cloud server end, if the verification result indicates that the device end can be bound by the application program, generating authentication information and sending the authentication information to the application program to complete the binding between the application program and the device end, wherein the authentication information is used to realize the interaction between the application program and the device end.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of device binding, and in particular, to a binding method, system, device and storage medium. BACKGROUND

[0002] With the popularity of Internet of Things devices, users have higher and higher requirements for the intelligent application of Internet of Things devices. At present, an Internet of Things device can be bound by an application program, so that the user controls and manages the Internet of Things device through the application program.

[0003] At present, the binding between the application program and the Internet of Things device is realized by means of Bluetooth, Wi-Fi and the like. However, in the binding process, the user needs to manually operate multiple times, such as starting the Bluetooth scanning function of the electronic device to which the application program belongs, manually inputting the configuration information of the device to be bound, and the like, which is cumbersome and prone to manual configuration errors leading to failure to bind. In addition, in the binding process by means of Bluetooth, Wi-Fi and the like, it is vulnerable to man-in-the-middle attacks, replay attacks and the like, resulting in low security of the electronic device to which the application program belongs and the Internet of Things device.

[0004] Therefore, there is an urgent need for a method for binding an application program of an electronic device and an Internet of Things device. SUMMARY

[0005] In view of this, the purpose of the embodiments of the present disclosure is to provide a binding method, system, device and storage medium for solving the problems of cumbersome operation and low security in the binding of an application program of an electronic device and an Internet of Things device at present.

[0006] In one aspect, the embodiments of the present disclosure provide a binding method applied to a device end, comprising:

[0007] broadcasting attribute information of the device end;

[0008] listening to a discovery request and sending address information of the device end in response to the discovery request, wherein the discovery request is generated and sent by an application program of a user end in response to the attribute information, and the device end and the user end are located in the same local area network;

[0009] obtaining binding information, wherein the binding information is generated and sent by the application program of the user end in response to the address information;

[0010] transmitting the address information and the binding information to a cloud server end, so that the cloud server end verifies whether the device end can be bound by the application program;

[0011] After receiving the verification result returned by the cloud server, if the verification result indicates that the device end can be bound by the application program, authentication information is generated and sent to the application program to complete the binding between the application program and the device end, wherein the authentication information is used to realize the interaction between the application program and the device end.

[0012] In a possible implementation, after the address information and the binding information are transmitted to the cloud server, the following steps are included:

[0013] The encrypted ciphertext transmitted by the cloud server is received, wherein the encrypted ciphertext is generated by the cloud server based on the address information.

[0014] The encrypted ciphertext is decrypted to obtain to-be-verified information.

[0015] The to-be-verified information is returned to the cloud server, so that the cloud server verifies the to-be-verified information.

[0016] In a possible implementation, the authentication information is generated and sent to the application program, including:

[0017] Based on the port information included in the attribute information, a first credential is generated, and the first credential is sent to the application program, wherein the first credential is used to call the port of the device end.

[0018] Based on the user identity information of the user end, a second credential is generated, and the second credential is sent to the application program, wherein the second credential is used for the device end to verify the user identity information, and the user identity information is obtained by the cloud server from the binding information and returned to the device end.

[0019] In a possible implementation, when the verification result returned by the cloud server is received, the following steps are further included:

[0020] The third credential returned by the cloud server is received, wherein the third credential indicates that the device end has the access right to the cloud server.

[0021] In the case where the third credential is invalid, the address information and the binding information are retransmitted to the cloud server, so that the cloud server re-generates the third credential.

[0022] The third credential re-generated by the cloud server is received and stored.

[0023] On the other hand, another binding method is provided in the embodiments of the present disclosure, which is applied to a cloud server and includes the following steps:

[0024] receiving address information of the device end, and binding information, wherein the binding information is generated by an application program of a user end;

[0025] verifying the device end based on the address information, and verifying the user end based on the binding information;

[0026] generating a verification result when the device end and the user end are both verified;

[0027] returning the verification result to the device end, so that the device end can complete the binding between the application program of the user end based on the verification result.

[0028] In a possible implementation, verifying the device end based on the address information comprises:

[0029] extracting a device ID in the address information;

[0030] finding a corresponding device public key based on the device ID;

[0031] transmitting an encrypted ciphertext generated based on the device public key to the device end based on an IP address in the address information;

[0032] receiving to-be-verified information returned by the device end, wherein the to-be-verified information is obtained by decrypting the encrypted ciphertext by the device end;

[0033] verifying the to-be-verified information to determine whether the device end is verified.

[0034] In a possible implementation, after extracting the device ID in the address information, the method further comprises:

[0035] querying a binding state of the device end based on the device ID;

[0036] generating prompt information and transmitting the prompt information to the user end when the binding state of the device end is bound;

[0037] generating the encrypted ciphertext based on the device public key when the binding state of the device end is unbound.

[0038] In a possible implementation, when the device end and the user end are both verified, the method further comprises:

[0039] updating the binding state of the device end.

[0040] In a possible implementation, verifying the user end based on the binding information comprises:

[0041] extracting a fourth credential included in the binding information, wherein the fourth credential is generated by the cloud server and sent to the user terminal when logging into the application program;

[0042] parsing the fourth credential to determine whether the user identity information included in the binding information is verified.

[0043] In a possible implementation, in the case that the device terminal and the user terminal are both verified, the method further comprises:

[0044] generating a third credential based on the device ID included in the address information, wherein the third credential represents that the device terminal has the access right to the cloud server;

[0045] sending the third credential to the device terminal based on the IP address in the address information.

[0046] In a possible implementation, in the case that the device terminal and the user terminal are both verified, the method further comprises:

[0047] returning the user identity information to the device terminal, so that the device terminal generates authentication information, wherein the authentication information is used to realize the interaction between the application program and the device terminal.

[0048] In another aspect, the disclosure provides a binding system, comprising a user terminal and a device terminal located in the same local area network, and a cloud server;

[0049] The device terminal broadcasts attribute information of the device terminal;

[0050] The user terminal generates a discovery request through an application program in response to the attribute information;

[0051] After listening to the discovery request, the device terminal responds to the discovery request and sends address information of the device terminal to the user terminal;

[0052] The user terminal generates binding information in response to the address information through an application program, and sends the binding information to the device terminal;

[0053] The device terminal transmits the address information and the binding information to the cloud server;

[0054] The cloud server verifies the device terminal based on the address information, and verifies the user terminal based on the binding information, obtains a verification result, and returns the verification result to the device terminal;

[0055] The device end generates authentication information and sends the authentication information to the application program after receiving the verification result returned by the cloud service end, so as to complete the binding between the application program and the device end, wherein the authentication information is used to realize the interaction between the application program and the device end.

