CN114902611B

CN114902611B - Method and device for configuring client and communication system

Info

Publication number: CN114902611B
Application number: CN202080091231.1A
Authority: CN
Inventors: 茹昭; 张军
Original assignee: Guangdong Oppo Mobile Telecommunications Corp Ltd
Current assignee: Guangdong Oppo Mobile Telecommunications Corp Ltd
Priority date: 2020-03-12
Filing date: 2020-03-12
Publication date: 2023-12-05
Anticipated expiration: 2040-03-12
Also published as: CN114902611A; WO2021179267A1

Abstract

The invention discloses a method and a device for configuring a client, and a communication system. The method comprises the following steps: determining a target security domain added by a client; and switching the current stack in an active state on the client based on the matching relation between the target security domain and the mapping relation set, wherein the mapping relation set is used for storing the mapping relation between the security domain and the stack. The invention solves the technical problems of complex operation and lower configuration efficiency of the related technology that the client needs to be manually configured in the process of joining the security domain.

Description

Method and device for configuring client and communication system

Technical Field

The present invention relates to the field of communications, and in particular, to a method and apparatus for configuring a client, and a communication system.

Background

In the current internet of things architecture, after a new client APP connects to a network, a security domain existing in the network can be obtained, and the flow of joining the security domain by the client APP is as follows: the client APP creates a stack applied to the security domain; the created stack is loaded into the security domain by the client APP creating the security domain. In the whole process, manual configuration is needed, the operation is complex, and the configuration efficiency is low.

In view of the above problems, no effective solution has been proposed at present.

Disclosure of Invention

The invention provides a method and a device for configuring a client, and a communication system, at least in part, so as to at least solve the technical problems of complex operation and lower configuration efficiency in the process of manually configuring the client in the process of joining a security domain in the related art.

According to one embodiment of the present invention, there is provided a method for configuring a client, including: determining a target security domain added by a client; and switching the current stack in an active state on the client based on the matching relation between the target security domain and the mapping relation set, wherein the mapping relation set is used for storing the mapping relation between the security domain and the stack.

According to one embodiment of the present invention, there is also provided an apparatus for configuring a client, including: the first determining module is used for determining a target security domain added by the client; and the switching module is used for switching the current stack in an active state on the client based on the matching relation between the target security domain and the mapping relation set, wherein the mapping relation set is used for storing the mapping relation between the security domain and the stack.

According to one embodiment of the present invention, there is also provided a communication system including: the client is used for switching the current stack in an active state on the client based on the matching relation between the target security domain added by the client and the mapping relation set, wherein the mapping relation set is used for storing the mapping relation between the security domain and the stack; and the configuration equipment is positioned in the target security domain and is used for configuring the stack after the client is switched.

According to an embodiment of the present invention, there is also provided a storage medium having stored therein a computer program, wherein the computer program is arranged to execute the method of configuring a client in any of the above-mentioned claims when run.

According to an embodiment of the present invention, there is also provided a processor for running a program, wherein the program is arranged to execute the method of configuring a client in any of the above-mentioned claims at run-time.

According to one embodiment of the present invention, there is also provided a mobile terminal including a memory having a computer program stored therein and a processor configured to run the computer program to perform the method of configuring a client in any of the above.

According to one embodiment of the present invention, there is also provided a chip including: a processor arranged to call and run a computer program from the memory, such that the device on which the chip is mounted performs the method of configuring the client in any of the above.

According to one embodiment of the present invention, there is also provided a computer program product comprising computer program instructions for causing a computer to perform the method of configuring a client in any one of the above.

According to one embodiment of the present invention, there is also provided a computer program that causes a computer to execute the method of configuring a client in any one of the above.

In at least some embodiments of the present invention, after determining the target security domain added by the client, the current stack in the active state on the client may be switched based on the matching relationship between the target security domain and the mapping relationship set, so that after the client discovers the security domain information in the network, the stack may be switched conveniently based on the mapping relationship set, without manual operation, thereby achieving the technical effects of reducing the operation complexity and improving the configuration efficiency, and further solving the technical problems of complicated operation and lower configuration efficiency in the related art that the client needs to be manually configured in the process of adding the security domain.

Drawings

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the invention and do not constitute a limitation on the invention. In the drawings:

FIG. 1 is a flow chart of an activation tool configuration device according to the prior art;

FIG. 2 is a schematic diagram of an activation tool configuration device application scenario according to the prior art;

FIG. 3 is a flow diagram of a client APP creating multiple security domains according to the prior art;

FIG. 4 is a flow diagram of a client APP being configured to multiple different security domains according to the prior art;

FIG. 5 is a flow chart of a method of configuring a client according to one embodiment of the invention;

FIG. 6 is a schematic diagram of an existing security domain in an office network according to one embodiment of the present invention;

FIG. 7 is a flowchart of the operation of a client entering a security domain according to a first embodiment of the present invention;

FIG. 8 is a flowchart of the operation of a client entering a security domain according to a second embodiment of the present invention;

FIG. 9 is a flowchart of the operation of a client entering a security domain according to a third embodiment of the present invention;

FIG. 10 is a block diagram of an apparatus for configuring a client according to one embodiment of the invention;

FIG. 11 is a schematic block diagram of a communication system in accordance with an embodiment of the present invention;

fig. 12 is a schematic structural view of a communication device according to an embodiment of the present invention;

fig. 13 is a schematic diagram of a chip structure according to an embodiment of the invention.

