WO2017008640A1

WO2017008640A1 - Method for issuing access token and related device

Info

Publication number: WO2017008640A1
Application number: PCT/CN2016/087973
Authority: WO
Inventors: 周巍
Original assignee: 电信科学技术研究院
Priority date: 2015-07-16
Filing date: 2016-06-30
Publication date: 2017-01-19
Also published as: CN106358246B; CN106358246A

Abstract

A method for issuing an access token and a related device are used for giving a specific authorization mechanism in a oneM2M system. The method comprises: receiving an access token resource creating request, transmitted by an initiating entity, for an access token issuing resource under an access token root resource, and the access token resource creating request carrying an identify of the initiating entity and authority description information of the requested access token; according to an access token authorization policy and the authority description information, generating an access token for the initiating entity, the access token carrying at least authorization information, and creating the access token resource of the generated access token under the access token root resource; transmitting the access token or address information of the access token resource to the initiating entity; and the access token root resource being a common resource under an CSE root resource, the access token issuing resource being a virtual resource under the access token root resource, and the access token resource being a common resource under the access token root resource.

Description

Access token issuance method and related equipment

The present application claims priority to Chinese Patent Application No. 201510419740.3, entitled "Access Token Issuance Method and Related Equipment", filed on July 16, 2015, the entire contents of which are incorporated herein by reference. In this application.

Technical field

The present invention relates to the field of communications technologies, and in particular, to an access token issuance method and related device.

Background technique

OneM2M, the Internet of Things standardization organization, is dedicated to developing technical specifications for constructing a common Machine-To-Machine (M2M) Service Layer.

The oneM2M functional architecture is shown in Figure 1. Three basic entities are defined:

First, an Application Entity (AE) is located at the application layer, and the entity can implement an M2M application service logic. An application service logic can reside in multiple M2M nodes, or multiple execution instances in a single node. Each execution instance of the application service logic is referred to as an application entity, and each application entity is identified by a unique AE identity (AE-ID).

For example, a fleet tracking application instance, a remote blood glucose monitoring application instance, a remote power metering instance, or a control application instance are all application entities.

Second, the Common Service Entity (CSE), a public service entity consists of a set of common service functions in the M2M environment. The public service function is exposed to other entities through the reference point Mca and the reference point Mcc. The reference point Mcn is used to access the underlying network service entity. Each public service entity is identified by a unique CSE-ID.

Third, the Underlying Network Services Entity (NSE), an underlying network service entity provides underlying network services to multiple CSEs, such as providing device management, location services, and device triggering services.

oneM2M implements service layer resource sharing and interaction through operations on standardized resource trees. The oneM2M resource tree exists in the CSE defined by the oneM2M system.

According to the definition of the functional architecture in oneM2M TS-0001, the form of oneM2M resource tree is shown in Figure 2. Among them, CSEBase1 represents a CSE root resource <CSEBase>, CSE1 represents a resource <remoteCSE>, APP1 represents a resource <AE>, CONT1 and CONT2 respectively represent a resource <container>, and ACP1 and ACP2 respectively represent a resource <accessControlPolice>. For oneM2M resources, operations such as Create (C, C, Retrieve, R), Update (U), and Delete (D) can be performed.

The resource related to the authorization defined by oneM2M is the access control policy resource <accessControlPolicy>, which defines an Access Control Policy (ACP), and the <accessControlPolicy> resource is uniquely identified by the resource identity (ID). Other resources specify the applicable access control policy through the accessControlPolicyIDs attribute in the resource.

The service subscription information in the oneM2M system is stored in the <m2mServiceSubscriptionProfile> resource. The serviceRoles attribute of the resource stores a list of serviceable service IDs (Service Role IDs), and the AE obtains the corresponding contract service by acquiring the contractable service role. It is the authority to manage the M2M Node (M2M Node) described in the <serviceSubscribedNode> sub-resource in the <m2mServiceSubscriptionProfile> resource.

OneM2M defines three resource types:

Normal Resource, with specific resource structure and resource attributes;

A virtual resource (Virtual Resource) does not have a specific resource structure and resource attributes, and is mainly used to trigger a specific process;

Announced Resource has a specific resource structure and resource attributes. This resource is a copy of some content in common resources on other entities. The main purpose is to facilitate resource discovery.

At present, only the service subscription information and the authorization related resources are given in the oneM2M system, and no specific authorization mechanism is given.

Summary of the invention

An embodiment of the present invention provides an access token issuance method and related device, which are used to provide a specific authorization mechanism in a oneM2M system.

The specific technical solutions provided by the embodiments of the present invention are as follows:

In a first aspect, an access token issuance method is provided, including:

Receiving an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the requested access token Description;

Generating an access token for the initiating entity according to the access token authorization policy and the rights description information, where the access token carries at least authorization information, and the generated access token is created under the access token root resource. Accessing a token resource, where the access token is stored in the access token resource;

Sending the access token or address information of the access token resource to the initiating entity;

The access token root resource is a common resource under the CSE root resource of the public service entity, and the access token is a virtual resource under the access token root resource, where the access token resource is Access common resources under the token root resource.

In an implementation, the access token root resource has a common attribute of a common resource and a public attribute of the specified access control policy, and the access control policy specified by the public attribute indicates that the access token root resource and the access order are allowed to be accessed. The entity of the virtual resource under the root resource.

In an implementation, after receiving an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, the method further includes:

And determining, according to the public attribute of the specified access control policy of the access token root resource, that the initiating entity is allowed to access the virtual resource under the access token root resource.

In an implementation, the access token resource has a common attribute of a common resource and an expired time attribute, an issuer attribute, a holder attribute, and a token attribute, where the expired time attribute is used to specify a validity period of the access token resource. The issuer attribute is used to indicate an entity that generates the access token, The holder attribute is used to indicate an entity requesting and obtaining the access token, and the token attribute is used to store the access token.

