Internet of Things equipment access method and device, equipment, storage medium and program product

Abstract

The invention relates to an Internet of Things equipment access method and device, equipment, a storage medium and a program product. The method comprises the following steps: acquiring a first access credential preset in the local of target Internet of Things equipment under the condition that an initial access condition is met; establishing a first connection with a proxy server in a message queue telemetry transmission (MQTT) architecture based on the first access credential, and after the first connection is established, sending a target activation request to a management platform in the MQTT architecture through the proxy server, the target activation request being used for indicating the management platform to generate a second access credential; receiving a second access credential generated by the management platform through the proxy server; and disconnecting the first connection, and establishing a second connection with the proxy server based on the second access credential, the information access authority corresponding to the second connection being greater than the information access authority corresponding to the first connection. By adopting the method, the security of equipment access can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security authentication, and in particular to an Internet of Things device access method, device, equipment, storage medium and program product. BACKGROUND

[0002] With the popularity of Internet of Things technology, the Message Queuing Telemetry Transport (MQTT) protocol is widely used in the Internet of Things because it can efficiently transmit information between devices. The MQTT architecture includes Internet of Things devices, proxy servers and management platforms. The proxy server is configured with multiple topics, each different topic is used to store different types of sensor data, and the Internet of Things devices and the management platform can transmit data to each other through the proxy server based on a subscription-published mechanism. Specifically, the Internet of Things devices can publish data to a topic, and the management platform receives data by subscribing to the corresponding topic, or the management platform can publish data to a topic, and the Internet of Things devices receive data by subscribing to the corresponding topic. In actual applications, the Internet of Things devices need to access the proxy server before they can publish or receive data.

[0003] In related technologies, access credentials can be pre-installed in the Internet of Things devices, which include an access account and a password. The Internet of Things devices can access the proxy server through the access credentials.

[0004] However, there is a risk of leakage of pre-installed access credentials. For example, an attacker can access the proxy server by stealing the pre-installed access credentials and attack the proxy server or steal the data stored in the proxy server. Therefore, the security of the existing access method needs to be improved. SUMMARY

[0005] Therefore, it is necessary to provide an Internet of Things device access method, device, equipment, storage medium and program product that can improve access security to solve the above technical problems.

[0006] In a first aspect, the present application provides an Internet of Things device access method for a target Internet of Things device, comprising:

[0007] When the initial access condition is met, a first access credential pre-installed locally in the target Internet of Things device is obtained;

[0008] A first connection is established between the first access credential and a proxy server in a Message Queuing Telemetry Transport (MQTT) architecture, and after the first connection is established, a target activation request is sent to a management platform in the MQTT architecture through the proxy server, the target activation request being used to instruct the management platform to generate a second access credential;

[0009] receiving, by the proxy server, the second access credential generated by the management platform;

[0010] disconnecting the first connection, and establishing a second connection with the proxy server based on the second access credential, the second connection corresponding to information access authority greater than that of the first connection.

[0011] In one of the embodiments, the information access authority corresponding to the first connection includes the access authority to an active topic in the proxy server, the active topic being used to store an activation request sent by the IoT device and for the management platform to subscribe to, the target activation request being sent to the management platform in the MQTT architecture through the proxy server, comprising:

[0012] storing the target activation request in the active topic in the proxy server for the management platform to obtain the target activation request from the active topic based on the subscription to the active topic.

[0013] In one of the embodiments, the information access authority corresponding to the second connection includes the access authority to a business topic in the proxy server, the business topic being used to store the sensing data sent by the IoT device.

[0014] In one of the embodiments, the method further comprises:

[0015] after the second connection is established, sending the sensing data collected by the target IoT device to the business topic for storage, so that the management platform obtains the sensing data from the business topic based on the subscription to the business topic.

[0016] In one of the embodiments, the method further comprises:

[0017] obtaining the activation state of the target IoT device, the activation state being used to indicate whether the target IoT device receives the second access credential sent by the management platform;

[0018] when the activation state is the inactivated state, determining that the initial access condition is met.

[0019] In one of the embodiments, the method further comprises:

[0020] after the second connection is established based on the second access credential, modifying the activation state of the target IoT device to the activated state.

[0021] In one of the embodiments, the method further comprises:

[0022] when the activation state is the activated state, obtaining the second access credential stored locally by the target IoT device;

[0023] establishing the second connection with the proxy server based on the second access credential.

[0024] In one embodiment, the method further comprises:

[0025] receiving, by the proxy server, an offline notification sent by the management platform;

[0026] performing an offline operation in response to the offline notification;

[0027] wherein the offline operation comprises disconnecting the second connection, deleting the second access credential locally stored by the target IoT device, and modifying the activation state of the target IoT device to an unactivated state.

[0028] In a second aspect, the present application further provides an IoT device access method for a proxy server in an MQTT architecture, comprising:

[0029] establishing a first connection with a target IoT device based on a first access credential, and after the establishment of the first connection, receiving a target activation request sent by the target IoT device, and sending the target activation request to a management platform in the MQTT architecture, the activation request being used to instruct the management platform to generate a second access credential;

[0030] receiving the second access credential generated by the management platform, and sending the second access credential to the target IoT device;

[0031] disconnecting the first connection, and establishing a second connection with the target IoT device based on the second access credential, the information access authority corresponding to the second connection being greater than the information access authority corresponding to the first connection.

[0032] In one embodiment, establishing a first connection with a target IoT device based on a first access credential comprises:

[0033] verifying the first access credential according to a target credential library to determine a first verification result, the target credential library being used to include a plurality of corresponding relationships of access credentials and information access authorities;

[0034] in a case where the first verification result is a verification pass, establishing the first connection with the target IoT device according to the first access credential, and obtaining a first target information access authority corresponding to the first access credential;

[0035] taking the first target information access authority as the information access authority corresponding to the first connection.

[0036] In one embodiment, establishing a second connection with a target IoT device based on a second access credential comprises:

[0037] verifying the second access credential according to a target credential library to determine a second verification result;

[0038] In a case where the second verification result is a verification pass, a second connection is established according to the second access credential and the target Internet of Things device, and a second target information access permission corresponding to the second access credential is acquired;

[0039] The second target information access permission is taken as an information access permission corresponding to the second connection.