[0056] In another aspect, the embodiment of the present disclosure provides a computer program product, which stores a computer program. The computer program is executed by a processor to implement the steps of the above method.

[0057] In another aspect, the embodiment of the present disclosure provides a storage medium, which carries one or more computer programs. The one or more computer programs are executed by a processor to implement the steps of the above method.

[0058] In the embodiment of the present disclosure, the device end can automatically broadcast the attribute information of the device end, so that the application program of the user end responds to the attribute information and returns a discovery request. Then, the device end automatically responds to the discovery request and sends the address information of the device end, so that the application program of the user end responds to the address information and sends binding information to start the binding between the application program of the user end and the device. Without too much operation of the user, the degree of automation is high, and the convenience is improved. Moreover, the cloud service end receives and verifies the address information and the binding information transmitted by the device end to perform security verification with the user end and the device end. Through a more sound and flexible binding mechanism, the security of the user end, the device end and the binding process of the user end and the device end is effectively improved. It is also convenient for the user end to centrally manage and remotely maintain the device end through the cloud service end, which helps to improve the management efficiency.

[0059] In order to make the above objectives, characteristics and advantages of the present disclosure more obvious and easy to understand, the following preferred embodiments are specifically described below, and the accompanying drawings are described in detail as follows. BRIEF DESCRIPTION OF DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the present disclosure or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments described in the present disclosure, and for those skilled in the art, other drawings can also be obtained without creative labor under the premise of these drawings.

[0061] Figure 1 A flowchart of a binding method provided by the present disclosure is shown;

[0062] Figure 2 A flowchart of another binding method provided by the present disclosure is shown;

[0063] Figure 3 A flow chart of another binding method provided by the present disclosure is shown;

[0064] Figure 4 A flow chart of another binding method provided by the present disclosure is shown;

[0065] Figure 5 A flow chart of the cloud server verifying the device end based on the address information in a binding method provided by the present disclosure is shown;

[0066] Figure 6 A flow chart of the cloud server verifying the device end based on the address information in a binding method provided by the present disclosure is shown;

[0067] Figure 7 A flow chart of the binding system provided by the present disclosure is shown;

[0068] Figure 8 A structural schematic diagram of the computer device provided by the present disclosure is shown. DETAILED DESCRIPTION

[0069] In order to make the objectives, technical solutions and advantages of the present disclosure clearer, the technical solutions of the present disclosure will be described clearly and completely below in conjunction with the drawings of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the described embodiments of the present disclosure, all other embodiments obtained by those of ordinary skill in the art without any creative effort fall within the scope of protection of the present disclosure.

[0070] Unless otherwise defined, the technical terms or scientific terms used in the present disclosure shall be understood as the usual meanings understood by those of ordinary skill in the art to which the present disclosure belongs. The terms “first”, “second” and the like used in the present disclosure do not represent any order, number or importance, but are only used to distinguish different components. The terms “include” or “contain” and the like mean that the elements or objects before the terms cover the elements or objects listed after the terms and their equivalents, without excluding other elements or objects. The terms “connect” or “connected” and the like are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms “up”, “down”, “left”, “right” and the like are only used to represent relative positional relationships, and when the absolute positions of the described objects change, the relative positional relationships may also change accordingly.

[0071] In order to keep the following description of the present disclosure clear and concise, the present disclosure omits the detailed description of known functions and known components.

[0072] The binding method provided by the present disclosure can be applied to various scenarios, for example, in a smart home scenario, a user terminal (including but not limited to a user's mobile phone, tablet computer or notebook computer) binds a device terminal (including but not limited to a sound box, refrigerator, air conditioner, etc.) through a specific application program to control and manage the sound box, refrigerator, air conditioner, etc. For another example, in a conference scenario, the user terminal (including but not limited to the user's mobile phone, tablet computer or notebook computer) binds the device terminal (including but not limited to a projector, printer, etc.) through a certain application program to control the projector to display conference content and control the printer to print conference materials. That is, the binding method of the present disclosure can be applied to the binding between the user terminal and the device terminal, and without too much operation of the user, the degree of automation is high, and at the same time, the security of the user terminal, the device terminal and the binding process of the user terminal and the device terminal can be improved.

[0073] In one aspect, the present disclosure provides a binding method, which is applied to a device terminal as an example, Figure 1 A flowchart of the binding method provided by the present disclosure is shown, which is applied to a device terminal, Figure 1 The specific steps of the binding method shown can include S101-S105.

[0074] S101, broadcast attribute information of the device terminal.

[0075] As an example, the device terminal automatically broadcasts the attribute information of the device terminal after accessing a certain local area network. The attribute information can include the device name, service type, service domain and service port of the device terminal, and the device name, service type and service port are all set before factory.

[0076] Optionally, the present disclosure sets that the local area network complies with the Multicast Domain Name System (MDNS) protocol, so that the devices in the local area network can discover and access each other through the device name. Based on the MDNS protocol, the attribute information of the device terminal is broadcasted after the device terminal accesses the local area network.

[0077] As another example, the present disclosure can also be pre-set for the device terminal, for example, the attribute information of the device terminal is broadcasted after the device terminal accesses any local area network, so that the attribute information of the device terminal can be obtained by other devices in the local area network.

[0078] S102, listen to a discovery request and send address information of the device terminal in response to the discovery request, wherein the discovery request is generated and sent by an application program of a user terminal in response to the attribute information, and the device terminal and the user terminal are located in the same local area network.

[0079] Optionally, the device end listens to information sent by other devices in real time after broadcasting the attribute information, to listen to a discovery request. The discovery request is generated and sent by the application program of the user end in response to the attribute information, for example, based on the MDNS protocol, the application program of the user end scans information broadcast in the local area network in real time or periodically, after scanning the attribute information broadcast by the device end, the attribute information is responded to generate a discovery request, and the discovery request is sent. Here, since the address information of the device end is not included in the attribute information, the user end can also send the discovery request in the form of broadcast. It should be noted that the application program of the user end scans the information broadcast in the local area network and the device end broadcasts the attribute information of the device end can be performed simultaneously, and the two steps are not arranged in sequence.

[0080] Here, the device end and the user end are located in the same local area network, so that the user end can scan the attribute information of the device end and the device end can listen to the discovery request of the user end.

[0081] After listening to the discovery request, the device end responds to the discovery request and sends the address information of the device end to the user end. Optionally, the application program of the user end can send the discovery request in the form of broadcast, and send the network address of the user end at the same time, so that the device end can respond to the discovery request of the user end based on the network address. The network address can include a physical address (such as a MAC address) and / or a logical address (such as an IP address).