The method further includes: before generating an access token for the initiating entity, according to the access token authorization policy and the rights description information, the method further includes:

The access token authorization policy is obtained from an access token authorization policy entity.

In an implementation, the access token further includes authentication information, where the authentication information includes an entity identifier that generates the access token, an identifier of the initiating entity, and an expiration time;

The authorization information of the access token includes a service role and/or an access control policy of the originating entity.

In an implementation, generating an access token for the initiating entity according to the access token authorization policy and the permission description information, including:

Generating an access token plaintext according to the access token authorization policy and the permission description information;

Transmitting the generated access token clear text to the security function entity, and the security function entity digitally signs and/or encrypts the access token plaintext to obtain the access token and returns;

Receiving the access token returned by the security function entity.

In a second aspect, an access token issuance method is provided, including:

And sending, to the authorized entity, an access token resource creation request for the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the permission description information of the requested access token;

Receiving an access token returned by the authorized entity, or receiving address information of an access token resource created by the authorized entity under the access token root resource, where the access token resource stores an access token, where The access token carries at least the authorization information;

The access token root resource is a common resource under the CSE root resource of the public service entity, and the access token is a virtual resource under the access token root resource, where the access token resource is the access A common resource under the token root resource.

In an implementation, the access token root resource has a common attribute of a common resource and a public attribute specifying an access control policy, and the access control policy specified by the public attribute indicates that access to the An entity that accesses the token root resource and the virtual resource under the access token root resource.

In an implementation, the access token resource has a common attribute of a common resource and an expired time attribute, an issuer attribute, a holder attribute, and a token attribute, where the expired time attribute is used to specify a validity period of the access token resource. The issuer attribute is used to indicate an entity that generates the access token, the holder attribute is used to indicate an entity that requests and obtains the access token, and the token attribute is used to store the access token .

In an implementation, after receiving the address information of the access token resource created by the authorized entity under the access token root resource, the method further includes:

Obtaining the access token according to the address information.

In an implementation, the access token further includes authentication information, where the authentication information includes an entity identifier that generates the access token, an entity identifier that requests and holds the access token, and an expiration time;

In implementation, the method further includes:

Sending a resource access request, where the resource access request carries the access token.

In a third aspect, an authorized entity is provided, including:

a receiving module, configured to receive an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier and the request of the initiating entity Access permission description information of the access token;

a processing module, configured to generate, according to the access token authorization policy and the rights description information, an access token, where the access token carries at least authorization information, and is generated under the access token root resource. Access token resource of the access token, the access token is stored in the access token resource;

a sending module, configured to send the access token or address information of the access token resource to the initiating entity;

The access token root resource is a common resource under the CSE root resource of the public service entity, and the access token is a virtual resource under the access token root resource, where the access token is The resource is a common resource under the access token root resource.

In implementation, the processing module is further configured to:

Before generating the access token for the initiating entity, determining, according to the public attribute of the specified access control policy of the access token root resource, that the initiating entity is allowed to access the virtual resource under the access token root resource.

In an implementation, the processing module is further configured to: obtain the access token authorization policy from an access token authorization policy entity.

In implementation, the processing module is specifically configured to:

The sending module is further configured to:

The receiving module is further configured to:

Receiving the access token returned by the security function entity.

In a fourth aspect, an originating entity is provided, including:

a sending module, configured to send, to the authorized entity, an access token resource creation request for the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the requested access token Permission description information;

a receiving module, configured to receive an access token returned by the authorized entity, or receive address information of an access token resource created by the authorized entity under the access token root resource, where the access token resource is saved An access token, the access token carrying at least authorization information;

In the implementation, the acquisition module is also included for:

After the receiving module receives the address information of the access token resource created by the authorized entity under the access token root resource, the access token is obtained according to the address information.

In implementation, the sending module is further configured to:

In a fifth aspect, an authorization entity is provided, including: a processor, a transceiver, and a memory;

The processor is configured to read a program in the memory and perform the following process:

Receiving, by the transceiver, an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, where the access token resource creation request carries the permission description information of the requested access token;

And transmitting, by the transceiver, the address information of the access token or the access token resource to the initiating entity.

In a sixth aspect, an originating entity is provided, including: a processor, a transceiver, and a memory;

Sending, by the transceiver, an access token resource creation request for the access token issuing resource under the access token root resource to the authorized entity, where the access token resource creation request carries the permission description information of the requested access token;

Receiving, by the transceiver, an access token returned by the authorized entity, or receiving address information of an access token resource created by the authorized entity under the access token root resource, where the access token resource has an access order Card, the access token carries at least authorization information.

Based on the foregoing technical solution, in the embodiment of the present invention, an access token root resource whose resource type is a common resource is defined under the CSE root resource, and an access token issuing resource whose resource type is a virtual resource is defined under the access token root resource. And defining an access token resource whose resource type is a common resource under the access token root resource, and defining an access token resource creation operation for the access token issuing resource triggers an access token issuance process, so that the receiving entity pair is received Accessing an access token resource creation request of the access token issuing resource under the token root resource, triggering an access token issuance process, and generating an access token for the initiating entity according to the access token authorization policy and the permission description information, And the access token resource is created, and the mechanism for authorizing by the access token is implemented in the oneM2M system.

DRAWINGS

1 is a schematic diagram of a oneM2M functional architecture in the prior art;

2 is a schematic structural diagram of a oneM2M resource tree in the prior art;

3 is a schematic diagram of relationships between three resources defined in an embodiment of the present invention;

4 is a schematic diagram of a basic structure of an <accessToken> resource according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a process for an authorization entity to issue an access token according to an embodiment of the present invention; FIG.

6 is a schematic diagram of a process for an originating entity to request an access token according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of a process of using an access token by a managed entity according to an embodiment of the present invention; FIG.

FIG. 8 is a schematic diagram of a basic process of issuing and using an access token according to an embodiment of the present invention; FIG.