Detailed Description

In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

In the technical field of the internet of things, a new device needs to be activated to operate in a network or interact with other devices. The first step in activating a new device is to configure device ownership. A legitimate user establishes ownership of a device via an activation Tool (OBT) using an owner transfer method (Owner Transfer Method, OTM). After ownership is established, the OBT is used for configuring the new equipment, so that the new equipment can normally operate and interact with other equipment finally. The specific flow is shown in figure 1:

1. the activation tool discovers new equipment needing to be configured in the network;

2. the new device returns to its supported owner transfer method;

3. the activation tool establishes a secure connection with the new device according to the selected owner transfer method;

4. the activation tool configures its own Identifier (ID) to the deviceowneruuid (Universal Unique Identifier, device owner universal unique Identifier) attribute of the device/oic/sec/doxm (Device Owner Transfer Method ), establishing the owner identity of the device;

5. the activation tool looks at the security credential types supported by the new device, such as symmetric keys, asymmetric keys, certificates, etc.;

6. the activation tool selects an appropriate symmetric security credential;

7. The activation tool configures the selected symmetric security Credential to the device's/oic/sec/credited (Credential) resource;

8. the activation tool assigns the new device to a credential management service (Credential Management Service, CMS) key management service, which is typically part of the activation tool, which can also be deployed separately as a service, considering extensibility and modular design;

9. the activation tool configures its own identifier to the roweruid (Resource Owner UUID, resource owner universal unique identifier) attribute of the device/oic/sec/doxm, setting/doxm resource owner;

10. the activation tool configures its own identifier (the identifier of the credential management service) to the roweruid attribute of the new device/oic/sec/cred, setting the owner of the/oic/sec/cred resource;

11. the activation tool configures credentials for establishing a secure connection with the credential management service to the per-oic/sec/cred resource of the device;

12. activating the tool/credential management service to change the state of the new device to a service configuration state;

13. activating a tool/credential management service to configure credentials for establishing a local area network secure connection with other devices to the device's/oic/sec/cred resources;

14. The activation tool/credential management service changes the state of the new device to a normal operating state.

The activation tool is a master of the network, and can configure interconnection and interworking between Client (Client) equipment and Server (Server) equipment in the network. After configuration, the activation tool is the owner of the device being configured. For example, a scene of an application in a home as shown in fig. 2.

1. A client APP is installed on a mobile phone of a mother;

2. the client APP of the mother creates various user roles such as family, administrator (admin), family member (family), tenant (guest) and the like;

3. the mom's client APP finds and configures the restaurant's lights (lightbulb in Dining Room, DR-Bulb);

4. the client APP of the mother can control the lamp of the restaurant;

5. a client APP is installed on the father mobile phone;

6. the client APP of mom discovers the client APP of dad, configures the client APP of dad and gives the authority of family members, and the client APP of dad can also control the lamp of the restaurant;

7. the client APP of mom can also give the authority to the client APP manager of dad, and then the client APP of dad can also configure and manage the lamps of the restaurant;

8. for a new device, such as a living room light (lightbulb in Living Room, LR-Bulb), the configuration is performed in the same manner as the restaurant light;

9. For a new client APP, its roles and permissions are configured in the same way as dad's client APP.

And 5, after the client APP is installed on the father mobile phone, the APP is turned on and connected to the home network, so that the client APP of the mother and the lamp of the restaurant in the network can be found. Further, the client APP of dad obtains deviceuuid and deviceowneruuid in the doxm resource of both respectively. The comparison shows that: for the client APP of the mother, the deviceuuid and deviceowneruuid in the doxm resource are the same, and the client APP of the mother is an activation tool; for the lights of the restaurant, the deviceuuid and deviceuowneruuid in the doxm resource are different, and the lights of the restaurant are Client devices or Server devices. Meanwhile, comparing the defawneruid of the lamp of the restaurant with the defaceruuid of the client APP of the mother, and if the defaceruuid of the lamp of the restaurant is identical to the defaceruuid of the client APP of the mother, the lamp of the restaurant is considered to be configured by the client APP of the mother. And then, the client APP of father can request the client APP of mother to configure into the home network, and the step 6 is entered.

If dad's client APP also wants to configure a new device as an activation tool to enter the home network, mom's client APP may configure dad's client APP as a slave activation tool, and dad's client APP is the master activation tool. After that, the equipment configured by the client APP of father can also access the home network to interconnect and communicate with the lamp of the restaurant. In a secure domain network, there may be only one master activation tool and there may be multiple slave activation tools.

One client APP may create multiple security domains, as shown in fig. 3, in the following way:

1. the user starts a client App, wherein the client App instantiates a new open connection foundation (Open Connectivity Foundation, OCF) stack (stack 1) comprising an activation tool;

2. automatically creating a new open connection foundation security domain 1 by an activation tool running in stack 1;

3. the user instructs the client to create an additional open connection foundation security domain;

4. the client instantiates a new open connection foundation stack (stack 2) including the activation tool and listens on the new port;

5. a new open connection foundation security domain 2 is automatically created by the activation tool running in stack 2.

A new security domain can be created by repeating the above steps 2 and 3.