[0082] The address information includes the device ID and the IP address of the device end.

[0083] S103, obtaining binding information, wherein the binding information is generated and sent by the application program of the user end in response to the address information.

[0084] In one example, after the device end sends the address information of the device end to the user end, the application program of the user end receives and responds to the address information, that is, generates a binding information, and returns the binding information to the device end according to the IP address in the address information. The binding information includes user identity information corresponding to the application program of the user end and a binding request, that is, the application program wants to bind the device end. Of course, the binding information can also include other information of the application program of the user end, such as identification information of the application program, a port of the user end corresponding to the application program, and a credential for verifying the user identity information.

[0085] After the device end sends the address information to the user end, the device end monitors whether the binding information returned by the application program of the user end is received in real time, so as to obtain the binding information in time.

[0086] Optionally, there are multiple device terminals and user terminals simultaneously joining the same local area network, that is, the user terminal can scan the attribute information broadcasted by each device terminal and generate a corresponding discovery request for each attribute information. In order to ensure that the device terminal bound by the application program of the user terminal is the device terminal that the user wants to bind, the application program receives the address information sent by the device terminal in response to the discovery request in real time after sending all the discovery requests, determines the number of received address information, and if the received address information is multiple, generates and displays a device terminal list, and prompts the user to determine the device terminal that he wants to bind based on the device terminal list. The device terminal list can include device name, service type, device ID, etc.

[0087] After the user determines the device terminal that he wants to bind based on the device terminal list, the application program generates binding information based on the device terminal, and returns the binding information to the device terminal according to the IP address in the address information of the device terminal.

[0088] For example, multiple Bluetooth headsets of multiple users simultaneously access the same local area network, and the multiple Bluetooth headsets broadcast attribute information respectively, the attribute information at least including the name, service type, service domain and service port of the Bluetooth headset. After the mobile phone of user A scans the attribute information of the multiple Bluetooth headsets, it generates a discovery request for each attribute information respectively, so that each Bluetooth headset can receive the discovery request. Then, each Bluetooth headset responds to the discovery request and sends address information, the address information at least including the ID and IP address of the Bluetooth headset. The mobile phone of user A receives the address information sent by the Bluetooth headset through the application program, and when the received address information is multiple, generates a Bluetooth headset list and displays it through the mobile phone of user A. User A determines his Bluetooth headset based on the Bluetooth headset list, and then the application program generates binding information based on the Bluetooth headset determined by the user, and returns the binding information to the Bluetooth headset determined by the user according to the IP address corresponding to the Bluetooth headset determined by the user.

[0089] S104, transmitting the address information and the binding information to the cloud server, so that the cloud server verifies whether the device terminal can be bound by the application program.

[0090] The cloud server and the device terminal are network connected, of course, the cloud server and the user terminal are also network connected. Based on this, the device terminal transmits the address information and the binding information to the cloud server after receiving the binding information, so that the cloud server verifies whether the device terminal can be bound by the application program.

[0091] Optionally, the cloud server verifies the application program and the device terminal based on the address information and the binding information respectively after receiving the address information and the binding information transmitted by the device terminal, and obtains the corresponding verification result, and then returns the verification result to the device terminal.

[0092] The verification result includes that the application and / or the device pass the verification and that the application and the device both fail the verification, and if the verification result is that the application and the device both pass the verification, the device can be bound by the application; if the application or the device passes the verification or the application and the device both fail the verification, the device cannot be bound by the application.

[0093] S105, after receiving the verification result returned by the cloud server, if the verification result indicates that the device can be bound by the application, authentication information is generated and sent to the application to complete the binding between the application and the device, wherein the authentication information is used to realize the interaction between the application and the device.

[0094] Optionally, after receiving the verification result returned by the cloud server, if it is determined that the verification result indicates that the device can be bound by the application, authentication information is generated and sent to the application. The authentication information is used to realize the interaction between the application and the device, for example, to realize the application calling the port of the device, to realize the device authenticating the user identity information corresponding to the application to determine whether the application has access rights, etc.

[0095] After the authentication information is generated on the device and sent to the application, the binding between the application and the device is completed. That is, the user can access, control and manage the device through the application.

[0096] Correspondingly, after the application on the user side receives the authentication information, it is ensured that the binding with the device is completed, at this time, a binding result is generated, and the binding result is displayed on the display screen of the user side to prompt the user through the displayed binding result that the application and the device have completed the binding.

[0097] In the above binding method disclosed by the embodiments of the present disclosure, the user does not need to manually perform too many operations, and when the device and the user side are located in the same local area network, the automatic binding between the application on the user side and the device can be realized according to the above steps, the degree of automation is high, thereby greatly improving the user experience, and at the same time, the problem that the user cannot complete the binding due to the misoperation when performing too many manual operations is avoided. Moreover, in the process of binding between the application on the user side and the device, the cloud server performs security verification on the application on the user side and the device, which not only improves the security of the user side, the device and the binding process of the user side and the device, but also facilitates the cloud server to centrally manage and maintain the user side and the device, improves the management efficiency and maintenance efficiency, etc.

[0098] As another example, after transmitting the address information and the binding information to the cloud server, the device end can perform Figure 2 The steps in the flowchart of another binding method shown are performed to complete the verification of the device end by the cloud server. By Figure 2 It can be seen that the specific steps include S201-S203.

[0099] S201, receiving the encrypted ciphertext transmitted by the cloud server, wherein the encrypted ciphertext is generated by the cloud server based on the address information.

[0100] S202, decrypting the encrypted ciphertext to obtain the to-be-verified information.

[0101] S203, returning the to-be-verified information to the cloud server, so that the cloud server verifies the to-be-verified information.

[0102] As another example, after transmitting the address information and the binding information to the cloud server, the cloud server verifies the user end based on the binding information, specifically whether the user identity information corresponding to the application program has the permission to be bound with the device end; at the same time, the server also verifies the device end based on the address information to verify whether the device end has the permission to be bound with the application program of the user end.

[0103] Optionally, for the device end, the server generates corresponding encrypted ciphertext based on the address information of the device end, and transmits the encrypted ciphertext to the device end based on the IP address in the address information. Here, the encrypted ciphertext can be generated based on one or more of a public-private key pair, a random number, and a timestamp.

[0104] After receiving the encrypted ciphertext transmitted by the cloud server, the device end decrypts the encrypted ciphertext to obtain the to-be-verified information, and then returns the to-be-verified information to the cloud server, so that the cloud server verifies the to-be-verified information. The device end and the cloud server store a shared key, which is used to generate and parse the encrypted ciphertext. By verifying the device end by the cloud server, it effectively avoids attackers from maliciously forging devices that can be bound by the application program of the user end, such as virtual devices, thereby avoiding the problem of data leakage of the user end caused by the application program binding maliciously forged devices, i.e., ensuring the security of the data of the user end.

