KR20230031717A - IoT portal server, IoT platform server, Method for managing authority using AN ACP data field and token obtained from authentication server and Computer program for executing the method - Google Patents

Abstract

According to the present invention, provided are a method for minimizing data of an ACP field and managing a right by using a token and an ACP data field obtained through an IoT portal server, an IoT platform server, and an authentication server to which IoT platform data is provided for each group by using the authentication server and a computer program for executing the method.

Description

IoT portal server, IoT platform server, method for managing authority using a token and ACP data field acquired through an authentication server, and a computer program for executing the method {IoT portal server, IoT platform server, Method for managing authority using AN ACP data field and token obtained from authentication server and Computer program for executing the method}

According to embodiments of the present disclosure, a method for managing authority using a token and an ACP data field obtained through an IoT portal server, an IoT platform server, and an authentication server, and a computer program for executing the method may be disclosed there is.

As IoT develops, various IoT platforms are being developed. The IoT platform is software that provides common functions required by IoT devices, and is one of the important elements in the future IoT environment.

The IoT platform standard transmits data with certain rules when transmitting data. This is to adopt a method of communicating in a predetermined data format because it is difficult to interoperate with each other because the data of various IoT devices has its own form. At this time, there is a field called ACP (Access Control Policy) to determine the data structure or set the authority of the data. Since users who do not exist in the ACP cannot even access, the more users and the more complicated the authority, the more difficult the data in the ACP field is. There is a problem in that the data of the ACP becomes larger than the actual amount of data and thus the overhead of internal communication increases.

In the present invention, data of the ACP field can be minimized, and IoT platform data can be provided for each group using an authentication server.

A method according to embodiments of the present disclosure may include receiving a task request signal for allowing an IoT portal server to perform a first requested task from a first terminal to a first device; Transmitting, by the IoT portal server, a verification request of the first terminal for the job request signal to an authentication server in response to the job request signal; In the authentication server, using the token of the first terminal included in the verification request, with respect to the account of the first terminal and the first terminal, whether to grant permission for the first requested operation for the first device receiving a success signal for a verification request for verifying the token of the first terminal generated by verification from the verification server;

Transmitting, by the IoT portal server, a request for authorizing the first requested task to the first terminal to the authentication server; Receiving, by the IoT portal server, a success response signal to a request for authorizing the first requested task generated by checking from a permission authorization list managed by the authentication server; And when it is determined that the first terminal has authority for the first requested task by the success response signal, the IoT portal server sends a command signal to the first device to perform the first requested task to the IoT platform Transmitting to the server; authority can be managed using the token obtained through the authentication server and the ACP data field.

According to embodiments of the present disclosure, after the step of transmitting the verification request for the first terminal, when a success signal for the verification request for verifying the token of the first terminal is not received, the first request operation is performed. Authorization may be managed using the token obtained through the authentication server and the ACP data field, further comprising transmitting a reject signal to the first terminal.

According to embodiments of the present disclosure, after the step of transmitting the verification request of the first terminal, the authentication server identifies the account of the first terminal using the token of the first terminal, and For the account of the terminal, generating authentication information accessible to the IoT platform server may be further included.

According to embodiments of the present disclosure, the authentication server may further include transmitting authentication information accessible to the IoT platform server to the IoT platform server and processing the storage in an ACP field of the IoT platform server. .

According to embodiments of the present disclosure, account information of the first terminal may be stored in the ACP field of the IoT platform server.

According to embodiments of the present disclosure, the IoT platform server receiving a command signal from the IoT portal server to perform a second request operation to the second device requested by the second terminal; Transmitting, by the IoT platform server, a verification request signal for the token included in the command signal to an authentication server; receiving, in the authentication server, a success response signal indicating whether the token verified by using the token included in the verification request signal has been verified; Step, by the IoT platform server, in response to the success response signal, extracting resource path information to be processed by analyzing the command signal, and requesting from an authentication server whether or not there is authority for the resource path information with the token; receiving a success response from the authentication server indicating whether or not the resource path information has authority through the token, and determining whether the command signal includes an authority tolerance range using the success response and the ACP field; and generating and processing, by the IoT platform server, a second command signal for the second requested task when the authority for the permission range of the command signal is authorized.

According to the embodiments of the present disclosure, an account ID of the second terminal is requested to the authentication server to confirm whether or not the account of the second terminal is verified, and the authority for the second requested task requested by the second terminal is checked. The presence or absence can be confirmed from the authentication server.

According to embodiments of the present disclosure, the IoT platform server processing the second requested task to be performed in a second device according to the second command signal for the second requested task; may further include .

According to embodiments of the present disclosure, a processor and a communication unit are included, and the processor receives a task request signal for performing a first requested task from a first terminal to a first device, and responds to the task request signal. , Transmits a verification request of the first terminal for the operation request signal to an authentication server, and the authentication server uses the token of the first terminal included in the verification request to determine the account of the first terminal and the first terminal. For the terminal, a success signal for a verification request for verifying a token of the first terminal generated by checking whether permission is granted for a first requested operation for the first device is received from the authentication server, and the authentication server In response to the request for authorizing the first requested job, a request for authorizing the first requested job is transmitted to the first terminal, and the request for authorizing the first requested job is generated by checking from the authorization list managed by the authentication server. When a success signal for the first requested operation is received and it is determined that the first terminal has authority for the first requested operation based on the success signal, a command signal for performing the first requested operation is transmitted to the first device to the IoT platform. can be sent to the server.

According to embodiments of the present disclosure, it includes a processor and a communication unit, and the processor receives a command signal from an IoT portal server to a second device requested by a second terminal to perform a second request operation, and the command To transmit a verification request signal for the token included in the signal to an authentication server, and to receive a success response signal indicating whether the token verified by using the token included in the verification request signal has been verified in the verification server. and, in response to the success response signal, extracts resource path information to be processed by analyzing the command signal, requests from an authentication server whether or not there is authority for the resource path information with the token, and obtains information from the authentication server. Receiving a success response of whether or not the resource path information has authority with the token, using the success response and the ACP field, determining whether or not the authority permission range of the command signal is included, and the authority permission range of the command signal When the authority for is authorized, a second command signal for the second requested task may be generated and processed.

The processor requests the account ID of the second terminal to the authentication server, checks whether or not the account of the second terminal is verified, and determines whether or not there is authority for the second requested operation requested by the second terminal to the authentication server. can be checked from

The processor may process the second requested task to be performed in a second device according to a second command signal for the second requested task.

A computer program according to an embodiment of the present invention may be stored in a medium to execute any one of the methods according to an embodiment of the present invention using a computer.

In addition to this, another method for implementing the present invention, another system, and a computer readable recording medium recording a computer program for executing the method are further provided.

Other aspects, features and advantages other than those described above will become apparent from the following drawings, claims and detailed description of the invention.

According to the present invention, the data of the ACP field can be minimized, and the IoT portal server that provides IoT platform data by group using the authentication server, the IoT platform server, and the token obtained through the authentication server and the ACP data field are used. A method for managing authority and a computer program for executing the method may be provided.

1 is a diagram of a network environment of a rights management system 1 according to an embodiment of the present disclosure.
2 is a diagram of a rights management system 1' network environment according to other embodiments of the present disclosure.
3 is a block diagram of an IoT portal server 100 according to embodiments of the present disclosure.
4 is a block diagram of an IoT platform server 200 according to embodiments of the present disclosure.
5 is a flowchart of a rights management method according to embodiments of the present disclosure.
6 is a flowchart of a method for receiving authorization through an authentication server in an IoT portal server according to embodiments of the present disclosure.
7 is a flowchart of a method of performing a request operation for a resource using an ACP in an IoT platform server according to embodiments of the present disclosure.
8 is a flowchart of a method of determining whether a token is verified in an authentication server according to an embodiment of the present disclosure.
9 is a flowchart of a method of determining whether an authority is authorized for a verified token in an authentication server according to embodiments of the present disclosure.
10 is a flowchart illustrating a process of adding authority to an account ID in an authentication server according to an embodiment of the present disclosure.

Hereinafter, the configuration and operation of the present invention will be described in detail with reference to embodiments of the present invention shown in the accompanying drawings.

Since the present invention can apply various transformations and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. Effects and features of the present invention, and methods for achieving them will become clear with reference to the embodiments described later in detail together with the drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various forms.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, and when describing with reference to the drawings, the same or corresponding components are assigned the same reference numerals, and overlapping descriptions thereof will be omitted. .

In this specification, terms such as “learning” and “learning” are terms that refer to performing machine learning through computation according to procedures, which are not intended to refer to mental operations such as human educational activities. interpret

In the following embodiments, terms such as first and second are used for the purpose of distinguishing one component from another component without limiting meaning.

In the following examples, expressions in the singular number include plural expressions unless the context clearly dictates otherwise.

In the following embodiments, terms such as include or have mean that features or components described in the specification exist, and do not preclude the possibility that one or more other features or components may be added.

In the drawings, the size of components may be exaggerated or reduced for convenience of description. For example, since the size and thickness of each component shown in the drawings are arbitrarily shown for convenience of description, the present invention is not necessarily limited to the illustrated bar.

When an embodiment is otherwise implementable, a specific process sequence may be performed differently from the described sequence. For example, two processes described in succession may be performed substantially simultaneously, or may be performed in an order reverse to the order described.

Here, the token refers to data generated in correspondence with authority. According to an embodiment of the present disclosure, a token is required to access an IoT platform or resource, and the authentication server performs a process related to issuance of the token.

Here, an app is a kind of program implemented in software and is an abbreviation for application.

Here, the Internet of Things (IoT) refers to connecting and controlling a plurality of devices.

Here, an account is created to manage users accessed by the system, and can be used in correspondence with users in the system. Accounts can be distinguished by ID. According to embodiments of the present disclosure, accounts may be grouped and managed. A permission authorization list of an account belonging to the group may be generated through the permission authorization list for the group. The privileges of the account include all privileges of the group, but may have privileges not included in the privileges of the group.

Here, the resources refer to devices controlled by the system, such as sensors for detecting temperature, humidity, movement, etc., devices for checking operation, electronic devices such as microwave ovens, washing machines, TVs, air purifiers, air conditioners, dehumidifiers, ventilators, It may include devices such as stands, lights, and blinds, and may include various devices without being limited thereto.

1 is a diagram of a network environment of a rights management system 1 according to an embodiment of the present disclosure.

The rights management system 1 may include an IoT portal server 10, an IoT platform server 20, and an authentication server 30.

The IoT portal server 10 may store and manage device authority information. The IoT portal server 10 may store device information, IoT platform information, and authentication server information. The IoT portal server 10 may store identification codes of a plurality of electrically connected and controlled devices, rules for control signals transmitted to the devices, information controlled by the devices, and the like. The IoT portal server 10 may include information about one or more platforms. Each platform can be implemented to control certain devices. Information of the authentication server may include information required to access the authentication server.

The IoT portal server 10 may set relation information with a device as a data field of a predetermined data set, for example, an ACP, and may provide a token used for authorizing authority. Here, ACP refers to an access control policy and refers to a data field stored in the platform server. According to an embodiment of the present disclosure, an ID when accessing an ACP data field is managed by an authentication server, and after information on a verified token is transmitted, the ACP ID may be obtained. At this time, one or more account IDs may be converted into one ACP ID when they have the same authority. Since the ACP ID is converted according to the authority, the ACP ID does not need to be allocated for all accounts, so the ACP data capacity may be reduced.

The IoT portal server 10 may provide data and tokens related to authority authorization to the connected device. The token may be issued and registered by the authentication server 30 .

The IoT portal server 10 performs a function of managing one or more IoT platforms, and may be implemented to perform all operations of the IoT platform server 20 .

The IoT platform server 20 may identify and provide desired devices and authorization data from the IoT portal server 10 . The IoT platform server 20 may be implemented to process a request signal through which a user terminal accesses and controls other resources. The IoT platform server 20 performs a process of acquiring a verified token before determining whether the account ID is authorized.

The IoT portal server 10 or the IoT platform server 20 may generate and transmit a signal requesting authorization to the authentication server 30 . The IoT portal server 10 or the IoT platform server 20 may generate and transmit a signal requesting verification of a user account to the authentication server 30 . Whether or not the user account is verified can be confirmed by the presence or absence of a token corresponding to the account ID. The IoT portal server 10 or the IoT platform server 20 may generate and transmit a signal requesting permission for a user account to the authentication server 30 . The authentication server 30 may create a permission authorization list for the account ID, determine whether or not there is permission for the account ID based on this, and newly authorize the permission when it is determined that there is no permission. In this case, permission may be set in units of platforms, units of devices, and units of apps. A platform is a higher level concept of a device or an app, and an account ID having authority for the platform may be set as having authority for lower devices and lower apps belonging to the platform.

The IoT portal server 10 or the IoT platform server 20 may perform an authentication process for accessing resources through the authentication server 30 .

The IoT portal server 10 or the IoT platform server 20 may check authority information of a user or terminal that has requested authentication through an ACP data field. At this time, in the method of checking authority, the presence or absence of authority can be confirmed by recording the requested account ID in the ACP field and comparing it.

The authentication server 30 may generate a token corresponding to an account ID in response to a token generation request from the IoT portal server 10 . The authentication server 30 may check the presence or absence of authority to access the device and perform the IoT portal server 10 or the like. If there is no requested authority, the authentication server 30 may add the requested authority information to the authority authorization list.

2 is a diagram of a rights management system 1' network environment according to other embodiments of the present disclosure.

The authority management system 1' includes a first IoT device 51, a second IoT device 52, ... , an nth IoT device 5n, a manager terminal 61, and a user terminal 62 may be further included.

The manager terminal 61 accesses the IoT platform server 20 and connects the first IoT device 51, the second IoT device 52, ... , a task request for the nth IoT device 5n may be transmitted. The IoT platform server 20 may access the authentication server 30 through the IoT portal server 10 and check whether the manager terminal 61 has access rights. When there is an access right and the range of the access right is appropriate, the work request of the manager terminal 61 can be processed.

The user terminal 62 accesses the IoT platform server 20, and the first IoT device 51, the second IoT device 52, ... , a task request for the nth IoT device 5n may be transmitted. The IoT platform server 20 may access the authentication server 30 through the IoT portal server 10 and check whether the user terminal 62 has access rights. When there is an access right and the range of the access right is appropriate, the work request of the manager terminal 61 can be processed.

3 is a block diagram of an IoT portal server 100 according to embodiments of the present disclosure.

The communication unit 110 may communicate with various types of external devices or servers according to various types of communication methods. The communication unit 110 of one device 100 is connected to the communication units of the other devices 20, 30, 51, 52, 53, 61, and 62 through a network to exchange data with each other.

The processor 120 may perform an operation of generally controlling each device 100 having each memory using various programs stored in the memory 130 . The processor 220 includes a microprocessor, a central processing unit (CPU), a processor core, a multiprocessor, an application-specific integrated circuit (ASIC), and a field programmable gate array (FPGA). ), but the present invention is not limited thereto.

The memory 130 may temporarily or permanently store data processed by each device 100 or the servers 200 and 30 having each memory. The memory 130 may include a random access memory (RAM), a read only memory (ROM), and a permanent mass storage device such as a disk drive, but the present invention is not limited thereto.

The apparatus 100 as shown in FIG. 3 may further include a storage medium (not shown) storing various data for overall operations, such as a program for processing or controlling the processor 120 . The storage medium may store a plurality of application programs (application programs or applications) running in the device 100, data for operation of the servers 200 and 30, and commands. At least some of these application programs may be downloaded from an external server through wireless communication. In addition, at least some of these application programs may exist on the device 100 from the factory for basic functions of the device 100 . The application program may be stored in a storage medium and driven by the processor 120 to perform an operation (or function) of the device 100 .

The rights management system and each module or unit included therein may be entirely hardware, or may have aspects that are part hardware and part software. For example, the rights management system and each module or unit included therein may collectively refer to hardware and related software for processing data of a specific format and content or exchanging data in an electronic communication method. In this specification, terms such as “unit”, “module”, “device”, “terminal”, “server” or “system” may be interpreted as referring to a combination of hardware and software driven by the hardware. For example, the hardware may be a data processing device including a CPU or other processor. Also, software driven by hardware may refer to a running process, an object, an executable file, a thread of execution, a program, and the like.

In addition, each element constituting the rights management system is not necessarily limited to referring to a separate device that is physically separated from each other. That is, the communication unit 110, processor 120, memory 130, etc. of FIG. 3 are only functionally classified according to the operation performed by the IoT portal server 10, and do not necessarily have to be independently distinguished from each other. . Of course, depending on the embodiment, they may be implemented as separate devices that are physically separated from each other.

Hereinafter, information transmission and reception between each component of the rights management system that can take the above configuration will be described along with a rights management method.

4 is a block diagram of an IoT platform server 200 according to embodiments of the present disclosure.

The communication unit 210 may communicate with various types of external devices or servers according to various types of communication methods. The communication unit 210 of one device 200 is connected to the communication unit 210 of another device 200 through a network to exchange data with each other.

The processor 220 may perform an operation to generally control each device 200 or servers 100 and 30 having each memory using various programs stored in the memory 230 . The processor 220 includes a microprocessor, a central processing unit (CPU), a processor core, a multiprocessor, an application-specific integrated circuit (ASIC), and a field programmable gate array (FPGA). ), but the present invention is not limited thereto.

The memory 230 may temporarily or permanently store data processed by each device 200 or the servers 100 and 30 having each memory. The memory 230 may include a random access memory (RAM), a read only memory (ROM), and a permanent mass storage device such as a disk drive, but the present invention is not limited thereto.

The apparatus 200 as shown in FIG. 4 may further include a storage medium (not shown) storing various data for overall operations, such as a program for processing or controlling the processor 220 . The storage medium may store a plurality of application programs (application programs or applications) running in the device 200, data for operation of the servers 40, 50, 60, and 80, and commands. At least some of these application programs may be downloaded from an external server through wireless communication. In addition, at least some of these application programs may exist on the device 200 from the factory for basic functions of the device 200 . The application program may be stored in a storage medium and driven by the processor 220 to perform an operation (or function) of the device 200 .

The rights management system and each module or unit included therein may be entirely hardware, or may have aspects that are part hardware and part software. For example, the rights management system and each module or unit included therein may collectively refer to hardware and related software for processing data of a specific format and content or exchanging data in an electronic communication method. In this specification, terms such as “unit”, “module”, “device”, “terminal”, “server” or “system” may be interpreted as referring to a combination of hardware and software driven by the hardware. For example, the hardware may be a data processing device including a CPU or other processor. Also, software driven by hardware may refer to a running process, an object, an executable file, a thread of execution, a program, and the like.

In addition, each element constituting the rights management system is not necessarily limited to referring to a separate device that is physically separated from each other. That is, the communication unit 210, the processor 220, and the memory 230 of FIG. 4 are only functionally classified according to the operation performed by the IoT platform server 20, and do not necessarily have to be independently distinguished from each other. . Of course, depending on the embodiment, they may be implemented as separate devices that are physically separated from each other.

Hereinafter, information transmission and reception between each component of the rights management system that can take the above configuration will be described along with a rights management method.

5 is a flowchart of a rights management method according to embodiments of the present disclosure.

In S10, the rights management system may perform verification on the terminal upon receiving a request for a device operation from the terminal.

In S20, the rights management system may verify the token corresponding to the account ID of the terminal. In S25, the rights management system may register the account ID/token when the token corresponding to the account ID is not verified.

In S30, if it is determined that the token corresponding to the account ID of the terminal has been verified, the rights management system can determine whether or not there is authority for the job request.

In S40, the rights management system may determine whether there is an ACP for the corresponding token. In S45, if there is no ACP for the token, the rights management system can register the ACP/Group for the token.

In S50, the rights management system may map and store the account ID to the ACP.

6 is a flowchart of a method for receiving authorization through an authentication server in an IoT portal server according to embodiments of the present disclosure.

In S110, the IoT portal server 100 may receive a first task request signal for performing a first requested task from the first terminal to the first device.

In S120, the IoT portal server 100 may transmit a verification request of the first terminal to the authentication server in response to the first task request. The IoT portal server 100 may be connected to the authentication server through a network and transmit a verification request through the network.

In S130, the IoT portal server 100 includes verification information for the token of the first terminal generated by checking the account ID of the first terminal using the token of the first terminal included in the verification request in the authentication server. A success signal for the verification request of the first terminal may be received from the verification server.

The authentication server may determine whether there is a token for the account ID of the first terminal, and if there is a token of the first terminal, it may be determined that the token is verified.

In S140, the IoT portal server 100 may transmit a signal requesting permission for the first requested task to the authentication server.

In S150, the IoT portal server 100 may receive a completion signal for authorization from the authentication server.

In S160, the IoT portal server 100 may generate a command signal for the first requested task and transmit it to the first device through the IoT platform server.

7 is a flowchart of a method of performing a request operation for a resource using an ACP in an IoT platform server according to embodiments of the present disclosure.

In S210, the IoT platform server 200 may receive a command signal for performing a second requested operation to the second device requested from the second terminal.

In S220, the IoT platform server 200 may transmit a verification request signal for the token included in the command signal to the authentication server.

In S230, the IoT platform server 200 may receive a success response signal regarding whether the verified token has been verified using the token included in the verification request signal from the authentication server.

In S240, when the IoT platform server 200 receives a success response signal that the token is verified, it may extract resource path information to be processed by analyzing the command signal.

In S250, the IoT platform server 200 may request, to the authentication server, whether or not there is authority for resource path information with respect to the account ID of the second terminal.

In S260, the IoT platform server 200 may receive a success response signal indicating that the resource path information is authorized for the account ID of the second terminal from the authentication server. The success response signal may include an ACP-ID associated with the second terminal.

In S270, when the success response signal is received, the IoT platform server 200 may determine whether the second requested task belongs to an operating range permitted by the ACP. The IoT platform server 200 may use the ACP-ID to determine whether the second requested task falls within the range of operations allowed in the ACP.

In S280, the IoT platform server 200 may generate a command signal for the second requested task when it is within the range of motion permitted by the ACP data field. The IoT platform server 200 may read data by accessing the ACP data field of the second terminal using the ACP-ID.

8 is a flowchart of a method of determining whether a token is verified in an authentication server according to an embodiment of the present disclosure.

In S310, the authentication server may receive a signal requesting verification of the received token of the requestor. The authentication server may receive a signal requesting verification of the token from the IoT portal server 100 or the IoT platform server 200 .

In S320, the authentication server performs verification of the token.

In S330, the authentication server may determine whether the token of the requestor is a verified token.

In S340, the authentication server may transmit a response signal including whether or not the token is verified for the verified token. In S335, if the token is not verified, the authentication server may transmit a verification failure response signal.

The authentication server may transmit a response signal regarding whether to verify to the IoT portal server 100 or the IoT platform server 200 that has transmitted the request signal for verification.

At this time, whether to verify the token may be determined in correspondence to the domain of the IoT platform. The same token may be verified for the domain of the first IoT platform and may not be verified for the domain of the second IoT platform, but is not limited thereto.

9 is a flowchart of a method of determining whether an authority is authorized for a verified token in an authentication server according to embodiments of the present disclosure.

In S410, the authentication server may receive a permission authorization request. The authentication server may receive a signal requesting authorization from the IoT portal server or the IoT platform server. The permission authorization request may include a token for an object to which permission is to be granted and target information (resource, resource path information, etc.) to be accessed.

In S420, the authentication server may check the account ID using the token included in the request.

In S430, the authentication server may create and initialize an authorization list of account IDs.

In S440, the authentication server may check the authority that the account ID may have and add the authority information that the account ID may have to the authority authorization list for the account ID.

In S450, the authentication server may determine whether there is an unadded authority.

In S460, the authentication server checks the unadded authority for the corresponding account ID and transmits a response signal to the authority authorization request. At this time, for the IoT platform, the authentication server allows the account ID requested in the signal for which permission authorization is requested to access resource path information, and transmits the ACP-ID as a response signal. The authentication server may acquire group information to which the account ID belongs and search for an ACP-ID corresponding to the group information.

10 is a flowchart illustrating a process of adding authority to an account ID in an authentication server according to an embodiment of the present disclosure.

In S510, the authentication server may check whether the IoT platform authority is added to the account ID acquired as a token.

In S540, if the IoT platform authority is added to the account ID, the authentication server allows the account ID to access the resource path information without adding additional authority, and transmits the ACP-ID as a response signal. The authentication server may acquire group information to which the account ID belongs and search for an ACP-ID corresponding to the group information.

In S520, the authentication server may check whether a device or app permission has been added to the account ID.

For the account ID, if the device or app permission is added, the requested IoT resource path information can be checked (S530). The authentication server allows the corresponding account ID to access the resource path information without adding additional authority, and may transmit the ACP-ID as a response signal (S540).

The authentication server may transmit an access denial response to the requested resource if the device or app permission is not added for the account ID.

The devices described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. The processing device may run an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. The device can be commanded. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with limited examples and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

1, 1': Authority management system
10, 100: IoT portal server
20, 200: IoT platform server
30: authentication server

Claims (17)

Receiving, by an IoT portal server, a task request signal for performing a first requested task from a first terminal to a first device;
Transmitting, by the IoT portal server, a verification request of the first terminal for the job request signal to an authentication server in response to the job request signal;
In the authentication server, using the token of the first terminal included in the verification request, with respect to the account of the first terminal and the first terminal, whether to grant permission for the first requested operation for the first device receiving a success signal for a verification request for verifying the token of the first terminal generated by verification from the verification server;
Transmitting, by the IoT portal server, a request for authorizing the first requested task to the first terminal to the authentication server;
Receiving, by the IoT portal server, a success response signal to a request for authorizing the first requested task generated by checking from a permission authorization list managed by the authentication server; and
When it is determined that the first terminal has authority for the first requested task by the success response signal, the IoT portal server sends a command signal to the first device to perform the first requested task, and the IoT platform server A method for managing authority using a token obtained through an authentication server and an ACP data field, comprising: transmitting to. According to claim 1,
After the step of transmitting the verification request of the first terminal,
When a success signal for the verification request for verifying the token of the first terminal is not received, transmitting a signal rejecting the first requested operation to the first terminal, further comprising: How to manage permissions using tokens and ACP data fields. According to claim 1,
After the step of transmitting the verification request of the first terminal,
The authentication server identifies the account of the first terminal using the token of the first terminal,
For the account of the first terminal, further comprising generating authentication information accessible to the IoT platform server, using a token obtained through an authentication server and an ACP data field to manage authority. According to claim 3,
The authentication server transmits authentication information accessible to the IoT platform server to the IoT platform server and processes the authentication information to be stored in the ACP field of the IoT platform server. Token and ACP data acquired through the authentication server How to manage permissions using fields. According to claim 4,
In the ACP field of the IoT platform server, the account information of the first terminal is stored, a method for managing authority using a token obtained through an authentication server and an ACP data field. Receiving, by the IoT platform server, a command signal for performing a second requested operation from the IoT portal server to the second device requested by the second terminal;
Transmitting, by the IoT platform server, a verification request signal for the token included in the command signal to an authentication server;
receiving, in the authentication server, a success response signal indicating whether the token verified by using the token included in the verification request signal has been verified;
Step, by the IoT platform server, in response to the success response signal, extracting resource path information to be processed by analyzing the command signal, and requesting from an authentication server whether or not there is authority for the resource path information with the token;
receiving a success response from the authentication server indicating whether or not the resource path information has authority through the token, and determining whether the command signal includes an authority tolerance range using the success response and the ACP field; and
Generating and processing a second command signal for the second requested task when the IoT platform server is authorized for the permission range of the command signal; further comprising a token obtained through the authentication server. and how to manage authority using ACP data fields. According to claim 6,
Requesting an account ID of the second terminal to the authentication server to check whether the account of the second terminal is verified;
A method for managing authority using a token obtained through an authentication server and an ACP data field, wherein the authentication server checks whether or not the second requested operation is authorized by the second terminal. According to claim 6,
The IoT platform server processing the second requested task to be performed in a second device according to the second command signal for the second requested task; Token and ACP data acquired through the authentication server, further comprising How to manage permissions using fields. Including a processor and a communication unit,
the processor,
Receiving a task request signal for performing a first requested task from the first terminal to the first device;
In response to the work request signal, transmits a verification request of the first terminal for the work request signal to an authentication server;
In the authentication server, using the token of the first terminal included in the verification request, with respect to the account of the first terminal and the first terminal, whether to grant permission for the first requested operation for the first device Receiving a success signal for a verification request for verifying the token of the first terminal generated by the verification from the verification server;
To the authentication server, transmits a request for authorizing the first requested operation to the first terminal;
Receiving a success signal for a request to authorize the first requested task generated by checking from a permission authorization list managed by the authentication server;
When it is determined that the first terminal has authority for the first requested task by the success signal, the IoT portal transmits a command signal for performing the first requested task to the first device to the IoT platform server. server. According to claim 9,
After transmitting the verification request of the first terminal,
the processor,
When a success signal for a verification request for verifying a token of the first terminal is not received, a signal rejecting the first requested operation is transmitted to the first terminal, the IoT portal server. According to claim 9,
After transmitting the verification request of the first terminal,
Using the token of the first terminal, to acquire the account ID of the first terminal, and for the account of the first terminal, to communicate with an authentication server that controls to generate authentication information accessible to the IoT platform server, IoT portal server. According to claim 11,
Characterized in that the authentication server transmits authentication information accessible to the IoT platform server to the IoT platform server and processes it to be stored in an ACP field of the IoT platform server. According to claim 12,
In the ACP field of the IoT platform server, the account information of the first terminal is stored, the IoT portal server. Including a processor and a communication unit,
the processor,
Receiving a command signal from the IoT portal server to perform a second requested operation from the second terminal to the second device;
Transmits a verification request signal for the token included in the command signal to the authentication server;
In the authentication server, to receive a success response signal whether the token verified by using the token included in the verification request signal is verified,
In response to the success response signal, extracting resource path information to be processed by analyzing the command signal, requesting whether or not there is authority for the resource path information with the token from an authentication server,
Receiving a success response from the authentication server on the presence or absence of authority for the resource path information with the token, and using the success response and the ACP field to determine whether the permission range of the command signal is included,
When the permission for the permission range of the command signal is authorized, the IoT platform server for generating and processing a second command signal for the second requested task. According to claim 14,
the processor,
Requesting an account ID of the second terminal to the authentication server to check whether the account of the second terminal is verified;
The IoT platform server for confirming, from the authentication server, the presence or absence of authority for the second requested operation requested by the second terminal. According to claim 14,
The processor processes the second requested task to be performed in the second device according to the second command signal for the second requested task, the IoT platform server. A computer program stored in a computer readable storage medium to execute the method of any one of claims 1 to 8 using a computer.

Images