[0040] In a third aspect, the present application further provides an Internet of Things device access apparatus, which is arranged in a target Internet of Things device, and comprises:

[0041] An acquisition module, configured to acquire a first access credential pre-stored in the target Internet of Things device locally in a case where an initial access condition is met;

[0042] A first connection module, configured to establish a first connection with a broker server in an MQTT architecture based on the first access credential, and send a target activation request to a management platform in the MQTT architecture through the broker server after the first connection is established, the target activation request being used to instruct the management platform to generate a second access credential;

[0043] A receiving module, configured to receive the second access credential generated by the management platform through the broker server;

[0044] A second connection module, configured to disconnect the first connection, and establish a second connection with the broker server based on the second access credential, an information access permission corresponding to the second connection being greater than an information access permission corresponding to the first connection.

[0045] In a fourth aspect, the present application further provides an Internet of Things device access apparatus, which is arranged in a broker server in an MQTT architecture, and comprises:

[0046] A first connection module, configured to establish a first connection with a target Internet of Things device based on a first access credential, and receive a target activation request sent by the target Internet of Things device after the first connection is established, and send the target activation request to a management platform in the MQTT architecture, the target activation request being used to instruct the management platform to generate a second access credential;

[0047] A receiving module, configured to receive the second access credential generated by the management platform, and send the second access credential to the target Internet of Things device;

[0048] A second connection module, configured to disconnect the first connection, and establish a second connection with the target Internet of Things device based on the second access credential, an information access permission corresponding to the second connection being greater than an information access permission corresponding to the first connection.

[0049] In a fifth aspect, the present application further provides an Internet of Things device, comprising a memory and a processor, the memory stores a computer program, and the processor implements the method of any one of the first aspect when executing the computer program.

[0050] In a sixth aspect, the present application also provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the method of any one of the second aspect when executing the computer program.

[0051] In a seventh aspect, the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method of any one of the first aspect or the second aspect.

[0052] In an eighth aspect, the present application also provides a computer program product comprising a computer program, and the computer program is executed by a processor to implement the method of any one of the first aspect or the second aspect.

[0053] The above Internet of Things device access method, device, equipment, storage medium and program product, by acquiring the first access credential pre-stored in the local target Internet of Things device under the condition of meeting the initial access condition; based on the first access credential and the proxy server in the Message Queue Telemetry Transport (MQTT) architecture, a first connection is established, and after the first connection is established, the target activation request is sent to the management platform in the MQTT architecture through the proxy server, and the target activation request is used to instruct the management platform to generate a second access credential; the second access credential generated by the management platform is received through the proxy server; the first connection is disconnected, and the second connection is established based on the second access credential and the proxy server, and the information access authority corresponding to the second connection is greater than the information access authority corresponding to the first connection. In this way, when the target Internet of Things device is put into use, the second access credential special for the target Internet of Things device is dynamically generated through the management platform, more topics in the proxy server are accessed through the second access credential, the risk of credential leakage caused by the pre-stored access credential is avoided, and the access security of the Internet of Things device is improved. At the same time, the access credential does not need to be manually configured, the high cost and low efficiency caused by manual configuration are avoided, the credential is more avoided to be leaked in the process of manual configuration and maintenance, and the access security of the Internet of Things device is improved. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technical solutions, the drawings needed to be used in the description of the embodiments of the present application or the related technical solutions will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other related drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0055] Figure 1 An application environment diagram of the Internet of Things device access method in an embodiment;

[0056] Figure 2 Flowchart of the method for accessing the Internet of Things device in one embodiment;

[0057] Figure 3 Flowchart of the method for accessing the Internet of Things device in another embodiment;

[0058] Figure 4 Flowchart of the method for accessing the Internet of Things device in another embodiment;

[0059] Figure 5 Flowchart of the method for accessing the Internet of Things device in another embodiment;

[0060] Figure 6 Flowchart of the method for accessing the Internet of Things device in another embodiment;

[0061] Figure 7 Flowchart of the method for accessing the Internet of Things device in another embodiment;

[0062] Figure 8 Flowchart of the method for accessing the Internet of Things device in another embodiment;

[0063] Figure 9 Flowchart of the method for accessing the Internet of Things device in another embodiment;

[0064] Figure 10 Flowchart of the method for accessing the Internet of Things device in one embodiment;

[0065] Figure 11 Flowchart of the method for accessing the Internet of Things device in one embodiment;

[0066] Figure 12 Structure block diagram of the device for accessing the Internet of Things device in one embodiment;

[0067] Figure 13 Structure block diagram of the device for accessing the Internet of Things device in another embodiment;

[0068] Figure 14 Structure diagram of the Internet of Things device in one embodiment

[0069] Figure 15 Structure diagram of the computer device in one embodiment. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0071] With the popularity of Internet of Things technology, Message Queue Telemetry Transport (MQTT) protocol is widely used in Internet of Things because it can efficiently transmit information between devices. The MQTT architecture includes Internet of Things devices, a broker server and a management platform. The broker server is configured with multiple topics, each different topic is used to store different types of sensor data, and the Internet of Things devices and the management platform can transmit data to each other through the broker server based on a subscription-published mechanism. Specifically, the Internet of Things devices can publish data to a topic, and the management platform receives data by subscribing to the corresponding topic, or the management platform can publish data to a topic, and the Internet of Things devices receive data by subscribing to the corresponding topic. In actual application, the Internet of Things devices need to access the broker server before they can publish or receive data.

[0072] In related technologies, an access credential can be pre-installed in the Internet of Things device, the access credential includes an access account and a password, and the Internet of Things device can access the broker server through the access credential.

[0073] However, the pre-installed access credential has a risk of leakage. For example, an attacker can access the broker server by stealing the pre-installed access credential, and attack the broker server or steal the data stored in the broker server. Therefore, the security of the existing access method needs to be improved.

[0074] It should be noted that the beneficial effects or technical problems solved by the embodiments of the present application are not limited to this, but also other implicit or related problems. For details, please refer to the description of the following embodiments.

[0075] Please refer to Figure 1 , which shows an application scenario of a method for accessing an Internet of Things device provided by an embodiment of the present application. As Figure 1 shown, the application scenario can include an Internet of Things device 10, a broker server 20 in a Message Queue Telemetry Transport (MQTT) architecture, and a management platform 30 in the MQTT architecture. The Internet of Things device 10 includes a state management module 101, a client management module 102 in the MQTT architecture, and a storage module 103. The management platform 30 includes a management platform backend service 301 and a management platform frontend service 302. The Internet of Things device 10 can establish a connection with the broker server 20 based on the client management module 102, and after the connection is established, the Internet of Things device 10 transmits data to the management platform 30 through the broker server 20.

