Device access authentication method, terminal device and cloud platform

Abstract

The present application relates to a device access authentication method, a terminal device, and a cloud platform. The device access authentication method includes: a terminal device receiving device authentication information corresponding to device information of a device to be accessed from a first cloud platform; a terminal device receiving an access authentication certificate from the device to be accessed; and a terminal device verifying the access authentication certificate using the device authentication information. The embodiment of the present application performs device authentication in a network configuration process to improve security.

Description

[Technical field]

[0001] The present application relates to the field of communications, and in particular to a device access authentication method, a terminal device and a cloud platform. [Background technology]

[0002] The device requires that the device can realize access between manufacturer platforms, configure the device of the first manufacturer to access the platform of the second manufacturer, and realize interconnection with the device of the platform of the second manufacturer. In general, any legitimate participating platform that has unified authentication access can be the platform of the second manufacturer. Therefore, when the device is shipped, the same configuration network protocol is required for the APP of the second manufacturer to configure the device and allow the device to enter the home network and access the platform.

[0003] However, in the network configuration process, the device cannot perform access authentication, and access authentication can only be performed after the device is configured on the network, which may result in the leakage of privacy information such as home network information. Summary of the Invention

[0004] The embodiments of the present application provide a device access authentication method, a terminal device and a cloud platform, which can improve the security of a network configuration process.

[0005] An embodiment of the present application provides a method for device access authentication, comprising: The terminal device receives device authentication information corresponding to device information of the network access target device from the first cloud platform; The terminal device receives an access authentication certificate from the network access target device; The terminal device verifies the access authentication credential using the device authentication information.

[0006] An embodiment of the present application provides a method for device access authentication, comprising: A first cloud platform receives device information of a network access target device from a terminal device; The first cloud platform obtains device authentication information corresponding to the device information; The first cloud platform sends the device authentication information to the terminal device, and the device authentication information is used by the terminal device to verify the access authentication certificate from the network access target device.

[0007] An embodiment of the present application provides a method for device access authentication, comprising: A second cloud platform receives device information of a network access target device; The second cloud platform obtains device authentication information corresponding to the device information; and The second cloud platform sends the device authentication information to the first cloud platform, and sends the device authentication information to a terminal device via the first cloud platform, where the device authentication information is used by the terminal device to verify an access authentication certificate from the network access target device.

[0008] An embodiment of the present application provides a method for device access authentication, comprising: The method includes a device targeted for network access sending an access authentication certificate of the device targeted for network access to a terminal device, and the terminal device verifying the access authentication certificate using device authentication information of the device targeted for network access obtained from a cloud platform.

[0009] An embodiment of the present application provides a terminal device, including a first receiving unit, a second receiving unit, and a device verification unit; The first receiving unit is configured to receive device authentication information corresponding to device information of the network access target device from the first cloud platform; The second receiving unit is configured to receive an access authentication certificate from the network access target device; A device verification unit is configured to verify the access authentication credential using the device authentication information.

[0010] An embodiment of the present application provides a first cloud platform, including a receiving unit, an acquiring unit, and a sending unit; The receiving unit is configured to receive device information of a network access target device from a terminal device; The obtaining unit is configured to obtain device authentication information corresponding to the device information; The sending unit is configured to send the device authentication information to the terminal device, and the device authentication information is used by the terminal device to verify an access authentication credential from the network access target device.

[0011] An embodiment of the present application provides a second cloud platform, including a receiving unit, an acquiring unit, and a sending unit; The receiving unit is configured to receive device information of a network access target device; The obtaining unit is configured to obtain device authentication information corresponding to the device information; The sending unit is configured to send the device authentication information to a first cloud platform and send the device authentication information to a terminal device via the first cloud platform, where the device authentication information is used by the terminal device to verify an access authentication certificate from the network access target device.

[0012] An embodiment of the present application provides a network access target device, comprising a sending unit; The sending unit is configured to send an access authentication certificate of the network access target device to a terminal device, and verify the access authentication certificate by using device authentication information of the network access target device obtained from the cloud platform by the terminal device.

[0013] An embodiment of the present application provides a terminal device including a processor and a memory, the memory storing a computer program, and the processor calling and executing the computer program stored in the memory, thereby causing the terminal device to execute a device access authentication method executed by the terminal device.

[0014] An embodiment of the present application provides a cloud platform including a processor and a memory, the memory storing a computer program, and the processor calling and executing the computer program stored in the memory, thereby causing the cloud platform to execute a device access authentication method executed by the first cloud platform or the second cloud platform. An embodiment of the present application provides a network access target device, including a processor and a memory, wherein the memory stores a computer program, and the processor calls and executes the computer program stored in the memory, thereby causing the network access target device to execute a device access authentication method executed by the network access target device.

[0015] An embodiment of the present application provides a chip for implementing the above-mentioned device access authentication method.

[0016] Specifically, the chip includes a processor that calls and executes a computer program from a memory so that a device in which the chip is installed performs any one of the device access authentication methods described above.

[0017] An embodiment of the present application provides a computer-readable storage medium for storing a computer program, which, when executed by a device, causes the device to perform any of the above device access authentication methods.

[0018] An embodiment of the present application provides a computer program product including computer program instructions for causing a computer to perform any of the device access authentication methods described above.

[0019] An embodiment of the present application provides a computer program causing a computer to execute any one of the above device access authentication methods.

[0020] According to an embodiment of the present application, a terminal device obtains device authentication information corresponding to device information of a device to be accessed through a network from a first cloud platform, and uses the device authentication information to verify the access authentication certificate, thereby authenticating the device during network configuration. By configuring network access after verifying the device, security is improved. [Brief description of the drawings]

[0021] [Figure 1] FIG. 2 is a schematic diagram of an application scenario of an embodiment of the present application. [Diagram 2] 2 is a flowchart of a device access authentication method in an embodiment of the present application. [Diagram 3] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Figure 4] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Diagram 5] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Figure 6] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Figure 7] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Figure 8] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Figure 9] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Figure 10] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Figure 11] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Figure 12] 4 is a flowchart of a device access authentication method according to another embodiment of the present application; [Figure 13] FIG. 2 is a schematic diagram of a discovery process in a scenario. [Figure 14] FIG. 2 is a schematic diagram of a network configuration process in a scenario. [Figure 15] FIG. 2 is a schematic diagram of an access authentication process in a network configuration process. [Figure 16] FIG. 11 is another schematic diagram of the access authentication process in the network configuration process. [Figure 17] FIG. 2 is a block diagram of a terminal device according to an embodiment of the present application. [Figure 18] FIG. 2 is a block diagram of a terminal device according to another embodiment of the present application. [Figure 19] FIG. 2 is a block diagram of a first cloud platform in one embodiment of the present application. [Figure 20] FIG. 2 is a block diagram of a second cloud platform in an embodiment of the present application. [Figure 21] FIG. 2 is a block diagram of a device to be accessed by a network according to an embodiment of the present application. [Figure 22] FIG. 2 is a block diagram of a network access target device according to another embodiment of the present application. [Diagram 23]FIG. 2 is a block diagram of a communication device according to an embodiment of the present application. [Figure 24] FIG. 2 is a block diagram of a chip according to an embodiment of the present application. [Diagram 25] 1 is a block diagram of a communication system according to an embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Hereinafter, technical aspects of the embodiments of the present application will be described with reference to the drawings of the embodiments of the present application.

[0023] The embodiments of the present application may be applied to various communication systems, such as a Global System of Mobile Communication (GSM) system, a Code Division Multiple Access (CDMA) system, a Wideband Code (Wideband Coding) system, a Division Multiple Access (WCDMA) system, a General Packet Radio Service (GPRS) system, a Long Term Evolution (LTE) system, an Advanced long term evolution (LTE-A) system, a New Radio (NR) system, an evolution of an NR system, an LTE-based access to unlicensed spectrum (LTE-U) system, an NR-based access to unlicensed spectrum (NR-U) system, a Universal Mobile Telecommunication System (UMTS), a Wireless Local Area Network (WLAN), a Wireless Fidelity (WiFi), a next-generation communication (5G) system, or other communication systems.

