CN114338082A - Method and system for safely connecting intelligent gateway to cloud platform - Google Patents

Method and system for safely connecting intelligent gateway to cloud platform Download PDF

Info

Publication number
CN114338082A
CN114338082A CN202111442714.4A CN202111442714A CN114338082A CN 114338082 A CN114338082 A CN 114338082A CN 202111442714 A CN202111442714 A CN 202111442714A CN 114338082 A CN114338082 A CN 114338082A
Authority
CN
China
Prior art keywords
platform
theme
message
equipment
client
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202111442714.4A
Other languages
Chinese (zh)
Inventor
李志军
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Fujian Supwit Group Co ltd
Original Assignee
Fujian Supwit Group Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Fujian Supwit Group Co ltd filed Critical Fujian Supwit Group Co ltd
Priority to CN202111442714.4A priority Critical patent/CN114338082A/en
Publication of CN114338082A publication Critical patent/CN114338082A/en
Pending legal-status Critical Current

Links

Images

Abstract

The invention discloses a method and a system for safely connecting an intelligent gateway with a cloud platform, which comprises the following steps: the equipment is connected with the platform through the client, and the client sends the unique identification code of the equipment to the platform; the platform inquires a user name and a password according to the unique identification code and performs connection login verification; after the verification is passed, the platform creates session information of the client, inquires a theme which can be subscribed by the unique identification code, and updates a client subscription theme list and a theme list allowed to be sent according to the theme which can be subscribed; when the platform receives the theme message of the equipment, judging whether the theme message is in the theme list allowed to be sent, if so, receiving the theme message, otherwise, discarding the theme message.

