WO2021046782A1

WO2021046782A1 - Access control method, device, and storage medium

Info

Publication number: WO2021046782A1
Application number: PCT/CN2019/105474
Authority: WO
Inventors: 杨宁
Original assignee: Oppo广东移动通信有限公司
Priority date: 2019-09-11
Filing date: 2019-09-11
Publication date: 2021-03-18
Also published as: CN113728600B; CN113728600A

Abstract

An access control method, comprising: a terminal device (1100) determining the role of an access device (1200) of a secure domain in which the terminal device (1100) is located; and when at least one access control role in an access control list of the terminal device (1100) comprises the role of the access device (1200), the terminal device (1100) allowing the access device (1200) to configure a secure resource in the terminal device (1100), the access control role being a role that is allowed to configure the secure resource. Further provided are another access control method, an electronic device (1400), and a storage medium.

Description

Access control method, equipment and storage medium

Technical field

The present invention relates to the Internet of Things technology, and in particular to an access control method, equipment and storage medium. The equipment involved in the present invention includes at least one of the following: terminal equipment, access equipment and activation equipment.

Background technique

In related technologies, the terminal device can only be configured by one activation tool (Onboarding Tool, OBT), that is, there can only be one device owner, and the security resources such as device configuration resources and certificates in the terminal device can only have one resource. The resource owner. Since only the resource owner has the authority to configure the corresponding security resources, after a terminal device is configured in a security domain, when it enters another security domain again, it needs to reconfigure the terminal device to communicate with devices in other security domains. In other security domains. In this way, when the terminal device moves in different security domains, it needs to be reconfigured each time.

Summary of the invention

The embodiments of the present invention provide an access control method, equipment, and storage medium, which can avoid repetition of the tedious resource owner's security resource configuration process, and break the access isolation of terminal equipment in different security domains.

The technical solution of the embodiment of the present invention is realized as follows:

In the first aspect, an embodiment of the present invention provides an access control method, including:

The terminal device determines the role of the access device in the security domain in which it is located;

In the case that at least one access control role of the access control list of the terminal device includes the role of the access device, the terminal device allows the access device to configure the security resources in the terminal device, and The access control role is a role that is allowed to configure the security resource.

In the second aspect, an embodiment of the present invention provides an access control method, including:

The access device sends the role of the access device to the terminal device in the security domain; when the role of the access device is included in at least one access control role in the access control list of the terminal device, the terminal The device allows the access device to configure the security resource in the terminal device, and the access control role is a role that is allowed to configure the security resource.

In a third aspect, an embodiment of the present invention provides an access control method, including:

The activation device configures an access control list for the terminal device, where the access control list is used in at least one access control role of the access control list including the role of the access device, and the terminal device allows the access device to access the terminal device. The security resource is configured, and the access control role is a role that is allowed to configure the security resource.

In a fourth aspect, an embodiment of the present invention provides a terminal device, including:

The role determination module is configured to determine the role of the access device in the security domain;

An authority management module configured to allow the access device to configure the security resources in the terminal device when at least one access control role in the access control list of the terminal device includes the role of the access device, The access control role is a role that is allowed to configure the security resource.

In a fifth aspect, an embodiment of the present invention provides an access device, including:

The sending module is configured to send the role of the access device to the terminal device in the security domain; when the role of the access device is included in at least one access control role in the access control list of the terminal device, The terminal device allows the access device to configure the security resource in the terminal device, and the access control role is a role that is allowed to configure the security resource.

In a sixth aspect, an embodiment of the present invention provides an activation device, and the method includes:

The list configuration module is configured to configure an access control list to a terminal device, where the access control list is used in at least one access control role of the access control list including the role of the access device, and the terminal device allows the access device to The security resource in the terminal device is configured, and the access control role is a role that is allowed to configure the security resource.

In a seventh aspect, an embodiment of the present invention provides a terminal device, including a processor and a memory for storing a computer program that can run on the processor, wherein the processor is used to execute the above-mentioned terminal when the computer program is running. Steps of the access control method executed by the device.

In an eighth aspect, an embodiment of the present invention provides an access device, including a processor and a memory for storing a computer program that can run on the processor, wherein the processor is configured to execute the above-mentioned access when the computer program is running. Steps of the access control method executed by the device.

In a ninth aspect, an embodiment of the present invention provides an activation device, including a processor and a memory for storing a computer program that can run on the processor, wherein the processor is used to execute the above activation when the computer program is running. Steps of the access control method executed by the device.

In a tenth aspect, an embodiment of the present invention provides a storage medium that stores an executable program, and when the executable program is executed by a processor, the above-mentioned access control method executed by the terminal device is implemented.

