WO2018184433A1 - 一种物联网认证系统和物联网认证方法 - Google Patents

一种物联网认证系统和物联网认证方法 Download PDF

Info

Publication number
WO2018184433A1
WO2018184433A1 PCT/CN2018/077527 CN2018077527W WO2018184433A1 WO 2018184433 A1 WO2018184433 A1 WO 2018184433A1 CN 2018077527 W CN2018077527 W CN 2018077527W WO 2018184433 A1 WO2018184433 A1 WO 2018184433A1
Authority
WO
WIPO (PCT)
Prior art keywords
request message
target device
binding relationship
authentication request
information
Prior art date
Application number
PCT/CN2018/077527
Other languages
English (en)
French (fr)
Inventor
陈安地
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP18781142.7A priority Critical patent/EP3609152A4/en
Publication of WO2018184433A1 publication Critical patent/WO2018184433A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/50—Secure pairing of devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2151—Time stamp

Definitions

  • the present disclosure relates to the field of mobile communication and Internet of Things technologies, and in particular, to an Internet of Things authentication system and an Internet of Things authentication method.
  • an authentication method using biometric technology can authenticate identity quickly, securely, and accurately.
  • identity authentication using biometrics such as fingerprints, face shapes, and irises has been widely applied to smart mobile terminals.
  • an effective remote authentication system and method between users and devices in an IoT environment has not been proposed.
  • the present disclosure provides an Internet of Things authentication system and an Internet of Things authentication method.
  • the IoT authentication system includes a first user terminal, a first rich communication suite server, and a first target device, wherein the first user terminal is configured to accept an interactive communication request of the user, and generate a second Binding a remote authentication request message of the relationship information, and transmitting the remote authentication request message to the first target device;
  • the first rich communication suite server is used at the first user terminal and/or the rich communication account and the Transmitting, by the first target device, a message forwarding between the first user terminal and the first target device, where the first target device establishes a binding relationship and the authentication binding relationship;
  • the first target device is configured to store the first The first binding relationship information between the user terminal and/or the rich communication account and the first target device, receiving the remote authentication request message, and detecting the second binding relationship in the remote authentication request message Whether the information is consistent with the first binding relationship information, where the second binding relationship information in the remote authentication request message is related to the first binding Agreement-based information, authentication, and the first target device accepts the request for an interactive
  • the remote authentication request message carries timestamp information; and the first target device is further configured to verify the binding relationship information in the remote authentication request message and the stored binding When the relationship information is consistent, detecting whether the timestamp is timed out, wherein if the second binding relationship information in the remote authentication request message is consistent with the second binding relationship information and the timestamp does not time out, the authentication is performed. by.
  • the first user terminal is further configured to require the user to input biometric information authentication before generating the remote authentication request message.
  • the biometric information is authenticated as at least one of fingerprint recognition, facial recognition, or speech recognition.
  • the embodiment of the present disclosure further provides an Internet of Things authentication system, including a second user terminal, a second rich communication suite server, a second target device, and a third-party server, wherein the second user terminal is configured to accept user interaction.
  • a communication request generating a remote authentication request message carrying the second binding relationship information, and transmitting the remote authentication request message to the second target device;
  • the second rich communication suite server is configured to be in the second user Transmitting a message between the second user terminal and the third-party server in a process of establishing a binding relationship between the terminal and/or the rich communication account and the second target device, and performing the binding relationship;
  • the third-party server And storing first binding relationship information between the second user terminal and/or the rich communication account and the second target device; receiving the remote authentication request message, and verifying the foregoing in the remote authentication request message Whether the binding information is consistent with the first binding relationship information, where the second binding relationship information in the remote authentication request message Consistent with the first binding relationship information, forwarding the remote authentication request message to
  • An embodiment of the present disclosure further provides an Internet of Things authentication method, including: forwarding a message by a first rich communication suite server to bind a first user terminal and/or a rich communication account with a first target device, and binding the first The first relationship information is stored in the first target device; the first user terminal requests to send a request for interactive communication with the first target device, and the first user terminal generates the second binding relationship information.
  • Remote authentication request message and sending the remote authentication request message to the first target device; and receiving the remote authentication request message by the first target device, verifying the second binding in the remote authentication request message Whether the relationship information is consistent with the first binding relationship information, if the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information, the authentication passes, and the first target
  • the device accepts an interactive communication request of the first user terminal.
  • the remote authentication request message when the remote authentication request message is sent to the first target device, the remote authentication request message carries timestamp information, and the method further includes: verifying the remote If the second binding relationship information in the authentication request message is consistent with the first binding relationship information, detecting whether the timestamp is timed out, wherein if the second binding relationship information in the remote authentication request message is If the first binding relationship information is consistent and the timestamp does not expire, the authentication is passed.
  • the method further includes encrypting the remote authentication request message when the remote authentication request message is sent to the first target device.
  • the first user terminal when a request for interactive communication with the first target device is issued by the first rich communication suite server, the first user terminal requires a user to input biometric information authentication, wherein if the creature If the information authentication is successful, the first user terminal generates the remote authentication request message.
  • An embodiment of the present disclosure further provides an Internet of Things authentication method, including: forwarding a message by a second rich communication suite server to bind a second user terminal and/or a rich communication account with a second target device, and The first binding relationship information is stored in the third-party server; the second user terminal sends a request for interactive communication with the second target device, and the second user terminal generates a remote authentication request message that carries the second binding relationship information.
  • FIG. 1 is a schematic structural diagram of an Internet of Things authentication system according to a first embodiment of the present disclosure
  • FIG. 2 is a schematic structural diagram of an Internet of Things authentication system according to a second embodiment of the present disclosure
  • FIG. 3 is a schematic flow chart of an Internet of Things authentication method according to a first embodiment of the present disclosure
  • FIG. 4 is a schematic flow chart of an Internet of Things authentication method according to a second embodiment of the present disclosure.
  • FIG. 5 is a schematic flowchart of an Internet of Things authentication method according to a third embodiment of the present disclosure.
  • FIG. 6 is a schematic flowchart of a binding step in an Internet of Things authentication method according to a third embodiment of the present disclosure
  • FIG. 7 is a schematic diagram of a signaling flow in an Internet of Things authentication method according to a third embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of an Internet of Things authentication system according to a third embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of an Internet of Things authentication system according to a fourth embodiment of the present disclosure.
  • Rich Communication Suite is a technical standard with a unified service set definition built on the IMS (IP Multimedia Subsystem) network promoted by the Global Mobile Communications Alliance (GSMA).
  • RCS implements multimedia services such as voice, messaging, and presence presentation based on the mobile phone directory.
  • the user uses the RCS service through the software client on the smart terminal.
  • the RCS service can be similar to the instant messaging service such as QQ and WeChat of the Internet, and can directly display the online status of the user by using the phone number saved on the mobile phone, thereby performing voice, picture, video and the like in real time. Communication.
  • the Internet of Things authentication system and the Internet of Things authentication method according to embodiments of the present disclosure are based on an RCS implementation.
  • the user needs to be an RCS user who has successfully authenticated the real-name authentication mechanism of the operator.
  • the user logs into the RCS terminal using his own RCS user account as an IoT account.
  • the message interactions involved in this disclosure all use signaling channels in the RCS environment.
  • RCS has high information integration capabilities and timeliness, as well as better multimedia presentation capabilities and an excellent user experience.
  • RCS communication also has better security.
  • the user registration RCS platform needs to be authenticated by the real-name system of the operator network.
  • the SIP device is authenticated and authenticated by the REGISTER signaling sequence process in the Session Initiation Protocol (SIP), thereby effectively establishing a secure signaling interaction. aisle.
  • SIP Session Initiation Protocol
  • the present disclosure provides an Internet of Things authentication system, including a first user terminal 10, a first rich communication suite server 20, and a first target device 30, wherein the first user terminal 10 is configured to accept a user's Transmitting a communication request, generating a remote authentication request message carrying the second binding relationship information, and transmitting the remote authentication request message to the first target device 30;
  • the first rich communication suite server 20 is configured to be at the first user terminal 10 and/or The rich communication account establishes a binding relationship with the first target device 30 and implements message forwarding between the first user terminal 10 and the first target device 30 in the process of authenticating the binding relationship;
  • the first target device 30 is configured to store the first The first binding relationship information between the user terminal 10 and/or the rich communication account and the first target device 30, receiving the remote authentication request message, and detecting the second binding relationship information in the remote authentication request message and the stored first Whether the binding relationship information is consistent, and if the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information, the authentication is passed.
  • the first rich communication suite server 20 is further configured to pre-establish a binding relationship between the first user terminal 10 and the rich communication account.
  • the remote authentication request message carries timestamp information; and the first target device 30 is further configured to verify the second binding relationship information in the remote authentication request message with the When the first binding relationship information is consistent, detecting whether the timestamp is timed out, where the second binding relationship information in the remote authentication request message is consistent with the second binding relationship information and the timestamp If it does not time out, the certification passes.
  • the timeout period set by the timestamp may be shorter to ensure the timeliness of the operation and enhance the anti-counterfeiting capability of the message.
  • the first user terminal 10 is further configured to require the user to input biometric information authentication before generating the remote authentication request message.
  • biometric technology is a convenient and secure method of authentication.
  • Bio features for biometric identification may include hand shape, fingerprint, face shape, iris, retina, pulse, auricle, and the like. Behavioral characteristics can include signatures, sounds, button strengths, and the like.
  • the biometric information authentication includes, but is not limited to, fingerprint recognition, facial recognition, and speech recognition.
  • the remote authentication request message is sent with an encryption process.
  • the binding relationship established between the first user terminal and/or the rich communication account and the first target device may be separately established before accepting the user's interactive communication request, or may be accepted. Established when the user's interactive communication request.
  • the process of establishing a binding relationship between the first user terminal 10 and/or the rich communication account and the first target device 30 includes: the first user terminal 10 generates a second binding request message carrying the target device identifier, and is first
  • the rich communication suite server 20 sends the second binding request message to the first target device 30; the first target device 30 receives the second binding request message, and detects the target device identification code information and the local information in the second binding request message. Whether the binding is successful, and the binding request of the first user terminal 10 is accepted if the target device identifier information in the second binding request message is consistent with the local information.
  • the present disclosure further provides an Internet of Things authentication system, including a second user terminal 40, a second rich communication suite server 50, a second target device 70, and a third party server 60, wherein
  • the second user terminal 40 is configured to accept a remote communication request of the user, generate a remote authentication request message carrying the second binding relationship information, and send the remote authentication request message to the second target device 70;
  • the second rich communication suite server 50 is configured to establish a binding relationship between the second user terminal and/or the rich communication account and the second target device, and in the process of authenticating the binding relationship, in the second user terminal 40 and the third party server 60. Message forwarding between;
