WO2017076129A1 - 角色颁发方法、访问控制方法及相关设备 - Google Patents

角色颁发方法、访问控制方法及相关设备 Download PDF

Info

Publication number
WO2017076129A1
WO2017076129A1 PCT/CN2016/098866 CN2016098866W WO2017076129A1 WO 2017076129 A1 WO2017076129 A1 WO 2017076129A1 CN 2016098866 W CN2016098866 W CN 2016098866W WO 2017076129 A1 WO2017076129 A1 WO 2017076129A1
Authority
WO
WIPO (PCT)
Prior art keywords
role
resource
entity
access control
initiator
Prior art date
Application number
PCT/CN2016/098866
Other languages
English (en)
French (fr)
Inventor
周巍
Original Assignee
电信科学技术研究院
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 电信科学技术研究院 filed Critical 电信科学技术研究院
Publication of WO2017076129A1 publication Critical patent/WO2017076129A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a role issuing method, an access control method, and related devices.
  • OneM2M the Internet of Things standardization organization, is dedicated to developing technical specifications for constructing a common Machine-To-Machine (M2M) Service Layer.
  • M2M Machine-To-Machine
  • the oneM2M functional architecture is shown in Figure 1. Three basic entities are defined:
  • the Application Entity is located at the application layer, and the entity can implement an M2M application service logic.
  • An application service logic can reside in multiple M2M nodes, or multiple execution instances in a single node.
  • Each execution instance of the application service logic is referred to as an application entity, and each application entity is identified by a unique AE identity (AE-ID).
  • a fleet tracking application instance For example, a fleet tracking application instance, a remote blood glucose monitoring application instance, a remote power metering instance, or a control application instance are all application entities.
  • CSE Common Service Entity
  • M2M environment a public service entity consists of a set of common service functions in an M2M environment.
  • the public service function is exposed to other entities through the reference point Mca and the reference point Mcc.
  • the reference point Mcn is used to access the underlying network service entity.
  • Each public service entity is identified by a unique CSE-ID.
  • NSE Underlying Network Services Entity
  • an underlying network service entity provides underlying network services to multiple CSEs, such as providing device management, location services, and device triggering services.
  • oneM2M implements service layer resource sharing and interaction through operations on standardized resource trees.
  • the oneM2M resource tree exists in the CSE defined by the oneM2M system.
  • CSEBase1 represents a CSE root resource ⁇ CSEBase>
  • CSE1 represents a resource ⁇ remoteCSE>
  • APP1 represents a resource ⁇ AE>
  • CONT1 and CONT2 respectively represent a resource ⁇ container>
  • ACP1 and ACP2 respectively represent a resource ⁇ accessControlPolicy>.
  • the resource related to the authorization defined by oneM2M is the access control policy resource ⁇ accessControlPolicy>, which defines an Access Control Policy (ACP), and the ⁇ accessControlPolicy> resource is uniquely identified by the resource identity (ID). Other resources specify the applicable access control policy through the accessControlPolicyIDs attribute in the resource.
  • the privileges attribute in the ⁇ accessControlPolicy> resource is used to store specific access control rules, and the self-privilege privilege (selfPrivileges) attribute is used to store access control rules that maintain ⁇ accessControlPolicy> resources.
  • the oneM2M security solution specification oneM2M TS-0003 gives an assessment of the authorization architecture and access control policies.
  • the functions of each authorization component are:
  • PEP Policy Enforcement Point
  • PDP Policy Decision Point
  • a Policy Decision Point is responsible for evaluating whether to approve the access control decision request sent by the PEP according to the access control policy, and returning the evaluation result to the PEP through the access control decision response.
  • the Policy Retrieval Point obtains the applicable access control policy according to the policy request provided by the PDP, and returns the obtained access control policy to the PDP.
  • PDP Policy Information Point
  • the PEP generates an access control decision request (Access Control Decision Request) according to the user's access request and sends it to the PDP.
  • Access Control Decision Request Access Control Decision Request
  • the PDP sends an Access Control Policy Request to the PRP according to the access control decision request of the PEP;
  • the PDP analyzes the content provided by the access control policy returned by the PRP and the access control decision request of the PEP. If other attributes are required, the access control attribute request (Access Control Attribute Request) is sent to the PIP, otherwise step 5 is performed.
  • the PIP requests to obtain the corresponding access control related attribute according to the access control attribute of the PDP, and returns it to the PDP.
  • the PDP determines the applicable access control policy and passes the access control decision response (Access Control). Attribute Response) is returned to the PEP.
  • the PEP determines whether to perform the user's access request according to the access control policy in the access control decision response.
  • the second phase of oneM2M (Release 2) will study and develop interfaces between the various components of the authorization architecture and will support a wider variety of access control policies, such as role-based access control, attribute-based access control, and more.
  • the new feature of Role-based access control in Release 2 has been clarified, but there is no solution for how to implement role-based access control.
  • the embodiment of the present application provides a role issuing method, an access control method, and related devices, to provide role-based access control for oneM2M.
  • a role issuing method including:
  • the public service entity CSE receives the role resource creation request sent by the role issuing entity, where the role resource creation request carries the role information issued to the initiator entity, and the role information includes at least the role identifier;
  • the CSE creates a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and the role information is stored.
  • the CSE further includes:
  • the CSE returns a role resource creation response to the role issuing entity.
  • the CSE further includes:
  • the CSE modifies the role information saved in the role resource according to the re-issued the role information
  • the CSE further includes:
  • the CSE returns a role resource modification response to the role issuing entity.
  • the method further includes:
  • the CSE returns a resource read response to the initiator entity, where the resource read response carries the role information.
  • the method further includes:
  • the CSE determines, according to the access control policy of the resource corresponding to the initiator entity, that the role issuing entity is allowed to create the role resource.
  • the method further includes:
  • the CSE determines, according to the access control policy of the resource corresponding to the initiator entity, that the role issuing entity is allowed to modify the role resource.
  • the role resource has a common attribute of a common resource, and has a public attribute that specifies an expiration time and a contracted sub-resource.
  • the role resource has a role identifier attribute, a role issuer identifier attribute, a role valid start time attribute, and a role effective end time attribute, where the role identifier attribute is used to save the role identifier, and the role issuer identifier attribute Used to save the role issuer ID, the role valid start time attribute is used to save the role effective start time, and the role effective end time attribute is used to save the role effective end time.
  • the role resource further has any one or more of a role type attribute, a role name attribute, and an application category attribute, where the role type attribute is used to save the role type, and the role name attribute is used to save the role.
  • the name can be read, and the application category attribute is used to save the application category to which the role belongs.
  • a role issuing method including:
  • the role issuing entity generates a role resource creation request, where the role resource creation request carries the role information issued to the initiator entity, and the role information includes at least the role identifier;
  • the role issuing entity sends the role resource creation request to the public service entity CSE, and the CSE creates a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and is stored. There is role information of the initiator entity.
  • the method further includes:
  • the role issuing entity receives a role resource creation response returned by the CSE.
  • the CSE further includes:
  • the role issuing entity sends the indication information of the address information of the role resource to the initiator entity, and sends the indication information of the address information of the role resource to the policy decision point PDP entity and/or policy information.
  • Point PIP entity sends the indication information of the address information of the role resource to the policy decision point PDP entity and/or policy information.
  • the method further includes:
  • the role issuing entity generates a role resource modification request, where the role resource modification request carries role information re-issued to the initiator entity;
  • the role issuing entity sends the role resource modification request to the CSE.
  • the method further includes:
  • the role issuing entity receives a role resource modification response returned by the CSE.
  • the role resource has a common attribute of a common resource, and has a public attribute that specifies an expiration time and a contracted sub-resource.
  • the role resource has a role identifier attribute, a role issuer identifier attribute, a role valid start time attribute, and a role effective end time attribute, where the role identifier attribute is used to save the role identifier, and the role issuer identifier attribute Used to save the role issuer ID, the role valid start time attribute is used to save the role effective start time, and the role effective end time attribute is used to save the role effective end time.
  • the role resource further has any one or more of a role type attribute, a role name attribute, and an application category attribute, where the role type attribute is used to save the role type, and the role name attribute is used to save the role.
  • the name can be read, and the application category attribute is used to save the application category to which the role belongs.
  • a method for issuing a role including:
  • the initiator entity sends a resource read request to the public service entity CSE for the role resource under the resource corresponding to the initiator entity, where the role resource is a common resource and the role information of the initiator entity is stored;
  • the initiator entity receives a resource read response returned by the CSE, where the resource read response carries role information saved in the role resource, and the role information includes at least a role identifier.
  • the role resource has a common attribute of a common resource, and has a public attribute that specifies an expiration time and a contracted sub-resource.
  • the role resource has a role identifier attribute, a role issuer identifier attribute, a role valid start time attribute, and a role effective end time attribute, where the role identifier attribute is used to save the role identifier, and the role issuer identifier attribute Used to save the role issuer ID, the role valid start time attribute is used to save the role effective start time, and the role effective end time attribute is used to save the role effective end time.
  • the role resource further has any one or more of a role type attribute, a role name attribute, and an application category attribute, where the role type attribute is used to save the role type, and the role name attribute is used to save the role.
  • the name can be read, and the application category attribute is used to save the application category to which the role belongs.
  • an access control method including:
  • the policy enforcement point PEP entity obtains a resource access request sent by the initiator entity, where the resource access request carries role information of the initiator entity, where the role information includes at least a role identifier;
  • the PEP entity generates an access control decision request according to the resource access request, where the access control decision request carries role information of the initiator entity;
  • the PEP entity sends the access control decision request to the policy decision point PDP entity, and the PDP entity queries the role resource corresponding to the initiator entity according to the role information to obtain a query result, and is used by the PDP entity according to the PDP entity.
  • the query result and the access control policy determine a decision result, where the role resource is a common resource and the role information of the initiator entity is stored;
  • the PEP performs access control on a resource access request of the initiator entity according to the decision result.
  • the role resource has a common attribute of a common resource, and has a public attribute that specifies an expiration time and a contracted sub-resource.
  • the role resource has a role identifier attribute, a role issuer identifier attribute, a role valid start time attribute, and a role effective end time attribute, where the role identifier attribute is used to save the role identifier, and the role issuer identifier attribute Used to save the role issuer ID, the role valid start time attribute is used to save the role effective start time, and the role effective end time attribute is used to save the role effective end time.
  • the role resource further has any one or more of a role type attribute, a role name attribute, and an application category attribute, where the role type attribute is used to save the role type, and the role name attribute is used to save the role.
  • the name can be read, and the application category attribute is used to save the application category to which the role belongs.
  • the role identifier of the initiator entity that is carried in the resource access request is determined according to an application category to which the current resource access belongs and an application category to which the role belongs.
  • an access control method including:
  • the policy decision point PDP entity receives the access control decision request sent by the policy enforcement point PEP entity, where the access control decision request carries the role information of the initiator entity that initiates the resource access request, and the role information includes at least the role identifier;
  • the PDP entity obtains a query result according to the role identifier of the initiator entity, and determines a result of the decision according to the query result and the access control policy, where the role resource is a common resource and the initiator is stored.
  • the role information of the entity
  • the PDP entity returns an access control decision response to the PEP entity, where the access control decision response carries the decision result.
  • the PDP entity obtains the query result by querying the role resource corresponding to the initiator entity according to the role identifier, including:
  • the PDP entity sends a query request to the public service entity CSE for the role resource of the initiator entity, and obtains a query result returned by the CSE, where the query request carries the role identifier;
  • the PDP entity sends an access control attribute request to the policy information point PIP entity, where the access control attribute request carries the role identifier of the initiator entity, and receives an access control attribute response returned by the PIP entity, where the access control
  • the attribute response carries a query result obtained by the PIP entity querying the role resource corresponding to the initiator entity according to the role identifier.
  • the PDP entity determines, according to the query result and the access control policy, a decision result, including:
  • the PDP entity determines that the query result carries the role information saved in the role resource, and determines that the role identifier is valid according to the role information, determining a decision result according to the access control policy and the role identifier;
  • the PDP entity determines that the query result is empty, determining, according to the access control policy, that the decision result is that the resource access request of the initiator entity is not allowed; or, if the query result is determined to carry the role resource, And saving the role information, and determining, according to the role information, that the role identifier is invalid, and determining, according to the access control policy, that the decision result is that the resource access request of the initiator entity is not allowed.
  • the role resource has a common attribute of a common resource, and has a public attribute that specifies an expiration time and a contracted sub-resource.
  • the role resource has a role identifier attribute, a role issuer identifier attribute, a role valid start time attribute, and a role effective end time attribute, where the role identifier attribute is used to save the role identifier, and the role issuer identifier attribute Used to save the role issuer ID, the role valid start time attribute is used to save the role effective start time, and the role effective end time attribute is used to save the role effective end time.
  • the role resource further has any one or more of a role type attribute, a role name attribute, and an application category attribute, where the role type attribute is used to save the role type, and the role name attribute is used to save the role.
  • the name can be read, and the application category attribute is used to save the application category to which the role belongs.
  • an access control method including:
  • the policy information point PIP entity receives the access control attribute request sent by the policy decision point PDP entity, where the access control attribute request carries the role information of the initiator entity that initiates the resource access request, and the role information includes at least the role identifier;
  • the PIP entity queries the public service entity CSE for the role resource corresponding to the initiator entity according to the role identifier, and obtains a query result, where the role resource is a common resource and the role information of the initiator entity is stored;
  • the role resource has a common attribute of a common resource, and has a public attribute that specifies an expiration time and a contracted sub-resource.
  • the role resource has a role identifier attribute, a role issuer identifier attribute, a role valid start time attribute, and a role effective end time attribute, where the role identifier attribute is used to save the role identifier, and the role issuer identifier attribute Used to save the role issuer ID, the role valid start time attribute is used to save the role effective start time, and the role effective end time attribute is used to save the role effective end time.
  • the role resource further has any one or more of a role type attribute, a role name attribute, and an application category attribute, where the role type attribute is used to save the role type, and the role name attribute is used to save the role.
  • the name can be read, and the application category attribute is used to save the application category to which the role belongs.
  • a public service entity CSE including:
  • a receiving module configured to receive a role resource creation request sent by the role issuing entity, where the role resource creation request carries role information issued to the initiator entity, where the role information includes at least the role identifier;
  • a processing module configured to create a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and the role information is stored.
  • the receiving module is further configured to:
  • the role resource modification request sent by the role issuing entity is received, and the role resource modification request is re-issued to the Describe the role information of the initiator entity;
  • the processing module is further configured to:
  • a first sending module for:
  • a second sending module is further included, configured to:
  • the processing module After the processing module creates a role resource under the resource corresponding to the initiator entity according to the role information, the processing module returns a role resource creation response to the role issuing entity.
  • the third sending module is further configured to:
  • the receiving module is further configured to:
  • processing module is further configured to:
  • the role authorization entity is allowed to create the role resource according to the access control policy of the resource corresponding to the initiator entity.
  • processing module is further configured to:
  • a role issuing entity including:
  • a processing module configured to generate a role resource creation request, where the role resource creation request carries role information issued to the initiator entity, where the role information includes at least a role identifier;
  • a sending module configured to send the role resource creation request to the public service entity CSE, where the CSE creates a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and is stored. There is role information of the initiator entity.
  • the method further includes: a first receiving module, configured to:
  • the sending module is further configured to:
  • processing module is further configured to:
  • the sending module is further configured to:
  • a second receiving module is further included, configured to:
  • an originating entity comprising:
  • a sending module configured to send, to the public service entity CSE, a resource reading request for a role resource of a resource corresponding to the initiator entity, where the role resource is a common resource and the role information of the initiator entity is stored;
  • the receiving module is configured to receive a resource read response returned by the CSE, where the resource read response carries role information saved in the role resource, where the role information includes at least a role identifier.
  • the initiator entity is an application entity or a public service entity.
  • a policy enforcement point PEP entity including:
  • a first acquiring module configured to acquire a resource access request sent by an initiator entity, where the resource access request carries role information of the initiator entity, where the role information includes at least a role identifier;
  • a generating module configured to generate an access control decision request according to the resource access request acquired by the acquiring module, where the access control decision request carries role information of the initiator entity;
  • a sending module configured to send the access control decision request to a policy decision point PDP entity, where the PDP entity queries a role resource corresponding to the initiator entity according to the role information to obtain a query result, and is used by the PDP entity Determining a decision result according to the query result and the access control policy, where the role resource is a common resource and the role information of the initiator entity is stored;
  • a second obtaining module configured to obtain an access control decision response returned by the PDP entity, where the access control decision response carries the decision result
  • the access control module is configured to perform access control on the resource access request of the initiator entity according to the decision result.
  • a policy decision point PDP entity including:
  • a receiving module configured to receive an access control decision request sent by a policy execution point PEP entity, where the access control decision request carries role information of an initiator entity that initiates a resource access request, where the role information includes at least a role identifier;
  • a processing module configured to query a role resource corresponding to the initiator entity according to the role identifier to obtain a query result, and determine a decision result according to the query result and an access control policy, where the role resource is a common resource and the initiator is stored The role information of the party entity;
  • a sending module configured to return an access control decision response to the PEP entity, where the access control decision response carries the decision result.
  • processing module is specifically configured to:
  • the access control attribute request carries a role identifier of the initiator entity
  • the access control attribute response carries a query result obtained by the PIP entity querying the role resource corresponding to the initiator entity according to the role identifier.
  • processing module is specifically configured to:
  • the query result carries the role information saved in the role resource, and determines that the role identifier is valid according to the role information, determining a decision result according to the access control policy and the role identifier;
  • the result of the query is determined to be empty, determining, according to the access control policy, that the result of the decision is that the resource access request of the initiator entity is not allowed; or determining that the query result carries the role information saved in the role resource. And determining, according to the role information, that the role identifier is invalid, and determining, according to the access control policy, that the decision result is that the resource access request of the initiator entity is not allowed.
  • a policy information point PIP entity including:
  • a receiving module configured to receive an access control attribute request sent by a policy decision point PDP entity, where the access control attribute request carries role information of an initiator entity that initiates a resource access request, where the role information includes at least a role identifier;
  • a processing module configured to query, according to the role identifier, a role resource corresponding to the initiator entity to the public service entity CSE, and obtain a query result, where the role resource is a common resource and the role information of the initiator entity is stored;
  • a sending module configured to return an access control attribute response to the PDP entity, where the access control attribute response carries the query result.
  • a public service entity CSE including a processor, a memory, and a transceiver, wherein the transceiver is configured to receive and transmit data under the control of the processor, and the preset program is stored in the memory, and the processing is performed.
  • the program reads the program saved in the memory, and executes the following process according to the program:
  • the transceiver And receiving, by the transceiver, a role resource creation request sent by the role issuing entity, where the role resource creation request carries the role information issued to the initiator entity, where the role information includes at least the role identifier;