[0076] Exemplarily, as Figure 1As shown, the state management module 101 in the Internet of Things device 10 is configured to record the state information of the device, such as an activation state (an activated state or a non-activated state), to determine whether the initial access condition is met according to the state information of the device, and to determine the corresponding access mode; the storage module 103 includes a secure storage module and a normal storage module, the secure storage module is configured to securely store the second access credential, and has the capability of anti-reading and anti-tampering; the normal storage module is configured to store the preset first access credential; the client management module 102 is configured to perform MQTT connection, publishing, and subscription operations according to the access credential, and to process the sending and receiving of an activation request and a response and decryption when the access credential is the first access credential.

[0077] The proxy server 20 can include a core management and message routing module 201 and an authentication module 202, wherein the core management and message routing module 201 is configured to process MQTT connection, authentication, message routing, and distribution. The authentication module 202 includes an authentication plug-in / interface, which is configured to connect to a target credential library or a platform API, and verify the validity and authority of the access credential provided by the target Internet of Things device when connecting.

[0078] The management platform backend service 301 includes a device management module, a credential management module, and a storage module, wherein the device management module is configured to subscribe to a topic in the proxy server 20, receive and parse the device identifier and other information reported by the target Internet of Things device, send a list of devices to be activated to the management platform frontend, receive an approval instruction input by an administrator through the management platform frontend, and trigger the credential management module to work. The credential management module is configured to dynamically generate a unique and strongly secure second access credential when the device is approved, bind the generated second access credential, a device identifier, and a permission policy, and securely store them in a target credential library, construct an activation response message containing the second access credential, and encrypt the activation response message. The encrypted response message is published to an activation topic corresponding to the target Internet of Things device. The storage module is configured to store the target credential library, which stores the second access credentials of all activated devices.

[0079] The management platform frontend 302 includes an approval interface and a device list interface, the approval interface is configured to show the administrator a list of devices to be activated, receive an approval instruction input by the administrator, and make an activation approval decision based on the device information to be approved; the device list interface is configured to display the state of all Internet of Things devices and receive business operations or Internet of Things device offline operations.

[0080] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail in the following specific embodiments. The following several specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0081] In one example embodiment, as shown in Figure 2 A method for accessing an IoT device is provided, which is applied to the IoT device 10 in Figure 1 The method includes the following steps 201-204. In which:

[0082] Step 201, in the case of meeting the initial access condition, obtaining the first access credential pre-stored in the local of the target IoT device.

[0083] In which, the target IoT device can be any one of the IoT devices in Figure 1

[0084] Optionally, the target IoT device can determine whether the initial access condition is met by obtaining the state information of the target IoT device, and determining the initial access condition according to the state information. The target IoT device can also obtain the locally stored access credentials, and determine whether the initial access condition is met according to the number or type of the stored access credentials.

[0085] In one possible implementation, when determining whether the initial access condition is met according to the state information of the target IoT device, the state information can include the activation state of the target IoT device, which is used to indicate whether the target IoT device has received the second access credential sent by the management platform. The activation state of the target IoT device can include an activated state and an unactivated state.

[0086] For example, the activation state of the target IoT device is obtained, and when the activation state is the unactivated state, it is determined that the initial access condition is met. When the activation state is the activated state, it is determined that the initial access condition is not met.

[0087] The way in which the target IoT device accesses the proxy server when the activation state is the activated state will be described in the following embodiments.

[0088] In another possible implementation, when determining whether the initial access condition is met according to the state information of the target IoT device, the state information can also include the historical access state of the target IoT device, which includes the access result of the target IoT device when accessing the proxy server last time. The access result can include access success and access failure.

[0089] For example, the historical access state of the target IoT device is obtained, and when the historical access state is the access success, it is determined that the initial access condition is not met. When the historical access state is the access identification, it is determined that the initial access condition is met.

[0090] ​In another possible implementation, when determining whether the initial access condition is met according to the number or type of the stored access credentials, the access credentials stored locally by the target IoT device can include preset first access credentials and second access credentials generated by the management platform.

[0091] For example, the number or type of the locally stored access credentials can be acquired, and when the number of the access credentials is 1, it is determined that the initial access condition is met, or when the number of the access credentials is 1 and the type of the access credentials is the preset first access credentials, it is determined that the initial access condition is met. When the number of the access credentials is not 1, it is determined that the initial access condition is not met, or when the type of the access credentials in the access credentials is the second access credentials generated by the management platform, it is determined that the initial access condition is not met.

[0092] Optionally, the first access credentials preset in the local storage of the target IoT device can be acquired when it is determined that the target IoT device meets the initial access condition.

[0093] The first access credentials can be fixed credentials, which are preset in the local storage of the target IoT device before the target IoT device is shipped, and the first access credentials include default login user information and passwords. The first access credentials of each IoT device can be the same, or the first access credentials of each IoT device can be different, which is not limited in the embodiments of the present application.

[0094] It can be understood that, since the first access credentials are preset in the local storage of the target IoT device, there is a risk of credential leakage. Therefore, in the embodiments of the present application, the information access permission corresponding to the first access credentials is controlled, and the first access credentials are credentials with limited information access permission. After the target IoT device establishes a connection with the proxy server based on the first access credentials, it can only access part of the topics in the proxy server.

[0095] In step 202, a first connection is established between the first access credentials and a proxy server in a Message Queue Telemetry Transport (MQTT) architecture, and after the first connection is established, a target activation request is sent to a management platform in the MQTT architecture through the proxy server.

[0096] The target activation request is used to instruct the management platform to generate second access credentials.

[0097] Optionally, after the preset first access credentials are acquired, the target IoT device can establish a first connection with the proxy server according to the first access credentials, and the target IoT device can access part of the topics in the proxy server through the first connection.

[0098] For example, the target IoT device can send a first connection request to the proxy server based on the first access credential. The target IoT device and the proxy server can connect via Transport Layer Security (TLS), that is, an encrypted communication channel is established between the target IoT device and the proxy server, and the first connection request is sent through the encrypted communication channel.

[0099] Upon receiving the first connection request, the proxy server can compare the received first access credential with a pre-set restricted credential in the proxy server. If the first access credential matches the pre-set restricted credential, a first connection is established with the target IoT device. Alternatively, after receiving the first access credential, the proxy server can obtain a target credential database and verify the first access credential against the database to determine a first verification result. The target credential database contains multiple sets of correspondences between access credentials and information access permissions. If the first access credential exists in the target credential database, the first verification result is determined to be successful.

