WO2017076165A1 - 一种访问控制方法和访问令牌颁发方法、设备 - Google Patents

一种访问控制方法和访问令牌颁发方法、设备 Download PDF

Info

Publication number
WO2017076165A1
WO2017076165A1 PCT/CN2016/102457 CN2016102457W WO2017076165A1 WO 2017076165 A1 WO2017076165 A1 WO 2017076165A1 CN 2016102457 W CN2016102457 W CN 2016102457W WO 2017076165 A1 WO2017076165 A1 WO 2017076165A1
Authority
WO
WIPO (PCT)
Prior art keywords
token
access
resource
request
entity
Prior art date
Application number
PCT/CN2016/102457
Other languages
English (en)
French (fr)
Inventor
周巍
Original Assignee
电信科学技术研究院
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 电信科学技术研究院 filed Critical 电信科学技术研究院
Publication of WO2017076165A1 publication Critical patent/WO2017076165A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos

Definitions

  • the present application relates to the field of communications technologies, and in particular, to an access control method and an access token issuance method and device.
  • OneM2M the Internet of Things standardization organization, is dedicated to developing technical specifications for constructing a common M2M (Machine-To-Machine) service layer.
  • M2M Machine-To-Machine
  • the functional architecture of oneM2M is shown in Figure 1. Three basic entities are defined:
  • AE Application Entity: The application entity is located at the application layer, which implements an M2M application service logic.
  • CSE Common Services Entity: A public service entity consists of "common service functions" in a set of M2M environments.
  • NSE Underlying Network Services Entity: A network service entity provides underlying network services to CSEs.
  • oneM2M implements service layer resource sharing and interaction by employing operations on standard resource trees.
  • the form of oneM2M resource tree is shown in Figure 2.
  • CSEBase1 represents a CSE root resource ⁇ CSEBase>
  • CSE1 represents a remote CSE ⁇ remoteCSE> resource
  • APP1 represents an ⁇ AE> resource
  • CONT1 and CONT2 respectively represent a container ⁇ container> resource
  • ACP1 and ACP2 respectively represent an access control.
  • Policy ⁇ accessControlPolicy> resource Create, query, modify, and delete operations for oneM2M resources.
  • the resource related to the authorization defined by oneM2M is the access control policy ⁇ accessControlPolicy> resource, which defines an Access Control Policy, and the ⁇ accessControlPolicy> resource is uniquely identified by the resource identity (ID).
  • Other resources specify the applicable access control policy through the accessControlPolicyIDs attribute in the resource.
  • the authorization architecture shown in Figure 3 is given in the oneM2M Security Solution Technical Specification (oneM2M TS-0003: Security Solutions).
  • the authorized entities in the architecture include:
  • a PEP (Policy Enforcement Point) entity coexists with an application system that requires access control and is called by the application system.
  • the PEP entity generates a corresponding access control decision request according to the user's access request.
  • the policy request is sent to a PDP (Policy Decision Point) entity, and determines whether to perform the user's access request according to the access control decision response of the PDP entity.
  • PDP Policy Decision Point
  • the PDP entity evaluates whether the access control decision request sent by the PEP entity is allowed according to the access control policy, and returns the evaluation result to the PEP entity through the access control decision response.
  • the PRP (Policy Retrieval Point) entity obtains the applicable access control policy according to the access control policy request (referred to as the policy request) provided by the PDP entity, and returns the obtained access control policy to the PDP entity through the access control policy response.
  • a PIP (Policy Information Point) entity requests to obtain attributes related to a user, a resource, or an environment according to an access control policy of the PDP entity, such as an Internet Protocol (IP) address of the access user, a creator of the resource, and a current time. Etc. Then return the various properties obtained to the PDP entity.
  • IP Internet Protocol
  • the PEP entity generates an access control decision request (Access Control Decision Request) according to the user's access request and sends it to the PDP entity.
  • Access Control Decision Request Access Control Decision Request
  • the PDP entity sends an access control policy request (Access Control Policy Request) to the PRP entity according to the access control decision request of the PEP entity;
  • the PRP entity obtains the applicable access control policy according to the access control policy request and returns it to the PDP.
  • the PDP entity evaluates the access control decision request according to the access control policy returned by the PRP entity, and carries the evaluation result in the access control decision response and returns it to the PEP entity. During the evaluation process, if other attributes are required, the access control attribute request is sent to the PIP entity, otherwise step 6 is performed.
  • the PIP entity obtains the attributes related to the access control according to the access control attribute request and returns to the PDP entity.
  • the PEP entity determines whether to perform the user's access request according to the access control decision response.
  • the initiator In the process of access control, the initiator sometimes has privileges, such as the role information of the initiator, so that when the PDP entity evaluates the resource access request of the initiator, it must not only be based on the corresponding access control policy, but also need to consider The privilege that the initiator has. At present, how to perform access control based on the privilege of the initiator in oneM2M has not yet given a specific implementation method.
  • the embodiment of the present application provides an access control method and an access token issuance method and device, which are used to solve the problem of how to perform access control based on the privilege of the initiator in oneM2M, and have not given a specific implementation method.
  • the originating direction token issuing entity sends an access token request request, wherein the access token request request is used for Asking the token issuing entity to issue an access token for the privilege that the initiator needs to use during the access control process;
  • the initiator receives an access token request response returned by the token issuing entity to determine whether the access token was successfully issued.
  • the method further includes:
  • the token issuing entity receives an access token request request sent by the initiator, where the access token request request is used to request the token issuing entity to issue an access token for the privilege that the initiator needs to use in the access control process ;
  • the token issuing entity generates an access token according to the access token request request, and sends a token resource creation request to the public service entity CSE to request the CSE to create the access token with the initiator Associated token resource;
  • the token issuing entity receives a token resource creation response returned by the CSE to determine whether the CSE has completed creation of the token resource;
  • the token issuing entity returns an access token request response to the initiator to notify the initiator whether the access token is successfully issued.
  • the token issuing entity after receiving the access token application request sent by the initiator, the token issuing entity further includes:
  • the token issuing entity determines whether to approve the access token request request sent by the initiator by using the privilege authorization function entity.
  • the method further includes:
  • the token issuing entity sends a token resource modification request to the CSE, where the token resource modification request carries an access token that is re-issued by the token issuing entity for the initiator;
  • the token issuing entity receives a token resource modification response sent by the CSE to determine whether the CSE has completed modification of the token resource.
  • the public service entity CSE receives the token resource creation request sent by the token issuing entity, where the token resource creation request is used to request the CSE to create a token resource for the access token issued by the token issuing entity;
  • the CSE creates a token resource associated with the initiator according to the token resource creation request
  • the CSE returns a token resource creation response to the token issuing entity to notify the token issuing entity whether the CSE has completed creation of the token resource.
  • the CSE further includes:
  • the CSE creates a token resource according to the token resource creation request, and the CSE creates the token resource according to the token resource creation request when determining that the token issuing entity has the right to create a token resource.
  • the method further includes:
  • the CSE receives the token resource modification request sent by the token issuing entity, where the token resource modification request carries an access token that is re-issued by the token issuing entity for the initiator;
  • the CSE modifies the token resource that needs to be modified according to the token resource modification request
  • the CSE sends a token resource modification response to the token issuing entity to notify the token issuing entity whether the CSE has completed modification of the token resource.
  • the method further includes: the CSE determining an access control policy associated with the target resource that the initiator needs to access, and according to The access control policy determines whether the initiator has the right to create a token resource;
  • the CSE creates a token resource associated with the initiator according to the token resource creation request, including: after the CSE determines that the initiator has the right to create the token resource, the CSE creates the The token resource associated with the initiator.
  • the policy decision point PDP entity receives the access control decision request sent by the policy enforcement point PEP entity;
  • the PDP entity obtains, by the PDP entity, the privilege information in the access token corresponding to the token information according to the token information of the initiator that is carried by the access control decision request, and according to the initiator that is carried in the access control decision request a target resource that needs to be accessed, and an access control policy associated with the target resource, where the privilege information is used to indicate a privilege that the initiator can use in the access control process;
  • the PDP entity evaluates the access control decision request according to the access control policy and the privilege information, and carries the evaluation result in the access control decision response, and returns the PEP entity, so that the PEP entity performs the evaluation according to the The result is a resource access.
  • the PDP entity before evaluating the access control decision request according to the access control policy and the privilege information, further includes: the PDP entity verifying validity of the access token corresponding to the token information;
  • the PDP entity is configured to: the PDP entity, after determining that the access token corresponding to the token information is valid, according to the access control policy and the Privilege information that evaluates the access control decision request.
  • the token information is: an access token, or identifier information of the access token.
  • the PDP entity after receiving the access control decision request sent by the PEP entity, the PDP entity further includes:
  • the PDP entity obtains the access token or the privilege information from the token resource by using a policy information point PIP entity.
  • the policy enforcement point PEP entity sends an access control decision request to the policy decision point PDP entity, where the access control decision request is generated according to the resource access request of the initiator, where the access control decision request includes the resource access request Token information of the originator;
  • the PEP entity receives an access control decision response returned by the PDP entity, and performs resource access according to the evaluation result carried in the access control decision response.
  • a sending module configured to send an access token request request to the token issuing entity, where the access token requesting request is used to request the token issuing entity to issue access for the privilege that the initiator needs to use in the access control process Token
  • the receiving module is configured to receive an access token application response returned by the token issuing entity to determine whether the access token is successfully issued.
  • the initiator further includes: a token obtaining module, configured to acquire, from the token resource associated with the initiator, the access token or the privilege information in the access token, where The privilege information is used to indicate the privilege that the initiator can use during the access control process.
  • a token obtaining module configured to acquire, from the token resource associated with the initiator, the access token or the privilege information in the access token, where The privilege information is used to indicate the privilege that the initiator can use during the access control process.
  • a first receiving module configured to receive an access token request request sent by an initiator, where the access token request request is used to request the token issuing entity to issue a privilege that the initiator needs to use during an access control process Access token
  • a token issuing module configured to generate an access token according to the access token request request
  • a first sending module configured to send a token resource creation request to the public service entity CSE, to request the CSE to create a token resource associated with the initiator for the access token;
  • a second receiving module configured to receive a token resource creation response returned by the CSE, to determine whether the CSE has completed creation of the token resource
  • a second sending module configured to return an access token request response to the initiator, to notify the initiator whether the access token is successfully issued.
  • the token issuing module is further configured to: determine, according to the locally saved authorization policy, whether to approve the access token application request sent by the initiator, or determine whether to approve the initiator by using the privilege authorization function entity. Send an access token request request.
  • the first sending module is further configured to: send a token resource modification request to the CSE, where the token resource modification request carries the token issuing entity to re-issue the initiator Access token
  • the second receiving module is further configured to: receive a token resource modification response sent by the CSE, to determine whether the CSE has completed modification of the token resource.
  • a receiving module configured to receive a token resource creation request sent by the token issuing entity, where the token resource creation request is used to request the CSE to create a token resource for an access token issued by the token issuing entity;
  • a resource creation module configured to create a token resource associated with the initiator according to the token resource creation request
  • a sending module configured to return a token resource creation response to the token issuing entity, to notify the token issuing entity whether the CSE has completed creation of the token resource.
  • the resource creation module is specifically configured to: determine, according to an access control policy associated with the token issuing entity, whether the token issuing entity has the right to create a token resource; and determine the token issuing entity When the right to create a token resource, the token resource is created according to the token resource creation request.
  • the receiving module is further configured to: receive a token resource modification request sent by the token issuing entity, where the token resource modification request carries the token issuing entity to re-initiate the The access token issued by the party;
  • the resource creation module is further configured to: modify, according to the token resource modification request, a token resource that needs to be modified;
  • the sending module is further configured to: send a token resource modification response to the token issuing entity, to notify the token issuing entity whether the CSE has completed modification of the token resource.
  • the resource creation module is specifically configured to: determine, related to a target resource that the initiator needs to access Corresponding access control policy, and determining, according to the access control policy, whether the initiator has the right to create a token resource; after determining that the initiator has the right to create a token resource, creating a request according to the token resource creation request The token resource associated with the initiator.
  • a receiving module configured to receive an access control decision request sent by a policy enforcement point PEP entity
  • An acquiring module configured to acquire, according to the token information of the initiator that is carried by the access control decision request, the privilege information in the access token corresponding to the token information, and according to the initiation of the access control decision request
  • the target resource that the party needs to access obtains an access control policy associated with the target resource, where the privilege information is used to indicate a privilege that the initiator can use in the access control process;
  • An evaluation module configured to evaluate the access control decision request according to the access control policy and the privilege information, and carry the evaluation result in the access control decision response, and return the result to the PEP entity, so that the PEP entity is configured according to the The evaluation results perform resource access.
  • the evaluating module is specifically configured to: verify validity of the access token corresponding to the token information; and after determining that the access token corresponding to the token information is valid, according to the access control policy and the privilege Information that evaluates the access control decision request.
  • the acquiring module is further configured to: obtain the access token or the privilege information from a token resource associated with the initiator; or The policy information point PIP entity obtains the access token or the privilege information from the token resource.
  • a sending module configured to send an access control decision request to the policy decision point PDP entity, where the access control decision request is generated according to the resource access request of the initiator, where the access control decision request includes the resource access request Token information of the originator;
  • a receiving module configured to receive an access control decision response returned by the PDP entity
  • the access control module is configured to perform resource access according to the evaluation result carried in the access control decision response.
  • Another initiator provided by the embodiment of the present application includes a processor, an input interface, an output interface, a memory, and a system bus; wherein:
  • the output interface sends an access token request request to the token issuing entity under the control of the processor, where the access token request request is used to request the token issuing entity to access the initiator
  • the control process needs to use the privilege to issue an access token
  • the input interface receives an access token application response returned by the token issuing entity under the control of the processor to determine whether the access token is successfully issued.
  • the processor reads a program in the memory, and is configured to: obtain the privilege information in the access token or the access token from a token resource associated with the initiator, where The privilege information is used to indicate the privilege that the initiator can use during the access control process.
  • Another token issuing entity provided by the embodiment of the present application includes: a processor, an input interface, an output interface, a memory, and a system bus; wherein:
  • the processor reads a program in the memory, and is configured to: generate an access token according to the access token request request; and control the output interface to send a token resource creation request to the public service entity CSE to request the location
  • the CSE creates a token resource associated with the initiator for the access token
  • the output interface returns an access token request response to the initiator under the control of the processor to notify the initiator whether the access token is successfully issued.
  • the processor further performs: determining, according to the locally saved authorization policy, whether to approve the access token application request sent by the initiator; or determining, by using the privilege authorization function entity, whether to agree to the access sent by the initiator Token request request.
  • the output interface sends a token resource modification request to the CSE under the control of the processor, where the token resource modification request carries the token issuing entity to the The access token issued by the initiator;
  • the input interface under the control of the processor, further receives a token resource modification response sent by the CSE to determine whether the CSE has completed modification of the token resource.
  • Another CSE provided by the embodiment of the present application includes: a processor, an input interface, an output interface, a memory, and a system bus; wherein:
  • the processor reads a program in the memory, and is configured to: create a token resource associated with the initiator according to the token resource creation request; and control the output interface to return a token resource creation to the token issuing entity Responding to notify the token issuing entity whether the CSE has completed the creation of the token resource.
  • the processor is specifically configured to: determine, according to an access control policy associated with the token issuing entity, whether the token issuing entity has the right to create a token resource; and determine that the token issuing entity has the right When the token resource is created, the token resource is created according to the token resource creation request.
  • the input interface under the control of the processor, further receives a token resource modification request sent by the token issuing entity, where the token resource modification request carries the token issuing entity An access token issued for the initiator;
  • the processor further performs: modifying, according to the token resource modification request, a token resource that needs to be modified; and controlling the output interface to send a token resource modification response to the token issuing entity, to notify the Whether the token issuing entity has completed the modification of the token resource by the CSE.
  • the processor is specifically configured to: determine an access control policy associated with the target resource that the initiator needs to access, and determine, according to the access control policy, whether the initiator has the right to create a token resource; After determining that the initiator has the right to create a token resource, the token resource associated with the initiator is created according to the token resource creation request.
  • An embodiment of the present application provides another PDP entity, including: a processor, an input interface, an output interface, a memory, and a system bus; wherein:
  • the input interface receives, under the control of the processor, an access control decision request sent by the policy enforcement point PEP entity;
  • the processor reads a program in the memory, and is configured to: obtain the privilege information in the access token corresponding to the token information according to the token information of the initiator that is carried by the access control decision request, and Determining, by the access control decision request, the target resource that the initiator needs to access, and acquiring an access control policy associated with the target resource, where the privilege information is used to indicate a privilege that the initiator can use in the access control process Evaluating the access control decision request according to the access control policy and the privilege information, and carrying the evaluation result in the access control decision response, and returning to the PEP entity through the output interface, so that the PEP entity is based on The evaluation result performs resource access.
  • the processor is specifically configured to: verify validity of the access token corresponding to the token information; and after determining that the access token corresponding to the token information is valid, according to the access control policy and the privilege information And evaluating the access control decision request.
  • the processor further performs: acquiring the access token or the privilege information from the token resource associated with the initiator; or adopting a policy
  • the information point PIP entity obtains the access token or the privilege information from the token resource.
  • An embodiment of the present application provides another PEP entity, including: a processor, an input interface, an output interface, a memory, and a system bus; wherein:
  • the output interface sends an access control decision request to the PDP entity under the control of the processor, where the access control decision request is generated according to the resource access request of the initiator, where the access control decision request includes the resource access The token information of the initiator carried in the request;
  • the processor reads a program in the memory for performing: performing resource access according to the evaluation result carried in the access control decision response.
  • the token resource has:
  • a token identifier attribute for storing identification information of the access token
  • a token issuer attribute for storing identification information of an access token issuer
  • a start time attribute for storing the start time of the validity period of the access token
  • End time attribute used to store the end time of the validity period of the access token
  • a token value attribute that stores privilege information in an access token or access token A token value attribute that stores privilege information in an access token or access token.
  • the token resource further has at least one of the following attributes:
  • a token type attribute for storing type information of an access token
  • a token name attribute for storing a readable name of the access token
  • the application category attribute is used to store the application category to which the access token applies.
  • the token resource is a sub-resource of the originating resource of the initiator.
  • the access token includes the following content:
  • the identification information of the access token the identification information of the access token issuer, the identification information of the access token owner, the start time of the validity period of the access token, and the validity period of the access token End time, and the privilege information.
  • the access token further includes at least one of the following:
  • the type information of the access token the readable name of the access token, the application category to which the access token applies, and the content of the access token defined by the application system.
  • the initiating direction token issuing entity sends an access token request request to request the token issuing entity to issue an access token for the privilege that the initiator needs to use in the access control process.
  • the token issuing entity generates an access token according to the access token request request, and sends a token resource creation request to the public service entity CSE to request the CSE to create an association with the initiator for the access token.
  • the token resource is created by the CSE according to the token resource creation request, and the token resource associated with the initiator is created, so that the issuance process of the access token is completed, and the dynamic issuance of the access token is implemented, so that the PDP entity can be based on the access control.
  • the policy and access token evaluates the initiator's resource access request to determine whether the initiator's access to the target resource is allowed.
  • the PDP entity after receiving the access control decision request sent by the PEP entity, the PDP entity obtains the privilege information in the access token corresponding to the token information according to the token information. Obtaining an access control policy associated with the target resource according to the target resource that the initiator needs to access according to the access control decision request; and the PDP entity evaluates the access control decision according to the access control policy and the privilege information. And submitting the evaluation result to the PEP entity in the access control decision response, so that the PEP entity performs resource access according to the evaluation result. Since the PDP entity evaluates the access control decision request based on the access control policy and the privilege information to determine whether to allow the initiator to access the target resource, the access token-based access control process is implemented.
  • Figure 1 is a schematic diagram of the functional architecture of oneM2M
  • FIG. 2 is a schematic structural diagram of a oneM2M resource tree
  • 3 is a schematic diagram of an authorization architecture of oneM2M
  • FIG. 4 is a schematic structural diagram of an access token in an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a token resource in an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of an ⁇ AE> resource in an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of a method for issuing an access token according to an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of another method for issuing an access token according to an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of still another method for issuing an access token according to an embodiment of the present application.
  • FIG. 10 is a schematic flowchart diagram of an access control method according to an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of another access control method according to an embodiment of the present application.
  • FIG. 12 is a schematic diagram of a connection relationship between entities in an embodiment of the present application.
  • FIG. 13 is a schematic diagram of an interaction process between entities in an embodiment of the present application.
  • Embodiment 14 is a schematic diagram of a connection relationship between entities in Embodiment 1 in the embodiment of the present application;
  • FIG. 15 is a schematic diagram of a resource tree in Embodiment 1 of the embodiment of the present application.
  • FIG. 16 is a schematic diagram of a process of issuing and using an access token in Embodiment 1 of the embodiment of the present application;
  • FIG. 17 is a schematic diagram of an initiator in an embodiment of the present application.
  • FIG. 18 is a schematic diagram of a token issuing entity in an embodiment of the present application.
  • FIG. 19 is a schematic diagram of a CSE in an embodiment of the present application.
  • FIG. 20 is a schematic diagram of a PDP entity in an embodiment of the present application.
  • FIG. 21 is a schematic diagram of a PEP entity in an embodiment of the present application.
  • 22 is a schematic diagram of another initiator in the embodiment of the present application.
  • FIG. 23 is a schematic diagram of another token issuing entity in the embodiment of the present application.
  • 25 is a schematic diagram of another PDP entity in the embodiment of the present application.
  • FIG. 26 is a schematic diagram of another PEP entity in the embodiment of the present application.
  • the PDP entity evaluates the resource access request of the initiator based on the access control policy and the access token to determine whether the initiator is allowed to target the resource.
  • the access the dynamic authorization access token is implemented, and the access token based access control scheme is also implemented.
  • the access token that is, the token related to the access control, the structure of the access token and the information stored internally are as shown in FIG. 4, and the main information stored in the access token includes:
  • token ID an identifier of the access token, for uniquely identifying the access token
  • Owner ID which is the identification information of the owner of the access token
  • the issuer (issuer), that is, the identification information of the access token issuer;
  • Start time (startTime), which is the start time of the validity period of the access token
  • ExpiryTime which is the end time of the validity period of the access token
  • Privileges used to indicate privileged information that the initiator can use during the access control process, such as a list of roles, access control lists, and so on.
  • the initiator is an entity that initiates resource access, and the initiator may be an entity such as an AE or a CSE.
  • At least one of the following information is also stored in the access token:
  • a token type that is, type information of an access token, which is based on the type of token designed by the application system, such as a role token carrying a role, a token carrying a privilege owned by an initiator, and a oneM2M service.
  • a service subscription role token defined by a provider (M2M Service Provider), an application token associated with a specific application defined by a oneM2M Application Service Provider, and the like.
  • the token can read the name (tokenName), which is the readable name of the access token;
  • the application category (appCategory) to which the access token applies may be an application category to which the access token applies, such as a device management application, a smart home application, an intelligent transportation application, and the like.
  • the initiator may select an access token that matches the application category to which the current resource access belongs, for the target resource. Access control process;
  • Extensions that is, the contents of the access token customized by the application system, and the application system can define the token content according to actual needs.
  • the token resource defines a new oneM2M resource - a token resource (ie ⁇ token> resource) for storing an access token for access control in the CSE resource tree (or the access order)
  • the basic structure of the newly defined ⁇ token> resource is shown in Figure 5.
  • the resource type is oneM2M Normal Resource.
  • the ⁇ token> resource includes a common attribute (expirationTime) and a sub-resource ⁇ subscription> resource (also called a contract resource) in addition to the common attribute shared by the oneM2M common resource.
  • Each ⁇ token> resource instance is used to describe an access token to facilitate resource management and token usage.
  • the ⁇ token> resource newly defined resource has the following attributes:
  • token ID a token identifier
  • identifier information a token identifier configured to store identifier information of the access token, where the identifier information is used to uniquely identify an access token
  • An issuer attribute for storing the identification information of the issuer of the access token
  • Start time (startTime) attribute for storing the effective start time of the access token
  • TokenValue attribute Used to store privilege information in an access token or access token.
  • the token resource also has at least one of the following attributes:
  • the application category (appCategory) attribute is used to store application categories to which the access token applies, such as device management applications, smart home applications, intelligent transportation applications, and the like.
  • the initiator may determine, according to the content, that the corresponding token should be selected for specific resource access.
  • the structure of the redefined ⁇ AE> resource is as shown in FIG. 6, except that the ⁇ token> resource is added as its child resource, and the number of ⁇ token> sub-resources under the ⁇ AE> resource may be 0 or n (n An integer greater than or equal to 1 is used to indicate that those privileged privileges have been assigned to the AE.
  • the redefinition of ⁇ CSEBase> resources and ⁇ remoteCSEBase> resources is similar to the redefinition of ⁇ AE>, that is, only the ⁇ token> resource is added as its child resource under their resource tree, and the number of child resources can be 0 or n (n is an integer greater than or equal to 1).
  • the token resource is a resource associated with the initiator, and may be created in the registration resource of the initiator in the CSE as a sub-resource of the originating resource of the initiator; or may be created in the CSE.
  • Non-registered resource as a sub-resource of the originator's unregistered resource.
  • the CSE or token issuing entity that creates the token resource also needs to perform:
  • Notifying the PDP entity or the PIP entity of the creation address of the token resource so that the PDP entity or the PIP entity can read the access token in the token resource and/or the associated access token according to the created address. information.
  • An method for issuing an access token on the initiator side is provided in the embodiment of the present application. As shown in FIG. 7, the method includes:
  • the initiating direction token issuing entity sends an access token request request, where the access token requesting request is used to request the token issuing entity to issue an access token for the privilege that the initiator needs to use in the access control process;
  • the token issuing entity issues an access token issued by the initiator for use in the initiator's access control process.
  • the Token Authority entity is responsible for issuing an access token to the initiator (AE or CSE, etc.).
  • the initiator receives an access token application response returned by the token issuing entity to determine whether the access token is successfully issued.
  • the initiating direction token issuing entity sends an access token request request to request the token issuing entity to issue an access token for the privilege that the initiator needs to use in the access control process, and implements the dynamic of the access token. Issuance to enable the PDP entity to evaluate the originator's resource access request based on the access control policy and the access token to determine whether the initiator's access to the target resource is allowed.
  • the initiator may obtain the access token or the privilege information in the access token from the token resource associated with the initiator. And information about the access token (such as a valid start time, etc.).
  • the embodiment of the present application provides a method for issuing an access token on the token issuing entity side, which is the same as the initiator side.
  • the method includes:
  • the token issuing entity receives an access token request request sent by the initiator, where the access token request request is used to request the token issuing entity to issue an access token for the privilege that the initiator needs to use in the access control process.
  • the token issuing entity generates an access token according to the access token application request, and sends a token resource creation request to the CSE, to request the CSE to create a token resource associated with the initiator for the access token.
  • the CSE involved in the embodiment of the present application is any CSE that holds the resource associated with the initiator and can create a token resource under the resource of the initiator.
  • the token issuing entity may initiate a token resource creation request to the registration response CSE (Registrar CSE) to request the registration response CSE to create a token resource under the initiator's registered resource.
  • Registrar CSE Registration response CSE
  • the token issuing entity receives a token resource creation response returned by the CSE to determine whether the CSE has completed the creation of the token resource.
  • the token issuing entity returns an access token request response to the initiator to notify the initiator whether the access token is successfully issued.
  • the token issuing entity after receiving the access token application request sent by the initiator, the token issuing entity generates an access token, and requests the CSE to create a token resource associated with the initiator for the access token, and implements
  • the dynamic issuance of the access token enables the PDP entity to evaluate the originating resource access request based on the access control policy and the access token to determine whether the initiator's access to the target resource is allowed.
  • the token issuing entity after receiving the access token application request sent by the initiator, the token issuing entity further includes:
  • the token issuing entity determines whether to agree to the access token application request sent by the initiator according to the locally saved authorization policy; or
  • the token issuing entity determines whether to agree to the access token request request sent by the initiator through the privilege authorization function entity.
  • the Privilege Authorization Function may provide an ability to confirm whether or not to approve the privilege applied by the initiator for access control, and the specific manner of implementing the capability may be determined by the application system, for example, only providing the relevant authorization policy, and then The token issuing entity performs a specific privilege authorization check, or evaluates the originator's access token request request according to the authorization policy, and then returns the evaluation result to the token issuing entity, or an evaluation process in which someone participates.
  • the method further includes:
  • the token issuing entity sends a token resource modification request to the CSE, where the token resource modification request carries the access token issued by the token issuing entity to the initiator again;
  • the token issuing entity receives the token resource modification response sent by the CSE to determine whether the CSE has completed the modification of the token resource.
  • the embodiment of the present application provides a method for issuing an access token on the CSE side, which is the same as the token issuing entity side.
  • the method includes:
  • the CSE receives a token resource creation request sent by the token issuing entity, where the token resource creation request is used to request the CSE to create a token resource for the access token issued by the token issuing entity.
  • the CSE creates a token resource associated with the initiator according to the token resource creation request.
  • the CSE returns a token resource creation response to the token issuing entity to notify the token issuing entity CSE whether the creation of the token resource has been completed.
  • the CSE after receiving the token resource creation request sent by the token issuing entity, the CSE creates a token resource associated with the initiator for the access token issued by the token issuing entity, and implements the dynamic of the access token. Issuance to enable the PDP entity to evaluate the originator's resource access request based on the access control policy and the access token to determine whether the initiator's access to the target resource is allowed.
  • the token resource creation request carries the information required to create the token resource, and specifically includes: the identifier information of the access token, the identifier information of the access token issuer, and the identifier information of the owner of the access token.
  • the token resource creation request further carries at least one of the following information: type information of the access token, a readable name of the access token, an application category to which the access token applies, and an application-defined access token. content.
  • the CSE after the CSE receives the token resource creation request sent by the token issuing entity, the CSE further includes:
  • the CSE determines an access control policy associated with the target resource that the initiator needs to access, and determines whether the initiator has the right to create the token resource according to the determined access control policy.
  • the S92 specifically includes: after determining that the initiator has the right to create the token resource, the CSE creates the token resource associated with the initiator according to the information required to create the token resource carried in the token resource creation request.
  • the issued access token may be used in the access control process of the initiator to the target resource, and the access token-based access control process provided by the embodiment of the present application is performed. Description.
  • an access control method on the PDP entity side is provided in the embodiment of the present application. As shown in FIG. 10, the method includes:
  • the PDP entity receives an access control decision request sent by the PEP entity.
  • the PDP entity obtains the privilege information in the access token corresponding to the token information according to the token information of the initiator that is carried by the access control decision request, and the target resource that the initiator needs to access according to the access control decision request. Obtaining an access control policy associated with the target resource, wherein the privilege information is used to indicate a privilege that the initiator can use in the access control process;
  • the PDP entity evaluates the access control decision request according to the access control policy and the privilege information, and returns the evaluation result to the PEP entity in the access control decision response, so that the PEP entity performs resource access according to the evaluation result.
  • the PDP entity after receiving the access control decision request sent by the PEP entity, the PDP entity obtains the privilege information in the access token corresponding to the token information according to the token information carried in the access control decision request, and carries the privilege information according to the access control decision request.
  • the initiator needs access to the target resource to obtain the access control policy associated with the target resource, and then evaluates the access control decision request according to the access control policy and the privilege information to determine whether to allow the initiator to access the target resource, thereby implementing Access token based access control process.
  • the method further includes: the PDP entity verifying the validity of the access token corresponding to the token information;
  • the PDP entity evaluates the access control decision request according to the access control policy and the privilege information, and includes: after determining that the access token corresponding to the token information is valid, the PDP entity evaluates according to the access control policy and the privilege information.
  • the access control decision request includes: after determining that the access token corresponding to the token information is valid, the PDP entity evaluates according to the access control policy and the privilege information.
  • the validity of the PDP entity to verify the access token includes: whether the access token is issued by a legal token issuing entity, whether the access token is still valid, and whether the owner identifier of the access token is The same as the initiator ID in the resource access request, whether the privilege carried in the access token is applicable to the target resource accessed, and the like. If these verifications are passed, the access control decision request is evaluated based on the access control policy and the privilege information.
  • the token information carried in the access control decision request may be the access token itself, and may also be the identifier information of the access token.
  • the PDP entity after receiving the access control decision request sent by the PEP entity, further includes:
  • the PDP entity obtains the access token or privilege information from the token resource associated with the initiator; or
  • the PDP entity obtains the access token or privilege information from the token resource through the PIP entity.
  • the PDP entity may directly use the identifier information to obtain an access command in the token value attribute from the ⁇ token> resource in the resource associated with the initiator. Card or privilege information.
  • the PDP entity may also obtain the access token or privilege information in the token value (tokenValue) through the PIP entity, that is, the PIP entity queries the ⁇ token> resource in the resource associated with the initiator, and from the ⁇ token> resource Obtain the required access token or privilege information in the tokenValue attribute, and then the PIP entity sends the obtained access token or privilege information to the PDP entity.
  • the access control method of the PEP entity side provided by the embodiment of the present application is the same as that of the PDP entity side.
  • the method includes:
  • the PEP entity sends an access control decision request to the PDP entity, where the access control decision request is generated according to the resource access request of the initiator, where the access control decision request includes the initiator that is carried in the resource access request.
  • Token information is
  • the PEP entity receives the access control decision response returned by the PDP entity, and performs resource access according to the evaluation result carried in the access control decision response, where the evaluation result is an access control policy associated with the target resource that the PDP entity needs to access according to the initiator. Obtained from the privilege information in the access token corresponding to the token information.
  • the PEP entity when the PEP entity sends an access control decision request to the PDP entity, the PEP entity carries the token information of the initiator, so that the PDP entity obtains the access token corresponding to the token information according to the token information carried in the access control decision request.
  • the privilege information in the privilege information is obtained according to the target resource that the initiator needs to access according to the access control decision request, and then the access control policy associated with the target resource is evaluated according to the access control policy and the privilege information, and the access control decision request of the PEP entity is evaluated according to the access control policy and the privilege information.
  • the access token-based access control process is implemented by determining whether the initiator is allowed access to the target resource.
  • the method for issuing an access token and the access control method provided by the embodiments of the present application are described in detail below from the interaction process between the entities.
  • the connection relationship between the entities is shown in Figure 12.
  • the interaction process is shown in Figure 13, including:
  • Step 1 The AE or CSE, which is an access control initiator (originator), sends an access token request request to the token issuing entity, where the request includes description information of the token privilege, for example, the resource access that the initiator wants to perform. Or the role of the applicant or the like.
  • Step 2 If the token issuing entity cannot determine whether to agree to the initiator's access token request according to the local authorization policy, then an external privilege authorization function (Privilege Authorization Function) entity needs to be queried to determine whether the initiator can own it. The privilege applied for.
  • an external privilege authorization function Principal Authorization Function
  • Step 3 The privilege authorization function entity returns the authorization policy or authorization decision required by the token issuing entity.