FIG. 9 is a schematic diagram of a specific implementation process of issuing and using an access token according to an embodiment of the present invention; FIG.

FIG. 10 is a schematic diagram of another specific implementation process of issuing and using an access token according to an embodiment of the present invention; FIG.

FIG. 11 is a schematic structural diagram of an authorization entity according to an embodiment of the present invention;

FIG. 12 is a schematic structural diagram of another authorized entity according to an embodiment of the present invention;

FIG. 13 is a schematic structural diagram of an initiating entity according to an embodiment of the present invention;

FIG. 14 is a schematic structural diagram of another initiating entity according to an embodiment of the present invention.

detailed description

The present invention will be further described in detail with reference to the accompanying drawings, in which FIG. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

In the embodiment of the present invention, three oneM2M resources are defined to implement an authorization access token (Access Token).

The three oneM2M resources defined are: access token root resource <accessTokens>, access token issuance resource <accessTokenIssuing>, and access token resource <accessToken>. The relationship between the three is shown in Figure 3.

The <accessTokens> resource is defined as a sub-resource of the CSE root resource <CSEBase>, the resource type is oneM2M common resource, and the <CSEBase> resource may have zero or more <accessTokens> resources.

The <accessTokens> resource has a common attribute (Universal Attribute) contained in the oneM2M common resource, and has a Common Attribute of the specified access control policy: accessControlPolicyIDs, and the access control of the virtual resource under the <accessTokens> resource is controlled by the The public attribute determines that the AE entity and the CSE entity that allow access to the <accessTokens> resource and the virtual resource under it are defined in the access control policy specified by the public attribute.

The <accessTokenIssuing> resource is a sub-resource under the <accessTokens> resource, and an <accessTokens> resource has an <accessTokenIssuing> resource. The resource type of the <accessTokenIssuing> resource is oneM2M virtual resource, so there is no resource attribute and no child resource. The oneM2M virtual resource is mainly used to trigger a process. A Create Request for the <accessTokenIssuing> resource will trigger an access token issuance process.

The access control of the <accessTokenIssuing> resource is determined by the access control policy specified by the accessControlPolicyIDs attribute of its parent resource <accessTokens>. The accessControlPolicyIDs attribute specifies the AE entity and CSE entity that can access the <accessTokenIssuing> resource, that is, apply for an access token.

The <accessToken> resource is a sub-resource under the <accessTokens> resource, and an <accessTokens> resource can contain zero or more <accessToken> resources. Each <accessToken> represents an access token (Access Token) issued by an authorized entity, and its resource type is oneM2M Normal Resource.

The basic structure of <accessToken> is shown in Figure 4. In addition to the Universal Attribute common to oneM2M common resources, the <accessToken> resource also contains the Common Attribute: expirationTime, including The newly defined 3 resource attributes. expirationTime specifies the validity period of the resource, which is the same as the validity period of the access token. The three newly defined resource attributes are:

Issuer: The issuer of the access token, specifically the CSE identifier (CSE-ID) that generated the access token.

Holder: The holder of the access token, specifically the AE identifier (AE-ID) or CES identifier (CSE-ID) that requests and holds the access token.

Token: Stores the access token issued.

The embodiments of the present invention are defined as follows:

Originator Entity: The owner of the access token in the oneM2M system, specifically the AE entity or CSE entity in the oneM2M system that needs to access the resources in the managed entity;

Authorization Entity (Authority Entity): is the issuer of the access token in the oneM2M system, specifically the CSE entity with the access token issuing capability in the oneM2M system;

Hosting Entity: A user accessing a token in the oneM2M system, specifically a CSE entity providing resource access in the oneM2M system, which provides a resource access service for the initiating entity according to the access right described in the access token;

Access Token Authorization Policy Entity: Provides an access token authorization policy for the authorized entity, and the access token authorization policy is used to determine the permission to write the access token;

Security Function Entity: The access token plaintext can be digitally signed and/or encrypted to generate an access token, or the access token can be decrypted and/or the digital signature verified to obtain the access token plaintext.

The access token in the embodiment of the present invention is defined as: carrying the authorization information applied in the oneM2M environment, and mainly includes a service role and/or an access control policy. The service role carried in the access token is used for Role Based Access Control (RBAC); and is also used to carry authentication information, where the authentication information includes a CSE identifier (ie, an issuer identifier) that generates an access token. , the entity ID that requested and holds the access token (the holder's identity) and the timeout period.

If the authorization information of the access token carries only the role, the escrow entity evaluates the resource access request of the initiating entity by using the role carried in the access token and the role-based access control policy stored locally by the escrow entity to determine whether to agree to the resource of the initiating entity. Access request.

If the authorization information of the access token carries only the access control policy, the access control policy is access. The token holder's private authorization policy, the escrow entity uses the access control policy carried in the access token to evaluate the resource access request of the originating entity to determine whether to agree to the resource access request.

If the authorization information of the access token carries the role and the access control policy, the escrow entity uses the role and the access control policy carried in the access token to evaluate the resource access request of the initiating entity to determine whether to agree to the resource access request of the initiating entity.

It should be noted that the specific format of the access token is not limited in the embodiment of the present invention. The access token can be correctly used by the format of the access token between the authorized entity, the initiating entity and the escrow entity. The scope of protection of the present invention is not limited by the specific format of the access token.

Based on the above definition, in the embodiment of the present invention, as shown in FIG. 5, the detailed method for issuing an access token by an authorized entity is as follows:

Step 501: Receive an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the requested access order The license description information of the card.

The access token root resource is a common resource under the CSE root resource, and the access token is issued as a virtual resource under the access token root resource.

In an implementation, since the access token root resource has a common attribute of a common resource and a public attribute of the specified access control policy, the access control policy specified by the public attribute indicates that the access token root resource and the virtual resource under the access token root resource are allowed to be accessed. Entity, therefore, after the receiving entity sends an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, before the generating the access token for the initiating entity, according to the designation of the access token root resource The public attribute of the access control policy determines that the initiating entity is allowed to access the virtual resource under the access token root resource.

