Summary of the invention
The present invention proposes a kind of flexible access of supporting domestic electric appliance (monitored object), support subscriber customized intelligent control function combination (sight), support the consistance of intranet and extranet to monitor and guarantee the security of communication port and system itself and the Smart Home scheme of confidentiality.
The stratification of this programme based on system architecture definition, and the model of watch-dog and monitored object is abstract, decomposition and recombinant technology.This scheme comprises following main points:
(1) subsystem of intelligent domestic system is divided and layering framework;
(2) model of watch-dog and monitored object is abstract: decompose and mapping techniques;
(3) recombinant of monitored object unit and the realization of sight and control technology;
(4) user terminal of intranet and extranet consistance access is realized skill;
(5) encryption of system and communication port and security mechanism.
One, the subsystem of intelligent domestic system is divided and layering framework
What be different from other directly controls the system architecture of domestic electric appliance by user terminal, the present invention proposes that a kind of subsystem is clearly divided and the intelligent domestic system framework of stratification.
First, intelligent domestic system is divided into user terminal, intelligent domestic gateway, universal intelligent monitor, four subsystems of monitored object.Interface between each subsystem is done standardized abstract processing, guarantees the independence to a certain degree of subsystems on software and hardware.As shown in Figure 1.Wherein,
1, user terminal (hereinafter to be referred as " terminal ") is the access point that user controls whole intelligent domestic system, be generally general smart mobile phone, flat board, PC PC or other electronic equipments, on these electronic equipments, move this Smart Home user terminal software, to user, provide operation interface, and do order and data interaction by Ethernet message protocol and the intelligent domestic gateway of standard, to gateway, send and control the order of slave computer or obtain the data from slave computer;
2, intelligent domestic gateway (hereinafter to be referred as " gateway ") is the core of whole intelligent domestic system, except 1. realizing the gateway function that message protocol between Ethernet and watch-dog bus network transforms, also bringing into play realize 2. monitored object and monitored object unit to the mapping of watch-dog and watch-dog bus transform, 3. the explanation of sight carry out, the 4. function such as the dynamic monitoring of watch-dog and monitored object and management;
3, universal intelligent monitor (hereinafter to be referred as " watch-dog ") is that whole intelligent domestic system is carried out maincenter, being responsible for will be from online message commands and the data of watch-dog bus (hereinafter to be referred as " bus "), change into the associative operation to watch-dog port (and the monitored object being connected unit), simultaneously, by (monitored object) state arriving by watch-dog Port detecting or other data, be converted into the message commands or the data that meet bus network communication protocol, send on bus network;
4, monitor control object (hereinafter to be referred as " monitored object "), refer to those final controlled home appliances or input pickup etc., such as TV, air-conditioning, panel, touch switch, smog sensing etc.Monitored object can be divided into input detected object, control object output, and data object etc.Such as the televisor in hall is exactly an output control object, the touch switch of the bedroom head of a bed is an input detected object, and the camera that gathers video or image stream is provided, and may be defined as a data object.This programme has proposed the technology of a kind of abstract decomposition and recombinant, to monitored object carry out abstract modeling and description, details please refer to next joint " model of watch-dog and monitored object is abstract: decompose and mapping techniques ".
Secondly, the software architecture of Smart Home, can be divided into application layer, core layer and network layer, as shown in Figure 2.Wherein,
1, application to as if monitored object, monitored object unit or its combination (sight).The monitored object unit that monitored object obtains after decomposing, and the transaction module to monitored object unit Criterion, between application layer and core layer, define unified data-interface definition format, the bus type of these interface definition forms and monitored object and access thereof or port numbering are irrelevant;
2, core layer is responsible for generation, parsing, the conversion of message, and the realization of some other Core Feature, comprise the functions such as the decomposition of bus conversion, monitored object and the dynamic monitoring of explanation execution, watch-dog and the monitored object of mapping conversion, rights management, sight and management.When core layer need to be transmitted data to network layer, can be according to the bus type at the difference of upstream or downstream and monitored object place, automatically select correct network layer interface (Ethernet, CAN, 485,433, Zigbee, WIFI ... .) communicate;
3, network layer is responsible for the realization of the bottom communication between user terminal and gateway, gateway and watch-dog.Between the transceiver module of various bus types and core layer, according to unified interface format definition, between various watch-dogs and gateway, defined unified communication interface form.