In an eleventh aspect, an embodiment of the present invention provides a storage medium that stores an executable program, and when the executable program is executed by a processor, the access control method executed by the above-mentioned access device is implemented.

In a twelfth aspect, an embodiment of the present invention provides a storage medium that stores an executable program, and when the executable program is executed by a processor, the above-mentioned access control method executed by the activation device is implemented.

The access control method provided by the embodiment of the present invention includes: the terminal device determines the role of the access device in the security domain where it is located; the situation where the role of the access device is included in at least one access control role in the access control list of the terminal device Next, the terminal device allows the access device to configure the secure resources in the terminal device. Since the access control list is set in the terminal device, when the role of the access device is included in at least one role in the access control list that is allowed to configure security resources, it can be considered that the access device has configuration authority to the security resources in the terminal device. The access device is allowed to configure the security resources in the terminal device, so that access devices in different security domains can configure the security resources in the terminal device based on the access control list, which can avoid repeating the tedious configuration process of the resource owner and break the terminal device Access isolation of different security domains.

Description of the drawings

FIG. 1 is a schematic diagram of an optional process for providing role declaration according to an embodiment of the present invention;

2 is a schematic diagram of an optional flow chart of device configuration provided by an embodiment of the present invention;

FIG. 3 is an optional structural diagram of the Internet of Things system provided by an embodiment of the present invention;

FIG. 4 is an optional structural diagram of the Internet of Things system provided by an embodiment of the present invention;

FIG. 5 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 6 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 7 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 8 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 9 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 10 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 11 is a schematic diagram of an optional structure of a terminal device provided by an embodiment of the present invention;

FIG. 12 is a schematic diagram of an optional structure of an access device provided by an embodiment of the present invention;

FIG. 13 is a schematic diagram of an optional structure of an activation device provided by an embodiment of the present invention;

FIG. 14 is a schematic diagram of an optional structure of an electronic device provided by an embodiment of the present invention.

detailed description

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present invention. Those of ordinary skill in the art have not made All other embodiments obtained under the premise of creative work belong to the protection scope of the present invention.

Before describing in detail the access control method provided by the embodiments of the present invention, a brief description of the resources, role declarations, and terminal device configuration of the Internet of Things system will be given first.

In the Internet of Things, resources can be used to express the physical devices of the Internet of Things, as well as information such as the functional services provided by the physical devices of the Internet of Things and the status of the devices. The device that provides the resource is the server, and the device that accesses the resource is the client. The client and server are logical functional entities, and each IoT device can be a client, a server, or both a client and a server. For example, a device (such as a light bulb) that implements a certain basic function can only be used as a server, and it can be provided to the client for query and control. It does not have the need to control or query other devices.

After the client uses the certificate to authenticate the server, it can declare one or more roles by using the role certificate to update the server role resource. The role credential must be a certificate credential and should include the certificate chain. The server will verify each certificate chain. In addition, the public key used for end-entity authentication must be the same as the public key in all role certificates. In addition, the end entity authentication and the distinguished name of the subject in the role certificate must match. The declared role is encoded in the subjectAltName extension of the role certificate. The subjectAltName field can have multiple values, allowing a single role certificate to encode multiple roles applicable to the client. Among them, different roles can be distinguished by different role identifiers, such as: owner, family, guest, etc. Different roles can have different access rights, such as: owner can access terminal equipment With complete control, family members can fully control some of the resources in the terminal, and guests can only access some of the resources in the terminal.

Figure 1 shows the interaction process of the client-side role declaration to the server-side, including:

In step S101, the client sends an update (UPDATE) request to the server.

The UPDATE request is sent from the client to the server to partially or completely update the role resources on the server. Here, the Uniform Resource Identifier (URI) is used to identify the name of the resource. The URI can be indicated by the Uniform Resource Location (URL). For example, the URI of the role resource is oic, and the URL is / oic/sec/roles. Each resource contains attributes, which are used to describe the status information of the resource, and the attributes appear in the form of "<key>=<value>" key-value pairs.

The client uses an UPDATE request to write the role information related to the role certificate into the role resource of the device.

For example, an example of the resource expression requested by UPDATE is:

/oic/sec/roles

[{"credid":"...","sub":"...","credtype":8,

"pbdata":"DER-encoded role and CA certificate chain in base64",

"roleid":{"authority":"OptionalAuthorityIdentifier","role":"16-byte octet string"},

"ownrs":"..."

}]

Here, the role of the client is declared in the above resource expression.

The resource representation is a snapshot of the attribute. The interaction with resources is realized by exchanging requests and responses that contain resource expressions. For example, a read request is made to a resource, the resource expression can be obtained by responding, and the resource can be updated by updating the resource expression.