  • the third-party server 60 is configured to store first binding relationship information between the second user terminal 40 and/or the rich communication account and the second target device 70, receive the remote authentication request message, and verify the first in the remote authentication request message. Whether the second binding relationship information is consistent with the first binding relationship information, wherein if the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information, forwarding the remote authentication request message to the a second target device 70;
  • the second target device 70 is configured to receive a remote authentication request message, and determine whether the target device information in the remote authentication request message is consistent with the local information, where the target device information in the remote authentication request message is consistent with the local information, and then the authentication is performed. And the second target device accepts the interactive communication request of the second user terminal 40.
  • the second rich communication suite server 50 is further configured to pre-establish a binding relationship between the second user terminal 40 and the rich communication account.
  • the remote authentication request message carries timestamp information; the third-party server 60 is further configured to verify the second binding relationship information in the remote authentication request message with the first When the binding relationship information is consistent, detecting whether the timestamp is timed out, wherein if the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information and the timestamp does not expire, Forwarding the remote authentication request message to the second target device 70; the second target device 70 is further configured to detect the timestamp when detecting whether the target device information in the remote authentication request message is consistent with the local information Whether the timeout occurs, wherein if the target device information in the remote authentication request message is consistent with the local information and the timestamp does not time out, the authentication passes.
  • the second user terminal 40 is further configured to require the user to input biometric information authentication before generating the remote authentication request message.
  • the biometric information authentication includes, but is not limited to, fingerprint recognition, facial recognition, and speech recognition.
  • the remote authentication request message is sent with an encryption process.
  • the third party server 60 may be an RCS public number server.
  • the binding relationship established between the second user terminal and/or the rich communication account and the second target device may be separately established before accepting the user's interactive communication request, or may be accepted. Established when the user's interactive communication request.
  • the process of establishing a binding relationship between the second user terminal 40 and/or the rich communication account and the second target device 70 includes: the second user terminal 40 generates a binding request message carrying the target device identifier of the second target device 70, And sending the binding request message to the third-party server 60 via the second rich communication suite server 50; the third-party server 60 receives the binding request message, and detects whether the information of the second target device 70 is pre-stored, wherein if the information is stored in advance, The information of the second target device 70 sends a binding request message to the second target device 70.
  • the second target device 70 receives the binding request message, and detects whether the target device identification code information in the binding request message is consistent with the local information. Wherein, if the target device identifier information in the binding request message is consistent with the local information, the binding is successful and the second target device 70 accepts the binding request of the second user terminal 40.
  • an Internet of Things authentication method includes the following steps:
  • Step 301 Forward the message by the first rich communication suite server to bind the first user terminal and/or the rich communication account with the first target device, and store the first binding relationship information in the first target device.
  • Step 302 Send a request for interactive communication with the first target device by using the first user terminal, and generate a remote authentication request message carrying the second binding relationship information by using the first user terminal, and pass the first rich a communication suite server transmitting the remote authentication request message to the first target device;
  • Step 303 The first target device receives the remote authentication request message, and verifies whether the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information, where If the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information, the authentication is passed, and the first target device accepts the interactive communication request of the first user terminal; if the remote authentication request is If the second binding relationship information in the message is inconsistent with the first binding relationship information, the authentication fails, and the first target device rejects the interactive communication request of the first user terminal.
  • the user may pre-establish a binding relationship between the first user terminal and the rich communication account through the first rich communication suite server.
  • the remote authentication request message when the remote authentication request message is sent to the first target device, the remote authentication request message carries timestamp information.
  • the first target device detects whether the timestamp expires when the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information. And if the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information and the timestamp does not time out, the authentication is passed; if the second binding in the remote authentication request message is If the relationship information is inconsistent with the first binding relationship information or the timestamp expires, the authentication fails.
  • step 302 further includes: performing encryption processing on the remote authentication request message when the remote authentication request message is sent to the first target device.
  • the first user terminal when a request for interactive communication with the first target device is issued by the first rich communication suite server, the first user terminal requires a user to input biometric information authentication, wherein if the creature If the information authentication is successful, the first user terminal generates the remote authentication request message.
  • the biometric information authentication includes, but is not limited to, fingerprint recognition, facial recognition, and speech recognition.
  • the binding relationship established between the first user terminal and/or the rich communication account and the first target device may be separately established before accepting the user's interactive communication request, or may be accepted. Established when the user's interactive communication request.
  • the step of forwarding the message by the first rich communication suite to bind the first user terminal and/or the rich communication account to the first target device includes: generating, by the first user terminal, a second carrying the target device identification code Binding the request message, and transmitting the second binding request message to the first target device via the first rich communication suite server; and detecting, by the first target device, the second binding request message Whether the target device identifier information in the second binding request message is consistent with the local information, if the target device identifier information in the second binding request message is consistent with the local information, the binding is successful, and the binding is successful.
  • the first target device accepts the binding request of the first user terminal.
  • an Internet of Things authentication method includes:
  • Step 401 Forward a message by the second rich communication suite server to bind the second user terminal and/or the rich communication account with the second target device, and store the first binding relationship information in the third party server.
  • Step 402 Send a request for interactive communication with the second target device by using the second user terminal, generate a remote authentication request message carrying the second binding relationship information by using the second user terminal, and pass the second rich communication suite.
  • the server sends the remote authentication request message to the third party server;
  • Step 403 The remote authentication request message is received by the third-party server, and the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information, where the remote authentication request message is used. And the second binding relationship information is consistent with the first binding relationship information, and the remote authentication request message is forwarded to the second target device; if the second binding relationship information in the remote authentication request message is If the first binding relationship information is inconsistent, the authentication fails, and the third-party server rejects the interactive communication request of the second user terminal;
  • Step 404 Receive a remote authentication request message by the second target device, and check whether the target device information in the remote authentication request message is consistent with the local information, where the target device information in the remote authentication request message is consistent with the local information. And the authentication is passed, and the second target device accepts the interactive communication request of the second user terminal; if the target device information in the remote authentication request message is inconsistent with the local information, the authentication fails, and the second target device rejects the An interactive communication request of two user terminals.
  • the user pre-establishes a binding relationship between the second user terminal and the rich communication account through the second rich communication suite server.
  • step 403 further includes: detecting, by the third-party server, whether the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information, Whether the timestamp is timed out, wherein if the second binding relationship information in the remote authentication request message is consistent with the first binding relationship information and the timestamp does not time out, the remote authentication request message is forwarded to the The second target device; if the second binding relationship information in the remote authentication request message is inconsistent with the first binding relationship information or the timestamp expires, the authentication fails, and the third party server rejects the second user
  • the step 404 further includes: detecting, by the second target device, whether the target device information in the remote authentication request message is consistent with the local information, whether the timestamp is detected Timeout, where if the target device information in the remote authentication request message
  • the method further includes: encrypting the remote authentication request message when the remote authentication request message is sent to the third party server or the second target device.
  • the second user terminal when requesting interaction with the second target device by the second user terminal, the second user terminal requires the user to input biometric information authentication, wherein if the biometric information is successfully authenticated, The second user terminal generates the remote authentication request message.
  • the biometric information authentication includes, but is not limited to, fingerprint recognition, facial recognition, or speech recognition.
  • the binding relationship established between the second user terminal and/or the rich communication account and the second target device may be separately established before accepting the user's interactive communication request, or may be accepted by the user. Established when an interactive communication request is made.
  • the process of establishing a binding relationship between the second user terminal and/or the rich communication account and the second target device includes: generating, by the second user terminal, a second binding request message carrying the target device identifier, and using the second rich communication suite
  • the server sends the second binding request message to the third-party server; the third-party server receives the binding request message, and detects whether the information of the second target device is pre-stored, wherein if the information of the second target device is pre-stored,
  • the second binding request message is sent to the second target device, and the second target device receives the binding request message, and detects whether the target device identification code information in the second binding request message is consistent with the local information, where If the target device identifier information in the second binding request message is consistent with the local information, the binding is successful, and the second target device accepts the binding request of the second user terminal.
  • the Internet of Things authentication method includes the following steps:
  • Step 501 Log in to the RCS terminal by using the RCS account, and forward the message through the rich communication suite server to bind the user terminal, the RCS account, and the target device, and store the binding relationship information in the target device or the third-party server.
  • Step 502 Issue a request for interactive communication with a target device by using an RCS terminal.
  • Step 503 Generate an encrypted remote authentication request message by using an RCS terminal, where the remote authentication request message includes RCS account information, a user terminal identifier, a target device identifier, and timestamp information, where the binding relationship information is stored in In the third-party server, go to step 504; if the binding relationship information is stored in the target device, go to step 506;
  • Step 504 Send the remote authentication request message to the third-party server by using the RCS terminal, and the third-party server receives and parses the remote authentication request message, and detects the RCS account information, the user terminal identifier, and the target device identifier in the remote authentication request message.
  • step 508 Whether the binding relationship information is consistent with the pre-stored binding information and whether the timestamp information is timed out, wherein the RCS account information, the user terminal identification code, and the target device identification code in the remote authentication request message are consistent with the pre-stored binding relationship information and time If the timeout expires, the process proceeds to step 508; if the RCS account information, the user terminal identifier, and the target device identifier in the remote authentication request message are not completely consistent with the pre-stored binding relationship information or the timestamp expires, go to step 508;
  • Step 505 The remote authentication request message carrying the timestamp information is sent to the target device by the third-party server, and the target device receives and parses the remote authentication request message, and detects whether the target device identifier and the local identifier in the remote authentication request message are Consistent and whether the timestamp information is timed out, wherein if the target device identification code in the remote authentication request message is consistent with the local identification code and the timestamp does not time out, go to step 507; if the target device identification code in the remote authentication request message is local If the identification code is inconsistent or the timestamp information expires, go to step 508;
  • Step 506 Send the remote authentication request message to the target device by using the RCS terminal, and the target device receives and parses the remote authentication request message, and detects the RCS account information, the user terminal identifier, and the target device identifier in the remote authentication request message.
  • the stored binding information is consistent and whether the timestamp information is timed out, wherein if the RCS account information, the user terminal identification code, and the target device identification code in the remote authentication request message are consistent with the pre-stored binding information, and the timestamp does not expire, Go to step 507; if the RCS account information, the user terminal identifier and the target device identifier in the remote authentication request message are not completely consistent with the pre-stored binding information or the timestamp information expires, go to step 508;
  • Step 507 Determine that the authentication is passed, so that the target device accepts the user's interactive communication request
  • Step 508 Determine that the authentication fails, so that the target device rejects the user's interactive communication request.
  • the step of forwarding a message by the rich communication suite server to bind the user terminal, the RCS account, and the target device includes:
  • Step 5011 The RCS terminal requests the binding target device to enable the RCS terminal to generate binding request information, where the binding request information includes a user terminal identification code, an RCS account, and a target device identification code, where the binding is performed by using a third-party server. If yes, go to step 5012; if the binding is performed by the target device, go to step 5014;
  • Step 5012 Send the binding request information to the third-party server through the RCS server, and the third-party server receives the binding request information and parses, and verifies whether the target device information is pre-stored, wherein if the target device information is stored in advance, go to the step 5013; if the target device information is not stored in advance, go to step 5016;
  • Step 5013 Send the binding request information to the target device by using the third-party server, and the target device receives the binding request information, and verifies whether the target device identification code in the binding request information is consistent with the local identification code, where if the binding The target device identifier in the request information is consistent with the local identifier, prompting the user to accept the binding, and if the user accepts the binding, returning the confirmation binding to cause the third party server to store the binding mapping, and proceeds to step 5015; The target device identifier in the request information is inconsistent with the local identifier or the user refuses to bind, go to step 5016;
  • Step 5014 Send the binding request information to the target device by using the RCS server, and the target device receives and parses the binding request information, and verifies whether the target device identification code in the binding request information is consistent with the local identification code, wherein if the binding request is The target device identifier in the message is consistent with the local identifier, prompting the user to accept the binding, and if the user accepts the binding, returning the confirmation binding to cause the target device to store the binding mapping, and proceeds to step 5015; if the binding request information The target device identifier in the inconsistency with the local identifier or the user refuses to bind, go to step 5016;
  • Step 5015 Determine that the binding is successful
  • Step 5016 Determine that the binding fails.
  • the target device may require the user to enter biometric information authentication. If the biometric authentication is successful, the user is prompted to accept the binding. If the biometric authentication fails, go to step 5016.
  • the target device identifier or the user terminal identifier may be a Medium Access Control (MAC) address of the target device or the user terminal, and a Universally Unique Identifier (Universally Unique Identifier).
  • UUID Medium Access Control
  • MSISDN Mobile Station International SDN
  • IMSI International Mobile Subscriber Identification Number
  • each network element module in this embodiment is as shown in FIG. 7.
  • the user when the user initiates an instruction to bind the target device, the user inputs the target device unique identifier.
  • the RCS terminal generates a binding request message that binds the RCS account and the target device, and forwards the message to the third-party server or the target device through the RCS server.
  • the RCS terminal accepts the remote operation request of the user, and generates a remote operation request instruction that carries the binding relationship information. If the binding relationship information is stored in the target device, the RCS terminal transmits a remote operation request instruction to the target device through the RCS server.
  • the target device After receiving the remote operation request instruction, the target device verifies the binding relationship information therein. If the verification passes, the user's remote operation instruction is accepted. If the binding relationship information is stored in a third party server, the RCS terminal sends the remote operation request instruction to the third party server through the RCS server. After receiving the remote operation request instruction, the third-party server verifies the binding relationship information therein, and if the verification passes, sends the remote operation instruction to the target device. The target device verifies whether the target device identification code is consistent with the local identification code. If the target device identification code is consistent with the local identification code, the target device accepts the user's remote operation instruction.
  • the user terminal described in the present disclosure includes, but is not limited to, a mobile communication device such as a mobile phone, a tablet computer (PAD) having an RCS application.
  • the target device has at least the capability of networking to resolve SIP signaling.
  • the RCS server can carry multiple public account services, and provides, but is not limited to, messaging, message query, and modification capabilities based on SIP signaling.
  • the third-party server has independent storage and logical processing capabilities, and is interconnected with the RCS server to interact with the RCS user.
  • user terminal A is provided with a fingerprint recognition system (e.g., a common smartphone).
  • the RCS terminal software is installed on the user terminal A.
  • the user is an RCS user.
  • the user needs to remotely start the vehicle system device B through the user terminal A, and the vehicle system device B can simply parse the SIP signaling and has a database for storing the binding information.
  • User terminal A and vehicle system equipment B can implement information interaction through the RCS platform.
  • the user terminal A prompts the user to authenticate the fingerprint and input the unique identification code of the device B (such as the engine number), wherein if the fingerprint authentication is passed, the user terminal A will carry the unique identification code of the user terminal A through the forwarding of the RCS server (eg The mobile phone UUID or ISDN, etc., the device B unique identification code, and the encryption binding command of the user RCS account are sent to the device B, and the process goes to step (3); if the fingerprint authentication fails, the user identity is prompted, and the process ends.
  • the RCS server eg The mobile phone UUID or ISDN, etc., the device B unique identification code, and the encryption binding command of the user RCS account are sent to the device B, and the process goes to step (3); if the fingerprint authentication fails, the user identity is prompted, and the process ends.
  • Device B receives the encryption binding command and decrypts it, displays the user terminal A and the user RCS account information, and prompts the user whether to accept the binding.
  • the user operates device B to perform binding confirmation, so that device B binds the user RCS account and user.
  • the binding completion message is sent to the user terminal A; at this time, the user can initiate the device B instruction through the remote authentication module of the user terminal A.
  • User terminal A requests the user to input a fingerprint for identity authentication.
  • the user terminal A sends an encrypted start request carrying the timestamp, the user RCS account, and the unique identifier of the user terminal A to the device B through the forwarding of the RCS server, and proceeds to step (7);
  • the authentication fails, and user terminal A prompts the user to be abnormal and ends the process.
  • Device B decrypts the start request, the check timestamp does not time out, and verifies whether the user's RCS account, the unique identifier of the user terminal A, and the unique identifier of the device B are consistent with the stored binding information; if the check passes, the device B starts the engine of the car; if the check fails, device B ignores the request.
  • the user terminal C carries a fingerprint identification system.
  • the RCS terminal software is installed on the user terminal C.
  • the user is an RCS user.
  • the user needs to remotely open the access control device D through the user terminal C, and the access control system device D can simply parse the SIP signaling.
  • step (b) The user initiates a binding request, the user terminal C prompts the user to perform fingerprint authentication; the user inputs a unique identification code of the access device D (such as a network module MAC address) to initiate binding; if the authentication passes, the user terminal C passes the RCS server.
  • the forwarding sends the initiating binding command to the RCS public number server, and proceeds to step (c); if the authentication fails, the user terminal C prompts the user to be abnormal and ends the process.
  • the RCS public number server decrypts the information to confirm whether the access control device D exists; if the access control device D exists, the confirmation information is initiated to the access control device D; the access control device D prompts the user whether to accept the binding, so that the user operates the access control device D to bind Confirmation; after the user confirms, the public number system binds the user RCS account, the unique identification code of the user terminal C and the unique identification code of the access device D, and goes to step (d); if there is no device D or the user refuses to bind the device D, the user terminal C process ends.
  • step (f) If the identity authentication is passed, the user terminal C sends an encrypted unlock request carrying the time stamp, the user RCS account, the unique identifier of the user terminal C, and the unique identification code of the access device D to the RCS public number server through the forwarding of the RCS server. Go to step (g); if the identity authentication fails, user terminal C prompts the user to be abnormal and ends the process.
  • the RCS public number server decrypts the unlock request, the check timestamp does not time out, and verifies whether the user RCS account, the unique identifier of the user terminal C, and the unique identification code of the access device D are consistent with the stored binding information, and if they are consistent,
  • the encrypted unlock command carrying the time stamp and the unique identification code of the access device D is sent to the access device D, and proceeds to step (h); if the check is inconsistent or the time stamp expires, the user terminal C prompts the user to be abnormal and ends the process.
  • the check time stamp does not time out, and the unique identifier in the unlock command is consistent with the unique identifier of the device; if they are consistent, the access device D is unlocked; if not, the request is ignored.
  • user terminal E carries a fingerprint identification system.
  • the RCS terminal software is installed on the user terminal E.
  • the user is an RCS user.
  • the user needs to remotely unlock the terminal device F through the user terminal E.
  • the RCS software client is pre-installed on the terminal device F and is logged into the RCS account.
  • the user terminal E prompts the user to perform fingerprint authentication; if the fingerprint authentication is passed, the user terminal E sends the encryption binding instruction of the user RCS account carrying the user terminal E to the terminal device F through the forwarding of the RCS server; if the fingerprint authentication fails, The user terminal E prompts the user to be abnormal and ends the process.
  • the terminal device F receives the binding instruction and decrypts it, displays the binding instruction of the user terminal E, and prompts the user whether to accept the binding.
  • the terminal device F requests the user to input the fingerprint verification identity; if the identity verification passes and accepts the binding, the terminal device F sends the binding receipt information to the user terminal E, records the authorized user information of the user terminal E, and proceeds to step (v) If the authentication fails or the binding is refused, the user terminal E process ends.
  • the user terminal E records the binding information of the terminal device F by binding the receipt information, wherein the user can see the terminal device F in the unlocking device list; the user initiates the startup command to the terminal device F through the remote authentication module of the user terminal E.
  • the user terminal E requests the user to input a fingerprint for identity authentication.
  • step (vii) if the identity authentication is passed, the user terminal E sends an encrypted activation request carrying the timestamp, the user RCS account of the user terminal E to the terminal device F, by the forwarding of the RCS server, and proceeds to step (viii); if the identity authentication fails, The user is prompted to have a problem and the process ends.
  • the terminal device F decrypts the start request, the check time stamp does not time out, checks whether the user information in the start request is an authorized user, and if the check passes, unlocks the terminal device F; if the check fails, the start request is ignored.
  • the Internet of Things authentication system and the Internet of Things authentication method provided by the present disclosure initiate remote authentication commands through an RCS account, and use a Rich Communication Suite (RCS) server for remote authentication.
  • the command security is based on the RCS security signaling channel, and the remote authentication is performed by detecting the initiator device, the peer device, and the RCS account information.
  • RCS Rich Communication Suite
  • the present disclosure effectively combines the traditional biometrics with the new RCS rich communication method, and fully utilizes the advantages of the biometric identification system and the RCS rich communication, which can effectively avoid the analysis of the server bioinformatics algorithm and reduce the server authentication pressure.
  • the biometric authentication method is applied to the Internet of Things to reduce the cost of learning for users and effectively realize the safety certification of people, things, objects and objects.
  • the unified signaling interaction mode transparently transmits the authentication information, unified the interaction scheme, and implements a unified remote authentication module, which encourages each device manufacturer to lower the development cost and efficiently deploy the security authentication environment. At the same time, the user's viscosity is greatly improved by expanding the function of the RCS module.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Theoretical Computer Science (AREA)
  • Medical Informatics (AREA)
  • Power Engineering (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本公开提出了一种物联网认证系统和物联网认证方法。所述物联网认证系统包括第一用户终端，用于接受用户的交互通信请求，生成携带第二绑定关系信息的远程认证请求消息，并将远程认证请求消息发送至第一目标设备；第一富通信套件服务器，用于在第一用户终端和/或富通信账号与第一目标设备建立绑定关系以及认证绑定关系的过程中，实现第一用户终端和第一目标设备之间的消息转发；第一目标设备，用于存储第一绑定关系信息，接收远程认证请求消息，检测第二绑定关系信息与第一绑定关系信息是否一致，其中，如果一致，则认证通过，第一目标设备接受第一用户终端的交互通信请求。

Description

一种物联网认证系统和物联网认证方法 技术领域
本公开涉及移动通信与物联网技术领域，特别涉及一种物联网认证系统和物联网认证方法。
背景技术
随着社会的发展、科学技术水平的不断提高，物联网得到了广泛的发展。物联网的迅速崛起，使得通过人与物、物与物之间的互联交互，来实现各种远程业务或是远程设备管理的场景也日益增加。但是，随之而来的用户身份认证以及远程身份认证中存在的安全性和易用性问题，也逐渐暴露。
在一种情况中，采用生物识别技术的认证方法可以快速、安全、准确地进行身份的认证。例如，利用指纹、脸形、虹膜等生物特征的身份认证已经广泛第应用于智能移动终端。但是，尚未提出在物联网环境下的用户与设备间的有效的远程认证系统和方法。
发明内容
本公开提供了一种物联网认证系统和物联网认证方法。
本公开实施例提供的物联网认证系统，包括第一用户终端、第一富通信套件服务器和第一目标设备，其中，所述第一用户终端用于接受用户的交互通信请求，生成携带第二绑定关系信息的远程认证请求消息，并将所述远程认证请求消息发送至所述第一目标设备；所述第一富通信套件服务器用于在第一用户终端和/或富通信账号与所述第一目标设备建立绑定关系以及认证绑定关系过程中，实现所述第一用户终端与所述第一目标设备之间的消息转发；所述第一目标设备用于存储所述第一用户终端和/或富通信账号与所述第一目标设备之间的第一绑定关系信息，接收所述远程认证请求消息，并且检测所述远程认证请求消息中的所述第二绑定关系信息与所述第一绑定关系信息是否一致，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述 第一绑定关系信息一致，则认证通过，并且所述第一目标设备接受所述第一用户终端的交互通信请求。
在一个示例性实施例中，所述远程认证请求消息中携带时间戳信息；并且所述第一目标设备还用于在验证所述远程认证请求消息中的绑定关系信息与所述存储的绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第二绑定关系信息一致且时间戳不超时，则认证通过。
在一个示例性实施例中，所述第一用户终端还用于在生成所述远程认证请求消息之前，要求用户输入生物信息认证。
在一个示例性实施例中，所述生物信息认证为指纹识别、面部识别或语音识别中的至少一者。
本公开实施例还提供了一种物联网认证系统，包括第二用户终端、第二富通信套件服务器、第二目标设备和第三方服务器，其中，所述第二用户终端用于接受用户的交互通信请求，生成携带第二绑定关系信息的远程认证请求消息，并将所述远程认证请求消息发送至所述第二目标设备；所述第二富通信套件服务器用于在所述第二用户终端和/或富通信账号与所述第二目标设备建立绑定关系以及认证绑定关系过程中，实现所述第二用户终端与所述第三方服务器之间的消息转发；所述第三方服务器用于存储所述第二用户终端和/或富通信账号与所述第二目标设备之间的第一绑定关系信息；接收所述远程认证请求消息，验证远程认证请求消息中的所述第二绑定关系信息与所述第一绑定关系信息是否一致，其中，如果远程认证请求消息中的所述第二绑定关系信息与所述第一绑定关系信息一致，将所述远程认证请求消息转发至所述第二目标设备；所述第二目标设备，用于接收所述远程认证请求消息，检测所述远程认证请求消息中的目标设备信息与本地信息是否一致，如果与本地信息一致，则认证通过，接受第二用户终端的交互通信请求。
本公开实施例还提供了一种物联网认证方法，包括：通过第一富通信套件服务器转发消息以使第一用户终端和/或富通信账号与第一目标设备绑定，并将第一绑定关系信息存储在所述第一目标设备中；通 过所述第一用户终端请求发出与所述第一目标设备进行交互通信的请求，通过所述第一用户终端生成携带第二绑定关系信息的远程认证请求消息，并将所述远程认证请求消息发送至第一目标设备；以及通过所述第一目标设备接收所述远程认证请求消息，验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致，则认证通过，并且所述第一目标设备接受第一用户终端的交互通信请求。
在一个示例性实施例中，在将所述远程认证请求消息发送至所述第一目标设备时，所述远程认证请求消息中携带时间戳信息，并且所述方法还包括：在验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致且时间戳不超时，则认证通过。
在一个示例性实施例中，所述方法还包括：在将所述远程认证请求消息发送至所述第一目标设备时，对所述远程认证请求消息进行加密处理。
在一个示例性实施例中，在通过所述第一富通信套件服务器发出与所述第一目标设备进行交互通信的请求时，所述第一用户终端要求用户输入生物信息认证，其中，如果生物信息认证成功，则所述第一用户终端生成所述远程认证请求消息。
本公开实施例还提供了一种物联网认证方法，包括：通过第二富通信套件服务器转发消息以使第二用户终端和/或富通信账号与第二目标设备的绑定，并将所述第一绑定关系信息存储在第三方服务器中；通过第二用户终端发出与第二目标设备进行交互通信的请求，通过所述第二用户终端生成携带第二绑定关系信息的远程认证请求消息，并将所述远程认证请求消息发送至第三方服务器；通过所述第三方服务器接收所述远程认证请求消息，验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致， 将所述远程认证请求消息转发至所述第二目标设备；通过所述第二目标设备接收远程认证请求消息，检测所述远程认证请求消息中的目标设备信息与本地信息是否一致，其中，如果所述远程认证请求消息中的目标设备信息与本地信息一致，则认证通过，并且述第二目标设备接受第二用户终端的交互通信请求。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为根据本公开第一实施例的物联网认证系统的结构示意图；
图2为根据本公开第二实施例的物联网认证系统的结构示意图；
图3为根据本公开第一实施例的物联网认证方法的流程示意图；
图4为根据本公开第二实施例的物联网认证方法的流程示意图；
图5为根据本公开第三实施例的物联网认证方法的流程示意图；
图6为根据本公开第三实施例的物联网认证方法中的绑定步骤的流程示意图；
图7为根据本公开第三实施例的物联网认证方法中的信令流程示意图；
图8为根据本公开第三实施例的物联网认证系统的结构示意图；以及
图9为根据本公开第四实施例的物联网认证系统的结构示意图。
具体实施方式
为使本公开的目的、技术方案和优点更加清楚明白，下文中将结合附图对本公开的实施例进行详细说明。需要说明的是，在不冲突的情况下，本公开中的实施例及实施例中的特征可以相互任意组合。
富通信套件(Rich Communication Suite)是由全球移动通信联盟(GSMA)推进的、构建在IMS(IP Multimedia Subsystem)网络之上的、具有统一业务集定义的技术标准。RCS基于手机电话号码簿实现 语音、消息、状态呈现等多媒体业务。用户通过智能终端上的软件客户端来使用RCS业务。在一些情况下，RCS业务可以类似于互联网的QQ、微信等即时通信业务并且可以直接使用手机上保存的电话号码来自动显示用户的在线状态，从而实时地进行语音、图片、视频等多种方式的沟通。除非另有所指，根据本公开实施例的物联网认证系统和物联网认证方法基于RCS实现。
需要说明的是，使用本公开提供的物联网认证方法之前，用户需要成为运营商实名认证机制认证成功的RCS用户。用户使用自己的RCS用户账户作为物联网账户登录RCS终端。本公开中涉及的消息交互均使用RCS环境中的信令通道。RCS具有较高信息整合能力和及时性，同时也具有更好的多媒体呈现能力和极佳的用户体验。RCS通信还具有较好安全性，用户注册RCS平台需要通过运营商网络国家实名制认证。在RCS平台下的用户登录场景中，通过会话初始协议(Session Initiation Protocol，SIP)中的注册(REGISTER)信令系列流程来确认SIP设备并认证SIP代理，从而有效地建立一个安全的信令交互通道。
如图1所示，本公开提供了一种物联网认证系统，包括第一用户终端10、第一富通信套件服务器20和第一目标设备30，其中，第一用户终端10用于接受用户的交互通信请求，生成携带第二绑定关系信息的远程认证请求消息，并将远程认证请求消息发送至第一目标设备30；第一富通信套件服务器20用于在第一用户终端10和/或富通信账号与第一目标设备30建立绑定关系并且在认证绑定关系过程中，实现第一用户终端10和第一目标设备30之间的消息转发；第一目标设备30用于存储第一用户终端10和/或富通信账号与第一目标设备30之间的第一绑定关系信息，接收远程认证请求消息，并且检测远程认证请求消息中的第二绑定关系信息与存储的第一绑定关系信息是否一致，其中，如果检测远程认证请求消息中的第二绑定关系信息与第一绑定关系信息一致，则认证通过并且所述第一目标设备接受第一用户终端10的交互通信请求。
在一个示例性实施例中，所述第一富通信套件服务器20还用于预先建立第一用户终端10与富通信账号之间的绑定关系。
在一个示例性实施例中，所述远程认证请求消息中携带时间戳信息；并且所述第一目标设备30还用于在验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第二绑定关系信息一致且所述时间戳不超时，则认证通过。
需要说明的是，在所述远程认证请求消息中携带时间戳信息的情况下，所述时间戳设定的超时时间可以较短，以确保操作的时效性，同时增强消息的防伪能力。
在一个示例性实施例中，所述第一用户终端10还用于在生成所述远程认证请求消息之前，要求用户输入生物信息认证。
需要说明的是，生物识别技术是一种便捷并且安全的认证方式。用于生物识别的生物特征可以包括手形、指纹、脸形、虹膜、视网膜、脉搏、耳廓等。行为特征可以包括签字、声音、按键力度等。在一个示例性实施例中，所述生物信息认证包括但不限于指纹识别、面部识别和语音识别。
在一个示例性实施例中，所述远程认证请求消息发送时进行加密处理。
在一个示例性实施例中，所述在第一用户终端和/或富通信账号与第一目标设备之间建立的绑定关系可以在接受用户的交互通信请求前预先单独建立，也可以在接受用户的交互通信请求时建立。
所述第一用户终端10和/或富通信账号与第一目标设备30建立绑定关系的过程包括：第一用户终端10生成携带目标设备识别码的第二绑定请求消息，并经由第一富通信套件服务器20将第二绑定请求消息发送至第一目标设备30；第一目标设备30接收第二绑定请求消息，检测第二绑定请求消息中的目标设备识别码信息与本地信息是否一致，其中，如果第二绑定请求消息中的目标设备识别码信息与本地信息一致，则绑定成功，接受第一用户终端10的绑定请求。
如图2所示，本公开还提供了一种物联网认证系统，包括第二用户终端40、第二富通信套件服务器50、第二目标设备70和第三方服 务器60，其中，
所述第二用户终端40用于接受用户的交互通信请求，生成携带第二绑定关系信息的远程认证请求消息，并将远程认证请求消息发送至所述第二目标设备70；
所述第二富通信套件服务器50用于在第二用户终端和/或富通信账号与第二目标设备建立绑定关系以及认证绑定关系过程中，在第二用户终端40和第三方服务器60之间进行消息转发；
所述第三方服务器60用于存储第二用户终端40和/或富通信账号与第二目标设备70之间的第一绑定关系信息，接收远程认证请求消息，验证远程认证请求消息中的第二绑定关系信息与第一绑定关系信息是否一致，其中，如果远程认证请求消息中的第二绑定关系信息与第一绑定关系信息一致，将所述远程认证请求消息转发至所述第二目标设备70；