Two, the model of watch-dog and monitored object is abstract: decompose and mapping techniques
1, the modeling of watch-dog
(1) as shown in watch-dog part in the middle of Fig. 3, in intelligent domestic system, the external interface of watch-dog can simplified characterization be: a 1. watch-dog bus interface, realize and between watch-dog and intelligent domestic gateway, by bus, be connected and communicate by letter, bus type can be CAN, RS485, RF315/433, Zigbee, wherein a kind of such as WIFI, each watch-dog has uniquely identified bus address in its bus, therefore, for a mounted intelligent domestic system, data group (bus type, bus address) and between watch-dog, set up mapping relations one to one, 2. one or more ports, monitored object unit of each port is connected, and realize the input of monitored object is detected or output is controlled, and each port can pass through port item unique identification.Therefore,, for a mounted intelligent domestic system, between data group (bus type, bus address, port numbers) and monitored object unit, mapping relations have one to one also been advised.The port here, it can be port physically, such as inputing or outputing of certain actual IO mouth on watch-dog, also port (each logic port deriving from by modes such as addressing such as certain actual physical port) that can be in logic, whole infrared output such as an infrared transceiver, according to the logic groups of coding, definable goes out a plurality of logic ports, and each logic port is the different household electrical appliance of remote control respectively;
(2), according to the feature of household electric appliances equipment, the type of watch-dog comprises substantially: 1. Intelligent infrared transponder, for realizing the infrared remote control to electrical equipment such as TV, air-conditionings; 2. intelligent light regulator, as the brightness regulation of light; 3. smart jack/switch, for turning on and off of the power supply of control apparatus equipment; 4. intelligent driver, for exporting some logic low and high levels, controlling outside some needs relay equipment that direct IO controls such as curtain etc.; 5. intelligent sensor, for inputting the digital switch quantity of some home appliances or detecting analog input amount, such as the input of photoimpact, touch switch, door magnetic, smoke transducer etc.; 6. intelligent security guard, for coordinating the sideband transmission of the first-class control of video camera and data; 7. watch-dog of some other specific type etc.
2, the modeling of monitored object
As shown in the right half of Fig. 3, for the various monitored object in household, from the convenience (easily accessing certain standardized port of watch-dog) of electrical control and the angle of custom naturally of user's operation, carry out model decomposition and standardization abstract, target monitoring object is decomposed and is abstracted into one or more monitored object subelements (being called " monitored object unit ") of being convenient to access standardization watch-dog port.For example, for electric equipments such as televisor, Set Top Box, air-conditionings, control the most intuitively and decompose " power switch " and " remote control " two monitored object units, and access respectively port of certain smart jack/switch and certain port of Intelligent infrared transponder, system only need be controlled this two monitored object units by these two ports corresponding to watch-dog, can realize to the controlling of this televisor, as shown in Figure 4; For the smoke transducer of charged pool, only has the monitored object unit of the input detection of " cigarette sense input "; For gas valve, there is the monitored object unit of the output control of one " relay control "; And for monitoring camera, the monitored object unit that comprises one " control channel ", realize transmitting order to lower levels or extraction state, and the monitored object of " data channel " unit, for transmit video flowing or the image stream of big data quantity by sideband, these two monitored object units, use may be certain several logic port of certain several watch-dog.
3, watch-dog/watch-dog port, the attribute of monitored object/monitored object unit and database description and the relational calculus of mapping relations
According to above analysis, we describe the attribute of these models and the subordinate between them and mapping relations by two simple and clear databases.These database files are kept on intelligent domestic gateway, and user terminal can obtain real-time update by Ethernet:
(1) watch-dog database file, the description that has comprised all watch-dogs to using in current intelligent domestic system, the corresponding data-base recording of each watch-dog.As shown in Figure 5, each data-base recording comprises: identification name is (for identifying a name of expressing the meaning of this watch-dog, such as " supply socket 1 in hall ", " infrared transponder in hall " etc.), bus type under this watch-dog is (such as RF433MHz bus, represent that this watch-dog communicates by RF433MHz bus and gateway), bus address (is distributed to the bus address of this watch-dog, for other equipment that are different from same bus, carry out addressing), watch-dog type (identifies the affiliated device type of this watch-dog, can coordinate bus address to realize further addressing and filter or operate the expanded functions such as filtration, such as " smart jack/switch ", " wireless infrared repeater " etc.), and some other data-base recording item of realizing subsidiary function
(2) monitored object and monitored object metadatabase file, comprised all monitored object to using in current intelligent domestic system and the description of monitored object unit thereof.As shown in Figure 6, database adopts the form of secondary tree directory to arrange, and trunk node represents a monitored object, follows a plurality of leaf nodes below each trunk node, each leaf nodes comprises a data-base recording, and each record is to a monitored object unit that should monitored object.Each trunk node has a unique sign, and the sign of corresponding monitored object, as " televisor in hall ".The corresponding data-base recording of monitored object unit of every leaf representative comprises: the port numbers (as " port one ") of the identification name of the watch-dog that identification name (for representing a name of expressing the meaning of this monitored object unit, such as " remote control ", " supply socket " etc.), this monitored object unit access (as " infrared transponder in hall ", " supply socket 1 in hall " etc.), watch-dog that this monitored object unit accessed and some other data-base recording item of realizing subsidiary function (such as the user right of this port of operation etc.)