Description

Method and system for safely connecting intelligent gateway to cloud platform
Technical Field
The invention relates to the field of Internet of things, in particular to the fields of Internet of things platforms, smart pole management systems, smart city management systems and the like, and specifically relates to the technical field of IoT equipment connection platforms, authentication and information interaction management and control.
Background
The Internet of things is an important component of a new generation of information technology and is also an important development stage of the 'informatization' era. Its english name is: "Internet of things (IoT)". As the name implies, the Internet of things is the Internet with connected objects. This has two layers: firstly, the core and the foundation of the internet of things are still the internet, and the internet is an extended and expanded network on the basis of the internet; and secondly, the user side extends and expands to any article to perform information exchange and communication, namely, the article information. The internet of things is widely applied to network fusion through communication perception technologies such as intelligent perception, identification technology and pervasive computing, and is also called as the third wave of development of the world information industry after computers and the internet. IoT equipment is mostly directly connected with a platform by adopting an MQTT protocol at present, and the security control mainly adopts ssl/tls encryption or asymmetric encryption on an MQTT message at present.
MQTT (Message queue Telemetry Transport) is a lightweight protocol based on publish/subscribe (publish/subscribe) mode, which is built on top of TCP/IP protocol, and has the greatest advantage that it can provide real-time and reliable Message service for connecting remote devices with very few codes and limited bandwidth. As an instant messaging protocol with low cost and low bandwidth occupation, the method has wide application in the aspects of Internet of things, small-sized equipment, mobile application and the like.
MQTT is a client-server based message publish/subscribe transport protocol. The MQTT protocol is lightweight, simple, open, and easy to implement, which makes it very versatile. In many cases, including in restricted environments, such as: machine to machine (M2M) communication and internet of things (IoT). It has found widespread use in communication sensors via satellite links, occasionally dial-up medical devices, smart homes, and some miniaturized devices.
The existing MQTT encrypts content in the transmission process, a server supporting MQTT generally forwards messages by adopting a topic route, validity identification of equipment, sending and receiving of the equipment are not controlled, and security holes exist, for example, a terminal device of any access platform can simulate the platform to send messages to terminal devices of other access platforms.
Disclosure of Invention
Therefore, a method and a system for safely connecting the intelligent gateway to the cloud platform are needed to be provided, so that the problem of the safety of the connection between the equipment and the platform is solved.
In order to achieve the purpose, the invention provides a method for safely connecting an intelligent gateway with a cloud platform, which comprises the following steps:
the equipment is connected with the platform through the client, and the client sends the unique identification code of the equipment to the platform when establishing connection;
the platform inquires a user name and a password according to the unique identification code and performs connection login verification;
after the verification is passed, the platform creates session information of the client, inquires the topic of the message which can be subscribed and published by the unique identification code, and updates the client subscription topic list and the topic list allowed to be sent according to the topic of the message which can be subscribed and published;
when the platform receives the theme message of the equipment, judging whether the theme message is in the theme list allowed to be sent, if so, receiving the theme message, otherwise, discarding the theme message.
Further, the method also comprises the following steps: the platform updates a theme list which is allowed to be received by the client;
the method further comprises the steps of: when the platform receives the theme message sent to the equipment, the platform judges whether the theme message is in the theme list allowed to be received, if so, the platform forwards the theme message to the equipment, otherwise, the platform discards the theme message.
Further, the platform completes the steps of the method through a message middleware plug-in.
Further, the platform and the device communicate through an MQTT protocol.
Further, the MQTT protocol is also encrypted by ssl or tls.
Further, before the device is connected with the platform through the client, the method further comprises the following steps:
when the equipment is connected with the platform for the first time, the equipment is registered first, and the serial number, the login user name and the password of the equipment are input into the platform.
Further, the querying the platform for the username and password comprises: the platform inquires a user name and a password from an information center; or:
the platform inquiring the subject on which the unique identification code can subscribe and publish messages comprises: and the platform inquires the unique identification code from the information center to subscribe and publish the topic of the message.
Further, the session information is session information.
Further, the device is an IoT device.
The invention provides an intelligent gateway security connection cloud platform system which comprises equipment and a platform which are in communication connection with each other, wherein the equipment and the platform realize the steps of the method according to any one of the embodiments of the invention.
Different from the prior art, the technical scheme queries the theme of the messages which can be subscribed and published by the equipment according to the unique identification code of the equipment, manages and controls the theme when the equipment receives and sends the theme messages, avoids the forwarding of illegal messages and improves the safety.
Drawings