所述第二目标设备70用于接收远程认证请求消息，检测远程认证请求消息中的目标设备信息与本地信息是否一致，其中，如果远程认证请求消息中的目标设备信息与本地信息一致，则认证通过并且所述第二目标设备接受第二用户终端40的交互通信请求。
在一个示例性实施例中，所述第二富通信套件服务器50还用于预先建立第二用户终端40与富通信账号之间的绑定关系。
在一个示例性实施例中，所述远程认证请求消息中携带时间戳信息；所述第三方服务器60还用于在验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致且时间戳不超时，则将所述远程认证请求消息转发至所述第二目标设备70；所述第二目标设备70还用于在检测远程认证请求消息中的目标设备信息与本地信息是否一致时，检测所述时间戳是否超时，其中，如果远程认证请求消息中的目标设备信息与本地信息一致且时间戳不超时，则认证通过。
在一个示例性实施例中，所述第二用户终端40还用于在生成所述远程认证请求消息前，要求用户输入生物信息认证。
在一个示例性实施例中，所述生物信息认证包括但不限于指纹识别、面部识别和语音识别。
在一个示例性实施例中，所述远程认证请求消息发送时进行加密处理。
在一个示例性实施例中，所述第三方服务器60可以为RCS公众号服务器。
在一个示例性实施例中，所述在第二用户终端和/或富通信账号与第二目标设备之间建立的绑定关系可以在接受用户的交互通信请求前预先单独建立，也可以在接受用户的交互通信请求时建立。
所述第二用户终端40和/或富通信账号与第二目标设备70建立绑定关系的过程包括：第二用户终端40生成携带第二目标设备70的目标设备识别码的绑定请求消息，并经由第二富通信套件服务器50将绑定请求消息发送至第三方服务器60；第三方服务器60接收绑定请求消息，检测是否预先存储有第二目标设备70的信息，其中，如果预先存储有第二目标设备70的信息，则将绑定请求消息发送至第二目标设备70；第二目标设备70接收绑定请求消息，检测绑定请求消息中的目标设备识别码信息与本地信息是否一致，其中，如果绑定请求消息中的目标设备识别码信息与本地信息一致，则绑定成功并且第二目标设备70接受第二用户终端40的绑定请求。
如图3所示，根据本公开实施例的一种物联网认证方法，包括如下步骤：
步骤301：通过第一富通信套件服务器转发消息以使第一用户终端和/或富通信账号与第一目标设备绑定，并将第一绑定关系信息存储在所述第一目标设备中；
步骤302：通过所述第一用户终端发出与所述第一目标设备进行交互通信的请求，通过所述第一用户终端生成携带第二绑定关系信息的远程认证请求消息，并通过第一富通信套件服务器将所述远程认证请求消息发送至所述第一目标设备；以及
步骤303：通过所述第一目标设备接收所述远程认证请求消息，验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关 系信息是否一致，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致，则认证通过，并且所述第一目标设备接受第一用户终端的交互通信请求；如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息不一致，则认证失败，所述第一目标设备拒绝所述第一用户终端的交互通信请求。
在一个示例性实施例中，在步骤301之前，用户可以通过第一富通信套件服务器，预先建立第一用户终端和富通信账号之间的绑定关系。
在一个示例性实施例中，在将所述远程认证请求消息发送至所述第一目标设备时，所述远程认证请求消息中携带有时间戳信息。在一个示例性实施例中，所述第一目标设备在验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致且时间戳不超时，则认证通过；如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息不一致或时间戳超时，则认证失败。
需要说明的是，当所述远程认证请求消息中携带时间戳信息时，所述时间戳设定的超时时间应当较短，以确保操作时效性，同时增强消息的防伪能力。在一个示例性实施例中，步骤302还包括：在将所述远程认证请求消息发送至所述第一目标设备时，对所述远程认证请求消息进行加密处理。
在一个示例性实施例中，在通过所述第一富通信套件服务器发出与所述第一目标设备进行交互通信的请求时，所述第一用户终端要求用户输入生物信息认证，其中，如果生物信息认证成功，则所述第一用户终端生成所述远程认证请求消息。在一个示例性实施例中，所述生物信息认证包括但不限于指纹识别、面部识别和语音识别。
在一个示例性实施例中，在第一用户终端和/或富通信账号与第一目标设备之间建立的所述绑定关系可以在接受用户的交互通信请求前预先单独建立，也可以在接受用户的交互通信请求时建立。
所述通过第一富通信套件转发消息以使第一用户终端和/或富通 信账号与第一目标设备的绑定的步骤包括：通过所述第一用户终端生成携带目标设备识别码的第二绑定请求消息，并经由第一富通信套件服务器将所述第二绑定请求消息发送至所述第一目标设备；以及通过所述第一目标设备接收所述第二绑定请求消息，检测所述第二绑定请求消息中的目标设备识别码信息与本地信息是否一致，如果所述第二绑定请求消息中的目标设备识别码信息与本地信息一致，则绑定成功，并且所述第一目标设备接受第一用户终端的绑定请求。
在一个示例性实施例中，如图4所示，根据本公开实施例的一种物联网认证方法，包括：
步骤401：通过第二富通信套件服务器转发消息以使第二用户终端和/或富通信账号与第二目标设备的绑定，并将第一绑定关系信息存储在第三方服务器中；
步骤402：通过第二用户终端发出与第二目标设备进行交互通信的请求，通过所述第二用户终端生成携带第二绑定关系信息的远程认证请求消息，并通过所述第二富通信套件服务器将所述远程认证请求消息发送至所述第三方服务器；
步骤403：通过所述第三方服务器接收所述远程认证请求消息，验证远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致，其中，如果远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致，则将所述远程认证请求消息转发至所述第二目标设备；如果远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息不一致，则认证失败，并且所述第三方服务器拒绝第二用户终端的交互通信请求；
步骤404：通过所述第二目标设备接收远程认证请求消息，检测远程认证请求消息中的目标设备信息与本地信息是否一致，其中，如果所述远程认证请求消息中的目标设备信息与本地信息一致，则认证通过，并且述第二目标设备接受第二用户终端的交互通信请求；如果所述远程认证请求消息中的目标设备信息与本地信息不一致，则认证失败，并且述第二目标设备拒绝第二用户终端的交互通信请求。
在一个示例性实施例中，在步骤401之前，用户通过第二富通信 套件服务器，预先建立第二用户终端和富通信账号之间的绑定关系。
在一个示例性实施例中，在将所述远程认证请求消息发送至所述第三方服务器或第二目标设备时，所述远程认证请求消息中携带时间戳信息。在一个示例性实施例中，步骤403还包括：在通过所述第三方服务器验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致且时间戳不超时，则将所述远程认证请求消息转发至所述第二目标设备；如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息不一致或时间戳超时，则认证失败，并且所述第三方服务器拒绝第二用户终端的交互通信请求；在一个示例性实施例中，步骤404还包括：在通过所述第二目标设备检测远程认证请求消息中的目标设备信息与本地信息是否一致时，检测所述时间戳是否超时，其中，如果远程认证请求消息中的目标设备信息与本地信息一致且时间戳不超时，则认证通过，并且所述第二目标设备接受第二用户终端的交互通信请求；如果远程认证请求消息中的目标设备信息与本地信息不一致或时间戳超时，则认证失败，所述第二目标设备拒绝第二用户终端的交互通信请求。
在一个示例性实施例中，所述方法还包括：在将所述远程认证请求消息发送至所述第三方服务器或第二目标设备时，对所述远程认证请求消息进行加密处理。
在一个示例性实施例中，在通过所述第二用户终端请求与所述第二目标设备进行交互通信时，所述第二用户终端要求用户输入生物信息认证，其中，如果生物信息认证成功，所述第二用户终端生成所述远程认证请求消息。
在一个示例性实施例中，所述生物信息认证包括但不限于指纹识别、面部识别或语音识别。
在一个示例性实施例中，在第二用户终端和/或富通信账号与第二目标设备之间建立的绑定关系可以在接受用户的交互通信请求前预先单独建立，也可以在接受用户的交互通信请求时建立。
所述第二用户终端和/或富通信账号与第二目标设备建立绑定关系的过程包括：第二用户终端生成携带目标设备识别码的第二绑定请求消息，并经由第二富通信套件服务器将所述第二绑定请求消息发送至第三方服务器；第三方服务器接收绑定请求消息，检测是否预先存储有第二目标设备的信息，其中，如果预先存储有第二目标设备的信息，则将所述第二绑定请求消息发送至第二目标设备；第二目标设备接收绑定请求消息，检测所述第二绑定请求消息中的目标设备识别码信息与本地信息是否一致，其中，如果所述第二绑定请求消息中的目标设备识别码信息与本地信息一致，则绑定成功，并且第二目标设备接受第二用户终端的绑定请求。
在本公开的一个示例性实施例中，如图5所示，所述物联网认证方法，包括如下步骤：
步骤501：使用RCS账户登录RCS终端，通过富通信套件服务器转发消息以使用户终端、RCS账户与目标设备之间绑定，并将绑定关系信息存储在目标设备或第三方服务器中；
步骤502：通过RCS终端发出与目标设备进行交互通信的请求；
步骤503：通过RCS终端生成加密的远程认证请求消息，所述远程认证请求消息包括RCS账户信息、用户终端识别码、目标设备识别码和时间戳信息，其中，如果所述绑定关系信息存储在第三方服务器中，转到步骤504；如果所述绑定关系信息存储在目标设备中，转到步骤506；
步骤504：通过RCS终端将所述远程认证请求消息发送至第三方服务器，第三方服务器接收并解析远程认证请求消息，检测远程认证请求消息中的RCS账户信息、用户终端识别码和目标设备识别码与预先存储的绑定关系信息是否一致以及时间戳信息是否超时，其中，如果远程认证请求消息中的RCS账户信息、用户终端识别码和目标设备识别码与预先存储的绑定关系信息一致且时间戳不超时，转到步骤505；如果远程认证请求消息中的RCS账户信息、用户终端识别码和目标设备识别码与预先存储的绑定关系信息不完全一致或者时间戳超时，转到步骤508；
步骤505：通过所述第三方服务器将携带时间戳信息的远程认证请求消息发送至目标设备，目标设备接收并解析远程认证请求消息，检测远程认证请求消息中的目标设备识别码与本地识别码是否一致以及时间戳信息是否超时，其中，如果远程认证请求消息中的目标设备识别码与本地识别码一致且时间戳不超时，转到步骤507；如果远程认证请求消息中的目标设备识别码与本地识别码不一致或时间戳信息超时，转到步骤508；