It should be noted that, the "stack" referred to in the embodiments of the present invention is not a program stack in a general sense, but an abstraction of the open connection foundation logic device includes core resources and attributes of the open connection foundation device.

The client APP may also be configured to multiple different security domains, as shown in fig. 4, taking the scenario in which one client APP is configured to two security domains as an example:

1. The activation tool 1 of the client APP 1 loads the stack 1 of the client APP2 into the security domain 1;

2. the user instructs the client APP2 to join another security domain N;

3. client APP2 instantiates another stack N;

4. the activation tool 1 of the client APP 1 loads the stack N of the client APP2 into the security domain N.

It should be noted that, the client APP2 may also be configured by the client APP 1 and the client APP 3 to join two different security domains (created by the client APP 1 and the client APP 3, respectively).

When the client APP discovers the existing security domain in the network, more participation of users is needed in the process of joining the security domain, and an intelligent processing mechanism is lacked to simplify the operation of the users.

In order to solve the problems, the invention provides a method and a device for configuring a client, and a communication system.

According to one embodiment of the present invention, there is provided an embodiment of a method of configuring a client, it being noted that the steps illustrated in the flowchart of the figures may be performed in a computer system, such as a set of computer executable instructions, and that although a logical order is illustrated in the flowchart, in some cases the steps illustrated or described may be performed in an order other than that illustrated herein.

In this embodiment, a method for configuring a client running on the terminal device is provided, and fig. 5 is a flowchart of a method for configuring a client according to one embodiment of the present invention, as shown in fig. 5, where the method includes the following steps:

step S502, determining a target security domain added by a client;

the client in the above steps may refer to a client APP installed on a new device accessing the network, and after the client accesses the network, one or more security domains existing in the network may be discovered, where the one or more security domains may be created by one client APP or may be created by multiple client APPs, and the present invention is not limited in this particular manner.

The target security domain in the above step may be a security domain selected to be added by the user according to the use requirement of the client APP, for example, the client APP may be added to a security domain where other devices that need to operate or interact are located.

Step S504, based on the matching relationship between the target security domain and the mapping relationship set, the current stack in the active state on the client is switched, wherein the mapping relationship set is used for storing the mapping relationship between the security domain and the stack.

After joining a security domain, the client APP activates the stack corresponding to the security domain and puts it in an active state. When a client APP needs to join another security domain, the client APP needs to activate another stack, and therefore needs to switch the current stack in an active state.

To ensure that the client APP can automatically switch the current stack, the client APP may maintain a mapping table (i.e., the above-mentioned mapping relation set) of an open connection foundation stack and a security domain ID, as shown in table 1 below, where the security domain ID is unique identification information of the security domain, and the open connection foundation stack is a handle that uniquely identifies the stack in the client APP.

TABLE 1

Security Domain ID	Open connection foundation stack
		SDI (Security Domain Information ): uuid	Stack handle

Assume that in the home network scenario shown in fig. 2, a client APP of mom is used as an activation tool, and is first self-activated and configured, and then a client APP of dad is configured and security domain information is set, where the client APP of dad uses stack 1.

Then, dad's client APP enters the office network, and the client APP finds controllable devices and finds a plurality of security domains corresponding to the controllable devices, as shown in fig. 6, two security domains already exist in the office network, namely office 1 and office 2, respectively, where device 1 is configured in office 1, and device 2 is configured in office 2.

If dad wishes to control device 1, then client APP can be controlled to join the security domain named office 1 and switch stack 1 currently in use.

By adopting the embodiment of the invention, after the target security domain added by the client is determined, the current stack in an active state on the client can be switched based on the matching relation between the target security domain and the mapping relation set, so that the client can conveniently switch the stack based on the mapping relation set after the security domain information in the network is found, manual operation is not needed, the technical effects of reducing the operation complexity and improving the configuration efficiency are achieved, and the technical problems that the client needs manual configuration in the process of adding the security domain in the related art, the operation is complex and the configuration efficiency is lower are solved.

In the above embodiment of the present invention, based on the matching relationship between the target security domain and the mapping relationship set, switching the current stack in the active state on the client includes: under the condition that a stack matched with the target security domain exists in the mapping relation set, switching the current stack to be the stack matched with the target security domain; if there is no stack in the set of mappings that matches the target security domain, a new stack is created and the current stack is switched to the new stack.

In an alternative embodiment, after determining the target security domain that needs to be joined, the client APP may check whether there is an entry in the maintained mapping table that matches the target security domain, and then determine whether there is a stack in the already created stack that matches the target security domain. If present, indicating that a stack has been created for application to the target security domain, then a switch may be made directly to the stack; if none exists, indicating that a stack applied to the target security domain has not been created, a new stack may be created so that the stack can be applied to the target security domain and switched to.

In the above embodiment of the present invention, after creating the new stack, the method further includes: configuring a new stack in an initialized state; determining the type of the new stack in the target security domain; based on the type, a new stack is configured.

The types in the above steps may refer to roles and rights of the client APP in the target security domain, and may include, for example: the client type or the activation tool type, and the type of client APP may be selected by the user.

In an alternative embodiment, the newly created stack needs to be configured by the activation tool, so that the created new stack can be placed in an initialized state, i.e. in a configurable state, and the user selects whether to use the identity of the client or the activation tool to enter the security domain, and further, different configuration procedures can be performed for different identities.