A resource creation operation that issues a resource for an access token triggers an access token issuance process.

Step 502: Generate an access token for the initiating entity according to the access token authorization policy and the entitlement description information carried in the access token resource creation request, where the access token carries at least the authorization information, and is created under the access token root resource. The access token resource of the generated access token, and the access token is stored in the access token resource.

The access token resource has a common attribute of the common resource and an expired time attribute, and is issued. Owner attribute, holder attribute and token attribute, the expired time attribute is used to specify the validity period of the access token resource, and the issuer attribute is used to indicate the entity that generated the access token, that is, the identifier of the authorized entity, and the holder attribute is used for The entity that indicates the request and obtains the access token, that is, the identity of the originating entity, and the token attribute is used to store the access token.

The access token generated by the authorized entity and the access token stored by the token attribute include authentication information in addition to the authorization information. The authentication information includes an identifier of the authorized entity that generates the access token (ie, the issuer identifier), an identifier of the originating entity that requests and holds the access token (the holder identifier), and an expiration time, and the expiration time defines the access order. The validity period of the card. The authorization information includes a service role of the initiating entity and/or an access control policy.

Optionally, the access token authorization policy is saved in the access token authorization policy entity; the authorization entity obtains the access order from the access token authorization policy entity before generating the access token for the initiating entity according to the access token authorization policy and the rights description information. Card authorization strategy.

In a specific implementation, the access token authorization policy entity stores the correspondence between the access token authorization policy and the initiating entity and the authorized entity. For example, the access token authorization policy entity includes each authorized entity resource tree, which respectively corresponds to different authorized entities. The number of authorized entity resources includes access token authorization policy resources of different initiating entities.

The privilege description information is used to describe the privilege of the requesting entity, and the privilege may be the requested service role, or the requested access control policy, or the service role and the access control policy.

In the implementation, the service role issued to the initiating entity in the authorization information is: the service role requested in the authorization description information and the access token authorization policy allows the service role issued to the initiating entity. The access control policy issued to the initiating entity in the authorization information is: the authorization request information in the authorization description information and the access token authorization policy allows the access control policy corresponding to the authority used by the initiating entity.

It should be noted that the access token authorization policy is used to determine whether to issue an access token for the initiating entity, and to determine the permission to write the access token, that is, the authority issued to the initiator of the access token and the holder, the specific policy Those skilled in the art can apply the existing authorization policies to the present invention in combination with the specific application, and the scope of protection of the present invention is not limited thereto.

In the implementation, the authorization entity determines that the access token is not allowed to be issued for the initiating entity according to the access token authorization policy and the rights description information, and does not perform step 503 to return an error message to the initiating entity.

Step 503: Send the address information of the access token or the access token resource to the initiating entity.

The access token resource is a common resource under the access token root resource.

In an optional implementation manner, the authorization entity generates an access token plaintext according to the access token authorization policy and the rights description information, and sends the generated access token clear text to the security function entity, where the security function entity digitally signs the access token. And/or encrypting to obtain an access token and returning; the authorized entity receives the access token returned by the security function entity, and sends the access token to the initiating entity.

It should be noted that the digital signature algorithm and the encryption algorithm specifically used by the security function entity are not limited, and existing digital signature algorithms and encryption algorithms can be used in the present invention, and the specific digital signature algorithm and encryption algorithm are not limited, and the present invention The scope of protection is not subject to this limitation.

Based on the above definition, in the embodiment of the present invention, as shown in FIG. 6, the detailed method for the initiating entity to request an access token is as follows:

Step 601: Send an access token resource creation request for the access token issuing resource under the access token root resource to the authorized entity, where the access token resource creation request carries the identifier of the initiating entity and the permission description information of the requested access token. .

The access token root resource has a common attribute of a common resource and a public attribute of the specified access control policy, and the access control policy specified by the public attribute indicates an entity that allows access to the access token root resource and the virtual resource under the access token root resource. .

Step 602: Receive an access token returned by the authorized entity, or receive the address information of the access token resource created by the authorized entity under the access token root resource, where the access token is stored with an access token, and the access token carries at least Authorization information.

The access token root resource is a common resource under the CSE root resource, and the access token is issued as a virtual resource under the access token root resource, and the access token resource is an ordinary under the access token root resource. Resources.

The access token resource has a common attribute of the common resource and an expired time attribute, an issuer attribute, a holder attribute, and a token attribute. The expired time attribute is used to specify the validity period of the access token resource, and the issuer attribute is used to indicate the generation of the access order. The entity of the card, the holder attribute is used to indicate the entity requesting and obtaining the access token, and the token attribute is used to store the access token.

In the implementation, if the initiating entity receives the address information of the access token resource created by the authorized entity under the access token root resource, the initiating entity obtains the access token according to the address information.

The access token carries the authentication information in addition to the authorization information, and the authentication information includes an entity identifier for generating an access token, an entity identifier for requesting and holding the access token, and an expiration time, and the authorization information includes a service role of the initiating entity. And/or access control policies.

In an implementation, after the obtaining entity obtains the access token, the sending entity sends a resource access request to the authorized entity, where the resource access request carries the access token.

Based on the same inventive concept, in the embodiment of the present invention, as shown in FIG. 7, the detailed method of using the access token by the escrow entity is as follows:

Step 701: Receive a resource access request sent by the initiating entity, where the resource access request carries an access token.

The access token carries at least the authorization information, and the authorization information includes a service role and/or an access control policy of the initiating entity.

In the implementation, the access token carries the authentication information in addition to the authorization information, and the authentication information includes an entity identifier that generates an access token, an entity identifier that requests and holds the access token, and an expiration time.