[0024] Generally, conventional communication systems support a limited number of connections and are easy to implement. However, with the evolution of communication technology, mobile communication systems support not only conventional communication but also, for example, D2D (Device to Device) communication, M2M (Machine to Machine) communication, MTC (Machine Type Communication), V2V (Vehicle to Vehicle), and V2X (Vehicle to everything) communication, which can also be used in the embodiments of the present application.

[0025] Optionally, the communication system in the embodiments of the present application may be applied to a Carrier Aggregation (CA) scenario, a Dual Connectivity (DC) scenario, or a Standalone (SA) deployment scenario.

[0026] Optionally, the communication system in the embodiments of the present application may be applied to ungranted spectrum, where the ungranted spectrum may also be considered as shared spectrum, or the communication system in the embodiments of the present application may be applied to granted spectrum, where the granted spectrum may also be considered as non-shared spectrum.

[0027] The present application describes various embodiments in relation to terminal devices and network devices, where a terminal device may also be referred to as User Equipment (UE), an access terminal, a user unit, a user station, a mobile station, a remote station, a far end terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent, or a user device.

[0028] The terminal device may be a station in a WLAN (STAION, ST), a mobile phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), a digital assistant device, a portable device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, an in-vehicle device, a wearable device, a terminal device in an NR network or a future evolving Public Land Mobile Network (PLMN) network.

[0029] In embodiments of the present application, the terminal device may be configured indoors or outdoors, handheld, worn or on land, including vehicle-mounted, on the water surface (such as a steamship), or in the air, such as an aircraft, balloon, or satellite.

[0030] In an embodiment of the present application, the terminal device may be a mobile phone, a tablet, a computer with wireless transmission and reception capabilities, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self driving, a wireless terminal device in remote medical, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, or a wireless terminal device in a smart home.

[0031] By way of example and not limitation, in the embodiments of the present application, the terminal device may be a wearable device. A wearable device, also called a wearable smart device, is a general term for equipment that is intelligently designed and developed on the premise of applying wearable technology to everyday clothing such as glasses, gloves, watches, clothes, and shoes and being worn. A wearable device is a mobile terminal that is worn directly on the body or incorporated into the user's clothing or accessories. A wearable device is not just a hardware device, but realizes its functions not only through software support but also through data interaction and cloud-based interaction. Roughly speaking, a wearable smart device refers to a large, full-function device such as a smart watch or smart glasses that does not depend on a smartphone for all or part of its functions, and a smart bracelet or smart jewelry that needs to be used in conjunction with other devices such as a smartphone for specific purposes such as various body monitoring.

[0032] In an embodiment of the present application, the network device may be an access point (AP) in a WLAN, a base station (BTS) in GSM or CDMA, or a base station (NodeB, NB) in WCDMA, or an evolved base station (eNB or eNodeB) in LTE, or a relay station or an access point, or an in-vehicle device, a wearable device, and a network device (gNB) in an NR network, or a network device in a future evolved PLMN network, or a network device in an NTN network, etc.

[0033] By way of example, but not of limitation, in the embodiments of the present application, the network device may have a mobile characteristic, for example, the network device may be a mobile device. Optionally, the network device may be a satellite, a satellite station. For example, the satellite may be a low earth orbit (LEO) satellite, a medium earth orbit (MEO) satellite, a geostationary earth orbit (GEO) satellite, a high elliptical orbit (HEO) satellite, etc. Alternatively, the network device may be a base station installed on land, water, etc.

[0034] In an embodiment of the present application, a network device can provide a service to a cell, and a terminal device can communicate with the network device via a transmission resource (e.g., a frequency domain resource or a spectrum resource) used by the cell, and the cell may be a cell corresponding to a network device (e.g., a base station), and the cell may belong to a macro base station or a base station corresponding to a small cell, and the small cell here may include a metro cell, a micro cell, a pico cell, a femto cell, etc., and these small areas are characterized by a small coverage area and low transmission power, and are suitable for providing high-rate data transmission services.

[0035] 1 shows an exemplary communication system 100 consisting of one network device and two terminal devices. Optionally, the communication system 100 may include multiple network devices, and each network device may include, but is not limited to, other numbers of terminal devices within its coverage area in this application example.

[0036] Optionally, the communication system 100 may also include other network entities, such as a network controller, a mobility management entity (MME), an access and mobility management function (AMF), etc., and the embodiments of the present application are not limited thereto.

[0037] Here, the network device may include an access network device and a core network device. That is, the wireless communication system further includes a plurality of core networks for communicating with the access network device. The access network device may be an evolutionary base station (evolutional nodeB, abbreviated as eNB or e-NodeB), a macro base station, a micro base station (also called a "small base station"), a pico base station, an access point (AP), a transmission point (TP), or a new generation NodeB (gNodeB) in a long-term evolution (LTE) system, a next radio (NR) system, or an authorized auxiliary access long-term evolution (LAA-LTE) system.

[0038] In addition, a device having a communication function in a network / system in the embodiment of the present application can be called a communication device. Taking the communication system shown in Figure 1 as an example, the communication device can include a network device and a terminal device having a communication function, which can be specific devices in the embodiment of the present application, and the communication device can also include other devices in the communication system, such as a network controller, a mobility management entity, etc., and is not limited to this in the embodiment of the present application.

[0039] It should be understood that the terms "system" and "network" are often used interchangeably herein. As used herein, "and / or" simply indicates the relationship of related things, such as A and / or B, which indicates that there are three possible relationships: A alone, A and B together, or B alone. Additionally, the character " / " in this document generally indicates an "or" relationship between the related objects before and after it.

[0040] It should be understood that the "indication" referred to in the embodiments of the present application may be a direct indication, an indirect indication, or an indication that there is an associated relationship. For example, A can indicate B, A can directly indicate B, for example, B can be obtained by A, A can indicate C, B can be obtained through C, and it can also indicate that there is a correlation between A and B.

[0041] In describing the embodiments of the present application, the term "corresponding" may mean that there is a direct or indirect corresponding relationship between the two, or that there is an association relationship between the two, or a relationship such as indicating and indicated, or configuring and configured.

[0042] In order to facilitate understanding of the technical aspects of the embodiments of the present application, the following describes related art of the embodiments of the present application, which can be combined with the technical aspects of the embodiments of the present application as any aspect belonging to the protection scope of the embodiments of the present application.

[0043] 2 is a schematic flowchart of a device access authentication method 200 according to an embodiment of the present application. The method can be optionally applied to, but is not limited to, the system shown in FIG 1. The method includes at least part of the following contents:

[0044] In S210, the terminal device receives device authentication information corresponding to device information of the device to be accessed through the network from the first cloud platform; In S220, the terminal device receives an access authentication certificate from the network access target device; At S230, the terminal device verifies the access authentication credential using the device authentication information.

[0045] Exemplarily, the first cloud platform may be a cloud platform directly connected to the terminal device. For example, the first cloud platform is a cloud platform of a manufacturer of the terminal device, and includes device authentication information provided by the manufacturer of the terminal device. For example, the first cloud platform may be a cloud platform that aggregates device authentication information of multiple manufacturers.

[0046] The terminal device can obtain device authentication information corresponding to device information of the network access target device from the first cloud platform. The device authentication information is used to verify whether the device is authentic. The terminal device can obtain an access authentication certificate of the network access target device from the network access target device. Then, the terminal device uses the device authentication information to verify the access authentication certificate to determine whether the network access target device is authentic. If the network access target device is authentic, the terminal device performs subsequent network configuration.

[0047] Optionally, in an embodiment of the present application, as shown in FIG. 3, the method further comprises: In S110, the terminal device receives device information from the network access target device; In S120, the terminal device sends device information of the network access target device to a first cloud platform.

[0048] Specifically, after the terminal device obtains the device information of the network access target device from the network access target device, it sends the device information to the first cloud platform, and then executes S210 to S230.

