WO2014005268A1

WO2014005268A1 - Resource access method and device

Info

Publication number: WO2014005268A1
Application number: PCT/CN2012/078071
Authority: WO
Inventors: 许斌; 张永靖
Original assignee: 华为技术有限公司
Priority date: 2012-07-02
Filing date: 2012-07-02
Publication date: 2014-01-09
Also published as: CN104169930A; CN104169930B

Abstract

Disclosed are a resource access method and device. The method comprises: receiving a resource access request of an access device; according to the resource access request, obtaining at least two access authority resources of the resource; according to a parsing rule for the resource and the access authority resources, determining an access rule set for the resource; and according to the access rule set, the device identifier and the resource access operation indication, responding to the resource access request of the access device. The resource access method and device in the embodiments of the present invention achieve the mutual inheritance of access authority resources between resources to enable the access authority of the resources to conduct self-adjustment with the modification of the access authority of the inherited resource, thereby improving the efficiency of resource access authority management.

Description

Resource access method and device

Technical field

The present invention relates to the field of communications, and in particular, to a resource access method and device

Background technique

Machine-to-Machine Communications (M2M) is a networked application and service centered on intelligent machine interaction. It embeds wireless or wired communication modules and application processing logic inside the machine to realize data communication without manual intervention to meet the information needs of users for monitoring, command and dispatch, data acquisition and measurement.

In M2M, the access control mechanism is used to prevent data from being illegally accessed by unauthorized applications in M2M terminals, gateways, and service platforms, thereby ensuring the privacy and security of various types of data. In general, the elements involved in a single visit include the requester (access subject), access operations (such as "read", "write", etc.) and access objects (access object). The access control mechanism works by: When the accessing entity initiates an access request for accessing certain access operations of the object, the access rule is allowed or prohibited according to the access rule associated with the accessing object.

European Telecommunication Standardization

In the M2M specification developed by the Institute, ETSI, the access rule set is configured in the access rights resource, and the configuration is limited.

Since the M2M specification defined by ETSI stipulates that the access resource identifier can only reference zero or one access rights resource, when zero resources are referenced, the system defaults to the access resource of the parent resource of the resource, so it is still substantially a reference. An access resource. In this case, when configuring the access resource identifier of a resource, there are two methods according to different requirements: Method 1: If the resource to be configured has no relationship with other resources, then create a new access right that meets the requirements. Resource and reference the resource; Method 2: The resource to be configured is related to other resources in access rights. For example, a resource with a parent-child relationship has an inheritance relationship, and directly refers to an access resource of another resource. Because M2M is organized and managed in the structure of resource tree, there are hierarchical relationships among resources, and resources have many relationships. Therefore, method 2 (that is, directly accessing access resources of other resources) is used to configure access rights of resources.

However, when a resource is accessed by multiple applications, and each application has different access rights. Or as a capital When the access permission part of the source refers to other resources, but has different permissions from the referenced resource, the prior art can only adopt the method of re-configuring the rights for the resource, and cannot invent the content through the access rights.

The invention provides a resource access method and device, which realizes access authority inheritance between resources and improves management efficiency of resource access rights.

In one aspect, a resource access method is provided, including receiving a resource access request of an access device, where the resource access request includes an access device identifier, an access resource identifier, and a resource access operation indication; the rights resource identifier, according to the at least two access rights The resource identifier reads an access authority resource indicated by each access authority resource identifier; determining an access rule set for the resource according to the parsing rule for the resource and the access authority resource; and according to the access rule set and the device The identification and the resource access operation indication are responsive to a resource access request of the access device.

Optionally, the method further includes: receiving a setting request for accessing the resource, where the setting request includes at least two access rights resource identifiers, and setting the access rights for the resources according to the at least two access rights resource identifiers .

Optionally, the setting request further includes a rule parsing identifier, where determining, according to the parsing rule for the resource and the accessing authority resource, an access rule set for the resource, including: parsing according to the rule The parsing rule corresponding to the identifier parses the access authority resource, and acquires an access rule set for the resource.

Optionally, the setting request further includes an access authority resource priority rule, and determining, according to the parsing rule for the resource and the access authority resource, an access rule set for the resource, including: according to the The access authority resource priority rule and the parsing rule corresponding to the rule resolution identifier parse the access authority resource, and obtain an access rule set for the resource.

Optionally, the setting request further includes: dividing a plurality of access rights resources, so that the multiple The access authority resource includes an access authority resource parent block and a plurality of sub-blocks corresponding to the parent block, and the parent block and the plurality of sub-blocks corresponding to the parent block each include a corresponding rule resolution identifier, and the Determining the access rule set for the resource by the parsing rule and the access authority resource, including: first parsing the access authority resource according to a parsing rule corresponding to the parent block rule parsing identifier, and then according to the The rule resolution identifier corresponding to the plurality of sub-blocks parses the access authority resource corresponding to the sub-block, and acquires an access rule set for the resource.

Optionally, the setting request further includes a priority rule of the parent block and the sub-block, and determining, according to the parsing rule for the resource and the access authority resource, an access rule set for the resource, including: And parsing the access authority resource according to the parsing rule and the priority rule corresponding to the parent block rule parsing identifier, and then accessing the rule set according to the parsing rule resource corresponding to the plurality of sub-block rule parsing identifiers.

Optionally, the setting request includes at least two indirect access rights resource identifiers, and determining, according to the parsing rules for the resources and the access rights resources, an access rule set for the resources, including: The indirect access authority resource identifier obtains the access authority resource address, and the access authority resource is read according to the access authority resource address; the access authority resource is parsed according to the parsing rule corresponding to the rule parsing identifier, and the resource is obtained for the resource Access rule set.