FIG. 1 is a flow chart of a method according to the present invention;
FIG. 2 is a schematic diagram of a system architecture according to the present invention;
fig. 3 is a schematic diagram of system message forwarding according to an embodiment of the present invention.
Detailed Description
To explain technical contents, structural features, and objects and effects of the technical solutions in detail, the following detailed description is given with reference to the accompanying drawings in conjunction with the embodiments.
Referring to fig. 1 to fig. 3, the present embodiment provides a method for a secure connection between an intelligent gateway and a cloud platform, which can be implemented on a cloud platform system. The cloud platform system comprises a platform and equipment, wherein the platform can be regarded as a server and can be called a server side. The equipment is equipment which is connected and communicated with the platform, such as a camera, terminal equipment, management equipment, wearing equipment and the like, the equipment is provided with a client of software, information interaction with the platform is realized through the client, and the information interaction can be realized through the connection mode of the Internet or the Internet of things.
When the invention is in safety communication, as shown in fig. 1, the invention comprises the following steps: step S101, the device is connected with the platform through the client, and the unique identification code of the device is sent to the platform when the client establishes connection. The unique identification code of the device can be stored in the device after the platform is generated, and has unique identification. The identification code may be in the form of a string of numbers, characters or words. And then in step S102, the platform inquires a user name and a password according to the unique identification code and performs connection login verification. Namely, the unique identification code is associated with the user name and the password, the user name and the password can be inquired through the unique identification code, and the verification of the user name and the password can be realized. And then, after the verification in step S103 is passed, the platform creates session information of the client, and the session information is used for maintaining the login state of the client. And the platform queries the topics of which the unique identification codes can subscribe and publish the messages, and updates the client subscription topic list (subscription addition requiring subscription, subscription cancellation not capable of subscription, and other maintenance) and the topic list allowed to be sent by the client according to the topics (topic) of which the messages can be subscribed and published. The subscribed themes may be factory set, such as different themes determined and associated with the unique identification code of the device based on different types of devices. In some embodiments, the subscribed topics may also be set by a platform administrator or a user, and the platform administrator or the user modifies the subscribed topics and associates the subscribed topics with the unique device identification code. And then when the platform receives the theme message of the device in step S104, judging whether the theme message is in the theme list allowed to be sent, if so, accepting the theme message, otherwise, discarding the theme message. Therefore, different theme types which can be accepted by the platform can be set for different devices, when the theme message which is sent to the platform by the device is received, the theme message can be judged and filtered, the device theme message which does not have the theme type can not be sent through the platform, and the device is prevented from simulating the device which does not have the theme type to send the message to the outside. If the platform has a platform-level theme type and the device does not have the platform-level theme type, when the device sends a theme message on the simulation platform, the platform will determine that the theme message is not in the theme list allowed by the device, and may discard the message, avoiding forwarding the message, thereby improving platform security.
The invention not only can control the theme message sent by the equipment, but also can control the theme message received by the equipment. Further, the method also comprises the following steps: and the platform updates the topic list allowed to be received by the client, namely updates the topic list allowed to be received when acquiring the subscription topic list. The method further comprises the steps of: when the platform receives the theme message sent to the equipment, the platform judges whether the theme message is in the theme list allowed to be received, if so, the platform forwards the theme message to the equipment, otherwise, the platform discards the theme message. Therefore, the management and control of the theme messages which can be received by the equipment can be realized according to the theme list which is allowed to be received, the theme messages which do not correspond to the equipment are prevented from reaching the equipment, and the safety of direct messages of the platform and the equipment is further ensured.
In some embodiments, the platform may further filter the specific content of the subject message, and the platform may further store a filtered message model, and when it is determined that the message content in the subject message received or sent by the device conforms to the filtered message model, the subject message is also discarded. And only when the message does not conform to the filtered message model and the topic type is the topic type which can be subscribed by the equipment, responding, such as forwarding, to the topic message, so that the safety is further improved.
The platform can realize the steps of the method of the invention through the system software of the platform, in some embodiments, the platform completes the steps of the method through a message middleware (mq) plug-in, and the message can be conveniently processed through the mq plug-in, thereby facilitating the system development.