步骤506：通过RCS终端将所述远程认证请求消息发送至目标设备，目标设备接收并解析远程认证请求消息，检测远程认证请求消息中的RCS账户信息、用户终端识别码和目标设备识别码与预先存储的绑定信息是否一致以及时间戳信息是否超时，其中，如果远程认证请求消息中的RCS账户信息、用户终端识别码和目标设备识别码与预先存储的绑定信息一致且时间戳不超时，转到步骤507；如果远程认证请求消息中的RCS账户信息、用户终端识别码和目标设备识别码与预先存储的绑定信息不完全一致或时间戳信息超时，转到步骤508；
步骤507：确定认证通过，使得所述目标设备接受用户的交互通信请求；以及
步骤508：确定认证失败，使得所述目标设备拒绝用户的交互通信请求。
在一个示例性实施例中，如图6所示，所述通过富通信套件服务器转发消息以使用户终端、RCS账户与目标设备之间绑定的步骤包括：
步骤5011：通过RCS终端请求绑定目标设备以使RCS终端生成绑定请求信息，所述绑定请求信息包括用户终端识别码、RCS账户、目标设备识别码，其中，如果通过第三方服务器进行绑定，转到步骤5012；如果通过目标设备进行绑定，转到步骤5014；
步骤5012：通过RCS服务器将绑定请求信息发送至第三方服务器，第三方服务器接收绑定请求信息并解析，验证是否预先存储有目标设备信息，其中，如果预先存储有目标设备信息，转到步骤5013；如果没有预先存储目标设备信息，转到步骤5016；
步骤5013：通过所述第三方服务器将绑定请求信息发送至目标设 备，目标设备接收绑定请求信息，验证绑定请求信息中的目标设备识别码与本地识别码是否一致，其中，如果绑定请求信息中的目标设备识别码与本地识别码一致，提示用户是否接受绑定，如果用户接受绑定，返回确认绑定以使第三方服务器存储绑定映射，并且转到步骤5015；如果绑定请求信息中的目标设备识别码与本地识别码不一致或用户拒绝绑定，转到步骤5016；
步骤5014：通过RCS服务器将绑定请求信息发送至目标设备，目标设备接收并解析绑定请求信息，验证绑定请求信息中的目标设备识别码与本地识别码是否一致，其中，如果绑定请求信息中的目标设备识别码与本地识别码一致，提示用户是否接受绑定，如果用户接受绑定，返回确认绑定以使目标设备存储绑定映射，并且转到步骤5015；如果绑定请求信息中的目标设备识别码与本地识别码不一致或用户拒绝绑定，转到步骤5016；
步骤5015：确定绑定成功；以及
步骤5016：确定绑定失败。
在一个示例性实施例中，如果目标设备为RCS终端，目标设备可以要求用户输入生物信息认证。如果生物信息认证成功，提示用户是否接受绑定。如果生物信息认证失败，转到步骤5016。
在一个示例性实施例中，例如，所述目标设备识别码或用户终端识别码可以为目标设备或用户终端的介质访问控制(Medium Access Control，MAC)地址、通用唯一识别码(Universally Unique Identifier，UUID)、移动用户国际号码(Mobile Station International SDN，MSISDN)或国际用户识别码(International Mobile Subscriber Identification Number，IMSI)。
在本实施例中的各个网元模块间的信令流程如图7所示。在图7中，当用户发起绑定目标设备的指令时，用户输入目标设备唯一标识。RCS终端生成绑定RCS账户和目标设备的绑定请求消息，并通过RCS服务器转发至第三方服务器或目标设备。当用户发起远程操作目标设备的请求时，RCS终端接受用户的远程操作请求，生成携带绑定关系信息的远程操作请求指令。如果所述绑定关系信息存储在目标设备中， RCS终端通过RCS服务器将远程操作请求指令发送至目标设备。目标设备接收到所述远程操作请求指令后，对其中的绑定关系信息进行验证。如果验证通过，则接受用户的远程操作指令。如果所述绑定关系信息存储在第三方服务器中，RCS终端通过RCS服务器将远程操作请求指令发送至第三方服务器。第三方服务器接收到所述远程操作请求指令后，对其中的绑定关系信息进行验证，如果验证通过，则将远程操作指令发送至目标设备。目标设备验证目标设备识别码与本地识别码是否一致。如果目标设备识别码与本地识别码一致，则目标设备接受用户的远程操作指令。
值得说明的是，本公开所述的用户终端包括但不限于具有RCS应用的手机、平板电脑(PAD)等移动通讯设备。所述的目标设备至少具有联网解析SIP信令的能力。所述的RCS服务器可承载多种公共账号业务，提供包括但不限于以SIP信令为基础的消息收发、消息查询、修改能力。所述的第三方服务器具有独立的存储和逻辑处理能力，和RCS服务器互联，进而可以和RCS用户进行交互。
本公开还提供了几个优选的实施例对本公开进行进一步解释，但是值得注意的是，该优选实施例只是为了更好的描述本公开，并不构成对本公开不当的限定。下面的各个实施例可以独立存在，且不同实施例中的技术特点可以组合在一个实施例中一起使用。
在一个实例中，如图8所示，用户终端A带有指纹识别系统(如常见智能手机)。用户终端A上安装有RCS终端软件。用户为RCS用户。用户需要通过用户终端A远程启动车机系统设备B，车机系统设备B能简单解析SIP信令，并设有用于存储绑定信息的数据库。用户终端A和车机系统设备B可以通过RCS平台实现信息交互。
(1)用户登录用户终端A的RCS系统以发起绑定请求。
(2)用户终端A提示用户认证指纹并输入设备B的唯一识别码(如发动机号)，其中，如果指纹认证通过，则用户终端A通过RCS服务器的转发将携带用户终端A唯一识别码(如手机UUID或ISDN等)、设备B唯一识别码、用户RCS账户的加密绑定指令发送至设备B，转到步骤(3)；如果指纹认证失败，提示用户身份有问题，结束 流程。
(3)设备B收到加密绑定指令并解密，显示用户终端A和用户RCS账户信息，提示用户是否接受绑定；用户操作设备B进行绑定确认，使得设备B绑定用户RCS帐号、用户终端A的唯一识别码和设备B的唯一识别码。
(4)在绑定完成后，发送绑定完成消息到用户终端A；此时，用户可通过用户终端A远程认证模块发起启动设备B指令。
(5)用户终端A请求用户输入指纹进行身份认证。
(6)如果身份认证通过，则用户终端A通过RCS服务器的转发将携带时间戳、用户RCS账户、用户终端A唯一识别码的加密启动请求发送到设备B，转到步骤(7)；如果身份认证失败，用户终端A提示用户身份异常并结束流程。
(7)设备B解密启动请求，核对时间戳未超时，校验用户RCS帐号、用户终端A的唯一识别码和设备B的唯一识别码与存储的绑定信息是否一致；如果校验通过，设备B启动车机发动机；如果校验失败，设备B忽略该请求。
在一个实例中，如图9所示，用户终端C带有指纹识别系统。用户终端C上安装有RCS终端软件。用户为RCS用户。用户需要通过用户终端C远程打开门禁设备D，门禁系统设备D能简单解析SIP信令。
(a)用户登录用户终端C上的RCS系统，并进入门禁设备D的RCS公众号服务器。
(b)用户发起绑定请求，用户终端C提示用户进行指纹认证；用户输入门禁设备D的唯一识别码(如网络模块MAC地址)以发起绑定；如果认证通过，则用户终端C通过RCS服务器的转发将发起绑定指令发送至RCS公众号服务器，转到步骤(c)；如果认证失败，用户终端C提示用户身份异常并结束流程。
(c)RCS公众号服务器解密信息，确认是否存在门禁设备D；如果存在门禁设备D，向门禁设备D发起确认信息；门禁设备D提示用户是否接受绑定，以使用户操作门禁设备D进行绑定确认；用户确认后，公众号系统绑定用户RCS帐号、用户终端C的唯一识别码和门禁 设备D的唯一识别码，转到步骤(d)；如果不存在设备D或用户拒绝绑定设备D，用户终端C流程结束。
(d)绑定完成后，用户通过用户终端C远程认证模块发起解锁指令。
(e)用户终端C请求用户输入指纹进行身份认证。
(f)如果身份认证通过，用户终端C通过RCS服务器的转发将携带时间戳、用户RCS账户、用户终端C唯一识别码和门禁设备D的唯一识别码的加密解锁请求发送到RCS公众号服务器，转到步骤(g)；如果身份认证失败，用户终端C提示用户身份异常并结束流程。
(g)RCS公众号服务器解密解锁请求，核对时间戳未超时，校验用户RCS账户、用户终端C唯一识别码和门禁设备D的唯一识别码与存储的绑定信息是否一致，如果一致，将携带时间戳和门禁设备D唯一识别码的加密解锁指令发送到门禁设备D，转到步骤(h)；如果校验不一致或者时间戳超时，用户终端C提示用户身份异常并结束流程。
(h)门禁设备D解密解锁请求后，核对时间戳未超时，校验解锁指令中的唯一识别码与本设备唯一识别码是否一致；如果一致，门禁设备D解锁；如果不一致，忽略该请求。
在一个实例中，用户终端E带有指纹识别系统。用户终端E上安装有RCS终端软件。用户为RCS用户。用户需要通过用户终端E远程解锁终端设备F。终端设备F上预装RCS软件客户端且登录RCS账户。
(i)用户终端E登录RCS系统，并与终端设备F进行绑定。
(ii)用户终端E提示用户进行指纹认证；如果指纹认证通过，用户终端E通过RCS服务器的转发将携带用户终端E的用户RCS账户的加密绑定指令发送至终端设备F；如果指纹认证失败，用户终端E提示用户身份异常并结束流程。
(iii)终端设备F收到绑定指令并解密，显示用户终端E的绑定指令，并提示用户是否接受绑定。
(iv)终端设备F请求用户输入指纹验证身份；如果身份验证通过且接受绑定，终端设备F发送绑定回执信息至用户终端E，记录用户终端E的授权用户信息，转到步骤(v)；如果身份验证失败或拒 绝绑定，用户终端E流程结束。
(v)用户终端E通过绑定回执信息来记录终端设备F的绑定信息，其中，用户在解锁设备列表中可见终端设备F；用户通过用户终端E远程认证模块发起启动指令至终端设备F。
(vi)用户终端E请求用户输入指纹进行身份认证。
(vii)如果身份认证通过，通过RCS服务器的转发，用户终端E发送携带时间戳、用户终端E的用户RCS账户的加密启动请求到终端设备F，转到步骤(viii)；如果身份认证失败，提示用户身份有问题，流程结束。
(viii)终端设备F解密启动请求，核对时间戳未超时，检验启动请求中的用户信息是否为授权用户，如果校验通过，解锁终端设备F；如果校验失败，则忽略该启动请求。
本公开提供的物联网认证系统和物联网认证方法，通过RCS账户发起远程认证指令，利用富通信套件(Rich Communication Suite，RCS)服务器进行远程认证。指令防伪基于RCS安全信令通道，通过检测发起方设备、对端设备、RCS账户信息进行远程认证。借助RCS服务的实时性、安全性、规范性，便捷有效地实现物联网环境中用户和设备、设备和设备间的安全交互。
本公开有效地将传统生物识别和新的RCS富通信方式结合，充分发挥生物识别系统和RCS富通信的优势，可有效避免服务器生物信息算法分析，减少服务器认证压力。一方面，将生物认证方式运用于物联网中，降低用户学习成本，有效实现人与物、物与物的安全认证。另一方面，采用统一的信令交互方式透传认证信息，统一交互方案，实现一个统一的远程认证模块，促使各个设备厂商低开发成本，高效部署安全认证环境。同时，通过对RCS模块功能的扩充，大大提高用户粘度。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现，相应地，上述实施例中的各 模块/单元可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。本公开不限制于任何特定形式的硬件和软件的结合。
以上所述仅为本公开的优选实施例而已，并不用于限制本公开，对于本领域的技术人员来说，本公开可以有各种更改和变化。凡在本公开的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。