In step S102, the server updates the role resources.

After the server receives the UPDATE request, the server verifies whether the client sending the request has the authority to update the role resource. Yes, the client will update the role resource information according to the parameters in the UPDATE request.

Step S103, the server returns an UPDATE response to the client.

The terminal device needs to be activated before it can interact with other terminal devices in the security domain. The first step in activating a terminal device is to configure the ownership of the terminal device. Legitimate users use an Owner Transfer Method (OTM) through OBT to establish ownership of terminal equipment. After the ownership is established, use OBT to configure the terminal device, and finally enable the terminal device to operate normally and interact with other terminal devices.

Figure 2 is a schematic diagram of the interactive process of terminal device configuration, as shown in Figure 2, including:

Step S201: The OBT discovers terminal devices that need to be configured in the security domain.

Here, the discovered device is a new terminal device that needs to be configured without an owner.

Step S202: The terminal device returns the owner transfer method it supports to the OBT.

Among them, step S201 and step S202 are for OBT to discover new equipment and find a suitable owner transfer method.

Step S203: The OBT establishes a secure connection with the terminal device according to the owner transfer method supported by the terminal device.

Among them, step S203 is used to execute the owner's transfer method.

Step S204: The OBT configures its own ID in the owner resource of the terminal device.

Here, the URL of the owner resource may be /oic/sec/doxm, and the ID of the OBT may be configured to the device owner identifier (device owneruuid) attribute of the owner resource of the terminal device.

Step S204 is used to establish the owner identity of the terminal equipment

Step S205: The OBT requests the owner credential type supported by the terminal device.

The type of owner's certificate supported by the terminal device may include: symmetric key, asymmetric key, certificate, etc.

Step S206, OBT selects a suitable owner certificate.

OBT selects a suitable security certificate according to the type of owner certificate supported by the terminal device

Step S207: OBT configures the owner's credential.

OBT configures the selected owner's credential to the credential resource of the terminal device. The URL of the credential resource of the terminal device can be /oic/sec/cred.

Steps S205 to S207 are used to determine whether the terminal device uses symmetric and/or asymmetric credentials used by the device owner.

Step S208: OBT allocates the terminal device to the credential management server.

Credential Management Service (CMS) can usually be used as a part of OBT. Considering scalability and modular design, CMS can also be deployed separately as a service.

Step S208 is used to add new terminal device information for device management related services.

Step S209: OBT configures its own ID to the owner resource of the terminal device.

OBT configures OBT as the owner of the owner's resources. Here, OBT can configure its own ID to the owner identification (rowneruuid) attribute of /oic/sec/doxm of the terminal device.

Step S2010: The OBT configures the ID of the CMS to the credential resource of the terminal device.

OBT sets CMS as the owner of the credential resource. OBT configures the ID of the CMS to the rowneruuid attribute of /oic/sec/cred.

In step S2011, the OBT configures the CMS credential used to establish a secure connection with the CMS to the credential resource of the terminal device.

Steps S209 to S2011 are used to define terminal devices and representative management services, such as CMS credentials and device owners.

Step S2012, OBT/CMS changes the state of the terminal device to the service configuration state.

Step S2013OBT/CMS configures the credential used to establish a secure LAN connection with other devices to the credential resource of the terminal device.

Among them, in step S2012 and step S2013, the new device is configured using the peer-to-peer credential and the access control policy.

Step S2014, OBT/CMS changes the state of the terminal device to a normal working state.

Step S2014 enables the terminal device to work normally.

In the above process, the owner credential configured in step S207 is the credential for the interconnection of OBT and the terminal device, the CMS credential configured in step S2011 is the credential for the interconnection of the CMS and the terminal device, and the credential configured in step S2013 is end-to-end (P2P) The credential is the credential for the terminal device to interconnect with other terminal devices in the security domain in the security domain.

In an example, the structure of the owner's resources can be:

In an example, the structure of the credential resource can be:

Here, OBT means that the activation device is the master of the security domain, and the client and server in the security domain can be configured to communicate with each other. The owners of different security domains are different OBTs. After the client or server in the security domain is configured, the OBT is the owner of the configured terminal device. Among them, among multiple devices configured by the same OBT in a network, the two devices can be interconnected, and it is considered that these devices form a security domain. Among them, for example, in a home network environment, all devices are configured by the male owner’s mobile phone APP (as OBT), so that the client and server in the home can form a secure domain for establishing a secure communication connection; the neighbor’s network The device in China Interconnection is configured by the neighbor's mobile phone APP (another OBT), which forms another security domain that is different from the security domain of the family.

The configuration information of different security domains is independent of each other, and the configuration information of one security domain cannot be used in other security domains. Therefore, access between devices in different security domains is isolated from each other. For example, after the terminal device is configured to the security domain A, the configuration information in the terminal device is the configuration information of the security domain A; when the terminal device enters the security domain B, it passes the configuration information in the security domain A and the device in the security domain B. There is no interconnection and intercommunication between the two; if the terminal device wants to interconnect and interwork with the device in the security domain B, it needs to be re-configured to configure the terminal device in the security domain B.

For example, Figure 3 is the establishment of a security domain in a home environment:

A client APP is installed in the activation device 301, and the activation device 301 creates terminal devices in a secure domain (such as a home network) and various roles such as the administrator (admin), family member (family), and guest (guest) of each terminal device . That is, the activation device 301 is the OBT of the home network. The activation device 301 discovers and configures light bulb 1, and can control light bulb 1.

A client APP is installed in the terminal device 302, and the client APP of the activated device 301 discovers the client APP of the terminal device 302, configures the APP of the terminal device 302, and grants the APP family permission of the terminal device 302, then The terminal device 302 can also control the bulb 1. The activation device 301 can also give the terminal device 302 administrator (admin) authority, and the terminal device 302 can also configure and manage the bulb 1.

For an IoT device, such as light bulb 2, it is configured in the same way as light bulb 1.

For a new terminal device with a client APP, its roles and permissions are configured in the same way as the terminal device 302.

In the above solution, the terminal device can only be configured by one OBT, that is, there can only be one device owner, and only one resource owner can be used for security resources such as owner resources and credential resources. Since only the resource owner has the authority to configure the corresponding security resources, when a terminal device enters a security domain other than the security domain corresponding to the current device owner, the owner of the other security domain cannot configure the security resources of the terminal device, resulting in the current device It cannot communicate with devices in other security domains. For example: after the client APP of the terminal device 302 in Figure 3 is configured by the activated device 301, when the terminal device 302 enters the office, since the owner of the security domain in the office network is the Client APP (OBT) of the activated device Boss, the device is activated The Boss cannot configure the Client APP of the terminal device 302 to enable the terminal device 302 to communicate with the terminal devices in the security domain of the office.

Even if the configuration information in the terminal device is reset so that the terminal device can interconnect with terminal devices in other security domains, when the terminal device enters the current security domain again, the terminal device cannot control the devices in the current security domain .

Take the terminal device 302 shown in FIG. 3 as an example, even if the client APP of the terminal device 302 is reset, the activated device Boss can configure the client APP of the terminal device 302 to realize the terminal device 302 and the devices in the office network If the terminal device 302 enters the home security domain again, it cannot control the devices in the home security domain again and needs to be reconfigured by the activation device 301. In this way, when the terminal device moves in different security domains, it needs to be reconfigured each time, and the user experience is not good.

Based on the above-mentioned problems, the present invention provides an access control method. The access control entry method of the embodiment of the present invention can be applied to the Internet of Things system 400 shown in FIG. 4, including: activation device 401, credential management server 402, and terminal device 403- 1. Activation device 404, credential management server 405, and terminal device 403-2.

The activation device 401 and the credential management server 402 belong to the same security domain: security domain 1, and the activation device 404 and the credential management server 405 belong to the same security domain: security domain 2. The activation device 401 is the OBT of the security domain 1, that is, the owner, and the credential management server 402 manages and configures the credential of the device in the security domain 1. The activation device 404 is the OBT of the network 2, that is, the owner, and the credential management server 405 manages and configures the credential of each device in the secure domain 2.

When the terminal device 403-1 or the terminal device 403-2 enters the network where the security domain 1 is located, the activation device 401 configures the terminal device 403-1 or the terminal device 403-2 so that the terminal device 403-1 or the terminal device 403-2 Enter security zone 1. As shown in FIG. 4, when the terminal device 403-2 and the terminal device 403-1 enter the security domain 1 at the same time, the terminal device 403-2 and the terminal device 403-1 can communicate with each other.

The activation device 401, terminal device 403-1, and terminal device 403-2 may refer to access terminals, user equipment (UE), user units, user stations, mobile stations, mobile stations, remote stations, remote terminals, and mobile devices. , User terminal, terminal, wireless communication equipment, user agent or user device. The access terminal can be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a wireless local loop (Wireless Local Loop, WLL) station, a personal digital processing (Personal Digital Assistant, PDA), with wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in 5G networks, or devices in the future evolution of PLMN, etc.