The invention is not limited to the communication protocol, preferably, the system of the invention can be an internet of things system, the protocol can be an MQTT protocol commonly used in the internet of things, and the platform and the device communicate through the MQTT protocol. The device may also be a common internet of things IoT device. The messages communicated may be encrypted, for example, by using conventional ssl or tls, which is convenient for system development, or in some embodiments, by using a custom encryption scheme. The session message in the present invention is used to maintain the login status of the client, such as session information, and in some embodiments, may also be a cookie.
As mentioned in the foregoing embodiment, the platform may obtain the user name and the password according to the unique device identifier, and the user name and the password need to be stored in the platform in advance. In particular, registration and storage may occur when a device first connects to the platform. Then, before the device is connected to the platform through the client, the method further includes the following steps: when the equipment is connected with the platform for the first time, the equipment is registered first, and the serial number, the login user name and the password of the equipment are input into the platform. The platform may then generate a unique identification code based on the serial number of the device, such as by MD5 encryption of the device serial number, which is returned to the device and stored. The platform may authenticate the username and password and associate the unique identification code with the username and password. Therefore, the corresponding user name and the password can be obtained subsequently according to the unique identification code, the user name and the password are not required to be directly adopted, and the safety is improved.
The platform of the present invention may be a large server on which all the steps of the present invention may be performed, and in some embodiments, some functions may be implemented in other service device centers. Further, the invention also comprises an information center. The information center is used for realizing the storage function and the functions of verifying, managing messages and the like by the platform user. The querying of the username and password by the platform comprises: the platform inquires a user name and a password from an information center; or: the platform inquiring the subject on which the unique identification code can subscribe and publish messages comprises: and the platform inquires the unique identification code from the information center to subscribe and publish the topic of the message. Therefore, the resource consumption of the platform can be reduced through the message center, and the operating efficiency of the platform is improved.
As shown in fig. 3, as a specific embodiment, the system uses MQTT protocol for communication, and the MQTT connection uses ssl/tls encryption, and on this basis, the following operations are performed:
the first time the IoT device connects to the platform, it needs to register first, and enter the device serial number, login username and password, and other information into the platform. The other information may be user information or device information, etc.
The IoT equipment is connected with the platform through an MQTT client, the client needs to take a unique identification code of the equipment as clintId (client id), the unique identification code is obtained by calculating a serial number of the equipment by md5 or other abstract algorithms, and login is carried out through a user name and a password;
3. when the device is connected to a platform, namely a server connected to the MQTT, the mqt plug-in can implement the following functions:
1) when the equipment is connected, the plug-in takes the unique identification code of the MQTT, goes to the information center to inquire the user name and the password, and performs authentication check.
2) When the authentication is passed, mq creates session information of the client, after the session creation or reconnection is completed, the plugin queries the information center according to the clintId, takes the topic which can be subscribed by the equipment and the sent topic, then queries the topic which is currently subscribed by the equipment, and then compares the topic which is required to subscribe and not subscribed with the equipment, and cancels the topic which cannot be subscribed with the equipment. And updating the topic list which the device is allowed to send.
3) When the device sends a message, the mq checks the sent topic before receiving the message and preparing to forward, and if not, the plug-in is discarded (the platform can add filtering and screening on message capacity and needs to build a message content filtering model in the information center).
4) When the device wants to self-define the topic of the MQTT, the plug-in of the mq is also intercepted, and the subscription is directly discarded by the plug-in, or the plug-in queries an information center according to the clienid to check whether the device is allowed to subscribe to the topic, and the device is not allowed to directly discard and is allowed to subscribe.
5) When the mq forwards the message to the IoT device, it can also be intercepted by the plug-in to determine whether the device allows to accept the message content (the received topic is not determined at this time, and the second step and the fourth step have limited the message topic that can be received by the device).
The invention provides an intelligent gateway security connection cloud platform system which comprises equipment and a platform which are in communication connection with each other, wherein the equipment and the platform realize the steps of the method according to any one of the embodiments of the invention. The system queries the theme which can be subscribed by the equipment according to the unique identification code of the equipment, manages and controls the theme when the equipment receives and sends the theme message, avoids forwarding of illegal messages and improves safety.
It should be noted that, although the above embodiments have been described herein, the invention is not limited thereto. Therefore, based on the innovative concepts of the present invention, the technical solutions of the present invention can be directly or indirectly applied to other related technical fields by making changes and modifications to the embodiments described herein, or by using equivalent structures or equivalent processes performed in the content of the present specification and the attached drawings, which are included in the scope of the present invention.