[0105] As one of the examples, after determining that the verification result indicates that the device end can be bound by the application program, the device end generates a first credential based on the port information included in the attribute information, wherein the first credential is used to call the port of the device end. The port information can include one or more of a port number, a port type, a protocol followed by the port, and a purpose of the port.

[0106] Further, the device end sends the first credential to the application program after generating the first credential, so that the application program can call the port corresponding to the port information based on the first credential, to realize access, control and management of the device end, etc. For example, the first credential is a token Token, that is, the device end generates a Token according to the encryption mechanism based on the port information, and sends the Token to the application program of the user end. Then, when the user communicates with the device end based on the application program, the application program sends the communication information (such as access request, control instruction, etc.) and the Token to the device end at the same time, to call the port of the device end, realize communication with the device end, and correspondingly, the device end determines that the application program should have the permission to call the port after receiving the Token, and then receives the communication information sent by the application program through the port, etc. Optionally, the encryption mechanism can be set as any one of symmetric encryption, asymmetric encryption, key exchange, message digest, electronic signature, and certificate and PKI.

[0107] Further, the device end sends the first credential to the application program after generating the first credential, so that the application program can call the port corresponding to the port information based on the first credential, to realize access, control and management of the device end, etc. For example, the first credential is a token Token, that is, the device end generates a Token according to the encryption mechanism based on the port information, and sends the Token to the application program of the user end. Then, when the user communicates with the device end based on the application program, the application program sends the communication information (such as access request, control instruction, etc.) and the Token to the device end at the same time, to call the port of the device end, realize communication with the device end, and correspondingly, the device end determines that the application program should have the permission to call the port after receiving the Token, and then receives the communication information sent by the application program through the port, etc. Optionally, the encryption mechanism can be set as any one of symmetric encryption, asymmetric encryption, key exchange, message digest, electronic signature, and certificate and PKI.

[0108] For example, the second credential is a JWT, the device end generates the JWT based on the user identity information by using a public key after receiving the user identity information returned by the cloud service end, stores a private key for verifying the JWT, associates the private key with the user identity information corresponding to the JWT, and transmits the JWT to the application program of the user end. Then, when the user communicates with the device end based on the application program, the application program sends the communication information, the Token for calling the port of the device end, and the JWT to the device end at the same time. Correspondingly, the device end determines that the application program should have the permission to call the port after receiving the Token, and then receives the communication information and the JWT sent by the application program through the port, and verifies the JWT. Specifically, the device end finds the private key associated with the user identity information corresponding to the application program, verifies the JWT by using the private key, and responds to the communication information if the verification is successful, to realize communication with the user end.

[0109] As another example, upon receiving the verification result returned by the cloud server, the device end can perform Figure 3 The flowchart of another binding method is shown to ensure that the device end has the access right to the cloud server. The specific steps include S301-S303. Figure 3 The specific steps include S301-S303.

[0110] S301, receiving the third credential returned by the cloud server, wherein the third credential indicates that the device end has the access right to the cloud server.

[0111] S302, in the case of invalid third credential, retransmitting the address information and the binding information to the cloud server to make the cloud server regenerate the third credential.

[0112] S303, receiving the third credential regenerated by the cloud server and storing it.

[0113] Optionally, after the cloud server verifies that the device end can be bound by the application program, the third credential is generated for the device end and returned to the device end, which indicates that the device end has the access right to the cloud server. The third credential can be Token or JWT, etc.

[0114] Upon receiving the verification result returned by the cloud server, the third credential returned by the cloud server is received. The cloud server can send the third credential after sending the verification result, or send the verification result and the third credential at the same time, which is not limited in the embodiment of the disclosure.

[0115] After receiving the third credential, the device end can apply to the cloud server for access to the data, files, etc. that it wants to access based on the third credential.

[0116] In order to ensure the security of the data, files, etc. on the cloud server, the third credential can be set to have a validity period, for example, the third credential includes a timestamp or other information, so that in the case of invalid third credential, the device end that no longer has the access right can still access the cloud server, which improves the security of the data, files, etc. on the cloud server to a certain extent.

[0117] On the other hand, the embodiment of the disclosure provides another binding method, as an example, Figure 4 The flowchart of another binding method provided by the embodiment of the disclosure is shown, which is applied to the cloud server. The specific steps of the binding method include S401-S404. Figure 4 The specific steps of the binding method include S401-S404.

[0118] S401, receiving the address information of the device end and the binding information from the device end, wherein the binding information is generated by an application program of a user end.

[0119] Optionally, the cloud server end receives various information of the device end and the user end in real time, such as a request, binding information, a query instruction, address information, and the like.

[0120] As one of the examples, after receiving the binding information sent by the application program of the user end, the device end receives the address information of the device end and the binding information, that is, the binding information is generated by the application program of the user end and is generated by the user end after obtaining the address information of the device end, wherein the user end and the device end are located in the same local area network.

[0121] S402, verifying the device end based on the address information and verifying the user end based on the binding information.

[0122] As one of the examples, after receiving the address information and the binding information, the cloud server end verifies the device end based on the address information to avoid that an attacker maliciously forges a device that can be bound by the application program of the user end, thereby avoiding data leakage of the user end and ensuring the security of the data of the user end.

[0123] In addition, after receiving the address information and the binding information, the cloud server end also verifies the user end based on the binding information to verify whether the application program of the user end has the permission to bind the device end, thereby preventing an attacker from maliciously binding the device end and causing information leakage of the device end and ensuring the security of the data of the device end.

[0124] S403, generating a verification result when the device end and the user end are both verified.

[0125] As one of the examples, after verifying the device end and the user end respectively, the cloud server end generates a verification result when the device end and the user end are both verified. Of course, the cloud server end can also generate a verification result when the device end or the user end is verified and when the device end and the user end are both not verified. The present disclosure does not make a specific limitation on this.

[0126] S404, returning the verification result to the device end to enable the device end to complete the binding between the device end and the application program of the user end based on the verification result.

[0127] After generating the verification result, the cloud server end returns the verification result to the device end to enable the device end to complete the binding between the device end and the application program of the user end based on the verification result. As one of the examples, after receiving the verification result indicating that the device end can be bound by the application program, the device end generates authentication information and sends the authentication information to the application program to complete the binding between the application program and the device end.

[0128] In the process of binding the application program at the user end and the device end, the cloud server is used to verify the application program at the user end and the device end, thereby improving the security of the user end, the device end and the binding process of the user end and the device end, facilitating the centralized management and subsequent maintenance of the user end and the device end by the cloud server, and improving the management efficiency and maintenance efficiency.