Figure 4 exemplarily shows two security domains and two terminal devices. Optionally, the Internet of Things system 300 may include more than two security domains and more than two terminal devices. There is no restriction, and there is no restriction on the number of terminal devices in a security domain.

Here, the security domain 1 and the security domain 2 may belong to the same network, or may belong to different networks.

The Internet of Things shown in Figure 4 may also include Internet of Things devices such as sensors, laser scanning systems, and smart home appliances.

An optional processing flow of the access control method provided by the embodiment of the present invention, as shown in FIG. 5, includes the following steps:

Step S501: The terminal device determines the role of the access device in the security domain where it is located.

Optionally, the security domain where the terminal device is located is an already entered security domain. Optionally, the security domain in which the terminal device is located is a security domain that has not entered but is to be entered.

Taking the security domain where the terminal device is located is an already entered security domain as an example, the active device corresponding to the current security domain has configured the terminal device, and the terminal device can communicate with other terminal devices in the current security domain.

Taking the security domain in which the terminal device is located is the security domain to be entered as an example, the active device corresponding to the current security domain has not configured the terminal device, and the terminal device cannot communicate with other terminal devices in the current security domain.

The access device is a device in the security domain where the terminal device is located that requests to configure the security resources in the terminal device, and may be at least one of the following devices in the security domain where the terminal device is located: activation device, CMS, and other terminal devices.

In the embodiment of the present invention, before step S501, as shown in FIG. 5, step S500 is included. The access device sends the role of the access device to the terminal device. At this time, the terminal device receives the role of the access device sent by the access device.

Optionally, the roles of access devices in different security domains are the same. Optionally, the roles of access devices in different security domains are different.

Optionally, the access device sends a role certificate to the terminal device in the security domain where it is located, and the public field of the role certificate includes the role of the access device. At this time, step S501 that the terminal device determines the role of the access device in the security domain includes: the terminal device determines the role of the access device from the public field in the role certificate sent by the access device in the security domain.

In the embodiment of the present invention, the role of the access device can be characterized by a role identifier. Optionally, the roles of different access devices are the same. For example, the roles of access device 1 and access device 2 are both owner. Optionally, different access devices have different roles. For example, the role of access device 1 is owner1, and the role of access device 2 is owner2.

Step S502: In the case that the access control role of the access control list of the terminal device includes the role of the access device, the terminal device allows the access device to configure the security resources in the terminal device.

After determining the role of the access device, the terminal device queries whether the role of the access device is included in at least one access control role of the access control list (ACL) in the terminal device. If it is included, the access device is allowed to configure the secure resource in the terminal device. If it is not included, the access device is not allowed to configure the secure resource in the terminal device. Wherein, the access control role is a role that is allowed to configure the security resource

In the embodiment of the present invention, the roles in different role certificates may be the same, and the public field of the role certificate indicates the role of the role certificate.

In the embodiment of the present invention, the terminal device includes at least one access control list, and one access control list includes one or more access control roles. Wherein, an access control list may include one or more access control items, one access control item corresponds to one access control role, and different access control items correspond to different or the same access control role.

In an example, the terminal device includes three access control lists: List 1, List 2, and List 3. The access control role in List 1 is role 1, and the access control role in List 2 is role 2 and role 3. List The access control role in 3 is role 4. When the role of the access device is role 2, the access device is allowed to configure the security resources in the terminal device. When the role of the access device is role 5, the access device to the terminal is not allowed The security resources in the device are configured.

Optionally, the security resources in the terminal equipment include: owner resources (/oic/sec/doxm), credential resources (/oic/sec/cred), status resources (/oic/sec/pstat) and other terminal equipment One or more resources among the resources related to the initial configuration. Among them, the owner resource is the resource related to the equipment owner, the credential resource is the resource related to the security credential, and the state resource is the resource related to the configuration state.

Optionally, the access device configures the secure resource to perform operations such as adding, modifying, and deleting information in the secure resource.

Taking the access device as the credential management server and the credential management server adding the credential resource as an example, the credential resource of the terminal device includes: credential 1 for establishing a connection between the terminal device and a refrigerator, and credential 2 for establishing a connection between the terminal device and a TV. When the terminal device allows the credential management server to configure the credential resource in the terminal device, the credential management server adds the credential 3 for establishing the connection between the terminal device and the lamp to the credential resource in the terminal device, so that the terminal device can communicate with the refrigerator and washing machine. On the basis of being able to interoperate, it can establish interoperability with the desk lamp.

Optionally, the access list further includes: security resources that are allowed to be accessed corresponding to the access control role; in step S502, the terminal device allows the access device to configure the security resources in the terminal device, The method includes: the terminal device allows the access device to configure a target security resource in the terminal device, and the target security resource is a security resource that is allowed to be accessed corresponding to the role of the access device.