(3) relationship map with search parsing:
By the relational calculus to " watch-dog database file " and " monitored object and monitored object metadatabase file ", gateway can be described the operation from user terminal easily, be converted into bus message and issue watch-dog, or by the bus message from watch-dog, be converted into operation or state description that user terminal can be understanding;
For descending operation, concrete way is described below: 1. user terminal sends an operation by Ethernet to intelligent domestic gateway and describes (such as " connect the supply socket of the TV in hall "), and the most basic core of this description comprises a monitored object unit (such as " supply socket of the TV in hall ") and operational code for this monitored object unit and operating parameter (such as " connection " power supply).2. intelligent domestic gateway receives after this operation description, from " monitored object and monitored object metadatabase file " Rigen, according to monitored object sign and monitored object unit sign, find corresponding record, obtain the parameter (such as " operating right " is " domestic consumer ") of " the watch-dog sign accessing " (such as " smart jack 1 in hall "), " institute's access watch-dog port numbers " (such as " m ") and other subsidiary functions in this record etc.3. follow, according to " the watch-dog sign accessing " that obtain, from " watch-dog database file ", search and obtain this watch-dog corresponding " bus type " (such as " CAN "), " bus address " (such as address is " 2 ") and " watch-dog type " (such as " smart jack switch ").So 4., intelligent domestic gateway is according to simple relational calculus, operation from user terminal is described to the core body part that (that is: monitored object unit+operational code and operating parameter) changed into a data message that is adapted at sending in bus (that is: bus type+bus address+watch-dog type+message data, wherein message data=watch-dog port numbers+operational code and operating parameter), and message protocol according to the rules sends in bus.5. " bus type+bus address+watch-dog type " realizes the addressing to Target Monitor, and " watch-dog port numbers+operational code and operating parameter " is responsible for resolving and transforming by watch-dog, at the target port of this watch-dog, carry out output and control or input the operations such as detection.And due to this port of this watch-dog, with target monitoring, picture dot is connected, so, finally realized the monitoring to this monitored object unit;
For up operation, concrete way is equivalent to a descending inverse process above, be briefly described below: 1. monitored object unit sends data by the watch-dog port of its connection to watch-dog, the core body of these data comprises mode of operation code and mode of operation parameter.Watch-dog, after receiving these data, and after the combination of this port numbers and bus address, by the bus at this watch-dog place, sends to intelligent domestic gateway with the form of bus message.2. intelligent gateway receives after this bus message in certain bus interface, according to " bus type+bus address+watch-dog type " wherein, from " watch-dog database file ", find corresponding watch-dog sign, then from " monitored object and monitored object metadatabase file " Rigen according to " watch-dog sign and port numbers obtain monitored object unit sign.3. intelligent domestic gateway sends to user terminal by " monitored object unit's sign+mode of operation code and mode of operation parameter " by Ethernet.