[0129] As one of the examples, Figure 5 The flowchart for verifying the device end based on the address information by the cloud server is shown, and the specific steps can include S501-S505.

[0130] S501, extract the device ID in the address information.

[0131] S502, find the corresponding device public key based on the device ID.

[0132] S503, based on the IP address in the address information, transmit the encrypted ciphertext generated based on the device public key to the device end.

[0133] S504, receive the to-be-verified information returned by the device end, which is obtained by decrypting the encrypted ciphertext by the device end.

[0134] S505, verify the to-be-verified information to determine whether the device end passes the verification.

[0135] As one of the examples, the cloud server extracts the device ID of the device end from the address information after receiving the address information of the device end. Here, the device ID has been set before the device end is manufactured, and the device ID uniquely corresponds to one device end.

[0136] After obtaining the device ID of the device end, the corresponding device public key is found based on the device ID, and the encrypted ciphertext is generated based on the device public key. For example, a string of random characters is generated, and the random characters are encrypted by the device public key to obtain the encrypted ciphertext. The device public key is generated by the cloud server for the device end before the device end is manufactured, and the device private key corresponding to the device public key is also generated.

[0137] Further, the IP address in the address information is extracted, wherein the IP address is generated based on the IP protocol after the device end accesses the local area network, and the IP address also uniquely corresponds to one device end.

[0138] After generating the encrypted ciphertext, the encrypted ciphertext is transmitted to the device end based on the IP address in the address information. Optionally, the encrypted ciphertext can also be accompanied by a timestamp when transmitted to the device end, so as to enhance the security of the encrypted ciphertext and avoid the problem of low security caused by malicious decryption of the encrypted ciphertext.

[0139] The device's private key, corresponding to its public key, is stored on the device itself. Upon receiving encrypted ciphertext from the cloud server, the device uses this private key to decrypt the ciphertext, obtaining the information to be verified, and then returns this information to the cloud server. This information to be verified includes at least a random string. If a timestamp is received, the information to be verified also includes time information and / or the device's digital signature. This digital signature is also stored on the cloud server before the device leaves the factory.

[0140] The cloud server receives the verification information returned by the device and verifies it to determine whether the device passes the verification. Optionally, if the cloud server does not send a timestamp to the device, it verifies whether the random string included in the verification information is the same as the random string used when generating the encrypted ciphertext. If the cloud server sends a timestamp to the device, in addition to verifying whether the random string included in the verification information is the same as the random string used when generating the encrypted ciphertext, it also needs to verify whether the electronic signature included in the verification information is the electronic signature corresponding to the device, and whether the verification time information included in the verification information is consistent with the time information corresponding to the timestamp generation.

[0141] In cases where the cloud server does not send a timestamp to the device, if the random string included in the information to be verified is the same as the random string used when generating the encrypted ciphertext, then the device is determined to have passed the verification. This means that the device has the permissions to be bound to the user's application, and also that the device has the permissions allowed by the cloud server to be accessed.

[0142] As another example, to ensure the security and uniqueness of the device, it can be configured that a device can only be bound to one application of the same type. Based on this, after extracting the device ID from the address information, the cloud server queries the binding status of the device based on the device ID. The cloud server stores the binding status of each device and updates it in real time. The binding status includes "bound" and "unbound." Optionally, an identifier code can be used to represent the binding status. For example, identifier code A indicates that the device is bound; identifier code B indicates that the device is unbound. It is worth noting that using an identifier code to represent the binding status is only one example, and setting the identifier code to English letters is also only one example. This disclosure does not specifically limit this approach. Those skilled in the art should understand that using other forms to represent the binding status or using Arabic numerals, icons, etc., as identifier codes all fall within the protection scope of this disclosure.

[0143] In a case that the binding state of the device end is queried and it is determined that the binding state of the device end is bound, it is represented that the device end cannot be bound by the application program, at this time, prompt information is generated and transmitted to the user end. The prompt information is used to prompt the user that the application program of the user end fails to bind the device end, and the reason for the failure is that the device end is bound.

[0144] In a case that the binding state of the device end is queried and it is determined that the binding state of the device end is not bound, the encrypted ciphertext is generated based on the device public key, and then the above-mentioned step of verifying the device end is executed.

[0145] Here, based on the binding state of the device end, it is determined whether the device end cannot be bound by the application program or the above-mentioned step of verifying the device end is executed, which can avoid the problems of low security of the device end, low security of the user end, and low user experience caused by the same device end being bound by the application programs of different user ends, that is, the security of the device end and the user end and the user experience are effectively ensured.

[0146] Further, in a case that the device end and the user end are both verified, that is, the cloud service end determines that the device end can be bound by the application program, and generates a verification result and returns it to the device end to make the device end complete the binding between the application program and the device end in response to the verification result, the binding state of the device end is updated based on the device ID of the device end.

[0147] As one of the examples, Figure 6 A flowchart of the cloud service end verifying the user end based on the binding information is shown, and the specific steps can include S601-S602.

[0148] S601, the fourth credential included in the binding information is extracted, wherein the fourth credential is generated by the cloud service end when logging into the application program and sent to the user end.

[0149] S602, the fourth credential is parsed to determine whether the user identity information included in the binding information is verified.

[0150] As one of the examples, after the cloud service end receives the binding information, the fourth credential included in the binding information is extracted, and the fourth credential is generated by the cloud service end when logging into the application program and sent to the user end. The fourth credential is used for the cloud service end to verify the identity information corresponding to the application program of the user end.

[0151] Optionally, taking the fourth credential as an example of a JWT, when the user logs in the application through the user terminal for the first time, the cloud server generates a JWT based on the user identity information corresponding to the application, stores the private key for verifying the JWT in association with the user identity information, and sends the JWT to the user terminal, so that the user terminal stores the JWT. When the application on the user terminal interacts with the cloud server (such as the user accessing the cloud server or requesting data from the cloud server through the application), the user identity information and the JWT are sent to the cloud server at the same time. After the cloud server receives the request, the user identity information and the JWT sent by the application on the user terminal, the corresponding private key is found based on the user identity information, and the private key is used to verify the JWT. If the JWT is verified, the cloud server responds to the request.

[0152] In the embodiments of the present disclosure, after the cloud server extracts the fourth credential from the binding information, the corresponding private key is found based on the user identity information included in the binding information, so that the private key is used to parse the extracted fourth credential. If the parsing is successful, it indicates that the user identity information included in the binding information is verified. Therefore, the security of the user terminal can be ensured to a certain extent, and the security of the device terminal bound with the application on the user terminal is ensured.