In the above embodiment of the present invention, in the case where the type is the client type, configuring the new stack includes: a configuration device for determining a target security domain, wherein the configuration device comprises a master activation tool; the security domain of the new stack is configured as the target security domain by the configuration device.

In an alternative embodiment, if the client APP enters the security domain with the identity of the client, an activation tool for creating the security domain may be found, and the new stack is configured by the activation tool, and the security domain of the new stack is configured as the target security domain, that is, the new stack has a mapping relationship with the target security domain.

In one embodiment of the present invention, where the type is an active tool type, configuring the new stack includes: configuring the security domain of the new stack as a target security domain; a configuration device for determining a target security domain, wherein the configuration device comprises a master activation tool; the new stack is configured as a slave activation tool by the configuration device. In another embodiment of the present invention, configuring the new stack includes: a configuration device for determining a target security domain, wherein the configuration device comprises a master activation tool; the new stack is configured as a slave activation tool by the configuration device and the security domain of the new stack is configured as a target security domain.

In an alternative embodiment, if the client APP enters the security domain with the identity of the activation tool, the user may set the security domain of the new stack to the target security domain directly through the client APP, i.e. the new stack has a mapping relationship with the target security domain. The client APP then looks for an activation tool that creates the security domain, which acts as a master activation tool, further configures the new stack as a slave activation tool through the master activation tool, and completes the other configuration.

In another alternative embodiment, the client APP may directly find an activation tool that creates the security domain, which serves as a master activation tool, further configures the new stack as a slave activation tool through the master activation tool, and configures the security domain of the new stack as a target security domain, that is, the new stack has a mapping relationship with the target security domain.

In the above embodiment of the present invention, after the security domain corresponding to the new stack is configured as the target security domain, the mapping relationship between the new stack and the target security domain is stored into the mapping relationship set.

To facilitate rejoining the target security domain, avoiding creating a stack multiple times, the mapping of the new stack and the target security domain may be stored in a mapping table, i.e., an entry is added to the mapping table, storing the target security domain ID and the handle of the new stack to represent the new stack and its security domain.

In the above embodiment of the present invention, in the case that there are a plurality of stacks matching the target security domain in the mapping relation set, the method further includes: acquiring attribute parameters of each stack; determining a priority of each stack based on the attribute parameters of each stack; the current stack is switched to the stack with the highest priority.

Optionally, the attribute parameter in the step includes at least one of: the last time activated, the frequency of activation, the number of times activated, the duration of the active state, the marking information set by the user. The time of last activation may be the time of last running in the foreground, the frequency/times of activation may be the frequency/times of activation of the stack by the client APP into an active state, the duration of the active state may be the time of the stack in the active state, and the marking information set by the user may be the priority stack marked by the user as under the security domain.

The attribute parameter may also be stored in a mapping table, for example, a last activation time, where the last activation time is the stack, as shown in table 2 below.

TABLE 2

Security Domain ID	Open connection foundation stack	Last time activatedInterval (C)
			SDI：uuid	Stack handle	YYYY-MM-DD

In an alternative embodiment, for the target security domain, there may be multiple matched entries in the mapping table, that is, multiple matched stacks may be queried from the mapping table, where the stack with the highest priority may be selected for switching according to the last activation time, the frequency of use, the duration of use, and other factors of each stack recorded by the client APP.

In the above embodiment of the present invention, after switching the current stack to the stack with the highest priority or switching the current stack to the new stack, the parameter value of the attribute parameter of the current stack is updated.

In order to ensure the accuracy of the queried last activation time, frequency of use, duration of use, etc. when the security domain is added again, after the stack is switched, the last activation time, frequency of use, duration of use, etc. of the stack before the switching may be updated, for example, the last activation time may be updated to be the current time.

In the above embodiment of the present invention, switching the current stack includes: configuring the stack after switching to be in an active state; and configuring the current stack to be in an inactive state, and storing configuration information of the current stack.

In an alternative embodiment, the stack switching process may be to switch the switched stack to the foreground, switch the original foreground stack to the inactive state and preserve the configuration.

In the above embodiment of the present invention, the mapping relation set stores identification information of the security domain and identification information of the stack. Optionally, in the case that the same identification information as the target identification information of the target security domain exists in the mapping relation set, determining that a stack matched with the target security domain exists in the mapping relation set; if the mapping relation set does not have the same identification information as the target identification information, it is determined that the mapping relation set does not have a stack matched with the target security domain.

The identification information of the security domain in the above step may refer to a security domain ID in the mapping table, and the identification information of the stack may be a stack handle in the mapping table.

In an alternative embodiment, the client APP may find whether the mapping table stores the security domain ID of the target security domain, if so, determine that there is a stack matching the target security domain, and directly read the stack handle in the entry of the mapping table where the security domain ID is located; if not, it is determined that there is no stack matching the target security domain and a new stack needs to be created.

In the above-described embodiments of the present invention, the detected at least one security domain is displayed before determining the target security domain to which the client is added.

In an alternative embodiment, the client APP, after detecting one or more security domains in the lan network, may present the security domain information to the user, make a selection by the user, and determine the target security domain based on the result of the selection by the user.

In the above embodiment of the present invention, before determining the type of the new stack in the target security domain, the prompt information for prompting the user to determine the type of the new stack is output.

In an alternative embodiment, after creating the new stack, the client APP may prompt the user to enter the security domain with the identity of the client or activation tool, make a selection by the user, and determine the type of new stack based on the user's selection.

The following describes the preferred embodiment of the present invention in detail with reference to fig. 7 to 9, for example, still taking the scenario shown in fig. 6 as an example, where dad's client APP uses stack 1.

In the first embodiment, as shown in fig. 7, the operation flow of dad's client APP entering the office network is as follows:

1. The client APP finds a plurality of security domains in the network and presents the security domains to the user;

2. the user selects to join one of the security domains;

3. the client APP checks whether the maintained mapping table has an item matched with the security domain, so as to find out whether a stack matched with the security domain selected by the user exists in the existing stack;

4. if yes, activating the stack 2 and making it turn to the foreground, the original foreground stack 1 turns to the inactive state and keeps the configuration, and the step 16 is reached; if not, carrying out the next step;

5. the client APP creates a new stack 2, and the stack is in an initialized state;

6. the client APP prompts the user to join the security domain with the identity of the client or the activation tool;

7. the user selects to enter a security domain by the identity of the client, and the step 8 is carried out; user selection to activate the identity of the tool into the security domain, go to step 11;

8. the client APP causes the stack 2 to be transferred to the foreground and is in an initialized state, and the original foreground stack 1 is transferred to an inactive state and remains configuration;

9. stack 2 is loaded by an activation tool in the network and configures a security domain;

10. the client APP adds an item in the maintained mapping table to represent the stack 2 and the security domain thereof, and goes to the 16 th step;

11. The client APP turns the stack 2 to the foreground, is set as an activation tool and is in an initialization state, and the original foreground stack 1 turns to an inactive state and retains configuration;

12. the client APP sets the security domain of the stack 2 as the security domain selected by the user;

13. the client APP adds an item in the maintained mapping table to represent the stack 2 and the security domain thereof;

14. stack 2 looks for the master activation tool and requests configuration;

15. the master activation tool configures the stack 2 as a slave activation tool, and finds that the activation tool has configured a security domain, completes other configurations, and goes to step 16;

16. and (3) finishing.

In the second embodiment, the previous activation time is taken as an example, and as shown in fig. 8, this embodiment is different from the first embodiment in that steps 4-5, 7, 12 and 16 are added, in which:

4. if two items are matched and correspond to the stack 2 and the stack 3 respectively, turning to the step 5; if not, turning to the step 8;

5. comparing the last activation times of stack 2 and stack 3, wherein stack 2 is newer;

7. updating the last activation time of the corresponding item of the stack 1 in the mapping table as the current time, and turning to the 21 st step;

12. updating the last activation time of the corresponding item of the stack 1 in the mapping table as the current time;

16. And updating the last activation time of the corresponding item of the stack 1 in the mapping table as the current time.

In a third embodiment, as shown in fig. 9, this embodiment differs from the first embodiment in steps 12-14, wherein:

12. stack 2 looks for the master activation tool and requests configuration;

13. the master activation tool configures the stack 2 as a slave activation tool and configures the security domain of the stack 2;

14. the client APP adds an entry in the maintained mapping table to represent stack 2 and its security domain.

In the fourth embodiment, this embodiment differs from the second embodiment in that the last activation time is replaced with the frequency/number of uses, the frequency/number of uses in the last year, the duration of use, and the user is given a priority stack under the security domain, etc.

The embodiment also provides a device for configuring a client, which is used for implementing the foregoing embodiments and preferred embodiments, and is not described in detail.

Fig. 10 is a block diagram of an apparatus for configuring a client according to one embodiment of the present invention, as shown in fig. 10, the apparatus including:

a first determining module 102, configured to determine a target security domain to which the client joins;

and the switching module 104 is configured to switch the current stack in an active state on the client based on a matching relationship between the target security domain and a mapping relationship set, where the mapping relationship set is used to store a mapping relationship between the security domain and the stack.

In the above embodiment of the present invention, the switching module includes: the first switching unit is used for switching the current stack to be a stack matched with the target security domain under the condition that the stack matched with the target security domain exists in the mapping relation set; and the second switching unit is used for creating a new stack and switching the current stack into the new stack under the condition that the stack matched with the target security domain does not exist in the mapping relation set.

In the above embodiment of the present invention, the apparatus further includes: the first configuration module is used for configuring the new stack to be in an initialized state; a second determining module for determining a type of the new stack in the target security domain; and the second configuration module is used for configuring the new stack based on the type.

In the above embodiment of the present invention, in the case where the type is a client type, the second configuration module includes: the system comprises a determining unit, a configuration unit and a control unit, wherein the determining unit is used for determining configuration equipment of a target security domain, and the configuration equipment comprises an activation tool; and the first configuration unit is used for configuring the security domain corresponding to the new stack into a target security domain through configuration equipment.

In one embodiment of the present invention, in the case that the type is an activation tool type, the second configuration module includes: a first two-configuration unit for configuring the security domain of the new stack as a target security domain; the determining unit is used for determining configuration equipment of the target security domain, wherein the configuration equipment comprises a main activation tool; a second third configuration unit for configuring the new stack as a slave activation tool by the configuration device. In another embodiment, the second configuration module comprises: the determining unit is used for determining configuration equipment of the target security domain, wherein the configuration equipment comprises a main activation tool; and a third fourth configuration unit, configured to configure the new stack as a slave activation tool by the configuration device, and configure the security domain of the new stack as a target security domain.