4, the increase and decrease of watch-dog and monitored object or modification
(1) increase and decrease of watch-dog and monitored object and modification, be equivalent to generation and the modification of above-mentioned two database files
(2) for user-friendly readability, some component identifications that those are relevant with user terminal application layer, comprise the sign of watch-dog, monitored object, the sign of monitored object unit, all adopt the mode (as " smart jack 1 in hall ", " TV in hall ", " power switch " etc.) of directly expressing the meaning; And those elements in core layer or network layer can be used the form of enumerating assignment to simplify processing, such as bus type CAN is defined as " 0 ", bus type RF433 is defined as " 1 ", and the rest may be inferred for other watch-dog bus types
(3) especially,, for the mode of operation code of various monitored object unit and definition and the parsing of parameter, give application layer and complete.Application layer at user terminal, for each monitored object, have database file corresponding with it, this database file is realized the operational code of digitized operational code and parameter and expressing the meaning and the mapping one by one between parameter, is referred to as " monitored object express the meaning data of description library file ".When user terminal software need to be to certain monitored object transmitting order to lower levels, the operational code by expressing the meaning and parameter are searched and are obtained digitized operational code and parameter, by gateway and watch-dog, send to monitored object; When user terminal software receives from certain monitored object process mode of operation code that watch-dog and gateway transmitted up and parameter, by digitized operational code and anti-operational code and the parameter that checks in expressing the meaning of parameter, and show in the user interface of user terminal software.Therefore, when increasing the monitored object of a newtype, mainly in user terminal software, increase by one for this monitored object " data of description of expressing the meaning library file ", after processing like this, when increase and decrease or modification monitored object, not only accomplished the independence with core layer and network layer, and guaranteed the independence of user terminal application software core body and monitored object, thereby greatly increased to intelligent domestic system increase and decrease or revised the simplicity of monitored object
(4) generation and the modification of the abstract and database of the decomposition of monitored object, dynamically complete installing first, when later stage increase and decrease or change monitored object.User can complete this work by a simple small tool, also can transfer to supplier according to the mode of user's usage monitoring object, after off-line generates after above-mentioned three database files, download in user terminal software package and intelligent domestic gateway in.
5, brief summary
After above-mentioned modeling process, comprise monitored object is decomposed to abstract and Database Mapping and relational calculus, monitored object can flexible and convenient the various standardized watch-dogs of access, meanwhile, be also easy to combination and obtain higher level monitoring combination and realize the support to sight control model.
Three, the recombinant of monitored object unit and the realization of sight and control technology
1, the recombinant of monitored object unit and the concept of sight
By the abstract decomposition of above-mentioned process and and watch-dog port between set up the monitored object unit of mapping relations, if according to the basic composition of single monitored object, in application layer, reconfigure monitoring, be called simple recombinant, can realize the monitoring to single monitored object.If further, the monitored object unit by a plurality of monitored object or a plurality of monitored object, combines according to certain user habit or functional purpose, adds execution sequence and the logic Rule of judgment of sequencing simultaneously, is referred to as complicated recombinant, or is called sight.Sight belongs to a kind of combination form of expression of high-level user view, and for example user wishes may wish when going home that entrance hall can play music, opens corridor, entrance hall lamp, and opens curtain.These intentions that operate for electrical equipment of user are combined to description, are exactly a kind of sight.Simple recombinant to the monitoring of single monitored object, is also used as the simplest a kind of sight and processes.
2, the status attribute of sight and conversion thereof
(1) sight is according to its current present state, can mainly be divided into static, activate and executing state, and some facilitate other of Function Extension can further self-defining state:
1. resting state: sight is preserved in the file system with system with the form of static file stream at first, and this state of sight is called as the resting state of sight
2. activated state: allow a sight work in system, first should be by this sight loading system internal memory.If sight is after being written into internal memory, do not carry out at once but enter monitoring waiting status (waiting for a reason that is called as " the triggering factor "), this state of this sight after being written into is called as activated state so.This action by this sight loading system internal memory is called as " activation " of sight, and it generally comes from the activation command of external user, also may the nesting allocation order to this sight from another one sight inside.Whether the sight in activated state is a kind of " ready supervision " state, and it is monitoring whether its trigger condition is met constantly, and have external trigger order to arrive.When trigger condition is met, maybe ought receive external trigger order, sight can enter execution state from activated state
3. execution state: the sight in execution state, can carry out the more defined row sequences of operation of sight.After being finished, meeting, according to the exit criteria of the definition of sight, is got back to resting state or activated state automatically
4. expand state: resting state, activated state, execution state are topmost three states of sight.In order to increase or to expand some functions to system, outside these states, can expand some transitional or descriptive states, be referred to as the expansion state of sight.The expansion state of sight is mainly brought into play some complementary effects
(2) state of sight transforms:
As shown in Figure 7, the conversion schematic diagram between three of sight kinds of main states.Sight in resting state, by activation command or trigger command, activates or executing state and enter.Sight in activated state, returns stationary state by countermanding an order; By trigger command or monitor the triggering factor, and enter execution state.Sight in executing state, by countermanding an order or after its sequence of operation is finished, according to the attribute of sight itself or cancel parameter, or enters stationary state, or enters state of activation and restart triggering the supervision of the factor.The operational order of said order, or external user here, or from the nesting allocation order of another one sight.