[0153] In another example, in the case that both the device terminal and the user terminal are verified, the cloud server can also generate a third credential based on the device ID included in the address information, wherein the third credential indicates that the device terminal has the access right to the cloud server. The device terminal can interact with the cloud server based on the third credential, such as accessing the cloud server or requesting data from the cloud server, and the third credential can be a Token or a JWT.

[0154] Then, based on the IP address in the address information, the third credential is sent to the device terminal. Optionally, the cloud server can send the third credential after sending the verification result, or send the verification result and the third credential at the same time.

[0155] In another example, in the case that both the device terminal and the user terminal are verified, the cloud server can also return the user identity information to the device terminal, so that the device terminal generates authentication information, wherein the authentication information is used to realize the interaction between the application and the device terminal.

[0156] On the other hand, the embodiments of the present disclosure also provide a binding system. Since the principle of solving the problem of the binding system in the embodiments of the present disclosure is similar to the binding method of the present disclosure, the implementation of the binding system can be referred to the implementation of the method, and the repeated parts will not be described here.

[0157] Optionally, the binding system includes a user terminal and a device terminal located in the same local area network, and a cloud server;

[0158] The device end broadcasts attribute information of the device end;

[0159] The user end generates a discovery request in response to the attribute information through an application program;

[0160] The device end sends address information of the device end to the user end in response to the discovery request after listening to the discovery request;

[0161] The user end generates binding information in response to the address information through the application program, and sends the binding information to the device end;

[0162] The device end transmits the address information and the binding information to a cloud service end;

[0163] The cloud service end verifies the device end based on the address information, and verifies the user end based on the binding information, obtains a verification result, and returns the verification result to the device end;

[0164] After receiving the verification result returned by the cloud service end, if the verification result indicates that the device end can be bound by the application program, the device end generates authentication information and sends it to the application program to complete the binding between the application program and the device end; wherein the authentication information is used to realize the interaction between the application program and the device end.

[0165] As an example, Figure 7 A flowchart of a binding system provided by an embodiment of the present disclosure is shown. Referring to Figure 7 , the binding process includes:

[0166] The device end automatically broadcasts attribute information of the device end after accessing a local area network.

[0167] The user end scans the information broadcast in the local area network according to a scanning period or in real time through an application program. After the user end scans the attribute information broadcast by the device end through the application program, the attribute information is responded to, a discovery request is generated and sent, and the network address of the user end is also sent. It should be noted that after the user end accesses a local area network, the application program can be started (such as background start) and begin to scan the information broadcast in the local area network according to a scanning period or in real time. Although Figure 7 The device end "automatically broadcasts attribute information of the device end" and the user end "scans the information broadcast in the local area network according to a scanning period or in real time through an application program" have a sequence, but in actual application, the two steps do not have a sequence.

[0168] The device end starts its own listening function after the broadcast of the attribute information, to listen to the information returned by other device ends. After listening to the discovery request, the device end responds to the discovery request and sends the address information of the device end to the user end, i.e., sends the device ID and IP address of the device end to the user end.

[0169] The user end further determines the number of received address information after receiving the address information sent by the device end through the application program. Here, Figure 7 The binding process shown in FIG. 6 is described by taking the case where the user end receives multiple address information as an example. That is, the application program of the user end generates a device end list and displays the device end list when it is determined that the received address information is multiple, and prompts the user to determine the device end that the user wants to bind based on the device end list. After the user determines the device end that the user wants to bind based on the device end list, the application program responds to the address information of the device end determined by the user, generates binding information, and returns the binding information to the device end according to the IP address corresponding to the device end.

[0170] The device end transmits the address information and the binding information to the cloud service end after receiving the binding information returned by the user end.

[0171] The cloud service end verifies the device end based on the address information and verifies the user end based on the binding information after receiving the address information and the binding information transmitted by the device end, and then obtains a verification result. Similarly, Figure 7 The step of "verifying the device end based on the address information" and the step of "verifying the user end based on the binding information" are sequentially represented in the above description, but in actual application, the two steps are not limited in sequence and can be performed simultaneously.

[0172] For example, when the cloud service end verifies the device end based on the address information, the device ID in the address information is extracted, the corresponding device public key is found based on the device ID, and the binding state of the device end is determined based on the device ID, i.e., if the binding state of the device end is bound, the cloud service end generates a prompt information "binding device end fails, the reason for failure is that the device end is bound" and sends it to the application program of the user end. Of course, the content of the prompt information can be adjusted according to actual needs, and the present disclosure does not make specific limitations thereon. If the binding state of the device end is unbound, the cloud service end generates an encrypted ciphertext based on the device public key corresponding to the device ID, and then transmits the encrypted ciphertext generated based on the device public key to the device end based on the IP address in the address information.

[0173] The device end receives the encrypted ciphertext transmitted by the cloud service end, decrypts the encrypted ciphertext using the shared key, obtains the to-be-verified information, and returns the to-be-verified information to the cloud service end.

[0174] After the cloud server end receives the to-be-verified information returned by the device end, the to-be-verified information is verified, if the verification fails, a prompt information of "binding device end fails, the failure reason is that the device end fails to pass the verification" is generated and sent to the application program of the user end, of course, the content of the prompt information can also be adjusted according to actual needs.

[0175] When the cloud server end verifies the user end based on the binding information, the first JWT included in the binding information is extracted, wherein the first JWT is generated by the cloud server end when the application program is logged in and sent to the user end, and the cloud server end also stores the private key corresponding to the first JWT. Then, the first JWT is parsed by using the private key to determine whether the user identity information included in the binding information passes the verification. If the user identity information fails to pass the verification, a prompt information of "binding device end fails, the failure reason is that the user identity information fails to pass the verification" is generated and sent to the application program of the user end.

[0176] In the case that the user identity information and the device end both pass the verification, the cloud server end generates a corresponding verification result, which represents that the device end can be bound by the application program. Then, the verification result is returned to the device end, and the user identity information is also returned to the device end.

[0177] After the device end receives the verification result returned by the cloud server end, in the case that the verification result represents that the device end can be bound by the application program, a Token is generated based on the port information included in the attribute information, and a second JWT is generated based on the user identity information of the user end, and the Token and the second JWT are sent to the application program of the user end. The Token is used for the application program to call the port of the device end, and the second JWT is used for the device end to verify the user identity information, thereby completing the binding between the application program and the device end, and then the application program can realize the interaction with the device end based on the Token and the second JWT.

[0178] In the case that the device end and the user end both pass the verification, the cloud server end generates a third JWT based on the device ID included in the address information, and sends the third JWT to the device end based on the IP address in the address information, wherein the third JWT represents that the device end has the access right to the cloud server end, so that the device end can access the cloud server end subsequently.