[0049] Optionally, in an embodiment of the present application, the terminal device receiving device information from the network access target device in S110 includes the terminal device receiving a Service Set Identifier (SSID) broadcast by the network access target device, and the device information in the SSID includes at least one of manufacturer information and product information. For example, the manufacturer information includes a manufacturer name, a manufacturer number, etc. The product information includes a product name and a product serial number, etc.

[0050] For example, a device to be accessed from a network may carry part of the device information in an information element (IE) included in an SSID broadcast beacon frame. When a terminal device receives an SSID broadcast, it may analyze a discovery field therein to obtain device information such as a manufacturer name, a product name, and a product serial number of the device. The terminal device may present the manufacturer name, product name, and the like to a user, and the user may use the terminal device to determine whether to start device configuration. When starting device configuration and determining that the terminal device has established or maintained a secure connection with the first cloud platform, the terminal device may obtain device authentication information corresponding to the device information from the first cloud platform.

[0051] Optionally, in an embodiment of the present application, in S120, the terminal device sending device information of the network access target device to a first cloud platform includes: when the terminal device has a secure connection to the first cloud platform, the terminal device sending an authentication information acquisition request to the first cloud platform, where the authentication information acquisition request includes product information of the network access target device.

[0052] Optionally, in an embodiment of the present application, in S210, the terminal device receiving device authentication information corresponding to the device information from the first cloud platform includes the terminal device receiving device authentication information corresponding to the product information from the first cloud platform.

[0053] For example, the authentication information acquisition request sent by the terminal device to the first cloud platform includes product information of the network access target device, such as the product name and product serial number, etc. In this way, when device authentication information corresponding to the product information is found in the first cloud platform, the terminal device can receive the device authentication information from the first cloud platform.

[0054] Optionally, in the embodiment of the present application, in S120, the terminal device sends the device information of the network access target device to the first cloud platform, and when the terminal device is securely connected to the first cloud platform, the terminal device sends an authentication information acquisition request to the first cloud platform, and the authentication information acquisition request includes manufacturer information and product information of the network access target device, where the manufacturer information corresponds to the second cloud platform and the product information corresponds to the device authentication information. In this way, if the first cloud platform does not search and find the device authentication information of the network access target device, it may search in the second cloud platform. The first cloud platform may be connected to one or more second cloud platforms. The first cloud platform may determine which second cloud platform to send the authentication information acquisition request to based on the manufacturer information.

[0055] Optionally, in an embodiment of the present application, in S210, the terminal device receiving device authentication information corresponding to the device information of the network access target device from a first cloud platform includes the terminal device receiving device authentication information corresponding to the product information from the first cloud platform, where the device authentication information corresponding to the product information is obtained from a second cloud platform, where the first cloud platform corresponds to the manufacturer information.

[0056] For example, the first cloud platform may be connected to one or more second cloud platforms, and each second cloud platform corresponds to different manufacturer information. The device information of the network access target device may be located in a certain second cloud platform. In this case, after the terminal device sends an authentication information acquisition request to the first cloud platform, if the terminal device does not search and find the device authentication information corresponding to the product information in the first cloud platform, it may search in the second cloud platform. If the authentication information acquisition request received by the first cloud platform includes the manufacturer information of the network access target device, the first cloud platform may determine which second cloud platform to send the authentication information acquisition request to based on the manufacturer information. The first cloud platform searches for the second cloud platform corresponding to the manufacturer information, sends the product information to the searched second cloud platform via the authentication information acquisition request, and searches for the device authentication information corresponding to the product information in the second cloud platform. Then, the second cloud platform returns the device authentication information corresponding to the searched product information to the terminal device via the first cloud platform.

[0057] Optionally, in an embodiment of the present application, as shown in Fig. 3, after the terminal device sends device information of the network access target device to the first cloud platform in S120, the method further includes: the terminal device joins a soft access point (SoftAP) of the network access target device in S130. This step may be performed after the terminal device receives device authentication information corresponding to the device information of the network access target device from the first cloud platform in S210.

[0058] Exemplarily, after the terminal device sends device information of the network access target device to the first cloud platform and receives device authentication information from the first cloud platform, when the user decides to initiate device configuration, the terminal device can join the SoftAP of the network access target device and establish a secure connection with the first cloud platform.

[0059] Optionally, in an embodiment of the present application, after S130, the method further includes verifying whether the cloud platform is legitimate, which specifically includes the following content:

[0060] Method 1: Verify whether the cloud platform is legitimate using the platform certificate, see Figure 4.

[0061] Optionally, in an embodiment of the present application, after the terminal device joins the SoftAP of the network access target device in S130 and the terminal device establishes a secure connection with the network access target device, the method further includes, in S140, the terminal device sending a platform certificate of the first cloud platform to the network access target device to verify whether the first cloud platform is legitimate.

[0062] Optionally, in an embodiment of the present application, after the terminal device joins the SoftAP of the network access target device in S130 and the terminal device establishes a secure connection with the network access target device, the method further includes: in S150, the terminal device sends a platform certificate of the second cloud platform to the network access target device to verify whether the second cloud platform is legitimate.

[0063] Optionally, in an embodiment of the present application, the platform certificate includes a timestamp or serial number, which can prevent the platform certificate from being used multiple times.

[0064] Method 2: Using an implicit method to verify whether the cloud platform is legitimate, see Figure 5.

[0065] Optionally, in an embodiment of the present application, the terminal device receiving an access authentication credential from the network access target device in S220 includes: the terminal device receiving an encrypted access authentication credential from the network access target device in S221; The method further includes, in S222, the terminal device decrypts the encrypted access authentication certificate using platform decryption information, and sends the decrypted data to the network access target device, and the network access target device verifies whether the decryption is successful, and the cloud platform corresponding to the successfully decrypted platform decryption information is a legitimate platform.

[0066] Optionally, in the embodiment of the present application, in the manner 1, if the cloud platform is authentic, the following steps S220 and S230 can be executed. In the manner 2, in the process of S220, it can be verified whether the cloud platform is authentic.

[0067] Optionally, in an embodiment of the present application, in S220, the terminal device receiving an access authentication certificate from the network access target device includes, if the verified cloud platform is legitimate, the terminal device receiving an access authentication request from the network access target device, where the access authentication request includes the access authentication certificate.

[0068] Optionally, in an embodiment of the present application, in S230, the terminal device verifying the access authentication certificate using the device authentication information includes the terminal device verifying the access authentication certificate using the device authentication information to determine whether the network access target device is a legitimate device.

[0069] Optionally, in an embodiment of the present application, as shown in Fig. 3, the method further comprises: in S240, if the network access target device is a valid device, the terminal device configures the network access target device with device configuration information, and the device configuration information is obtained from the first cloud platform or the second cloud platform. For example, the device configuration information includes a device identification (ID), a certificate, a key, etc.

[0070] 6 is a schematic flowchart of a device access authentication method 300 according to another embodiment of the present application. The method can be optionally applied to, but is not limited to, the system shown in FIG. 1. The method includes at least part of the following contents:

[0071] At S310, the first cloud platform receives device information of a device to be accessed through a network from a terminal device.

[0072] At S320, the first cloud platform obtains device authentication information corresponding to the device information; At S330, the first cloud platform sends the device authentication information to the terminal device, and the device authentication information is used by the terminal device to verify the access authentication certificate from the network access target device.

[0073] Optionally, in an embodiment of the present application, in S310, the first cloud platform receiving device information of the network access target device from the terminal device includes: when the terminal device is securely connected to the first cloud platform, the first cloud platform receiving an authentication information acquisition request from the terminal device, where the authentication information acquisition request includes product information of the network access target device.

[0074] Optionally, in an embodiment of the present application, in S320, the first cloud platform sending the device authentication information to the terminal device includes the first cloud platform sending device authentication information corresponding to the product information to the terminal device.

[0075] Optionally, in an embodiment of the present application, the method further includes: in S340, the first cloud platform sends a platform certificate of the first cloud platform to the terminal device. Then, the terminal device sends the platform certificate of the first cloud platform to the network access target device, and the network access target device verifies whether the first cloud platform is legitimate. If it is legitimate, the network access target device sends its access authentication certificate to the terminal device, and the terminal device verifies the access authentication certificate from the network access target device by using the device authentication information obtained from the first cloud platform.