3, the inscape of sight
The key element that forms sight, comprising:
(1) the sign title of sight:
A title of expressing the meaning that is used for certain sight of unique identification, such as " home mode "
(2) condition that sight is triggered---trigger the factor, trigger prerequisite, trigger retention time:
Trigger the factor, trigger prerequisite, trigger retention time, be used to specify the factor being triggered and the constraint of activated state sight
1. trigger the factor: the sight in activated state, when there is certain or certain several factor, can automatically be triggered and enter execution state, this factor is called as the triggering factor.Such as, carry out the sight of certain warning function, general in monitoring ready activated state at ordinary times; When detecting someone and come in, will start to carry out and play warning, send the operations such as SMS notification proceeding to execution state; All can automatically open the operation that the simulations such as hall lamp have people to be in 8 of nights every day.Here, " detecting someone comes in " and " point at every day to nights 8 " is respectively respectively two triggering factors.Triggering the factor is the concept of " point ", is divided into two kinds of Status Change and clocked flips.If Status Change triggers, on electric, show as the saltus step edge that a digital signal detected, or certain analog quantity is passed through certain threshold value; If clocked flip shows as in time current time and arrives or crossing point sometime.The triggering factor can have a plurality of, is the relation of " or logic " between them
2. trigger prerequisite: trigger the precondition that the factor can play a role, only when triggering precondition and be satisfied, trigger the factor and be just accepted and trigger sight and enter executing state.Such as, certain sight of watering flowers, only require just to carry out during at 10-30 degree Celsius at 9 in morning of on every Tuesdays with four and room temperature the action of watering, can be used as one here at 9 in the morning and trigger the factor, " Tuesday, four " and " room temperature is at 10-30 degree Celsius " are exactly two and trigger prerequisite, between these two prerequisites, are the relations of " with logic ".Triggering prerequisite is the concept in " interval ", comprises two kinds of state prerequisite and time prerequisites.If state prerequisite, show as low and high level state or an analog quantity that a digital signal detected on electric and drop on certain interval, if time prerequisite shows as in time, current time is positioned at certain time interval.The prerequisite of setting out can have a plurality of, is the relation of " or logic " between them
3. trigger retention time: in the occasion of some special applications, need in a period of time after sight is activated, even if exist to trigger the factor and meet, trigger prerequisite, also not trigger this sight and enter executing state.Only have after sight is activated and surpasses during this period of time, sight just can be triggered existing to trigger the factor and meet under the condition that triggers prerequisite.During this period of time, be called as " triggering retention time "
(3) sequence of operation collection:
1. sequence of operation collection is the core of sight effect.Sight, by explaining the sequence of operations in executable operations sequence, completes the described a series of user views of sight
2. sequence of operation collection is comprised of many sequences of operation, and every composition the most basic comprises: the precondition of the time migration that operand, operational code and parameter, sequence are carried out, the number of times repeating and intermittence, execution etc.Wherein, the type of " operand " comprises monitored object unit (such as " power switch of the televisor in hall "), watch-dog (such as " all watch-dogs in hall "), sight (such as " pattern of leaving home ") and other targets that need to use (such as " note ", " bus ", " user terminal ") in kind etc.; " operational code and parameter " representative add action type and the parameter to operand, such as " unlatching ", " reset ", " trigger and be finished then enter activated state ", " SMS notification; content is XXXX ", " by bus uploading data XXXX ", " informing user terminal, data are XXXX " etc.; The time migration that sequence is carried out, refers to and after sight is activated, how long just starts to carry out this sequence of operation, and the time migration of each sequence of operation is different, thereby has realized logical order and the time delay execution of multioperation; Certain action need of some occasion repeats, and " number of times repeating and intermittently " is used for supporting this attribute of the sequence of operation; The precondition of carrying out, it is the precondition that this sequence can be performed, such as certain sequence of operation be such description " destination object be curtain, the operational code in hall be open, to equal 10 seconds, the precondition carried out be that outdoor brightness is over 3 grades in time migration ", wherein " outdoor brightness is over 3 grades " are exactly to carry out the precondition of opening curtain action, only have outdoorly bright enough time, just need to carry out this sequence of operation and remove to open curtain
3. sight has not only completed the sequence of operations of monitored object unit and combination thereof has been described, and support administering and maintaining of some other destination object except monitored object, in example above, by the sequence of operation " all watch-dogs in reset hall ", " cancelling the pattern of leaving home ", " SMS notification; content is XXXX " etc., be just not limited to the operation to monitored object
(4) the sight state of the sequence of operation after being finished:
After all sequences of operation of sight are performed, sight can transform to two different states from executing state, is respectively activated state and resting state.Some sight, after being finished, all sequences of operation wish that it can thoroughly exit, such as " sight of going home ", after execute in triggering home mode and turn on light, play music, the curtain of taking a breath, window etc. moved, we no longer need this sight to exist, so can thoroughly release this sight.And other sight, we wish after all sequences of operation are finished, the activated state that continues to get back to " ready supervision " continues to monitor and triggers the factor, when receiving that when triggering the factor, sequence of operation rally is carried out again, such as " the security protection sight of leaving home ", after complete the spending of hole irrigation today 9, if the later date triggers, meet the demands, need again to carry out this sequence of operation, so after carrying out this sight, we wish that it gets back to state of activation and continue to monitor the factor and the condition of triggering
This function, can realize by one " state after the sequence of operation is finished " sign.