  • a role resource is created under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and the role information is stored.
  • the processor creates a role resource under the resource corresponding to the initiator entity according to the role information, and then returns a role resource creation response to the role issuing entity by using the transceiver.
  • the processor after the role resource is created according to the role information, is configured to receive, by the transceiver, a role resource modification request sent by the role issuing entity, where the role resource modification request is carried. Re-issuing role information to the initiator entity;
  • the processor after modifying the role information saved in the role resource according to the re-issued the role information, the processor returns a role resource modification response to the role issuing entity by using the transceiver.
  • the processor receives, by the transceiver, a resource read request of the initiator entity to the role resource;
  • the processor determines, according to the access control policy of the resource corresponding to the initiator entity, that the role is allowed to create the role, according to the role information, before the role resource is created under the resource corresponding to the initiator entity.
  • Role resource
  • the role information saved in the role resource before modifying the role information saved in the role resource according to the re-issued the role information, determining, by the access control policy of the resource corresponding to the initiator entity, that the role is allowed to modify the Role resource.
  • a role issuing entity including a processor, a memory, and a transceiver, wherein the transceiver is configured to receive and transmit data under the control of the processor, the memory stores a preset program, and the processor reads Take the program saved in the memory and follow the procedure to perform the following process:
  • the role resource creation request carries role information issued to the initiator entity, where the role information includes at least the role identifier;
  • the transceiver Sending, by the transceiver, the role resource creation request to the public service entity CSE, where the CSE creates a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and is stored.
  • the role information of the initiator entity is a common resource and is stored.
  • the processor receives, by the transceiver, a role resource creation response returned by the CSE.
  • the processor sends, by the transceiver, indication information of the address information of the role resource to the initiator entity, and sends indication information of the address information of the role resource to the policy decision point PDP entity and / or policy information point PIP entity.
  • the processor generates a role resource modification request, where the role resource modification request carries role information re-issued to the initiator entity;
  • the role resource modification request is sent to the CSE through a transceiver.
  • the processor receives, by the transceiver, a role resource modification response returned by the CSE.
  • an initiator entity including a processor, a memory, and a transceiver, wherein the transceiver receives and transmits data under the control of the processor, the memory stores a preset program, and the processor reads the memory.
  • the initiator entity is an application entity or a public service entity.
  • a policy enforcement point PEP entity including a processor, a memory, and a transceiver, wherein the transceiver receives and transmits data under the control of the processor, and the memory stores a preset program, and the processor reads Take the program saved in the memory and follow the procedure to perform the following process:
  • the access control decision request to the policy decision point PDP entity, and the PDP entity queries the role resource corresponding to the initiator entity according to the role information to obtain a query result, and the PDP entity is configured by the PDP entity.
  • the query result and the access control policy determine a decision result, where the role resource is a common resource and the role information of the initiator entity is stored;
  • a policy decision point PDP entity including a processor, a memory, and a transceiver, wherein the transceiver receives and transmits data under the control of the processor, and the memory stores a preset program, and the processor reads Take the program saved in the memory and follow the procedure to perform the following process:
  • an access control decision request sent by the policy enforcement point PEP entity where the access control decision request carries the role information of the initiator entity that initiates the resource access request, where the role information includes at least the role identifier;
  • the processor sends a query request for the role resource of the initiator entity to the public service entity CSE by using the transceiver, and obtains a query result returned by the CSE by using the transceiver, where the query carries the role Identification
  • the transceiver Sending, by the transceiver, an access control attribute request to the policy information point PIP entity, where the access control attribute request carries the role identifier of the initiator entity, and receives, by the transceiver, an access control attribute response returned by the PIP entity,
  • the access control attribute response carries the PIP entity to query the initiator entity pair according to the role identifier. The result of the query obtained by the role resource.
  • the processor determines, if the query result carries the role information saved in the role resource, and determines that the role identifier is valid according to the role information, determining, according to the access control policy and the role identifier result;
  • the result of the query is determined to be empty, determining, according to the access control policy, that the result of the decision is that the resource access request of the initiator entity is not allowed; or determining that the query result carries the role information saved in the role resource. And determining, according to the role information, that the role identifier is invalid, and determining, according to the access control policy, that the decision result is that the resource access request of the initiator entity is not allowed.
  • a policy information point PIP entity including a processor, a memory, and a transceiver, wherein the transceiver receives and transmits data under the control of the processor, and the memory stores a preset program, and the processor reads Take the program saved in the memory and follow the procedure to perform the following process:
  • an access control attribute request sent by the policy decision point PDP entity where the access control attribute request carries role information of the initiator entity that initiates the resource access request, where the role information includes at least a role identifier;
  • the role resource is created by using the resource corresponding to the initiator entity, and the role resource is a common resource and is used to save the role information, and the role information includes at least the role identifier, so that the The operation of the role resource obtains the role information saved in the role resource, and implements role-based access control in oneM2M based on the obtained role information.
  • Figure 1 is a schematic diagram of a oneM2M functional architecture
  • FIG. 2 is a schematic structural diagram of a oneM2M resource tree
  • Figure 3 is a schematic diagram of the oneM2M authorization architecture
  • FIG. 4 is a schematic diagram of a basic structure of a role resource in an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of an ⁇ AE> resource in an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of a method for issuing a CSE execution role according to an embodiment of the present application
  • FIG. 7 is a schematic flowchart of a method for performing role issuing by a role issuing entity in an embodiment of the present application
  • FIG. 8 is a schematic flowchart of a method for performing an issue by an initiator entity in an embodiment of the present application
  • FIG. 9 is a schematic flowchart of a method for performing access control by a PEP entity according to an embodiment of the present application.
  • FIG. 10 is a schematic flowchart of a method for performing access control by a PDP entity in an embodiment of the present application
  • FIG. 11 is a schematic flowchart of a method for performing access control by a PIP entity according to an embodiment of the present application
  • FIG. 12 is a schematic diagram of a process of issuing and using a role in an embodiment of the present application.
  • FIG. 13 is a schematic diagram of an entity relationship in an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a resource tree related to CSE1 in the embodiment of the present application.
  • 15 is a schematic diagram of a process of issuing and using another role in the embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of a CSE in an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of a role issuing entity in an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of an initiator entity in an embodiment of the present application.
  • FIG. 19 is a schematic structural diagram of a PEP entity in an embodiment of the present application.
  • FIG. 20 is a schematic structural diagram of a PDP entity in an embodiment of the present application.
  • FIG. 21 is a schematic structural diagram of a PIP entity in an embodiment of the present application.
  • FIG. 22 is a schematic structural diagram of another CSE in the embodiment of the present application.
  • 24 is a schematic structural diagram of another initiator entity in the embodiment of the present application.
  • 25 is a schematic structural diagram of another PEP entity in the embodiment of the present application.
  • 26 is a schematic structural diagram of another PDP entity in the embodiment of the present application.
  • FIG. 27 is a schematic structural diagram of another PIP entity in the embodiment of the present application.
  • a oneM2M resource is defined in the embodiment of the present application to implement role-based access control.
  • the defined resource is the role resource ⁇ role>, which is used to store role information in the CSE resource tree.
  • the ⁇ role> resource may be located under resources such as ⁇ CSEBase>, ⁇ remoteCSE>, ⁇ AE> in the oneM2M infrastructure node IN-CSE, that is, the role resource is created in the resource associated with the initiator entity, so that the resources are available.
  • An ⁇ CSEBase>, ⁇ remoteCSE>, or ⁇ AE> resource in an IN-CSE can have one or more role resource instances, and a role resource instance represents a role.
  • Role resource The stored role is the role assigned to the entity corresponding to the role resource.
  • a role ID is stored in at least one role resource.
  • the basic structure of the ⁇ role> resource is defined as shown in Figure 4.
  • the resource type is oneM2M normal resource (Normal Resource), and the oneM2M common resource has a specific resource structure and resource attributes.
  • the ⁇ role> resource contains, in addition to the Uniseal Attribute of the oneM2M common resource, a common attribute (Common Attribute) for specifying the expiration time and a subscription ⁇ subscription> sub-resource defined by oneM2M. Define each ⁇ role> resource instance to describe a role.
  • the numbers in FIG. 4 indicate the number of corresponding resource attributes or the number of corresponding sub-resources.
  • Role ID attribute The user saves the role ID
  • Role issuer identifier (issuer) attribute used to save the role issuer ID
  • Role effective start time (startTime) attribute used to save the effective start time of the role
  • Role type attribute used to distinguish whether the role is defined by the service subscription role defined by the oneM2M Service Provider or by the oneM2M Application Service Provider. a specific application-related role;
  • RoleName attribute a readable name for saving a character
  • AppCategory attribute used to save the application category to which the role belongs, that is, the application scope of the role, such as device management application, smart home application, intelligent traffic application, and the like.
  • the ⁇ role> resource has at least the roleID attribute, and may also have the issuer, startTime, and expiryTime attributes.
  • the roleType attribute, the roleName attribute, and the appCategory attribute are optional resource attributes, that is, a role resource may have any one or more of a roleType attribute, a roleName attribute, and an appCategory attribute.
  • the structure of the ⁇ AE> resource is defined as shown in Figure 5. Only the ⁇ role> resource is added to the existing ⁇ AE> resource as a sub-resource.
  • the number of ⁇ role> sub-resources under the ⁇ AE> resource can be zero or n. , n is greater than or equal to 1, used to indicate the role assigned to the AE.
  • the definitions of ⁇ CSEBase> resources and ⁇ remoteCSE> resources are similar to those of ⁇ AE> resources.
  • the ⁇ role> resource is added as a sub-resource under the ⁇ CSEBase> resource, and the ⁇ role> resource is added to the ⁇ remoteCSE> resource.
  • the number of ⁇ role> sub-resources under the ⁇ CSEBase> resource or ⁇ remoteCSE> resource can be zero or n, and n is greater than or equal to 1.
  • the entities associated with role-based access control are defined as follows:
  • Role Authority entity responsible for issuing a role to an AE or CSE and having an entity at the originator The ability to create ⁇ role> sub-resources under the corresponding resources (such as the registered resources of the initiator);
  • Originator entity an AE or CSE, an object issued by a role for accessing resources using a role;
  • Registration Responsive CSE The Originator registers with the CSE, that is, the registered resources of the Originator are created in the CSE;
  • the resource that the Originator wants to access exists in the resource tree of the CSE.
  • the Registrar CSE and the Hosting CSE can be the same CSE or different CSEs.
  • PEP Policy enforcement point
  • PDP Policy Decision Point
  • PIP Policy Information Point
  • the PDP can obtain the required attributes through PIP, or obtain the required information directly from the resources corresponding to the initiator.
  • the resource corresponding to the initiator entity refers to the resource associated with the initiator entity.
  • a role resource is created under the resource corresponding to the initiator, or the role resource needs to be created or modified under the resource corresponding to the initiator.
  • the CSE storing the resource corresponding to the initiator entity is used as an execution entity, and the CSE may be an entity that stores the registered resource of the initiator entity, or may be stored.
  • the detailed method flow for the role is as follows:
  • Step 601 The CSE receives the role resource creation request sent by the role issuing entity, where the role resource creation request carries the role information issued to the initiator entity, and the role information includes at least the role identifier.
  • Step 602 The CSE creates a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and the role information is stored.
  • the CSE after the CSE creates the role resource under the resource corresponding to the initiator entity, the CSE returns a role resource creation response to the role issuing entity, where the role resource creation response is used to notify the role issuing entity whether the role resource is successfully created.
  • the CSE can also modify the role resource, specifically:
  • the CSE receives the role resource modification request sent by the role issuing entity after the role resource is created according to the role information, and the role resource modification request carries the role information re-issued to the initiator entity; This role information modifies the role information saved in the role resource.
  • the CSE issues the role to the role.
  • the sending entity returns a role resource modification response, and the role resource modification response is used to notify the role issuing entity whether the role resource is successfully modified.
  • the CSE receives the resource read request of the initiator entity for the role resource, and returns a resource read response to the initiator entity, where the resource read response carries the role information.
  • the CSE storing the registered resource is the registration response CSE.
  • the CSE performs access control on operations related to the resource according to an access control policy associated with the resource corresponding to the initiator entity. Specifically, before the CSE creates the role resource according to the role information, the CSE determines that the role issuing entity is allowed to create the role resource according to the access control policy of the resource corresponding to the initiator entity. Specifically, before modifying the role information saved in the role resource according to the re-issued role information, the CSE determines, according to the access control policy of the resource corresponding to the initiator entity, that the role issuing entity is allowed to modify the role resource.
  • an access control policy associated with a resource corresponding to an initiator entity specifies an entity that is allowed to access the resource.
  • Step 701 The role issuing entity generates a role resource creation request, where the role resource creation request carries the role information issued to the initiator entity, and the role information includes at least the role identifier.
  • the role information carried in the role resource creation request may include, in addition to the role identifier, a role issuer identifier, a role effective start time, and a role effective end time.
  • the role type and the role may be included. Read the name and one or more of the application categories to which the role belongs.
  • Step 702 The role issuing entity sends a role resource creation request to the CSE, and the CSE creates a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and the role information of the initiator entity is stored. .
  • the CSE stores the resource corresponding to the initiator entity. If the resource corresponding to the initiator entity is a registered resource, the CSE is a registration response CSE. If the resource corresponding to the initiator entity is not a registered resource, the CSE is saved. An entity corresponding to the originator entity and capable of creating a role resource under the resource.
  • the role resource creation response returned by the CSE is received, and the role resource creation response is used to indicate whether the role resource is successfully created.
  • the role issuing entity sends the indication information of the address information of the created role resource to the initiator entity; and the role resource created by the initiator entity.
  • the indication information of the address information is sent to the PDP entity and/or the PIP entity.
  • the indication information of the address information of the role resource may be the address information of the role resource or the address information of the upper-level resource of the role resource. Etc., where the upper level resource of the role resource is the resource associated with the initiator entity.
  • the role issuing entity may further modify the role resource. Specifically, the role issuing entity generates a role resource modification request, where the role resource modification request is Carrying the role information re-issued to the initiator entity, and sending the role resource modification request to the CSE.
  • the role resource modification response returned by the CSE is received, where the role resource modification response is used to indicate whether the role resource is successfully modified.
  • the PEP entity obtains the resource access request carrying the role information of the initiator entity, and then the PDP entity initiates the resource access request.
  • the role information is queried in the role resource corresponding to the party entity, and the query result is obtained.
  • the PDP entity determines whether the role information carried in the resource access request is actually issued to the initiator entity according to the query result and the role information carried in the resource access request. If it is determined that the initiator entity is issued, the decision result of the resource access request is determined according to the access control policy, thereby implementing role-based access control.
  • the process of acquiring the issued role information by the initiator entity is as follows:
  • Step 801 The initiator entity sends a resource read request to the CSE for the role resource under the resource corresponding to the initiator entity, where the role resource is a common resource and the role information of the initiator entity is stored.
  • the CSE stores the resource corresponding to the initiator entity. If the resource corresponding to the initiator entity is a registered resource, the CSE is a registration response CSE. If the resource corresponding to the initiator entity is not a registered resource, the CSE is saved. An entity corresponding to the originator entity and capable of creating a role resource under the resource.
  • Step 802 The initiator entity receives the resource read response returned by the CSE, where the resource read response carries the role information saved in the role resource, and the role information includes at least the role identifier.
  • the role information carried in the resource read response may include a role issuer identifier, a role valid start time, and a role valid end time, and may also include a role type and a role. Read the name and one or more of the application categories to which the role belongs.
  • the initiator entity obtains the role that is issued to itself by reading the role information saved in the role resource, so that the role information issued to itself can be carried when the resource access request is initiated, so that the PEP entity can be based on the initiator entity.
  • Role-based access control is implemented by the role information saved in the corresponding role resource, the role information carried in the resource access request, and the access control policy.
  • Step 901 The PEP entity acquires a resource access request sent by the initiator entity, where the resource access request carries the The role information of the originating entity, the role information includes at least the role identifier.
  • the resource access request of the initiator entity carries the address information of the target resource that needs to be accessed.
  • the role identifier of the initiator entity that is carried in the resource access request is determined according to the application category to which the current resource access belongs and the application category to which the role belongs. For example, if the application class to which the resource entity belongs to the current resource is an intelligent transportation application, the initiator entity searches for a role corresponding to the intelligent transportation application from the role list, and carries the role identifier of the role in the resource access request.
  • Step 902 The PEP entity generates an access control decision request according to the resource access request, where the access control decision request carries the role information of the initiator entity.
  • Step 903 The PEP entity sends the access control decision request to the PDP entity, and the PDP entity queries the role resource corresponding to the initiator entity according to the role information to obtain the query result, and the PDP entity determines the decision result according to the query result and the access control policy.
  • the role resource is a common resource and stores role information of the initiator entity, where the access control policy is associated with the target resource that the initiator entity needs to access.
  • Step 904 The PEP entity obtains an access control decision response returned by the PDP entity, where the access control decision response carries the decision result.
  • Step 905 The PEP entity performs access control on the resource access request of the initiator entity according to the decision result.
  • Step 1001 The PDP entity receives an access control decision request sent by the PEP entity, where the access control decision request carries the role information of the initiator entity that initiates the resource access request, and the role information includes at least the role identifier.
  • Step 1002 The PDP entity obtains the query result according to the role identifier of the initiator entity, and determines the result of the decision according to the query result and the access control policy.
  • the role resource is a common resource and the role information of the initiator entity is stored.
  • the PDP entity sends a query request to the CSE for the role resource of the initiator entity, and obtains a query result returned by the CSE, where the query request carries the role identifier.
  • the CSE stores resources corresponding to the initiator entity.
  • the PDP entity sends an access control attribute request to the PIP entity, where the access control attribute request carries the role identifier of the initiator entity, and receives an access control attribute response returned by the PIP entity, where the access control attribute response is
  • the PIP entity carries the query result obtained by querying the role resource corresponding to the initiator entity according to the role identifier.
  • the PDP entity determines that the query result carries the role information saved in the role resource, and determines that the role identifier is valid according to the role information
  • the PDP entity determines the decision result according to the access control policy and the role identifier. That is, if The access control policy is configured to allow the initiating entity to perform resource access by the role indicated by the role identifier, and determine that the decision result is to allow the initiator entity to access the resource at the current time; if the access control policy is to not allow the originating entity to indicate the role identifier The role of the resource access, determine the decision result is not allowed for the originator entity this resource access.
  • the PDP entity determines that the result of the query is empty, and determines that the result of the decision is not allowed to access the resource of the initiator entity according to the access control policy; or, if the query result is determined to carry the role information saved in the role resource, and according to the role information It is determined that the role identifier is invalid, and the result of the decision is determined according to the access control policy to not allow the resource access request of the initiator entity.
  • the access control policy may be that the PDP sends an access control policy request to the PRP to obtain an access control policy response returned by the PRP, where the access control policy response carries an access control policy based on the role for access control.
  • Step 1003 The PDP entity returns an access control decision response to the PEP entity, where the access control decision response carries the decision result.