Claims (14)

  1. 一种物联网认证系统，包括第一用户终端、第一富通信套件服务器和第一目标设备，其中，
    所述第一用户终端用于接受用户的交互通信请求，生成携带第二绑定关系信息的远程认证请求消息，并将所述远程认证请求消息发送至所述第一目标设备；
    所述第一富通信套件服务器用于在第一用户终端和/或富通信账号与所述第一目标设备建立绑定关系以及认证绑定关系过程中，实现所述第一用户终端与所述第一目标设备之间的消息转发；
    所述第一目标设备用于存储所述第一用户终端和/或富通信账号与所述第一目标设备之间的第一绑定关系信息，接收所述远程认证请求消息，并且检测所述远程认证请求消息中的所述第二绑定关系信息与所述第一绑定关系信息是否一致，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致，则认证通过并且所述第一目标设备接受所述第一用户终端的交互通信请求。
  2. 根据权利要求1所述的物联网认证系统，其中，所述远程认证请求消息中携带时间戳信息；并且
    所述第一目标设备还用于在验证所述远程认证请求消息中的绑定关系信息与所述存储的绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第二绑定关系信息一致且时间戳不超时，则认证通过。
  3. 根据权利要求1所述的物联网认证系统，其中，所述第一用户终端还用于在生成所述远程认证请求消息之前，要求用户输入生物信息认证。
  4. 根据权利要求3所述的物联网认证系统，其中，所述生物信息认证包括指纹识别、面部识别和语音识别中的至少一者。
  5. 一种物联网认证系统，包括第二用户终端、第二富通信套件服务器、第二目标设备和第三方服务器，其中，
    所述第二用户终端用于接受用户的交互通信请求，生成携带第二绑定关系信息的远程认证请求消息，并将所述远程认证请求消息发送至所述第二目标设备；
    所述第二富通信套件服务器用于在所述第二用户终端和/或富通信账号与所述第二目标设备建立绑定关系以及认证绑定关系过程中，实现所述第二用户终端与所述第三方服务器之间的消息转发；
    所述第三方服务器用于存储所述第二用户终端和/或富通信账号与第二目标设备之间的第一绑定关系信息，接收所述远程认证请求消息，验证远程认证请求消息中的所述第二绑定关系信息与所述第一绑定关系信息是否一致，其中，如果远程认证请求消息中的所述第二绑定关系信息与所述第一绑定关系信息一致，将所述远程认证请求消息转发至所述第二目标设备；
    所述第二目标设备用于接收远程认证请求消息，检测远程认证请求消息中的目标设备信息与本地信息是否一致，其中，如果远程认证请求消息中的目标设备信息与本地信息一致，则认证通过并且所述第二目标设备接受所述第二用户终端的交互通信请求。
  6. 根据权利要求5所述的物联网认证系统，其中，所述远程认证请求消息中携带时间戳信息；
    所述第三方服务器还用于在验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致且时间戳不超时，则将所述远程认证请求消息转发至所述第二目标设备；
    所述第二目标设备还用于在检测远程认证请求消息中的目标设备信息与本地信息是否一致时，检测所述时间戳是否超时，其中，如果远程认证请求消息中的目标设备信息与本地信息一致且时间戳不超时， 则认证通过。
  7. 一种物联网认证方法，包括：
    通过第一富通信套件服务器转发消息以使第一用户终端和/或富通信账号与第一目标设备绑定，并将第一绑定关系信息存储在所述第一目标设备中；
    通过所述第一用户终端发出与所述第一目标设备进行交互通信的请求，通过所述第一用户终端生成携带第二绑定关系信息的远程认证请求消息，并将所述远程认证请求消息发送至所述第一目标设备；以及
    通过所述第一目标设备接收所述远程认证请求消息，验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致，则认证通过，并且所述第一目标设备接受第一用户终端的交互通信请求。
  8. 根据权利要求7所述的物联网认证方法，其中，
    在将所述远程认证请求消息发送至所述第一目标设备时，所述远程认证请求消息中携带时间戳信息，并且
    所述方法还包括：在验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致且时间戳不超时，则认证通过。
  9. 根据权利要求7所述的物联网认证方法，还包括：在将所述远程认证请求消息发送至所述第一目标设备时，对所述远程认证请求消息进行加密处理。
  10. 根据权利要求7所述的物联网认证方法，其中，在通过所述第一富通信套件服务器发出与所述第一目标设备进行交互通信的请求 时，所述第一用户终端要求用户输入生物信息认证，其中，如果生物信息认证成功，则所述第一用户终端生成所述远程认证请求消息。
  11. 一种物联网认证方法，包括：
    通过第二富通信套件服务器转发消息以使第二用户终端和/或富通信账号与第二目标设备的绑定，并将第一绑定关系信息存储在第三方服务器中；
    通过第二用户终端发出与第二目标设备进行交互通信的请求，通过所述第二用户终端生成携带第二绑定关系信息的远程认证请求消息，并将所述远程认证请求消息发送至所述第三方服务器；
    通过所述第三方服务器接收所述远程认证请求消息，验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致，将所述远程认证请求消息转发至所述第二目标设备；
    通过所述第二目标设备接收远程认证请求消息，检测所述远程认证请求消息中的目标设备信息与本地信息是否一致，其中，如果所述远程认证请求消息中的目标设备信息与本地信息一致，则认证通过，并且述第二目标设备接受第二用户终端的交互通信请求。
  12. 根据权利要求11所述的物联网认证方法，其中，在将所述远程认证请求消息发送至所述第三方服务器时，所述远程认证请求消息中携带时间戳信息，
    所述方法还包括：在通过所述第三方设备验证所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息是否一致时，检测所述时间戳是否超时，其中，如果所述远程认证请求消息中的第二绑定关系信息与所述第一绑定关系信息一致且时间戳不超时，则认证通过；以及
    在通过所述第二目标设备检测远程认证请求消息中的目标设备信息与本地信息是否一致时，检测所述时间戳是否超时，其中，如果远 程认证请求消息中的目标设备信息与本地信息一致且时间戳不超时，则认证通过，并且所述第二目标设备接受第二用户终端的交互通信请求。
  13. 根据权利要求11所述的物联网认证方法，还包括：在将所述远程认证请求消息发送至所述第三方服务器时，对所述远程认证请求消息进行加密处理。
  14. 根据权利要求11所述的物联网认证方法，其中，在通过所述第二富通信套件服务器请求与所述第三方设备进行交互通信时，所述第二用户终端要求用户输入生物信息认证，其中，如果生物信息认证成功，所述第二用户终端生成所述远程认证请求消息。
PCT/CN2018/077527 2017-04-07 2018-02-28 一种物联网认证系统和物联网认证方法 WO2018184433A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP18781142.7A EP3609152A4 (en) 2017-04-07 2018-02-28 INTERNET OF THINGS AUTHENTICATION SYSTEM AND INTERNET OF THINGS AUTHENTICATION PROCEDURE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710223657.8 2017-04-07
CN201710223657.8A CN108696479A (zh) 2017-04-07 2017-04-07 一种物联网认证系统和物联网认证方法