4, the description of sight and explanation are carried out
(1) this programme adopts the mode of script file (being called sight description script) to be described sight.In script file, comprise successively a plurality of sight description script projects, the corresponding sight of each sight description script, defines each inscape that some key words characterize sight
(2) by sight description script be written into and explain execution, realize user's various intentions
1. the activation of sight: scanning sight description script file, the corresponding sight item obtaining according to " sign title " coupling of sight, the inscape of this sight is written into internal memory with the form of a structure example, the state of this sight is set to " activated state ", and starts to monitor the condition that this sight is triggered
2. the triggering of sight: be met when receiving the condition of being triggered of the sight of external trigger order or activated state, this sight need to be triggered.If this sight is not yet activated, first according to the method for above-mentioned " the 1. activation of sight ", activate this sight, then trigger this sight.After sight is triggered, each sequence of operation in systematic order scan operation sequence sets, explains according to the definition in the inscape of sight " 3, ", explains and carries out successively.After all sequences of operation (number of times that comprises its repetition) are performed, " the sight state after the sequence of operation is finished " attribute according to sight itself, or when sending " trigger command ", entrained " the sight state after the sequence of operation is finished " parameter, next step is to enter resting state or activated state to determine sight
3. cancelling of sight: the sight in activated state or execution state, can, by the countermanding an order of outside, exit current state, and enter resting state or activated state.
Four, the user terminal of intranet and extranet consistance access is realized skill
As shown in fig. 1, user terminal comprises Intranet user terminal and external user terminal;
For Intranet user terminal, on intelligent domestic gateway, open up a server end daemon thread, each LAN subscriber terminal is as client, direct intelligent domestic gateway in same LAN initiates to connect (connect), then by socket (socket), communicates;
For external user terminal, the Smart Home net in but cannot be directly from outer net to Intranet initiates to connect.In order to address this problem, the invention provides two kinds of solutions, this two schemes can exist side by side.
(1) solution based on router intranet and extranet port mapping technology
The description of scheme: have certain router itself to possess the port forwarding function of a kind of being referred to as " virtual server ", realize outer network data and inwardly in net, specify the Service-Port of ip address to shine upon, thereby realize, the user terminal of outer net is mapped in Intranet.If on such router, by certain port mapping of router to the Service-Port of intelligent domestic gateway, when the outer net ip address that external user terminal access router is corresponding and port, just look like that user terminal in Intranet equally connects intelligent domestic gateway server end daemon thread
The advantage of this scheme: implement fairly simple
The limitation of this scheme: 1. in household, LAN (Local Area Network) accessing external network must be by supporting the router of the port forwarding function of " virtual server " to complete, when router is not supported this function, or, when in household, LAN (Local Area Network) is by form accessing external networks such as partial wideband or cable modem, the method may lose efficacy.So this method depends on the method for accessing external network, do not possess general applicability, especially in a lot of households, the mode of LAN (Local Area Network) accessing external network is newly-increased while disposing intelligent domestic system under definite prerequisite, and this method will be subject to great restriction.2. router online IP address must be fixed outside, or must adopt DDNS technology to guarantee that the domain name of router fixes, only in this way, and IP address or domain name link router that outer net client terminal just can be correct.Nonetheless, to outer net service provider ISP application fixedly IP tend to increase user's hire charge; And employing DDNS technology, except meeting increases certain operation cost, be often also difficult to guarantee the real-time update of corresponding relation between domain name and the dynamic IP of ISP distribution, so in reality operation, even if domain name is fixed, also may there is the problem that cannot successfully connect.3. this method is also unfavorable for being different from for external user terminal the unified management of Intranet user terminal.