  • Step 1101 The PIP receives the access control attribute request sent by the PDP entity, where the access control attribute request carries the role information of the initiator entity that initiates the resource access request, and the role information includes at least the role identifier.
  • Step 1102 The PIP entity queries the CSE for the role resource corresponding to the initiator entity according to the role identifier, and obtains the query result.
  • the role resource is a common resource and stores the role information of the initiator entity.
  • the role information corresponding to the role identifier is saved in the role resource corresponding to the initiator entity in the CSE, the role information is returned to the PIP as the query result; if the role resource corresponding to the initiator entity in the CSE is not If the role information corresponding to the role identifier is saved, the query result returned to the PIP is empty.
  • the initiator entity may have multiple role resources, and the CSE queries each role resource corresponding to the initiator entity according to the role identifier, determines the role resource corresponding to the role identifier, and lists the role information saved in the role resource. The form is returned to the PIP.
  • Step 1103 The PIP entity returns an access control attribute response to the PDP entity, where the access control attribute response carries the query result.
  • Step 1201 The role issuing entity sends a role resource creation or maintenance request to the registration resource of the Originator in the Registrar CSE, where the request includes the values of the role attributes such as roleID, issuer, startTime, expiryTime, roleType, roleName, and appCategory created or modified.
  • the role attributes such as roleID, issuer, startTime, expiryTime, roleType, roleName, and appCategory created or modified.
  • Step 1202 After receiving the role resource creation or maintenance request sent by the Role Authority, the Registrar CSE checks the access control policy associated with the registered resource of the Originator to determine whether the Role Authority has the right to create or maintain the ⁇ role> resource. Creates or maintains the requested ⁇ role> resource based on the ⁇ role> resource attribute value provided by the role resource creation or maintenance request.
  • Step 1203 The Registrar CSE returns a role resource creation or maintenance response to the Role Authority to notify the Role Authority whether the creation or maintenance is successful.
  • Step 1204 The Originator sends a resource read request for the role resource to the registration resource of the Originator in the Registrar CSE, so as to obtain the role information that has been issued to the Originator.
  • Step 1205 The Registrar CSE returns a resource read response to the Originator, and the role read by the Originator is sent to the Originator by the role information list, and the role information includes roleID, issuer, startTime, expiryTime, roleType, roleName, and The value of a role attribute such as appCategory.
  • Step 1206 The Originator compares the application category to which the current resource access belongs and the application category to which the role belongs, selects an applicable role, and then sends a resource access request to the target resource in the Hosting CSE, where the resource access request is used to request access to the target resource. And attach the role information of the selected role to the request, and the attached role information should at least include the role identifier.
  • Step 1207 The PEP in the Hosting CSE generates an access control decision request according to the resource access request sent by the Originator.
  • the access control decision request includes the role information provided by the Originator, and sends the access control decision request to the PDP.
  • Step 1208 After receiving the access control decision request sent by the PEP, the PDP needs to check whether the role indicated by the role identifier carried in the access control decision request is actually issued to the Originator.
  • the PDP can perform the check by using the PIP, that is, the PIP sends a role resource query request to the Registrar CSE, and the role resource query request carries the role identifier to query the ⁇ role> resource in the registered resource of the Originator.
  • the PDP sends a role resource query request to the Registrar CSE.
  • the role resource query request carries the role identifier to query the ⁇ role> resource in the registered resource of the Originator to perform the check.
  • the query request should include at least the role identifier
  • the query result returned by the query may be all the information of the ⁇ role> resource, or may be part of the ⁇ role> resource, but the returned query result should be Enables the PDP to determine if the role has been issued to the Originator and is still valid.
  • Step 1209 The Registrar CSE queries the role resource of the Originator's registered resource according to the role resource query request, and sends the query result to the PIP through the role resource query response, and sends the PIP to the PDP.
  • the Registrar CSE queries the Originator according to the role resource query request.
  • the role resource under the registered resource is sent to the PDP directly through the role resource query response.
  • Step 1210 After receiving the role resource query response, the PDP first determines whether the role is actually issued to the Originator according to the query result and is still in the validity period, and then uses the access control policy and the role information of the Originator to evaluate the access control decision request sent by the PEP.
  • Step 1211 The PDP sends the evaluation result to the PEP through the access control decision response, and the access control decision response carries the evaluation result.
  • Step 1212 After receiving the access control decision response, the PEP determines whether to allow the resource access request of the Originator according to the evaluation result, and if permitted, executes the resource access request of the Originator.
  • Step 1213 The PEP returns a resource access response to the Originator, where the resource access response carries an execution result.
  • the oneM2M Application Service Provider reads the data stored in the Home Gateway through a platform provided by the oneM2M Service Provider.
  • FIG. 13 is a schematic diagram of an entity relationship involved in the specific implementation, and the entities involved are described as follows:
  • CSE1 CSE (called IN-CSE) in the infrastructure node of oneM2M Service Provider.
  • CSE2 CSE (referred to as ASN-CSE) in oneM2M Application Service Node existing in a Home Gateway.
  • AE1 For the AE registered to CSE1, the role issuing entity accesses the resources in CSE1 through AE1 and has the privilege to create a ⁇ role> resource in CSE1.
  • AE2 For the AE registered to CSE1, the oneM2M Application Service Provider accesses the resources in CSE2 through AE2.
  • the related resource tree in CSE1 is as shown in FIG. 14, wherein:
  • ⁇ CSEBase> is the root node of the CSE1 resource tree.
  • ⁇ AE2> Registered resources after AE2 is successfully registered to CSE1.
  • ⁇ role> a sub-resource created for AE1 in ⁇ AE2>, a ⁇ role> sub-resource representing a role assigned to AE2, and a ⁇ role> sub-resource describing roleID, issuer, startTime, expiryTime, roleType, roleName and Role attribute information such as roleAppCategory.
  • the pre-configuration process for role issuance and use is: oneM2M application service provider AE2 is registered in the IN-CSE (CSE1) of the oneM2M service provider, and the ⁇ AE2> resource is created.
  • Step 1501 The role issuing entity sends a role resource creation request to the ⁇ AE2> resource in the CSE1 through the AE1.
  • Step 1502 CSE1 verifies the access authority of AE1, determines that AE1 is allowed to create the ⁇ role> resource, and creates a related ⁇ role> resource under the ⁇ AE2> resource according to the attribute information of the role resource provided by AE1.
  • Step 1503 CSE1 will return a role resource creation response to AE1, and the role resource creation response is used to tell whether AE1 is successfully created.
  • Step 1504 AE2 sends a resource read request to the ⁇ role> resource of the ⁇ AE2> resource to CSE1.
  • Step 1507 The PEP in the CSE2 generates an access control decision request according to the resource access request sent by the AE2, and includes the role information provided by the AE2, and sends the access control decision request to the PDP.
  • Step 1510 The PDP determines whether the role is issued to the AE2 and is still valid within the validity period by using the role identifier and the role valid start/end time in the role information according to the queried role information. If yes, the access control policy and the AE2 are utilized.
  • Step 1511 The PDP sends the evaluation result to the PEP through the access control decision response.
  • Step 1512 The PEP determines that the resource access request of the AE2 is allowed according to the evaluation result, and then executes the resource access request of the AE2, and reads the target resource that is requested to be accessed.
  • Step 1513 The PEP sends the execution result to the AE2 through the resource access response.
  • a CSE is provided in the embodiment of the present application, where the CSE may be any CSE that holds a resource corresponding to the initiator entity, for example, may be a registration response CSE that stores the registered resource of the initiator entity.
  • the CSE mainly includes:
  • the receiving module 1601 is configured to receive a role resource creation request sent by the role issuing entity, where the role resource creation request carries role information issued to the initiator entity, where the role information includes at least the role identifier.
  • the processing module 1602 is configured to create a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and the role information is stored.
  • the receiving module 1601 is further configured to:
  • the role resource modification request sent by the role issuing entity is received, and the role resource modification request is re-issued to the Describe the role information of the initiator entity;
  • the processing module is further configured to:
  • the receiving module is further configured to:
  • a first sending module 1603 for:
  • a second sending module 1604 is further included, configured to:
  • the processing module After the processing module creates a role resource under the resource corresponding to the initiator entity according to the role information, the processing module returns a role resource creation response to the role issuing entity.
  • the third sending module 1605 is further configured to:
  • processing module is further configured to:
  • the role authorization entity is allowed to create the role resource according to the access control policy of the resource corresponding to the initiator entity.
  • processing module is further configured to:
  • a role issuing entity is also provided in the embodiment of the present application, and the role is issued by the entity.
  • the entity mainly includes:
  • the processing module 1701 is configured to generate a role resource creation request, where the role resource creation request carries the role information issued to the initiator entity, where the role information includes at least the role identifier.
  • the sending module 1702 is configured to send the role resource creation request to the public service entity CSE, where the CSE creates a role resource according to the role information, and the role resource is a common resource.
  • the role information of the initiator entity is stored.
  • the first receiving module 1703 is further configured to:
  • the sending module is further configured to:
  • processing module is further configured to:
  • the sending module is further configured to:
  • a second receiving module 1704 is further included, configured to:
  • an initiator entity is also provided in the embodiment of the present application.
  • the originating entity mainly includes:
  • the sending module 1801 is configured to send, to the public service entity CSE, a resource reading request for the role resource under the resource corresponding to the initiator entity, where the role resource is a common resource and the role information of the initiator entity is stored;
  • the receiving module 1802 is configured to receive a resource read response returned by the CSE, where the resource read response carries role information saved in the role resource, where the role information includes at least a role identifier.
  • the initiator entity is an application entity or a public service entity.
  • a PEP entity is also provided in the embodiment of the present application.
  • the PEP entity refer to the description of the method part in the foregoing method, and the repeated description is not repeated.
  • the PEP entity is shown in FIG. mainly includes:
  • the first obtaining module 1901 is configured to acquire a resource access request sent by the initiator entity, where the resource access request is Carrying role information of the initiator entity, where the role information includes at least a role identifier;
  • a generating module 1902 configured to generate an access control decision request according to the resource access request acquired by the acquiring module, where the access control decision request carries role information of the initiator entity;
  • the sending module 1903 is configured to send the access control decision request to the policy decision point PDP entity, and the PDP entity queries the role resource corresponding to the initiator entity according to the role information to obtain a query result, and the PDP is used by the PDP entity.
  • the entity determines a decision result according to the query result and the access control policy, where the role resource is a common resource and the role information of the initiator entity is stored;
  • the second obtaining module 1904 is configured to obtain an access control decision response returned by the PDP entity, where the access control decision response carries the decision result;
  • the access control module 1905 is configured to perform access control on the resource access request of the initiator entity according to the decision result.
  • the PEP entity is located in the CSE where the target resource requested by the resource access request is located.
  • a PDP entity is also provided in the embodiment of the present application.
  • the PDP entity refers to the description of the method part in the foregoing method, and the repeated description is not repeated.
  • the PDP entity is shown. mainly includes:
  • the receiving module 2001 is configured to receive an access control decision request sent by the PEP entity of the policy enforcement point, where the access control decision request carries role information of the initiator entity that initiates the resource access request, where the role information includes at least a role identifier.
  • the processing module 2002 is configured to query the role resource corresponding to the initiator entity according to the role identifier to obtain a query result, and determine a decision result according to the query result and the access control policy, where the role resource is a common resource and the The role information of the initiator entity;
  • the sending module 2003 is configured to return an access control decision response to the PEP entity, where the access control decision response carries the decision result.
  • processing module is specifically configured to:
  • the access control attribute request carries a role identifier of the initiator entity
  • the access control attribute response carries the PIP entity according to the role identifier query The result of the query obtained by the role resource corresponding to the initiator entity.
  • processing module is specifically configured to:
  • the query result carries the role information saved in the role resource, and determines that the role identifier is valid according to the role information, determining a decision result according to the access control policy and the role identifier;
  • the result of the query is determined to be empty, determining, according to the access control policy, that the result of the decision is that the resource access request of the initiator entity is not allowed; or determining that the query result carries the role information saved in the role resource. And determining, according to the role information, that the role identifier is invalid, and determining, according to the access control policy, that the decision result is that the resource access request of the initiator entity is not allowed.
  • the PIP entity mainly includes:
  • the receiving module 2101 is configured to receive an access control attribute request sent by a policy decision point PDP entity, where the access control attribute request carries role information of an initiator entity that initiates a resource access request, where the role information includes at least a role identifier.
  • the processing module 2102 is configured to query, according to the role identifier, the role resource corresponding to the initiator entity to the public service entity CSE, and obtain the query result, where the role resource is a common resource and the role information of the initiator entity is stored;
  • the sending module 2103 is configured to return an access control attribute response to the PDP entity, where the access control attribute response carries the query result.
  • the CSE may be any CSE that holds a resource corresponding to the initiator entity, or may be a registration response CSE that stores the registered resource of the initiator entity.
  • the CSE mainly includes a processor 2201, a memory 2202, and a transceiver 2203.
  • the transceiver 2203 is used to The data is received and transmitted under the control of the processor 2201, the preset program is stored in the memory 2202, and the processor 2201 reads the program stored in the memory 2202, and executes the following process according to the program:
  • a role resource is created under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and the role information is stored.
  • the processor 2201 creates a role resource under the resource corresponding to the initiator entity according to the role information, and then returns a role resource creation response to the role issuing entity through the transceiver 2203.
  • the processor 2201 creates a role under the resource corresponding to the initiator entity according to the role information.
  • the processor 2201 modifies the role information saved in the role resource according to the reissued role information.
  • the processor 2201 After modifying the role information saved in the role resource according to the reissued role information, the processor 2201 returns a role resource modification response to the role issuing entity by using the transceiver 2203.
  • the processor 2201 receives, by the transceiver 2203, a resource read request of the initiator entity for the role resource, and returns, by the transceiver 2203, a resource read response to the initiator entity, where the resource read response is The character information is carried in the middle.
  • the processor 2201 determines, according to the access control policy of the resource corresponding to the initiator entity, that the role issuing entity is created, according to the role information, before the role resource is created under the resource corresponding to the initiator entity. Describe the role resource.
  • the processor 2201 determines to allow the role issuing entity to modify the location according to the access control policy of the resource corresponding to the initiator entity before modifying the role information saved in the role resource according to the re-issued role information. Describe the role resource.
  • the role issuing entity mainly includes a processor 2301, a memory 2302, and a transceiver 2303.
  • the transceiver 2303 is configured to receive and send data under the control of the processor 2301.
  • the memory 2302 stores a preset program, and the processor 2301 reads
  • the program stored in the memory 2302 executes the following processes in accordance with the program:
  • the role resource creation request carries role information issued to the initiator entity, where the role information includes at least the role identifier;
  • the role resource creation request is sent to the public service entity CSE by the transceiver 2303, and the CSE creates a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and is stored.
  • the role information of the initiator entity is sent to the public service entity CSE by the transceiver 2303, and the CSE creates a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and is stored.
  • the role information of the initiator entity is sent to the public service entity CSE by the transceiver 2303, and the CSE creates a role resource under the resource corresponding to the initiator entity according to the role information, where the role resource is a common resource and is stored.
  • the processor 2301 receives, by the transceiver 2303, a role resource creation response returned by the CSE.
  • the processor 2301 sends the indication information of the address information of the role resource to the initiator entity by using the transceiver 2303, and sends the indication information of the address information of the role resource to the policy decision point PDP.
  • the policy decision point PDP Entity and/or policy information point PIP entity.
  • the processor 2301 generates a role resource modification request, where the role resource modification request carries role information re-issued to the initiator entity; and the role resource modification request is sent to the CSE by the transceiver 2303.
  • the processor 2301 receives, by the transceiver 2303, a role resource modification response returned by the CSE.
  • the initiator entity mainly includes a processor 2401, a memory 2402, and a transceiver 2403.
  • the transceiver 2403 is configured to receive and send data under the control of the processor 2401.
  • the memory 2402 stores a preset program, and the processor 2401 reads
  • the program stored in the memory 2402 executes the following processes in accordance with the program:
  • the initiator entity is an application entity or a public service entity.
  • a PEP entity is also provided in the embodiment of the present application.
  • the PEP entity is shown in FIG. It mainly includes a processor 2501 for receiving and transmitting data under the control of the processor 2501, a preset program stored in the memory 2502, and a processor 2501 reading the memory 2502.
  • the saved program according to the program performs the following process:
  • the access control decision request is sent by the transceiver 2503 to the policy decision point PDP entity, and the PDP entity queries the role resource corresponding to the initiator entity according to the role information to obtain a query result, and is determined by the PDP entity according to the PDP entity.
  • the query result and the access control policy determine a decision result, where the role resource is a common resource and the role information of the initiator entity is stored;
  • the PEP entity is located in the CSE where the target resource requested by the resource access request is located.
  • a PDP entity is also provided in the embodiment of the present application.
  • the processor 2601 includes a processor 2601, a memory 2602, and a transceiver 2603.
  • the transceiver 2603 is used in the processor 2601. Receiving and transmitting data under the control, a preset program is stored in the memory 2602, and the processor 2601 reads the program stored in the memory 2602, and executes the following process according to the program:
  • an access control decision request sent by the policy enforcement point PEP entity where the access control decision request carries the role information of the initiator entity that initiates the resource access request, where the role information includes at least the role identifier;
  • An access control decision response is returned to the PEP entity by the transceiver 2603, and the access control decision response carries the decision result.
  • the processor 2601 sends a query request for the role resource of the initiator entity to the public service entity CSE through the transceiver 2603, and obtains a query result returned by the CSE by using the transceiver 2603, where the query request is carried.
  • the role identifier ;
  • the access control attribute response carries a query result obtained by the PIP entity querying a role resource corresponding to the initiator entity according to the role identifier.
  • the processor 2601 determines, if the query result carries the role information saved in the role resource, and determines that the role identifier is valid according to the role information, determining, according to the access control policy and the role identifier. Decision result
  • the result of the query is determined to be empty, determining, according to the access control policy, that the result of the decision is that the resource access request of the initiator entity is not allowed; or determining that the query result carries the role information saved in the role resource. And determining, according to the role information, that the role identifier is invalid, and determining, according to the access control policy, that the decision result is that the resource access request of the initiator entity is not allowed.
  • the PIP entity mainly includes a processor 2701. 2702 and a transceiver 2703, wherein the transceiver 2703 is configured to receive and transmit data under the control of the processor 2701, a preset program is stored in the memory 2702, and the processor 2701 reads the program saved in the memory 2702, according to the program. Perform the following process:
  • the access control attribute request carries the role information of the initiator entity that initiates the resource access request, and the role information includes at least the role identifier.
  • the access control attribute response is returned to the PDP entity by the transceiver 2703, and the access control attribute response carries the query result.
  • the bus architecture may include any number of interconnected buses and bridges, and the various circuits of the memory represented by one or more processors and memories represented by the processor are together.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the bus interface provides an interface.
  • the transceiver can be a plurality of components, including a transmitter and a transceiver, providing means for communicating with various other devices on a transmission medium.
  • the processor is responsible for managing the bus architecture and the usual processing, and the memory can store the data that the processor uses when performing operations.
  • the role resource is created by using the resource corresponding to the initiator entity, and the role resource is a common resource and is used to save the role information, and the role information includes at least the role identifier, so that the The operation of the role resource obtains the role information saved in the role resource, and implements role-based access control in oneM2M based on the obtained role information.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory include instructions.
  • the instruction means implements the functions specified in a block or blocks of a flow or a flow and/or a block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种角色颁发方法、访问控制方法及相关设备，用以为oneM2M提供基于角色的访问控制。角色颁发方法为：CSE接收角色颁发实体发送的角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述角色信息。