[0100] Optionally, the target credential repository may be stored in the database or cache (e.g., Redis) of the proxy server, or in the database or cache (Redis) of the management platform. This application embodiment does not limit this.

[0101] If the first verification result is successful, the proxy server establishes a first connection with the target IoT device and obtains the first target information access permission corresponding to the first access credential in the target credential library, and uses the first target information access permission as the information access permission corresponding to the first connection.

[0102] Optionally, after the first connection is established, the target IoT device can send a target activation request to a subset of topics that it has access to on the proxy server, and the management platform can receive the target activation request by subscribing to the corresponding subset of topics.

[0103] For example, after the management platform and the target IoT device subscribe to a portion of the topics corresponding to the first connection in the proxy server, they cannot access business data and will not perform other business processing.

[0104] Optionally, upon receiving a target activation request, the management platform can generate a second access credential based on the request. The second access credential carries greater access permissions than the first access credential. The second access credential includes login user information (Client ID) and a password. The login user information in the second access credential is associated with the device identification information of the target IoT device. Different IoT devices will have different login user information and passwords in their second access credentials. Therefore, even if the second access credential corresponding to the target IoT device is leaked, it will not affect other IoT devices.

[0105] Step 203: Receive the second access credential generated by the management platform through the proxy server.

[0106] Optionally, after generating the second access credential, the management platform can send the second access credential to the relevant topics in the proxy server that the target IoT device has access to. Since the target IoT device has previously established a first connection with the proxy server, it can receive the second access credential from the subscribed topics.

[0107] It is understandable that when receiving the second access credential generated by the management platform through the proxy server, sending the target activation request and obtaining the second access credential can be asynchronous. The target IoT device can obtain the corresponding second access credential from the proxy server in a weak network environment or after the network is restored.

[0108] Optionally, when the management platform sends the second access credential to the proxy server, it can encrypt the second access credential or send it through an encrypted channel to prevent the second access credential from being stolen during the transmission process.

[0109] Furthermore, after receiving the encrypted second access credential, the target IoT device can decrypt it to obtain the second access credential and store it in local secure storage.

[0110] Storing the second access credential in secure storage can improve its security, integrity, and availability, and prevent it from being leaked or tampered with.

[0111] Step 204: Disconnect the first connection and establish a second connection with the proxy server based on the second access credential. The information access permissions corresponding to the second connection are greater than those corresponding to the first connection.

[0112] Optionally, after receiving the second access credential, the target IoT device can disconnect the first connection and then re-establish a second connection with the proxy server based on the second access credential.

[0113] For example, the target IoT device sends a second connection request to the proxy server based on the second access credential, the second connection request including the second access credential. Upon receiving the second connection request, the proxy server can obtain the target credential database and verify the second access credential against the database to determine a second verification result. The target IoT device then connects to the proxy server via TLS based on the second access credential.

[0114] It is understandable that after generating a second access credential, the management platform can store the generated second access credential in the target credential database, or the proxy server can store the second access credential in the target credential database after receiving it from the management platform.

[0115] Specifically, if a second access credential exists in the target credential repository, the second verification result can be determined as successful. Next, with the second verification result successful, the proxy server establishes a second connection with the target IoT device and simultaneously obtains the second target information access permission corresponding to the second access credential in the target credential repository, using this second target information access permission as the information access permission corresponding to the second connection.

[0116] For example, the target credential repository can store the second access credentials, device identification information, and information access permissions corresponding to each second access credential of all activated IoT devices. The target credential repository can be queried based on the second access credential in the second connection request. If the login user information in the second access credential exists in the target credential repository, and the password corresponding to the login user information in the target credential repository is the same as the password in the second access credential, and the device identification information corresponding to the login user information in the target credential repository is the same as the device identification information of the target IoT device, the second verification result is determined to be successful.

[0117] After the second connection is established, the target IoT device and management platform can transmit business data through the topic corresponding to the second connection in the proxy server.

[0118] Under the condition that the initial access conditions are met, a first access credential pre-installed locally on the target IoT device is obtained. Based on this first access credential, a first connection is established with the proxy server in the Message Queuing Telemetry Transmission (MQTT) architecture. After the first connection is established, a target activation request is sent to the management platform in the MQTT architecture through the proxy server. This target activation request instructs the management platform to generate a second access credential. The second access credential generated by the management platform is received through the proxy server. The first connection is closed, and a second connection is established with the proxy server based on the second access credential. The information access permissions corresponding to the second connection are greater than those corresponding to the first connection. This allows the management platform to dynamically generate a second access credential specific to the target IoT device when it is put into use. This second access credential allows access to more topics on the proxy server, avoiding the risk of credential leakage associated with pre-installed access credentials and improving the access security of IoT devices. Furthermore, no manual configuration of access credentials is required during access, avoiding the high costs and inefficiencies of manual configuration and further preventing credential leakage during manual configuration and maintenance, thus improving the access security of IoT devices.

[0119] In an exemplary embodiment, optionally, the information access permissions corresponding to the first connection include access to the activation topic in the proxy server. The activation topic is used to store activation requests sent by IoT devices and is available for subscription by the management platform. Sending the target activation request to the management platform in the MQTT architecture through the proxy server includes:

[0120] The target activation request is sent to the activation topic in the proxy server for storage, so that the management platform can retrieve the target activation request from the activation topic based on the subscription to the activation topic.

[0121] Optionally, if the access permissions for the active topic in the proxy server are low, or if no access permissions are set for the active topic, the target IoT device can access the active topic and publish data to the active topic after the target IoT device establishes the first connection with the proxy server, so that the active topic can store the published data.

[0122] Optionally, after receiving the target activation request, the management platform can first verify the legitimacy of the target IoT device based on the target activation request, and after verifying that the target IoT device is a legitimate device, it can generate a second access credential.

[0123] The target activation request may carry device information of the target IoT device, including device identification information and device installation location information.

[0124] For example, after receiving a target activation request, the access management platform can send the device information in the target activation request to the administrator for review, and determine the legitimacy of the target IoT device based on the review result received from the administrator. Alternatively, the device information in the target activation request can be input into a pre-trained neural network model to determine the legitimacy of the target IoT device based on the neural network model.

[0125] For example, device identification information, device installation location information, procurement information, device type, firmware version information, etc., can be sent to the administrator so that the administrator can verify the legitimacy of the target IoT device based on the device information. Historical decommissioning information of the target IoT device can also be obtained, including the decommissioning time and reason. This historical decommissioning information can be referenced when the administrator verifies or the neural network model determines the legitimacy of the target IoT device.