Claims (10)

1. A method for safely connecting an intelligent gateway with a cloud platform is characterized by comprising the following steps:
the equipment is connected with the platform through the client, and the client sends the unique identification code of the equipment to the platform when establishing connection;
the platform inquires a user name and a password according to the unique identification code and performs connection login verification;
after the verification is passed, the platform creates session information of the client, inquires the topic of the message which can be subscribed and published by the unique identification code, and updates the client subscription topic list and the topic list allowed to be sent according to the topic of the message which can be subscribed and published;
when the platform receives the theme message of the equipment, judging whether the theme message is in the theme list allowed to be sent, if so, receiving the theme message, otherwise, discarding the theme message.
2. The method for the intelligent gateway to be safely connected with the cloud platform according to claim 1, further comprising the following steps: the platform updates a theme list which is allowed to be received by the client;
the method further comprises the steps of: when the platform receives the theme message sent to the equipment, the platform judges whether the theme message is in the theme list allowed to be received, if so, the platform forwards the theme message to the equipment, otherwise, the platform discards the theme message.
3. The method for the intelligent gateway to be safely connected with the cloud platform according to claim 1, wherein the method comprises the following steps: the platform completes the steps of the method through a message middleware plug-in.
4. The method for the intelligent gateway to be safely connected with the cloud platform according to claim 1, wherein the method comprises the following steps: the platform and the equipment communicate through an MQTT protocol.
5. The method for the intelligent gateway to be safely connected with the cloud platform according to claim 4, wherein the method comprises the following steps: the MQTT protocol is also encrypted by ssl or tls.
6. The method for the intelligent gateway to be safely connected with the cloud platform according to claim 1, wherein before the device is connected with the platform through the client, the method further comprises the following steps:
when the equipment is connected with the platform for the first time, the equipment is registered first, and the serial number, the login user name and the password of the equipment are input into the platform.
7. The method according to any one of claims 1 to 6, wherein the platform querying for a user name and a password comprises: the platform inquires a user name and a password from an information center; or:
the platform inquiring the subject on which the unique identification code can subscribe and publish messages comprises: and the platform inquires the unique identification code from the information center to subscribe and publish the topic of the message.
8. The method according to any one of claims 1 to 6, wherein the session information is session information.
9. The intelligent gateway secure connection cloud platform method according to any one of claims 1 to 6, wherein the device is an IoT device.
10. The utility model provides an intelligent gateway safe connection cloud platform system which characterized in that: comprising devices and platforms communicatively connected to each other, the devices and platforms implementing the steps of the method according to any of the claims 1 to 9.
CN202111442714.4A 2021-11-30 2021-11-30 Method and system for safely connecting intelligent gateway to cloud platform Pending CN114338082A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111442714.4A CN114338082A (en) 2021-11-30 2021-11-30 Method and system for safely connecting intelligent gateway to cloud platform

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111442714.4A CN114338082A (en) 2021-11-30 2021-11-30 Method and system for safely connecting intelligent gateway to cloud platform

Publications (1)

Publication Number Publication Date
CN114338082A true CN114338082A (en) 2022-04-12

Family

ID=81047878

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111442714.4A Pending CN114338082A (en) 2021-11-30 2021-11-30 Method and system for safely connecting intelligent gateway to cloud platform

Country Status (1)

Country Link
CN (1) CN114338082A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115514610A (en) * 2022-09-20 2022-12-23 四川虹美智能科技有限公司 MQTT-based method for constructing multi-split Internet of things
CN115580534A (en) * 2022-11-24 2023-01-06 锱云(上海)物联网科技有限公司 Data acquisition and transmission method, system, equipment and gateway

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020002688A1 (en) * 1997-06-11 2002-01-03 Prism Resources Subscription access system for use with an untrusted network
WO2012137215A1 (en) * 2011-04-08 2012-10-11 Yogesh Chunilal Rathod A system and method for communication
US20160291940A1 (en) * 2014-07-07 2016-10-06 Symphony Teleca Corporation Remote Embedded Device Update Platform Apparatuses, Methods and Systems
WO2020063992A1 (en) * 2018-09-29 2020-04-02 深圳前海达闼云端智能科技有限公司 Pon network, method and apparatus for pon network and robot system
CN111131501A (en) * 2019-12-31 2020-05-08 郑州信大捷安信息技术股份有限公司 MQTT protocol-based message pushing system and method
CN111343289A (en) * 2020-05-22 2020-06-26 苏宁智能终端有限公司 MQTT protocol-based message pushing method and system
CN112039882A (en) * 2020-08-31 2020-12-04 广州鲁邦通物联网科技有限公司 Message transmission processing method, system, device and storage medium
CN113014584A (en) * 2021-02-26 2021-06-22 北京金山云网络技术有限公司 Internet of things communication method and device, electronic equipment and storage medium