Description

角色颁发方法、访问控制方法及相关设备
本申请要求在2015年11月03日提交中国专利局、申请号为201510736941.6、申请名称为“角色颁发方法、访问控制方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种角色颁发方法、访问控制方法及相关设备。
背景技术
物联网标准化组织oneM2M致力于开发用于构造一个公共的机器对机器通信(Machine-To-Machine，M2M)服务层(Service Layer)的技术规范。
oneM2M功能架构如图1所示，定义了三种基本实体：
一，应用实体(Application Entity，AE)，位于应用层，该实体可实现一个M2M应用服务逻辑。一个应用服务逻辑既可以驻留在多个M2M节点中，也可以在单个节点中存在多个执行实例。应用服务逻辑的每个执行实例被称为一个应用实体，每个应用实体由唯一的AE身份标识(AE-ID)标识。
例如，车队跟踪应用实例、远程血糖监测应用实例、远程电力计量实例或控制应用实例等都属于应用实体。
二，公共服务实体(Common Services Entity，CSE)，一个公共服务实体由一组M2M环境中的公共服务功能(common service functions)构成。公共服务功能通过参考点Mca和参考点Mcc公开给其他实体。参考点Mcn用于访问底层网络服务实体。每个公共服务实体由唯一的CSE-ID标识。
三，底层网络服务实体(Underlying Network Services Entity，NSE)，一个底层网络服务实体向多个CSE提供底层网络服务，例如提供设备管理、位置服务和设备触发服务。
oneM2M通过对标准化的资源树的操作实现服务层资源共享和交互。oneM2M资源树存在于oneM2M系统定义的CSE中。
根据oneM2M TS-0001中关于功能架构的定义，oneM2M资源树的形式如图2所示。其中，CSEBase1表示一个CSE根资源<CSEBase>，CSE1表示一个资源<remoteCSE>，APP1表示一个资源<AE>，CONT1和CONT2分别代表一个资源<container>，ACP1和ACP2分别代表一个资源<accessControlPolicy>。对于oneM2M资源可进行创建(Create，简称C)、 查询(Retrieve，简称R)、修改(Update，简称U)和删除(Delete，简称D)等操作。
oneM2M定义的资源中与授权相关的资源为访问控制策略资源<accessControlPolicy>，其中定义有访问控制策略(Access Control Policy，ACP)，<accessControlPolicy>资源由资源身份标识(ID)唯一标识。其他资源通过资源中的accessControlPolicyIDs属性指定适用的访问控制策略。<accessControlPolicy>资源中的特权(privileges)属性用于存储具体的访问控制规则，自我管理特权(selfPrivileges)属性用于存储维护<accessControlPolicy>资源的访问控制规则。
oneM2M安全解决技术规范oneM2M TS-0003中给出了授权架构和访问控制策略的评估。如图3所示的授权架构中，各授权组件的功能为：
策略执行点(Policy Enforcement Point，PEP)，与需要访问控制的应用系统共存，并由应用系统调用。PEP根据用户的访问请求生成相应的访问控制决策请求，发送给策略决策点(Policy Decision Point，PDP)，并根据PDP的访问控制决策应答确定是否执行用户的访问请求。
策略决策点(Policy Decision Point，PDP)，负责根据访问控制策略评估是否同意由PEP发送来的访问控制决策请求，并将评估结果通过访问控制决策应答返回给PEP。
策略获取点(Policy Retrieval Point，PRP)，根据PDP提供的策略请求获取适用的访问控制策略，并将获取的访问控制策略返回给PDP。
策略信息点(Policy Information Point，PIP)，根据PDP的请求获取与用户、资源或环境相关的属性，例如访问用户的互联网协议(IP)地址、资源的创建者、当前的时间等，然后将获得的各种属性返回给PDP。
oneM2M的基本授权流程如下：
1、PEP根据用户的访问请求生成访问控制决策请求(Access Control Decision Request)发送给PDP；
2、PDP根据PEP的访问控制决策请求向PRP发送访问控制策略请求(Access Control Policy Request)；
3、PDP分析由PRP返回的访问控制策略和PEP的访问控制决策请求中提供的内容，若需要其他属性，则向PIP发送访问控制属性请求(Access Control Attribute Request)，否则执行步骤5。
4、PIP根据PDP的访问控制属性请求获取相应的与访问控制相关的属性，并返回给PDP。
5、PDP根据确定适用的访问控制策略，并通过该访问控制决策应答(Access Control  Attribute Response)返回给PEP。
6、PEP根据访问控制决策应答中的访问控制策略决定是否执行用户的访问请求。
oneM2M第二阶段(Release 2)将研究和制定授权架构各组成部分之间的接口，并将支持更多种类的访问控制策略，例如基于角色的访问控制，基于属性的访问控制等。目前已经明确了Release 2中将支持基于角色的访问控制这一新特性，但是如何实现基于角色的访问控制，尚没有解决方案。
发明内容
本申请实施例提供一种角色颁发方法、访问控制方法及相关设备，用以为oneM2M提供基于角色的访问控制。
本申请实施例提供的具体技术方案如下：
第一方面，提供了一种角色颁发方法，包括：
公共服务实体CSE接收角色颁发实体发送的角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述角色信息。
可选地，所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，还包括：
所述CSE向所述角色颁发实体返回角色资源创建响应。
可选地，所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，还包括：
所述CSE接收所述角色颁发实体发送的角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息。
可选地，所述CSE根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息后，还包括：
所述CSE向所述角色颁发实体返回角色资源修改响应。
可选地，所述方法还包括：
所述CSE接收所述发起方实体对所述角色资源的资源读取请求；
所述CSE向所述发起方实体返回资源读取响应，所述资源读取响应中携带所述角色信息。
可选地，所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源之前，还包括：
所述CSE根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体创建所述角色资源。
可选地，所述CSE根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息之前，还包括：
所述CSE根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体修改所述角色资源。
可选地，所述角色资源具有普通资源的通用属性，还具有指定失效时间的公共属性以及签约子资源。
可选地，所述角色资源具有角色标识属性、角色颁发者标识属性、角色有效起始时间属性以及角色有效结束时间属性，所述角色标识属性用于保存角色标识，所述角色颁发者标识属性用于保存角色颁发者标识，所述角色有效起始时间属性用于保存角色有效起始时间，所述角色有效结束时间属性用于保存角色有效结束时间。
可选地，所述角色资源还具有角色类型属性、角色名字属性以及应用类别属性中的任意一种或多种，所述角色类型属性用于保存角色类型，所述角色名字属性用于保存角色可阅读名字，所述应用类别属性用于保存角色所属的应用类别。
第二方面，提供了一种角色颁发方法，包括：
角色颁发实体生成角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
所述角色颁发实体向公共服务实体CSE发送所述角色资源创建请求，由所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述发起方实体的角色信息。
可选地，所述角色颁发实体向所述CSE发送所述角色资源创建请求之后，还包括：
所述角色颁发实体接收所述CSE返回的角色资源创建响应。
可选地，所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源之后，还包括：
所述角色颁发实体将所述角色资源的地址信息的指示信息发送给所述发起方实体，以及将所述角色资源的地址信息的指示信息发送给所述策略决策点PDP实体和/或策略信息点PIP实体。
可选地，所述角色颁发实体向所述CSE发送所述角色资源创建请求之后，还包括：
所述角色颁发实体生成角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
所述角色颁发实体向所述CSE发送所述角色资源修改请求。
可选地，所述角色颁发实体向所述CSE发送所述角色资源修改请求之后，还包括：
所述角色颁发实体接收所述CSE返回的角色资源修改响应。
可选地，所述角色资源具有普通资源的通用属性，还具有指定失效时间的公共属性以及签约子资源。
可选地，所述角色资源具有角色标识属性、角色颁发者标识属性、角色有效起始时间属性以及角色有效结束时间属性，所述角色标识属性用于保存角色标识，所述角色颁发者标识属性用于保存角色颁发者标识，所述角色有效起始时间属性用于保存角色有效起始时间，所述角色有效结束时间属性用于保存角色有效结束时间。
可选地，所述角色资源还具有角色类型属性、角色名字属性以及应用类别属性中的任意一种或多种，所述角色类型属性用于保存角色类型，所述角色名字属性用于保存角色可阅读名字，所述应用类别属性用于保存角色所属的应用类别。
第三方面，提供了一种角色颁发方法，包括：
发起方实体向公共服务实体CSE发送对发起方实体对应的资源下的角色资源的资源读取请求，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
所述发起方实体接收所述CSE返回的资源读取响应，所述资源读取响应中携带所述角色资源中保存的角色信息，所述角色信息至少包括角色标识。
可选地，所述角色资源具有普通资源的通用属性，还具有指定失效时间的公共属性以及签约子资源。
可选地，所述角色资源具有角色标识属性、角色颁发者标识属性、角色有效起始时间属性以及角色有效结束时间属性，所述角色标识属性用于保存角色标识，所述角色颁发者标识属性用于保存角色颁发者标识，所述角色有效起始时间属性用于保存角色有效起始时间，所述角色有效结束时间属性用于保存角色有效结束时间。
可选地，所述角色资源还具有角色类型属性、角色名字属性以及应用类别属性中的任意一种或多种，所述角色类型属性用于保存角色类型，所述角色名字属性用于保存角色可阅读名字，所述应用类别属性用于保存角色所属的应用类别。
第四方面，提供了一种访问控制方法，包括：
策略执行点PEP实体获取发起方实体发送的资源访问请求，所述资源访问请求中携带所述发起方实体的角色信息，所述角色信息至少包括角色标识；
所述PEP实体根据所述资源访问请求生成访问控制决策请求，所述访问控制决策请求中携带所述发起方实体的角色信息；
所述PEP实体将所述访问控制决策请求发送给策略决策点PDP实体，由所述PDP实体根据所述角色信息查询所述发起方实体对应的角色资源获得查询结果，并由所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
所述PEP实体获取所述PDP实体返回的访问控制决策应答，所述访问控制决策应答中携带所述决策结果；
所述PEP根据所述决策结果对所述发起方实体的资源访问请求进行访问控制。
可选地，所述角色资源具有普通资源的通用属性，还具有指定失效时间的公共属性以及签约子资源。
可选地，所述角色资源具有角色标识属性、角色颁发者标识属性、角色有效起始时间属性以及角色有效结束时间属性，所述角色标识属性用于保存角色标识，所述角色颁发者标识属性用于保存角色颁发者标识，所述角色有效起始时间属性用于保存角色有效起始时间，所述角色有效结束时间属性用于保存角色有效结束时间。
可选地，所述角色资源还具有角色类型属性、角色名字属性以及应用类别属性中的任意一种或多种，所述角色类型属性用于保存角色类型，所述角色名字属性用于保存角色可阅读名字，所述应用类别属性用于保存角色所属的应用类别。
可选地，所述资源访问请求中携带的所述发起方实体的角色标识，为根据本次资源访问所属的应用类别以及所述角色所属的应用类别确定。
第五方面，提供了一种访问控制方法，包括：
策略决策点PDP实体接收策略执行点PEP实体发送的访问控制决策请求，所述访问控制决策请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
所述PDP实体根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
所述PDP实体向所述PEP实体返回访问控制决策应答，所述访问控制决策应答中携带所述决策结果。
可选地，所述PDP实体根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，包括：
所述PDP实体向公共服务实体CSE发送对所述发起方实体的角色资源的查询请求，并获得所述CSE返回的查询结果，所述查询请求中携带所述角色标识；
或者，
所述PDP实体向策略信息点PIP实体发送访问控制属性请求，所述访问控制属性请求中携带所述发起方实体的角色标识，并接收所述PIP实体返回的访问控制属性响应，所述访问控制属性响应中携带所述PIP实体根据所述角色标识查询所述发起方实体对应的角色资源获得的查询结果。
可选地，所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，包括：
所述PDP实体若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识有效，根据所述访问控制策略以及所述角色标识确定决策结果；
所述PDP实体若确定所述查询结果为空，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求；或者，若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识无效，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求。
可选地，所述角色资源具有普通资源的通用属性，还具有指定失效时间的公共属性以及签约子资源。
可选地，所述角色资源具有角色标识属性、角色颁发者标识属性、角色有效起始时间属性以及角色有效结束时间属性，所述角色标识属性用于保存角色标识，所述角色颁发者标识属性用于保存角色颁发者标识，所述角色有效起始时间属性用于保存角色有效起始时间，所述角色有效结束时间属性用于保存角色有效结束时间。
可选地，所述角色资源还具有角色类型属性、角色名字属性以及应用类别属性中的任意一种或多种，所述角色类型属性用于保存角色类型，所述角色名字属性用于保存角色可阅读名字，所述应用类别属性用于保存角色所属的应用类别。
第六方面，提供了一种访问控制方法，包括：
策略信息点PIP实体接收策略决策点PDP实体发送的访问控制属性请求，所述访问控制属性请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
所述PIP实体根据所述角色标识向公共服务实体CSE查询所述发起方实体对应的角色资源并获取查询结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
所述PIP实体向所述PDP实体返回访问控制属性响应，所述访问控制属性响应中携带 所述查询结果。
可选地，所述角色资源具有普通资源的通用属性，还具有指定失效时间的公共属性以及签约子资源。
可选地，所述角色资源具有角色标识属性、角色颁发者标识属性、角色有效起始时间属性以及角色有效结束时间属性，所述角色标识属性用于保存角色标识，所述角色颁发者标识属性用于保存角色颁发者标识，所述角色有效起始时间属性用于保存角色有效起始时间，所述角色有效结束时间属性用于保存角色有效结束时间。
可选地，所述角色资源还具有角色类型属性、角色名字属性以及应用类别属性中的任意一种或多种，所述角色类型属性用于保存角色类型，所述角色名字属性用于保存角色可阅读名字，所述应用类别属性用于保存角色所属的应用类别。
第七方面，提供了一种公共服务实体CSE，包括：
接收模块，用于接收角色颁发实体发送的角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
处理模块，用于根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述角色信息。
可选地，所述接收模块还用于：
在所述处理模块根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，接收所述角色颁发实体发送的角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
所述处理模块还用于：
根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息。
还包括第一发送模块，用于：
向所述发起方实体返回资源读取响应，所述资源读取响应中携带所述角色信息。
可选地，还包括第二发送模块，用于：
在所述处理模块根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，向所述角色颁发实体返回角色资源创建响应。
可选地，还包括第三发送模块，用于：
在所述处理模块根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息后，向所述角色颁发实体返回角色资源修改响应。
可选地，所述接收模块还用于：
接收所述发起方实体对所述角色资源的资源读取请求；
可选地，所述处理模块还用于：
根据所述角色信息在所述发起方实体对应的资源下创建角色资源之前，根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体创建所述角色资源。
可选地，所述处理模块还用于：
根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息之前，根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体修改所述角色资源。
第八方面，提供了一种角色颁发实体，包括：
处理模块，用于生成角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
发送模块，用于向公共服务实体CSE发送所述角色资源创建请求，由所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述发起方实体的角色信息。
可选地，还包括第一接收模块，用于：
接收所述CSE返回的角色资源创建响应。
可选地，所述发送模块还用于：
将所述角色资源的地址信息的指示信息发送给所述发起方实体，以及将所述角色资源的地址信息的指示信息发送给所述策略决策点PDP实体和/或策略信息点PIP实体。
可选地，所述处理模块还用于：
生成角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
所述发送模块还用于：
向所述CSE发送所述角色资源修改请求。
可选地，还包括第二接收模块，用于：
接收所述CSE返回的角色资源修改响应。
第九方面，提供了一种发起方实体，包括：
发送模块，用于向公共服务实体CSE发送对发起方实体对应的资源下的角色资源的资源读取请求，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
接收模块，用于接收所述CSE返回的资源读取响应，所述资源读取响应中携带所述角色资源中保存的角色信息，所述角色信息至少包括角色标识。
可选地，所述发起方实体为应用实体或公共服务实体。
第十方面，提供了一种策略执行点PEP实体，包括：
第一获取模块，用于获取发起方实体发送的资源访问请求，所述资源访问请求中携带所述发起方实体的角色信息，所述角色信息至少包括角色标识；
生成模块，用于根据所述获取模块获取的所述资源访问请求生成访问控制决策请求，所述访问控制决策请求中携带所述发起方实体的角色信息；
发送模块，用于将所述访问控制决策请求发送给策略决策点PDP实体，由所述PDP实体根据所述角色信息查询所述发起方实体对应的角色资源获得查询结果，并由所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
第二获取模块，用于获取所述PDP实体返回的访问控制决策应答，所述访问控制决策应答中携带所述决策结果；
访问控制模块，用于根据所述决策结果对所述发起方实体的资源访问请求进行访问控制。
第十一方面，提供了一种策略决策点PDP实体，包括：
接收模块，用于接收策略执行点PEP实体发送的访问控制决策请求，所述访问控制决策请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
处理模块，用于根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
发送模块，用于向所述PEP实体返回访问控制决策应答，所述访问控制决策应答中携带所述决策结果。
可选地，所述处理模块具体用于：
通过所述发送模块向公共服务实体CSE发送对所述发起方实体的角色资源的查询请求，并通过所述接收模块获得所述CSE返回的查询结果，所述查询请求中携带所述角色标识；
或者，
通过所述发送模块向策略信息点PIP实体发送访问控制属性请求，所述访问控制属性请求中携带所述发起方实体的角色标识，并通过所述接收模块接收所述PIP实体返回的访问控制属性响应，所述访问控制属性响应中携带所述PIP实体根据所述角色标识查询所述发起方实体对应的角色资源获得的查询结果。
可选地，所述处理模块具体用于：
若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识有效，根据所述访问控制策略以及所述角色标识确定决策结果；
若确定所述查询结果为空，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求；或者，若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识无效，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求。
第十二方面，提供了一种策略信息点PIP实体，包括：
接收模块，用于接收策略决策点PDP实体发送的访问控制属性请求，所述访问控制属性请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
处理模块，用于根据所述角色标识向公共服务实体CSE查询所述发起方实体对应的角色资源并获取查询结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
发送模块，用于向所述PDP实体返回访问控制属性响应，所述访问控制属性响应中携带所述查询结果。
第十三方面，提供了一种公共服务实体CSE，包括处理器、存储器和收发机，其中，收发机用于在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
通过收发机接收角色颁发实体发送的角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述角色信息。
可选地，处理器根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，通过收发机向所述角色颁发实体返回角色资源创建响应。
可选地，处理器根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，通过收发机接收所述角色颁发实体发送的角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息。
可选地，处理器根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息后，通过收发机向所述角色颁发实体返回角色资源修改响应。
可选地，处理器通过收发机接收所述发起方实体对所述角色资源的资源读取请求；