The security resources that are allowed to be accessed in the access control list are indicated by the URL.

For example: the access control role in the access control list is role 1, and the security resource that is allowed to access corresponding to role 1 is: URL1. When the role of the access device is role 1, the terminal device allows the access device to access the security indicated by URL1 Resources.

In the embodiment of the present invention, the security resources that are allowed to be accessed in the access control list include one or more security resources, and different security resources are indicated by different URLs. When multiple access control items correspond to the same access control role, the security resources corresponding to the access control roles in each access control item can be different.

Optionally, the access control list further includes: operation authority corresponding to the access control role; correspondingly, in step S502, the terminal device allows the access device to configure the security resources in the terminal device, including: The terminal device allows the access device to perform configuration corresponding to a target operation authority on the secure resources in the terminal device, and the target operation authority is an operation authority corresponding to the role of the access device.

Operation permissions include: Create (Create), Retrieve (Retrieve), Update (Update), Delete (Delete), and Notification (Notify), etc., wherein the operation permissions corresponding to the access control role may include one of the above-mentioned operation permissions or Multiple. Taking the update of the operating authority as an example, the terminal device allows the access device to update the secure resources in the terminal device.

Taking the access control list including: the access control role, the security resources that are allowed to access to the corresponding access control role, and the operation authority of the corresponding access control role as an example, the access control list includes the following content:

In another example, the content of an access control list is as follows:

Here, the subject corresponding to the access control item includes the access control role of the access control item.

The above access control list indicates that the access device with the role of oic.owner.office is allowed to fully control the security resources in the terminal device: /oic/sec/doxm, /oic/sec/cred, and /oic/sec/pstat".

In the embodiment of the present invention, for different access devices, the access control lists are the same access control list, and the roles of the different access devices are the same; or for different access devices, the access control lists are different Access control list, and the roles of the different access devices are different.

Taking the access devices in different security domains, the access control list is the same access control list, and the roles of the access devices in the different security domains are the same, and the access device is a credential management server as an example, the credential management server of security domain 1 The roles of credential management server 2 in security domain 1 and security domain 2 are both owner, and the terminal device includes an access control list whose access control role is owner, and then credential management server 1 and credential management server 2 are allowed to perform access to secure resources in the terminal device. Configuration.

For access devices in different security domains, the access control lists are different access control lists, and the roles of the access devices in different security domains are different, and the access devices are credential management servers as an example, security domain 1 credential management server 1 The role of the credential management server 2 in the security domain is owner1, and the role of the credential management server 2 in the security domain 2 is owner2, and the terminal device includes the access control list 1 with the access control role of owner1. Based on the access control list 1, the credential management server 1 is allowed to secure the terminal Resources are controlled. The terminal device includes an access control list 2 with an access control role of owner2. Based on the access control list 2, the credential management server 2 is allowed to control the secure resources in the terminal device.

In practical applications, among the access control roles included in the access control list of the terminal device, some of the access control roles are common roles of multiple different access devices, and some of the access control roles correspond to different access devices.

Optionally, the access control list is preset in the terminal device. The access control list in the terminal device can be preset in the terminal device before leaving the factory. When the terminal device is initialized, the access control list preset in the terminal device will not be cleared.

Optionally, the access control list is configured by the activation device.

Taking the access control list configured by an activation device as an example, the activation device includes: an activation device in a security domain where the terminal device is located; or an activation device in a security domain other than the security domain where the terminal device is located.

When the activation device is an activation device in a security domain other than the security domain in which the terminal device is located, when the terminal device is configured by an activation device in a security domain other than the security domain in which the terminal device is located, the terminal device Configure the access control list.

In the embodiment of the present invention, a role is included in the access control role of the access control list in the terminal device, and the activated devices of other security domains no longer configure the access control list of this role in the terminal device configuration access control role, thereby Multiple security domains with the same role can share the same access control list to avoid repeated configuration of the access control list.

In the case that the access control list is configured by the active device of the current security domain, before step S501, as shown in FIG. 6, it includes: step S600: the active device configures the access control list to the terminal device.

The access control list is used for the at least one access control role of the access control list including the role of the access device, and the terminal device allows the access device to configure the security resources in the terminal device.

Optionally, the access control list further includes at least one of the following: security resources and operation permissions that are allowed to be accessed by the corresponding access control role.

In the embodiment of the present invention, before step S502, as shown in FIG. 7, step S701 is included: the terminal device authenticates the role certificate of the access device according to the root of trust to confirm the role of the access device.