Optionally, the access rule set includes an access subject set and an access operation set corresponding to the access body, and the resource that responds to the access device according to the access rule set and the device identifier and the resource access operation indication The access request includes: if the access device matches the set of access subjects, and the resource access operation indicates that the indicated access operation matches the access operation set, allowing the access device to access the resource; The access device does not match the set of access subjects, or the access device matches the set of access subjects, but the access operation indicated by the resource access operation indication does not match the access operation set of the access device, And the access device is denied access to the resource; if the access device matches the set of access subjects, but the access operation set of the access device is “None”, the various access operation requests of the access device are rejected.

In another aspect, a resource access apparatus is provided, including: a receiving unit, configured to receive a resource access request of an access device, where the resource access request includes an access device identifier, an access resource identifier, and a resource Identifying at least two access rights resource identifiers of the corresponding resources, and reading the access rights resources indicated by the access rights resource identifiers according to the at least two access rights resource identifiers; and further, according to the parsing rules for the resources, Accessing a permission resource, determining an access rule set for the resource; and a response unit, configured to respond to the resource access request of the access device according to the access rule set and the device identifier and the resource access operation indication.

Optionally, the resource accessing device further includes: a setting unit, configured to set an access right of the resource, where the setting unit includes: a receiving subunit, configured to receive a setting request for accessing the resource, The setting request includes at least two access rights resource identifiers; and a setting subunit, configured to identify an access authority resource identifier of the resource according to the setting request received by the receiving subunit.

Optionally, the receiving subunit is specifically configured to: receive a setting request for accessing the resource, where the setting request further includes a rule parsing identifier, where the acquiring unit includes: a first acquiring unit, Obtaining at least two access rights resource identifiers in the access right identifiers of the resources, respectively reading the access rights resources according to the access rights resource identifiers; the second obtaining unit, according to the parsing rules corresponding to the rule parsing identifiers Parsing the access authority resource to obtain an access rule set for the resource.

Optionally, the receiving subunit is further configured to: receive an access permission setting request for the resource, where the setting request further includes an access authority resource priority rule, where the acquiring unit further includes: a third acquiring unit And the step of parsing the access authority resource according to the access authority resource priority rule and the parsing rule corresponding to the rule parsing identifier, and obtaining an access rule for the resource, where the receiving subunit further Specifically, the method is: receiving a setting request for accessing the resource, where the setting request further includes: dividing a plurality of access rights resources, wherein the multiple access rights resources include an access rights resource parent block and the a plurality of sub-blocks corresponding to the parent block, the parent block and the plurality of sub-blocks corresponding to the parent block each include a corresponding rule-resolving identifier, and the acquiring unit further includes: a fourth acquiring unit, configured to first The parsing rule corresponding to the block rule parsing identifier parses the access authority resource, and then parses the identifier according to the rule corresponding to the multiple sub-blocks The sub-block corresponding to the resource access parses the rule set for gaining access to the resource. Optionally, the receiving sub-unit is further configured to: receive a setting request for accessing the resource, where the setting request further includes a priority rule of the parent block and the sub-block, and the acquiring unit further includes And a fifth acquiring unit, configured to parse the access permission resource according to a parsing rule and a priority rule corresponding to the parent block rule parsing identifier, and then describe an access rule set of the resource according to a rule corresponding to the multiple sub-blocks .

Optionally, the receiving sub-unit is further configured to: receive a setting request for accessing a resource, where the setting request includes at least two indirect access rights resource identifiers, and the acquiring unit further includes a sixth acquiring unit, And the access authority resource is obtained according to the indirect access authority resource identifier, and the access authority resource is read according to the access authority resource address; and the access permission resource is parsed according to the parsing rule corresponding to the rule parsing identifier. An access rule set for the resource.

Optionally, the response unit is specifically configured to: if the access device matches the access subject set, and the resource access operation indicates that the indicated access operation matches the access operation set of the access device, The access device accesses the resource; if the access device does not match the set of access subjects, or the access device matches the set of access subjects but the resource access operation does not match the access operation set, And the access device is denied access to the resource; if the access device matches the access subject set, but the access device has an access operation set of “None”, the access device requests of the access device are rejected.

Optionally, the device includes: an M2M terminal, an M2M platform, and an M2M gateway.

In the resource access method and the resource access device of the embodiment of the present invention, the entity having the resource configuration authority sets the access authority resource identifier of the resource in the resource access device, and adds the access authority resource identifier of the other resource to the access authority resource identifier. In the symbol, the resource access device can obtain the relevant access authority resource according to the access authority resource identifier, and parse the access permission resource according to the parsing rule set by itself, thereby implementing mutual inheritance of the access authority resources between the resources, so that the resource The access rights can be adjusted according to the modification of the access rights of the inherited resources, thereby improving the management efficiency of the resource access rights, and at the same time, improving the utilization of the access resource storage space and saving storage space.

DRAWINGS

Figure 1 is a typical M2M system architecture diagram; 2 is a flowchart of a resource access method according to an embodiment of the present invention;

FIG. 3B is a representational state transition resource tree of resources according to an embodiment of the present invention; FIG.

4 is a signaling interaction diagram of a resource access method according to an embodiment;

FIG. 5 is a schematic diagram of a signaling interaction configuration of a resource access authority resource identifier in a resource access method according to another embodiment of the present invention; FIG.

FIG. 6 is a resource access method of this embodiment;

FIG. 7 is a diagram showing an access authority resource identifier setting signal interaction diagram of a resource access method according to another embodiment of the present invention; FIG.

FIG. 8 is a signaling interaction diagram of a resource access method according to another embodiment; setting a signaling interaction diagram;

FIG. 9B is a structural diagram of an access authority resource identifier having multiple access rights resource blocks according to an embodiment of the present invention; FIG.

FIG. 10 is a signaling interaction diagram of a resource access method according to still another embodiment of the present invention;

FIG. 11 is a schematic diagram of a resource access apparatus according to an embodiment of the present invention; FIG.

FIG. 12 is a schematic diagram of a setting unit in a resource access device according to an embodiment of the present invention; FIG.

FIG. 13 is a schematic diagram of an acquiring unit in a resource access device according to an embodiment of the present invention; FIG.

FIG. 14 is a schematic diagram of a resource access apparatus according to another embodiment of the present invention. detailed description

BRIEF DESCRIPTION OF THE DRAWINGS The technical solutions in the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative work are within the scope of the present invention.

Figure 1 shows a typical M2M system architecture diagram, including:

The M2M network application NA 101 is used for registering to the M2M service platform 102, accessing data collected by the M2M device through the mid interface, and also for remote device management of the M2M device; The M2M device D, 104 is connected to the M2M service platform 102 through the M2M gateway G103;

The M2M device dl05 is connected to the M2M service platform 102 through the M2M gateway G103;

The M2M device dl05, connects to the M2M service platform 102 through the M2M device D 106.

The M2M device dl05 and the M2M device dl05 are traditional devices that do not conform to the ETSI M2M specification; the M2M device D and the M2M device D are devices that conform to the ETSI M2M specification, wherein the M2M device D has the service capability layer defined by the ETSI M2M standard. (SCL, Service Capability Layer), M2M device D, does not have the Service Capability Layer (SCL) defined by the ETSI M2M standard.

M2M Gateway G103 uses Gateway Interworking Proxy (GIP, Gateway Interworking Proxy) by wireless or wired communication (eg, Zigbee, Bluetooth, DLMS/COSEM, Zwave, BACnet, ANSIC12, mBus, etc.) with M2M legacy device d and M2M device D ,interconnected. The mid interface between the M2M gateway or the M2M device D and the M2M platform generally uses wired or wireless wide area network communication (eg, Xdsl, HFC, satellite, GERAN, UTRAN, eUTRAN, W-LAN and WiMAX, etc.).

The following is a description of the technical solution of an embodiment of the present invention. FIG. 2 is a flowchart of a resource access method according to an embodiment of the present invention, including:

201. Receive a resource access request of an access device, where the resource access request includes an access device identifier, an access resource identifier, and a resource access operation indication.

Specifically, the middleware receives the resource access request from the access device, and requests related operations on the resource, such as: reading, writing, and the like. The middleware is a logical entity set in the M2M terminal or the M2M gateway or the M2M platform. The resource access request includes an access device identifier, an access resource identifier, and a specific access operation indication for the resource.

It should be noted that the access device may be an M2M terminal, an M2M platform, or an M2M gateway. In addition, the middleware performs related setting on the access authority of the resource in advance. Specifically, the middleware sets a request according to the access authority of the requesting device to the resource, and the access authority resource identifier of the resource is entered into the source identifier, and the access authority resource identifier points to the access. Permission resources. The access authority resource includes an access rule set, and each access rule includes at least an access subject set and an access operation set. The set of access subjects includes a plurality of access subjects that allow access to the resource, the access subject may employ a URI, a global identifier, or An identifier of a specific meaning is described. The access operation set includes allowable access operations corresponding to the allowed access subject, such as "read", "write", etc. Similarly, the access operation can also be described by using a URI, a global identifier, or an identifier of a specific meaning. The two access rights resource identifiers are used to read the access rights resources indicated by the access rights resource identifiers according to the at least two access rights resource identifiers.

Specifically, the middleware may view the access authority resource identifier of the resource corresponding to the resource identifier according to the resource identifier specified in the access request, and obtain the corresponding access authority resource identifier from the access authority resource identifier, according to the access The rights resource ID reads the access rights resource it points to.

Generally, the access authority resource identifier includes a URI of the access authority resource, and the middleware can be based on the

The URI gets its corresponding access rights resource.

203. Determine an access rule set for the resource according to the parsing rule for the resource and the access authority resource.

Specifically, the middleware may preset a rule resolution identifier of the access authority resource, where the rule resolution identifier indicates a default parsing rule of the middleware default configuration. The access rule can be parsed by the parsing rule to obtain the access rule set of the resource.

204. Respond to the resource access request of the access device according to the access rule set and the device identifier and the resource access operation indication.

Specifically, the middleware determines whether the access device identifier matches the access subject set in the access rule set, that is, whether it is an access subject in the access subject set, and then determines whether the access operation of the access device matches the subject access operation set, that is, the subject Whether the access operation is an access operation allowed in the access operation set.

When the access device meets the above two conditions at the same time, the middleware allows the access device to perform access operations on the specified resource. Otherwise, when the access device does not satisfy any of the above conditions, the middleware denies the access device from accessing the specified resource. .

In the resource access method according to an embodiment of the present invention, the access authority of the resource having the resource configuration authority is set, and the access authority resource identifier of the other resource is added to the access authority resource identifier, so that the middleware can be Obtaining the related access authority resource according to the access authority resource identifier, thereby implementing mutual inheritance of the access authority resources between the resources, so that the access authority of the resource can be The access rights of the inherited resources are modified by themselves to improve the management efficiency of the resource access rights. At the same time, the utilization of the access resource storage space can be improved, and the storage space is saved.

The resource access method according to an embodiment of the present invention will be described below from the perspective of access authority resource identifier setting. As shown in FIG. 3A, a signaling interaction diagram for setting an access authority identifier of a resource in a resource access method according to an embodiment of the present invention includes:

301. The resource setting requesting device sends a setting request for accessing a resource to a receiving device, such as an M2M terminal, an M2M gateway, or an M2M platform, where the setting request includes at least two resource access rights identifiers and resource identifiers to request a pair. Set the access rights of the resource corresponding to the identifier of the resource. The device of the resource setting requesting device includes the permission to set the access resource, and may be an M2M platform.

Specifically, the resources in the M2M describe a Representational State Transfer (RESTful) of the resource as described in FIG. 3B.

Where the field container contains one or more containers <container>. The container <container> is a container resource representation of the prior art, and mainly includes data information resources for describing applications or M2M terminals, platforms, and gateways.

The container <container> has the accessRightID attribute, and the accessRightID is the access resource identifier. According to the ETSI M2M specification, the accessRightID attribute can be set to AnyURI[0...1 ], which means 0 to 1 URI, which points to the access resource. accessRight. If the accessRightID property is set to "htt : //m2m. o . com/accessRights/<ar5 >", the access rule indicating the resource is described by the access resource <& 5>.

Step 302: Set access rights of the resource according to the setting request.

Specifically, the receiving device may modify the setting accessRightID attribute AnyURI[0...1] to AnyURI[0...unbounded] (that is, AnyURIList), and each URI needs to point to the access authority resource <accessRight>, that is, The resource access permission identifier is introduced. This enables a combined reference to at least two access rights resources.

In the embodiment of the present invention, the requesting device may be an M2M platform or an M2M2 gateway, and the receiving device may be an M2M terminal, an M2M platform or an M2M2 gateway. The M2M platform or the M2M2 gateway may request access rights to resources located in other devices such as an M2M terminal, an M2M platform, or an M2M2 gateway through a setting request for access rights of resources, or may also access the resources. The limit setting requests the setting of access rights to resources located locally on the requesting device. That is to say, the requesting device and the receiving device may be the same device or different devices. The embodiments of the present invention are not limited herein.

As shown in FIG. 4, the signaling interaction diagram of the resource access method in this embodiment includes:

401. The access device sends a resource access request to the receiving device, where the resource access request includes an access identifier, a resource identifier, and a resource access operation indication for the resource.

The receiving device is configured to view the access right resource identifier of the resource according to the resource identifier, obtain at least two access rights resource identifiers, and read the corresponding access rights resource according to the at least two access rights resource identifiers, and parse the identifier according to the preset rule. The specified parsing rule parses at least two access rights resources to obtain a resource access rule set for the resource.

403. The receiving device returns a resource access response to the access device according to the access rule set, the access device identifier, and the access device operation indication of the resource.

The rule resolution identifier is described by a string. The preset rule resolution identifier is "overlay", and the resolution rule specified by the rule resolution identifier is "sequential coverage". Specifically, the resources are sequentially acquired from the previous ones, and at least two imported access rights resources are used to identify respective access rights resources. The access rules in each access permission resource are analyzed sequentially.

For an access subject that appears in an access subject set of multiple access rules, the set of allowed access actions is determined by the first access rule that contains the access subject. If the access device matches the set of access subjects in the access rule set, it is determined whether the access operation of the access device belongs to the access operation set, and if so, the access device is allowed to access and operate the resource. If the access device does not belong to the access subject set in the access rule set, or if the access device belongs to the access subject set in the access rule set, but the access operation does not match the allowed access operation set, or the access operation set is "none", The resource access request of the access device is rejected.

Column ^: accessRightID belongs to '! "Life is set to" htt :〃 m2m.op.com/accessRights/<ar3>;http://m2m.op.com/accessRights/<ar4>" , indicating that the resource is accessed by the access resource <& 3 > Commonly described with <&4>, when the access device reads the resource, it receives the preset rule resolution identifier of the device (this embodiment assumes "overlay", and the default access resolution rule "sequentially overwrites") , first get access rights resource <&4>, such as <ar4> set the rule set as the access subject The set "Appl" and "App2" allow access to the operation "Read", which in turn gets the access rights resource <&3>, such as setting the rule set in <ar3> to access the subject set "App 1" and "App3" to allow access operation "Write"" , the parsed rule set for the access subject "Appl" allows access operation "Read", the access body body "App2" allows access operation "Read", and the body "App3" allows access operation "Write".

The following is a detailed description of another embodiment of the present invention from the perspective of the configuration of the rule resolution identifier. FIG. 5 is a schematic diagram showing the signaling interaction configuration of the resource access authority resource identifier in the resource access method according to another embodiment of the present invention. Includes:

501. The requester sends an access authority resource identifier setting request for the resource to the receiving device, where the setting request includes a resource identifier, an access authority resource identifier, and a rule resolution identifier.

Specifically, the resource identifier points to a resource that needs to set a privilege resource identifier, and the privilege resource identifier is an identifier of the imported access privilege resource, and the rule parsing identifier is an identifier corresponding to the parsing rule to be set, and is described by a character or a string, for example, Set to "overlay", "union", etc., respectively, to use "sequential coverage", "take the collection" way to parse access rights resources. It should be noted that here is merely an example, and the rule resolution identifier may be set to any other form that can be understood by those skilled in the art. If there is no rule resolution identifier or the value of the rule resolution identifier is not set, the default parsing rules are used, such as: parsing the permission resources one by one from the back to the front.

502. Set an access authority resource identifier of the resource according to the setting request.

Specifically, the receiving device, such as the M2M terminal, the M2M gateway, or the M2M platform, adds the imported rights resource identifier and the rule resolution identifier to the access rights identifier of the resource corresponding to the resource identifier according to the setting request.

Optionally, as shown in the following figure is a data structure for expressing an access resource identifier, and accessRightlD includes an imports element, the element includes one or more import elements and at least one resolveMode element, and each import element is used for the bow I. In the access permission resource, the resolveMode is used to describe the rule resolution identifier to indicate a certain parsing rule. For example, the rule parsing identifier can be set to "RFC4745 or "RFC3530", etc., to indicate that the access authority resource is parsed according to the RFC4745 or RFC3530 specifications. Please refer to the relevant specifications for the resolution rules specified by the RFC4745 or RFC3530 rule resolution identifier.

The following is an example of describing an access rights identifier as an XML extensible tag. <imports>

http://m2m.op.com/accessRights ar3>

</import>

http://m2m.op.com/accessRights ar4>

</import>

RFC4745

</resolveMode>

</imports>

As shown in FIG. 6, the resource access method in this embodiment includes:

601. The access device sends an access request to the receiving device, where the access request carries a resource identifier, an access device identifier, and an access operation to the resource.

602. The receiving device checks the access permission identifier and the rule resolution identifier according to the access permission identifier of the resource, and reads the access permission resource of the resource according to the access permission resource identifier, and then accesses the access according to the parsing manner corresponding to the rule resolution identifier. The permission resource is parsed to obtain an access rule set for the resource.

603. Respond to the access request according to the access rule set and the access device identifier and the access operation indication.

Specifically, if the access device identifier belongs to the access subject set in the access rule set, and the access operation belongs to the allowed access operation set of the access rule set, the resource access request of the device is allowed to be accessed, otherwise the jumbo color is given.

For example, when the access device reads the resource, the middleware first obtains the value of resolveMode, which is "RFC4745", and then parses the access rule set for the resource according to the RFC 4745 specification of the rule resolution identifier. According to the parsed access rule set, it is judged whether the access device can read the resource, and if so, the read is allowed, if otherwise, the reject response is given.

It is worth mentioning that if some of the resolution modes indicated by resolveMode have priority requirements for the imported rights resources, the access rights resources are parsed according to the priority requirements.

The following access resource resource identifier points to multiple access rights resources, and the access rights resources are excellent. The configuration of the resource access identifier setting signaling interaction diagram of another embodiment of the present invention is as follows:

701. The requesting device sends a setting request for an access right identifier of a specific resource to a receiving device, such as an M2M terminal, an M2M gateway, or an M2M platform, where the setting request includes a resource identifier, an imported access right resource identifier, a rule parsing identifier, and an access. Permission resource priority rules.

702. The receiving device sets an access authority resource identifier of the specified resource according to the setting request.

Specifically, the access authority resource for each entry defines a priority value according to the access authority resource priority rule.

For example, the priority attribute is set for each import element of the access resource identifier. The value of the attribute can be a numeric value or a character to describe the priority relationship of the imported access rights resource. For example, in the access resource identifier, the priority attributes of the three imported elements are set to: "Priority=l", "Priority=2", "Priority=3", which means "Priority=3" The import element has a higher priority than the import element with "Priority=2", and the import element with "Priority=2" has a higher priority than the import element with "Priority=l". If the priority attributes of the three import elements have the same value, the default priority order is adopted, that is, the priority of the import element from the back to the top is gradually reduced.

As shown in FIG. 8, the signaling interaction diagram of the resource access method in this embodiment includes:

801. The access device sends a resource access request to the receiving device, where the resource access request includes a resource identifier, an access device identifier, and an access operation to the resource.

The receiving device may be an M2M terminal, an M2M gateway, or an M2M platform, and the access device may also be an M2M terminal, an M2M gateway, or an M2M platform.

802. The receiving device searches for an access right resource identifier under the resource corresponding to the resource identifier according to the resource identifier in the resource access request, and reads the access right resource according to the access right identifier under the access right resource identifier, and according to the The rule resolution identifier under the access authority resource identifier is parsed by the parsing rule corresponding to the rule parsing identifier, and the access rule set for the resource is obtained.

803. The receiving device accesses the device according to the access device identifier, the access operation, and the access rule set. Returns the resource access response.

Specifically, if the access device belongs to the access subject set in the access rule set, and determines whether the access operation carried in the access request indicates that the access operation corresponding to the access operation belongs to the access operation set allowed by the access subject, if yes, the access device is allowed to perform resources on the resource. Access and operation; if the access device does not match the set of access subjects in the access rule set, or if the access operation does not match the allowed access operation set, the resource access and operation of the access device are rejected.

For example, after introducing the priority attribute, an example of accessing the resource identifier identifier accessRightID in the XML language: 3⁄4 port as shown below:

Http://m2m.op. com/access ights/<ar3>

</import>

Http://m2m.op. com/access ights/<ar4>

</import>

Overlay

</resolveMode>

</imports> The example shown above shows that the access rights of the resource are described by the access rights resources <ar3> and <ar4>, and the imported access rights have a priority relationship. The <ar3> has higher priority. The priority of <ar4> is also indicated by the resolveMode indicating that the parsing rules are based on the "sequential coverage" method. First get the access permission resource <&3>, for example, set the rule set in <ar3> to access the subject set "Appl" and "App3" to allow the access operation "Write", and then obtain the access permission resource <ar4>, such as <ar4> Set the rule set to access the subject set "ΑρρΓ, and "App2" to allow access to the operation "Read", then the parsed rule set for the access subject "App 1" allows access operation "Write", access to the body body "App2" allows access operations "Read", the main body "App3" allows access operation "Write". If the resolveMode is set to "union", that is, the "collection" is resolved, since this method does not require priority, the value of "priority" is ignored.

The parsed rule set is: The parsed rule set is the access subject "Appl" allows access operations "Write" and "Read", the access body body "App2" allows access operation "Read", the main body "App3" allows access operation"Write". In addition, the resolveMode can also be set to "RFC4745", "RFC3530", etc., respectively, according to the "RFC4745" specification, The "RFC3530" specification performs rule analysis. For details, please refer to the corresponding specification.

The resource access method according to another embodiment of the present invention will be described below by taking an access right identifier from a plurality of access rights resources, and the access rights resource is introduced in a block, including a parent block and a plurality of sub-blocks corresponding to the parent block.

As shown in FIG. 9A, a signaling interaction diagram for setting an access authority resource identifier of a resource in a resource access method according to another embodiment of the present invention includes:

901. The requester sends a setting request for an access right identifier of the resource to a receiving device, such as an M2M terminal, an M2M gateway, or an M2M platform, where the setting request includes a resource identifier, an access authority resource identifier, and a parent block for the access authority resource. The rule of sub-block division, and the rule resolution identifier corresponding to the parent block and each sub-block respectively.