In the implementation, after the escrow entity obtains the access token in the resource access request, it determines whether the access token is valid, as follows:

If the preset condition is met, it is determined that the access token is valid; otherwise, it is determined that the access token is invalid; Preset conditions can include the following conditions:

If it is determined that the entity identifier of the generated access token carried in the access token is the same as the preset CSE identifier; and/or,

The entity identifier of the request carried in the access token and holding the access token is the same as the identity of the originating entity; and/or,

If the access token does not exceed the expiration time carried in the access token, it is determined that the access token is valid.

In the implementation, if the escrow entity determines that the access token is invalid, step 702 is no longer performed, and an error message is returned to the initiating entity.

Step 702: Determine, according to the authorization information in the access token, that the resource access request of the initiating entity is within the authorization scope, and execute the resource access request of the initiating entity.

In the implementation, if the authorization information includes only the service role, the locally saved service role-based access control policy is obtained according to the service role in the access token, and the resource access request of the initiating entity is determined according to the service role-based access control policy. If the authorization information includes only the access control policy, the resource access request of the initiating entity is determined according to the access control policy in the access token; if the authorization information includes the service role and the access control policy, according to the access token The service role and access control policy in the determination determines that the resource access request of the initiating entity is within the scope of authorization.

In an optional implementation manner, after obtaining the access token in the resource access request, the escrow entity sends the access token to the security authentication entity, and the security authentication entity decrypts and/or digitally signs the access token. The authentication obtains the plaintext of the access token and returns; the escrow entity receives the plaintext of the access token returned by the security authentication entity, obtains the authorization information in the plaintext of the access token, and determines whether the resource access request of the originating entity is within the authorized scope according to the obtained authorization information. .

In the above embodiment, the authorized entity and the managed entity may be deployed in the same entity device or in different physical devices.

In the above embodiment, before the communication between the initiating entity and the authorized entity, before the communication between the initiating entity and the managed entity, the security association is established by mutual authentication by using the method provided by oneM2M to ensure communication between the two entities communicating with each other. Integrity and confidentiality, specific through two-way recognition For the way to establish a security association, see the rules of oneM2M, which will not be detailed here.

The basic process of the issuance and use of the access tokens in the above embodiments can be seen in FIG. 8. For the specific process, refer to the description of the foregoing embodiments, which is not repeated here.

The access token issuance and use process provided by the present invention is exemplified by two specific embodiments.

In a first specific embodiment, an oneM2M Infrastructure Node (IN-CSE) as an Authorized Entity issues an access token containing a Service Role to an Initiating Entity (AE-1); the Initiating Entity (AE-1) utilizes the The access token accesses the device management resource in the managed entity (CSE-1); the node where CSE-1 is located is Node-1.

It is assumed in this particular embodiment that the IN-CSE accessible security function entity and the CSE-1 accessible security function entity have a symmetric key Ks for access token encryption and decryption; the IN-CSE accessible security function entity There is a private key Kprv for signing the access token plaintext; the CSE-1 accessible security function entity has a public key certificate INcert for verifying the IN-CSE digital signature, which contains the public key Kpub that matches Kprv.

And, it is assumed that the application entity AE-1 of the oneM2M application service provider is registered to the infrastructure node IN-CSE of the oneM2M service provider. An <accessTokens-1> resource responsible for issuing an access token is created under the root resource <CSEBase> of the IN-CSE resource tree; resources such as <m2mServiceSubscriptionProfile>, <serviceSubscribedNode>, and <serviceSubscribedAppRule> are defined in the IN-CSE resource tree. , which describes the role and managed M2M Node (M2M Node) that the application service provider's application entity can have.

As shown in Figure 9, the process of issuing and using an access token is as follows:

Step 901: AE-1 and IN-CSE establish a security association by mutual authentication;

Step 902: The AE-1 sends an <accessToken> resource creation request to the IN-CSE to the sub-resource <accessTokenIssuing> of the <accessTokens-1> resource under the IN-CSE resource tree, where the request requires the node Node where the CSE-1 is located. -1 performs the device diagnostic function, that is, AE-1 wants to obtain an access token containing the "Device Diagnostics and Management" role;

Step 903: After the IN-CSE receives the request of the AE-1, the access token activated by the request is created. The process will do the following:

1. Check the access control policy associated with the <accessTokenIssuing> resource to determine whether AE-1 has the authority to create the <accessToken> resource, and if so, proceed to the next step;

2. Obtain the required access token authorization policy from the IN-CSE resource tree as the access token authorization policy entity, that is, resources such as <m2mServiceSubscriptionProfile>, <serviceSubscribedNode>, and <serviceSubscribedAppRule> related to AE-1;

3. Check the serviceRoles attribute in the <m2mServiceSubscriptionProfile> resource belonging to the application service provider to determine whether it has the requested Device Diagnostics and Management role, and if so, proceed to the next step;

4. Check the <serviceSubscribedNode> sub-resource under the <m2mServiceSubscriptionProfile> resource to determine whether the application service provider has the management authority for the node Node-1, that is, whether the value of the node-ID attribute of a <serviceSubscribedNode> sub-resource is Node-1, if any, proceed to the next step;

5. Check the <serviceSubscribedAppRule> resource specified by the ruleLinks attribute of the <serviceSubscribedNode> resource in the previous step to determine whether the AE-1 can be registered to the node Node-1, that is, whether the AE-1 is in the <serviceSubscribedAppRule> resource allowedAEs. In the AE list of attributes, if any, proceed to the next step;

6. Generate an access token plaintext containing the "Device Diagnostics and Management" role and set the validity period of the access token;

7. The security function entity is required to digitally sign the access token plaintext by using the private key Kprv, and then encrypt the access token plaintext and the signature result by using the symmetric key Ks to generate the access token AE-Token-1.

Step 904: The IN-CSE sends the generated access token AE-Token-1 to the AE-1.