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020002688A1 (en) * 1997-06-11 2002-01-03 Prism Resources Subscription access system for use with an untrusted network
WO2012137215A1 (en) * 2011-04-08 2012-10-11 Yogesh Chunilal Rathod A system and method for communication
US20160291940A1 (en) * 2014-07-07 2016-10-06 Symphony Teleca Corporation Remote Embedded Device Update Platform Apparatuses, Methods and Systems
WO2020063992A1 (en) * 2018-09-29 2020-04-02 深圳前海达闼云端智能科技有限公司 Pon network, method and apparatus for pon network and robot system
CN111131501A (en) * 2019-12-31 2020-05-08 郑州信大捷安信息技术股份有限公司 MQTT protocol-based message pushing system and method
CN111343289A (en) * 2020-05-22 2020-06-26 苏宁智能终端有限公司 MQTT protocol-based message pushing method and system
CN112039882A (en) * 2020-08-31 2020-12-04 广州鲁邦通物联网科技有限公司 Message transmission processing method, system, device and storage medium
CN113014584A (en) * 2021-02-26 2021-06-22 北京金山云网络技术有限公司 Internet of things communication method and device, electronic equipment and storage medium

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115514610A (en) * 2022-09-20 2022-12-23 四川虹美智能科技有限公司 MQTT-based method for constructing multi-split Internet of things
CN115514610B (en) * 2022-09-20 2024-02-23 四川虹美智能科技有限公司 Method for constructing multi-split air conditioner based on MQTT (multiple-speed transmission protocol) internet of things
CN115580534A (en) * 2022-11-24 2023-01-06 锱云(上海)物联网科技有限公司 Data acquisition and transmission method, system, equipment and gateway
CN115580534B (en) * 2022-11-24 2023-02-21 锱云(上海)物联网科技有限公司 Data acquisition and transmission method, system, equipment and gateway

Similar Documents

Publication Publication Date Title
EP3726806B1 (en) Method for remotely controlling vehicle on the basis of smart apparatus
US11765150B2 (en) End-to-end M2M service layer sessions
CN107018147B (en) Internet of things communication method and system and gateway module
US10904340B2 (en) Method for operating an automation network
EP3073699B1 (en) System and method for controlling mutual access of smart devices
US9894518B2 (en) Server and method for remotely controlling working of communications terminal, and communications terminal
US20210136042A1 (en) Interworking between iot service layer systems and distributed ledger systems
CN110365741B (en) Connection establishing method and transfer server
CN114338082A (en) Method and system for safely connecting intelligent gateway to cloud platform
US20230300106A1 (en) Data processing method, network element device and readable storage medium
CN114157537A (en) System and method for realizing multi-source heterogeneous data access by general equipment gateway
CN110290176B (en) Point-to-point information pushing method based on MQTT
CN102546727B (en) Full-time on-line system and method of vehicle
US20220248228A1 (en) Methods and Apparatus for Device Authentication and Authorisation
CN113595991A (en) HTTP interface gateway, communication system and communication method
CN202050442U (en) Automobile full-time on-line system
Buchheim et al. Implementing the intrusion detection exchange protocol
CN103200211B (en) A kind of method of data synchronization, system and equipment
CN115426392B (en) Equipment network management method, device, equipment and storage medium
EP3580901B1 (en) Connection apparatus for establishing a secured application-level communication connection
WO2022141132A1 (en) Resource checking method for service-based interface and related device
CN117062075A (en) Private network security authentication method, device and system
CN117395016A (en) Data management method, device and system and readable storage medium
CN115842813A (en) Communication method and related device
CN117459256A (en) Mobile end cross-platform data communication system and method based on MQTT protocol

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination