WO2018227693A1

WO2018227693A1 - Method and system for acquiring usage permissions of internet of things-based equipment

Info

Publication number: WO2018227693A1
Application number: PCT/CN2017/093335
Authority: WO
Inventors: 杜光东
Original assignee: 深圳市盛路物联通讯技术有限公司
Priority date: 2017-06-16
Filing date: 2017-07-18
Publication date: 2018-12-20
Also published as: CN107395567B; CN107395567A

Abstract

Provided in the present embodiment are a method and system for acquiring usage permissions of an Internet of Things equipment. The method comprises: according to a request by a user for usage permissions of an equipment, acquiring user information and receiving a delegation certificate that is sent by an owner terminal; decrypting and validating the validity of the delegation certificate, and determining whether the request by the user for the usage permissions of the equipment meets a condition for acquiring the usage permissions of the equipment; when the condition is met, generating an authorization certificate; encrypting the authorization certificate and then sending the encrypted authorization certificate to the user such that the user validates the authorization certificate by means of the equipment. The user acquires usage permissions of an equipment by means of requesting a proxy terminal, and the proxy terminal acquires information, such as a delegation certificate and so on, from the owner terminal according to the request by the user, thus avoiding direct information exchange between the user and an owner, and thus the safety of personal information of the owner may be protected, while a permissions acquisition request of the user for the equipment may be satisfied.

Description

Title of Invention: Method and System for Obtaining Device Usage Rights Based on Internet of Things

[0001] The embodiments of the present invention belong to the field of information security of the Internet of Things, and particularly relate to a method and system for acquiring device usage rights of the Internet of Things.

Background technique

[0002] The Internet of Things (IoT) is connected to the Internet. It is predicted to be another technology and economic wave in the global information industry after the Internet. It is valued by governments, enterprises and academia. The United States, the European Union, Japan, etc. even Incorporate national and regional informationization strategies. At present, IoT applications face many problems in the development process. For example, in the Internet of Things, for a city's various facilities and public services, each user in the city can be either a provider or a user, that is, users can use their own personal facilities or other things through the Internet of Things. Resource sharing, such as cars, parking spaces, houses, etc., to help the government manage and utilize urban facilities and personal resources more effectively and rationally, improve management efficiency and service quality in various fields such as transportation, medical care, education, tourism, etc., and promote urban harmony. development of. In such a shared urban IoT environment, IoT devices may be shared and used multiple times, so the right to use shared devices can be passed from the owner to different users (such as friends passed by the owner to the owner or Friends of friends, etc.) There is a lot of information transfer in the transfer of usage rights of various facilities. However, the prior art cannot guarantee the security of this information transfer process, nor can it carry out the privacy information such as the identity of the owner. Effective protection. technical problem

[0003] Embodiments of the present invention provide a method and system for acquiring device usage rights based on the Internet of Things, which are intended to solve the problem that the transfer of various facilities in the prior art Internet of things cannot guarantee the security of the transferred information. The issue of protecting the owner's private information.

Problem solution

Technical solution

[0004] In a first aspect of the embodiments of the present invention, a method for acquiring a device usage right based on an Internet of Things is provided, where the method for acquiring device rights based on the Internet of Things includes:

[0005] receiving a request for the user to use the device, according to the user's request for the device's use permission Taking user information and receiving the delegation certificate sent by the owner;

Decrypting the delegation voucher and verifying validity of the delegation voucher;

[0007] after the delegation certificate is valid, determining whether the request of the user for the use right of the device is consistent with the condition for obtaining the use right of the device;

[0008] generating a authorization credential after the user's request for the use right of the device is consistent with the condition for obtaining the use right of the device;

Encrypting the authorization credential and transmitting the encrypted authorization credential to the user, so that the user verifies the authorization credential through the device.

[0010] A second aspect of the embodiments of the present invention provides a device usage right acquisition system based on the Internet of Things, where the device rights acquisition system based on the Internet of Things includes:

[0011] a proxy credential obtaining unit, configured to receive a user's request for the use right of the device, obtain the user information according to the request of the user for the use right of the device, and receive the proxy credential sent by the main object;

[0012] a delegation certificate verification unit, configured to decrypt the delegation certificate, and verify validity of the delegation certificate;

[0013] a condition judging unit, configured to determine, according to the validity of the entrusted voucher, whether the request of the user for the use right of the device is consistent with the condition for obtaining the use right of the device;

[0014] an authorization credential generating unit, configured to generate an authorization credential after the request of the user for the usage right of the device is consistent with the condition for obtaining the use right of the device;

[0015] an authorization credential encryption unit, configured to encrypt the authorization credential, and send the encrypted authorization credential to the user, so that the user verifies the authorization credential through the device.

[0016] A third aspect of the embodiments of the present invention provides an Internet of Things-based device usage right acquisition system, including a memory, a processor, and a computer program stored in the memory and operable on the processor, The processor executes the computer program to implement the steps of the Internet of Things-based device usage right acquisition method according to any one of the Internet of Things-based device usage rights acquisition methods.

[0017] A fourth aspect of the embodiments of the present invention provides a computer readable storage medium, where the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement an apparatus based on the Internet of Things. The step of using the rights acquisition method of any one of the Internet of Things-based device usage rights acquisition methods.

Advantageous effects of the invention Beneficial effect

[0018] In the embodiment of the present invention, the agent receives the request for the usage right of the device sent by the user, and then obtains the delegation certificate according to the request of the user, and decrypts the obtained delegation certificate to verify the validity thereof. After determining that the received delegation certificate is a valid delegation certificate, the user is judged whether the current user meets the condition for obtaining the usage authority of the requested device. Authorization credentials are generated when the user meets the conditions for obtaining the usage rights of the requested device, and the authorized user obtains the usage rights. In this process, the user obtains the usage right of the device by requesting the agent, and the agent obtains the information such as the delegation certificate from the owner according to the request of the user, thereby avoiding the direct information exchange between the user and the owner, and protecting the individual of the owner. Information security, and can satisfy the user's permission to obtain the device.

Brief description of the drawing

DRAWINGS

1 is a schematic structural diagram of distribution of various devices in an Internet of Things system in the prior art;

2 is a flow chart of a method for acquiring usage rights of a device based on an Internet of Things according to a first embodiment of the present invention;

[0021] FIG. 3 is a specific flowchart of step S22 in FIG. 2 provided by the first embodiment;

[0022] FIG. 4 is a specific flowchart of step S23 in FIG. 2 provided by the first embodiment;

5 is a flow chart of a method for acquiring usage rights of a device based on the Internet of Things according to a second embodiment of the present invention;

6 is a flow chart of a method for acquiring usage rights of a device based on the Internet of Things according to a third embodiment of the present invention;

7 is a structural diagram of a device usage right acquisition system based on the Internet of Things according to a fourth embodiment of the present invention.

8 is a structural diagram of a device usage right acquisition system based on an Internet of Things according to a fifth embodiment of the present invention;

9 is a structural diagram of a device usage right acquisition system based on the Internet of Things according to a sixth embodiment of the present invention. Embodiments of the invention The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0029] In order to explain the technical solutions described in the present invention, the following description will be made by way of specific embodiments.

Embodiment 1

[0031] FIG. 1 is a schematic structural diagram of distribution of various devices in an IoT system in the prior art. As shown in FIG. 1, the Internet of Things as a management platform can be applied in intelligent transportation, construction, medical, environmental protection, public Security, mobile POS, supply chain, agriculture, forestry, water, finance and many other aspects. In terms of public safety, the Internet of Things can receive the security information transmitted by all parties through the management platform, and connect various security devices to the Internet of Things management system through the Internet. When receiving certain security risks to be processed, The networked management system schedules nearby related devices to handle security risks.

[0032] After being applied to various public resources in the city, each user in the city can use the equipment owned by the user as a public resource for the purpose of saving resources and maximizing the use of various devices. In this case, you only need to connect each user's various devices through the network. After other users need to use another user's device, they can use it with the authorization of the owner. This process is both a provider of public resources and a beneficiary of public resources for each user. When the user needs to use a certain master device, the information interaction with the owner is inevitable to obtain the use permission, but the prior art has difficulty in ensuring the security of the personal information of the two parties during the interaction of the information, and For an owner, there are countless users who can request the permission of a certain device. When multiple users interact with each other, the personal information of the owner may be known by multiple users, which is completely unfavorable for the protection of the owner's personal information. .

[0033] FIG. 2 is a flow chart showing a method and system for obtaining usage rights of a device based on the Internet of Things according to the first embodiment of the present invention, which is described in detail as follows:

[0034] Step S21: receiving a request for the user to use the device, and acquiring the user information according to the request of the user for the use right of the device, and receiving the proxy certificate sent by the object owner;

[0035] Specifically, the agent is first set in the Internet of Things system. After the user needs to obtain the usage right of a certain device, the user can send a request to the agent through the smart terminal, and the agent requests the device according to the user. Requesting the delegate permission from the object owner, the agent receives the request from the agent, calls and checks the usage of the owned device, and filters out the devices that are currently in the idle state. Whether the device in the idle state is in the normal usable state, setting the daytime information and location information of the device for normal use; the number of devices that the object owner can use normally, the current location of the device, a specific The information about the external use of the device, the location information that can be used externally, the scope of the authority of the agent, and the conditions that the user must have are integrated into a proxy certificate and sent to the agent mountain.

[0036] For example, a city citizen can use his own umbrella, bicycle, private car or even idle house to access the Internet of Things system through Radio Frequency Identification (RFID), if a user sends a message to the agent. If the main house uses the authority, the agent requests the entrusted voucher from the agent, and the owner uses the external use of the currently idle house. The method is used (if the user can only use it for his own residence, it cannot be used for production or manufacturing. The information may be generated and sent to the agent after the information is integrated.

[0037] Preferably, the agent master encrypts the delegation certificate before sending the delegation certificate to the agent, and sends the encrypted delegation certificate to the agent, and the agent performs the encrypted delegation certificate received. Decrypted to obtain the delegation certificate. The entrusted voucher is encrypted in advance to prevent the entrusted voucher from being tampered with during the transmission process.

[0038] In this step, after the agent requests the delegation document from the agent, the object owner integrates various information of the currently available device to form a delegation certificate, and the agent passes various information contained in the delegation certificate. A request to respond to a user's usage rights to a device. In this process, the agent directly authorizes the user, avoiding the direct information exchange between the user and the owner, and effectively protecting the personal information of the owner. And the delegation certificate sent to the agent at the object owner includes the permission of the device and stipulates the authority of the agent. Therefore, the existing device can be fully utilized and the owner's will is fully respected, and the owner and the user are reached. A win-win effect.

[0039] step S22, decrypting the delegation certificate, and verifying the validity of the delegation certificate;

[0040] In this step, after receiving the encrypted proxy credential, the proxy decrypts the trusted credential, obtains the content of the entrusted credential, and entrusts the information generated by the credential to verify the validity of the trusted credential. .

[0041] As shown in FIG. 3, preferably, the decrypting the delegation certificate and verifying the validity of the delegation document specifically includes: [0042] step S221, decrypting the delegation voucher, and obtaining the generation time and the entrusted content of the entrusted voucher;

[0043] Step S222: determining whether the generation period of the delegation certificate is within a validity period;

[0044] step S223, when the generation period of the delegation document is within the validity period, calling the pre-stored delegation information, matching the delegation content and the delegation information, and finally determining the validity of the delegation document according to the matching result. .

[0045] Specifically, since the proxy credential received by the proxy end is a proxy credential encrypted by the agent terminal through the public key of the proxy end, the proxy end must decrypt the received proxy credential through its own private key. Get the content. The owner encrypts the entrusted voucher and sends it to the agent, which avoids the danger of the credential being falsified during the sending process, and protects the security of the owner and its devices. After the agent decrypts the trusted certificate, the proxy generates the information and the content of the delegation. The commissioned content includes the current location of the device, the time of the external release, the location of the external release, the condition that the user requesting the permission must satisfy, the proxy authority of the agent, and the like.

[0046] wherein the external release includes a device that can be used by a person other than the owner. For example, the external release time of a certain device can be set to 8:00 am on a weekly business day. -12:00, setting the device to the outside world not only can meet the owner's own use needs, but also can be used by others after the owner does not need to use the device to fully utilize the function of the device; The location includes the location where the user other than the owner can use the device. The positioning system can be installed on the device in advance. The device determines its location by its own positioning system. Therefore, the device must be located in the urban area where the owner is located. Or use within a certain range of the owner's urban area. If the device location system finds that the device is outside the preset external release location, it immediately sends an alert to the agent to remind the agent to pay attention to the device to ensure the security of the device. Safeguarding the asset security of the owner; the conditions that the user requesting the usage right must satisfy include the credit rating of the user and the use of the user's request The scope of the authority, etc.; the agent authority of the agent refers to the processing authority of the agent that can be given to the agent of the agent, and the agent can specify the scope of the agent's authority in the delegation certificate, and can also specify the agent. Agent authority can be exercised autonomously according to the actual situation.

[0047] Preferably, the entrusted voucher may further include: personal information of the owner, parameters of the device owned by the owner, and personal information of the owner includes: a unique confirmation voucher of the owner identity, a contact mode of the owner, etc. The parameters of the equipment owned by the owner include: the number of devices, the model of the device, and the brief instructions for using the device Wait.

[0048] In this step, the agent compares the generation time of the delegation voucher obtained after decrypting the delegation voucher with the pre-set validity period to initially determine the validity of the delegation voucher. The validity period may be within ten minutes from the receipt of the user's permission request, or within a half-time, or within one day; the specific setting of the validity period varies according to the device requested by the user, and may be set according to actual conditions. No, there are no restrictions here. Verifying that the received proxy certificate is within the validity period can prevent the owner from receiving the proxy proxy request request, and can not handle it, but after the agent has processed it, the user has made a request. For a long time, the user no longer needs the right to use the device, and the agent gives the right to use it. That is to avoid invalid authorization of the agent to the user. If the generation of the entrusted voucher is within the validity period, the entrusted voucher is initially determined to be a valid entrusted voucher.

[0049] After initially determining that the delegation document is a valid delegation document, invoking pre-stored delegation information, comparing whether the content of the delegation certificate is consistent with the delegation information, the delegation information is an object authenticated by an authoritative certification authority The agent agreement between the master and the agent includes the personal information of the owner of the owner, the agent age of the agent agent of the agent, and the personal information of the person in charge of the agent. After the owner personal information in the delegation document is consistent with the personal information of the owner in the delegation information, the final determination is that the delegation certificate is a valid delegation certificate; and the personal information of the owner in the delegation document is The personal information of the owner in the entrusted information is matched to determine that the owner's identity is truly unique, and the peer also determines that the agent has legal proxy authority to the owner.

[0050] In this step, the agent decrypts the delegation voucher to obtain the generation time of the delegation voucher, and initially determines the validity of the entrusted voucher through the diary of the entrusted voucher, thereby avoiding the invalidity of the agent to the user. Authorization. Then, the personal information of the owner in the decrypted proxy document is matched with the owner personal information stored in advance to determine the identity of the owner and the legitimacy of the agent.

[0051] Step S23: After the trusted credential is valid, determine whether the request of the user for the use right of the device is consistent with the condition for obtaining the use right of the device;

[0052] In this step, after determining that the proxy credential sent by the main object is a valid proxy credential, the personal information of the user who sent the request is invoked, and the user who requests the use permission of the specific device in the entrusted credential must satisfy certain The conditions, therefore, here will be the user's personal information and the use of the vouchers The conditions that the user must have are matched, and the user is given permission to use the user after the condition is met.

[0053] As shown in FIG. 4, the method for determining whether the request for the user to use the device is consistent with the permission to use the device is as follows:

[0054] Step S231: After the trusted credential is valid, obtaining ID information carried by the request for the user to use the device;

[0055] Step S232: Acquire a user credit level corresponding to the ID information.

[0056] Step S233, after the user credit level meets the requirement, determining that the user's request for the device's use right meets the condition for obtaining the use right of the device, otherwise, determining the user's use right for the device. The request does not meet the criteria for obtaining the usage rights of the device.

[0057] Specifically, after determining that the proxy credential sent by the main object is a valid proxy credential, calling the received user to send the user information included in the use permission request of the device, and calling the user's credit rating by using the ID information in the user information. Comparing the user's credit rating with the preset credit rating. Only when the user credit rating is greater than or equal to the preset credit rating, the user is judged to be a legitimate user, and the condition for obtaining the use permission of the device is met. Otherwise, the determination is made. The user does not meet the conditions for obtaining the usage rights of the requested device.

[0058] In this step, the ID information of the user is first verified to determine the legitimacy of the user, and the credit level is verified after the user is a legitimate user, and the user is granted the permission only if the user meets a certain credit rating. A high degree of user credit indicates a good reputation and helps protect the owner's equipment.

[0059] Step S24: Generate an authorization credential after the user's request for the usage right of the device meets the condition for obtaining the use permission of the device.

[0060] In this step, the user is determined to determine whether the user meets the authorized use condition according to the user's request for the right to use the device, and the authorization credential is generated, and the authorization credential is generated only for the user who meets the authorization condition, thereby avoiding unnecessary authorization credential generation. For example, some users send a request for permission to use a public bicycle device. Although the request itself is legal, but the user's condition is determined, and the user is found to be incapable of complying with the authorization requirement due to his own conditions, etc., the authorization certificate is not generated in this case.

[0061] Step S25: Encrypt the authorization credential, and send the encrypted authorization credential to the user, so that the user verifies the authorization credential through the device.