Step 905: AE-1 and CSE-1 establish a security association by mutual authentication;

Step 906: The AE-1 sends a device diagnostic request to the CSE-1 included in the Node-1, where the request includes an access token AE-Token-1;

Step 907: CSE-1 receives a device diagnosis request from AE-1, and requests a device diagnosis from the device Extract the access token AE-Token-1, and then do the following:

1. The security function entity is required to decrypt the access token by using Ks, and then use the public key Kpub in the INCR to verify the digital signature of the access token. If it is correct, proceed to the next step;

2. Check the validity period in the access token to determine whether the token has expired. If it is valid, proceed to the next step;

3. Extract the roles contained in the token and use the role-based access control policy to evaluate whether to approve the device diagnostic request of AE-1, and if yes, proceed to the next step;

4. Perform the device diagnostic function required by AE-1.

Step 908: CSE-1 returns the execution result to AE-1.

In the second embodiment, as shown in FIG. 10, in this specific embodiment, the authorized entity and the escrow entity are the same entity, that is, CSE-1. In this specific embodiment, the access token is issued and used with the first specific The process of the embodiment is similar except that:

Because the authorized entity and the managed entity are the same entity, the security mechanism for protecting the access token in the security function entity can adopt a simple symmetric key mechanism, that is, the integrity and confidentiality protection of the access token is implemented by using the symmetric key.

Also, since the type of CSE-1 is not an IN-CSE, that is, an infrastructure node, nor a node trusted and authorized by the infrastructure node, CSE-1 cannot issue an access token containing a Service Role.

Based on the same inventive concept, an authorization entity is provided in the embodiment of the present invention. For the specific implementation of the authorization entity, refer to the description of the method part. The details are not described here. As shown in FIG. 11, the authorization entity mainly includes:

The receiving module 1101 is configured to receive an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the requested access token. Permission description information;

The processing module 1102 is configured to generate an access token for the initiating entity according to the access token authorization policy and the rights description information, where the access token carries at least the authorization information, and the access token of the generated access token is created under the access token root resource. Card resource, an access token is stored in the access token resource;

The sending module 1103 is configured to send the address information of the access token or the access token resource to the initiating entity.

The access token root resource is a common resource under the CSE root resource, and the access token is a virtual resource under the access token root resource, and the access token resource is an ordinary resource under the access token root resource.

In an implementation, the access token root resource has a common attribute of a common resource and a public attribute of the specified access control policy, and the access control policy specified by the public attribute indicates that the access token root resource and the virtual resource under the access token root resource are allowed to access. entity.

In implementation, the processing module 1102 is further configured to:

In the implementation, the access token resource has a common attribute of the common resource and an expired time attribute, an issuer attribute, a holder attribute, and a token attribute, and the expired time attribute is used to specify the validity period of the access token resource, and the issuer attribute is used to indicate The entity that generates the access token, the holder attribute is used to indicate the entity that requested and obtained the access token, and the token attribute is used to store the access token.

In an implementation, the processing module 1102 is further configured to: obtain an access token authorization policy from an access token authorization policy entity.

In the implementation, the access token further carries the authentication information, where the authentication information includes an entity identifier that generates an access token, an identifier of the initiating entity, and an expiration time;

The authorization information of the access token includes the service role of the originating entity and/or the access control policy.

In implementation, the processing module 1102 is specifically configured to:

Generate an access token plaintext according to the access token authorization policy and the permission description information;

The sending module 1103 is also used to:

Sending the generated access token clear text to the security function entity, and the security function entity digitally signs and/or encrypts the access token plaintext to obtain the access token and returns;

The receiving module 1101 is further configured to:

Receive the access token returned by the security function entity.

In implementation, the authorized entity is a CSE entity.

Based on the same inventive concept, an authorization entity is provided in the embodiment of the present invention. For the specific implementation of the authorization entity, refer to the description of the method part. The repeated description is not repeated. As shown in FIG. 12, the authorization entity mainly includes processing. The device 1201 and the transceiver 1203 are configured to receive and transmit data under the control of the processor 1201, the preset program is saved in the memory 1202, and the processor 1201 is configured to read the program stored in the memory according to the program. The program performs the following process:

Receiving, by the transceiver 1203, an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the requested access token. Description;

An access token is generated for the initiating entity according to the access token authorization policy and the rights description information, and the access token carries at least the authorization information, and the access token resource of the generated access token is created under the access token root resource, and the access token is used. An access token is stored in the resource;

The address information of the access token or the access token resource is transmitted by the transceiver 1203 to the initiating entity.

In an implementation, before generating the access token for the initiating entity, the processor 1201 determines, according to the public attribute of the specified access control policy of the access token root resource, that the initiating entity is allowed to access the virtual resource under the access token root resource.

In implementation, the processor 1201 obtains an access token authorization policy from the access token authorization policy entity.

In an implementation, the processor 1201 generates an access token plaintext according to the access token authorization policy and the rights description information, and sends the generated access token plaintext to the security function entity by the transceiver 1203, and the security function entity performs the access token plaintext. The digital signature and/or encryption results in an access token and returns; the transceiver 1203 receives the access token returned by the security function entity.

In implementation, the authorized entity is a CSE entity.

The bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by the processor and various circuits of memory represented by the memory. The bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein. The bus interface provides an interface. The transceiver can be a plurality of components, including a transmitter and a transceiver, providing means for communicating with various other devices on a transmission medium. The processor is responsible for managing the bus architecture and the usual processing, and the memory can store the data that the processor uses when performing operations.

Based on the same inventive concept, an embodiment of the present invention provides an initiating entity. For the specific implementation of the initiating entity, refer to the description of the method part. As shown in FIG. 13 , the initiating entity mainly includes:

The sending module 1301 is configured to send, to the authorized entity, an access token resource creation request for the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the requested access token. Permission description information;

The receiving module 1302 is configured to receive an access token returned by the authorized entity, or receive address information of the access token resource created by the authorized entity under the access token root resource, where the access token includes an access token and an access token. Carry at least authorization information;

The access token root resource is a common resource under the CSE root resource of the public service entity, and the access token is issued as a virtual resource under the access token root resource, and the access token resource is an ordinary resource under the access token root resource.