In the above embodiment of the present invention, the apparatus further includes: and the storage module is used for storing the mapping relation between the new stack and the target security domain into a mapping relation set.

In the above embodiment of the present invention, the apparatus further includes: the first acquisition module is used for acquiring attribute parameters of each stack under the condition that a plurality of stacks matched with the target security domain exist in the mapping relation set; a third determining module, configured to determine a priority of each stack based on the attribute parameter of each stack; the switching module is also used for switching the current stack to be the stack with the highest priority.

Optionally, the attribute parameter includes at least one of: the last time activated, the frequency of activation, the number of times activated, the duration of the active state, the marking information set by the user.

In the above embodiment of the present invention, the apparatus further includes: and the updating module is used for updating the parameter value of the attribute parameter of the current stack after switching the current stack to be the stack with the highest priority or switching the current stack to be the new stack.

In the above embodiment of the present invention, the switching module includes: a fourth configuration unit, configured to configure the stack after switching to be in an active state; and a fifth configuration unit, configured to configure the current stack in an inactive state and save configuration information of the current stack.

In the above embodiment of the present invention, the mapping relation set stores identification information of the security domain and identification information of the stack. Optionally, the apparatus further comprises: a fourth determining module, configured to determine that, when the mapping relationship set has the same identification information as the target identification information of the target security domain, a stack matching the target security domain exists in the mapping relationship set; if the mapping relation set does not have the same identification information as the target identification information, it is determined that the mapping relation set does not have a stack matched with the target security domain.

In the above embodiment of the present invention, the apparatus further includes: and the display module is used for displaying the detected at least one security domain.

In the above embodiment of the present invention, the apparatus further includes: and the output module is used for outputting prompt information for prompting a user to determine the type of the new stack.

It should be noted that each of the above modules may be implemented by software or hardware, and for the latter, it may be implemented by, but not limited to: the modules are all located in the same processor; alternatively, the above modules may be located in different processors in any combination.

Fig. 11 is a schematic block diagram of a communication system in accordance with one embodiment of the present invention. As shown in fig. 11, the communication system includes a client 112 and a configuration device 114.

The client 112 is configured to switch a current stack in an active state on the client based on a matching relationship between a target security domain added by the client and a mapping relationship set, where the mapping relationship set is configured to store a mapping relationship between the security domain and the stack; the configuration device 114 is located within the target security domain for configuring the stack after the client is switched.

Optionally, the client 112 may be configured to implement the corresponding function implemented by the client in the above method, and the configuration device may be configured to implement the corresponding function implemented by the configuration device in the above method, which is not described herein for brevity.

Fig. 12 is a schematic structural diagram of a communication device according to an embodiment of the present invention. As shown in fig. 12, the communication device includes a processor that can call and run a computer program from a memory to implement the method in the embodiment of the present invention.

Optionally, as shown in fig. 12, the communication device may also include a memory. The processor may call and run the computer program from the memory to implement the method according to the embodiment of the present invention.

The memory may be a separate device from the processor or may be integrated into the processor.

Optionally, as shown in fig. 12, the communication device may further include a transceiver, and the processor may control the transceiver to communicate with other devices, and in particular, may send information or data to other devices, or receive information or data sent by other devices.

Wherein the transceiver may comprise a transmitter and a receiver. The transceiver may further include antennas, the number of which may be one or more.

Optionally, the communication device may specifically be a device where the client in the embodiment of the present invention is located, and the communication device may implement a corresponding flow implemented by the client in each method in the embodiment of the present invention, which is not described herein for brevity.

Optionally, the communication device may be specifically a configuration device in the embodiment of the present invention, and the communication device may implement a corresponding flow implemented by the configuration device in each method in the embodiment of the present invention, which is not described herein for brevity.

FIG. 13 is a schematic diagram of a chip structure according to an embodiment of the present invention, where the chip includes a processor, and the processor may call and execute a computer program from a memory to implement a method according to an embodiment of the present invention, as shown in FIG. 13.

Optionally, as shown in fig. 13, the chip may also include a memory. The processor may call and run the computer program from the memory to implement the method according to the embodiment of the present invention.

Optionally, the chip may further comprise an input interface. The processor may control the input interface to communicate with other devices or chips, and in particular, may acquire information or data sent by other devices or chips.

Optionally, the chip may further comprise an output interface. The processor may control the output interface to communicate with other devices or chips, and in particular, may output information or data to other devices or chips.

Optionally, the chip may be applied to a device where the client is located in the embodiment of the present invention, and the chip may implement a corresponding flow implemented by the client in each method of the embodiment of the present invention, which is not described herein for brevity.

Optionally, the chip may be applied to the configuration device in the embodiment of the present invention, and the chip may implement a corresponding flow implemented by the configuration device in each method in the embodiment of the present invention, which is not described herein for brevity.

It should be understood that the chips referred to in the embodiments of the present invention may also be referred to as system-on-chip chips, or the like.