  • Step 4 If the token application of the initiator is agreed, the token issuing entity issues a corresponding access token, which includes token attribute information such as tokenID, holderID, issuer, startTime, expiryTime, tokenType, tokenName, appCategory, privileges, and the like.
  • token attribute information such as tokenID, holderID, issuer, startTime, expiryTime, tokenType, tokenName, appCategory, privileges, and the like.
  • Step 5 The token issuing entity sends a token resource creation request to the registration response CSE (Registrar CSE) to The Registrar CSE is requested to create a token resource in the registration resource of the originator (originator), and the request includes attributes such as tokenID, holderID, issuer, startTime, expiryTime, tokenType, tokenName, appCategory and accessToken required to create the ⁇ token> resource. Value.
  • the Registrar CSE that is, the registration response CSE
  • the originator (Originator) is registered to the CSE, that is, the registration resource of the Originator is created in the CSE.
  • the AE's registered resource is the ⁇ AE> resource
  • the CSE's registered resource is the ⁇ remoteCSE> resource
  • the infrastructure node CSE (IN-CSE)'s token resource is stored under its ⁇ CSEBase> resource.
  • Step 6 After receiving the token resource creation request sent by the token issuing entity, the Registrar CSE performs the following processing:
  • Step 7 The Registrar CSE sends the result of the operation to the token issuing entity.
  • Step 8 The token issuing entity sends the result of the issuance of the access token to the Originator.
  • Step 9 The Originator (AE/CSE) sends a ⁇ token> resource read request to its registered resource in the Registrar CSE to obtain the token information that has been issued to the Originator.
  • Step 10 The Registrar CSE sends the token owned by the Originator to the Originator as a token information list.
  • Step 11 The Originator compares the application category to which the current resource access belongs with the application category of the token, selects an applicable access token, and then sends a resource operation request to the target resource in the Hosting CSE, and the selected access token is selected.
  • the token information is attached to the request.
  • the Hosting CSE that is, the host CSE, the target resource that the Originator wants to access exists in the resource tree of the Hosting CSE.
  • Registrar CSE and Hosting CSE can be the same CSE or different CSEs.
  • Step 12 The PEP entity in the Hosting CSE generates an access control decision request according to the resource access request sent by the Originator, and includes the token information provided by the Originator, and then sends the request to the PDP entity.
  • Step 13 If the initiator provides the access token itself, go directly to step 15; if the initiator only provides the token ID (tokenID), the PDP entity needs to use the token to identify the ⁇ token> in the registered resource from the Originator. Obtain an access token (tokenValue) in the resource.
  • the access token obtaining process may be performed by the PIP entity, and then the PIP entity queries the ⁇ token> resource in the registered resource of the Originator, obtains the required access token, and feeds back to the PDP entity, or may be fed by the PDP.
  • the entity directly performs related operations.
  • Step 14 The Registrar CSE sends the queried access token to the PIP entity, and then sends it to the PIP entity. PDP entity, or directly sent to the PDP entity.
  • Step 15 The PDP entity verifies the validity of the access token, including whether the access token is a legal token authority entity, whether the token owner identifier is still in the validity period, and whether the token owner identifier is the initiator in the resource access request. The identifier is the same, and the privilege carried in the access token is applicable to the accessed resource. If you pass these checks, go to the next step.
  • Step 16 Evaluate the access control decision request sent by the PEP entity by using the access control policy and the privilege information of the initiator.
  • Step 17 The PDP entity sends the evaluation result to the PEP entity through the access control decision response.
  • Step 18 After receiving the access control decision response, the PEP entity checks whether the resource access request of the initiator is allowed. If so, the resource access request of the initiator is executed.
  • Step 19 The PEP entity sends the execution result to the Originator.
  • the first embodiment of the present invention describes that the oneM2M application service provider (oneM2M Application Service Provider) reads the data stored in the home gateway through a platform provided by the oneM2M service provider.
  • This embodiment adopts an access token based access control mechanism, and the privilege information stored in the access token is a role required to access the target resource.
  • the connection relationship between the entities participating in this embodiment is as shown in FIG. 14, wherein:
  • CSE1 is the CSE (IN-CSE) in the oneM2M service provider Infrastructure Node
  • CSE2 is the CSE (ASN-CSE) in the oneM2M Application Service Node, and the token issuing entity can pass the CSE2
  • An access token is issued to the AE or CSE, and CSE2 has the privilege to create a ⁇ token> resource in CSE1
  • CSE3 is a CSE (ASN-CSE) present in the oneM2M application service node in a Home Gateway.
  • the Smart Meter Data is stored therein.
  • the Smart Meter Data needs to have a Data Collection Role.
  • the resource tree related to this embodiment in CSE1 is as shown in FIG. 15, and includes: ⁇ CSEBase> resource, root node of CSE1 resource tree; ⁇ AE1> resource, registered resource after AE1 is successfully registered to CSE1; ⁇ token> resource,
  • the sub-resource created by CSE2 in ⁇ AE1> represents an access token assigned to AE1, which describes resource attribute information such as tokenID, issuer, startTime, expiryTime, tokenType, tokenName, appCategory and tokenValue.
  • the process of issuing and using the access token includes the pre-configuration process, the issuance and use process, as follows:
  • the access token pre-configuration process includes:
  • Step 0.1 The oneM2M application service provider AE1 is registered in the IN-CSE (CSE1) of the oneM2M service provider.
  • Step 0.2 The token issuing entity provides the PDP entity with a security credential for verifying the access token it issued by CSE2, that is, a public key certificate for verifying the access token it issued.
  • Step 1 The access initiator AE1 sends an access token request request to the token issuing entity (ie, CSE2), and the request includes token privilege description information.
  • This embodiment is a smart meter data collection (Smart Meter Data Collection).
  • Step 2 Because the token authorization entity cannot determine whether to approve the access token application request according to the locally stored authorization policy, it forwards the token privilege description information sent by AE1 to a privilege authorization function that can handle the task.
  • Step 3 It is assumed here that the privilege authorization function is a privilege authorization process involving the owner of the house, at which time the privilege authorization function presents the request of AE1 to the owner of the house, and the owner of the house determines whether or not to approve the request. It is assumed here that the decision given by the owner of the house is "agree", so the privilege authorization function sends a response to the token issuing entity agreeing to the authorization.
  • the resource attributes required to create the token resource Value The resource attributes required to create the token resource Value.
  • Step 6 After receiving the resource operation request sent by CSE2, CSE1 first checks and confirms that CSE2 has the privilege of creating a ⁇ token> resource under the ⁇ AE1> resource, and then creates the requested ⁇ token> resource by using the resource attribute provided by CSE2.
  • Step 7 CSE1 sends the result of the successful creation of the resource to CSE2.
  • Step 8 CSE2 sends the result of the successful operation of the access token to AE1.
  • Step 9 AE1 reads the registration resource of the AE1 in CSE1 to obtain the token information that has been issued to it.
  • Step 10 CSE1 sends the access token owned by AE1 to AE1 as a token information list, where the token information includes token attributes such as tokenID, holderID, issuer, startTime, expiryTime, tokenType, tokenName, appCategory and tokenValue. Value.
  • token attributes such as tokenID, holderID, issuer, startTime, expiryTime, tokenType, tokenName, appCategory and tokenValue. Value.
  • the AE1 sends a resource access request to the target resource in the CSE3, and attaches the token information of the selected access token to the request.
  • Step 12 The PEP entity in the CSE3 generates an access control decision request according to the resource access request sent by the AE1, where the request includes the token information provided by the AE1, and then sends the request to the PDP entity.
  • Step 13 The PDP entity verifies the validity of the access token, including whether the access token is issued by a legal token issuing entity, whether the token owner identifier is still in the validity period, and whether the token owner identifier is the initiator in the resource access request. The identifier is the same, and the privilege carried in the access token is applicable to the accessed resource. If you pass these checks, go to the next step.
  • Step 13 After receiving the access control decision request sent by the PEP entity, the PDP entity first uses the security credential (public key certificate) provided by the CSE2 to verify that the received access token is actually issued by the CSE2, and after verification, continues to verify by the holderID attribute.
  • the access token belongs to AE1. It is verified by startTime and expiryTime that the access token is still valid.
  • Step 15 The PDP entity sends the evaluation result to the PEP entity through the access control decision response.
  • Step 16 Since the resource access request of AE1 is allowed, the PEP entity performs the Smart Meter Data data reading function requested by AE1.
  • Step 17 The PEP entity sends the execution result to AE1.
  • the above method processing flow can be implemented by a software program, which can be stored in a storage medium, and when the stored software program is called, the above method steps are performed.
  • an initiator is also provided in the embodiment of the present application. Since the principle of the initiator solving the problem is similar to the method for issuing the access token shown in FIG. 7 above, the implementation of the initiator may be referred to. The implementation of the method, the repetition will not be repeated.
  • An initiator provided in the embodiment of the present application, as shown in FIG. 17, includes:
  • the sending module 171 is configured to send an access token request request to the token issuing entity, where the access token request request is used to request the token issuing entity to issue the privilege required by the initiator to use the access control process.
  • Access token request request is used to request the token issuing entity to issue the privilege required by the initiator to use the access control process.
  • the receiving module 172 is configured to receive an access token application response returned by the token issuing entity to determine whether the access token is successfully issued.
  • the initiator further includes: a token obtaining module 173, configured to acquire, from the token resource associated with the initiator, the access token or the privilege information in the access token, where The privilege information is used to indicate the privilege that the initiator can use during the access control process.
  • a token obtaining module 173 configured to acquire, from the token resource associated with the initiator, the access token or the privilege information in the access token, where The privilege information is used to indicate the privilege that the initiator can use during the access control process.
  • a token issuing entity is further provided in the embodiment of the present application. Since the token issuing entity solves the problem is similar to the above-described access token issuing method shown in FIG. 8, the token is The implementation of the issuing entity can be referred to the implementation of the method, and the repetition will not be repeated.
  • a token issuing entity provided in the embodiment of the present application, as shown in FIG. 18, includes:
  • the first receiving module 181 is configured to receive an access token request sent by the initiator, where the access token request is used to request the token issuing entity to be a privilege required by the initiator in the access control process. Issue an access token;
  • a token issuing module 182 configured to generate an access token according to the access token request request;
  • a first sending module 183 configured to send a token resource creation request to the public service entity CSE, to request the CSE to create a token resource associated with the initiator for the access token;
  • the second receiving module 184 is configured to receive a token resource creation response returned by the CSE, to determine whether the CSE has completed creation of the token resource.
  • the second sending module 185 is configured to return an access token request response to the initiator to notify the initiator whether the access token is successfully issued.
  • the token issuance module 182 is further configured to: determine, according to the locally saved authorization policy, whether to approve the access token application request sent by the initiator, or determine, by using the privilege authorization function entity, whether to agree to send the initiator Access token request request.
  • the first sending module 183 is further configured to: send a token resource modification request to the CSE, where the token resource modification request carries the access that the token issuing entity re-issues for the initiator Token
  • the second receiving module 184 is further configured to: receive a token resource modification response sent by the CSE, to determine whether the CSE has completed modification of the token resource.
  • a token issuing entity is also provided in the embodiment of the present application, because the token is issued.
  • the principle of solving the problem is similar to the method for issuing the access token shown in FIG. 9 above. Therefore, the implementation of the token issuing entity can refer to the implementation of the method, and the repeated description is not repeated.
  • a public service entity CSE provided by the embodiment of the present application, as shown in FIG. 19, includes:
  • the receiving module 191 is configured to receive a token resource creation request sent by the token issuing entity, where the token resource creation request is used to request the CSE to create a token resource for an access token issued by the token issuing entity. ;
  • a resource creation module 192 configured to create a token resource associated with the initiator according to the token resource creation request
  • the sending module 193 is configured to return a token resource creation response to the token issuing entity to notify the token issuing entity whether the CSE has completed creation of the token resource.
  • the resource creation module 192 is specifically configured to:
  • the receiving module 191 is further configured to: receive a token resource modification request sent by the token issuing entity, where the token resource modification request carries the token issuing entity to be the initiator The issued access token;
  • the resource creation module 192 is further configured to: modify the token resource that needs to be modified according to the token resource modification request;
  • the sending module 193 is further configured to: send a token resource modification response to the token issuing entity to notify the token issuing entity whether the CSE has completed modification of the token resource.
  • the resource creation module 192 is specifically configured to:
  • a PDP entity is also provided in the embodiment of the present application. Since the principle of the PDP entity solving the problem is similar to the foregoing access control method shown in FIG. 10, the implementation of the PDP entity may refer to the method. Implementation, repetition will not be repeated.
  • the PDP entity includes:
  • the receiving module 201 is configured to receive an access control decision request sent by the policy enforcement point PEP entity;
  • the obtaining module 202 is configured to obtain the privilege information in the access token corresponding to the token information according to the token information of the initiator that is carried by the access control decision request, and according to the access control request a target resource that the initiator needs to access, and an access control policy associated with the target resource, where the privilege information is used. Representing the privilege that the initiator can use during the access control process;
  • the evaluation module 203 is configured to: according to the access control policy and the privilege information, evaluate the access control decision request, and carry the evaluation result in the access control decision response, and return the result to the PEP entity, so that the PEP entity according to the The evaluation results perform resource access.
  • the evaluating module 203 is specifically configured to: verify validity of the access token corresponding to the token information; and after determining that the access token corresponding to the token information is valid, according to the access control policy and the Privilege information that evaluates the access control decision request.
  • the obtaining module 202 is further configured to: obtain the access token or the privilege information from the token resource associated with the initiator; or pass the policy
  • the information point PIP entity obtains the access token or the privilege information from the token resource.
  • a PEP entity is also provided in the embodiment of the present application.
  • the principle of the PEP entity is similar to the access control method shown in Figure 11 above. Therefore, the implementation of the PEP entity can refer to the method. Implementation, repetition will not be repeated.
  • the PEP entity includes:
  • the sending module 211 is configured to send an access control decision request to the policy decision point PDP entity, where the access control decision request is generated according to the resource access request of the initiator, where the access control decision request includes the resource access request The token information of the initiator that is carried;
  • the receiving module 212 is configured to receive an access control decision response returned by the PDP entity.
  • the access control module 213 is configured to perform resource access according to the evaluation result carried in the access control decision response.
  • the initiator includes a processor 221, an input interface 222, an output interface 223, a memory 224, and a system bus 225;
  • the processor 221 is responsible for logical operations and processing.
  • the memory 224 includes a memory and a hard disk, and can store data used by the processor 221 in performing operations.
  • the input interface 222 is for reading data transmitted by the external device under the control of the processor 221, and the output interface 223 outputs data to the external device under the control of the processor 221.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 221 and various circuits of memory and hard disks represented by memory 224.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the processor 221 reads the program in the memory 224 to complete the function of the token obtaining module 173 shown in FIG. 17.
  • the processor 221 reads the program in the memory 224 to complete the function of the token obtaining module 173 shown in FIG. 17.
  • the input interface 222 is used under the control of the processor 221 to complete the function of the receiving module 172 shown in FIG. 17. For details, refer to the related description in the embodiment shown in FIG.
  • the output interface 223 is used to complete the function of the sending module 171 shown in FIG. 17 under the control of the processor 221. For details, refer to the related description in the embodiment shown in FIG.
  • the token issuing entity includes a processor 231, an input interface 232, an output interface 233, a memory 234, and a system bus 235;
  • the processor 231 is responsible for logical operations and processing.
  • the memory 234 includes a memory and a hard disk, and can store data used by the processor 231 when performing operations.
  • the input interface 232 is for reading data transmitted by an external device under the control of the processor 231, and the output interface 233 outputs data to the external device under the control of the processor 231.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 231 and various circuits of memory and hard disks represented by memory 234.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the processor 231 reads the program in the memory 234 to complete the function of the token issuing module 182 shown in FIG. 18. For details, refer to the related description in the embodiment shown in FIG. 18.
  • the input interface 232 is configured to perform the functions of the first receiving module 181 and the second receiving module 184 shown in FIG. 18 under the control of the processor 231. For details, refer to the related description in the embodiment shown in FIG. 18.
  • the output interface 233 is configured to perform the functions of the first sending module 183 and the second sending module 185 shown in FIG. 18 under the control of the processor 231. For details, refer to the related description in the embodiment shown in FIG. 18.
  • the CSE includes a processor 241, an input interface 242, an output interface 243, a memory 244, and a system bus 245;
  • the processor 241 is responsible for logical operations and processing.
  • the memory 244 includes a memory and a hard disk, and can store data used by the processor 241 when performing operations.
  • the input interface 242 is for reading data transmitted by an external device under the control of the processor 241, and the output interface 243 outputs data to the external device under the control of the processor 241.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 241 and various circuits of memory and hard disks represented by memory 244.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the processor 241 reads the program in the memory 244 to complete the resource creation shown in FIG.
  • the processor 241 reads the program in the memory 244 to complete the resource creation shown in FIG.
  • the input interface 242 is used to perform the functions of the receiving module 191 shown in FIG. 19 under the control of the processor 241. For details, refer to the related description in the embodiment shown in FIG.
  • the output interface 243 is used to perform the functions of the sending module 193 shown in FIG. 19 under the control of the processor 241. For details, refer to the related description in the embodiment shown in FIG.
  • the PDF entity includes a processor 251, an input interface 252, an output interface 253, a memory 254, and a system bus 255;
  • the processor 251 is responsible for logical operations and processing.
  • the memory 254 includes a memory and a hard disk, and can store data used by the processor 251 when performing operations.
  • the input interface 252 is for reading data transmitted by an external device under the control of the processor 251, and the output interface 253 outputs data to the external device under the control of the processor 251.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 251 and various circuits of memory and hard disks represented by memory 254.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the processor 251 reads the program in the memory 254 to complete the functions of the obtaining module 202 and the evaluating module 203 shown in FIG. 20 .
  • the processor 251 reads the program in the memory 254 to complete the functions of the obtaining module 202 and the evaluating module 203 shown in FIG. 20 .
  • the processor 251 reads the program in the memory 254 to complete the functions of the obtaining module 202 and the evaluating module 203 shown in FIG. 20 .
  • the processor 251 reads the program in the memory 254 to complete the functions of the obtaining module 202 and the evaluating module 203 shown in FIG. 20 .
  • the input interface 252 is used to perform the functions of the receiving module 201 shown in FIG. 20 under the control of the processor 251. For details, refer to the related description in the embodiment shown in FIG.
  • the PEP entity includes a processor 261, an input interface 262, an output interface 263, a memory 264, and a system bus 265;
  • the processor 261 is responsible for logical operations and processing.
  • the memory 264 includes a memory and a hard disk, and can store data used by the processor 261 in performing operations.
  • the input interface 262 is for reading data transmitted by an external device under the control of the processor 261, and the output interface 263 outputs data to the external device under the control of the processor 261.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 261 and various circuits of memory and hard disks represented by memory 264.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the processor 261 reads the program in the memory 264 to complete the function of the access control module 213 shown in FIG. 21 .
  • the processor 261 reads the program in the memory 264 to complete the function of the access control module 213 shown in FIG. 21 .
  • the processor 261 reads the program in the memory 264 to complete the function of the access control module 213 shown in FIG. 21 .
  • the processor 261 reads the program in the memory 264 to complete the function of the access control module 213 shown in FIG. 21 .
  • the input interface 262 is used to complete the function of the receiving module 212 shown in FIG. 21 under the control of the processor 261. For details, refer to the related description in the embodiment shown in FIG. 21.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种访问控制方法和访问令牌颁发方法、设备，用于解决目前oneM2M中如何基于发起方具有的特权进行访问控制，还没有给出具体的实现方法的问题。令牌颁发方法包括：发起方向令牌颁发实体发送访问令牌申请请求，其中，访问令牌申请请求用于请求令牌颁发实体为发起方在访问控制过程需要使用的特权颁发访问令牌；发起方接收令牌颁发实体返回的访问令牌申请响应，以确定访问令牌是否颁发成功。本申请实现了访问令牌的动态颁发，以使PDP实体能够基于访问控制策略和访问令牌，对发起方的资源访问请求进行评估，以确定是否允许发起方对目标资源的访问。