Specifically, the parent block is specified by setting an "introduction" (ie, "imports") element of the access authority identifier, and the child block is specified by setting a "reference" (ie, "import") element of the access authority identifier.

902. The receiving device sets an access right of the specified resource according to the setting request. Specifically, the receiving device obtains the resource according to the resource identifier specified in the setting request, and updates the access right identifier of the resource to the access right identifier carried in the request. That is, the access rights resource is partitioned, that is, the parent block and the plurality of sub-block access rights resources corresponding to the parent block are set. Each sub-block includes at least one access rights resource identifier. A separate rule resolution ID can be set for each sub-block and each parent block. At the same time, each sub-block and each parent block can also set a priority rule.

For example, an access rights resource identifier that introduces access rights resources into chunks can be described as a data structure as shown in Figure 9B.

As shown in FIG. 9B, the accessRightID structure map of the access authority resource identifier having multiple imports, the accessRightID includes an ersmissionsRef element, the element further includes one or more imports elements, and each imports element includes one or more import elements, each The import element includes one or more access rights resource identifiers.

As shown in FIG. 10, the signaling interaction diagram of the resource access method in this embodiment includes:

1001: The access device sends a resource access request to the receiving device, where the resource access request includes a resource identifier, an access device identifier, and an access operation to the resource.

The receiving device may be an M2M terminal, an M2M gateway, or an M2M platform, and the access device may also be an M2M terminal, an M2M gateway, or an M2M platform. 1002: The receiving device checks, according to the resource identifier in the resource access request, an access right resource identifier under the resource corresponding to the resource identifier, and first performs a parent node according to the parsing rule and the priority rule corresponding to the parent block rule parsing identifier. The corresponding access permission resource is parsed, and then the access permission resource corresponding to the sub-block is parsed according to the rule parsing identifier and the priority rule corresponding to the multiple sub-blocks, and the resource access rule set for the resource is obtained.

1003. The receiving device returns a resource access response to the access device according to the access device identifier, the access operation indication, and the access rule set.

The following is an example of describing the access permission accessRightID shown in the above figure in XML language.

Http://m2m.op. com/access ights/<ar3>

</import>

Http://m2m.op. com/access ights/<ar4>

</import>

Http://m2m.op. com/access ights/<ar5>

</import>

RFC4745

</resolveMode>

</imports>

Http://m2m.op. com/access ights/<arl>

</import>

Http://m2m.op. com/access ights/<ar2>

</import>

RFC3530

</resolveMode>

</imports>

< imports priority=3>

Http://m2m.op. com/access ights/<ar6>

</import>

Http://m2m.op. com/access ights/<ar7>

</import>

RFC4745

</resolveMode>

</imports>

RFC3530 In the example shown above, the access rights of the resource are jointly described by the access rights resources <arl>, <ar2>, <ar3>, <ar4>, <ar5>, <ar6>^<ar7>, when the access device When the resource sends an access operation request to perform a read operation, the receiving device first obtains the value of the resolve parameter of the "permission reference" (ie, permissionsRef) element, "RFC3530" (ie, the rule resolution identifier is RFC3530). The RFC 3530 specification that resolves the identity indication in accordance with the rule parses the access rule set for the resource. The RFC 3530 specification parsing method has priority requirements for access rights resources. Therefore, the receiving device reads the priority priority attribute of the imports element, and prioritizes according to the attribute value. Here, the priority of the last imports is the value of the priority attribute. Therefore, first the access permission resource in the imports element is parsed, and then the first imports element is parsed, because the importance attribute value of the imports element is 2, and finally the intermediate imports element is parsed because the imports The element's priority attribute value is 1, and the analysis of the imports element is based on the parsing method indicated by the value of the sub-element resolveMode. Finally, based on the parsed access rule set, it is determined whether the requester can read the resource and respond.

It should be noted that the middleware rejects or allows the response not always triggered after all the rules are parsed, but is triggered immediately when it is determined that the access device's resource access request does not meet the access rules.

The resource access method of another embodiment of the present invention is further described below by taking an access resource identifier directly or indirectly pointing to multiple access rights resources as an example.

In this embodiment, the access authority resource identifier of the resource and the resource are directly or indirectly pointed to the access authority resource identifier, and the indirect meaning means that the access authority resource identifier does not point to the access authority resource itself.

For example, access rights associated with a resource consist of zero or more direct or indirect pointing access resource IDs. For example, set the accessRightID property of the resource Resource to "http://m2m.o.com/containers/<container 1 >;http://m2m.op.com/accessRights/<ar5>" to indicate that the resource has access rights. Resource htt ://m2m. o . com/containers/<container 1 > access resource, resource htt ://m2m. o . com/containers/<container2> accessRightID indicates access rights to access device to resource Resource When the read operation is performed, the default access rights of the receiving device are received. The resource-resolving rule first parses whether the access subject set of the access rule set after <5> contains the requester, and if it exists and the allowed access operation set includes the read operation, the requester is allowed to read the resource, if The allowed access operation set does not contain a read operation, and the requestor is not allowed to read the resource.

If the access subject set of the access rule set after parsing <5> does not include the requester, continue to analyze the access authority resources indicated by the resource <container2>^ accessRightlD until all the access rights resources are resolved. It is worth noting that after parsing " http://m2m.op om/containers/<container2>/accessRightID''H† , the device needs to be parsed by the source identifier. In parsing htt :〃 m2m.op. For com/containers/<containerl>, the middleware needs to read htt: 〃 m2m.op.com/containers/<containerl> i" refers to the accessRightlD resource of the resource. In addition, for <container2>^ accessRightlD resolveMode, the default access permission resolution rule is adopted.

The resource access device according to an embodiment of the present invention is as follows. As shown in FIG. 11, the resource access device includes: a setting unit 1101, configured to set an access authority resource identifier of a resource, and enable an access authority resource identifier of the resource. The resource access request includes at least two resource access rights identifiers, and the resource access rights identifiers are directed to the access rights resources. The 1102 receiving unit is configured to receive a resource access request of the access device, where the resource access request includes an access device identifier and a resource access operation; The obtaining unit, the resource identifier identifies the access authority resource; parses the access authority resource according to a preset parsing rule, and obtains a resource access rule set for the resource; 1104 a response unit, configured to use the resource access rule according to the resource access rule The set and the access device identity are responsive to the access device resource access request.

The setting unit 1101 includes as shown in FIG. 12:

a receiving subunit 11011, configured to receive a setting request for an access right resource identifier of the resource, where the setting subunit 11012 is configured to set an access authority resource identifier of the resource according to the setting request received by the receiving subunit, The access authority resource identifier of the resource is included in the at least two introduced resource access rights identifiers. The acquisition unit is shown in Figure 13, and includes:

The first obtaining unit, the first acquiring unit, is configured to acquire an access right resource identifier in the access right identifier of the resource, and read the access right resource according to the access right resource identifier;

The second obtaining unit 11032 parses the access authority resource according to the parsing rule corresponding to the rule parsing identifier, and acquires a resource access rule set for the resource.

The third obtaining unit 11033 is configured to parse the access authority resource according to the access authority resource priority rule and the parsing rule corresponding to the rule resolution identifier, and acquire a resource access rule set for the resource.

The fourth obtaining unit 11034 is configured to parse the access permission resource according to the parsing rule corresponding to the parent block rule parsing identifier, and then corresponding to the sub-block according to the rule parsing identifier corresponding to the multiple sub-blocks The access rights resource is parsed to obtain a resource access rule set for the resource.

The fifth obtaining unit 11035 is configured to parse the access permission resource according to the parsing rule and the priority rule corresponding to the parent block rule parsing identifier, and then, according to the resource corresponding to the resource, corresponding to the multiple sub-blocks Access rule sets.

The sixth obtaining unit 11036 is configured to obtain an access authority resource address according to the indirect access authority resource identifier, and read the access authority resource according to the access authority resource address.

It should be noted that the resource access device in the embodiment of the present invention may be an M2M terminal, an M2M platform, or an M2M gateway.

The resource access device of the embodiment of the present invention, as shown above, sets the access authority resource identifier of the resource in the resource access device by the entity having the resource configuration authority, and adds the access authority resource identifier of the other resource to the access authority resource identifier. In the symbol, the resource access device can obtain the related access authority resource according to the access authority resource identifier, thereby implementing mutual inheritance of the access authority resources between the resources, so that the access authority of the resource can be modified according to the access authority of the inherited resource. Self-adjustment improves the management efficiency of resource access rights. At the same time, it can improve the utilization of access resource storage space and save storage space.

FIG. 14 is a schematic structural diagram of another resource access apparatus according to an embodiment of the present invention, including a memory 1401, and a processor 1402. Wherein the memory 1401 is used to store the units described in FIG. 11-13, The processor 1402 is coupled to the memory 1401, and each unit in the operational memory 1401 performs the respective functions of the units in the memory 1401. The functions of the units in the memory 1401 in FIG. 14 are the same as those in the units in FIG. 11-13, and the embodiments of the present invention are not described in detail herein.

The implementation of the processing functions of the units included in the above-mentioned device for resource access has been described in the previous method embodiments, and the description thereof will not be repeated here. In addition, in an M2M network, the M2M platform can be a computer, a device with a processor. M2M gateways and M2M terminals are not strictly distinguished on the device. For example, devices that use gateways can also serve as terminals. In addition, various terminal devices, such as mobile phones, computers, PDAs, notebook computers, remote controllers, household appliances, and various instruments , sensors, etc. can be used as gateways or terminals for M2M networks. In the above unit embodiment, each unit included is only divided according to functional logic, but is not limited to the above division, as long as the corresponding function can be implemented; in addition, the specific names of the functional units are only for convenience. They are distinguished from each other and are not intended to limit the scope of protection of the present invention. The above-mentioned method for realizing the charging and the functions of each functional unit of the charging device can be completed by the M2M gateway or the processor running the M2M platform.

A person skilled in the art can understand that all or part of the process of implementing the above embodiments can be completed by a computer program to instruct related hardware, and the above program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM: Read Random Memory), or a random access memory (RAM).

In conclusion, the above is only a preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Rights request

1. A resource access method, characterized by including:

Receive a resource access request from the access device, where the resource access request includes an access device identifier, an access resource identifier, and a resource access operation instruction; an access permission resource identifier, and reads each access permission resource identifier indication based on the at least two access permission resource identifiers. access rights resources;

Determine an access rule set for the resource based on the parsing rules for the resource and the access permission resource;

Respond to the resource access request of the access device according to the access rule set and the device identification and the resource access operation indication.

2. The method of claim 1, wherein the method further includes:

Receive a request for setting access rights to the resource, where the setting request includes at least two access rights resource identifiers;

Set the access permission for the resource according to the at least two access permission resource identifiers.

3. The method of claim 2, wherein the setting request further includes a rule parsing identifier, and the access to the resource is determined based on the parsing rule for the resource and the access permission resource. Rule sets, including:

The access permission resource is parsed according to the parsing rule corresponding to the rule parsing identifier, and an access rule set for the resource is obtained.

4. The method of claim 3, wherein the setting request further includes an access rights resource priority rule, and the method for determining the access rights resource is determined based on the parsing rules for the resource and the access rights resource. Resource access rule set, including:

The access permission resource is parsed according to the access permission resource priority rule and the parsing rule corresponding to the rule parsing identifier, and an access rule set for the resource is obtained.