[0076] Optionally, in the embodiment of the present application, the first cloud platform may be connected to one or more second cloud platforms, and the device information of the network access target device may be located in a second cloud platform. As shown in Fig. 8, the first cloud platform receiving the device information of the network access target device from the terminal device in S310 includes: when the terminal device is securely connected to the first cloud platform in S311, the first cloud platform receiving a first authentication information acquisition request from the terminal device, where the first authentication information acquisition request includes manufacturer information and product information of the network access target device.

[0077] Optionally, in the embodiment of the present application, if the first cloud platform does not have the device authentication information of the device to be accessed through the network, the second cloud platform may search for the device authentication information. In the method, the first cloud platform obtaining the device authentication information corresponding to the device information in S320 may further include: In S321, the first cloud platform sends a second authentication information acquisition request to a second cloud platform corresponding to the manufacturer information, and the second authentication information acquisition request includes the product information; At S322, the first cloud platform receives device authentication information corresponding to the product information from the second cloud platform.

[0078] Optionally, in an embodiment of the present application, the first cloud platform sending the device authentication information to the terminal device at S330 includes the first cloud platform sending device authentication information corresponding to the product information obtained from the second cloud platform to the terminal device at S331.

[0079] Optionally, in embodiments of the present application, the method further comprises: At S350, the first cloud platform receives a platform certificate of the second cloud platform; At S360, the first cloud platform sends a platform certificate of the second cloud platform to the terminal device.

[0080] Optionally, in embodiments of the present application, the method further comprises: At S370, the first cloud platform obtains or generates device configuration information of the network access target device from the second cloud platform; At S380, the first cloud platform sends the device configuration information to the terminal device.

[0081] Here, the timing between the first cloud platform obtaining the device authentication information, the platform certificate, and the device configuration information from the second cloud platform is not limited, may have a priority, and may be performed simultaneously. Therefore, the timing between the first cloud platform transmitting the device authentication information, the platform certificate, and the device configuration information to the terminal device is not limited, may have a priority, and may be performed simultaneously.

[0082] For example, a first cloud platform receives device authentication information, a platform certificate of the second cloud platform, and device configuration information from a second cloud platform, and then the first cloud platform sends the device authentication information, the platform certificate of the second cloud platform, and device configuration information to a terminal device.

[0083] Also, for example, the first cloud platform obtains device authentication information from the second cloud platform, and then sends the device authentication information to the terminal device. Then, the first cloud platform obtains a platform certificate and device configuration information from the second cloud platform, and sends the platform certificate and device configuration information to the terminal device.

[0084] For a detailed description and example of the execution method 300 of the first cloud platform in this embodiment, reference may be made to the description of the first cloud platform in the method 200 above, and the description will be omitted here for brevity.

[0085] 9 is a schematic flowchart of a device access authentication method 400 according to another embodiment of the present application. The method can be optionally applied to, but is not limited to, the system shown in FIG. 1. The method includes at least part of the following contents:

[0086] In S410, a second cloud platform receives device information of a device to be accessed through the network; At S420, the second cloud platform obtains device authentication information corresponding to the device information; At S430, the second cloud platform sends the device authentication information to the first cloud platform, and sends the device authentication information to a terminal device via the first cloud platform, and the device authentication information is used by the terminal device to verify the access authentication certificate from the network access target device.

[0087] Optionally, in an embodiment of the present application, the second cloud platform receiving device information of the network access target device includes the second cloud platform receiving an authentication information acquisition request from the first cloud platform, where the authentication information acquisition request includes product information of the network access target device, and the second cloud platform obtaining device authentication information corresponding to the device information includes the second cloud platform obtaining device authentication information corresponding to the product information.

[0088] Optionally, in embodiments of the present application, the method further comprises: The second cloud platform sends a platform certificate and / or device configuration information to the first cloud platform.

[0089] For a detailed description and example of the execution method 400 of the second cloud platform in this embodiment, reference may be made to the description of the second cloud platform in the above methods 200 and 300, and the description will be omitted here for brevity.

[0090] 10 is a schematic flowchart of a device access authentication method 500 according to another embodiment of the present application. The method can be optionally applied to, but is not limited to, the system shown in FIG. 1. The method includes at least part of the following contents:

[0091] In S510, the device to be accessed through the network sends an access authentication certificate of the device to be accessed through the network to a terminal device, and the terminal device verifies the access authentication certificate using device authentication information of the device to be accessed through the network obtained from a cloud platform.

[0092] Optionally, in an embodiment of the present application, the method further comprises: the network access target device verifying whether the cloud platform is a legitimate platform.

[0093] Optionally, the network access target device verifying the cloud platform includes the following manner.

[0094] Method 1: Verify whether the cloud platform is legitimate using the platform certificate, see Figure 11.

[0095] Optionally, in the embodiment of the present application, before the network access target device sends the access authentication certificate of the network access target device to the terminal device in S510, the network access target device verifies whether the cloud platform is a legitimate platform: In step S610, the network access target device receives a platform certificate; At S620, the network access target device verifies whether the cloud platform is legitimate based on the platform certificate.

[0096] If the cloud platform is legitimate, in S510, the device to be accessed through the network sends an access authentication certificate of the device to be accessed through the network to the terminal device.

[0097] Specifically, when the network access target device receives a platform certificate of a first cloud platform, it can verify whether the platform certificate of the first cloud platform is valid. When the network access target device receives a platform certificate of a second cloud platform, it can verify whether the platform certificate of the second cloud platform is valid. Here, the second cloud platform sends its platform certificate to the first cloud platform, then from the first cloud platform to the terminal device, and then from the terminal device to the network access target device for verification.

[0098] Method 2: Validate whether the cloud platform is valid using an implicit method, see Figure 12.

[0099] Optionally, in an embodiment of the present application, the network access target device verifying whether the cloud platform is a legitimate platform includes the following steps:

[0100] In S710, the network access target device sends an encrypted access authentication certificate to the terminal device, which step can replace S510.

[0101] In S720, the network access target device receives decrypted data from the terminal device, the decrypted data being data obtained by the terminal device decrypting the access authentication certificate according to platform decryption information; In S730, the network access target device verifies whether the decryption is successful based on the decrypted data, and the cloud platform corresponding to the platform decryption information that is successfully decrypted is a legitimate platform.

[0102] Optionally, an embodiment of the present application includes determining that the terminal device has joined a SoftAP of the network access target device and that the network access target device has established a secure connection with the terminal device before the network access target device sends an access authentication certificate of the network access target device.

[0103] Optionally, in an embodiment of the present application, before the terminal device joins the SoftAP of the network access target device and the network access target device establishes a secure connection with the terminal device, the method further includes: the network access target device broadcasting a service set identifier SSID, and the device information of the network access target device in the SSID includes at least one of manufacturer information and product information.

[0104] For a detailed description and example of the implementation method 500 of the network access target device in this embodiment, reference may be made to the description of the network access target device in the above methods 200, 300, and 400, and the description will be omitted here for the sake of brevity.

[0105] Next, a specific application scenario example of the device access authentication method in the present application will be described.

[0106] The SoftAP network configuration process includes the following steps:

[0107] (1) Discovery Process Discovery method: Device discovery can be performed based on the SSID in a WiFi (Wireless Fidelity) beacon frame message. This method can be used by a mobile phone (Application, APP) to discover devices (also called application terminals) that want to access the network.

[0108] Network configuration device: Also called the control terminal of mobile APP, smart large screen (smart TV, tablet, etc.), etc., which can display searched AP (Access Point) information.

[0109] As shown in Figure 13, in this process, the SSID field in the WiFiBeacon frame needs to be set to the discovery field as follows: The network access target device (also called application terminal) enters SoftAP mode; The network configuration device (also called control terminal) starts scanning, and after receiving the WiFiBeacon frame, it can discover application terminals such as smart wifi home devices by analyzing the SSID field in the WiFiBeacon frame. A hint for device discovery can be performed.