Description

一种访问控制方法和访问令牌颁发方法、设备
本申请要求在2015年11月03日提交中国专利局、申请号为201510737821.8、申请名称为“一种访问控制方法和访问令牌颁发方法、设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别涉及一种访问控制方法和访问令牌颁发方法、设备。
背景技术
物联网标准化组织oneM2M致力于开发用于构造一个公共的M2M(Machine-To-Machine，机器对机器通信)服务层(Service Layer)的技术规范。oneM2M的功能架构如图1所示，定义了三种基本实体：
AE(Application Entity，应用实体)：应用实体位于应用层，该实体可实现一个M2M应用服务逻辑。
CSE(Common Services Entity，公共服务实体)：一个公共服务实体由一组M2M环境中的“公共服务功能(common service functions)”构成。
NSE(Underlying Network Services Entity，底层网络服务实体)：一个网络服务实体向CSEs提供底层网络服务。
oneM2M通过采用对标准的资源树的操作实现服务层资源共享和交互。根据oneM2M TS-0001中关于功能架构的定义，oneM2M资源树的形式如图2所示。其中，CSEBase1表示一个CSE根资源<CSEBase>，CSE1表示一个远程CSE<remoteCSE>资源，APP1表示一个<AE>资源，CONT1和CONT2分别代表一个容器<container>资源，ACP1和ACP2分别代表一个访问控制策略<accessControlPolicy>资源。对于oneM2M资源可进行创建、查询、修改和删除等操作。oneM2M定义的资源中与授权相关的资源为访问控制策略<accessControlPolicy>资源，其中定义有访问控制策略(Access Control Policy)，<accessControlPolicy>资源由资源身份标识(ID)唯一标识。其他资源通过资源中的accessControlPolicyIDs属性指定适用的访问控制策略。
oneM2M安全解决方案技术规范(oneM2M TS-0003:Security Solutions)中给出了如图3所示的授权架构，该架构中各授权实体包括：
PEP(Policy Enforcement Point，策略执行点)实体，与需要访问控制的应用系统共存，并由应用系统调用。PEP实体根据用户的访问请求生成相应的访问控制决策请求(简称决 策请求)，发送给PDP(Policy Decision Point，策略决策点)实体，并根据PDP实体的访问控制决策响应确定是否执行用户的访问请求。
PDP实体，根据访问控制策略评估是否允许由PEP实体发送来的访问控制决策请求，并将评估结果通过访问控制决策响应返回给PEP实体。
PRP(Policy Retrieval Point，策略获取点)实体，根据PDP实体提供的访问控制策略请求(简称策略请求)获取适用的访问控制策略，并将获取的访问控制策略通过访问控制策略响应返回给PDP实体。
PIP(Policy Information Point，策略信息点)实体，根据PDP实体的访问控制策略请求获取与用户、资源或环境相关的属性，例如访问用户的互联网协议(IP)地址、资源的创建者、当前的时间等，然后将获得的各种属性返回给PDP实体。
oneM2M的基本授权流程如下：
1、PEP实体根据用户的访问请求生成访问控制决策请求(Access Control Decision Request)发送给PDP实体；
2、PDP实体根据PEP实体的访问控制决策请求，向PRP实体发送访问控制策略请求(Access Control Policy Request)；
3、PRP实体根据访问控制策略请求，获取适用的访问控制策略并返回给PDP。
4、PDP实体根据PRP实体返回的访问控制策略评估访问控制决策请求，并将评估结果携带在访问控制决策响应中返回给PEP实体。在评估过程中，若需要其他属性，则向PIP实体发送访问控制属性请求，否则执行步骤6。
5、PIP实体根据访问控制属性请求，获取与访问控制相关的属性并返回给PDP实体。
6、PEP实体根据访问控制决策响应，决定是否执行用户的访问请求。
在访问控制过程中，发起方有时会具有特权，如发起方的角色信息等，这样，PDP实体在对发起方的资源访问请求进行评估时，不仅要基于相应的访问控制策略，还需要考虑该发起方具有的特权。目前oneM2M中如何基于发起方具有的特权进行访问控制，还没有给出具体的实现方法。
发明内容
本申请实施例提供了一种访问控制方法和访问令牌颁发方法、设备，用于解决目前oneM2M中如何基于发起方具有的特权进行访问控制，还没有给出具体的实现方法的问题。
本申请实施例提供的一种访问令牌颁发方法，包括：
发起方向令牌颁发实体发送访问令牌申请请求，其中，所述访问令牌申请请求用于请 求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
所述发起方接收所述令牌颁发实体返回的访问令牌申请响应，以确定访问令牌是否颁发成功。
可选的，所述发起方接收所述令牌颁发实体返回的访问令牌申请响应之后，所述方法还包括：
所述发起方从与所述发起方关联的令牌资源中，获取所述访问令牌或者所述访问令牌中的特权信息，其中，所述特权信息用于表示发起方在访问控制过程能够使用的特权。
本申请实施例提供的另一种访问令牌颁发方法，包括：
令牌颁发实体接收发起方发送的访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
所述令牌颁发实体根据所述访问令牌申请请求，生成访问令牌，并向公共服务实体CSE发送令牌资源创建请求，以请求所述CSE为所述访问令牌创建与所述发起方关联的令牌资源；
所述令牌颁发实体接收所述CSE返回的令牌资源创建响应，以确定所述CSE是否已完成所述令牌资源的创建；
所述令牌颁发实体向所述发起方返回访问令牌申请响应，以通知所述发起方所述访问令牌是否颁发成功。
可选的，所述令牌颁发实体接收所述发起方发送的访问令牌申请请求之后，还包括：
所述令牌颁发实体根据本地保存的授权策略，确定是否同意所述发起方发送的访问令牌申请请求；或者
所述令牌颁发实体通过特权授权功能实体，确定是否同意所述发起方发送的访问令牌申请请求。
可选的，所述令牌颁发实体接收所述CSE返回的令牌资源创建响应之后，所述方法还包括：
所述令牌颁发实体向所述CSE发送令牌资源修改请求，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
所述令牌颁发实体接收所述CSE发送的令牌资源修改响应，以确定所述CSE是否已完成令牌资源的修改。
本申请实施例提供的再一种访问令牌颁发方法，包括：
公共服务实体CSE接收令牌颁发实体发送的令牌资源创建请求，其中，所述令牌资源创建请求用于请求所述CSE为所述令牌颁发实体颁发的访问令牌创建令牌资源；
所述CSE根据令牌资源创建请求，创建与发起方关联的令牌资源；
所述CSE向所述令牌颁发实体返回令牌资源创建响应，以通知所述令牌颁发实体所述CSE是否已完成所述令牌资源的创建。
可选的，所述CSE接收令牌颁发实体发送的令牌资源创建请求之后，所述CSE创建令牌资源之前，还包括：
所述CSE根据与所述令牌颁发实体关联的访问控制策略，确定所述令牌颁发实体是否有权创建令牌资源；
所述CSE根据令牌资源创建请求，创建令牌资源，包括：所述CSE在确定所述令牌颁发实体有权创建令牌资源时，根据令牌资源创建请求，创建所述令牌资源。
可选的，所述CSE向所述令牌颁发实体返回令牌资源创建响应之后，所述方法还包括：
所述CSE接收所述令牌颁发实体发送的令牌资源修改请求其中，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
所述CSE根据所述令牌资源修改请求，对需要修改的令牌资源进行修改；
所述CSE向所述令牌颁发实体发送令牌资源修改响应，以通知所述令牌颁发实体所述CSE是否已完成令牌资源的修改。
可选的，所述CSE接收所述令牌颁发实体发送的令牌资源创建请求之后，还包括：所述CSE确定出与所述发起方需要访问的目标资源相关联的访问控制策略，并根据所述访问控制策略确定所述发起方是否有权创建令牌资源；
所述CSE根据令牌资源创建请求，创建与发起方关联的令牌资源，包括：所述CSE在确定出所述发起方有权创建令牌资源后，根据令牌资源创建请求，创建所述发起方关联的令牌资源。
本申请实施例提供的一种访问控制方法，所述方法包括：
策略决策点PDP实体接收策略执行点PEP实体发送的访问控制决策请求；
所述PDP实体根据所述访问控制决策请求携带的发起方的令牌信息，获取所述令牌信息对应的访问令牌中的特权信息，并根据所述访问控制决策请求携带的所述发起方需要访问的目标资源，获取所述目标资源相关联的访问控制策略，其中，所述特权信息用于表示所述发起方在访问控制过程能够使用的特权；
所述PDP实体根据访问控制策略和所述特权信息，评估所述访问控制决策请求，并将评估结果携带在访问控制决策响应中返回给所述PEP实体，以使所述PEP实体根据所述评估结果执行资源访问。
可选的，所述PDP实体根据访问控制策略和所述特权信息，评估所述访问控制决策请求之前，还包括：所述PDP实体验证所述令牌信息对应的访问令牌的有效性；
所述PDP实体根据访问控制策略和所述特权信息，评估所述访问控制决策请求，包括：所述PDP实体在确定所述令牌信息对应的访问令牌有效后，根据访问控制策略和所述特权信息，评估所述访问控制决策请求。
可选的，所述令牌信息为：访问令牌、或者访问令牌的标识信息。
可选的，若所述令牌信息为所述标识信息，PDP实体接收PEP实体发送的访问控制决策请求之后，还包括：
所述PDP实体从所述发起方关联的令牌资源中，获取所述访问令牌或所述特权信息；或者
所述PDP实体通过策略信息点PIP实体，从令牌资源中获取所述访问令牌或所述特权信息。
本申请实施例提供的另一种访问控制方法，包括：
策略执行点PEP实体向策略决策点PDP实体发送访问控制决策请求，其中，所述访问控制决策请求是根据发起方的资源访问请求生成的，所述访问控制决策请求包含所述资源访问请求中携带的发起方的令牌信息；
所述PEP实体接收所述PDP实体返回的访问控制决策响应，并根据所述访问控制决策响应中携带的评估结果执行资源访问。
本申请实施例提供的一种发起方，包括：
发送模块，用于向令牌颁发实体发送访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
接收模块，用于接收所述令牌颁发实体返回的访问令牌申请响应，以确定访问令牌是否颁发成功。
可选的，所述发起方还包括：令牌获取模块，用于从与所述发起方关联的令牌资源中，获取所述访问令牌或者所述访问令牌中的特权信息，其中，所述特权信息用于表示发起方在访问控制过程能够使用的特权。
本申请实施例提供的一种令牌颁发实体，所述令牌颁发实体包括：
第一接收模块，用于接收发起方发送的访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
令牌颁发模块，用于根据所述访问令牌申请请求，生成访问令牌；
第一发送模块，用于向公共服务实体CSE发送令牌资源创建请求，以请求所述CSE为所述访问令牌创建与所述发起方关联的令牌资源；
第二接收模块，用于接收所述CSE返回的令牌资源创建响应，以确定所述CSE是否已完成所述令牌资源的创建；
第二发送模块，用于向所述发起方返回访问令牌申请响应，以通知所述发起方所述访问令牌是否颁发成功。
可选的，所述令牌颁发模块还用于：根据本地保存的授权策略，确定是否同意所述发起方发送的访问令牌申请请求；或者通过特权授权功能实体，确定是否同意所述发起方发送的访问令牌申请请求。
可选的，所述第一发送模块还用于：向所述CSE发送令牌资源修改请求，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
所述第二接收模块还用于：接收所述CSE发送的令牌资源修改响应，以确定所述CSE是否已完成令牌资源的修改。
本申请实施例提供的一种公共服务实体CSE，包括：
接收模块，用于接收令牌颁发实体发送的令牌资源创建请求，其中，所述令牌资源创建请求用于请求所述CSE为所述令牌颁发实体颁发的访问令牌创建令牌资源；
资源创建模块，用于根据令牌资源创建请求，创建与发起方关联的令牌资源；
发送模块，用于向所述令牌颁发实体返回令牌资源创建响应，以通知所述令牌颁发实体所述CSE是否已完成所述令牌资源的创建。
可选的，所述资源创建模块具体用于：根据与所述令牌颁发实体关联的访问控制策略，确定所述令牌颁发实体是否有权创建令牌资源；在确定所述令牌颁发实体有权创建令牌资源时，根据令牌资源创建请求，创建所述令牌资源。
可选的，所述接收模块还用于：接收所述令牌颁发实体发送的令牌资源修改请求其中，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
所述资源创建模块还用于：根据所述令牌资源修改请求，对需要修改的令牌资源进行修改；
所述发送模块还用于：向所述令牌颁发实体发送令牌资源修改响应，以通知所述令牌颁发实体所述CSE是否已完成令牌资源的修改。
可选的，所述资源创建模块具体用于：确定出与所述发起方需要访问的目标资源相关 联的访问控制策略，并根据所述访问控制策略确定所述发起方是否有权创建令牌资源；在确定出所述发起方有权创建令牌资源后，根据令牌资源创建请求，创建所述发起方关联的令牌资源。
本申请实施例提供的一种策略决策点PDP实体，包括：
接收模块，用于接收策略执行点PEP实体发送的访问控制决策请求；
获取模块，用于根据所述访问控制决策请求携带的发起方的令牌信息，获取所述令牌信息对应的访问令牌中的特权信息，并根据所述访问控制决策请求携带的所述发起方需要访问的目标资源，获取所述目标资源相关联的访问控制策略，其中，所述特权信息用于表示所述发起方在访问控制过程能够使用的特权；
评估模块，用于根据访问控制策略和所述特权信息，评估所述访问控制决策请求，并将评估结果携带在访问控制决策响应中返回给所述PEP实体，以使所述PEP实体根据所述评估结果执行资源访问。
可选的，所述评估模块具体用于：验证所述令牌信息对应的访问令牌的有效性；在确定所述令牌信息对应的访问令牌有效后，根据访问控制策略和所述特权信息，评估所述访问控制决策请求。
可选的，若所述令牌信息为所述标识信息，所述获取模块还用于：从所述发起方关联的令牌资源中，获取所述访问令牌或所述特权信息；或者通过策略信息点PIP实体，从令牌资源中获取所述访问令牌或所述特权信息。
本申请实施例提供的一种策略执行点PEP实体，包括：
发送模块，用于向策略决策点PDP实体发送访问控制决策请求，其中，所述访问控制决策请求是根据发起方的资源访问请求生成的，所述访问控制决策请求包含所述资源访问请求中携带的发起方的令牌信息；
接收模块，用于接收所述PDP实体返回的访问控制决策响应；
访问控制模块，用于根据所述访问控制决策响应中携带的评估结果，执行资源访问。
本申请实施例提供的另一种发起方包括处理器、输入接口、输出接口、存储器和系统总线；其中：
所述输出接口在所述处理器的控制下，向令牌颁发实体发送访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
所述输入接口在所述处理器的控制下，接收所述令牌颁发实体返回的访问令牌申请响应，以确定访问令牌是否颁发成功。
可选的，所述处理器读取存储器中的程序，用于执行：从与所述发起方关联的令牌资源中，获取所述访问令牌或者所述访问令牌中的特权信息，其中，所述特权信息用于表示发起方在访问控制过程能够使用的特权。
本申请实施例提供的另一种令牌颁发实体包括：处理器、输入接口、输出接口、存储器和系统总线；其中：
所述输入接口在处理器的控制下，接收发起方发送的访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
所述处理器读取存储器中的程序，用于执行：根据所述访问令牌申请请求，生成访问令牌；并控制所述输出接口向公共服务实体CSE发送令牌资源创建请求，以请求所述CSE为所述访问令牌创建与所述发起方关联的令牌资源；
所述输入接口在所述处理器的控制下，接收所述CSE返回的令牌资源创建响应，以确定所述CSE是否已完成所述令牌资源的创建；
所述输出接口在所述处理器的控制下，向所述发起方返回访问令牌申请响应，以通知所述发起方所述访问令牌是否颁发成功。
可选的，所述处理器还执行：根据本地保存的授权策略，确定是否同意所述发起方发送的访问令牌申请请求；或者通过特权授权功能实体，确定是否同意所述发起方发送的访问令牌申请请求。
可选的，所述输出接口在所述处理器的控制下，还向所述CSE发送令牌资源修改请求，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
所述输入接口在所述处理器的控制下，还接收所述CSE发送的令牌资源修改响应，以确定所述CSE是否已完成令牌资源的修改。
本申请实施例提供的另一种CSE，包括：处理器、输入接口、输出接口、存储器和系统总线；其中：
所述输入接口在处理器的控制下，接收令牌颁发实体发送的令牌资源创建请求，其中，所述令牌资源创建请求用于请求所述CSE为所述令牌颁发实体颁发的访问令牌创建令牌资源；
所述处理器读取存储器中的程序，用于执行：根据令牌资源创建请求，创建与发起方关联的令牌资源；并控制所述输出接口向所述令牌颁发实体返回令牌资源创建响应，以通知所述令牌颁发实体所述CSE是否已完成所述令牌资源的创建。
可选的，所述处理器具体执行：根据与所述令牌颁发实体关联的访问控制策略，确定所述令牌颁发实体是否有权创建令牌资源；在确定所述令牌颁发实体有权创建令牌资源时，根据令牌资源创建请求，创建所述令牌资源。
可选的，所述输入接口在处理器的控制下，还接收所述令牌颁发实体发送的令牌资源修改请求其中，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
所述处理器还执行：根据所述令牌资源修改请求，对需要修改的令牌资源进行修改；并控制所述输出接口向所述令牌颁发实体发送令牌资源修改响应，以通知所述令牌颁发实体所述CSE是否已完成令牌资源的修改。
可选的，所述处理器具体执行：确定出与所述发起方需要访问的目标资源相关联的访问控制策略，并根据所述访问控制策略确定所述发起方是否有权创建令牌资源；在确定出所述发起方有权创建令牌资源后，根据令牌资源创建请求，创建所述发起方关联的令牌资源。
本申请实施例提供另一种PDP实体，包括：处理器、输入接口、输出接口、存储器和系统总线；其中：
所述输入接口在处理器的控制下，接收策略执行点PEP实体发送的访问控制决策请求；
所述处理器读取存储器中的程序，用于执行：根据所述访问控制决策请求携带的发起方的令牌信息，获取所述令牌信息对应的访问令牌中的特权信息，并根据所述访问控制决策请求携带的所述发起方需要访问的目标资源，获取所述目标资源相关联的访问控制策略，其中，所述特权信息用于表示所述发起方在访问控制过程能够使用的特权；根据访问控制策略和所述特权信息，评估所述访问控制决策请求，并将评估结果携带在访问控制决策响应中，通过所述输出接口返回给所述PEP实体，以使所述PEP实体根据所述评估结果执行资源访问。
可选的，所述处理器具体执行：验证所述令牌信息对应的访问令牌的有效性；在确定所述令牌信息对应的访问令牌有效后，根据访问控制策略和所述特权信息，评估所述访问控制决策请求。
可选的，若所述令牌信息为所述标识信息，所述处理器还执行：从所述发起方关联的令牌资源中，获取所述访问令牌或所述特权信息；或者通过策略信息点PIP实体，从令牌资源中获取所述访问令牌或所述特权信息。
本申请实施例提供另一种PEP实体，包括：处理器、输入接口、输出接口、存储器和系统总线；其中：
所述输出接口在处理器的控制下，向PDP实体发送访问控制决策请求，其中，所述访问控制决策请求是根据发起方的资源访问请求生成的，所述访问控制决策请求包含所述资源访问请求中携带的发起方的令牌信息；
所述输入接口在处理器的控制下，接收所述PDP实体返回的访问控制决策响应；
所述处理器读取存储器中的程序，用于执行：根据所述访问控制决策响应中携带的评估结果，执行资源访问。
基于上述任一实施例，本申请实施例中，所述令牌资源具有：
令牌标识属性，用于存储访问令牌的标识信息；
令牌颁发者属性，用于存储访问令牌颁发者的标识信息；
起始时间属性，用于存储访问令牌的有效期的起始时间；
结束时间属性，用于存储访问令牌的有效期的结束时间；
令牌值属性，用于存储访问令牌或访问令牌中的特权信息。
可选的，所述令牌资源还具有以下至少一个属性：
令牌类型属性，用于存储访问令牌的类型信息；
令牌名字属性，用于存储访问令牌的可阅读名字；
应用类别属性，用于存储访问令牌适用的应用类别。
可选的，所述令牌资源为所述发起方的注册资源的子资源。
基于上述任一实施例，本申请实施例中，所述访问令牌包括以下内容：