以及通过收发机向所述发起方实体返回资源读取响应，所述资源读取响应中携带所述 角色信息。
可选地，处理器根据所述角色信息在所述发起方实体对应的资源下创建角色资源之前，根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体创建所述角色资源。
可选地，处理器根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息之前，根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体修改所述角色资源。
第十四方面，提供了一种角色颁发实体，包括处理器、存储器和收发机，其中收发机用于在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
生成角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
通过收发机向公共服务实体CSE发送所述角色资源创建请求，由所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述发起方实体的角色信息。
可选地，处理器通过收发机接收所述CSE返回的角色资源创建响应。
可选地，处理器通过收发机将所述角色资源的地址信息的指示信息发送给所述发起方实体，以及将所述角色资源的地址信息的指示信息发送给所述策略决策点PDP实体和/或策略信息点PIP实体。
可选地，处理器生成角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
通过收发机向所述CSE发送所述角色资源修改请求。
可选地，处理器通过收发机接收所述CSE返回的角色资源修改响应。
第十五方面，提供了一种发起方实体，包括处理器、存储器和收发机，其中收发机在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
通过收发机向公共服务实体CSE发送对发起方实体对应的资源下的角色资源的资源读取请求，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
通过收发机接收所述CSE返回的资源读取响应，所述资源读取响应中携带所述角色资源中保存的角色信息，所述角色信息至少包括角色标识。
可选地，所述发起方实体为应用实体或公共服务实体。
第十六方面，提供了一种策略执行点PEP实体，包括处理器、存储器和收发机，其中收发机在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
通过收发机获取发起方实体发送的资源访问请求，所述资源访问请求中携带所述发起方实体的角色信息，所述角色信息至少包括角色标识；
根据所述获取模块获取的所述资源访问请求生成访问控制决策请求，所述访问控制决策请求中携带所述发起方实体的角色信息；
通过收发机将所述访问控制决策请求发送给策略决策点PDP实体，由所述PDP实体根据所述角色信息查询所述发起方实体对应的角色资源获得查询结果，并由所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
通过收发机获取所述PDP实体返回的访问控制决策应答，所述访问控制决策应答中携带所述决策结果；
根据所述决策结果对所述发起方实体的资源访问请求进行访问控制。
第十七方面，提供了一种策略决策点PDP实体，包括处理器、存储器和收发机，其中收发机在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
通过收发机接收策略执行点PEP实体发送的访问控制决策请求，所述访问控制决策请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
通过收发机向所述PEP实体返回访问控制决策应答，所述访问控制决策应答中携带所述决策结果。
可选地，处理器通过收发机向公共服务实体CSE发送对所述发起方实体的角色资源的查询请求，并通过收发机获得所述CSE返回的查询结果，所述查询请求中携带所述角色标识；
或者，
通过收发机向策略信息点PIP实体发送访问控制属性请求，所述访问控制属性请求中携带所述发起方实体的角色标识，并通过收发机接收所述PIP实体返回的访问控制属性响应，所述访问控制属性响应中携带所述PIP实体根据所述角色标识查询所述发起方实体对 应的角色资源获得的查询结果。
可选地，处理器若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识有效，根据所述访问控制策略以及所述角色标识确定决策结果；
若确定所述查询结果为空，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求；或者，若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识无效，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求。
第十八方面，提供了一种策略信息点PIP实体，包括处理器、存储器和收发机，其中收发机在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
通过收发机接收策略决策点PDP实体发送的访问控制属性请求，所述访问控制属性请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
根据所述角色标识向公共服务实体CSE查询所述发起方实体对应的角色资源并获取查询结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
通过收发机向所述PDP实体返回访问控制属性响应，所述访问控制属性响应中携带所述查询结果。
基于上述技术方案，本申请实施例中，通过在发起方实体对应的资源下创建角色资源，该角色资源为普通资源且用于保存角色信息，该角色信息至少包括角色标识，从而能够通过对该角色资源的操作获取该角色资源中保存的角色信息，基于获取的角色信息在oneM2M中实现基于角色的访问控制。
附图说明
图1为oneM2M功能架构示意图；
图2为oneM2M资源树的结构示意图；
图3为oneM2M授权架构示意图；
图4为本申请实施例中角色资源的基本结构示意图；
图5为本申请实施例中<AE>资源结构示意图；
图6为本申请实施例中CSE执行角色颁发的方法流程示意图；
图7为本申请实施例中角色颁发实体执行角色颁发的方法流程示意图；
图8为本申请实施例中发起方实体执行角色颁发的方法流程示意图；
图9为本申请实施例中PEP实体进行访问控制的方法流程示意图；
图10为本申请实施例中PDP实体进行访问控制的方法流程示意图；
图11为本申请实施例中PIP实体进行访问控制的方法流程示意图；
图12为本申请实施例中角色颁发及使用的过程示意图；
图13为本申请实施例中实体关系示意图；
图14为本申请实施例中CSE1中相关的资源树的结构示意图；
图15为本申请实施例中另一角色颁发及使用的过程示意图；
图16为本申请实施例中CSE的结构示意图；
图17为本申请实施例中角色颁发实体的结构示意图；
图18为本申请实施例中发起方实体的结构示意图；
图19为本申请实施例中PEP实体的结构示意图；
图20为本申请实施例中PDP实体的结构示意图；
图21为本申请实施例中PIP实体的结构示意图；
图22为本申请实施例中另一CSE的结构示意图；
图23为本申请实施例中另一角色颁发实体的结构示意图；
图24为本申请实施例中另一发起方实体的结构示意图；
图25为本申请实施例中另一PEP实体的结构示意图；
图26为本申请实施例中另一PDP实体的结构示意图；
图27为本申请实施例中另一PIP实体的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本申请保护的范围。
本申请实施例中定义了一种oneM2M资源用以实现基于角色的访问控制。
定义的资源为角色资源<role>，用于在CSE资源树中存储角色信息。具体地，<role>资源可以位于oneM2M基础设施节点IN-CSE中的<CSEBase>、<remoteCSE>、<AE>等资源下，即角色资源创建在发起方实体相关联的资源中，以便这些资源能够使用自身对应的<role>资源存储赋给自身的角色信息。一个IN-CSE中的<CSEBase>、<remoteCSE>或<AE>资源下，可以有一个或多个角色资源实例，一个角色资源实例表示一个角色。角色资源中 存储的角色为分配给该角色资源对应的实体的角色。一个角色资源中至少存储有角色的角色标识。
定义<role>资源的基本结构如图4所示，其资源类型为oneM2M普通资源(Normal Resource)，oneM2M普通资源具有具体的资源结构以及资源属性。<role>资源除包含oneM2M普通资源的通用属性(Univesal Attribute)外，还包含用于指定失效时间(expirationTime)的公共属性(Common Attribute)和oneM2M已经定义的签约<subscription>子资源。定义每个<role>资源实例用于描述一个角色。图4中的数字表示对应的资源属性的个数或者对应的子资源的个数。
<role>资源的资源属性的具体用途定义为：
角色标识(roleID)属性：用户保存角色标识；
角色颁发者标识(issuer)属性：用于保存角色颁发者标识；
角色有效起始时间(startTime)属性：用于保存角色有效起始时间；
角色有效结束时间(expiryTime)属性：用于保存角色有效结束时间；
角色类型(roleType)属性：用于区分该角色是由oneM2M服务提供商(M2M Service Provider)定义的服务签约角色(Service Subscription Role)，还是由oneM2M应用服务提供商(M2M Application Service Provider)定义的与某具体应用相关的角色；
角色名字(roleName)属性：用于保存角色的可阅读名字；
应用类别(appCategory)属性：用于保存角色所属的应用类别，也即该角色的应用范围，例如设备管理应用，智能家居应用，智能交通应用等。
其中，<role>资源至少具有roleID属性，还可能具有issuer、startTime、expiryTime属性。除此之外，roleType属性、roleName属性和appCategory属性为可选的资源属性，即一个角色资源可以具有roleType属性、roleName属性和appCategory属性中的任意一种或多种。
定义<AE>资源的结构如图5所示，仅是在现有<AE>资源中增加了<role>资源为子资源，<AE>资源下<role>子资源的数量可以为零或n个，n大于等于1，用于表示赋给AE的角色。同理，<CSEBase>资源和<remoteCSE>资源的定义与<AE>资源的定义相似，在<CSEBase>资源下增加了<role>资源为子资源，在<remoteCSE>资源增加了<role>资源为子资源，<CSEBase>资源或<remoteCSE>资源下<role>子资源的数量可以为零或n个，n大于等于1。
与基于角色的访问控制相关的实体定义如下：
角色颁发(Role Authority)实体：负责向AE或CSE颁发角色，且具有在发起方实体 对应的资源(如发起方的注册资源)下创建<role>子资源的能力；
发起方(Originator)实体：为AE或CSE，是角色颁发的对象，用于使用角色进行资源访问；
注册响应CSE(Registrar CSE)：Originator注册至该CSE，也即Originator的注册资源创建于该CSE中；
宿主CSE(Hosting CSE)：Originator想要访问的资源存在于该CSE的资源树中，在实际应用中Registrar CSE和Hosting CSE可以为同一个CSE，也可以是不同的CSE；
策略执行点(PEP)实体：负责根据访问控制决策执行用户的访问请求，PEP存在于Host CSE中；
策略决策点(PDP)实体：负责利用访问控制策略评估用户的访问请求，并做出访问控制决策；
策略信息点(PIP)实体：负责获取与访问控制相关的属性。
在实际应用中，PDP可以通过PIP获取所需要的属性，也可以直接从发起方对应的资源中获取所需的信息。发起方实体对应的资源是指发起方实体相关联的资源。本申请各实施例中，发起方对应的资源下创建有角色资源，或者需要在发起方对应的资源下创建或修改角色资源。
基于以上定义，本申请实施例中，如图6所示，以存储有发起方实体对应的资源的CSE为执行主体，该CSE可以是存储有发起方实体的注册资源的实体，也可以是存储有发起方的非注册资源的实体，角色颁发的详细方法流程如下：
步骤601：CSE接收角色颁发实体发送的角色资源创建请求，该角色资源创建请求中携带颁发给发起方实体的角色信息，该角色信息至少包括角色标识。
步骤602：CSE根据该角色信息在该发起方实体对应的资源下创建角色资源，该角色资源为普通资源且存储有该角色信息。
可选地，CSE根据角色信息在发起方实体对应的资源下创建角色资源后，向角色颁发实体返回角色资源创建响应，该角色资源创建响应用于通知角色颁发实体该角色资源是否创建成功。
可选地，CSE在创建角色资源后还可以对角色资源进行修改，具体为：
CSE根据角色信息在发起方实体对应的资源下创建角色资源后，接收角色颁发实体发送的角色资源修改请求，该角色资源修改请求中携带重新颁发给该发起方实体的角色信息；根据重新颁发的该角色信息修改角色资源中保存的角色信息。
可选地，CSE根据重新颁发的角色信息修改角色资源中保存的角色信息后，向角色颁 发实体返回角色资源修改响应，该角色资源修改响应用于通知角色颁发实体该角色资源是否修改成功。
可选地，CSE接收发起方实体对角色资源的资源读取请求；向该发起方实体返回资源读取响应，该资源读取响应中携带角色信息。
实施中，若发起方实体对应的资源为该发起方实体的注册资源，则保存有该注册资源的CSE为注册响应CSE。
可选地，CSE根据与发起方实体对应的资源相关联的访问控制策略对与该资源相关的操作进行访问控制。具体地，CSE根据角色信息在发起方实体对应的资源下创建角色资源之前，根据发起方实体对应的资源的访问控制策略，确定允许该角色颁发实体创建角色资源。具体地，CSE根据重新颁发的角色信息修改角色资源中保存的角色信息之前，根据发起方实体对应的资源的访问控制策略，确定允许角色颁发实体修改该角色资源。实施中，与发起方实体对应的资源相关联的访问控制策略指定了允许访问该资源的实体。
基于以上定义，本申请实施例中，如图7所示，角色颁发实体进行角色颁发的详细方法流程如下：
步骤701：角色颁发实体生成角色资源创建请求，该角色资源创建请求中携带颁发给发起方实体的角色信息，该角色信息至少包括角色标识。
具体地，角色资源创建请求中携带的角色信息中除了包括角色标识外，还可能包括角色颁发者标识、角色有效起始时间、角色有效结束时间，可选地，还可能包括角色类型、角色可阅读名字以及角色所属的应用类别中的一种或多种。
步骤702：角色颁发实体向CSE发送角色资源创建请求，由该CSE根据该角色信息在该发起方实体对应的资源下创建角色资源，该角色资源为普通资源且存储有该发起方实体的角色信息。
其中，CSE保存有发起方实体对应的资源，若发起方实体对应的资源为注册资源，则该CSE为注册响应CSE，若发起方实体对应的资源不是注册资源，则该CSE为任意一个保存有发起方实体对应的资源且能够在该资源下创建角色资源的实体。
可选地，角色颁发实体向CSE发送角色资源创建请求之后，接收该CSE返回的角色资源创建响应，该角色资源创建响应用于指示是否成功创建角色资源。
实施中，若发起方实体对应的资源不是发起方实体的注册资源，则角色颁发实体将创建的角色资源的地址信息的指示信息发送给该发起方实体；以及将该发起方实体创建的角色资源的地址信息的指示信息发送给PDP实体和/或PIP实体。具体地，角色资源的地址信息的指示信息可以是角色资源的地址信息，或者是该角色资源的上一级资源的地址信息 等，其中角色资源的上一级资源为发起方实体相关联的资源。
可选地，角色颁发实体在CSE中发起方实体对应的资源下成功创建角色资源后，还可以对该角色资源进行修改，具体地，角色颁发实体生成角色资源修改请求，该角色资源修改请求中携带重新颁发给所述发起方实体的角色信息，向CSE发送该角色资源修改请求。
可选地，角色颁发实体向CSE发送角色资源修改请求之后，接收CSE返回的角色资源修改响应，该角色资源修改响应用于指示是否成功修改角色资源。
以上实施例中，通过在发起方实体对应的资源下创建角色资源，并在角色资源中保存角色信息，使得PEP实体获取发起方实体的携带角色信息的资源访问请求后，通过PDP实体从该发起方实体对应的角色资源中查询角色信息，获得查询结果，PDP实体根据该查询结果以及资源访问请求中携带的角色信息，确定资源访问请求中携带的角色信息是否确实颁发给了该发起方实体，若确定颁发给了该发起方实体，则根据访问控制策略确定对该资源访问请求的决策结果，从而实现基于角色的访问控制。
基于以上技术方案，本申请实施例中，如图8所示，发起方实体获取颁发的角色信息的过程如下：
步骤801：发起方实体向CSE发送对发起方实体对应的资源下的角色资源的资源读取请求，该角色资源为普通资源且存储有所述发起方实体的角色信息。
其中，CSE保存有发起方实体对应的资源，若发起方实体对应的资源为注册资源，则该CSE为注册响应CSE，若发起方实体对应的资源不是注册资源，则该CSE为任意一个保存有发起方实体对应的资源且能够在该资源下创建角色资源的实体。
步骤802：发起方实体接收CSE返回的资源读取响应，该资源读取响应中携带该角色资源中保存的角色信息，该角色信息至少包括角色标识。
具体地，资源读取响应中携带的角色信息中除了包括角色标识外，还可能包括角色颁发者标识、角色有效起始时间、角色有效结束时间，可选地，还可能包括角色类型、角色可阅读名字以及角色所属的应用类别中的一种或多种。
该实施例中，发起方实体通过读取角色资源中保存的角色信息，获知颁发给自身的角色，从而能够在发起资源访问请求时携带颁发给自身的角色信息，使得PEP实体能够根据发起方实体对应的角色资源中保存的角色信息、该资源访问请求中携带的角色信息以及访问控制策略，实现基于基于角色的访问控制。
基于同一发明构思，本申请实施例中，如图9所示，PEP进行访问控制的详细方法流程如下：
步骤901：PEP实体获取发起方实体发送的资源访问请求，该资源访问请求中携带发 起方实体的角色信息，该角色信息至少包括角色标识。
具体地，发起方实体的资源访问请求中携带需要访问的目标资源的地址信息。
可选地，资源访问请求中携带的发起方实体的角色标识，为根据本次资源访问所属的应用类别以及角色所属的应用类别确定。例如，若发起方实体本次资源访问所属的应用类别为智能交通应用，则该发起方实体从角色列表中查找与智能交通应用相对应的角色，在资源访问请求中携带该角色的角色标识。
步骤902：PEP实体根据该资源访问请求生成访问控制决策请求，该访问控制决策请求中携带该发起方实体的角色信息。
步骤903：PEP实体将该访问控制决策请求发送给PDP实体，由PDP实体根据角色信息查询发起方实体对应的角色资源获得查询结果，并由PDP实体根据该查询结果以及访问控制策略确定决策结果，该角色资源为普通资源且存储有发起方实体的角色信息，其中，访问控制策略与发起方实体需要访问的目标资源相关联。
步骤904：PEP实体获取PDP实体返回的访问控制决策应答，该访问控制决策应答中携带该决策结果。
步骤905：PEP实体根据该决策结果对发起方实体的资源访问请求进行访问控制。
基于同一发明构思，本申请实施例中，如图10所示，PDP进行访问控制的详细方法流程如下：
步骤1001：PDP实体接收PEP实体发送的访问控制决策请求，该访问控制决策请求中携带发起资源访问请求的发起方实体的角色信息，该角色信息至少包括角色标识；
步骤1002：PDP实体根据角色标识查询发起方实体对应的角色资源获得查询结果，根据查询结果以及访问控制策略确定决策结果，角色资源为普通资源且存储有所述发起方实体的角色信息。
在一个具体实施方式中，PDP实体向CSE发送对发起方实体的角色资源的查询请求，并获得该CSE返回的查询结果，查询请求中携带角色标识。其中，CSE保存有发起方实体对应的资源。
在另一个具体实施方式中，PDP实体向PIP实体发送访问控制属性请求，该访问控制属性请求中携带发起方实体的角色标识，并接收PIP实体返回的访问控制属性响应，该访问控制属性响应中携带PIP实体根据该角色标识查询发起方实体对应的角色资源获得的查询结果。
具体地，PDP实体若确定查询结果中携带角色资源中保存的角色信息，且根据该角色信息确定该角色标识有效，根据访问控制策略以及角色标识确定决策结果。也就是说，若 访问控制策略为允许发起发实体以该角色标识所指示的角色进行资源访问，确定决策结果为允许该发起方实体本次的资源访问；若访问控制策略为不允许发起发实体以该角色标识指示的角色进行资源访问，确定决策结果为不允许为发起方实体本次的资源访问。
具体地，PDP实体若确定查询结果为空，根据访问控制策略确定决策结果为不允许发起方实体的资源访问请求；或者，若确定查询结果中携带角色资源中保存的角色信息，且根据角色信息确定角色标识无效，根据访问控制策略确定决策结果为不允许发起方实体的资源访问请求。
其中，访问控制策略可以是PDP通过向PRP发送访问控制策略请求，获取PRP返回的访问控制策略响应，该访问控制策略响应中携带基于角色进行访问控制的访问控制策略。
步骤1003：PDP实体向PEP实体返回访问控制决策应答，该访问控制决策应答中携带决策结果。
基于同一发明构思，本申请实施例中，如图11所示，PIP进行访问控制的详细方法流程如下：
步骤1101：PIP接收PDP实体发送的访问控制属性请求，该访问控制属性请求中携带发起资源访问请求的发起方实体的角色信息，该角色信息至少包括角色标识。
步骤1102：PIP实体根据角色标识向CSE查询发起方实体对应的角色资源并获取查询结果，该角色资源为普通资源且存储有发起方实体的角色信息。
具体地，若CSE中的发起方实体对应的角色资源中保存有该角色标识对应的角色信息，则将该角色信息作为查询结果返回给PIP；若CSE中的发起方实体对应的角色资源中未保存有该角色标识对应的角色信息，则向PIP返回的查询结果为空。其中，发起方实体对应的角色资源可以有多个，CSE根据角色标识分别查询发起方实体对应的每个角色资源，确定该角色标识对应的角色资源，将该角色资源中保存的角色信息以列表的形式返回给PIP。
步骤1103：PIP实体向PDP实体返回访问控制属性响应，该访问控制属性响应中携带查询结果。
以下通过两个具体实施例对本申请实施例所提供的角色颁发以及使用过程进行说明。
第一具体实施例，如图12所示，角色颁发及使用的详细过程为：
步骤1201：角色颁发实体向Registrar CSE中Originator的注册资源发送角色资源创建或维护请求，该请求中包含有创建或修改的roleID，issuer，startTime，expiryTime，roleType，roleName和appCategory等角色属性的值。
步骤1202：Registrar CSE接收到Role Authority发送的角色资源创建或维护请求后，检查与Originator的注册资源相关联的访问控制策略，判断Role Authority是否有权创建或维护<role>资源，若有权，根据角色资源创建或维护请求所提供的<role>资源属性值创建或维护所请求的<role>资源。
步骤1203：Registrar CSE向Role Authority返回角色资源创建或维护响应，以通知Role Authority是否创建或维护成功。
步骤1204：Originator向Registrar CSE中的Originator的注册资源发送对角色资源的资源读取请求，以便获取已颁发给该Originator的角色信息。
步骤1205：Registrar CSE向Originator返回资源读取响应，通过该资源读取响应将Originator所拥有的角色以角色信息列表的方式发送给Originator，角色信息包括roleID，issuer，startTime，expiryTime，roleType，roleName和appCategory等角色属性的值。
步骤1206：Originator利用当前资源访问所属的应用类别与角色所属的应用类别进行比较，选择适用的角色，然后向Hosting CSE中的目标资源发送资源访问请求，该资源访问请求用于请求访问该目标资源，并将所选择的角色的角色信息附着在该请求中，所附着的角色信息至少应包含角色标识。
步骤1207：Hosting CSE中的PEP根据Originator发送的资源访问请求生成访问控制决策请求，访问控制决策请求中包含有Originator提供的角色信息，将该访问控制决策请求发送给PDP。