[0110] Illustratively, the SSID naming convention can be Uccx-AAA-BBB-yz[DDDDD], and the specific meaning is referred to the following table: [Table 1]

[0111] (2) Network configuration process The SoftAP network configuration process uses a network configuration device (or a configuration device, a control terminal, a terminal device, etc.) to connect to the open SoftAP of an application terminal, and performs security negotiation and data configuration between the IP networks between the two.

[0112] In the SoftAP network configuration scenario, after the network configuration device discovers the application terminal, it analyzes the discovery field in the application terminal Beacon broadcast message, displays the device related information, and asks the user for confirmation, such as entering the network configuration PIN code or scanning code. The flowchart is shown in Figure 14.

[0113] 1. After the network access target device enters the configuration mode, launch Soft-AP and its SSID matches a specific format, so that the hotspot access device can be automatically detected and automatically accessed.

[0114] 2. The network configuration device scans the SSID of the SoftAP, confirms that the SSID conforms to a specified format, and connects to the SoftAP.

[0115] 3. The network configuration device establishes a TCP (Transmission Control Protocol) connection with the device to be accessed from the network.

[0116] 4. Search for network access target device information. The network configuration device sends a request to the network access target device to obtain network access target device information. After the network access target device transitions to configuration mode, it scans for accessible APSSIDs at regular intervals (10 s).

[0117] 5. Respond with network access target device information: The network access target device transmits network access target device information to the network configuration device, including, for example, the SSID of the accessible AP scanned by the network access target device, the signal strength of the AP, and the like.

[0118] 6. Set network configuration information: The network configuration device sends network access configuration information to the device to be accessed, including, for example, the SSID and authentication information of the selected access AP.

[0119] 7. Respond with network configuration information After receiving the network access configuration information, the network access target device sends response information to the network configuration device.

[0120] 8. The network configuration device disconnects the Soft-AP connection.

[0121] 9. The device to be accessed network shuts down the Soft-AP, and configures network access according to the above configuration to select the Wi-Fi hotspot.

[0122] In the configuration process, a device needs to access a SoftAP network and disconnect from the home network and the Internet. In the network configuration process, the device cannot perform access authentication. If the device performs access authentication after the network configuration, privacy information such as home network information will be leaked, which is not secure. The embodiment of the present application can authenticate the device to access the network through a cloud platform, thereby improving security.

[0123] The device access authentication method in the present application may be a method for performing device access authentication during a SoftAP network configuration process. The method may include obtaining device authentication information from the cloud through device information obtained before a mobile phone connects to the device, and then connecting to the device SoftAP to perform device authentication and configuration. If the cloud platform (first cloud platform) directly connected to the mobile phone does not have device authentication information, the device authentication information can be obtained from a second cloud platform through a cloud-cloud connection.

[0124] Example 1: In this example, device authentication can adopt a non-binding method. It is mutually authenticated between the certificate system of the first manufacturer and the certificate system of the second manufacturer, or issued by a unified root CA. In this way, the device from the second manufacturer does not necessarily need to be authenticated by the platform of the second manufacturer. It is possible to authenticate the device of the second manufacturer through the integrated cloud platform or the platform of the first manufacturer. For example, the certificate of the device of the second manufacturer may be authenticated by the platform of the first manufacturer, and the device of the second manufacturer may authenticate the platform certificate of the platform of the first manufacturer.

[0125] In the above case, the network access target device can be abbreviated to device, an example of the network configuration device is a mobile phone, and the cloud platform can be abbreviated to cloud. In this example, the mobile phone is from a first manufacturer, the network access target device is from a second manufacturer, and the cloud platform connected to the mobile phone is used to authenticate the network access target device. As shown in FIG. 15, the specific operation steps of the flow for realizing access authentication during device network configuration include the following steps:

[0126] S11: A network access target device broadcasts an SSID, which includes the device's manufacturer name, product name, and product serial number. Some information can also be carried in an IE included in the SSID broadcast beacon frame.

[0127] S12, after the mobile phone discovers the device, it analyzes the discovery field in the device Beacon frame (or Beacon broadcast message) to obtain the manufacturer name, product name, and product serial number of the device.

[0128] S13, the user triggers the connection of the device. Optionally, the mobile phone presents the manufacturer name and product name of the device to the user, and the user decides to start device configuration.

[0129] S14: The mobile phone and the cloud platform establish a secure connection. When the mobile phone and the cloud platform are securely connected, there is no need to re-establish the connection.

[0130] S15, the mobile phone sends a request to the cloud platform to obtain device authentication information, and the request carries the product name and product serial number of the device.

[0131] S16. The cloud platform finds the certification information corresponding to the device based on the product name and product serial number of the device, including the certification certificate or related certificate issued after the device passes the unified test certification.

[0132] S17: The cloud platform generates device configuration information, such as device IDs, certificates, and keys, for the network-configured device to interconnect with other devices in the platform.

[0133] S18, The cloud platform sends the device authentication information and configuration information back to the mobile phone.

[0134] S19, if the user trigger in step S13 has not been realized, optionally, a user's connection trigger to the device can be realized in this step. After the mobile phone receives the device authentication and configuration information returned from the cloud platform, it presents the device manufacturer name and product name to the user, and the user decides to start device configuration.

[0135] S20, the phone joins the device's SoftAP and establishes a secure connection.

[0136] S21, the mobile phone initiates platform authentication to the device, which includes the authentication certificate of the cloud platform, which can be stored on the mobile phone or issued by the platform in step 6. This certificate is used to indicate the legitimate identity of the platform, and if there are multiple platforms, a unified authentication certificate can be used, such as all platforms using the same platform certificate. Alternatively, each platform can have its own independent certificate, and a unified mechanism can be used for authentication, such as each platform's certificate being signed by a unified CA and the validity of the platform certificate can be authenticated by an authentication root CA.

[0137] S22: The device verifies the authentication certificate of the platform and determines that it is a legitimate platform.

[0138] S23, the device initiates an access authentication request to the mobile phone, carrying the device's access authentication credentials.

[0139] S24: The mobile phone verifies the access certificate of the device using the device authentication information obtained from the cloud platform, and determines that the device is a legitimate device.

[0140] S25, the mobile phone configures the device using the configuration information obtained from the cloud platform.

[0141] S26, the mobile phone configures the network access information of the device, such as the network access SSID and password, to allow the device to access the home network.

[0142] After the device has access to the home network, it can use configuration information, such as the configured device ID, security keys, and certificates, to access the cloud platform or communicate with other devices in the network.

[0143] The device platform authentication in steps S21-S22 may also adopt an implicit authentication method, such as passing the device authentication certificate in an encrypted manner in the device authentication request, which can only be decrypted by the legitimate platform. The subsequent configuration information must include the decrypted information. The device can authenticate the authenticity of the platform by successfully decrypting the platform.

[0144] Example 2: In this example, the device authentication can adopt a binding method. The platform of the first manufacturer cannot directly authenticate the device of the second manufacturer. The device of the second manufacturer needs to be authenticated through the platform of the second manufacturer. For example, the device of the second manufacturer has a pre-configured authentication key, which is also partially stored in the platform of the second manufacturer. The platform of the first manufacturer can obtain the device authentication key from the platform of the second manufacturer and complete the authentication of the device of the second manufacturer.

[0145] In the above case, the network access target device can be abbreviated to device, and an example of a network configuration device is a mobile phone, where the mobile phone is from a first manufacturer and connects to the first manufacturer's cloud platform A. The network access target device is from a second manufacturer, and the second manufacturer's cloud platform is cloud platform B. As shown in FIG. 16, the specific operation steps of the flow for realizing access authentication during the network configuration of the device include the following steps:

[0146] S31, the network access target device broadcasts the SSID, which includes the device's manufacturer name, product name, and product serial number. Some information can also be carried in the IE included in the SSID broadcast Beacon frame.

[0147] S32, after the mobile phone discovers the device, it analyzes the discovery field in the device beacon broadcast message to obtain the manufacturer name, product name, and product serial number of the device.