所述访问令牌的标识信息、所述访问令牌颁发者的标识信息、所述访问令牌所有者的标识信息、所述访问令牌的有效期的起始时间、所述访问令牌的有效期的结束时间、以及所述特权信息。
可选的，所述访问令牌还包括以下至少一项内容：
所述访问令牌的类型信息、所述访问令牌的可阅读名字、所述访问令牌适用的应用类别、以及应用系统定义的所述访问令牌的内容。
本申请实施例提供的令牌颁发方法和设备中，发起方向令牌颁发实体发送访问令牌申请请求，以请求令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；令牌颁发实体根据所述访问令牌申请请求，生成访问令牌，并向公共服务实体CSE发送令牌资源创建请求，以请求所述CSE为所述访问令牌创建与所述发起方关联的令牌资源；CSE根据令牌资源创建请求，创建与发起方关联的令牌资源，从而已完成访问令牌的颁发过程，实现了访问令牌的动态颁发，以使PDP实体能够基于访问控制策略和访问令牌，对发起方的资源访问请求进行评估，以确定是否允许发起方对目标资源的访问。
本申请实施例提供的访问控制方法和设备中，PDP实体接收到PEP实体发送的访问控制决策请求后，根据所述令牌信息，获取所述令牌信息对应的访问令牌中的特权信息，并根据所述访问控制决策请求携带的所述发起方需要访问的目标资源，获取所述目标资源相关联的访问控制策略；PDP实体根据访问控制策略和所述特权信息，评估所述访问控制决策请求，并将评估结果携带在访问控制决策响应中返回给所述PEP实体，以使所述PEP实体根据所述评估结果执行资源访问。由于PDP实体基于访问控制策略和特权信息，对访问控制决策请求进行评估，以确定是否允许发起方对目标资源的访问，从而实现了基于访问令牌的访问控制过程。
附图说明
图1为oneM2M的功能架构的示意图；
图2为oneM2M资源树的结构示意图；
图3为oneM2M的授权架构的示意图；
图4为本申请实施例中的访问令牌的结构示意图；
图5为本申请实施例中的令牌资源的结构示意图；
图6为本申请实施例中的<AE>资源的结构示意图；
图7为本申请实施例中一种访问令牌颁发方法的流程示意图；
图8为本申请实施例中另一种访问令牌颁发方法的流程示意图；
图9为本申请实施例中再一种访问令牌颁发方法的流程示意图；
图10为本申请实施例中一种访问控制方法的流程示意图；
图11为本申请实施例中另一种访问控制方法的流程示意图；
图12为本申请实施例中各实体之间的连接关系示意图；
图13为本申请实施例中各实体之间的交互过程的示意图；
图14为本申请实施例中的实施例一中各实体之间的连接关系示意图；
图15为本申请实施例中的实施例一中的资源树的示意图；
图16为本申请实施例中的实施例一中访问令牌的颁发和使用过程的示意图；
图17为本申请实施例中的一种发起方的示意图；
图18为本申请实施例中的一种令牌颁发实体的示意图；
图19为本申请实施例中的一种CSE的示意图；
图20为本申请实施例中的一种PDP实体的示意图；
图21为本申请实施例中的一种PEP实体的示意图；
图22为本申请实施例中的另一种发起方的示意图；
图23为本申请实施例中的另一种令牌颁发实体的示意图；
图24为本申请实施例中的另一种CSE的示意图；
图25为本申请实施例中的另一种PDP实体的示意图；
图26为本申请实施例中的另一种PEP实体的示意图。
具体实施方式
本申请实施例中，通过定义访问令牌，以使在访问控制过程中，PDP实体基于访问控制策略和访问令牌，对发起方的资源访问请求进行评估，以确定是否允许发起方对目标资源的访问，实现了动态授权访问令牌，也实现了基于访问令牌的访问控制方案。
首先对本申请实施例中涉及到的访问令牌和令牌资源进行说明。
一、访问令牌，即与访问控制相关的令牌，该访问令牌的结构以及内部存储的信息如图4所示，访问令牌内存储的主要信息包括：
令牌标识(tokenID)，即访问令牌的标识信息，用于唯一标识该访问令牌；
所有者标识(holderID)，即访问令牌所有者的标识信息；
颁发者(issuer)，即访问令牌颁发者的标识信息；
起始时间(startTime)，即访问令牌的有效期的起始时间；
结束时间(expiryTime)，即访问令牌的有效期的结束时间；以及
特权(privileges)，用于表示发起方在访问控制过程能够使用的特权信息，例如角色列表，访问控制列表等。其中，发起方为发起资源访问的实体，发起方可以为AE或CSE等实体。
可选的，访问令牌内还存储如下信息中的至少一种：
令牌类型(tokenType)，即访问令牌的类型信息，该信息根据应用系统设计的令牌种类，例如携带角色的角色令牌、携带针对某个发起方所拥有的特权的令牌、oneM2M服务提供商(M2M Service Provider)定义的服务签约角色(Service Subscription Role)令牌、由oneM2M应用服务提供商(M2M Application Service Provider)定义的与某具体应用相关的应用令牌等。
令牌可阅读名字(tokenName)，即该访问令牌的可阅读名字；
访问令牌适用的应用类别(appCategory)，即该访问令牌适用的应用类别，可以是该访问令牌适用的应用类别，例如设备管理应用，智能家居应用，智能交通应用等。发起方可根据该内容，选择与当前资源访问所属的应用类别匹配的访问令牌，以用于对目标资源 的访问控制过程；
扩展(extensions)，即应用系统自定义的该访问令牌的内容，应用系统可根据实际需要自行定义的令牌内容。
二、令牌资源，本申请实施例定义了新的oneM2M资源——令牌资源(即<token>资源)，用以在CSE资源树中存储用于访问控制的访问令牌(或该访问令牌中的用于表示发起方在访问控制过程能够使用的特权的特权信息)，以及及其相关的描述信息，并重新定义了<CSEBase>资源，<remoteCSE>占用和<AE>资源等三个资源，以便它们能够使用新定义的<token>资源存储颁发给它们的访问令牌。
新定义的<token>资源的基本结构如图5所示，其资源类型为oneM2M普通资源(Normal Resource)。<token>资源除了包含oneM2M普通资源所共有的通用属性(Universal Attribute)外，还包含有公共属性(Common Attribute)有效时间(expirationTime)和子资源<subscription>资源(也称为签约资源)。每个<token>资源实例用于描述一个访问令牌，以方便资源管理和令牌使用。<token>资源新定义的资源具有如下属性：
令牌标识(tokenID)属性，用于存储访问令牌的标识信息，该标识信息用于唯一标识一个访问令牌；
颁发者(issuer)属性，用于存储访问令牌的颁发者的标识信息；
起始时间(startTime)属性，用于存储访问令牌的有效起始时间；
结束时间(expiryTime)属性，用于存储访问令牌的有效结束时间；
令牌值(tokenValue)属性：用于存储访问令牌或访问令牌中的特权信息。
可选的，令牌资源还具有以下至少一个属性：
令牌类型(tokenType)属性，用于存储访问令牌的类型信息，该信息根据应用系统设计的令牌种类，例如携带角色的角色令牌、携带针对某个发起方所拥有的特权的令牌、oneM2M服务提供商定义的服务签约角色令牌、由oneM2M应用服务提供商定义的与某具体应用相关的应用令牌等；
令牌名字(tokenName)属性，用于存储访问令牌的可阅读名字；
应用类别(appCategory)属性，用于存储访问令牌适用的应用类别，例如设备管理应用，智能家居应用，智能交通应用等。可选的，发起方可根据该内容确定应该选用相应的令牌用于具体的资源访问。
举例说明，重新定义的<AE>资源的结构如图6所示，只是增加了<token>资源作为其子资源，<AE>资源下<token>子资源的数量可以为0或n个(n为大于或等于1的整数)，用于表示那些特权privileges已经赋给了该AE。
<CSEBase>资源和<remoteCSEBase>资源的重定义情况与<AE>的重定义类似，也即仅是在他们的资源树下增加了<token>资源作为其子资源，且子资源的数量可以为0或n个(n为大于或等于1的整数)。
本申请实施例中，令牌资源是与发起方相关联的资源，可以创建在CSE中发起方的注册资源中，作为该发起方的注册资源的子资源；也可以创建在CSE中的发起方的非注册资源，作为该发起方的非注册资源的子资源。
需要说明的是，若令牌资源创建在发起方的非注册资源中，创建该令牌资源的CSE或令牌颁发实体还需要执行：
将该令牌资源的创建地址通知给发起方，以使发起方能够根据创建地址，读取到该令牌资源中的访问令牌和/或该访问令牌的相关的信息；以及
将该令牌资源的创建地址通知给PDP实体或PIP实体，以使PDP实体或PIP实体能够根据创建地址，读取到该令牌资源中的访问令牌和/或该访问令牌的相关的信息。
下面结合说明书附图对本申请实施例作进一步详细描述。应当理解，此处所描述的实施例仅用于说明和解释本申请，并不用于限定本申请。
本申请实施例提供的一种发起方侧的访问令牌颁发方法，如图7所示，所述方法包括：
S71、发起方向令牌颁发实体发送访问令牌申请请求，其中，所述访问令牌申请请求用于请求令牌颁发实体为发起方在访问控制过程需要使用的特权颁发访问令牌；
其中，令牌颁发实体为发起方所颁发的访问令牌用于该发起方的访问控制过程中。
本申请实施例中，令牌颁发(Token Authority)实体负责向发起方(AE或CSE等)颁发访问令牌。
S72、发起方接收令牌颁发实体返回的访问令牌申请响应，以确定访问令牌是否颁发成功。
本申请实施例中，发起方向令牌颁发实体发送访问令牌申请请求，以请求令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌，实现了访问令牌的动态颁发，以使PDP实体能够基于访问控制策略和访问令牌，对发起方的资源访问请求进行评估，以确定是否允许发起方对目标资源的访问。
本申请实施例中，在访问令牌成功颁发之后，所述发起方还可以从与该发起方关联的令牌资源中，获取所述访问令牌、或者所述访问令牌中的特权信息，以及所述访问令牌的相关信息(如有效起始时间等)。
基于同一发明构思，本申请实施例提供了一种令牌颁发实体侧的访问令牌颁发方法，与发起方侧相同的部分，具体参见如7所示实施例中的相关描述，此处不再赘述。如图8 所示，该方法包括：
S81、令牌颁发实体接收发起方发送的访问令牌申请请求，其中，所述访问令牌申请请求用于请求令牌颁发实体为发起方在访问控制过程需要使用的特权颁发访问令牌。
S82、令牌颁发实体根据所述访问令牌申请请求，生成访问令牌，并向CSE发送令牌资源创建请求，以请求CSE为所述访问令牌创建与发起方关联的令牌资源。
本申请实施例中所涉及的CSE为任意一个保存有发起方相关联的资源且能够在该发起方的资源下创建令牌资源的CSE。举例说明，令牌颁发实体可以向注册响应CSE(Registrar CSE)发起令牌资源创建请求，以请求注册响应CSE在该发起方的注册资源下创建令牌资源。
S83、令牌颁发实体接收CSE返回的令牌资源创建响应，以确定CSE是否已完成所述令牌资源的创建。
S84、令牌颁发实体向发起方返回访问令牌申请响应，以通知发起方所述访问令牌是否颁发成功。
本申请实施例中，令牌颁发实体在接收到发起方发送的访问令牌申请请求后，生成访问令牌，并请求CSE为所述访问令牌创建与发起方关联的令牌资源，实现了访问令牌的动态颁发，以使PDP实体能够基于访问控制策略和访问令牌，对发起方的资源访问请求进行评估，以确定是否允许发起方对目标资源的访问。
可选的，令牌颁发实体接收发起方发送的访问令牌申请请求之后，还包括：
令牌颁发实体根据本地保存的授权策略，确定是否同意发起方发送的访问令牌申请请求；或者
令牌颁发实体通过特权授权功能实体，确定是否同意发起方发送的访问令牌申请请求。
其中，特权授权功能(Privilege Authorization Function)可提供确认是否同意发起方所申请的用于访问控制的特权的能力，实现该能力的具体方式可由应用系统确定，例如仅提供相关的授权策略，然后由令牌颁发实体执行具体的特权授权检查，或者根据授权策略评估发起方的访问令牌申请请求，然后将评估结果返回给令牌颁发实体，或者是一个有人参加的评估过程等。
基于上述任一实施例，令牌颁发实体接收CSE返回的令牌资源创建响应之后，该方法还包括：
令牌颁发实体向CSE发送令牌资源修改请求，其中，令牌资源修改请求中携带令牌颁发实体重新为发起方颁发的访问令牌；
令牌颁发实体接收CSE发送的令牌资源修改响应，以确定CSE是否已完成令牌资源的修改。
基于同一发明构思，本申请实施例提供了一种CSE侧的访问令牌颁发方法，与令牌颁发实体侧相同的部分，具体参见如8所示实施例中的相关描述，此处不再赘述。如图9所示，该方法包括：
S91、CSE接收令牌颁发实体发送的令牌资源创建请求，其中，所述令牌资源创建请求用于请求CSE为令牌颁发实体颁发的访问令牌创建令牌资源；
S92、CSE根据令牌资源创建请求，创建与发起方关联的令牌资源；
S93、CSE向令牌颁发实体返回令牌资源创建响应，以通知令牌颁发实体CSE是否已完成所述令牌资源的创建。
本申请实施例中，CSE在接收到令牌颁发实体发送的令牌资源创建请求后，为令牌颁发实体颁发的访问令牌创建与发起方关联的令牌资源，实现了访问令牌的动态颁发，以使PDP实体能够基于访问控制策略和访问令牌，对发起方的资源访问请求进行评估，以确定是否允许发起方对目标资源的访问。
本申请实施例中，令牌资源创建请求中携带创建令牌资源所需的信息，具体包括：访问令牌的标识信息、访问令牌颁发者的标识信息、访问令牌所有者的标识信息、访问令牌的有效期的起始时间、访问令牌的有效期的结束时间、以及特权信息。
可选的，令牌资源创建请求中还携带以下至少一种信息：访问令牌的类型信息、访问令牌的可阅读名字、访问令牌适用的应用类别、以及应用系统定义的访问令牌的内容。
基于上述任一实施例，本申请实施例中，S91中CSE接收令牌颁发实体发送的令牌资源创建请求之后，还包括：
CSE确定出与发起方需要访问的目标资源相关联的访问控制策略，并根据确定出的访问控制策略确定发起方是否有权创建令牌资源。
相应的，S92具体包括：CSE在确定出发起方有权创建令牌资源后，根据令牌资源创建请求中携带的创建令牌资源所需的信息，创建与发起方关联的令牌资源。
本申请实施例中，在访问令牌颁发之后，可将所颁发的访问令牌用于发起方对目标资源的访问控制过程中，下面对本申请实施例提供的基于访问令牌的访问控制过程进行说明。
基于同一发明构思，本申请实施例提供的一种PDP实体侧的访问控制方法，如图10所示，所述方法包括：
S101、PDP实体接收PEP实体发送的访问控制决策请求；
S102、PDP实体根据访问控制决策请求携带的发起方的令牌信息，获取该令牌信息对应的访问令牌中的特权信息，并根据访问控制决策请求携带的所述发起方需要访问的目标资源，获取目标资源相关联的访问控制策略，其中，特权信息用于表示发起方在访问控制过程能够使用的特权；
S103、PDP实体根据访问控制策略和所述特权信息，评估访问控制决策请求，并将评估结果携带访问控制决策响应中返回给PEP实体，以使PEP实体根据所述评估结果执行资源访问。
本申请实施例中，PDP实体接收PEP实体发送的访问控制决策请求后，根据访问控制决策请求携带的令牌信息获取该令牌信息对应的访问令牌中的特权信息，根据访问控制决策请求携带的发起方需要访问的目标资源获取目标资源相关联的访问控制策略，之后根据访问控制策略和特权信息，对访问控制决策请求进行评估，以确定是否允许发起方对目标资源的访问，从而实现了基于访问令牌的访问控制过程。
可选的，PDP实体根据访问控制策略和所述特权信息，评估所述访问控制决策请求之前，还包括：PDP实体验证所述令牌信息对应的访问令牌的有效性；
PDP实体根据访问控制策略和所述特权信息，评估所述访问控制决策请求，包括：PDP实体在确定所述令牌信息对应的访问令牌有效后，根据访问控制策略和所述特权信息，评估所述访问控制决策请求。
在实施中，PDP实体验证访问令牌的有效性包括：该访问令牌是否是由合法的令牌颁发实体颁发的，该访问令牌是否仍在有效期内，该访问令牌的所有者标识是否与资源访问请求中的发起方标识相同，该访问令牌中携带的特权是否适用于所访问的目标资源等。若通过这些验证，则根据访问控制策略和所述特权信息评估所述访问控制决策请求。
本申请实施例中，访问控制决策请求携带的令牌信息可以为访问令牌本身，还可以是访问令牌的标识信息。
可选的，若令牌信息为访问令牌的标识信息，PDP实体接收PEP实体发送的访问控制决策请求之后，还包括：
PDP实体从发起方关联的令牌资源中，获取访问令牌或特权信息；或者
PDP实体通过PIP实体，从令牌资源中获取访问令牌或特权信息。
具体的，若令牌信息为访问令牌的标识信息，则PDP实体可以直接利用该标识信息从发起方相关联的资源中的<token>资源中获取令牌值(tokenValue)属性中的访问令牌或特权信息。PDP实体也可以通过PIP实体获取令牌值(tokenValue)中的访问令牌或特权信息，即由PIP实体查询发起方相关联的资源中的<token>资源，并从<token>资源的 tokenValue属性中获取所需的访问令牌或特权信息，然后由PIP实体将获取到的访问令牌或特权信息发送给PDP实体。
基于同一发明构思，本申请实施例提供的一种PEP实体侧的访问控制方法，与PDP实体侧相同的部分具体参见图10所示实施例中的相关描述，此处不再赘述，如图11所示，所述方法包括：
S111、PEP实体向PDP实体发送访问控制决策请求，其中，所述访问控制决策请求是根据发起方的资源访问请求生成的，所述访问控制决策请求包含所述资源访问请求中携带的发起方的令牌信息；
S112、PEP实体接收PDP实体返回的访问控制决策响应，并根据访问控制决策响应中携带的评估结果执行资源访问，其中，评估结果是PDP实体基于发起方需要访问的目标资源相关联的访问控制策略和令牌信息对应的访问令牌中的特权信息得到的。
本申请实施例中，PEP实体向PDP实体发送访问控制决策请求时，携带发起方的令牌信息，以使PDP实体根据访问控制决策请求携带的令牌信息获取该令牌信息对应的访问令牌中的特权信息，根据访问控制决策请求携带的发起方需要访问的目标资源获取目标资源相关联的访问控制策略，之后根据访问控制策略和特权信息，对PEP实体的访问控制决策请求进行评估，以确定是否允许发起方对目标资源的访问，从而实现了基于访问令牌的访问控制过程。
下面从各实体之间的交互过程，对本申请实施例提供的访问令牌的颁发方法和访问控制方法进行详细说明。各实体之间的连接关系如图12所示，其交互过程如图13所示，包括：
步骤1：作为访问控制发起方(Originator)的AE或CSE向令牌颁发实体发送访问令牌申请请求，其中，该请求中包含有令牌特权的描述信息，例如发起方想要进行的资源访问或期望申请的角色等。
步骤2：若令牌颁发实体不能根据本地授权策略确定是否同意发起方的访问令牌申请，则需要向某个外部特权授权功能(Privilege Authorization Function)实体进行查询，以确定发起方是否可以拥有其所申请的特权。
步骤3：特权授权功能实体返回令牌颁发实体所需的授权策略或授权决策。
步骤4：若同意发起方的令牌申请，则令牌颁发实体颁发相应的访问令牌，其中包含有tokenID，holderID，issuer，startTime，expiryTime，tokenType，tokenName，appCategory，privileges等令牌属性信息。
步骤5：令牌颁发实体向注册响应CSE(Registrar CSE)发送令牌资源创建请求，以 请求Registrar CSE在发起方(Originator)的注册资源中创建令牌资源，该请求中包含有创建<token>资源所需的tokenID，holderID，issuer，startTime，expiryTime，tokenType，tokenName，appCategory和accessToken等属性的值。
其中，Registrar CSE，即注册响应CSE，发起方(Originator)注册至该CSE，也即Originator的注册资源创建于该CSE中。在Registrar CSE中，AE的注册资源为<AE>资源，CSE的注册资源为<remoteCSE>资源，基础设施节点CSE(IN-CSE)的令牌资源存储在其<CSEBase>资源下。
步骤6：Registrar CSE接收到令牌颁发实体发送的令牌资源创建请求后做如下处理：
检查与目标AE/CSE资源相关联的访问控制策略，确定Originator是否有权创建<token>资源。若允许，则根据令牌资源创建请求所提供的属性值创建所请求的<token>资源。
步骤7：Registrar CSE将操作结果发送给令牌颁发实体。
步骤8：令牌颁发实体将访问令牌的颁发结果发送给Originator。
步骤9：Originator(AE/CSE)向Registrar CSE中其注册资源发送<token>资源读取请求，以便获取已颁发给该Originator的令牌信息。
步骤10：Registrar CSE将Originator所拥有的令牌以令牌信息列表的方式发送给Originator。