[0062] In this step, the agent encrypts the generated authorization credential, and sends the encrypted authorization credential to the user. . It is guaranteed that the authorization credentials accepted by the user will not be modified. After receiving the complete authorization certificate, the user verifies the decrypted authorization certificate through the device, and the device can be used after the verification is passed.

[0063] In the first embodiment of the present invention, the proxy end receives the encrypted proxy credential sent by the main object according to the user's request for the use right of the device; after decrypting the trusted credential, verifying the validity, and determining Whether the user has obtained the use right of the requested device, and after determining that the user has obtained the use right of the device, generates an authorization credential, encrypts the authorization credential, and sends the authorization credential to the user. In this process, the agent delegates the agent to manage the device that it owns and uses as the public resource. After the agent determines that the user who sent the permission request has the legal right to use the requested device, directly sends the authorization certificate to the The user does not need to involve the identity information of the owner, and avoids the direct information transmission between the user and the owner, thereby protecting the private information of the owner.

Embodiment 2

[0065] FIG. 5 is a flowchart of a method for acquiring a device usage right of an Internet of Things according to a second embodiment of the present invention. As shown in FIG.

[0066] Step S51, receiving authentication information sent by the server, the owner information, and the device in a normal state;

[0067] In this step, the server first reviews the agent, and when the agent meets the preset condition, it determines that it is a legitimate agent; the legal agent only enjoys the agent authority and sends the authentication information. To the legal agent. The server counts various devices in the IoT system in a normal use state and the owner information of the device in a certain range, and integrates the information and sends the information to the agent with the agent authority. The authentication information includes: a credit evaluation of the agent generated by the server according to the investigation result of the agent, an agent time limit of the agent, and the like. In addition, after the user sends the device permission request, the agent may first check whether the agent has the authentication information, or select the agent according to the credit evaluation in the agent's authentication information.

[0068] Step S52: Receive a request for the user to use the device, obtain the user information according to the user's request for the use right of the device, and receive the delegation certificate sent by the object owner;

[0069] step S53, decrypting the delegation certificate, and verifying the validity of the delegation certificate;

[0070] Step S54, after the delegation certificate is valid, determining that the user's request for the device usage right is Whether it meets the conditions for obtaining the usage rights of the device;

[0071] Step S55: Generate an authorization credential after the user's request for the usage right of the device meets the condition for obtaining the usage right of the device.

[0072] Step S56: Encrypt the authorization credential, and send the encrypted authorization credential to the user, so that the user verifies the authorization credential through the device.

[0073] Step S52 to step S56 in the embodiment respectively correspond to step S21 to step S25 in the first embodiment, and details are not described herein again.

[0074] In the second embodiment of the present invention, when receiving a request for the use right of the device sent by the user, first receiving the authentication information sent by the server, and the information of the device that the owner information can be utilized; The obligation to keep personal information confidential, therefore, the agent is first authenticated in this step to determine its legitimacy, which can ensure the security of the owner device and ensure that the personal information of the owner and the user are not randomly leaked.

Example 3

[0076] FIG. 6 is a flowchart of a method for acquiring usage rights of a device based on the Internet of Things according to a third embodiment of the present invention; as shown in FIG.

[0077] Step S61, receiving authentication information sent by the server, the owner information, and the device in a normal state;

[0078] Step S62: Receiving a request for the user to use the device, and acquiring the user information according to the request of the user for the use right of the device, and receiving the proxy certificate sent by the object owner;

[0079] step S63, decrypting the delegation certificate, and verifying the validity of the delegation certificate;

[0080] Step S64: After the trusted credential is valid, determine whether the request of the user for the use right of the device is consistent with the condition for obtaining the use right of the device;

[0081] Step S65: Generate an authorization credential after the user's request for the usage right of the device meets the condition for obtaining the usage right of the device.

[0082] Step S66: Encrypt the authorization credential, and send the encrypted authorization credential to the user, so that the user verifies the authorization credential through the device.

[0083] Step S61 to step S66 in the embodiment respectively correspond to step S51 to step S56 in the second embodiment, and details are not described herein again. [0084] Step S67: Receive a verification result of the authorization credential by the device, and send the verification result to the object owner.

[0085] In this step, after receiving the authorization credential sent by the proxy, the user decrypts the encrypted authorization credential with its own private key to obtain the use permission, and the user sends the information contained in the authorization credential to the device. The device verifies the received information, and the verification authority passes the user permission, and sends the verification result to the agent for recording and archiving, and sends the verification result to the owner to make the object The master knows how his device is being used.