[0179] In the embodiments of the present disclosure, the device end can automatically broadcast attribute information of the device end, so that an application program of the user end responds to the attribute information and returns a discovery request; then, the device end automatically responds to the discovery request and sends address information of the device end, so that the application program of the user end responds to the address information and sends binding information, to start the binding between the application program of the user end and the device, without too much operation of the user, and the degree of automation is high. Moreover, the cloud server receives and verifies the address information and the binding information transmitted by the device end, to perform security verification on the user end and the device end, thereby effectively improving the security of the user end, the device end and the binding process between the user end and the device end.

[0180] In another aspect, the present disclosure also provides a computer program product, which stores a computer program, and the computer program is executed by a processor to implement the method provided by any of the embodiments of the present disclosure, including the following steps S11 to S15 and S16 to S19:

[0181] S11, broadcast attribute information of the device end;

[0182] S12, listen to a discovery request, to respond to the discovery request and send address information of the device end, wherein the discovery request is generated and sent by an application program of the user end in response to the attribute information, and the device end and the user end are located in the same local area network;

[0183] S13, obtain binding information, wherein the binding information is generated and sent by the application program of the user end in response to the address information;

[0184] S14, transmit the address information and the binding information to a cloud server, to make the cloud server verify whether the device end can be bound by the application program;

[0185] S15, after receiving a verification result returned by the cloud server, if the verification result represents that the device end can be bound by the application program, generate authentication information and send it to the application program, to complete the binding between the application program and the device end, wherein the authentication information is used to realize the interaction between the application program and the device end.

[0186] S16, receive address information of the device end and binding information from the device end, wherein the binding information is generated by an application program of a user end;

[0187] S17, based on the address information, verify the device end, and based on the binding information, verify the user end;

[0188] S18, generating a verification result in a case that the device end and the user end are both verified;

[0189] S19, returning the verification result to the device end, so that the device end can complete the binding between the application program of the user end based on the verification result.

[0190] In another aspect, the disclosure also provides a storage medium carrying one or more computer programs, which are executed by a processor to implement the method provided by any of the embodiments of the present application, including the following steps S21-S25 and S26-S29:

[0191] S21, broadcasting attribute information of the device end;

[0192] S22, listening to a discovery request, and sending address information of the device end in response to the discovery request, wherein the discovery request is generated and sent by an application program of the user end in response to the attribute information, and the device end and the user end are located in the same local area network;

[0193] S23, obtaining binding information, wherein the binding information is generated and sent by the application program of the user end in response to the address information;

[0194] S24, transmitting the address information and the binding information to a cloud server, so that the cloud server verifies whether the device end can be bound by the application program;

[0195] S25, after receiving a verification result returned by the cloud server, if the verification result represents that the device end can be bound by the application program, generating authentication information and sending it to the application program, so as to complete the binding between the application program and the device end, wherein the authentication information is used to realize the interaction between the application program and the device end.

[0196] S26, receiving address information of the device end and binding information from the device end, wherein the binding information is generated by an application program of a user end;

[0197] S27, verifying the device end based on the address information, and verifying the user end based on the binding information;

[0198] S28, generating a verification result in a case that the device end and the user end are both verified;

[0199] S29, returning the verification result to the device end, so that the device end can complete the binding between the application program of the user end based on the verification result.

[0200] In another aspect, the present disclosure also provides a computer device, a structural schematic diagram of which can be as shown in Figure 8 The computer device at least includes a memory 801 and a processor 802, the memory 801 stores a computer program, and the processor 802 implements the method provided by any embodiment of the present disclosure when executing the computer program on the memory 801. For example, the computer device computer program steps are as follows S31 to S35 and S36 to S39:

[0201] S31, broadcast attribute information of the device end;

[0202] S32, listen to a discovery request, and in response to the discovery request, send address information of the device end, wherein the discovery request is generated and sent by an application program of the user end in response to the attribute information, and the device end and the user end are located in the same local area network;

[0203] S33, obtain binding information, wherein the binding information is generated and sent by the application program of the user end in response to the address information;

[0204] S34, transmit the address information and the binding information to a cloud server, so that the cloud server verifies whether the device end can be bound by the application program;

[0205] S35, after receiving a verification result returned by the cloud server, if the verification result represents that the device end can be bound by the application program, generate authentication information and send it to the application program, so as to complete the binding between the application program and the device end, wherein the authentication information is used to realize the interaction between the application program and the device end.

[0206] S36, receive address information of the device end and binding information from the device end, wherein the binding information is generated by an application program of a user end;

[0207] S37, based on the address information, verify the device end, and based on the binding information, verify the user end;

[0208] S38, generate a verification result when the device end and the user end are both verified;

[0209] S39, return the verification result to the device end, so that the device end can complete the binding with the application program of the user end based on the verification result.

[0210] In the embodiments of the present disclosure, the device end can automatically broadcast attribute information of the device end, so that the application program of the user end responds to the attribute information and returns a discovery request; then, the device end automatically responds to the discovery request and sends address information of the device end, so that the application program of the user end responds to the address information and sends binding information to start the binding between the application program of the user end and the device, without too much operation of the user, and the automation degree is high. Moreover, the cloud server receives and verifies the address information and the binding information transmitted by the device end, to perform security verification on the user end and the device end, thereby effectively improving the security of the user end, the device end and the binding process of the user end and the device end.

[0211] Optionally, in the embodiment, the storage medium can include but is not limited to a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes. Optionally, in the embodiment, the processor executes the method steps recorded in the above embodiments according to the program codes stored in the storage medium. Optionally, the specific examples in the embodiment can refer to the examples described in the above embodiments and optional implementation manners, which will not be described here again. Obviously, those skilled in the art should understand that the modules or steps of the present disclosure described above can be realized by a general computing device, which can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. Optionally, they can be realized by program codes executable by the computing device, so that they can be stored in the storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in different order, or they can be manufactured into individual integrated circuit modules, or multiple modules or steps among them can be manufactured into a single integrated circuit module to realize. Thus, the present disclosure is not limited to any specific hardware and software combination.

[0212] In addition, although the exemplary embodiments have been described herein, the scope of their range includes any and all embodiments based on the present disclosure having equivalent elements, modifications, omissions, combinations (for example, solutions cross various embodiments), adaptations, or alterations. The elements in the claims are to be broadly interpreted based on the language adopted in the claims, and are not limited to the examples described in the specification or during the implementation of the present disclosure, and the examples are to be interpreted as non-exclusive. Therefore, the specification and examples are intended to be considered only as examples, and the true range and spirit are indicated by the following claims and the full range of equivalents thereof.