Here, the root of trust includes keys such as the public key for authenticating the role certificate of the access device, and the signature of the role certificate of the access device is verified by the key to verify the legitimacy of the role certificate and confirm the role of the access device . Here, if the signature verification of the role certificate of the access device is passed, it means that the certificate authority (Certificate Authority, CA) of the access device and the CA of the terminal device are the same CA or mutually trusted CA, and the role certificate of the access device is legal.

In practical applications, the root of trust may also include information used to determine the CA issuing the role certificate, such as a certificate chain. Here, when the terminal device verifies the role certificate of the access device according to the root of trust, the CA of the access device is determined.

Optionally, for access devices in different security domains, the root of trust is the same root of trust. Optionally, for access devices in different security domains, the roots of trust are different roots of trust.

The role certificates of access devices in different security domains are different, and the roles in different role certificates can be the same or different. The access devices in different security domains have the same CA, and the access devices in these different security domains are authenticated through the same root of trust. The access devices in different security domains have different CAs, and the access devices in these different security domains are authenticated through different roots of trust. Access the device for authentication.

Optionally, the root of trust is preset in the terminal device. The root of trust in the terminal device can be preset in the terminal device before leaving the factory. When the terminal device is initialized, the root of trust preset in the terminal device will not be cleared.

Optionally, the root of trust is configured by the activation device.

Taking the root of trust configured by an activation device as an example, the activation device includes: an activation device in a security domain where the terminal device is located; or an activation device in a security domain other than the security domain where the terminal device is located.

When the activation device is an activation device in a security domain other than the security domain in which the terminal device is located, when the terminal device is configured by an activation device in a security domain other than the security domain in which the terminal device is located, the terminal device Configure the root of trust.

In the embodiment of the present invention, in the case that the root of trust for authenticating the access device role certificates of multiple security domains is the same root of trust, after the terminal device has the root of trust, the activated devices of other security domains no longer report to the terminal device. To configure the root of trust in multiple security domains, the same root of trust can be shared, avoiding repeated configuration of the root of trust.

In the embodiment of the present invention, when the access control list and the root of trust are both preset, since the access control lists corresponding to these security domains have been configured, there is no need to repeat the OTM operation each time the configuration is performed, thereby avoiding the Many tedious resource master configuration.

In the case that the root of trust is configured by the activation device of the current security domain, before step S501, as shown in FIG. 7, the method includes: step S700, in which the activation device configures the root of trust on the terminal device.

The root of trust is used by the terminal device to authenticate the role certificate of the access device to confirm the role of the access device.

In the embodiment of the present invention, before the terminal device enters the security domain, the method further includes:

The terminal device retains the configuration information corresponding to the secure resource; or the terminal device initializes the configuration information corresponding to the secure resource.

Here, the configuration information of the security resource is the configuration of the security resource by the access device in the security domain before the terminal device.

In the case that the terminal device retains the configuration information corresponding to the security resource, the terminal device retains the configuration information in the previous security domain, so that when moving from the current security domain to the previous security domain, it can be directly based on the reserved security domain. The configuration information is interconnected with the devices in the previous security domain.

When the terminal device initializes the configuration information corresponding to the security resource, the terminal device clears the configuration information in the previous security domain and restores the factory settings.

Here, the configuration information is mainly the initialization information of security resources such as owner resources, credential resources, and status resources configured in the previous security domain. If the terminal equipment is sold or transferred to others, the information previously configured by the user should be cleared so that the terminal equipment can be restored to an unowned state. The terminal device is not sold or transferred, but only enters a new security domain, and various initialization information configured in the previous security domain can be retained.

Optionally, the reservation condition for the terminal device to reserve the configuration information corresponding to the secure resource includes at least one of the following: receiving a reservation instruction instructing to reserve the configuration information; and not receiving an initialization instructing to initialize the configuration information instruction.

Optionally, the initialization condition for the terminal device to initialize the configuration information corresponding to the secure resource includes at least one of the following: receiving an initialization instruction instructing to initialize the configuration information; and not receiving a reservation instructing to retain the configuration information instruction.

Optionally, the terminal device retains the configuration information by default, and the terminal device may output a prompt whether the configuration information is initialized before entering the security domain. In the case of receiving an initialization instruction instructing to initialize the configuration information from a user, initialize the configuration information corresponding to the secure resource; in a case in which an initialization instruction instructing to initialize the configuration information from a user is not received, the The configuration information corresponding to the security resource.

Optionally, the terminal device initializes the configuration information by default, and the terminal device may output a prompt whether the configuration information is retained before entering the security domain. In the case of receiving the reservation instruction of the user instructing to reserve the configuration information, the configuration information corresponding to the secure resource is reserved; in the case of not receiving the reservation instruction of the user instructing to reserve the configuration information, the initialization of the The configuration information corresponding to the security resource.