[0086] In the third embodiment of the present invention, after the user obtains the authorization credential of the requested device, the device verifies the information contained in the authorization credential, and if the verification succeeds, the user is used to release the use authority, and the verification result is sent to the agent, the proxy. After the end record, the verification result is sent to the owner. In this process, the direct communication between the user and the owner is avoided, and the personal information of the owner is protected from being leaked and the personal security of the user is ensured.

Example 4

[0088] Corresponding to the Internet of Things-based device usage right acquisition, FIG. 7 is a structural diagram of an Internet of Things-based device usage right acquisition system according to a fourth embodiment of the present invention, which is based on the Internet of Things. The device usage right acquisition system can be applied to various mobile terminals. For the convenience of description, only parts related to the embodiment of the present invention are shown.

[0089] As shown in FIG. 7, the Internet of Things-based device usage right acquisition system includes: a delegation certificate obtaining unit 71, a delegation certificate verification unit 72, a condition determination unit 73, an authorization voucher generation unit 74, and an authorization voucher encryption unit 75. , among them:

[0090] The proxy credential obtaining unit 71 is configured to receive a request for the user to use the device, and obtain the user information according to the request of the user for the use right of the device, and receive the proxy credential sent by the main object;

[0091] a delegation voucher verification unit 72, configured to decrypt the delegation voucher, and verify the validity of the delegation voucher

[0092] Preferably, the delegation certificate verification unit specifically includes:

[0093] a decryption module, configured to decrypt the delegation certificate, and obtain a generation time and a delegation content of the delegation certificate

[0094] a preliminary determining module, configured to determine whether the generation period of the delegation certificate is within a validity period;

[0095] a matching module, configured to: when the generation of the delegation certificate is within a valid period, calling the pre-stored The information is matched with the delegation content and the delegation information, and the validity of the delegation certificate is finally determined according to the matching result.

[0096] The condition judging unit 73 is configured to determine, when the entrusted credential is valid, whether the request of the user for using the device is consistent with the condition for obtaining the use right of the device;

[0097] Preferably, the condition determining unit 73 specifically includes:

[0098] an ID obtaining module, configured to acquire ID information carried by the request for the user to use the device when the trusted credential is valid;

[0099] a credit rating obtaining module, configured to acquire a user credit rating corresponding to the ID information;

[0100] a condition judging module, configured to determine that the user's request for the use right of the device meets the condition for obtaining the use right of the device after the user credit level meets the requirement, otherwise, determining that the user is to the device The request to use the permission does not meet the conditions for obtaining the usage rights of the device.

[0101] an authorization credential generating unit 74, configured to generate an authorization credential after the request of the user for the use right of the device is consistent with the condition for obtaining the use right of the device;

[0102] The authorization credential encryption unit 75 is configured to encrypt the authorization credential and send the encrypted authorization credential to the user, so that the user verifies the authorization credential through the device.

[0103] In the fourth embodiment of the present invention, the proxy end receives the encrypted proxy credential sent by the main object according to the user's request for the use right of the device; after decrypting the trusted credential, verifying the validity, and determining Whether the user has obtained the use right of the requested device, and after determining that the user has obtained the use right of the device, generates an authorization credential, encrypts the authorization credential, and sends the authorization credential to the user. In this process, the agent delegates the agent to manage the device that it owns and uses as the public resource. After the agent determines that the user who sent the permission request has the legal right to use the requested device, directly sends the authorization certificate to the The user does not need to involve the identity information of the owner, and avoids the direct information transmission between the user and the owner, thereby protecting the private information of the owner.

Embodiment 5:

8 is a structural diagram of a device usage right acquisition system based on the Internet of Things according to the fifth embodiment of the present invention; as shown in FIG. 8, the device usage rights acquisition system based on the Internet of Things includes:

[0106] The information receiving unit 81 is configured to receive the authentication information, the owner information, and the device information in a normal state sent by the server. [0107] Specifically, the server first checks and determines the agent, and when the agent meets the preset condition, it determines that it is a legitimate agent; the legal agent only enjoys the agent right, and sends the authentication information to Legal agent. The server counts various devices in the IoT system in a normal use state within a certain range, and the owner information of the device, and integrates the information and sends the information to the agent with the agent authority. The authentication information includes: a credit evaluation of the agent generated by the server according to the investigation result of the agent, an agent time limit of the agent, and the like. In addition, after the user sends the device permission request, the agent may first check whether the agent has the authentication information, or select the agent according to the credit evaluation in the agent's authentication information.