[0213] The above description is intended to be illustrative, and not restrictive. For example, the above-described examples (or one or more aspects thereof) can be used in combination with each other. Other embodiments can be used, which will be apparent to those of ordinary skill in the art upon reviewing the above description. Additionally, the various features described above can be grouped together or divided into separate features for the purpose of streamlining the disclosure. This should not be interpreted as requiring that the claimed subject matter require features that are in any way related to each other. Rather, the subject matter described herein can be one or any combination of the features described. The following claims, as well as the full scope of equivalents to which they are entitled, are intended to cover any and all such variations.

[0214] The above detailed description has shown, described, and pointed out the various embodiments of the disclosure. Based upon the disclosure and described above, various modifications and adaptations to the specific embodiments can be used and designed while remaining within the scope of the disclosure. These and further examples can be implemented, independently and separately, or any combination thereof.

Claims

1. A binding method, characterized by, Applied to a device end, comprising: After accessing a local area network at the device end, broadcast attribute information of the device end; Listen to a discovery request, and in response to the discovery request, send address information of the device end, wherein the address information comprises a device ID and an IP address of the device end, the discovery request is generated and sent by an application program of a user end in response to the attribute information, the device end and the user end are located in the same local area network; Obtain binding information, wherein the binding information is generated and sent by the application program of the user end in response to the address information, and the binding information comprises user identity information corresponding to the application program of the user end; Transmit the address information and the binding information to a cloud service end, Receive an encrypted ciphertext transmitted by the cloud service end based on the IP address, wherein the encrypted ciphertext is generated by the cloud service end based on the address information; Decrypt the encrypted ciphertext to obtain to-be-verified information; Return the to-be-verified information to the cloud service end, so that the cloud service end verifies the to-be-verified information and passes, and verifies the application program of the user end based on the binding information, to verify whether the device end can be bound by the application program; After receiving a verification result returned by the cloud service end, if the verification result represents that the device end can be bound by the application program, generate authentication information and send it to the application program, to complete the binding between the application program and the device end, wherein the authentication information is used to realize the interaction between the application program and the device end.

2. The binding method of claim 1, wherein, Generating authentication information and sending it to the application program, comprising: Based on port information included in the attribute information, generate a first credential, and send the first credential to the application program, wherein the first credential is used to call a port of the device end; Based on the user identity information of the user end, generate a second credential, and send the second credential to the application program, wherein the second credential is used for the device end to verify the user identity information, and the user identity information is obtained from the binding information by the cloud service end and returned to the device end.

3. The binding method of claim 1, wherein, At the same time of receiving the verification result returned by the cloud service end, further comprising: Receive a third credential returned by the cloud service end, wherein the third credential represents that the device end has access to the cloud service end; In the case that the third credential is invalid, retransmit the address information and the binding information to the cloud service end, so that the cloud service end re-generates a third credential; Receive the third credential re-generated by the cloud service end, and store it.

4. A binding method, characterized by, Applied to a cloud service end, comprising: Receive address information of a device end and binding information from the device end, wherein the address information comprises a device ID and an IP address of the device end, the binding information is generated by an application program of a user end, the binding information is generated after the device end accesses a local area network, and the binding information comprises user identity information corresponding to the application program of the user end; transmitting, to the device end, an encrypted ciphertext based on the IP address, wherein the encrypted ciphertext is generated by the cloud server based on the address information; receiving verification information returned by the device end, wherein the verification information is obtained by decrypting the encrypted ciphertext by the device end; verifying the verification information to determine whether the device end passes the verification; verifying the user end based on the binding information after determining that the device end passes the verification; generating a verification result in a case where both the device end and the user end pass the verification; returning the verification result to the device end, so that the device end completes the binding between the application program and the user end based on the verification result.

5. The binding method of claim 4, wherein, Further comprising: extracting a device ID in the address information; finding a corresponding device public key based on the device ID; generating the encrypted ciphertext based on the device public key.

6. The binding method of claim 5, wherein, After extracting the device ID in the address information, further comprising: querying a binding state of the device end based on the device ID; generating a prompt information in a case where the binding state of the device end is bound, and transmitting the prompt information to the user end; generating the encrypted ciphertext based on the device public key in a case where the binding state of the device end is unbound.

7. The binding method of claim 6, wherein, In a case where both the device end and the user end pass the verification, further comprising: updating the binding state of the device end.

8. The binding method of claim 4, wherein, Verifying the user end based on the binding information, comprising: extracting a fourth credential included in the binding information, wherein the fourth credential is generated and sent to the user end by the cloud server when logging into the application program; parsing the fourth credential to determine whether the user identity information included in the binding information passes the verification.

9. The binding method of claim 8, wherein, In a case where both the device end and the user end pass the verification, further comprising: generating a third credential based on the device ID included in the address information, wherein the third credential represents that the device end has the access right to the cloud server; sending the third credential to the device end based on the IP address in the address information.

10. The binding method of claim 8, wherein, In a case where both the device end and the user end pass the verification, further comprising: returning the user identity information to the device end, so that the device end generates authentication information, wherein the authentication information is used to realize the interaction between the application program and the device end.

11. A binding system characterized by comprising a user end and a device end located in the same local area network, and a cloud server; broadcasting attribute information of the device end by the device end after accessing the local area network; generating a discovery request by the user end through the application program in response to the attribute information; after listening to the discovery request, responding to the discovery request, and sending address information of the device end to the user end, wherein the address information comprises a device ID and an IP address of the device end; generating binding information by the user end through the application program in response to the address information, and sending the binding information to the device end, wherein the binding information comprises user identity information corresponding to the application program of the user end; The device end transmits the address information and the binding information to a cloud server end; The cloud server end transmits an encrypted ciphertext to the device end based on the IP address, wherein the encrypted ciphertext is generated by the cloud server end based on the address information; receives the to-be-verified information returned by the device end, wherein the to-be-verified information is obtained by the device end by decrypting the encrypted ciphertext; verifies the to-be-verified information to determine whether the device end passes the verification; after determining that the device end passes the verification, verifies the user end based on the binding information, obtains a verification result, and returns the verification result to the device end; After receiving the verification result returned by the cloud server end, if the verification result indicates that the device end can be bound by the application program, the device end generates authentication information and sends the authentication information to the application program to complete the binding between the application program and the device end; wherein the authentication information is used to realize the interaction between the application program and the device end.

12. A computer program product, storing a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 3 and 4 to 10.

13. A storage medium, characterized by The storage medium carries one or more computer programs, and the one or more computer programs are executed by the processor to implement the steps of the method of any one of claims 1 to 3 and 4 to 10.

Images