Publications (1)

Publication Number Publication Date
WO2018184433A1 true WO2018184433A1 (zh) 2018-10-11

Family

ID=63713079

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077527 WO2018184433A1 (zh) 2017-04-07 2018-02-28 一种物联网认证系统和物联网认证方法

Country Status (3)

Country Link
EP (1) EP3609152A4 (zh)
CN (1) CN108696479A (zh)
WO (1) WO2018184433A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111726396A (zh) * 2020-06-01 2020-09-29 安徽华米信息科技有限公司 设备绑定方法及装置、云端、存储介质
CN113840245A (zh) * 2021-11-16 2021-12-24 中国电信股份有限公司 用于rcs消息的通信方法和通信系统
CN115208916A (zh) * 2022-06-27 2022-10-18 广州广日电梯工业有限公司 物联网终端与电梯的绑定方法、系统、装置及存储介质

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111865879B (zh) * 2019-04-29 2022-12-20 阿里巴巴集团控股有限公司 物联网接入方法、系统及相应的物联网设备
CN110099065A (zh) * 2019-05-10 2019-08-06 北京百度网讯科技有限公司 物联网设备及认证方法、云服务器、处理设备、可读介质
CN111132143B (zh) * 2019-12-25 2023-07-14 上海交通大学 一体化多媒体智能设备安全保护系统及方法
CN111540457B (zh) * 2020-04-02 2023-07-25 出门问问信息科技有限公司 一种绑定方法和装置、电子设备和计算机存储介质
CN112637154B (zh) * 2020-12-09 2022-06-21 迈普通信技术股份有限公司 设备认证方法、装置、电子设备及存储介质
CN113329056B (zh) * 2021-04-30 2023-12-01 河海大学 一种物联网设备和用户终端的绑定方法、设备和系统
CN113613190A (zh) * 2021-06-22 2021-11-05 国网思极网安科技（北京）有限公司 终端安全接入单元、系统及方法
CN114448725A (zh) * 2022-03-22 2022-05-06 北京一砂信息技术有限公司 一种设备认证方法、系统及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2161962B1 (en) * 2008-09-03 2013-02-20 TeliaSonera AB Ad-hoc connection in communications system
CN103475713A (zh) * 2013-09-10 2013-12-25 北京思特奇信息技术股份有限公司 基于融合通信技术实现远程监控智能家居的方法及系统
CN103999429A (zh) * 2011-10-21 2014-08-20 橙公司 有关增强型通信服务的信息交换方法
CN104468145A (zh) * 2014-12-03 2015-03-25 华为技术有限公司 基于rcs的群消息的处理方法和装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160149836A1 (en) * 2014-11-26 2016-05-26 Ecrio, Inc. Communication and Messaging Architecture for Affiliated Real-Time Rich Communications Client Devices
US10182043B2 (en) * 2015-07-17 2019-01-15 Cybrook Inc. Methods and system for user and device management of an IoT network
CN105704157A (zh) * 2016-04-08 2016-06-22 上海卓易科技股份有限公司 远程控制方法及系统、所适用的智能终端和服务端
CN106453234A (zh) * 2016-08-12 2017-02-22 北京东方车云信息技术有限公司 一种身份认证方法及相关服务器和客户端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2161962B1 (en) * 2008-09-03 2013-02-20 TeliaSonera AB Ad-hoc connection in communications system
CN103999429A (zh) * 2011-10-21 2014-08-20 橙公司 有关增强型通信服务的信息交换方法
CN103475713A (zh) * 2013-09-10 2013-12-25 北京思特奇信息技术股份有限公司 基于融合通信技术实现远程监控智能家居的方法及系统
CN104468145A (zh) * 2014-12-03 2015-03-25 华为技术有限公司 基于rcs的群消息的处理方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3609152A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111726396A (zh) * 2020-06-01 2020-09-29 安徽华米信息科技有限公司 设备绑定方法及装置、云端、存储介质
CN113840245A (zh) * 2021-11-16 2021-12-24 中国电信股份有限公司 用于rcs消息的通信方法和通信系统
CN115208916A (zh) * 2022-06-27 2022-10-18 广州广日电梯工业有限公司 物联网终端与电梯的绑定方法、系统、装置及存储介质

Also Published As

Publication number Publication date
EP3609152A4 (en) 2020-12-23
EP3609152A1 (en) 2020-02-12
CN108696479A (zh) 2018-10-23

Similar Documents

Publication Publication Date Title
WO2018184433A1 (zh) 一种物联网认证系统和物联网认证方法
CN107579827B (zh) 一种基于可信第三方和面部识别技术的电子文书签署方法
US20170353442A1 (en) Proximity-based authentication
CN107332808B (zh) 一种云桌面认证的方法、服务器及终端
US8499166B2 (en) Controlling access to a protected network
WO2017177435A1 (zh) 一种身份认证方法、终端及服务器
US8438385B2 (en) Method and apparatus for identity verification
WO2018090183A1 (zh) 一种身份认证的方法、终端设备、认证服务器及电子设备
KR100950894B1 (ko) 보이스 오버 인터넷 프로토콜(브이오아이피) 커뮤니케이션내에서 디지털-증명서를 등록하고 자동으로 검색하는 방법및 시스템
US20160337351A1 (en) Authentication system
CN106850680B (zh) 一种用于轨道交通设备的智能身份认证方法及装置
CN105847247A (zh) 一种认证系统及其工作方法
CN106921663B (zh) 基于智能终端软件/智能终端的身份持续认证系统及方法
WO2016078419A1 (zh) 一种开放授权方法、装置及开放平台
CN101714918A (zh) 一种登录vpn的安全系统以及登录vpn的安全方法
CN101557406A (zh) 一种用户终端的认证方法、装置及系统
WO2017076216A1 (zh) 服务器、移动终端、网络实名认证系统及方法
US9032483B2 (en) Authenticating a communication device and a user of the communication device in an IMS network
CN112543166B (zh) 实名登录的方法及装置
CN114531277B (zh) 一种基于区块链技术的用户身份认证方法
JP2018522323A (ja) 音声通信処理方法及びシステム、電子装置、並びに記憶媒体
WO2015196817A1 (zh) 账号登录方法、装置及系统
CN111404695B (zh) 令牌请求验证方法和装置
CN112020716A (zh) 远程生物特征识别
CN109784024A (zh) 一种基于多认证器多因子的快速在线身份认证fido方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18781142

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018781142

Country of ref document: EP

Effective date: 20191107