[0126] When the management platform generates a second access credential based on a target activation request including device identification information, it can provide precise authorization at the single device level and manage each IoT device in a large-scale IoT device network with fine granularity.

[0127] For example, when a water company needs to monitor sensor data from various IoT devices (such as pressure sensors, water quality analyzers, smart valves, etc.) deployed outdoors / underground, it needs to connect the IoT devices to a proxy server to transmit data between the IoT devices and the management platform. In this application scenario, an example of a possible activation topic and the message format for sending data to the activation topic is provided.

[0128] For example, the activation topic in the proxy server can be: water / provision / . When the target IoT device sends a target activation request to the activation topic, the message format can be as follows:

[0129] Subject: "water / provision / request / SN_PS5001"

[0130] Original load:

[0131] {

[0132] "sn": "SN_PS5001",

[0133] "mac": "00:1B:44:11:3A:E7",

[0134] "vendor": "Vendor_A2",

[0135] "loc": "Well A-07",

[0136] "type": "pressure",

[0137] "fw_ver": "V2.1.5"

[0138] }

[0139] Wherein, sn represents the unique device identifier of the target IoT device, such as the device serial number, mac represents the MAC address of the target IoT device, vendor represents the manufacturer identifier of the target IoT device, loc represents the installation location information of the target IoT device, type represents the device type of the target IoT device, and fw_ver represents the firmware version of the target IoT device.

[0140] When the management platform sends the second access credential to the activated topic, the message format can be exemplarily as follows:

[0141] Subject: "water / provision / response / SN_PS5001"

[0142] Original load:

[0143] {

[0144] "cid": "ps_5001_9fE3",

[0145] "pwd": ""Rt!8kLp*Qaz...",

[0146] "expire": "1735667200"

[0147] }

[0148] Wherein, cid represents the login user information of the target IoT device in the second access credential, which is related to the unique device identifier of the target IoT device; pwd is the password of the target IoT device, which can be the encrypted text of the password; and expire represents the expiration time of the second access credential, which can be determined according to the user configuration whether to include the expiration time.

[0149] Understandably, when the second access credential includes an expiration time, and the second target IoT device establishes a second connection with the proxy server based on the second access credential, the proxy server needs to verify not only the accuracy of the second access credential but also its validity.

[0150] The aforementioned method sends the target activation request to the activation topic stored in the proxy server. This allows the management platform to retrieve the target activation request from the activation topic based on its subscription. Alternatively, the proxy server can be accessed first using a pre-set first access credential, and then an activation request can be sent to the activation topic to obtain a second access credential dynamically generated by the management platform. This avoids the risk of credential leakage associated with pre-set access credentials and improves the access security of IoT devices.

[0151] In one exemplary embodiment, the IoT device access method may optionally further include:

[0152] After establishing the second connection, the sensor data collected by the target IoT device is sent to the business topic for storage, so that the management platform can obtain sensor data from the business topic based on the subscription to the business topic.

[0153] The information access permissions corresponding to the second connection include the permission to access the business topics in the proxy server, which are used to store sensor data sent by IoT devices.

[0154] Optionally, after the target IoT device establishes a second connection with the proxy server based on the second access credential, the target IoT device can either publish sensor data to the business topic or subscribe to the business topic to receive business data in the business topic.

[0155] Below, we will provide an example of a possible business topic and the message format for sending data to that business topic.

[0156] For example, the business topic in the proxy server could be: water / data / . When the target IoT device sends sensor data to the business topic, the business topic can also include the target IoT device's login user information and the type of sensor data. Taking the sensor data as stress data as an example, the message format can be as follows:

[0157] Subject: "water / data / ps_5001_9fE3 / pressure"

[0158] Original load:

[0159] {

[0160] "value": 0.38,

[0161] "unit": "MPa",

[0162] "timestamp": 1718100234

[0163] }

[0164] The original load includes pressure data, where value represents the corresponding pressure value, unit represents the pressure unit, and timestamp represents the timestamp when the target IoT device reports the sensor data.

[0165] After establishing the second connection, the sensor data collected by the target IoT device is sent to the business topic for storage. The management platform can then retrieve the sensor data from the business topic based on its subscription and access different topics in the proxy server according to different types of access credentials. This isolation of topics in the proxy server ensures the security of the data in the proxy server.

[0166] In an exemplary embodiment, optionally, when determining whether the initial access conditions are met based on the activation state of the target IoT device in step 201 above, the IoT device access method further includes:

[0167] After establishing a second connection with the proxy server based on the second access credential, the activation status of the target IoT device is changed to "activated".

[0168] Optionally, after the target IoT device establishes a second connection with the proxy server, it indicates that the target IoT device can send the sensor data collected by the target IoT device to the business subject and carry out normal data transmission with the management platform. At this time, the target IoT device has successfully accessed the proxy server, and the corresponding activation status can be changed to the activated status.

[0169] After successful access, the activation status of the target IoT device is modified. When the target IoT device disconnects from the proxy server due to offline or power-off conditions and needs to access the proxy server again, the corresponding access credential can be determined based on the activation status to avoid frequently generating a second access credential.

[0170] When the activation state is "activated," meaning the target IoT device does not meet the initial access conditions, optionally, as follows: Figure 3 As shown, the IoT device access method further includes steps 301 to 302. Wherein:

[0171] Step 301: When the activation state is activated, obtain the second access credential stored locally on the target IoT device.

[0172] Optionally, as can be seen from the above embodiments, after the target IoT device obtains the second access credential generated by the management platform through the proxy server, the second access credential can be stored in the local storage of the target IoT device so that it can directly establish a second connection with the proxy server based on the second access credential next time, without having to repeat the access steps in steps 201 to 204 above.

[0173] Step 302: Establish a second connection with the proxy server based on the second access credential.

[0174] The specific description of step 302 can be found in step 204, and will not be repeated here.

[0175] The above embodiments provide an exemplary description of scenarios where the activation state is modified to an activated state. Since the activation state also includes an inactive state, the following provides an exemplary description of scenarios where the activation state is modified to an inactive state. In one exemplary embodiment, optionally, as... Figure 4 As shown, the IoT device access method further includes steps 401 to 402. Wherein:

[0176] Step 401: Receive the offline notification sent by the management platform through the proxy server.