[0108] The proxy credential obtaining unit 82 is configured to receive a request for the user to use the device, and obtain the user information according to the request of the user for the use right of the device, and receive the proxy credential sent by the main object;

[0109] a delegation credential verification unit 83, configured to decrypt the delegation voucher, and verify the validity of the delegation voucher

[0110] The condition determining unit 84 is configured to determine, when the trusted credential is valid, whether the request of the user for using the device is consistent with the condition for obtaining the use right of the device;

[0111] an authorization credential generating unit 85, configured to generate an authorization credential after the request of the user for the use right of the device is consistent with the condition for obtaining the use right of the device;

[0112] The authorization credential encryption unit 86 is configured to encrypt the authorization credential, and send the encrypted authorization credential to the user, so that the user verifies the authorization credential through the device.

[0113] In this embodiment, the delegation credential obtaining unit 82, the delegation credential verification unit 83, the condition judging unit 84, the authorization credential generating unit 85, the authorization credential encryption unit 86, and the entrusted credential obtaining unit 71 and the delegation credential verification unit in the fourth embodiment 72. The condition judging unit 73, the authorization credential generating unit 74, and the authorization credential encrypting unit 75 respectively correspond to each other, and details are not described herein again.

[0114] In the fifth embodiment of the present invention, when receiving a request for the use right of the device sent by the user, first receiving the authentication information sent by the server, and the information of the device that the owner information can be utilized; The obligation to keep personal information confidential, therefore, the agent is first authenticated in this step to determine its legitimacy, which can ensure the security of the owner device and ensure that the personal information of the owner and the user are not randomly leaked.

Embodiment 6: [0116] FIG. 9 is a diagram showing a result of an Internet of Things-based device usage right acquisition system according to a sixth embodiment of the present invention. As shown in FIG. 9, the Internet of Things-based device usage right acquisition system includes:

[0117] The information receiving unit 91 is configured to receive the authentication information, the owner information, and the device information in a normal state sent by the server.

[0118] The proxy credential obtaining unit 92 is configured to receive a request for the user to use the device, and obtain the user information according to the user's request for the use right of the device, and receive the proxy credential sent by the main object;

[0119] a delegation voucher verification unit 93, configured to decrypt the delegation voucher, and verify the validity of the delegation voucher

[0120] The condition determining unit 94 is configured to determine, when the trusted credential is valid, whether the request of the user for using the device is consistent with the condition for obtaining the use right of the device;

[0121] an authorization credential generating unit 95, configured to generate an authorization credential after the request for the user's use right of the device is consistent with the condition for obtaining the use right of the device;

[0122] The authorization credential encryption unit 96 is configured to encrypt the authorization credential and send the encrypted authorization credential to the user, so that the user verifies the authorization credential through the device.

[0123] The information receiving unit 91, the delegation credential obtaining unit 92, the delegation credential verification unit 93, the condition judging unit 84, the authorization credential generating unit 95, the authorization credential encrypting unit 96, and the information receiving unit 81 in the fourth embodiment, The delegation voucher obtaining unit 82, the delegation voucher verification unit 83, the condition judging unit 84, the authorization voucher generation unit 85, and the authorization voucher encryption unit 86 respectively correspond to each other, and will not be described again.

[0124] The verification result receiving unit 97 is configured to receive a verification result of the authorization credential by the device, and send the verification result to the object owner.

[0125] In the sixth embodiment of the present invention, after the user obtains the authorization credential of the requested device, the device verifies the information contained in the authorization credential, and if the verification succeeds, the user is used to release the use permission, and the verification result is sent to the agent, the proxy. After the end record, the verification result is sent to the owner. In this process, the direct communication between the user and the owner is avoided, and the personal information of the owner is protected from being leaked and the personal security of the user is ensured.

It should be understood that, in the embodiment of the present invention, the size of the sequence numbers of the foregoing processes does not mean the order of execution sequence, and the execution order of each process should be determined by its function and internal logic, and should not be taken to the embodiment of the present invention. The implementation process constitutes any limitation.

[0127] Those of ordinary skill in the art will recognize the various examples described in connection with the embodiments disclosed herein. The unit and algorithm steps can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

For a specific working process of the system, the device and the unit described above, reference may be made to the corresponding process in the foregoing method embodiments, and details are not described herein again.

[0129] In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division, and the actual implementation may have another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.

[0130] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0131] The functions, if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: u disk

, mobile hard disk, read-only memory (ROM, Read-Only

Memory, random access memory (RAM), disk or optical disk, and other media that can store program code.