(2) the external user terminal access technology that intelligent domestic gateway " initiatively connects outer net "
The description of scheme: realize the limitation in above-mentioned in order to overcome " (1) router intranet and extranet port mapping technology ", 1. at outer net node (or the Intranet of equivalence is to outer net mapping node), above place one " outer network server " (as shown in fig. 1), and two ports of network server move respectively two server ends outside this.2. intelligent domestic gateway, after start, initiatively goes to connect the server end that one of them port is corresponding as client, and after successful connection, sets up socket, realizes the communication between intelligent domestic gateway and outer network server.In order to ensure intelligent domestic gateway and outer network server, constantly keep being connected, even because there is change in the outer net address of router, also the connection of guaranteeing intelligent domestic gateway and outer network server is also real-time update, between intelligent domestic gateway and outer network server, set up a kind of " heartbeat mechanism ", that is: intelligent domestic gateway periodically outwards network server send heartbeat querying command, after receiving heartbeat querying command, outer network server returns to a heartbeat to intelligent domestic gateway and confirms, when for a long time not receiving while confirming from the heartbeat of outer network server, intelligent domestic gateway is thought and the connection of outer network server was lost efficacy, lay equal stress on and newly initiate new connection and set up new socket communication, outer network server uses up-to-date connection socket to communicate by letter with intelligent domestic gateway all the time.When 3. external user terminal need to be accessed intelligent domestic gateway, the server end that first outwards the another one port of network server is corresponding initiates to connect, and after successful connection, sets up socket, realizes the communication between external user terminal and outer network server.4. outer network server completes from the socket data of intelligent domestic gateway with from the forwarding exchange between the socket data of outer network termination
The advantage of this scheme: 1. generally there is no what restriction because LAN node is initiatively accessed outer net, so this scheme is not subject to the restriction of the mode of household Intranet accessing external network completely.2. by outer network server to forwarding exchange between the socket data from intelligent domestic gateway and the socket data from external user terminal, be convenient to realize the unified management to external user terminal, be also convenient to the strict security mechanism of connection setup between network server and intelligent domestic gateway outside.3. outer network server can be one or more, and the introducing of outer network server conveniently realizes intelligent domestic system to the expansion in wisdom community and wisdom city.Be positioned on center of housing estate server such as one, on the central server that is positioned at operator, can realize easily the unified maintenance management within the scope of the unified maintenance management in ground in community and operator.
Five, the encryption of system and communication port and security mechanism
On intelligent domestic gateway, increase a hardware security chip, auxiliary some safety encipher functions that realize.The safety encipher mechanism that the present invention proposes three aspects, the difficulty of enhancing and software inverse engineering, has farthest guaranteed the security of communication port.
1, based on user-defined binary file, encrypt issue mechanism
The software binary file beginning in source is easy to be cracked by reverse-engineering.An approach that acquires the software binary file beginning in source appears in the issuing process of binary file, comprises production, upgrades issue links such as (containing downloading upgrading).The present invention proposes a kind of scheme, allows binary file when being published, and adopt user-defined cryptographic algorithm to be encrypted, and its corresponding decipherment algorithm is before production, is solidificated in safety chip.Before after the binary file of download encrypting, programming writes in the ROM of intelligent domestic gateway, first by safety chip, be decrypted.For the ease of unified, produce and safeguard, the enciphering and deciphering algorithm here, for all intelligent domestic systems in batch or Yi Ge operator field, is all consistent.This mechanism, contributes to increase the difficulty of reverse-engineering, guarantees the profit of operator, protection terminal user's privacy and interests.
2, the code storage of the encryption and decryption based on hardware uniqueness and load mechanism
The software binary file beginning in source is easy to be cracked by reverse-engineering.An approach that acquires the software binary file beginning in source appears in the ROM of the production board of preserving binary file.The present invention proposes a kind of scheme, allow and download to the binary code of intelligent domestic gateway, before programming enters ROM, first by safety chip, be encrypted, and start from ROM and, after loading code and before run time version, by safety chip, be decrypted at intelligent domestic gateway.The parameter of this encryption and decryption is solidificated in safety chip in advance.The encryption parameter that every safety chip is used is all different, so the binary file that each intelligent domestic gateway is saved in ROM after encrypting is different.So, even read out binary file from the ROM of certain intelligent domestic gateway, be also difficult to after burned at other intelligent domestic gateways or do not have to carry out on the intelligent domestic gateway of safety chip.This mechanism, has greatly increased the difficulty of reverse-engineering, guarantees the profit of operator, protection terminal user's privacy and interests.