[0148] S33: Optionally, the mobile phone presents the device manufacturer name, product name to the user, and the user decides to start device configuration.

[0149] S34: The mobile phone and the cloud platform A, for example, the cloud platform of the mobile phone, establish a secure connection. If the mobile phone and the cloud platform A are securely connected, there is no need to re-establish the connection.

[0150] S35, the mobile phone requests cloud platform A to obtain device authentication information, and the product name and product serial number of the device are carried in the request.

[0151] S36, the cloud platform A finds a cloud platform B corresponding to the device, for example, a cloud platform of the device, based on the product name and the product serial number of the device.

[0152] S37: Cloud platform A and cloud platform B establish a secure connection (cloud platform A and cloud platform B may have maintained a secure connection all along, and there is no need to re-establish the connection).

[0153] S38, cloud platform A requests cloud platform B to obtain device authentication information carrying the product name and product serial number of the device.

[0154] S39, cloud platform B finds authentication information corresponding to the device according to the product name and product serial number of the device, including the authentication certificate or related certificate issued after the device is authenticated by the unified test.

[0155] S40: Optionally, cloud platform B generates a platform authentication certificate for the device authentication platform. Optionally, the platform authentication certificate can include a timestamp indicating the time range for which the certificate is valid, or a serial number indicating that it is valid only this time.

[0156] S41: Optionally, cloud platform B generates device configuration information, such as device ID, certificate, key, etc., for configuring interconnection between the device and other devices of platform B.

[0157] S42, cloud platform B returns the device authentication information, the platform authentication certificate and the configuration information to cloud platform A.

[0158] S43, cloud platform A generates device configuration information such as device ID, certificate, key, etc. for configuring interconnection between the device and other devices of platform A.

[0159] S44, cloud platform A returns the device authentication information, platform authentication certificate, and configuration information to the mobile phone.

[0160] S45: if the user trigger of the third step is not realized, optionally, after receiving the device authentication and configuration information returned from the cloud platform A, the mobile phone presents the device manufacturer name and product name to the user, and the user decides to start device configuration.

[0161] S46, the mobile phone joins the device's SoftAP and establishes a secure connection.

[0162] S47, the mobile phone initiates platform authentication to the device and conveys a platform authentication certificate, which is used to indicate the authenticity of the platform.

[0163] S48: The device verifies the validity of the platform authentication certificate and the timestamp or serial number, and determines that it is a legitimate platform.

[0164] S49, the device initiates an access authentication request to the mobile phone, carrying the device's access authentication credentials.

[0165] S50: The mobile phone verifies the access certificate of the device using the device authentication information obtained from the cloud platform and determines that the device is a legitimate device.

[0166] S51, the mobile phone configures the device using configuration information obtained from the cloud platform.

[0167] S52, the mobile phone configures the network access SSID and password for the device, and allows the device to connect to the home network.

[0168] After a device has access to the home network, it can use configuration information such as the configured device ID, security keys, and certificates to access the cloud platform and communicate with other devices in the network.

[0169] The embodiment of the present application solves the problem of network configuration and network-configured devices being unable to connect to the cloud platform during the SoftAP network configuration process, and allows the network configuration terminal to represent the cloud platform in authenticating the device through the authentication agent method, thereby achieving an organic combination of network configuration and authentication steps, and authenticating equipment during the network configuration process, thereby improving security.

[0170] 17 is a block diagram of a terminal device 60 in an embodiment of the present application. The terminal device 60 includes a first receiving unit 61, a second receiving unit 62, and a device verification unit 63.

[0171] The first receiving unit 61 is configured to receive device authentication information corresponding to device information of a network access target device from a first cloud platform; The second receiving unit 62 is configured to receive an access authentication certificate from the network access target device; The device verification unit 63 is configured to verify the access authentication credentials using the device authentication information.

[0172] Optionally, in the embodiment of the present application, as shown in FIG. 18, the terminal device further includes a third receiving unit 64 and a sending unit 65. The third receiving unit 64 is configured to receive device information from the network access target device; The sending unit 65 is configured to send device information of the network access target device to the first cloud platform.

[0173] Optionally, in an embodiment of the present application, the third receiving unit 64 is further configured to receive a service set identifier SSID broadcasted by the network access target device, and the device information in the SSID includes at least one of manufacturer information and product information.

[0174] Optionally, in an embodiment of the present application, the sending unit 65 is further configured to, when the terminal device securely connects to the first cloud platform, send an authentication information acquisition request to the first cloud platform, where the authentication information acquisition request includes product information of the network access target device.

[0175] Optionally, in an embodiment of the present application, the first receiving unit 61 is further configured to receive device authentication information corresponding to the product information from the first cloud platform.

[0176] Optionally, in an embodiment of the present application, the sending unit 65 is further configured to, when the terminal device is securely connected to the first cloud platform, send an authentication information acquisition request to the first cloud platform, where the authentication information acquisition request includes manufacturer information and product information of the network access target device, where the manufacturer information corresponds to a second cloud platform, and the product information corresponds to device authentication information.

[0177] Optionally, in an embodiment of the present application, the first receiving unit 61 is configured to receive device authentication information corresponding to the product information from the first cloud platform, where the device authentication information corresponding to the product information is obtained from a second cloud platform, where the first cloud platform corresponds to the manufacturer information.

[0178] Optionally, in an embodiment of the present application, the terminal device further includes a control unit 66, which is configured to join a soft access point SoftAP of the network access target device after the terminal device sends device information of the network access target device to the first cloud platform.

[0179] Optionally, in the embodiment of the present application, the terminal device further includes a first platform verification unit 67, which sends a platform certificate of the first cloud platform to the network access target device after the terminal device joins the SoftAP of the network access target device and establishes a secure connection with the network access target device, to verify whether the first cloud platform is legitimate.

[0180] Optionally, in the embodiment of the present application, the terminal device further includes a second platform verification unit 68, which sends a platform certificate of the second cloud platform to the network access target device after the terminal device joins the SoftAP of the network access target device and establishes a secure connection with the network access target device, to verify whether the second cloud platform is legitimate.

[0181] Optionally, in embodiments of the present application, the platform certificate includes a timestamp or a serial number.

[0182] Optionally, in the embodiment of the present application, the second receiving unit 62 is further configured to receive an encrypted access authentication certificate from the network access target device. The terminal device further includes a third platform verification unit 69, which uses platform decryption information to decrypt the encrypted access authentication certificate and sends the decrypted data to the network access target device, and the network access target device verifies whether the decryption is successful, and the cloud platform corresponding to the platform decryption information that is successfully decrypted is a legitimate platform.

[0183] Optionally, in an embodiment of the present application, the second receiving unit 62 is further configured to receive an access authentication request from the network access target device when the verified cloud platform is legitimate, and the access authentication request includes an access authentication certificate.

[0184] Optionally, in an embodiment of the present application, the device verification unit 63 is further configured to use the device authentication information to verify the access authentication certificate, and determine whether the network access target device is a legitimate device.

[0185] Optionally, in an embodiment of the present application, the terminal device further includes a configuration unit 601, and the configuration unit 601 is configured to configure the network access target device using configuration information from the device when the network access target device is a legitimate device, where the device configuration information is obtained from the first cloud platform or the second cloud platform.

[0186] The terminal device 60 of the embodiment of the present application can realize the corresponding functions of the terminal device in the above-mentioned method embodiment. The flow, function, implementation form, and beneficial effects corresponding to each module (sub-module, unit, component, etc.) in the terminal device 60 can refer to the corresponding description in the above-mentioned method embodiment, and the description will be omitted here. Note that the functions described in each module (sub-module, unit, component, etc.) in the terminal device 60 according to the embodiment of the present application may be realized by different modules (sub-modules, units, components, etc.) or may be realized by the same module (sub-module, unit, component, etc.).

[0187] 19 is a block diagram of a first cloud platform 70 in an embodiment of the present application. The first cloud platform 70 includes a receiving unit 71, an acquiring unit 72, and a sending unit 73; The receiving unit 71 is configured to receive device information of a network access target device from a terminal device; The obtaining unit 72 is configured to obtain device authentication information corresponding to the device information; The sending unit 73 is configured to send the device authentication information to the terminal device, which is used by the terminal device to verify the access authentication credential from the network access target device.