步骤11：Originator利用当前资源访问所属的应用类别与令牌的应用类别进行比较，选择适用的访问令牌，然后向Hosting CSE中的目标资源发送资源操作请求，并将所选择的访问令牌的令牌信息附着在该请求中。
其中，Hosting CSE，即宿主CSE，Originator想要访问的目标资源存在该Hosting CSE的资源树中。在实际应用中Registrar CSE和Hosting CSE既可以为同一个CSE，也可以是不同的CSE。
步骤12：Hosting CSE中的PEP实体根据Originator发送的资源访问请求生成访问控制决策请求，其中包含有Originator提供的令牌信息，然后将该请求发送给PDP实体。
步骤13：若发起方提供了访问令牌本身，则直接执行步骤15；若发起方仅提供了令牌标识(tokenID)，则PDP实体需要利用令牌标识从Originator的注册资源中的<token>资源中获取访问令牌(tokenValue)。
具体的，该访问令牌获取过程既可以通过PIP实体，然后由PIP实体查询该Originator的注册资源中的<token>资源，获取所需的访问令牌，并反馈给PDP实体，也可以由PDP实体直接进行相关的操作。
步骤14：Registrar CSE将查询到的访问令牌发送给PIP实体，然后由PIP实体发送给 PDP实体，或者直接发送给PDP实体。
步骤15：PDP实体验证访问令牌的有效性，包括：访问令牌是否是由合法的令牌颁发机构实体的，是否仍在有效期内，令牌所有者标识是否与资源访问请求中的发起方标识相同，访问令牌中携带的特权是否适用于所访问的资源等。若通过这些检查，则进下一步。
步骤16：利用访问控制策略和发起方的特权信息评估PEP实体发送的访问控制决策请求。
步骤17：PDP实体将评估结果通过访问控制决策响应发送PEP实体。
步骤18：PEP实体接收到访问控制决策响应后，检查发起方的资源访问请求是否被允许，若允许，则执行发起方的资源访问请求。
步骤19：PEP实体将执行结果发送给Originator。
下面通过一个具体实施例，从各实体的交互过程，对本申请实施例提供的访问令牌的颁发方法和访问控制方法进行详细说明。
实施例一、本实施例描述的是oneM2M应用服务提供商(oneM2M Application Service Provider)通过oneM2M服务商(oneM2M Service Provider)提供的平台读取存储在家庭网关(Home Gateway)中的数据。本实施例采用了基于访问令牌的访问控制机制，访问令牌中存储的特权信息为有访问目标资源所需的角色。参与本实施例的各实体之间的连接关系如图14所示，其中：
CSE1为oneM2M服务提供商基础设施节点(Infrastructure Node)中的CSE(IN-CSE)；CSE2为一个oneM2M应用服务节点(Application Service Node)中的CSE(ASN-CSE)，令牌颁发实体可通过CSE2向AE或CSE颁发访问令牌，且CSE2具有在CSE1中创建<token>资源的特权；CSE3为存在于一个家庭网关(Home Gateway)中的oneM2M应用服务节点中的CSE(ASN-CSE)。其中存储有智能电表数据(Smart Meter Data)，读取Smart Meter Data需要具有数据采集角色(Data Collection Role)，该角色的标识为roleID＝ROLE1234；该应用类别为12，也即appCategory＝12；AE1为注册至CSE1的AE，oneM2M应用服务提供商可通过AE1访问CSE3中的资源。
CSE1中与本实施例相关的资源树如图15所示，包括：<CSEBase>资源，CSE1资源树的根节点；<AE1>资源，AE1成功注册至CSE1后的注册资源；<token>资源，CSE2在<AE1>中创建的子资源，表示一个赋给AE1的访问令牌，其中描述了tokenID，issuer，startTime，expiryTime，tokenType，tokenName，appCategory和tokenValue等资源属性信息。
访问令牌的颁发和使用过程包括：预配置过程、颁发和使用过程，具体描述如下：
访问令牌预配置过程包括：
步骤0.1：oneM2M应用服务提供商AE1注册至oneM2M服务提供商的IN-CSE(CSE1)中。
步骤0.2：令牌颁发实体通过CSE2向PDP实体提供用于验证其所颁发的访问令牌的安全凭证，也即用于验证其所签发的访问令牌的公钥证书。
访问令牌的颁发和使用过程，如图16所示，具体如下：
步骤1：访问发起方AE1向令牌颁发实体(即CSE2)发送访问令牌申请请求，该请求中包含有令牌特权描述信息，本实施例为智能电表数据采集(Smart Meter Data Collection)。
步骤2：因令牌授权实体不能根据本地存储的授权策略确定是否同意该访问令牌申请请求，因此其将AE1发送的令牌特权描述信息转发给可以处理此项任务的某个特权授权功能。
步骤3：这里假设特权授权功能是一个由房屋所有人参与的特权授权过程，此时特权授权功能将AE1的请求呈现给房屋所有人，并由房屋所有人确定是否同意该请求。这里假设房屋所有人给出的决策是“同意”，因此特权授权功能向令牌颁发实体发出同意该项授权的响应。
步骤4：若同意发起方的访问令牌申请请求，则令牌颁发实体颁发相应的访问令牌，其中包含有tokenID＝TOKEN1234，holderID＝AE1，issuer＝CSE2，startTime＝2015.10.01，expiryTime＝2016.10.10，tokenType＝10，tokenName＝智能电表数据采集令牌(Smart Meter Data Collection Token)，appCategory＝12，privileges＝{roleID＝ROLE1234}等令牌属性信息。这里假设tokenType＝10表示privileges属性中存储有角色信息。
步骤5：CSE2向注册响应CSE(即CSE1)请求在CSE1中发起方(Originator)AE1的注册资源(即<AE1>资源)创建<token>资源，该请求中包含有tokenID＝TOKEN1234，holderID＝AE1，Issuer＝CSE2，startTime＝2015.10.01，expiryTime＝2016.10.10，tokenType＝10，tokenName＝Smart Home Data Collection Token，appCategory＝12，tokenValue＝E8F852AE5B...等创建该令牌资源所需的资源属性的值。
步骤6：CSE1接收到CSE2发送的资源操作请求后，首先检查并确认CSE2具有在<AE1>资源下创建<token>资源的特权，然后利用CSE2提供的资源属性创建所请求的<token>资源。
步骤7：CSE1将资源创建成功的操作结果发送给CSE2。
步骤8：CSE2将访问令牌颁发成功的操作结果发送给AE1。
步骤9：AE1读取CSE1中该AE1的注册资源，以便获取已颁发给它的令牌信息。
步骤10：CSE1将AE1所拥有的访问令牌以令牌信息列表的方式发送给AE1，其中，令牌信息包括tokenID，holderID，issuer，startTime，expiryTime，tokenType，tokenName，appCategory和tokenValue等令牌属性的值。
步骤11：AE1当前资源访问所属的应用类别为“12”，据此AE1选择tokenID＝TOKEN1234的访问令牌，因为该访问令牌的appCategory＝12。AE1向CSE3中的目标资源发送资源访问请求，并将所选择的访问令牌的令牌信息附着在该请求中。
步骤12：CSE3中的PEP实体根据AE1发送的资源访问请求生成访问控制决策请求，其中该请求中包含有AE1提供的令牌信息，然后将该请求发送给PDP实体。
步骤13：PDP实体验证访问令牌的有效性，包括：访问令牌是否是由合法的令牌颁发实体颁发的，是否仍在有效期内，令牌所有者标识是否与资源访问请求中的发起方标识相同，访问令牌中携带的特权是否适用于所访问的资源等。若通过这些检查，则进下一步。
步骤13：PDP实体接收到PEP实体发送的访问控制决策请求后，首先利用CSE2提供的安全凭证(公钥证书)验证收到访问令牌确实为CSE2所颁发，通过验证后，继续通过holderID属性验证该访问令牌属于AE1，通过startTime和expiryTime验证该访问令牌仍在有效期内，通过appCategory验证访问令牌中所携带的特权信息适用于其所访问的目标资源，通过这些验证后，CSE3根据tokenType＝10知道访问令牌携带的特权信息是角色信息，然后其从访问令牌的privileges属性中提取出roleID＝ROLE1234的角色信息。
步骤14：PDP实体从PRP实体获取适用的访问控制策略，并利用访问控制策略和请求发起方提供的角色信息评估发起方的资源访问请求，其中，访问控制策略描述roleID＝ROLE1234的数据采集角色(Data Collection Role)具有Smart Meter Data数据读取权限，所以基于访问控制策略和角色信息的评估结果是“同意AE1的资源访问”。
步骤15：PDP实体将评估结果通过访问控制决策响应发送PEP实体。
步骤16：因AE1的资源访问请求被允许，所以PEP实体执行AE1所请求的Smart Meter Data数据读取功能。
步骤17：PEP实体将执行结果发送AE1。
上述方法处理流程可以用软件程序实现，该软件程序可以存储在存储介质中，当存储的软件程序被调用时，执行上述方法步骤。
基于同一发明构思，本申请实施例中还提供了一种发起方，由于该发起方解决问题的原理与上述图7所示的一种访问令牌颁发方法相似，因此该发起方的实施可以参见方法的实施，重复之处不再赘述。
本申请实施例提供的一种发起方，如图17所示，包括：
发送模块171，用于向令牌颁发实体发送访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
接收模块172，用于接收所述令牌颁发实体返回的访问令牌申请响应，以确定访问令牌是否颁发成功。
可选的，所述发起方还包括：令牌获取模块173，用于从与所述发起方关联的令牌资源中，获取所述访问令牌或者所述访问令牌中的特权信息，其中，所述特权信息用于表示发起方在访问控制过程能够使用的特权。
基于同一发明构思，本申请实施例中还提供了一种令牌颁发实体，由于该令牌颁发实体解决问题的原理与上述图8所示的一种访问令牌颁发方法相似，因此该令牌颁发实体的实施可以参见方法的实施，重复之处不再赘述。
本申请实施例提供的一种令牌颁发实体，如图18所示，包括：
第一接收模块181，用于接收发起方发送的访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
令牌颁发模块182，用于根据所述访问令牌申请请求，生成访问令牌；
第一发送模块183，用于向公共服务实体CSE发送令牌资源创建请求，以请求所述CSE为所述访问令牌创建与所述发起方关联的令牌资源；
第二接收模块184，用于接收所述CSE返回的令牌资源创建响应，以确定所述CSE是否已完成所述令牌资源的创建；
第二发送模块185，用于向所述发起方返回访问令牌申请响应，以通知所述发起方所述访问令牌是否颁发成功。
可选的，令牌颁发模块182还用于：根据本地保存的授权策略，确定是否同意所述发起方发送的访问令牌申请请求；或者通过特权授权功能实体，确定是否同意所述发起方发送的访问令牌申请请求。
可选的，第一发送模块183还用于：向所述CSE发送令牌资源修改请求，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
第二接收模块184还用于：接收所述CSE发送的令牌资源修改响应，以确定所述CSE是否已完成令牌资源的修改。
基于同一发明构思，本申请实施例中还提供了一种令牌颁发实体，由于该令牌颁发实 体解决问题的原理与上述图9所示的一种访问令牌颁发方法相似，因此该令牌颁发实体的实施可以参见方法的实施，重复之处不再赘述。
本申请实施例提供的一种公共服务实体CSE，如图19所示，包括：
接收模块191，用于接收令牌颁发实体发送的令牌资源创建请求，其中，所述令牌资源创建请求用于请求所述CSE为所述令牌颁发实体颁发的访问令牌创建令牌资源；
资源创建模块192，用于根据令牌资源创建请求，创建与发起方关联的令牌资源；
发送模块193，用于向所述令牌颁发实体返回令牌资源创建响应，以通知所述令牌颁发实体所述CSE是否已完成所述令牌资源的创建。
可选的，所述资源创建模块192具体用于：
根据与所述令牌颁发实体关联的访问控制策略，确定所述令牌颁发实体是否有权创建令牌资源；在确定所述令牌颁发实体有权创建令牌资源时，根据令牌资源创建请求，创建所述令牌资源。
可选的，接收模块191还用于：接收所述令牌颁发实体发送的令牌资源修改请求其中，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
资源创建模块192还用于：根据所述令牌资源修改请求，对需要修改的令牌资源进行修改；
发送模块193还用于：向所述令牌颁发实体发送令牌资源修改响应，以通知所述令牌颁发实体所述CSE是否已完成令牌资源的修改。
基于上述任一实施例，资源创建模块192具体用于：
确定出与所述发起方需要访问的目标资源相关联的访问控制策略，并根据所述访问控制策略确定所述发起方是否有权创建令牌资源；在确定出所述发起方有权创建令牌资源后，根据令牌资源创建请求，创建所述发起方关联的令牌资源。
基于同一发明构思，本申请实施例中还提供了一种PDP实体，由于该PDP实体解决问题的原理与上述图10所示的一种访问控制方法相似，因此该PDP实体的实施可以参见方法的实施，重复之处不再赘述。
本申请实施例提供的一种PDP实体，如图20所示，PDP实体包括：
接收模块201，用于接收策略执行点PEP实体发送的访问控制决策请求；
获取模块202，用于根据所述访问控制决策请求携带的发起方的令牌信息，获取所述令牌信息对应的访问令牌中的特权信息，并根据所述访问控制决策请求携带的所述发起方需要访问的目标资源，获取所述目标资源相关联的访问控制策略，其中，所述特权信息用 于表示所述发起方在访问控制过程能够使用的特权；
评估模块203，用于根据访问控制策略和所述特权信息，评估所述访问控制决策请求，并将评估结果携带在访问控制决策响应中返回给所述PEP实体，以使所述PEP实体根据所述评估结果执行资源访问。
可选的，所述评估模块203具体用于：验证所述令牌信息对应的访问令牌的有效性；在确定所述令牌信息对应的访问令牌有效后，根据访问控制策略和所述特权信息，评估所述访问控制决策请求。
可选的，若所述令牌信息为所述标识信息，获取模块202还用于：从所述发起方关联的令牌资源中，获取所述访问令牌或所述特权信息；或者通过策略信息点PIP实体，从令牌资源中获取所述访问令牌或所述特权信息。
基于同一发明构思，本申请实施例中还提供了一种PEP实体，由于该PEP实体解决问题的原理与上述图11所示的一种访问控制方法相似，因此该PEP实体的实施可以参见方法的实施，重复之处不再赘述。
本申请实施例提供的一种PEP实体，如图21所示，PEP实体包括：
发送模块211，用于向策略决策点PDP实体发送访问控制决策请求，其中，所述访问控制决策请求是根据发起方的资源访问请求生成的，所述访问控制决策请求包含所述资源访问请求中携带的发起方的令牌信息；
接收模块212，用于接收所述PDP实体返回的访问控制决策响应；
访问控制模块213，用于根据所述访问控制决策响应中携带的评估结果，执行资源访问。
下面结合优选的硬件结构，以本申请实施例提供的各实体为服务器为例，对各实体的结构、处理方式进行说明。
在图22的实施例中，发起方包括处理器221、输入接口222、输出接口223、存储器224和系统总线225；其中：
处理器221负责逻辑运算和处理。存储器224包括内存和硬盘，可以存储处理器221在执行操作时所使用的数据。输入接口222用于在处理器221的控制下读入外部设备传输的数据，输出接口223在处理器221的控制下向外部设备输出数据。
总线架构可以包括任意数量的互联的总线和桥，具体由处理器221代表的一个或多个处理器和存储器224代表的内存和硬盘的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。
本申请实施例中，处理器221读取存储器224中的程序，以完成图17所示的令牌获取模块173的功能，具体请参见图17所示的实施例中的相关描述。
输入接口222在处理器221的控制下，用以完成图17所示的接收模块172的功能，具体请参见图17所示的实施例中的相关描述。
输出接口223在处理器221的控制下，用以完成图17所示的发送模块171的功能，具体请参见图17所示的实施例中的相关描述。
在图23的实施例中，令牌颁发实体包括处理器231、输入接口232、输出接口233、存储器234和系统总线235；其中：
处理器231负责逻辑运算和处理。存储器234包括内存和硬盘，可以存储处理器231在执行操作时所使用的数据。输入接口232用于在处理器231的控制下读入外部设备传输的数据，输出接口233在处理器231的控制下向外部设备输出数据。
总线架构可以包括任意数量的互联的总线和桥，具体由处理器231代表的一个或多个处理器和存储器234代表的内存和硬盘的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。
本申请实施例中，处理器231读取存储器234中的程序，以完成图18所示的令牌颁发模块182的功能，具体请参见图18所示的实施例中的相关描述。
输入接口232在处理器231的控制下，用以完成图18所示的第一接收模块181和第二接收模块184的功能，具体请参见图18所示的实施例中的相关描述。
输出接口233在处理器231的控制下，用以完成图18所示的第一发送模块183和第二发送模块185的功能，具体请参见图18所示的实施例中的相关描述。
在图24的实施例中，CSE包括处理器241、输入接口242、输出接口243、存储器244和系统总线245；其中：
处理器241负责逻辑运算和处理。存储器244包括内存和硬盘，可以存储处理器241在执行操作时所使用的数据。输入接口242用于在处理器241的控制下读入外部设备传输的数据，输出接口243在处理器241的控制下向外部设备输出数据。
总线架构可以包括任意数量的互联的总线和桥，具体由处理器241代表的一个或多个处理器和存储器244代表的内存和硬盘的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。
本申请实施例中，处理器241读取存储器244中的程序，以完成图19所示的资源创 建模块192的功能，具体请参见图19所示的实施例中的相关描述。
输入接口242在处理器241的控制下，用以完成图19所示的接收模块191的功能，具体请参见图19所示的实施例中的相关描述。
输出接口243在处理器241的控制下，用以完成图19所示的发送模块193的功能，具体请参见图19所示的实施例中的相关描述。
在图25的实施例中，PDF实体包括处理器251、输入接口252、输出接口253、存储器254和系统总线255；其中：
处理器251负责逻辑运算和处理。存储器254包括内存和硬盘，可以存储处理器251在执行操作时所使用的数据。输入接口252用于在处理器251的控制下读入外部设备传输的数据，输出接口253在处理器251的控制下向外部设备输出数据。
总线架构可以包括任意数量的互联的总线和桥，具体由处理器251代表的一个或多个处理器和存储器254代表的内存和硬盘的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。
本申请实施例中，处理器251读取存储器254中的程序，以完成图20所示的获取模块202和评估模块203的功能，具体请参见图20所示的实施例中的相关描述。
输入接口252在处理器251的控制下，用以完成图20所示的接收模块201的功能，具体请参见图20所示的实施例中的相关描述。
在图26的实施例中，PEP实体包括处理器261、输入接口262、输出接口263、存储器264和系统总线265；其中：
处理器261负责逻辑运算和处理。存储器264包括内存和硬盘，可以存储处理器261在执行操作时所使用的数据。输入接口262用于在处理器261的控制下读入外部设备传输的数据，输出接口263在处理器261的控制下向外部设备输出数据。
总线架构可以包括任意数量的互联的总线和桥，具体由处理器261代表的一个或多个处理器和存储器264代表的内存和硬盘的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。
本申请实施例中，处理器261读取存储器264中的程序，以完成图21所示的访问控制模块213的功能，具体请参见图21所示的实施例中的相关描述。
输入接口262在处理器261的控制下，用以完成图21所示的接收模块212的功能，具体请参见图21所示的实施例中的相关描述。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (50)