It should be appreciated that the processor of an embodiment of the present invention may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method embodiments may be implemented by integrated logic circuits of hardware in a processor or instructions in software form. The processor may be a general purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), an off-the-shelf programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components. The disclosed methods, steps, and logic blocks in the embodiments of the present invention may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in connection with the embodiments of the present invention may be embodied directly in the execution of a hardware decoding processor, or in the execution of a combination of hardware and software modules in a decoding processor. The software modules may be located in a random access memory, flash memory, read only memory, programmable read only memory, or electrically erasable programmable memory, registers, etc. as well known in the art. The storage medium is located in a memory, and the processor reads the information in the memory and, in combination with its hardware, performs the steps of the above method.

It will be appreciated that the memory in embodiments of the invention may be volatile memory or nonvolatile memory, or may include both volatile and nonvolatile memory. The nonvolatile Memory may be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically Erasable EPROM (EEPROM), or a flash Memory. The volatile memory may be random access memory (Random Access Memory, RAM) which acts as an external cache. By way of example, and not limitation, many forms of RAM are available, such as Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double Data Rate SDRAM (Double Data Rate SDRAM), enhanced SDRAM (ESDRAM), synchronous DRAM (SLDRAM), and Direct RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to comprise, without being limited to, these and any other suitable types of memory.

It should be understood that the above memory is illustrative but not restrictive, and for example, the memory in the embodiments of the present invention may be Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous Link DRAM (SLDRAM), direct RAM (DR RAM), and the like. That is, the memory in embodiments of the present invention is intended to comprise, without being limited to, these and any other suitable types of memory.

The embodiment of the invention also provides a computer readable storage medium for storing a computer program.

Optionally, the computer readable storage medium may be applied to a mobile terminal/terminal device in the embodiment of the present invention, and the computer program causes a computer to execute a corresponding procedure implemented by the mobile terminal/terminal device in each method of the embodiment of the present invention, which is not described herein for brevity.

The embodiment of the invention also provides a computer program product comprising computer program instructions.

Optionally, the computer program product may be applied to a mobile terminal/terminal device in the embodiment of the present invention, and the computer program instructions cause a computer to execute corresponding processes implemented by the mobile terminal/terminal device in each method of the embodiment of the present invention, which are not described herein for brevity.

The embodiment of the invention also provides a computer program.

Optionally, the computer program may be applied to a mobile terminal/terminal device in the embodiment of the present invention, and when the computer program runs on a computer, the computer is caused to execute corresponding processes implemented by the mobile terminal/terminal device in each method in the embodiment of the present invention, which is not described herein for brevity.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.

In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a usb disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The foregoing is merely illustrative of the present invention, and the present invention is not limited thereto, and any person skilled in the art will readily recognize that variations or substitutions are within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method of configuring a client, comprising:

determining a target security domain added by a client;

switching a current stack in an active state on the client based on a matching relationship of the target security domain and a mapping relationship set, wherein the mapping relationship set is used for storing a mapping relationship of the security domain and the stack,

wherein switching the current stack in an active state on the client based on the matching relationship of the target security domain and the mapping relationship set comprises:

switching the current stack to be a stack matching the target security domain if a stack matching the target security domain exists in the mapping relation set;

and if the stack matched with the target security domain does not exist in the mapping relation set, creating a new stack, and switching the current stack to be the new stack.

2. The method of claim 1, wherein after creating the new stack, the method further comprises:

configuring the new stack to be in an initialized state;

determining a type of the new stack in the target security domain;

based on the type, the new stack is configured.

3. The method of claim 2, wherein configuring the new stack if the type is a client type comprises:

configuration equipment for determining the target security domain, wherein the configuration equipment comprises an activation tool;

and configuring the security domain of the new stack to be the target security domain through the configuration equipment.

4. The method of claim 2, wherein configuring the new stack if the type is an active tool type comprises:

configuring the security domain of the new stack as the target security domain;

a configuration device for determining the target security domain, wherein the configuration device comprises a master activation tool;

the new stack is configured as a slave activation tool by the configuration device.

5. The method of claim 2, wherein configuring the new stack if the type is an active tool type comprises:

the new stack is configured by the configuration device as a slave activation tool and the security domain of the new stack is the target security domain.

6. The method of any of claims 3 to 5, wherein after configuring the security domain corresponding to the new stack as the target security domain, storing the mapping relationship of the new stack and the target security domain to the set of mapping relationships.

7. The method of claim 1, wherein, in the case where there are multiple stacks in the set of mappings that match the target security domain, the method further comprises:

acquiring attribute parameters of each stack;

determining the priority of each stack based on the attribute parameters of each stack;

and switching the current stack to be the stack with the highest priority.

8. The method of claim 7, wherein the parameter values of the attribute parameters of the current stack are updated after switching the current stack to the highest priority stack or switching the current stack to the new stack.

9. The method of claim 7, wherein the attribute parameters include at least one of: the last time activated, the frequency of activation, the number of times activated, the duration of the active state, the marking information set by the user.

10. The method of claim 1, wherein switching the current stack comprises:

configuring the stack after switching to be in an active state;

and configuring the current stack to be in an inactive state, and storing configuration information of the current stack.

11. The method of claim 1, wherein the set of mappings stores identification information for a security domain and identification information for a stack.