[0188] Optionally, in an embodiment of the present application, the receiving unit 71 is further configured to receive an authentication information acquisition request from the terminal device when the terminal device is securely connected to the first cloud platform, where the authentication information acquisition request includes product information of the network access target device.

[0189] Optionally, in an embodiment of the present application, the sending unit 73 is further configured to: cause the first cloud platform to send device authentication information corresponding to the product information to the terminal device.

[0190] Optionally, in an embodiment of the present application, the sending unit 73 is further configured to send a platform certificate of the first cloud platform to the terminal device.

[0191] Optionally, in an embodiment of the present application, the receiving unit 71 is further configured to receive a first authentication information acquisition request from the terminal device when the terminal device is securely connected to the first cloud platform, where the first authentication information acquisition request includes manufacturer information and product information of the network access target device, and the acquiring unit 72 is further configured to send a second authentication information acquisition request to a second cloud platform corresponding to the manufacturer information, where the second authentication information acquisition request includes the product information, and receive device authentication information corresponding to the product information from the second cloud platform.

[0192] Optionally, in an embodiment of the present application, the sending unit 73 is further configured to send device authentication information corresponding to the product information obtained from the second cloud platform to the terminal device.

[0193] Optionally, in an embodiment of the present application, the receiving unit 71 is further configured to receive a platform certificate of the second cloud platform, and the sending unit is further configured to send the platform certificate of the second cloud platform to the terminal device.

[0194] Optionally, in an embodiment of the present application, the acquiring unit 72 is further configured to acquire or generate device configuration information of the network access target device from the second cloud platform, and the sending unit 73 is further configured to send the device configuration information to the terminal device.

[0195] The first cloud platform 70 of the embodiment of the present application can realize the corresponding functions of the terminal device in the above-mentioned method embodiment. The flow, function, implementation form, and beneficial effects corresponding to each module (sub-module, unit, component, etc.) in the first cloud platform 70 can refer to the corresponding description in the above-mentioned method embodiment, and the description will be omitted here. Note that the functions described in each module (sub-module, unit, component, etc.) in the first cloud platform 70 according to the embodiment of the present application may be realized in different modules (sub-modules, units, components, etc.) or in the same module (sub-module, unit, component, etc.).

[0196] 20 is a block diagram of a second cloud platform 80 in an embodiment of the present application. The second cloud platform 80 includes a receiving unit 81, an acquiring unit 82, and a sending unit 83; The receiving unit 81 is configured to receive device information of a network access target device; The obtaining unit 82 is configured to obtain device authentication information corresponding to the device information; The sending unit 83 is configured to send the device authentication information to a first cloud platform, and send the device authentication information to a terminal device via the first cloud platform, where the device authentication information is used by the terminal device to verify the access authentication certificate from the network access target device.

[0197] Optionally, in an embodiment of the present application, the receiving unit 81 is further configured to receive an authentication information acquisition request from the first cloud platform, where the authentication information acquisition request includes product information of the device to be accessed through the network, and the acquiring unit 83 is further configured to acquire device authentication information corresponding to the product information.

[0198] Optionally, in an embodiment of the present application, the sending unit 83 is further configured to send a platform certificate and / or device configuration information to the first cloud platform.

[0199] The second cloud platform 80 of the embodiment of the present application can realize the corresponding functions of the terminal device in the above-mentioned method embodiment. The flow, function, implementation form, and beneficial effects corresponding to each module (sub-module, unit, component, etc.) in the second cloud platform 80 can refer to the corresponding description in the above-mentioned method embodiment, and the description will be omitted here. Note that the functions described in each module (sub-module, unit, component, etc.) in the second cloud platform 80 according to the embodiment of the present application may be realized by different modules (sub-modules, units, components, etc.) or the same module (sub-modules, units, components, etc.).

[0200] 21 is a block diagram of a network access target device 90 according to an embodiment of the present application. The network access target device 90 includes a sending unit 91, The sending unit 91 is configured to send an access authentication certificate of the network access target device to a terminal device, and verify the access authentication certificate by using device authentication information of the network access target device obtained from the cloud platform by the terminal device.

[0201] Optionally, in an embodiment of the present application, as shown in FIG. 22 , the network access target device further includes a verification unit 92; The verification unit 92 is configured to verify whether the cloud platform is a legitimate platform.

[0202] Optionally, in an embodiment of the present application, the verification unit is further configured to receive a platform certificate before the sending unit sends the access authentication certificate of the network access target device to the terminal device, and verify whether the cloud platform is legitimate based on the platform certificate, and if the cloud platform is legitimate, instruct the sending unit to send the access authentication certificate of the network access target device to the terminal device.

[0203] Optionally, in an embodiment of the present application, the verification unit further sends an encrypted access authentication certificate to the terminal device, receives decrypted data from the terminal device, the decrypted data being data obtained by the terminal device decrypting the access authentication certificate based on platform decryption information, and verifies whether the decryption is successful based on the decrypted data, and the cloud platform corresponding to the platform decryption information that is successfully decrypted is a legitimate platform.

[0204] Optionally, in the embodiment of the present application, the network access target device further comprises a control unit 93; The control unit 93 is configured to determine that the terminal device joins the SoftAP of the network access target device and that the network access target device establishes a secure connection with the terminal device before the network access target device sends the access authentication certificate of the network access target device.

[0205] Optionally, in the embodiment of the present application, the network access target device further comprises a broadcast unit 94; The broadcast unit 94 broadcasts a service set identifier SSID before the terminal device joins the SoftAP of the network access target device and the network access target device determines to establish a secure connection with the terminal device, and the device information of the network access target device in the SSID includes at least one of manufacturer information and product information.

[0206] The network access target device 90 of the embodiment of the present application can realize the corresponding functions of the terminal device in the above-mentioned method embodiment. The flow, function, implementation form, and beneficial effects corresponding to each module (sub-module, unit, component, etc.) in the network access target device 90 can refer to the corresponding description in the above-mentioned method embodiment, and the description will be omitted here. Note that the functions described in each module (sub-module, unit, component, etc.) in the network access target device 90 according to the embodiment of the present application may be realized by different modules (sub-modules, units, components, etc.) or may be realized by the same module (sub-module, unit, component, etc.).

[0207] 23 is a schematic diagram of a communication device 600 according to an embodiment of the present application. The communication device 600 includes a processor 610 that can call and execute a computer program from a memory to implement a method according to an embodiment of the present application.

[0208] Optionally, as shown in Figure 23, the communication device 600 may also include a memory 620. Here, the processor 610 can call and execute a computer program from the memory 620 to implement the method in the embodiment of the present application.

[0209] Here, the memory 620 may be a separate device from the processor 610 or may be integrated into the processor 610 .

[0210] Optionally, as shown in FIG. 23, the communication device 600 further includes a transceiver 630, and the processor 610 can control the transceiver 630 to communicate with other devices, specifically, to transmit information or data to other devices or to receive information or data transmitted by other devices.

[0211] Here, the transceiver 630 may include a transmitter and a receiver. The transceiver 630 may further include an antenna, and the number of the antennas may be one or more.

[0212] Optionally, the communication device 600 may be a terminal device of an embodiment of the present application, and the communication device 600 may implement corresponding flows implemented by a terminal device in various methods of the embodiment of the present application, which are omitted here for brevity.

[0213] Optionally, the communication device 600 may be the first cloud platform or the second cloud platform of the embodiments of the present application, and the communication device 600 may implement corresponding flows implemented by the first cloud platform or the second cloud platform in various methods of the embodiments of the present application, which are omitted here for brevity.

[0214] Optionally, the communication device 600 may be a network access target device in an embodiment of the present application, and the communication device 600 may implement corresponding flows implemented by the network access target device in various methods of the embodiment of the present application, which are omitted here for brevity.

[0215] 24 is a schematic diagram of a chip according to an embodiment of the present application. A chip 700 includes a processor 710 that can call and execute a computer program from a memory to implement a method according to an embodiment of the present application.