[0177] Optionally, the target IoT device can receive offline notifications from the management platform by subscribing to a business topic in the proxy server or any other topic corresponding to the second access credential.

[0178] For example, when maintenance is required on a target IoT device, the administrator can send a shutdown command to the management platform through the terminal. The shutdown command carries the device identification information of the target IoT device, and the management platform can send a shutdown notification to the command topic according to the shutdown command.

[0179] At the same time, the management platform will delete the second access credential corresponding to the target IoT device from the target credential repository.

[0180] For example, the corresponding command topic could be: water / command / . When the management platform sends an offline notification to this command topic, the message format can be as follows:

[0181] Subject: "water / command / ps_5001_9fE3"

[0182] Original load:

[0183] {

[0184] "cmd": "deactivate",

[0185] "reason": "security_alert",

[0186] "timestamp": 1718100456,

[0187] "sign": "sha256(...)"

[0188] }

[0189] Here, cmd represents the command type, deactivate represents deactivation, reason represents the reason for deactivation, timestamp represents the timestamp when the deactivation command was sent, and sign represents the command signature.

[0190] Step 402: Execute the offline operation in response to the offline notification.

[0191] The offline operation includes disconnecting the second connection, deleting the second access credential stored locally on the target IoT device, and changing the activation status of the target IoT device to an inactive status.

[0192] Optionally, after receiving the offline notification, the target IoT device can disconnect the second connection with the proxy server, delete the locally stored second access credential, and change the activation status of the target IoT device to the inactive status to prevent the target IoT device from re-establishing the second connection based on the stored second access credential after disconnecting the second connection.

[0193] In addition to changing the activation status to inactive upon receiving a shutdown notification, the target IoT device can also change the activation status to inactive after failing to establish a second connection with the proxy server based on the second access credential.

[0194] For example, if the second access credential has an expiration time, the second access credential becomes unusable after the corresponding expiration time. At this time, when the target IoT device connects to the proxy server based on the second access credential, the connection fails. The activation status needs to be changed to the inactive status, and steps 201 to 204 above need to be repeated until the device successfully connects to the proxy server.

[0195] As an optional implementation method, such as Figure 5 As shown in the embodiments of this application, the IoT device access method may include the following specific steps: After the target IoT device is started, it obtains the device activation status. When the device activation status is inactive, it obtains a first access credential from local storage, establishes a first connection with a proxy server based on the first access credential, subscribes to an activation topic, and sends a target activation request to the activation topic to receive a second access credential generated by the management platform through the proxy server. The device activation status is then modified to activated, the second access credential is securely stored, a second connection is established with the proxy server based on the second access credential, a service topic is subscribed to, and data is transmitted with the management platform based on the service topic. When the device activation status is activated, it obtains a second access credential from local storage, establishes a second connection with the proxy server based on the second access credential, subscribes to a service topic, and transmits data with the management platform based on the service topic.

[0196] In one exemplary embodiment, such as Figure 6 As shown, an IoT device access method is provided. Taking the application of this method to a proxy server in a Message Queue Telemetry Transmission (MQTT) architecture as an example, the method includes the following steps 601 to 603. Wherein:

[0197] Step 601: Establish a first connection with the target IoT device based on the first access credential, and after the first connection is established, receive the target activation request sent by the target IoT device and send the target activation request to the management platform in the MQTT architecture.

[0198] The activation request is used to instruct the management platform to generate a second access credential.

[0199] Step 602: Receive the second access credential generated by the management platform and send the second access credential to the target IoT device.

[0200] Step 603: Disconnect the first connection and establish a second connection with the target IoT device based on the second access credential. The information access permissions corresponding to the second connection are greater than those corresponding to the first connection.

[0201] In one exemplary embodiment, such as Figure 7 As shown, optionally, establishing a first connection with the target IoT device based on a first access credential includes the following steps 701 to 703. Wherein:

[0202] Step 701: Verify the first access credential based on the target credential database and determine the first verification result. The target credential database is used to include multiple sets of correspondences between access credentials and information access permissions.

[0203] Step 702: If the first verification result is successful, establish a first connection with the target IoT device based on the first access credential and obtain the first target information access permission corresponding to the first access credential.

[0204] Step 703: Use the first target information access permission as the information access permission corresponding to the first connection.

[0205] In one exemplary embodiment, such as Figure 8 As shown, optionally, establishing a second connection with the target IoT device based on a second access credential includes the following steps 801 to 803. Wherein:

[0206] Step 801: Verify the second access credential based on the target credential database and determine the second verification result.

[0207] Step 802: If the second verification result is successful, establish a second connection with the target IoT device based on the second access credential and obtain the second target information access permission corresponding to the second access credential.

[0208] Step 803: Use the second target information access permission as the information access permission corresponding to the second connection.

[0209] Optionally, such as Figure 9 As shown, the proxy server can handle the following types of connection requests and message requests:

[0210] 1) The first connection request sent from the target IoT device returns a CONNACK message response and indicates that the topic is restricted after the first access credential in the first connection request is verified; otherwise, it returns a verification failure message.

[0211] 2) Target activation requests sent from IoT devices are sent to the management platform for processing.

[0212] 3) The second connection request sent from the target IoT device is verified against the second access credential in the second connection request according to the target credential library, and a message response is returned.

[0213] 4) The second access credential is sent from the management platform and stored.

[0214] 5) Upon successful verification of the second access credential sent from the management platform, a response message is returned, and the access permissions for the corresponding connection are extended.

[0215] 6) Offline notification sent from the management platform: Send an offline notification to the target IoT device.

[0216] The specific implementation method in this embodiment has been described in detail in the above-mentioned method embodiment on the target IoT device side, and will not be repeated here.

[0217] As an optional implementation method, such as Figure 10 As shown, the IoT device access method provided in this application embodiment may include: a service provider user evaluation method may be as follows: Figure 10 As shown, IoT device activation includes the following steps 1001 to 10, wherein:

[0218] Step 1001: When the target IoT device starts up, it obtains its activation status.

[0219] The activation status indicates whether the target IoT device has received the second access credential sent by the management platform.

[0220] Step 1002: When the activation state is inactive, the target IoT device is determined to meet the initial access conditions.

[0221] Step 1003: The target IoT device obtains the first access credential pre-installed locally on the target IoT device.

[0222] Step 1004: The target IoT device establishes a first connection with the proxy server based on the first access credential.

[0223] Step 1005: The proxy server verifies the first access credential based on the target credential database. If the verification is successful, it establishes the first connection with the target IoT device.