3, the dynamic encryption and decryption communication mechanism based on hardware uniqueness and asymmetric arithmetic
Guarantee the encryption safe of data communication channel, especially guarantee the encryption safe of communication port between intelligent domestic gateway and outer network server and outer network termination, for the security of assurance system operation and protection user's privacy, bringing into play effect greatly.The present invention proposes a kind of dynamic encryption and decryption communication mechanism based on hardware and asymmetric arithmetic, specifically describe as follows:
1. the key that is implanted into a pair of rivest, shamir, adelman at every safety chip is to (private key and PKI), and key is no less than 1024 to length, is called unique key pair.Every safety chip is assigned with a unique chip id, and its key being implanted into is to also all different.2. by the chip id of the safety chip in relevant range and PKI thereof, form a database, be kept at a secure hardware (higher security level is other) or encrypt file (compared with lower security rank) is inner, be dealt into the other side's (outer network server or LAN subscriber terminal) of intelligent domestic gateway communication.3. intelligent domestic gateway is after connecting with far-end server, or after the successful connection that listens to Intranet user terminal, in this locality, dynamically generate a pair of new key pair, dynamic PKI wherein, with after the right encrypted private key of unique key, is together sent to far-end server or LAN subscriber terminal together with oneself chip id.4. 3. far-end server or LAN subscriber terminal in receiving after the data from intelligent domestic gateway, according to chip id, search database in secure hardware or encrypt file, find the corresponding intrinsic PKI of this chip id, then with this PKI, the dynamic PKI after encrypting is decrypted and be kept at this locality.Then, far-end server or LAN subscriber terminal also dynamically generate a key pair in this locality, and with searching the intrinsic public key encryption obtaining above, send to intelligent domestic gateway with PKI wherein.5. intelligent domestic gateway, after the dynamic PKI receiving by the far-end server after the intrinsic public key encryption of oneself or LAN subscriber terminal, decrypts with the intrinsic private key of oneself.So far, intelligent domestic gateway and far-end server or LAN subscriber terminal, all obtained the other side's dynamic PKI separately, simultaneously in store dynamic private key separately.So intelligent domestic gateway and far-end server or LAN subscriber terminal, when sending or receiving data, are encrypted with dynamic key separately, and are decrypted with the other side's PKI.6. in order further to strengthen security, for the actual effect that dynamic key is right, make stipulations, when the time that certain dynamic key is used, surpass after certain official hour, the both sides of communication regenerate key pair separately, and repeat above 3.～similar procedure 5., dynamic PKI is separately sent to the other side
The advantage of this mechanism is except having given full play to the advantage of asymmetric arithmetic own, also be: the unique key of 1. preserving in the safety chip due to each intelligent domestic gateway is to different and not to external leakage, so, even if the encrypted tunnel of certain intelligent domestic gateway is broken solution, do not affect the communication port of other intelligent domestic gateways yet; 2. due in communication process, the key that the overwhelming majority time is used is to the temporary key for on-the-spot dynamic generation, so the unique key of system itself is very low to the probability that is exposed and cracks; Meanwhile, 3. because dynamic key is ageing to having, so, will be difficult to acquire the ciphertext of the sufficient amount of same encryption parameter, therefore increased the difficulty cracking; In addition, even if the encrypted communication channel of certain intelligent domestic gateway is broken solution, also only just within that time, crack effectively.User can the frequency of free adjustment key to dynamic change, and between the bandwidth taking because of dynamic password clearing house and the security of enhancing seeking balance.
This instructions is altogether with 7 system architecture diagrams that figure: Fig. 1 is intelligent domestic system, Fig. 2 is the software architecture figure of intelligent home control system, Fig. 3 is the monitoring model schematic diagram of monitored object unit and watch-dog port, Fig. 4 is an exemplary graph of monitored object unit and watch-dog port monitoring model, Fig. 5 is the tree-shaped description schematic diagram of watch-dog database, Fig. 6 is the tree-shaped description schematic diagram of monitored object database, and Fig. 7 is that the state of sight transforms schematic diagram.