步骤1208：PDP接收到PEP发送的访问控制决策请求后，需要检查该访问控制决策请求中携带的角色标识所指示的角色是否确实颁发给了Originator。一个具体实现中，PDP可以通过PIP进行该检查，即由PIP向Registrar CSE发送角色资源查询请求，该角色资源查询请求中携带角色标识，以查询该Originator的注册资源中的<role>资源。另一个具体实现中，PDP直接向Registrar CSE发送角色资源查询请求，该角色资源查询请求中携带角色标识，以查询该Originator的注册资源中的<role>资源，进行该检查。以上两个具体实现中，查询请求中应至少包含角色标识，查询返回的查询结果可以是该<role>资源的全部信息，也可以是该<role>资源的部分信息，但返回的查询结果应使PDP能够判断该角色是否已经颁发给Originator且仍在有效期内。
步骤1209：Registrar CSE根据角色资源查询请求查询Originator的注册资源下的角色资源，通过角色资源查询响应将查询结果发送给PIP，由PIP发送给PDP；或者，Registrar CSE根据角色资源查询请求查询Originator的注册资源下的角色资源，通过角色资源查询响应将查询结果直接发送给PDP。
步骤1210：PDP接收到角色资源查询响应后，首先根据查询结果判断该角色是否确实颁发给该Originator且仍在有效期内，然后利用访问控制策略和Originator的角色信息评估PEP发送的访问控制决策请求。
步骤1211：PDP将评估结果通过访问控制决策应答发送PEP，该访问控制决策应答中携带评估结果。
步骤1212：PEP接收到访问控制决策应答后，根据评估结果确定是否允许Originator的资源访问请求，若允许，则执行Originator的资源访问请求。
步骤1213：PEP向Originator返回资源访问响应，该资源访问响应中携带执行结果。
第二具体实施例，oneM2M应用服务提供商(oneM2M Application Service Provider)通过oneM2M服务商(oneM2M Service Provider)提供的平台读取存储在家庭网关(Home Gateway)中的数据。如图13所示为该具体实施所涉及的实体关系示意图，对所涉及的各实体描述如下：
CSE1：为oneM2M服务提供商(oneM2M Service Provider)基础设施节点(Infrastructure Node)中的CSE(称为IN-CSE)。
CSE2：为存在于一个家庭网关(Home Gateway)中的oneM2M应用服务节点(Application Service Node)中的CSE(称为ASN-CSE)。读取CSE2中的数据需要具有相应的数据收集角色(Data Collection Role)，该角色的角色标识为roleID＝ROLE1234；该假设读取CSE2中的数据所属的应用类别的应用类别编号为12，也即appCategory＝12。
AE1：为注册至CSE1的AE，角色颁发实体通过AE1访问CSE1中的资源且具有在CSE1中创建<role>资源的特权。
AE2：为注册至CSE1的AE，oneM2M应用服务提供商(oneM2M Application Service Provider)通过AE2访问CSE2中的资源。
该具体实施例中，CSE1中相关的资源树如图14所示，其中：
<CSEBase>：为CSE1资源树的根节点。
<AE2>：为AE2成功注册至CSE1后的注册资源。
<role>：为AE1在<AE2>中创建的子资源，一个<role>子资源表示一个赋给AE2的角色，<role>子资源中描述了roleID，issuer，startTime，expiryTime，roleType，roleName和roleAppCategory等角色属性信息。
该具体实施例中，角色颁发及使用的预配置过程为：oneM2M应用服务提供商AE2注册至oneM2M服务提供商的IN-CSE(CSE1)中，并创建了<AE2>资源。
该具体实施例中，如图15所示，角色颁发及使用的详细过程为：
步骤1501：角色颁发实体通过AE1向CSE1中的<AE2>资源发送角色资源创建请求，该角色资源创建请求中携带角色资源所需的属性信息，例如roleID＝ROLE1234，issuer＝AE1，startTime＝2015.10.01，expiryTime＝2016.10.01，roleType＝0，roleName＝数据收集角色(Data Collection Role)，appCategory＝12等。
步骤1502：CSE1验证AE1的访问权限，确定允许AE1创建<role>资源后，根据AE1提供的角色资源的属性信息在<AE2>资源下创建相关的<role>资源。
步骤1503：CSE1将向AE1返回角色资源创建响应，该角色资源创建响应用于告知AE1是否创建成功。
步骤1504：AE2向CSE1发送对<AE2>资源的<role>资源的资源读取请求。
步骤1505：CSE1向AE2返回资源读取响应，通过该资源读取响应将<AE2>资源下的角色资源中保存的角色信息以列表形式发送给AE2，其中角色信息中包含有roleID＝ROLE1234的角色信息。
步骤1506：AE2向CSE2发送资源访问请求，该资源访问请求中携带有roleID＝ROLE1234的角色信息。
步骤1507：CSE2中的PEP根据AE2发送的资源访问请求生成访问控制决策请求，其中包含有AE2提供的角色信息，将该访问控制决策请求发送给PDP。
步骤1508：PDP接收到PEP发送的访问控制决策请求后，从PRP获取到与该访问控制决策请求相关联的访问控制策略，并利用roleID＝ROLE1234作为查询条件向CSE1发送对<AE2>的角色资源查询请求，以从CSE1中的<AE2>读取AE2的角色信息。
步骤1509：CSE1利用roleID＝RBAC1234作为查询条件在<AE2>资源下检索到该roleID对应的角色资源，并向PDP返回角色资源查询响应，该角色资源查询响应中携带检索到的角色资源中保存的角色信息。
步骤1510：PDP根据查询到的角色信息，利用该角色信息中的角色标识和角色有效起始/终止时间等判断该角色是否颁发给AE2且仍在有效期内，若是，则利用访问控制策略和AE2的角色信息评估PEP发送的访问控制决策请求。因为roleID＝ROLE1234具有数据的读取权限，所以访问控制策略的评估结果是“同意AE2的资源访问”或“不同意AE2的资源访问”，该具体实施例中假设评估结果为同意AE2的资源访问。
步骤1511：PDP将评估结果通过访问控制决策响应发送给PEP。
步骤1512：PEP根据评估结果确定AE2的资源访问请求被允许，则执行AE2的资源访问请求，读取请求访问的目标资源。
步骤1513：PEP将执行结果通过资源访问响应发送给AE2。
基于同一发明构思，本申请实施例中提供了一种CSE，该CSE可以是保存有发起方实体对应的资源的任意一个CSE，例如，可以是保存有发起方实体的注册资源的注册响应CSE，该CSE的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图16所示，该CSE主要包括：
接收模块1601，用于接收角色颁发实体发送的角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
处理模块1602，用于根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述角色信息。
可选地，所述接收模块1601还用于：
在所述处理模块根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，接收所述角色颁发实体发送的角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
所述处理模块还用于：
根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息。
可选地，所述接收模块还用于：
接收所述发起方实体对所述角色资源的资源读取请求；
还包括第一发送模块1603，用于：
向所述发起方实体返回资源读取响应，所述资源读取响应中携带所述角色信息。
可选地，还包括第二发送模块1604，用于：
在所述处理模块根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，向所述角色颁发实体返回角色资源创建响应。
可选地，还包括第三发送模块1605，用于：
在所述处理模块根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息后，向所述角色颁发实体返回角色资源修改响应。
可选地，所述处理模块还用于：
根据所述角色信息在所述发起方实体对应的资源下创建角色资源之前，根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体创建所述角色资源。
可选地，所述处理模块还用于：
根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息之前，根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体修改所述角色资源。
基于同一发明构思，本申请实施例中还提供了一种角色颁发实体，该角色颁发实体的 具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图17所示，该实体主要包括：
处理模块1701，用于生成角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
发送模块1702，用于向公共服务实体CSE发送所述角色资源创建请求，由所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述发起方实体的角色信息。
可选地，还包括第一接收模块1703，用于：
接收所述CSE返回的角色资源创建响应。
可选地，所述发送模块还用于：
将所述角色资源的地址信息的指示信息发送给所述发起方实体，以及将所述角色资源的地址信息的指示信息发送给所述策略决策点PDP实体和/或策略信息点PIP实体。
可选地，所述处理模块还用于：
生成角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
所述发送模块还用于：
向所述CSE发送所述角色资源修改请求。
可选地，还包括第二接收模块1704，用于：
接收所述CSE返回的角色资源修改响应。
基于同一发明构思，本申请实施例中还提供了一种发起方实体，该发起方实体的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图18所示，该发起方实体主要包括：
发送模块1801，用于向公共服务实体CSE发送对发起方实体对应的资源下的角色资源的资源读取请求，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
接收模块1802，用于接收所述CSE返回的资源读取响应，所述资源读取响应中携带所述角色资源中保存的角色信息，所述角色信息至少包括角色标识。
实施中，所述发起方实体为应用实体或公共服务实体。
基于同一发明构思，本申请实施例中还提供了一种PEP实体，该PEP实体的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图19所示，该PEP实体主要包括：
第一获取模块1901，用于获取发起方实体发送的资源访问请求，所述资源访问请求中 携带所述发起方实体的角色信息，所述角色信息至少包括角色标识；
生成模块1902，用于根据所述获取模块获取的所述资源访问请求生成访问控制决策请求，所述访问控制决策请求中携带所述发起方实体的角色信息；
发送模块1903，用于将所述访问控制决策请求发送给策略决策点PDP实体，由所述PDP实体根据所述角色信息查询所述发起方实体对应的角色资源获得查询结果，并由所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
第二获取模块1904，用于获取所述PDP实体返回的访问控制决策应答，所述访问控制决策应答中携带所述决策结果；
访问控制模块1905，用于根据所述决策结果对所述发起方实体的资源访问请求进行访问控制。
实施中，PEP实体位于资源访问请求所请求访问的目标资源所在的CSE中。
基于同一发明构思，本申请实施例中还提供了一种PDP实体，该PDP实体的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图20所示，该PDP实体主要包括：
接收模块2001，用于接收策略执行点PEP实体发送的访问控制决策请求，所述访问控制决策请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
处理模块2002，用于根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
发送模块2003，用于向所述PEP实体返回访问控制决策应答，所述访问控制决策应答中携带所述决策结果。
可选地，所述处理模块具体用于：
通过所述发送模块向公共服务实体CSE发送对所述发起方实体的角色资源的查询请求，并通过所述接收模块获得所述CSE返回的查询结果，所述查询请求中携带所述角色标识；
或者，
通过所述发送模块向策略信息点PIP实体发送访问控制属性请求，所述访问控制属性请求中携带所述发起方实体的角色标识，并通过所述接收模块接收所述PIP实体返回的访问控制属性响应，所述访问控制属性响应中携带所述PIP实体根据所述角色标识查询所述 发起方实体对应的角色资源获得的查询结果。
可选地，所述处理模块具体用于：
若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识有效，根据所述访问控制策略以及所述角色标识确定决策结果；
若确定所述查询结果为空，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求；或者，若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识无效，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求。
基于同一发明构思，本申请实施例中还提供了一种PIP实体，该PIP实体的具体实施可参见上述方法实施例部分的描述，如图21所示，该PIP实体主要包括：
接收模块2101，用于接收策略决策点PDP实体发送的访问控制属性请求，所述访问控制属性请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
处理模块2102，用于根据所述角色标识向公共服务实体CSE查询所述发起方实体对应的角色资源并获取查询结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
发送模块2103，用于向所述PDP实体返回访问控制属性响应，所述访问控制属性响应中携带所述查询结果。
基于同一发明构思，本申请实施例中提供了一种CSE，该CSE可以是保存有发起方实体对应的资源的任意一个CSE，也可以是保存有发起方实体的注册资源的注册响应CSE，该CSE的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图22所示，该CSE主要包括处理器2201、存储器2202和收发机2203，其中，收发机2203用于在处理器2201的控制下接收和发送数据，存储器2202中保存有预设的程序，处理器2201读取存储器2202中保存的程序，按照该程序执行以下过程：
通过收发机2203接收角色颁发实体发送的角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述角色信息。
可选地，处理器2201根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，通过收发机2203向所述角色颁发实体返回角色资源创建响应。
可选地，处理器2201根据所述角色信息在所述发起方实体对应的资源下创建角色资 源后，通过收发机2203接收所述角色颁发实体发送的角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
处理器2201根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息。
可选地，处理器2201在根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息后，通过收发机2203向所述角色颁发实体返回角色资源修改响应。
可选地，处理器2201通过收发机2203接收所述发起方实体对所述角色资源的资源读取请求；通过收发机2203向所述发起方实体返回资源读取响应，所述资源读取响应中携带所述角色信息。
可选地，处理器2201根据所述角色信息在所述发起方实体对应的资源下创建角色资源之前，根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体创建所述角色资源。
可选地，处理器2201根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息之前，根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体修改所述角色资源。
基于同一发明构思，本申请实施例中还提供了一种角色颁发实体，该角色颁发实体的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图23所示，该角色颁发实体主要包括处理器2301、存储器2302和收发机2303，其中，收发机2303用于在处理器2301的控制下接收和发送数据，存储器2302中保存有预设的程序，处理器2301读取存储器2302中保存的程序，按照该程序执行以下过程：
生成角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
通过收发机2303向公共服务实体CSE发送所述角色资源创建请求，由所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述发起方实体的角色信息。
可选地，处理器2301通过收发机2303接收所述CSE返回的角色资源创建响应。
可选地，处理器2301通过收发机2303将所述角色资源的地址信息的指示信息发送给所述发起方实体，以及将所述角色资源的地址信息的指示信息发送给所述策略决策点PDP实体和/或策略信息点PIP实体。
可选地，处理器2301生成角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；通过收发机2303向所述CSE发送所述角色资源修改请求。
可选地，处理器2301通过收发机2303接收所述CSE返回的角色资源修改响应。
基于同一发明构思，本申请实施例中还提供了一种发起方实体，该发起方实体的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图24所示，该发起方实体主要包括处理器2401、存储器2402和收发机2403，其中，收发机2403用于在处理器2401的控制下接收和发送数据，存储器2402中保存有预设的程序，处理器2401读取存储器2402中保存的程序，按照该程序执行以下过程：
通过收发机2403向公共服务实体CSE发送对发起方实体对应的资源下的角色资源的资源读取请求，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
通过收发机2403接收所述CSE返回的资源读取响应，所述资源读取响应中携带所述角色资源中保存的角色信息，所述角色信息至少包括角色标识。
实施中，所述发起方实体为应用实体或公共服务实体。
基于同一发明构思，本申请实施例中还提供了一种PEP实体，该PEP实体的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图25所示，该PEP实体主要包括处理器2501、存储器2502和收发机2503，其中，收发机2503用于在处理器2501的控制下接收和发送数据，存储器2502中保存有预设的程序，处理器2501读取存储器2502中保存的程序，按照该程序执行以下过程：
通过收发机2503获取发起方实体发送的资源访问请求，所述资源访问请求中携带所述发起方实体的角色信息，所述角色信息至少包括角色标识；
根据所述资源访问请求生成访问控制决策请求，所述访问控制决策请求中携带所述发起方实体的角色信息；
通过收发机2503将所述访问控制决策请求发送给策略决策点PDP实体，由所述PDP实体根据所述角色信息查询所述发起方实体对应的角色资源获得查询结果，并由所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
通过收发机2503获取所述PDP实体返回的访问控制决策应答，所述访问控制决策应答中携带所述决策结果；
根据所述决策结果对所述发起方实体的资源访问请求进行访问控制。
实施中，PEP实体位于资源访问请求所请求访问的目标资源所在的CSE中。
基于同一发明构思，本申请实施例中还提供了一种PDP实体，该PDP实体的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图26所示，该PDP实体主要包括处理器2601、存储器2602和收发机2603，其中，收发机2603用于在处理器2601 的控制下接收和发送数据，存储器2602中保存有预设的程序，处理器2601读取存储器2602中保存的程序，按照该程序执行以下过程：
通过收发机2603接收策略执行点PEP实体发送的访问控制决策请求，所述访问控制决策请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
通过收发机2603向所述PEP实体返回访问控制决策应答，所述访问控制决策应答中携带所述决策结果。
可选地，处理器2601通过收发机2603向公共服务实体CSE发送对所述发起方实体的角色资源的查询请求，并通过收发机2603获得所述CSE返回的查询结果，所述查询请求中携带所述角色标识；
或者，
通过收发机2603向策略信息点PIP实体发送访问控制属性请求，所述访问控制属性请求中携带所述发起方实体的角色标识，并通过收发机2603接收所述PIP实体返回的访问控制属性响应，所述访问控制属性响应中携带所述PIP实体根据所述角色标识查询所述发起方实体对应的角色资源获得的查询结果。
可选地，处理器2601若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识有效，根据所述访问控制策略以及所述角色标识确定决策结果；
若确定所述查询结果为空，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求；或者，若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识无效，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求。
基于同一发明构思，本申请实施例中还提供了一种PIP实体，该PIP实体的具体实施可参见上述方法实施例部分的描述，如图27所示，该PIP实体主要包括处理器2701、存储器2702和收发机2703，其中，收发机2703用于在处理器2701的控制下接收和发送数据，存储器2702中保存有预设的程序，处理器2701读取存储器2702中保存的程序，按照该程序执行以下过程：
通过收发机2703接收策略决策点PDP实体发送的访问控制属性请求，所述访问控制 属性请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
根据所述角色标识向公共服务实体CSE查询所述发起方实体对应的角色资源并获取查询结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
通过收发机2703向所述PDP实体返回访问控制属性响应，所述访问控制属性响应中携带所述查询结果。
其中，图22至图27所对应的实施例中，总线架构可以包括任意数量的互联的总线和桥，具体由处理器代表的一个或多个处理器和存储器代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。收发机可以是多个元件，即包括发送机和收发机，提供用于在传输介质上与各种其他装置通信的单元。处理器负责管理总线架构和通常的处理，存储器可以存储处理器在执行操作时所使用的数据。
基于上述技术方案，本申请实施例中，通过在发起方实体对应的资源下创建角色资源，该角色资源为普通资源且用于保存角色信息，该角色信息至少包括角色标识，从而能够通过对该角色资源的操作获取该角色资源中保存的角色信息，基于获取的角色信息在oneM2M中实现基于角色的访问控制。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装 置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (26)