[0224] Step 1006: After establishing the first connection, the target IoT device sends a target activation request to the activation topic in the proxy server.

[0225] Step 1007: The proxy server sends the received target activation request to the management platform.

[0226] The target activation request is used to instruct the management platform to generate a second access credential.

[0227] Step 1008: The management platform generates a second access credential and sends the second access credential to the proxy server.

[0228] Step 1009: The proxy server sends the second access credential to the target IoT device.

[0229] Step 1010: The target IoT device disconnects from the first connection and establishes a second connection with the proxy server based on the second access credential.

[0230] The information access permissions for the second connection are greater than those for the first connection.

[0231] Step 1011: The proxy server verifies the second access credential based on the target credential database. If the verification is successful, a second connection is established with the target IoT device.

[0232] Step 1012: After establishing the second connection, the target IoT device sends the collected sensor data to the business topic in the proxy server.

[0233] Step 1013: The agent server sends the received sensor data to the management platform.

[0234] As an optional implementation method, such as Figure 11 As shown, the IoT device access method provided in this application embodiment may further include:

[0235] Step 1101: The management platform sends an offline notification to the proxy server and cancels the second access credential corresponding to the target physical device in the target credential database.

[0236] Step 1102: The proxy server stores the offline notification in the topic and pushes the offline notification to the target IoT device.

[0237] The proxy server can update the target IoT device's access permissions and start a countdown for a preset time period. After receiving the countdown, the proxy server disconnects the second connection and clears resources.

[0238] Step 1103: The target IoT device responds to the offline notification and performs an offline operation.

[0239] The offline operation includes disconnecting the second connection, deleting the second access credential stored locally on the target IoT device, and changing the activation status of the target IoT device to an inactive status.

[0240] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0241] Based on the same inventive concept, this application also provides an IoT device access apparatus for implementing the IoT device access method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more IoT device access apparatus embodiments provided below can be found in the limitations of the IoT device access method described above, and will not be repeated here.

[0242] In one exemplary embodiment, such as Figure 12 As shown, an IoT device access device 1200 is provided, which is installed on a target IoT device. The device includes an acquisition module 1201, a first connection module 1202, a receiving module 1203, and a second connection module 1204. Wherein:

[0243] The acquisition module 1201 is used to acquire the first access credential pre-installed locally on the target IoT device when the initial access conditions are met.

[0244] The first connection module 1202 is used to establish a first connection with the proxy server in the Message Queue Telemetry Transmission (MQTT) architecture based on the first access credential, and after the first connection is established, send a target activation request to the management platform in the MQTT architecture through the proxy server. The target activation request is used to instruct the management platform to generate a second access credential.

[0245] The receiving module 1203 is used to receive the second access credential generated by the management platform through the proxy server;

[0246] The second connection module 1204 is used to disconnect the first connection and establish a second connection with the proxy server based on the second access credential. The information access permissions corresponding to the second connection are greater than those corresponding to the first connection.

[0247] In one embodiment, the information access permissions corresponding to the first connection include the permission to access the activation topic in the proxy server. The activation topic is used to store activation requests sent by IoT devices and is available for the management platform to subscribe to. The first connection module 1202 is specifically used to send the target activation request to the activation topic in the proxy server for storage, so that the management platform can obtain the target activation request from the activation topic based on the subscription to the activation topic.

[0248] In one embodiment, the information access permissions corresponding to the second connection include the permission to access business topics in the proxy server, which are used to store sensor data sent by IoT devices.

[0249] In one embodiment, the second connection module 1204 is further configured to, after establishing the second connection, send the sensor data collected by the target IoT device to the business topic for storage, so that the management platform can obtain the sensor data from the business topic based on the subscription to the business topic.

[0250] In one embodiment, the acquisition module 1201 is specifically used to acquire the activation status of the target IoT device. The activation status is used to indicate whether the target IoT device has received the second access credential sent by the management platform. When the activation status is inactive, it is determined that the initial access conditions are met.

[0251] In one embodiment, the second connection module 1204 is further configured to modify the activation status of the target IoT device to an activated state after establishing a second connection with the proxy server based on the second access credential.

[0252] In one embodiment, the second connection module 1204 is further configured to, when the activation state is activated, obtain the second access credential stored locally by the target IoT device; and establish a second connection with the proxy server based on the second access credential.

[0253] In one embodiment, the receiving module 1203 is further configured to receive a shutdown notification sent by the management platform through a proxy server; and perform a shutdown operation in response to the shutdown notification; wherein the shutdown operation includes disconnecting the second connection, deleting the second access credential stored locally on the target IoT device, and changing the activation status of the target IoT device to an inactive status.

[0254] In one exemplary embodiment, such as Figure 13 As shown, an IoT device access device 1300 is provided, which is a proxy server set in a Message Queuing Telemetry Transmission (MQTT) architecture. The device includes a first connection module 1301, a receiving module 1302, and a second connection module 1303. Wherein:

[0255] The first connection module 1301 is used to establish a first connection with the target IoT device based on the first access credential, and after the first connection is established, receive the target activation request sent by the target IoT device and send the target activation request to the management platform in the MQTT architecture. The activation request is used to instruct the management platform to generate a second access credential.

[0256] The receiving module 1302 is used to receive the second access credential generated by the management platform and send the second access credential to the target IoT device;

[0257] The second connection module 1303 is used to disconnect the first connection and establish a second connection with the target IoT device based on the second access credential. The information access permissions corresponding to the second connection are greater than those corresponding to the first connection.

[0258] In one embodiment, the first connection module 1301 is specifically used to verify the first access credential according to the target credential library and determine the first verification result. The target credential library is used to include multiple sets of correspondences between access credentials and information access permissions. If the first verification result is successful, a first connection is established with the target IoT device according to the first access credential and the first target information access permission corresponding to the first access credential is obtained. The first target information access permission is used as the information access permission corresponding to the first connection.

[0259] In one embodiment, the second connection module 1303 is specifically used to verify the second access credential according to the target credential library and determine the second verification result; if the second verification result is successful, establish a second connection with the target IoT device according to the second access credential and obtain the second target information access permission corresponding to the second access credential; and use the second target information access permission as the information access permission corresponding to the second connection.

[0260] Each module in the aforementioned IoT device access device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0261] Figure 14 This is a schematic diagram of the structure of an Internet of Things (IoT) device provided in an embodiment of this application. The IoT device may include a processor 1400, a transceiver 1410, and a memory 1420. The transceiver 1410 is used to receive and transmit data under the control of the processor 1400.