12. The method of claim 11, wherein,

determining that a stack matched with the target security domain exists in the mapping relation set under the condition that the same identification information as the target identification information of the target security domain exists in the mapping relation set;

and under the condition that the identification information which is the same as the target identification information does not exist in the mapping relation set, determining that a stack which is matched with the target security domain does not exist in the mapping relation set.

13. The method of claim 1, wherein the detected at least one security domain is displayed prior to determining the target security domain to which the client is joining.

14. The method of claim 2, wherein, prior to determining the type of the new stack in the target security domain, outputting prompt information prompting a user to determine the type of the new stack.

15. An apparatus for configuring a client, comprising:

the first determining module is used for determining a target security domain added by the client;

a switching module, configured to switch a current stack in an active state on the client based on a matching relationship between the target security domain and a mapping relationship set, where the mapping relationship set is used to store a mapping relationship between the security domain and the stack,

Wherein, the switching module includes:

a first switching unit, configured to switch, when a stack matching the target security domain exists in the mapping relation set, the current stack to be a stack matching the target security domain;

and the second switching unit is used for creating a new stack and switching the current stack into the new stack under the condition that the stack matched with the target security domain does not exist in the mapping relation set.

16. The apparatus of claim 15, wherein the apparatus further comprises:

the first configuration module is used for configuring the new stack to be in an initialized state;

a second determining module, configured to determine a type of the new stack in the target security domain;

and the second configuration module is used for configuring the new stack based on the type.

17. The apparatus of claim 16, wherein, in the case where the type is a client type, the second configuration module comprises:

a determining unit, configured to determine a configuration device of the target security domain, where the configuration device includes an activation tool;

and the first configuration unit is used for configuring the security domain corresponding to the new stack as the target security domain through the configuration equipment.

18. The apparatus of claim 16, wherein, in the event that the type is an activation tool type, the second configuration module comprises:

a second configuration unit, configured to configure the security domain of the new stack as the target security domain;

a determining unit, configured to determine a configuration device of the target security domain, where the configuration device includes a master activation tool;

and a third configuration unit, configured to configure the new stack as a slave activation tool through the configuration device.

19. The apparatus of claim 16, wherein, in the event that the type is an activation tool type, the second configuration module comprises:

a fourth configuration unit, configured to configure the new stack as a slave activation tool by the configuration device, and configure a security domain of the new stack as the target security domain.

20. The apparatus according to any one of claims 17 to 19, wherein the apparatus further comprises:

and the storage module is used for storing the mapping relation between the new stack and the target security domain to the mapping relation set.

21. The apparatus of claim 15, wherein the apparatus further comprises:

the first acquisition module is used for acquiring attribute parameters of each stack under the condition that a plurality of stacks matched with the target security domain exist in the mapping relation set;

a third determining module, configured to determine a priority of each stack based on the attribute parameter of each stack;

the switching module is further configured to switch the current stack to a stack with a highest priority.

22. The apparatus of claim 21, wherein the apparatus further comprises:

and the updating module is used for updating the parameter value of the attribute parameter of the current stack after switching the current stack to be the stack with the highest priority or switching the current stack to be the new stack.

23. The apparatus of claim 21, wherein the attribute parameters comprise at least one of: the last time activated, the frequency of activation, the number of times activated, the duration of the active state, the marking information set by the user.

24. The apparatus of claim 15, wherein the switching module comprises:

a fourth configuration unit, configured to configure the stack after switching to be in an active state;

And a fifth configuration unit, configured to configure the current stack in an inactive state, and save configuration information of the current stack.

25. The apparatus of claim 15, wherein the set of mappings stores identification information for a security domain and identification information for a stack.

26. The apparatus of claim 25, wherein the apparatus further comprises:

a fourth determining module, configured to determine that, when there is identification information in the mapping relation set that is the same as the target identification information of the target security domain, there is a stack that matches the target security domain in the mapping relation set; and under the condition that the identification information which is the same as the target identification information does not exist in the mapping relation set, determining that a stack which is matched with the target security domain does not exist in the mapping relation set.

27. The apparatus of claim 15, wherein the apparatus further comprises:

and the display module is used for displaying the detected at least one security domain.

28. The apparatus of claim 16, wherein the apparatus further comprises:

and the output module is used for outputting prompt information for prompting a user to determine the type of the new stack.

29. A communication system, comprising:

the client is used for switching the current stack in an active state on the client based on the matching relation between the target security domain added by the client and the mapping relation set, wherein the mapping relation set is used for storing the mapping relation between the security domain and the stack;

the configuration equipment is positioned in the target security domain and is used for configuring the stack after the client is switched,

based on the matching relationship between the target security domain added by the client and the mapping relationship set, switching the current stack in an active state on the client comprises:

30. A storage medium having a computer program stored therein, wherein the computer program is arranged to, when run, perform the method of configuring a client as claimed in any of claims 1 to 14.

31. A processor for running a program, wherein the program is arranged to perform the method of configuring a client as claimed in any one of claims 1 to 14 at run-time.

32. A mobile terminal comprising a memory in which a computer program is stored and a processor arranged to run the computer program to perform the method of configuring a client as claimed in any one of claims 1 to 14.

33. A chip, comprising: a processor arranged to call and run a computer program from memory, to cause a device on which the chip is mounted to perform the method of configuring a client as claimed in any one of claims 1 to 14.