The access token resource has a common attribute of the common resource and an expired time attribute, an issuer attribute, a holder attribute, and a token attribute, and the expired time attribute is used to specify the validity period of the access token resource, and the issuer attribute is used to indicate the generation. The entity that accesses the token, the holder attribute is used to indicate the entity that requested and obtained the access token, and the token attribute is used to store the access token.

In the implementation, the obtaining module 1303 is further included for:

After receiving the address information of the access token resource created by the authorized entity under the access token root resource, the receiving module 1302 obtains the access token according to the address information.

The access token further carries the authentication information, where the authentication information includes an entity identifier that generates an access token, an entity identifier that requests and holds the access token, and an expiration time;

In implementation, the sending module 1301 is further configured to:

A resource access request is sent, and the resource access request carries an access token.

In implementation, the originating entity is an AE entity or a CSE entity.

Based on the same inventive concept, the embodiment of the present invention further provides another initiating entity. For the specific implementation of the initiating entity, refer to the description of the method part. The repeated description is not repeated. As shown in FIG. 14 , the initiating entity mainly includes processing. The device 1401, the memory 1402 and the transceiver 1403 are configured to receive and transmit data under the control of the processor 1401, the preset program is saved in the memory 1402, and the processor 1401 is configured to read the program stored in the memory according to the program. The program performs the following process:

Instructing the transceiver 1403 to send an access token resource creation request to the authorization entity for the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the permission description of the requested access token. information;

Receiving, by the transceiver 1403, an access token returned by the authorized entity, or receiving address information of the access token resource created by the authorized entity under the access token root resource, where the access token is stored with an access token, and the access token is at least Carrying authorization information;

In an implementation, after receiving the address information of the access token resource created by the authorized entity under the access token root resource by the transceiver 1403, the processor 1401 obtains the access token according to the address information.

In an implementation, the processor 1401 instructs the transceiver 1403 to send a resource access request, where the resource access request carries an access token.

In implementation, the originating entity is an AE entity or a CSE entity.

Based on the foregoing technical solution, in the embodiment of the present invention, by defining an access token root resource whose resource type is a common resource under the CSE root resource, the resource type is defined as virtual under the access token root resource. The access token of the resource issues the resource, and the access token resource whose resource type is a common resource is defined under the access token root resource, and the access token resource creation operation that defines the resource for the access token is triggered to trigger an access token issuance process. Therefore, the access token resource creation request of the originating entity to the access token issuing resource under the access token root resource is received, the access token issuance process is triggered, and the initiating entity is generated according to the access token authorization policy and the permission description information. The token is accessed and an access token resource is created, and the mechanism for authorization by the access token is implemented in the oneM2M system.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in a block or blocks of a flow or a flow and/or a block diagram of a flowchart Step.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims

An access token issuance method, which is characterized by comprising:

Receiving an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the requested access token Description;

Generating an access token for the initiating entity according to the access token authorization policy and the rights description information, where the access token carries at least authorization information, and the generated access token is created under the access token root resource. Accessing a token resource, where the access token is stored in the access token resource;

Sending the access token or address information of the access token resource to the initiating entity;

The access token root resource is a common resource under the CSE root resource of the public service entity, and the access token is a virtual resource under the access token root resource, where the access token resource is Access common resources under the token root resource.
The method of claim 1, wherein the access token root resource has a common attribute of a common resource and a public attribute specifying an access control policy, the access control policy specified by the public attribute indicating permission to access the An entity that accesses the token root resource and the virtual resource under the access token root resource.
The method according to claim 2, after receiving an access token resource creation request sent by the initiating entity for the access token issuing resource under the access token root resource, before generating the access token for the initiating entity The method further includes:

And determining, according to the public attribute of the specified access control policy of the access token root resource, that the initiating entity is allowed to access the virtual resource under the access token root resource.
The method of claim 1 wherein said access token resource has a generic attribute of a generic resource and an expired time attribute, an issuer attribute, a holder attribute, and a token attribute, said overdue time attribute being used Specifying an expiration date of the access token resource, the issuer attribute is used to indicate an entity that generates the access token, the holder attribute is used to indicate a request and obtain the An entity accessing a token, the token attribute being used to store the access token.
The method of claim 1, wherein the method further comprises: before generating an access token for the initiating entity, according to the access token authorization policy and the rights description information, the method further comprising:

The access token authorization policy is obtained from an access token authorization policy entity.
The method according to any one of claims 1-5, wherein the access token further carries authentication information, where the authentication information includes an entity identifier that generates the access token, and an identifier of the originating entity. And overtime;

The authorization information of the access token includes a service role and/or an access control policy of the originating entity.
The method of claim 6, wherein generating an access token for the initiating entity according to the access token authorization policy and the rights description information comprises:

Generating an access token plaintext according to the access token authorization policy and the permission description information;

Transmitting the generated access token clear text to the security function entity, and the security function entity digitally signs and/or encrypts the access token plaintext to obtain the access token and returns;

Receiving the access token returned by the security function entity.
An access token issuance method, which is characterized by comprising:

And sending, to the authorized entity, an access token resource creation request for the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the permission description information of the requested access token;

Receiving an access token returned by the authorized entity, or receiving address information of an access token resource created by the authorized entity under the access token root resource, where the access token resource stores an access token, where The access token carries at least the authorization information;

The access token root resource is a common resource under the CSE root resource of the public service entity, and the access token is a virtual resource under the access token root resource, where the access token resource is the access A common resource under the token root resource.
The method of claim 8, wherein the access token root resource has a common attribute of a common resource and a public attribute specifying an access control policy, the public attribute specifying The access control policy indicates an entity that allows access to the access token root resource and the virtual resource under the access token root resource.
The method of claim 8 wherein said access token resource has a common attribute of a generic resource and an expired time attribute, an issuer attribute, a holder attribute, and a token attribute, said overdue time attribute being used Specifying an expiration date of the access token resource, the issuer attribute is used to indicate an entity that generates the access token, and the holder attribute is used to indicate an entity requesting and obtaining the access token, the order Card attributes are used to store the access token.
The method of claim 10, after receiving the address information of the access token resource created by the authorized entity under the access token root resource, the method further includes:

Obtaining the access token according to the address information.
The method according to any one of claims 8 to 11, wherein the access token further carries authentication information, the authentication information including an entity identifier for generating the access token, requesting and holding the Entity ID and expiration time of the access token;

The authorization information of the access token includes a service role and/or an access control policy of the originating entity.
The method of claim 12, wherein the method further comprises:

Sending a resource access request, where the resource access request carries the access token.
An authorized entity, comprising:

a receiving module, configured to receive an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier and the request of the initiating entity Access permission description information of the access token;

a processing module, configured to generate, according to the access token authorization policy and the rights description information, an access token, where the access token carries at least authorization information, and is generated under the access token root resource. Access token resource of the access token, the access token is stored in the access token resource;

a sending module, configured to send the access token or address information of the access token resource to the initiating entity;

The access token root resource is a common resource under the CSE root resource of the public service entity, and the access token is a virtual resource under the access token root resource, where the access token resource is Access common resources under the token root resource.
The authorization entity according to claim 14, wherein the access token root resource has a common attribute of a common resource and a public attribute specifying an access control policy, and the access control policy specified by the public attribute indicates that the access is permitted An entity that accesses the token root resource and the virtual resource under the access token root resource.
The authorization entity according to claim 15, wherein the processing module is further configured to:

Before generating the access token for the initiating entity, determining, according to the public attribute of the specified access control policy of the access token root resource, that the initiating entity is allowed to access the virtual resource under the access token root resource.
The authorization entity according to claim 14, wherein said access token resource has a general attribute of a common resource and an expired time attribute, an issuer attribute, a holder attribute, and a token attribute, and the expired time attribute is used. Specifying an expiration date of the access token resource, the issuer attribute is used to indicate an entity that generates the access token, and the holder attribute is used to indicate an entity that requests and obtains the access token, A token attribute is used to store the access token.
The authorization entity according to claim 14, wherein the processing module is further configured to: acquire the access token authorization policy from an access token authorization policy entity.
The authorization entity according to any one of claims 14 to 18, wherein the access token further carries authentication information, where the authentication information includes an entity identifier that generates the access token, and the originating entity Identification and timeout;

The authorization information of the access token includes a service role and/or an access control policy of the originating entity.
The authorization entity according to claim 19, wherein the processing module is specifically configured to:

Generating an access token plaintext according to the access token authorization policy and the permission description information;

The sending module is further configured to:

Transmitting the generated access token clear text to the security function entity, and the security function entity digitally signs and/or encrypts the access token plaintext to obtain the access token and returns;

The receiving module is further configured to:

Receiving the access token returned by the security function entity.
An originating entity, comprising:

a sending module, configured to send, to the authorized entity, an access token resource creation request for the access token issuing resource under the access token root resource, where the access token resource creation request carries the identifier of the initiating entity and the requested access token Permission description information;

a receiving module, configured to receive an access token returned by the authorized entity, or receive address information of an access token resource created by the authorized entity under the access token root resource, where the access token resource is saved An access token, the access token carrying at least authorization information;

The access token root resource is a common resource under the CSE root resource of the public service entity, and the access token is a virtual resource under the access token root resource, where the access token resource is the access A common resource under the token root resource.
The originating entity according to claim 21, wherein the access token root resource has a common attribute of a common resource and a public attribute specifying an access control policy, and the access control policy specified by the public attribute indicates that the access is permitted An entity that accesses the token root resource and the virtual resource under the access token root resource.
The originating entity according to claim 21, wherein said access token resource has a common attribute of a common resource and an expired time attribute, an issuer attribute, a holder attribute, and a token attribute, and the expired time attribute is used. Specifying an expiration date of the access token resource, the issuer attribute is used to indicate an entity that generates the access token, and the holder attribute is used to indicate an entity that requests and obtains the access token, A token attribute is used to store the access token.
The originating entity according to claim 23, further comprising: an obtaining module, configured to:

After the receiving module receives the address information of the access token resource created by the authorized entity under the access token root resource, the access token is obtained according to the address information.
An originating entity according to any one of claims 21-24, wherein said access order The card further carries authentication information, where the authentication information includes an entity identifier that generates the access token, an entity identifier that requests and holds the access token, and an expiration time;

The authorization information of the access token includes a service role and/or an access control policy of the originating entity.
The initiating entity of claim 25, wherein the sending module is further configured to:

Sending a resource access request, where the resource access request carries the access token.
An authorized entity, comprising: a processor, a transceiver, and a memory;

The processor is configured to read a program in the memory and perform the following process:

Receiving, by the transceiver, an access token resource creation request sent by the initiating entity to the access token issuing resource under the access token root resource, where the access token resource creation request carries the permission description information of the requested access token;

Generating an access token for the initiating entity according to the access token authorization policy and the rights description information, where the access token carries at least authorization information, and the generated access token is created under the access token root resource. Accessing a token resource, where the access token is stored in the access token resource;

And transmitting, by the transceiver, the address information of the access token or the access token resource to the initiating entity.
An originating entity, comprising: a processor, a transceiver, and a memory;

The processor is configured to read a program in the memory and perform the following process:

Sending, by the transceiver, an access token resource creation request for the access token issuing resource under the access token root resource to the authorized entity, where the access token resource creation request carries the permission description information of the requested access token;

Receiving, by the transceiver, an access token returned by the authorized entity, or receiving address information of an access token resource created by the authorized entity under the access token root resource, where the access token resource has an access order Card, the access token carries at least authorization information.