The above description is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Claim

[Claim 1] A method for acquiring a device usage right of an Internet of Things, wherein the method for acquiring device rights based on an Internet of Things includes:

Receiving a request for the user to use the device, obtaining the user information according to the request of the user for using the device, and receiving the delegation certificate sent by the object owner;

Decrypting the delegation voucher and verifying the validity of the delegation voucher;

After the entrusted voucher is valid, determining whether the request of the user for the use right of the device is consistent with the condition for obtaining the use permission of the device;

Generating an authorization credential after the user's request for the usage right of the device conforms to the condition for obtaining the usage right of the device;

Encrypting the authorization credential and transmitting the encrypted authorization credential to the user to enable the user to authenticate the authorization credential through the device.

[Claim 2] The IoT-based device usage right acquisition method according to claim 1, wherein the decrypting the delegation certificate and verifying the validity of the delegation document specifically includes:

Decrypting the delegation voucher to obtain the generation time and the entrusted content of the entrusted voucher; determining whether the generation of the entrusted voucher is within the validity period; and when the generation of the entrusted voucher is within the validity period, calling the pre-storage The delegation information matches the delegation content and the delegation information, and finally determines the validity of the delegation certificate according to the matching result.

[Claim 3] The Internet of Things-based device usage right acquisition method according to claim 2, wherein, when the delegation certificate is valid, determining whether the user's request for the device's usage authority meets the acquisition The condition for the use permission of the device specifically includes: obtaining ID information carried by the request for the user to use the device when the trusted certificate is valid;

Obtaining a user credit rating corresponding to the ID information;

After the user credit rating meets the requirements, determining that the user's request for the device's usage rights meets the conditions for obtaining the device's usage rights; otherwise, determining that the user is The request for the usage permission does not meet the conditions for obtaining the usage rights of the device.

[Claim 4] The Internet of Things-based device usage right acquisition method according to claim 1, wherein the request for receiving the user's usage right to the device is based on the user's request for the device's usage authority Before obtaining the user information and receiving the delegation certificate sent by the owner, includes:

Receive authentication information, owner information, and device information in a normal state.

[Claim 5] The Internet of things-based device usage authority acquisition method according to any one of claims 1-4

And after the encrypting the authorization credential and sending the encrypted authorization credential to the user, so that the user verifies the authorization credential by using the device, the method includes:

Receiving a verification result of the authorization credential by the device, and transmitting the verification result to the object master.

[Claim 6] A device usage right acquisition system based on the Internet of Things, wherein the Internet of Things-based device authority acquisition system comprises:

The proxy credential obtaining unit is configured to receive a request for the user to use the device, obtain the user information according to the request of the user for the use right of the device, and receive the entrusted voucher sent by the main object;

a delegation certificate verification unit, configured to decrypt the delegation certificate, and verify validity of the delegation certificate;

a condition judging unit, configured to determine, according to the validity of the entrusted credential, whether the request of the user for the use right of the device is consistent with the condition for obtaining the use right of the device; the authorization credential generating unit, configured to be in the user-to-device The request for the use right meets the condition for obtaining the use right of the device, generating an authorization credential; the authorization credential encryption unit, configured to encrypt the authorization credential, and send the encrypted authorization credential to the user, so that the The user authenticates the authorization credential through the device

[Claim 7] The Internet of Things-based device usage right acquisition system according to claim 6, characterized in that The trusted certificate verification unit specifically includes:

a decryption module, configured to decrypt the delegation certificate, to obtain a generation time and a delegation content of the delegation certificate;

a preliminary determining module, configured to determine whether the generation period of the delegation document is within a validity period; and a matching module, configured to: when the generation period of the delegation certificate is within a valid period, call pre-stored delegation information, and match the commission The content and the delegation information finally determine the validity of the delegation document based on the matching result.

The Internet of Things-based device usage right acquisition system according to claim 7, wherein the condition determining unit specifically includes:

An ID obtaining module, configured to obtain ID information carried by the request for the user to use the device when the trusted credential is valid;

a credit rating obtaining module, configured to acquire a user credit rating corresponding to the ID information; a condition determining module, configured to determine, according to the user credit rating that the user has a request for the device to use the device The condition of the use permission of the device, otherwise, the request for determining the user's use right of the device does not meet the condition for obtaining the use right of the device.

An Internet of things-based device usage rights acquisition system includes a memory, a processor, and a computer program stored in the memory and operable on the processor, wherein the processor executes the computer program The step of implementing the Internet of Things-based device usage right acquisition method according to any one of claims 1 to 5.

A computer readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the Internet of Things-based device according to any one of claims 1 to 5. Use the steps to get the method.