  1. 一种角色颁发方法，其特征在于，包括：
    公共服务实体CSE接收角色颁发实体发送的角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
    所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述角色信息。
  2. 如权利要求1所述的方法，其特征在于，所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源后，还包括：
    所述CSE接收所述角色颁发实体发送的角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
    根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息。
  3. 如权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述CSE接收所述发起方实体对所述角色资源的资源读取请求；
    所述CSE向所述发起方实体返回资源读取响应，所述资源读取响应中携带所述角色信息。
  4. 如权利要求1或2所述的方法，其特征在于，所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源之前，还包括：
    所述CSE根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体创建所述角色资源。
  5. 如权利要求2所述的方法，其特征在于，所述CSE根据重新颁发的所述角色信息修改所述角色资源中保存的角色信息之前，还包括：
    所述CSE根据所述发起方实体对应的资源的访问控制策略，确定允许所述角色颁发实体修改所述角色资源。
  6. 一种角色颁发方法，其特征在于，包括：
    角色颁发实体生成角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
    所述角色颁发实体向公共服务实体CSE发送所述角色资源创建请求，由所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述发起方实体的角色信息。
  7. 如权利要求6所述的方法，其特征在于，所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源之后，还包括：
    所述角色颁发实体将所述角色资源的地址信息的指示信息发送给所述发起方实体，以及将所述角色资源的地址信息的指示信息发送给所述策略决策点PDP实体和/或策略信息点PIP实体。
  8. 如权利要求6或7所述的方法，其特征在于，所述角色颁发实体向所述CSE发送所述角色资源创建请求之后，还包括：
    所述角色颁发实体生成角色资源修改请求，所述角色资源修改请求中携带重新颁发给所述发起方实体的角色信息；
    所述角色颁发实体向所述CSE发送所述角色资源修改请求。
  9. 一种角色颁发方法，其特征在于，包括：
    发起方实体向公共服务实体CSE发送对发起方实体对应的资源下的角色资源的资源读取请求，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    所述发起方实体接收所述CSE返回的资源读取响应，所述资源读取响应中携带所述角色资源中保存的角色信息，所述角色信息至少包括角色标识。
  10. 一种访问控制方法，其特征在于，包括：
    策略执行点PEP实体获取发起方实体发送的资源访问请求，所述资源访问请求中携带所述发起方实体的角色信息，所述角色信息至少包括角色标识；
    所述PEP实体根据所述资源访问请求生成访问控制决策请求，所述访问控制决策请求中携带所述发起方实体的角色信息；
    所述PEP实体将所述访问控制决策请求发送给策略决策点PDP实体，由所述PDP实体根据所述角色信息查询所述发起方实体对应的角色资源获得查询结果，并由所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    所述PEP实体获取所述PDP实体返回的访问控制决策应答，所述访问控制决策应答中携带所述决策结果；
    所述PEP根据所述决策结果对所述发起方实体的资源访问请求进行访问控制。
  11. 一种访问控制方法，其特征在于，包括：
    策略决策点PDP实体接收策略执行点PEP实体发送的访问控制决策请求，所述访问控制决策请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
    所述PDP实体根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所 述发起方实体的角色信息；
    所述PDP实体向所述PEP实体返回访问控制决策应答，所述访问控制决策应答中携带所述决策结果。
  12. 如权利要求11所述的方法，其特征在于，所述PDP实体根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，包括：
    所述PDP实体向公共服务实体CSE发送对所述发起方实体的角色资源的查询请求，并获得所述CSE返回的查询结果，所述查询请求中携带所述角色标识；
    或者，
    所述PDP实体向策略信息点PIP实体发送访问控制属性请求，所述访问控制属性请求中携带所述发起方实体的角色标识，并接收所述PIP实体返回的访问控制属性响应，所述访问控制属性响应中携带所述PIP实体根据所述角色标识查询所述发起方实体对应的角色资源获得的查询结果。
  13. 如权利要求12所述的方法，其特征在于，所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，包括：
    所述PDP实体若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识有效，根据所述访问控制策略以及所述角色标识确定决策结果；
    所述PDP实体若确定所述查询结果为空，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求；或者，若确定所述查询结果中携带所述角色资源中保存的角色信息，且根据所述角色信息确定所述角色标识无效，根据所述访问控制策略确定决策结果为不允许所述发起方实体的资源访问请求。
  14. 一种访问控制方法，其特征在于，包括：
    策略信息点PIP实体接收策略决策点PDP实体发送的访问控制属性请求，所述访问控制属性请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
    所述PIP实体根据所述角色标识向公共服务实体CSE查询所述发起方实体对应的角色资源并获取查询结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    所述PIP实体向所述PDP实体返回访问控制属性响应，所述访问控制属性响应中携带所述查询结果。
  15. 一种公共服务实体CSE，其特征在于，包括：
    接收模块，用于接收角色颁发实体发送的角色资源创建请求，所述角色资源创建请求 中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
    处理模块，用于根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述角色信息。
  16. 一种角色颁发实体，其特征在于，包括：
    处理模块，用于生成角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
    发送模块，用于向公共服务实体CSE发送所述角色资源创建请求，由所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述发起方实体的角色信息。
  17. 一种发起方实体，其特征在于，包括：
    发送模块，用于向公共服务实体CSE发送对发起方实体对应的资源下的角色资源的资源读取请求，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    接收模块，用于接收所述CSE返回的资源读取响应，所述资源读取响应中携带所述角色资源中保存的角色信息，所述角色信息至少包括角色标识。
  18. 一种策略执行点PEP实体，其特征在于，包括：
    第一获取模块，用于获取发起方实体发送的资源访问请求，所述资源访问请求中携带所述发起方实体的角色信息，所述角色信息至少包括角色标识；
    生成模块，用于根据所述获取模块获取的所述资源访问请求生成访问控制决策请求，所述访问控制决策请求中携带所述发起方实体的角色信息；
    发送模块，用于将所述访问控制决策请求发送给策略决策点PDP实体，由所述PDP实体根据所述角色信息查询所述发起方实体对应的角色资源获得查询结果，并由所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    第二获取模块，用于获取所述PDP实体返回的访问控制决策应答，所述访问控制决策应答中携带所述决策结果；
    访问控制模块，用于根据所述决策结果对所述发起方实体的资源访问请求进行访问控制。
  19. 一种策略决策点PDP实体，其特征在于，包括：
    接收模块，用于接收策略执行点PEP实体发送的访问控制决策请求，所述访问控制决策请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
    处理模块，用于根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    发送模块，用于向所述PEP实体返回访问控制决策应答，所述访问控制决策应答中携带所述决策结果。
  20. 一种策略信息点PIP实体，其特征在于，包括：
    接收模块，用于接收策略决策点PDP实体发送的访问控制属性请求，所述访问控制属性请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
    处理模块，用于根据所述角色标识向公共服务实体CSE查询所述发起方实体对应的角色资源并获取查询结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    发送模块，用于向所述PDP实体返回访问控制属性响应，所述访问控制属性响应中携带所述查询结果。
  21. 一种公共服务实体CSE，其特征在于，包括处理器、存储器和收发机，其中，所述收发机用于在处理器的控制下接收和发送数据，存储器中保存有预设的程序，所述处理器读取存储器中保存的程序，按照该程序执行以下过程：
    通过收发机接收角色颁发实体发送的角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
    根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述角色信息。
  22. 一种角色颁发实体，其特征在于，该角色颁发实体包括处理器、存储器和收发机，其中，收发机用于在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
    生成角色资源创建请求，所述角色资源创建请求中携带颁发给发起方实体的角色信息，所述角色信息至少包括角色标识；
    通过收发机向公共服务实体CSE发送所述角色资源创建请求，由所述CSE根据所述角色信息在所述发起方实体对应的资源下创建角色资源，所述角色资源为普通资源且存储有所述发起方实体的角色信息。
  23. 一种发起方实体，其特征在于，该发起方实体包括处理器、存储器和收发机，其中，收发机用于在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
    通过收发机向公共服务实体CSE发送对发起方实体对应的资源下的角色资源的资源读取请求，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    通过收发机接收所述CSE返回的资源读取响应，所述资源读取响应中携带所述角色资源中保存的角色信息，所述角色信息至少包括角色标识。
  24. 一种策略执行点PEP实体，其特征在于，该PEP实体包括处理器、存储器和收发机，其中，收发机用于在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
    通过收发机获取发起方实体发送的资源访问请求，所述资源访问请求中携带所述发起方实体的角色信息，所述角色信息至少包括角色标识；
    根据所述资源访问请求生成访问控制决策请求，所述访问控制决策请求中携带所述发起方实体的角色信息；
    通过收发机将所述访问控制决策请求发送给策略决策点PDP实体，由所述PDP实体根据所述角色信息查询所述发起方实体对应的角色资源获得查询结果，并由所述PDP实体根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    通过收发机获取所述PDP实体返回的访问控制决策应答，所述访问控制决策应答中携带所述决策结果；
    根据所述决策结果对所述发起方实体的资源访问请求进行访问控制。
  25. 一种策略决策点PDP实体，其特征在于，该PDP实体包括处理器、存储器和收发机，其中，收发机用于在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
    通过收发机接收策略执行点PEP实体发送的访问控制决策请求，所述访问控制决策请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
    根据所述角色标识查询所述发起方实体对应的角色资源获得查询结果，根据所述查询结果以及访问控制策略确定决策结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    通过收发机向所述PEP实体返回访问控制决策应答，所述访问控制决策应答中携带所述决策结果。
  26. 一种策略信息点PIP实体，其特征在于，该PIP实体包括处理器、存储器和收发机，其中，收发机用于在处理器的控制下接收和发送数据，存储器中保存有预设的程序，处理器读取存储器中保存的程序，按照该程序执行以下过程：
    通过收发机接收策略决策点PDP实体发送的访问控制属性请求，所述访问控制属性请求中携带发起资源访问请求的发起方实体的角色信息，所述角色信息至少包括角色标识；
    根据所述角色标识向公共服务实体CSE查询所述发起方实体对应的角色资源并获取查询结果，所述角色资源为普通资源且存储有所述发起方实体的角色信息；
    通过收发机向所述PDP实体返回访问控制属性响应，所述访问控制属性响应中携带所述查询结果。
PCT/CN2016/098866 2015-11-03 2016-09-13 角色颁发方法、访问控制方法及相关设备 WO2017076129A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510736941.6 2015-11-03
CN201510736941.6A CN106656935A (zh) 2015-11-03 2015-11-03 角色颁发方法、访问控制方法及相关设备