  1. 一种访问令牌颁发方法，其特征在于，所述方法包括：
    发起方向令牌颁发实体发送访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
    所述发起方接收所述令牌颁发实体返回的访问令牌申请响应，以确定访问令牌是否颁发成功。
  2. 如权利要求1所述的方法，其特征在于，所述发起方接收所述令牌颁发实体返回的访问令牌申请响应之后，所述方法还包括：
    所述发起方从与所述发起方关联的令牌资源中，获取所述访问令牌或者所述访问令牌中的特权信息，其中，所述特权信息用于表示发起方在访问控制过程能够使用的特权。
  3. 如权利要求1所述的方法，其特征在于，所述令牌资源具有：
    令牌标识属性，用于存储访问令牌的标识信息；
    令牌颁发者属性，用于存储访问令牌颁发者的标识信息；
    起始时间属性，用于存储访问令牌的有效期的起始时间；
    结束时间属性，用于存储访问令牌的有效期的结束时间；
    令牌值属性，用于存储访问令牌或访问令牌中的特权信息。
  4. 如权利要求3所述的方法，其特征在于，所述令牌资源还具有以下至少一个属性：
    令牌类型属性，用于存储访问令牌的类型信息；
    令牌名字属性，用于存储访问令牌的可阅读名字；
    应用类别属性，用于存储访问令牌适用的应用类别。
  5. 如权利要求2～4任一项所述的方法，其特征在于，所述令牌资源为所述发起方的注册资源的子资源。
  6. 如权利要求2～4任一项所述的方法，其特征在于，所述访问令牌包括以下内容：
    所述访问令牌的标识信息、所述访问令牌颁发者的标识信息、所述访问令牌所有者的标识信息、所述访问令牌的有效期的起始时间、所述访问令牌的有效期的结束时间、以及所述特权信息。
  7. 如权利要求6所述的方法，其特征在于，所述访问令牌还包括以下至少一项内容：
    所述访问令牌的类型信息、所述访问令牌的可阅读名字、所述访问令牌适用的应用类别、以及应用系统定义的所述访问令牌的内容。
  8. 一种访问令牌颁发方法，其特征在于，所述方法包括：
    令牌颁发实体接收发起方发送的访问令牌申请请求，其中，所述访问令牌申请请求用 于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
    所述令牌颁发实体根据所述访问令牌申请请求，生成访问令牌，并向公共服务实体CSE发送令牌资源创建请求，以请求所述CSE为所述访问令牌创建与所述发起方关联的令牌资源；
    所述令牌颁发实体接收所述CSE返回的令牌资源创建响应，以确定所述CSE是否已完成所述令牌资源的创建；
    所述令牌颁发实体向所述发起方返回访问令牌申请响应，以通知所述发起方所述访问令牌是否颁发成功。
  9. 如权利要求8所述的方法，其特征在于，所述令牌颁发实体接收所述发起方发送的访问令牌申请请求之后，还包括：
    所述令牌颁发实体根据本地保存的授权策略，确定是否同意所述发起方发送的访问令牌申请请求；或者
    所述令牌颁发实体通过特权授权功能实体，确定是否同意所述发起方发送的访问令牌申请请求。
  10. 如权利要求8所述的方法，其特征在于，所述令牌资源具有：
    令牌标识属性，用于存储访问令牌的标识信息；
    令牌颁发者标识属性，用于存储访问令牌颁发者的标识信息；
    起始时间属性，用于存储访问令牌的有效期的起始时间；
    结束时间属性，用于存储访问令牌的有效期的结束时间；
    令牌值属性，用于存储访问令牌、或者访问令牌中的用于表示发起方在访问控制过程能够使用的特权的特权信息。
  11. 如权利要求10所述的方法，其特征在于，所述令牌资源还具有以下至少一个属性：
    令牌类型属性，用于存储访问令牌的类型信息；
    令牌名字属性，用于存储访问令牌的可阅读名字；
    应用类别属性，用于存储访问令牌适用的应用类别。
  12. 如权利要求8所述的方法，其特征在于，所述访问令牌包括以下内容：
    所述访问令牌的标识信息、所述访问令牌颁发者的标识信息、所述访问令牌所有者的标识信息、所述访问令牌的有效期的起始时间、所述访问令牌的有效期的结束时间、以及用于表示发起方在访问控制过程需要使用的特权的特权信息。
  13. 如权利要求12所述的方法，其特征在于，所述访问令牌包括以下至少一项内容：
    所述访问令牌的类型信息、所述访问令牌的可阅读名字、所述访问令牌适用的应用类别、以及应用系统定义的所述访问令牌的内容。
  14. 如权利要求8～13任一项所述的方法，其特征在于，所述令牌颁发实体接收所述CSE返回的令牌资源创建响应之后，所述方法还包括：
    所述令牌颁发实体向所述CSE发送令牌资源修改请求，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
    所述令牌颁发实体接收所述CSE发送的令牌资源修改响应，以确定所述CSE是否已完成令牌资源的修改。
  15. 如权利要求8～13任一项所述的方法，其特征在于，所述令牌资源为所述发起方的注册资源的子资源。
  16. 一种访问令牌颁发方法，其特征在于，所述方法包括：
    公共服务实体CSE接收令牌颁发实体发送的令牌资源创建请求，其中，所述令牌资源创建请求用于请求所述CSE为所述令牌颁发实体颁发的访问令牌创建令牌资源；
    所述CSE根据令牌资源创建请求，创建与发起方关联的令牌资源；
    所述CSE向所述令牌颁发实体返回令牌资源创建响应，以通知所述令牌颁发实体所述CSE是否已完成所述令牌资源的创建。
  17. 如权利要求16所述的方法，其特征在于，所述CSE接收令牌颁发实体发送的令牌资源创建请求之后，所述CSE创建令牌资源之前，还包括：
    所述CSE根据与所述令牌颁发实体关联的访问控制策略，确定所述令牌颁发实体是否有权创建令牌资源；
    所述CSE根据令牌资源创建请求，创建令牌资源，包括：所述CSE在确定所述令牌颁发实体有权创建令牌资源时，根据令牌资源创建请求，创建所述令牌资源。
  18. 如权利要求16所述的方法，其特征在于，所述令牌资源具有：
    令牌标识属性，用于存储访问令牌的标识信息；
    令牌颁发者标识属性，用于存储访问令牌颁发者的标识信息；
    起始时间属性，用于存储访问令牌的有效期的起始时间；
    结束时间属性，用于存储访问令牌的有效期的结束时间；
    令牌值属性，用于存储访问令牌、或者访问令牌中的用于表示发起方在访问控制过程能够使用的特权的特权信息。
  19. 如权利要求18所述的方法，其特征在于，所述令牌资源还具有以下至少一个属性：
    令牌类型属性，用于存储访问令牌的类型信息；
    令牌名字属性，用于存储访问令牌的可阅读名字；
    应用类别属性，用于存储访问令牌适用的应用类别。
  20. 如权利要求16所述的方法，其特征在于，所述访问令牌包括以下内容：
    所述访问令牌的标识信息、所述访问令牌颁发者的标识信息、所述访问令牌所有者的标识信息、所述访问令牌的有效期的起始时间、所述访问令牌的有效期的结束时间、以及用于表示发起方在访问控制过程需要使用的特权的特权信息。
  21. 如权利要求20所述的方法，其特征在于，所述访问令牌包括以下至少一项内容：
    所述访问令牌的类型信息、所述访问令牌的可阅读名字、所述访问令牌适用的应用类别、以及应用系统定义的所述访问令牌的内容。
  22. 如权利要求16～21任一项所述的方法，其特征在于，所述令牌资源为所述发起方的注册资源的子资源。
  23. 如权利要求16～21任一项所述的方法，其特征在于，所述CSE向所述令牌颁发实体返回令牌资源创建响应之后，所述方法还包括：
    所述CSE接收所述令牌颁发实体发送的令牌资源修改请求其中，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
    所述CSE根据所述令牌资源修改请求，对需要修改的令牌资源进行修改；
    所述CSE向所述令牌颁发实体发送令牌资源修改响应，以通知所述令牌颁发实体所述CSE是否已完成令牌资源的修改。
  24. 如权利要求16～21任一项所述的方法，其特征在于，所述CSE接收所述令牌颁发实体发送的令牌资源创建请求之后，还包括：所述CSE确定出与所述发起方需要访问的目标资源相关联的访问控制策略，并根据所述访问控制策略确定所述发起方是否有权创建令牌资源；
    所述CSE根据令牌资源创建请求，创建与发起方关联的令牌资源，包括：所述CSE在确定出所述发起方有权创建令牌资源后，根据令牌资源创建请求，创建所述发起方关联的令牌资源。
  25. 一种访问控制方法，其特征在于，所述方法包括：
    策略决策点PDP实体接收策略执行点PEP实体发送的访问控制决策请求；
    所述PDP实体根据所述访问控制决策请求携带的发起方的令牌信息，获取所述令牌信息对应的访问令牌中的特权信息，并根据所述访问控制决策请求携带的所述发起方需要访问的目标资源，获取所述目标资源相关联的访问控制策略，其中，所述特权信息用于表示 所述发起方在访问控制过程能够使用的特权；
    所述PDP实体根据访问控制策略和所述特权信息，评估所述访问控制决策请求，并将评估结果携带在访问控制决策响应中返回给所述PEP实体，以使所述PEP实体根据所述评估结果执行资源访问。
  26. 如权利要求25所述的方法，其特征在于，所述PDP实体根据访问控制策略和所述特权信息，评估所述访问控制决策请求之前，还包括：所述PDP实体验证所述令牌信息对应的访问令牌的有效性；
    所述PDP实体根据访问控制策略和所述特权信息，评估所述访问控制决策请求，包括：所述PDP实体在确定所述令牌信息对应的访问令牌有效后，根据访问控制策略和所述特权信息，评估所述访问控制决策请求。
  27. 如权利要求26所述的方法，其特征在于，所述令牌信息为：
    访问令牌、或者访问令牌的标识信息。
  28. 如权利要求27所述的方法，其特征在于，若所述令牌信息为所述标识信息，PDP实体接收PEP实体发送的访问控制决策请求之后，还包括：
    所述PDP实体从所述发起方关联的令牌资源中，获取所述访问令牌或所述特权信息；或者
    所述PDP实体通过策略信息点PIP实体，从令牌资源中获取所述访问令牌或所述特权信息。
  29. 如权利要求28所述的方法，其特征在于，所述令牌资源具有：
    令牌标识属性，用于存储访问令牌的标识信息；
    令牌颁发者标识属性，用于存储访问令牌颁发者的标识信息；
    起始时间属性，用于存储访问令牌的有效期的起始时间；
    结束时间属性，用于存储访问令牌的有效期的结束时间；
    令牌值属性，用于存储访问令牌或所述特权信息。
  30. 如权利要求29所述的方法，其特征在于，所述令牌资源还具有以下至少一个属性：
    令牌类型属性，用于存储访问令牌的类型信息；
    令牌名字属性，用于存储访问令牌的可阅读名字；
    应用类别属性，用于存储访问令牌适用的应用类别。
  31. 如权利要求25～30任一项所述的方法，其特征在于，所述令牌资源为所述发起方的注册资源的子资源。
  32. 如权利要求25～30任一项所述的方法，其特征在于，所述访问令牌包括以下内容：
    所述访问令牌的标识信息、所述访问令牌颁发者的标识信息、所述访问令牌所有者的标识信息、所述访问令牌的有效期的起始时间、所述访问令牌的有效期的结束时间、以及所述特权信息。
  33. 如权利要求32所述的方法，其特征在于，所述访问令牌还包括以下至少一项内容：
    所述访问令牌的类型信息、所述访问令牌的可阅读名字、所述访问令牌适用的应用类别、以及应用系统定义的所述访问令牌的内容。
  34. 一种访问控制方法，其特征在于，所述方法包括：
    策略执行点PEP实体向策略决策点PDP实体发送访问控制决策请求，其中，所述访问控制决策请求是根据发起方的资源访问请求生成的，所述访问控制决策请求包含所述资源访问请求中携带的发起方的令牌信息；
    所述PEP实体接收所述PDP实体返回的访问控制决策响应，并根据所述访问控制决策响应中携带的评估结果执行资源访问。
  35. 如权利要求34所述的方法，其特征在于，所述令牌信息为：
    访问令牌、或者访问令牌的标识信息。
  36. 如权利要求34或35所述的方法，其特征在于，所述访问令牌包括以下内容：
    所述访问令牌的标识信息、所述访问令牌颁发者的标识信息、所述访问令牌所有者的标识信息、所述访问令牌的有效期的起始时间、访问令牌的有效期的结束时间、以及用于表示发起方在访问控制过程能够使用的特权的特权信息。
  37. 如权利要求36所述的方法，其特征在于，所述访问令牌包括以下至少一项内容：
    所述访问令牌的类型信息、所述访问令牌的可阅读名字、所述访问令牌适用的应用类别、以及应用系统定义的所述访问令牌的内容。
  38. 一种发起方，其特征在于，所述发起方包括：
    发送模块，用于向令牌颁发实体发送访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
    接收模块，用于接收所述令牌颁发实体返回的访问令牌申请响应，以确定访问令牌是否颁发成功。
  39. 如权利要求38所述的发起方，其特征在于，所述发起方还包括：
    令牌获取模块，用于从与所述发起方关联的令牌资源中，获取所述访问令牌或者所述 访问令牌中的特权信息，其中，所述特权信息用于表示发起方在访问控制过程能够使用的特权。
  40. 一种令牌颁发实体，其特征在于，所述令牌颁发实体包括：
    第一接收模块，用于接收发起方发送的访问令牌申请请求，其中，所述访问令牌申请请求用于请求所述令牌颁发实体为所述发起方在访问控制过程需要使用的特权颁发访问令牌；
    令牌颁发模块，用于根据所述访问令牌申请请求，生成访问令牌；
    第一发送模块，用于向公共服务实体CSE发送令牌资源创建请求，以请求所述CSE为所述访问令牌创建与所述发起方关联的令牌资源；
    第二接收模块，用于接收所述CSE返回的令牌资源创建响应，以确定所述CSE是否已完成所述令牌资源的创建；
    第二发送模块，用于向所述发起方返回访问令牌申请响应，以通知所述发起方所述访问令牌是否颁发成功。
  41. 如权利要求40所述的令牌颁发实体，其特征在于，所述令牌颁发模块还用于：
    根据本地保存的授权策略，确定是否同意所述发起方发送的访问令牌申请请求；或者通过特权授权功能实体，确定是否同意所述发起方发送的访问令牌申请请求。
  42. 如权利要求40或41所述的令牌颁发实体，其特征在于，
    所述第一发送模块还用于：向所述CSE发送令牌资源修改请求，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
    所述第二接收模块还用于：接收所述CSE发送的令牌资源修改响应，以确定所述CSE是否已完成令牌资源的修改。
  43. 一种公共服务实体CSE，其特征在于，所述CSE包括：
    接收模块，用于接收令牌颁发实体发送的令牌资源创建请求，其中，所述令牌资源创建请求用于请求所述CSE为所述令牌颁发实体颁发的访问令牌创建令牌资源；
    资源创建模块，用于根据令牌资源创建请求，创建与发起方关联的令牌资源；
    发送模块，用于向所述令牌颁发实体返回令牌资源创建响应，以通知所述令牌颁发实体所述CSE是否已完成所述令牌资源的创建。
  44. 如权利要求43所述的CSE，其特征在于，所述资源创建模块具体用于：
    根据与所述令牌颁发实体关联的访问控制策略，确定所述令牌颁发实体是否有权创建令牌资源；在确定所述令牌颁发实体有权创建令牌资源时，根据令牌资源创建请求，创建所述令牌资源。
  45. 如权利要求43或44所述的CSE，其特征在于，
    所述接收模块还用于：接收所述令牌颁发实体发送的令牌资源修改请求其中，其中，所述令牌资源修改请求中携带所述令牌颁发实体重新为所述发起方颁发的访问令牌；
    所述资源创建模块还用于：根据所述令牌资源修改请求，对需要修改的令牌资源进行修改；
    所述发送模块还用于：向所述令牌颁发实体发送令牌资源修改响应，以通知所述令牌颁发实体所述CSE是否已完成令牌资源的修改。
  46. 如权利要求43或44所述的CSE，其特征在于，所述资源创建模块具体用于：
    确定出与所述发起方需要访问的目标资源相关联的访问控制策略，并根据所述访问控制策略确定所述发起方是否有权创建令牌资源；在确定出所述发起方有权创建令牌资源后，根据令牌资源创建请求，创建所述发起方关联的令牌资源。
  47. 一种策略决策点PDP实体，其特征在于，PDP实体包括：
    接收模块，用于接收策略执行点PEP实体发送的访问控制决策请求；
    获取模块，用于根据所述访问控制决策请求携带的发起方的令牌信息，获取所述令牌信息对应的访问令牌中的特权信息，并根据所述访问控制决策请求携带的所述发起方需要访问的目标资源，获取所述目标资源相关联的访问控制策略，其中，所述特权信息用于表示所述发起方在访问控制过程能够使用的特权；
    评估模块，用于根据访问控制策略和所述特权信息，评估所述访问控制决策请求，并将评估结果携带在访问控制决策响应中返回给所述PEP实体，以使所述PEP实体根据所述评估结果执行资源访问。
  48. 如权利要求47所述的PDP实体，其特征在于，所述评估模块具体用于：
    验证所述令牌信息对应的访问令牌的有效性；在确定所述令牌信息对应的访问令牌有效后，根据访问控制策略和所述特权信息，评估所述访问控制决策请求。
  49. 如权利要求47所述的PDP实体，其特征在于，若所述令牌信息为所述标识信息，所述获取模块还用于：
    从所述发起方关联的令牌资源中，获取所述访问令牌或所述特权信息；或者通过策略信息点PIP实体，从令牌资源中获取所述访问令牌或所述特权信息。
  50. 一种策略执行点PEP实体，其特征在于，PEP实体包括：
    发送模块，用于向策略决策点PDP实体发送访问控制决策请求，其中，所述访问控制决策请求是根据发起方的资源访问请求生成的，所述访问控制决策请求包含所述资源访问请求中携带的发起方的令牌信息；
    接收模块，用于接收所述PDP实体返回的访问控制决策响应；
    访问控制模块，用于根据所述访问控制决策响应中携带的评估结果，执行资源访问。
PCT/CN2016/102457 2015-11-03 2016-10-18 一种访问控制方法和访问令牌颁发方法、设备 WO2017076165A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510737821.8A CN106656937A (zh) 2015-11-03 2015-11-03 一种访问控制方法和访问令牌颁发方法、设备
CN201510737821.8 2015-11-03