[0216] Optionally, as shown in Figure 24, the chip 700 may also include a memory 720. Here, the processor 710 may call and execute a computer program from the memory 720 to implement the method in the embodiment of the present application.

[0217] Here, the memory 720 may be a separate device from the processor 710 or may be integrated into the processor 710 .

[0218] Optionally, the chip 700 may further include an input interface 730. The processor 710 may control the input interface 730 to communicate with other devices or chips, and in particular, may obtain information or data sent by other devices or chips.

[0219] Optionally, the chip 700 may further include an output interface 740. The processor 710 may control the output interface 740 to communicate with other devices or chips, and in particular, may output information or data to other devices or chips.

[0220] Optionally, the chip may be a terminal device of an embodiment of the present application, and the chip may implement corresponding flows implemented by the terminal device in various methods of the embodiments of the present application, which are omitted here for brevity.

[0221] Optionally, the chip may be a network device such as the first cloud platform or the second cloud platform of the embodiments of the present application, and the chip may implement corresponding flows implemented by the first cloud platform or the second cloud platform in various methods of the embodiments of the present application, which are omitted here for brevity.

[0222] Optionally, the chip may be a network access target device of an embodiment of the present application, and the chip may implement corresponding flows implemented by the network access target device in various methods of the embodiment of the present application, which are omitted here for brevity.

[0223] The chips applied to the terminal device, the first cloud platform, the second cloud platform, and the network access target device may be the same chip or different chips. It should be noted that the chips referred to in the embodiments of the present application may be chips, such as system on chip, chip system, system level chip, or system on chip.

[0224] The above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other programmable logic device, transistor logic device, discrete hardware component, etc. Here, the above-mentioned general-purpose processor may be a microprocessor, any conventional processor, etc.

[0225] The above-mentioned memory may be a volatile memory or a non-volatile memory, or may include both a volatile memory and a non-volatile memory. Here, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM).

[0226] The above-mentioned memories are illustrative and not limiting, for example, memories in the embodiments of the present application may be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synch link DRAM, SLDRAM), and direct memory bus random access memory (Direct Rambus RAM, DR RAM), etc. That is, memories in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memory.

[0227] 25 is a block diagram of a communication system 800 according to an embodiment of the present application. The communication system 800 includes a terminal device 810 and a network device 820.

[0228] The terminal device 810 is configured to receive device authentication information corresponding to device information of a network access target device from a first cloud platform, receive an access authentication certificate from the network access target device, and verify the access authentication certificate using the device authentication information.

[0229] The first cloud platform 820 is configured to receive device information of a network access target device from a terminal device, obtain device authentication information corresponding to the device information, and send the device authentication information to the terminal device, where the device authentication information is used by the terminal device to verify the access authentication certificate from the network access target device.

[0230] The network access target device 830 is configured to send an access authentication certificate of the network access target device to a terminal device, and verify the access authentication certificate using device authentication information of the network access target device obtained from the cloud platform by the terminal device.

[0231] In one embodiment, the system further includes a second cloud platform 840, which is configured to receive device information of a network access target device, obtain device authentication information corresponding to the device information, send the device authentication information to the first cloud platform, and send the device authentication information to a terminal device via the first cloud platform, where the device authentication information is used by the terminal device to verify an access authentication certificate from the network access target device.

[0232] Here, the terminal device 810 may be used to realize the corresponding functions realized by the terminal device in the above-mentioned method, the first cloud platform 820 may be used to realize the corresponding functions realized by the first cloud platform in the above-mentioned method, the network access target device 830 may be used to realize the corresponding functions realized by the network access target device 830 in the above-mentioned method, and the second cloud platform 840 can be used to realize the corresponding functions realized by the second cloud platform in the above-mentioned method. For the sake of brevity, the description is omitted here.

[0233] The above embodiments may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, they may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the flow or function described in the embodiments of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or may be transmitted from one computer-readable storage medium to another, for example, the computer instructions may be transmitted from one website, computer, server, or data center to another website site, computer, server, or data center by wire (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)), or wireless (e.g., infrared, radio, microwave, etc.), such as infrared, radio, microwave, etc. The computer-readable storage medium may be any available medium accessible by a computer, or may include a data storage device, such as a server, data center, in which one or more available media are integrated. Usable media include magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), and semiconductor media (e.g., Solid State Disks (SSDs)).

[0234] In various embodiments of the present application, it should be understood that the magnitude of the sequence number of each process described above does not mean the order of execution, and the order of execution of each process should be determined based on its function and inherent logic, without being limited to the implementation process of the embodiments of the present application.

[0235] It may be obvious to those skilled in the art that the specific operation processes of the above-mentioned systems, devices, and units may refer to the corresponding processes in the above-mentioned method embodiments for ease of explanation and conciseness, and will not be further described here.

[0236] The above are only specific examples of the present application, and the scope of protection of the present application is not limited thereto, and no person skilled in the art can easily think of modifications or replacements that should be included in the scope of protection of the present application within the technical scope disclosed in the present application. Therefore, the scope of protection of the present application should be in accordance with the scope of protection of the claims.

Claims

1. The terminal device receives device information from the network access target device; The terminal device sends device information of the network access target device to a first cloud platform; The terminal device receives device authentication information corresponding to device information of the network access target device from the first cloud platform; The terminal device receives an access authentication certificate from the network access target device; The terminal device verifies the access authentication credential using the device authentication information; The terminal device receiving device information from the network access target device includes: The terminal device receives a service set identifier (SSID) broadcast by the network access target device, and the device information in the SSID includes at least one of manufacturer information and product information.

13. A device access authentication method comprising:

2. The terminal device receiving an access authentication certificate from the network access target device, The terminal device receives an access authentication request from the network access target device, the access authentication request including an access authentication certificate. The device access authentication method according to claim 1 .

3. The terminal device verifies the access authentication credential by using the device authentication information, The terminal device verifies the access authentication certificate using the device authentication information to determine whether the device to be accessed from the network is a legitimate device.

3. The device access authentication method according to claim 1 or 2.

4. The first cloud platform is a cloud platform that aggregates device authentication information from multiple manufacturers. The device access authentication method according to claim 1 .

5. The authentication information corresponding to the network access target device includes an authentication certificate or a related certificate issued after the network access target device passes unified test authentication. The device access authentication method according to claim 1 .

6. A terminal device including a third receiving unit, a sending unit, a first receiving unit, a second receiving unit, and a device verification unit, The third receiving unit is configured to receive device information from a network access target device; The sending unit is configured to send device information of the network access target device to a first cloud platform; The first receiving unit is configured to receive device authentication information corresponding to device information of a network access target device from a first cloud platform; The second receiving unit is configured to receive an access authentication credential from the network access target device; The device verification unit is configured to verify the access authentication credential using the device authentication information; The third receiving unit is further configured to receive a service set identifier (SSID) broadcast by the network access target device, and the device information in the SSID includes at least one of manufacturer information and product information. A terminal device comprising:

7. The second receiving unit is further configured to receive an access authentication request from the network access target device, the access authentication request including an access authentication certificate. A terminal device according to claim 6 .

8. The device verification unit is further configured to verify the access authentication certificate using the device authentication information to determine whether the network access target device is a legitimate device. A terminal device according to claim 6 or 7.

9. The first cloud platform is a cloud platform that aggregates device authentication information from multiple manufacturers. A terminal device according to claim 6 .

10. The authentication information corresponding to the network access target device includes an authentication certificate or a related certificate issued after the network access target device passes unified test authentication. A terminal device according to claim 6 .

11. A network access target device comprising a transmitting unit, The sending unit is configured to send the access authentication certificate of the network access target device to the terminal device, so that the terminal device verifies the access authentication certificate by using device authentication information of the network access target device obtained from the cloud platform; The sending unit is configured to broadcast a service set identifier (SSID) to the terminal device, so that the terminal device sends device information of the network access target device to the cloud platform; The SSID includes at least one of manufacturer information and product information. A network access target device comprising:

Images