5. The method of claim 3, wherein the setting request further includes dividing multiple access rights resources into blocks, so that the multiple access rights resources include a parent block of access rights resources and a block corresponding to the parent block. A plurality of sub-blocks corresponding to a block, the parent block and the plurality of sub-blocks corresponding to the parent block all include corresponding rule parsing identifiers, and the determination is made based on the parsing rules for the resource and the access permission resource. Access rule set for the resource, including:

First, the access rights resources are parsed according to the parsing rules corresponding to the parent block rule parsing identification, and then the access rights resources corresponding to the sub-blocks are parsed according to the rule parsing identifications corresponding to the multiple sub-blocks, and the access rights resources corresponding to the sub-blocks are obtained. A set of access rules for the resource in question.

6. The method of claim 5, wherein the setting request further includes priority rules for parent blocks and child blocks, and the determination for the resource is based on the parsing rules for the resource and the access rights resource. The set of access rules for the resource includes:

First, the access permission resource is parsed according to the parsing rules and priority rules corresponding to the parent block rule parsing identifier, and then the child block rule parsing identifiers are parsed according to the parsing rules and priority rules corresponding to the multiple child block rule parsing identifiers. The access permission resource corresponding to the block is parsed to obtain the resource access rule set for the resource.

7. The method according to any one of claims 3 to 6, characterized in that the setting request includes at least two indirect access permission resource identifiers, which are determined according to the parsing rules for the resource and the access permission. Resource, determine the set of access rules for the resource, including:

Obtain the access permission resource address according to the indirect access permission resource identification, and read the access permission resource according to the access permission resource address;

8. The method of claim 1, wherein the access rule set includes an access subject set and an access operation set corresponding to the access subject, and the access rule set and the device identification and the access operation set are The resource access operation instruction responds to the resource access request of the access device, including:

If the access device matches the access subject set, and the access operation indicated by the resource access operation indication matches the access operation set, then the access device is allowed to access the resource;

If the access device does not match the access subject set, or the access device matches the access subject set, but the access operation indicated by the resource access operation indication does not match the access operation set of the access device , then the access device is denied access to the resource;

If the access device matches the access subject set, but the access operation set of the access device is "none", then various access operation requests of the access device are rejected.

9. A resource access device, characterized by including: A receiving unit, configured to receive a resource access request from an access device, where the resource access request includes an access device identifier, an access resource identifier, and a resource access operation instruction; at least two access permission resource identifiers of the source, according to the at least two access permissions The resource identifier reads the access permission resource indicated by each access permission resource identifier; and is also used to determine the access rule set for the resource based on the parsing rules for the resource and the access permission resource;

A response unit configured to respond to the resource access request of the access device according to the access rule set, the device identification, and the resource access operation indication.

10. The device according to claim 9, characterized in that, the device further includes: a setting unit, used to set the access permission of the resource, the setting unit includes: a receiving subunit, used to receive the A request to set the access rights of the resource, the setting request including at least two access rights resource identifiers;

The setting subunit is configured to request access to the resource according to the setting request received by the receiving subunit.

11. The device of claim 10, wherein the receiving subunit is specifically configured to: receive a setting request for access rights to the resource, where the setting request further includes a rule parsing identifier, so The acquisition units include:

The first acquisition unit is used to obtain at least two access rights resource identifiers among the access rights identifiers of the resources, and respectively read the access rights resources according to the access rights resource identifiers;

The second acquisition unit parses the access permission resource according to the parsing rule corresponding to the rule parsing identifier, and obtains an access rule set for the resource.

12. The device according to claim 10, characterized in that the receiving subunit is also specifically used for:

Receive an access permission setting request for the resource, the setting request also includes access permission resource priority rules, and the acquisition unit also includes:

The third acquisition unit is configured to parse the access authority resource according to the access authority resource priority rule and the parsing rule corresponding to the rule parsing identifier, and obtain an access rule set for the resource.

13. The device according to claim 11, characterized in that the receiving subunit is also specifically used for:

Receive a request for setting access rights to the resource, the setting request also includes dividing multiple access rights resources into blocks, so that the multiple access rights resources include a parent block of access rights resources and a block corresponding to the parent block. Multiple sub-blocks, the parent block and multiple sub-blocks corresponding to the parent block include corresponding rule parsing identifiers, and the acquisition unit further includes:

The fourth acquisition unit is configured to first parse the access rights resources according to the parsing rules corresponding to the parent block rule parsing identification, and then parse the access rights resources corresponding to the sub-blocks according to the rule parsing identifications corresponding to the plurality of sub-blocks. Access permission resources are parsed to obtain the access rule set for the resource.

14. The device according to claim 13, characterized in that the receiving subunit is also specifically used for:

Receive a setting request for access rights to the resource. The setting request also includes priority rules for the parent block and the child block. The acquisition unit also includes a fifth acquisition unit for first according to the rules of the parent block. Parse the access permission resources corresponding to the parsing identification and priority rules, and then parse the access permission resources corresponding to the sub-blocks according to the parsing identification and priority rules corresponding to the multiple sub-blocks, and obtain A set of access rules for the resource in question.

15. The device according to any one of claims 10 to 14, characterized in that the receiving subunit is also specifically used for:

Receive a setting request for access rights to resources, the setting request includes at least two indirect access rights resource identifiers, and the acquisition unit further includes a sixth acquisition unit for acquiring access rights resources based on the indirect access rights resource identifiers. Address, read the access permission resource according to the access permission resource address;

16. The device according to claim 9, wherein the response unit is specifically configured to: if the access device matches the access subject set, and the access operation indicated by the resource access operation indication is the same as the access subject set. If the access operation set of the access device matches, the access device is allowed to access the resource;

If the access device does not match the access subject set, or the access device does not match the access subject set, If the subject set matches but the resource access operation does not match the access operation set, then the access device is denied access to the resource;

17. The device according to any one of claims 9-17, characterized in that the device includes: an M2M terminal, an M2M platform and an M2M gateway.