[0262] The transceiver 1410 may be a combination of components, providing a unit for communicating with various other devices over a transmission medium. The processor 1400 is responsible for general processing, and the memory 1420 may store data used by the processor 1400 when performing operations.

[0263] The processor 1400 executes the steps performed by the IoT device in the above method embodiment by calling a program stored in memory, according to the obtained executable instructions.

[0264] Figure 15 This is a schematic diagram of a computer device provided in an embodiment of this application. The computer device may include a processor 1500, a transceiver 1510, and a memory 1520. The transceiver 1510 is used to receive and transmit data under the control of the processor 1500.

[0265] The transceiver 1510 may be a combination of components, providing a unit for communicating with various other devices over a transmission medium, the processor 1500 is responsible for general processing, and the memory 1520 may store the data used by the processor 1500 when performing operations.

[0266] The processor 1500 executes the steps performed by the broker server in the MQTT architecture in the above method embodiment by calling the program stored in memory, according to the obtained executable instructions.

[0267] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps described in the above method embodiments.

[0268] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps described in the above method embodiments.

[0269] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0270] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0271] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for connecting IoT devices, characterized in that, For a target IoT device, the method includes: If the initial access conditions are met, a first access credential pre-installed locally on the target IoT device is obtained; A first connection is established with the proxy server in the Message Queue Telemetry Transmission (MQTT) architecture based on the first access credential, and after the first connection is established, a target activation request is sent to the management platform in the MQTT architecture through the proxy server. The target activation request is used to instruct the management platform to generate a second access credential. The proxy server receives the second access credential generated by the management platform. The first connection is disconnected, and a second connection is established with the proxy server based on the second access credential. The information access permissions corresponding to the second connection are greater than those corresponding to the first connection.

2. The method according to claim 1, characterized in that, The information access permissions corresponding to the first connection include access to the activation topic in the proxy server. The activation topic is used to store activation requests sent by IoT devices and is available for subscription by the management platform. Sending the target activation request to the management platform in the MQTT architecture through the proxy server includes: The target activation request is sent to the activation topic in the proxy server for storage, so that the management platform can obtain the target activation request from the activation topic based on the subscription to the activation topic.

3. The method according to claim 2, characterized in that, The information access permissions corresponding to the second connection include the permission to access the business topics in the proxy server, which are used to store sensor data sent by IoT devices.

4. The method according to claim 3, characterized in that, The method further includes: After the second connection is established, the sensor data collected by the target IoT device is sent to the business topic for storage, so that the management platform can obtain the sensor data from the business topic based on the subscription to the business topic.

5. The method according to claim 1, characterized in that, The method further includes: Obtain the activation status of the target IoT device, wherein the activation status is used to indicate whether the target IoT device has received the second access credential sent by the management platform; When the activation state is inactive, it is determined that the initial access conditions are met.

6. The method according to claim 5, characterized in that, The method further includes: After establishing the second connection with the proxy server based on the second access credential, the activation status of the target IoT device is changed to activated.

7. The method according to claim 5 or 6, characterized in that, The method further includes: When the activation state is activated, the second access credential stored locally by the target IoT device is obtained; The second connection is established with the proxy server based on the second access credential.

8. The method according to claim 5 or 6, characterized in that, The method further includes: The proxy server receives the offline notification sent by the management platform. In response to the offline notification, perform a offline operation; The offline operation includes disconnecting the second connection, deleting the second access credential stored locally on the target IoT device, and changing the activation status of the target IoT device to an inactive status.

9. A method for connecting IoT devices, characterized in that, The method for using a proxy server in a Message Queued Telemetry Transport (MQTT) architecture includes: A first connection is established with the target IoT device based on a first access credential. After the first connection is established, a target activation request is received from the target IoT device and the target activation request is sent to the management platform in the MQTT architecture. The activation request is used to instruct the management platform to generate a second access credential. Receive the second access credential generated by the management platform and send the second access credential to the target IoT device; Disconnect the first connection and establish a second connection with the target IoT device based on the second access credential. The information access permissions corresponding to the second connection are greater than those corresponding to the first connection.

10. The method according to claim 9, characterized in that, The establishment of a first connection with the target IoT device based on a first access credential includes: The first access credential is verified based on the target credential database to determine the first verification result. The target credential database is used to include multiple sets of correspondences between access credentials and information access permissions. If the first verification result is successful, a first connection is established with the target IoT device based on the first access credential, and the first target information access permission corresponding to the first access credential is obtained; The first target information access permission shall be used as the information access permission corresponding to the first connection.

11. The method according to claim 10, characterized in that, The establishment of a second connection with the target IoT device based on the second access credential includes: The second access credential is verified based on the target credential database to determine the second verification result; If the second verification result is successful, a second connection is established with the target IoT device based on the second access credential, and access permissions for the second target information corresponding to the second access credential are obtained; Use the second target information access permission as the information access permission corresponding to the second connection.

12. An Internet of Things (IoT) device access device, characterized in that, The device, configured in a target IoT device, includes: The acquisition module is used to acquire a first access credential pre-installed locally on the target IoT device when the initial access conditions are met. The first connection module is used to establish a first connection with the proxy server in the MQTT architecture based on the first access credential, and after the first connection is established, send a target activation request to the management platform in the MQTT architecture through the proxy server. The activation request is used to instruct the management platform to generate a second access credential. The receiving module is used to receive the second access credential generated by the management platform through the proxy server; The second connection module is used to disconnect the first connection and establish a second connection with the proxy server based on the second access credential. The information access permissions corresponding to the second connection are greater than those corresponding to the first connection.

13. An Internet of Things (IoT) device access device, characterized in that, The device includes a broker server configured in an MQTT architecture. The first connection module is used to establish a first connection with the target IoT device based on a first access credential, and after the first connection is established, receive a target activation request sent by the target IoT device, and send the target activation request to the management platform in the MQTT architecture. The activation request is used to instruct the management platform to generate a second access credential. The receiving module is used to receive the second access credential generated by the management platform and send the second access credential to the target IoT device; The second connection module is used to disconnect the first connection and establish a second connection with the target IoT device based on the second access credential. The information access permissions corresponding to the second connection are greater than the information access permissions corresponding to the first connection.

14. An Internet of Things (IoT) device, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

15. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 9 to 11.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8 or 9 to 11.

17. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8 or 9 to 11.

Images