Publications (1)

Publication Number Publication Date
WO2017076165A1 true WO2017076165A1 (zh) 2017-05-11

Family

ID=58661916

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/102457 WO2017076165A1 (zh) 2015-11-03 2016-10-18 一种访问控制方法和访问令牌颁发方法、设备

Country Status (2)

Country Link
CN (1) CN106656937A (zh)
WO (1) WO2017076165A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110807189A (zh) * 2019-11-15 2020-02-18 内蒙古大学 一种区块链访问控制中的权限分割方法
CN112468409A (zh) * 2020-11-24 2021-03-09 平安消费金融有限公司 访问控制方法、装置、计算机设备及存储介质
CN109583863B (zh) * 2019-01-21 2024-04-02 深圳市祥云万维科技有限公司 一种区块链资源交易网络和交易方法

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018236420A1 (en) * 2017-06-20 2018-12-27 Google Llc CLOUD EQUIPMENT SECURITY MODULES FOR CRYPTOGRAPHIC EXTERNALIZATION OPERATIONS
CN107517208A (zh) * 2017-08-22 2017-12-26 努比亚技术有限公司 设备控制方法、装置和计算机可读存储介质
CN111490966A (zh) * 2019-01-28 2020-08-04 电信科学技术研究院有限公司 一种访问控制策略的处理方法、装置及计算机可读存储介质
CN111917808B (zh) * 2019-05-09 2022-06-03 中国移动通信有限公司研究院 负荷控制方法、服务提供者nf及服务使用者nf
CN112769735B (zh) * 2019-11-05 2023-03-24 阿里巴巴集团控股有限公司 资源访问方法、装置与系统
CN111970254B (zh) * 2020-07-31 2022-11-04 上海派拉软件股份有限公司 访问控制及配置方法、装置、电子设备和存储介质
CN111984622B (zh) * 2020-07-31 2023-10-31 上海派拉软件股份有限公司 Pap的配置及运行方法、装置、电子设备和存储介质
CN111988284B (zh) * 2020-07-31 2022-10-11 上海派拉软件股份有限公司 Pdp的配置方法、装置、电子设备和存储介质
CN111970253B (zh) * 2020-07-31 2022-10-11 上海派拉软件股份有限公司 Pep的配置方法、装置、电子设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102984252A (zh) * 2012-11-26 2013-03-20 中国科学院信息工程研究所 一种基于动态跨域安全令牌的云资源访问控制方法
CN103188229A (zh) * 2011-12-30 2013-07-03 上海贝尔股份有限公司 用于安全内容访问的方法和设备
WO2015101451A1 (en) * 2013-12-31 2015-07-09 Gemalto Sa System and method for securing machine-to-machine communications
CN104811465A (zh) * 2014-01-27 2015-07-29 电信科学技术研究院 一种访问控制的决策方法和设备

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2012503455A (ja) * 2009-01-09 2012-02-02 エヌイーシー ヨーロッパ リミテッド ネットワークにおけるアクセス制御方法およびネットワーク

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103188229A (zh) * 2011-12-30 2013-07-03 上海贝尔股份有限公司 用于安全内容访问的方法和设备
CN102984252A (zh) * 2012-11-26 2013-03-20 中国科学院信息工程研究所 一种基于动态跨域安全令牌的云资源访问控制方法
WO2015101451A1 (en) * 2013-12-31 2015-07-09 Gemalto Sa System and method for securing machine-to-machine communications
CN104811465A (zh) * 2014-01-27 2015-07-29 电信科学技术研究院 一种访问控制的决策方法和设备

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109583863B (zh) * 2019-01-21 2024-04-02 深圳市祥云万维科技有限公司 一种区块链资源交易网络和交易方法
CN110807189A (zh) * 2019-11-15 2020-02-18 内蒙古大学 一种区块链访问控制中的权限分割方法
CN110807189B (zh) * 2019-11-15 2023-07-07 内蒙古大学 一种区块链访问控制中的权限分割方法
CN112468409A (zh) * 2020-11-24 2021-03-09 平安消费金融有限公司 访问控制方法、装置、计算机设备及存储介质

Also Published As

Publication number Publication date
CN106656937A (zh) 2017-05-10

Similar Documents

Publication Publication Date Title
WO2017076165A1 (zh) 一种访问控制方法和访问令牌颁发方法、设备
TWI761357B (zh) 塊鏈實施之方法及系統
TWI713840B (zh) 數位憑證管理方法、裝置及電子設備
TWI714845B (zh) 數位憑證管理方法、裝置和系統
WO2017024791A1 (zh) 一种处理授权的方法和设备
JP6574168B2 (ja) 端末識別方法、ならびにマシン識別コードを登録する方法、システム及び装置
US11907939B2 (en) Methods for user authentication using non-fungible digital assets
WO2017054985A1 (en) Access control
EP3329409A1 (en) Access control
EP3329408A1 (en) Expendable access control
WO2022161181A1 (zh) 基于区块链的数据处理的方法、装置及电子设备
GB2540977A (en) Expendable access control
CN103248680A (zh) 一种分享网盘数据的方法及系统
WO2017084245A1 (zh) 购买请求处理方法及装置
WO2017181863A1 (zh) 资源访问控制方法及装置
TWI690819B (zh) 權限撤銷方法及裝置
CN106656942B (zh) 角色令牌颁发方法、访问控制方法及相关设备
WO2019037603A1 (zh) 一种用于对用户设备进行无线连接预授权的方法与设备
Chai et al. BHE-AC: A blockchain-based high-efficiency access control framework for Internet of Things
CN106358246B (zh) 一种访问令牌颁发方法及相关设备
CN111585946A (zh) 密码学主权方简档控制和交易仲裁
JP6575052B2 (ja) アクセス制御システム及びプログラム
WO2017076129A1 (zh) 角色颁发方法、访问控制方法及相关设备
CN109150815A (zh) 资源处理方法、装置和机器可读介质
KR20210109453A (ko) M2m 시스템에서 데이터의 라이선스를 관리하기 위한 방법 및 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16861433

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16861433

Country of ref document: EP

Kind code of ref document: A1