Publications (1)

Publication Number Publication Date
WO2017076129A1 true WO2017076129A1 (zh) 2017-05-11

Family

ID=58661587

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/098866 WO2017076129A1 (zh) 2015-11-03 2016-09-13 角色颁发方法、访问控制方法及相关设备

Country Status (2)

Country Link
CN (1) CN106656935A (zh)
WO (1) WO2017076129A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110858833B (zh) 2018-08-22 2022-09-30 京东方科技集团股份有限公司 访问控制策略配置方法、装置和系统以及存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102378987A (zh) * 2009-02-03 2012-03-14 易赛高博英国有限公司 交易处理系统及方法
CN103455888A (zh) * 2013-09-10 2013-12-18 山东中创软件工程股份有限公司 一种配置流程权限的方法及装置
WO2014017959A1 (en) * 2012-07-27 2014-01-30 Telefonaktiebolaget L M Ericsson (Publ) Secure session for a group of network nodes
CN103973634A (zh) * 2013-01-24 2014-08-06 腾讯科技（深圳）有限公司 应用数据创建方法和相关装置及网络系统
CN104811465A (zh) * 2014-01-27 2015-07-29 电信科学技术研究院 一种访问控制的决策方法和设备
CN104811922A (zh) * 2014-01-29 2015-07-29 中兴通讯股份有限公司 一种相邻节点注册方法和装置、跨节点注册方法和系统
WO2015117500A1 (zh) * 2014-07-24 2015-08-13 中兴通讯股份有限公司 一种m2m通信方法和系统以及m2m网络中的管理节点

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102035849B (zh) * 2010-12-23 2013-12-18 华为技术有限公司 云计算中实现资源管理的方法、设备及系统
EP2890073A1 (en) * 2013-12-31 2015-07-01 Gemalto SA System and method for securing machine-to-machine communications
CN104243453A (zh) * 2014-08-26 2014-12-24 中国科学院信息工程研究所 基于属性和角色的访问控制方法及系统
CN104869531B (zh) * 2015-04-28 2020-09-01 海尔优家智能科技（北京）有限公司 一种群组成员更新方法和装置

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102378987A (zh) * 2009-02-03 2012-03-14 易赛高博英国有限公司 交易处理系统及方法
WO2014017959A1 (en) * 2012-07-27 2014-01-30 Telefonaktiebolaget L M Ericsson (Publ) Secure session for a group of network nodes
CN103973634A (zh) * 2013-01-24 2014-08-06 腾讯科技（深圳）有限公司 应用数据创建方法和相关装置及网络系统
CN103455888A (zh) * 2013-09-10 2013-12-18 山东中创软件工程股份有限公司 一种配置流程权限的方法及装置
CN104811465A (zh) * 2014-01-27 2015-07-29 电信科学技术研究院 一种访问控制的决策方法和设备
CN104811922A (zh) * 2014-01-29 2015-07-29 中兴通讯股份有限公司 一种相邻节点注册方法和装置、跨节点注册方法和系统
WO2015117500A1 (zh) * 2014-07-24 2015-08-13 中兴通讯股份有限公司 一种m2m通信方法和系统以及m2m网络中的管理节点

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ONEM2M: "Roles and Focus Areas", ONEM2M- TR -0005-V-0.04, 20 February 2013 (2013-02-20) *

Also Published As

Publication number Publication date
CN106656935A (zh) 2017-05-10

Similar Documents

Publication Publication Date Title
WO2017076165A1 (zh) 一种访问控制方法和访问令牌颁发方法、设备
CN109936571B (zh) 一种海量数据共享方法、开放共享平台及电子设备
EP3861706B1 (en) Framework for dynamic brokerage and management of topics and data at the service layer
US9319412B2 (en) Method for establishing resource access authorization in M2M communication
JP7433294B2 (ja) アクセスコントロールポリシーの配置方法、装置、システム及び記憶媒体
JP2018532208A (ja) セマンティックｉｏｔのためのｒｅｓｔｆｕｌ動作
US20150143472A1 (en) Method for establishing resource access authorization in m2m communication
WO2016141783A1 (zh) 访问控制、策略获取、属性获取方法及相关装置
WO2017181863A1 (zh) 资源访问控制方法及装置
US10142805B2 (en) Method for managing child resource of group member in wireless communication system and device for same
KR20180058785A (ko) 향상된 RESTful 동작들
CN108092945A (zh) 访问权限的确定方法和装置、终端
CN106656942B (zh) 角色令牌颁发方法、访问控制方法及相关设备
US20230208831A1 (en) Service processing method and apparatus, server, and storage medium
CN106973031B (zh) 一种资源访问控制方法、装置及系统
WO2018129956A1 (zh) 操作实例资源的方法和装置
CN106358246B (zh) 一种访问令牌颁发方法及相关设备
EP2851838B1 (en) Method and apparatus for security domain management in trusted execution environment
WO2017076129A1 (zh) 角色颁发方法、访问控制方法及相关设备
CN106656936B (zh) 一种访问控制方法、prp实体、pdp实体和pep实体
CN110807185A (zh) 系统访问方法、装置及服务器
US20230076892A1 (en) Method and apparatus for managing licenses for data in m2m system
KR20220156429A (ko) M2m 시스템에서 디지털 권한 관리를 지원하기 위한 방법 및 장치
WO2017181775A1 (zh) 分布式授权管理方法及装置
WO2015127646A1 (zh) 用于语义混聚的装置、通信设备及语义混聚的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16861397

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16861397

Country of ref document: EP

Kind code of ref document: A1