The access control method provided by the embodiment of the present invention includes: the terminal device determines the role of the access device in the security domain where it is located; the situation where the role of the access device is included in at least one access control role in the access control list of the terminal device Next, the terminal device allows the access device to configure the secure resources in the terminal device. Since the access control list is set in the terminal device, when the role of the access device is included in the access control role of the access control list, it can be considered that the access device has the configuration authority to the security resources in the terminal device, and the access device is allowed to control the security resources in the terminal device. The security resources are configured, so that access devices in different security domains configure the security resources in the terminal device based on the access control list, which can avoid repeating the tedious configuration process of the resource owner and break the access isolation of the terminal device in different security domains.

In the access control method provided by the embodiment of the present invention, when the root of trust (Trust Anchor, TA) can be preset or configured by the activation device, the ACL can be preset or configured by the activation device. The access control method provided by the embodiment of the present invention includes The following scenarios:

Scenario 1. TA preset and ACL preset;

Scenario 2. TA presets, ACL is configured by OBT;

Scenario 3: TA is configured by OBT, ACL is configured by OBT;

Scenario 4. TA is configured by OBT and ACL is preset.

Among them, the role of ACL is to enable it to have corresponding permissions based on the role of the peer device. The ACL sets the required role oic.owner to access credential resources, and the role of CMS must be authenticated as oic.owner to configure credential resources.

The role of TA is to authenticate the identity of the role certificate of the CMS. When the terminal device receives the role certificate declared by the CMS, it uses the TA to verify the legality of the role certificate. If the verification is legal, the device considers the CMS to have the role identity in the role certificate, such as oic.owner.

In the present invention, the role authority set by the ACL is oic.owner1, and the certificate that can be authenticated by the TA is the certificate of the role of oic.owner2. When the CMS holding the role certificate of oic.owner1 is connected, the role identity of oic.owner1 cannot be verified because there is no suitable TA; when the CMS holding the role certificate of oic.owner2 is connected, the role identity can be verified, but the ACL does not match , There will be no corresponding configuration permissions. Therefore, ACL and TA have an association relationship (for example, both are associated with oic.owner) to play a role, thereby ensuring the legitimacy of the peer device.

Hereinafter, in the embodiment of the present invention, the terminal device is a mobile device and the access device is a CMS as an example, and the provided access control method is described through different application scenarios. It should be noted that, in Examples 1 to 3, the access control method provided by the embodiment of the present invention is explained by taking the access device as CMS as an example. In practical applications, when the access device is OBT, the interaction between OBT and mobile device can refer to CMS. Interaction with mobile devices.

Example one

The mobile device is preset with an access control list for the role of the owner (oic.owner). When the connected peer device, that is, the access device, is authenticated as oic.owner, the mobile device allows the peer device to access its secure resources. The access control list can be configured in the form of ACL resources.

In an example, the content of ACL security resources includes the following:

The above ACL indicates that the peer device whose role is authenticated as oic.owner is allowed to fully control the security resources of the mobile device: "/oic/sec/doxm", "/oic/sec/cred" and "/oic/sec/pstat".

Role certificates are preset in OBT and CMS. The public and private key of the role certificate adopts the public and private key of the corresponding device, and the public field of the certificate indicates the role ID of the certificate, such as "oic.owner". The role certificates preset by OBT and CMS in each network adopt the same oic.owner role.

When the mobile device purchased by the user Dad enters the home network and the office network respectively, the mobile device can be configured to work on the two networks separately. In addition, mobile devices can seamlessly switch after moving from one network to another.

The configuration process of mobile devices in the two networks is shown in Figure 8, including:

Step S801: The mobile device enters the home network.

The user Dad makes the mobile device enter the home network, namely network 1. The owner of the home network is Mom's mobile phone APP (OBT), and the credential management server in the home network is Home CMS, which is responsible for managing and configuring the credentials of the devices in the home network.

Here, before step S801, it further includes: step S800: preset ACL.

Step S802: The mobile device enters the configuration state.

Dad sets the mobile device into the configuration state.

Step S803: The mobile device confirms whether to retain the previous configuration information.

The mobile device asks the user Dad through the man-machine interface whether to retain the previous configuration information, and if the user responds with no, all the configuration information needs to be cleared.

Step S804: The mobile device clears all configuration information.

The user Dad determines not to retain the previous configuration information, and the mobile device clears all configuration information and restores the factory settings.

In step S805, the OBT of Mom establishes an OTM connection with the mobile device.

Step S806: Mom’s OBT configures TA1 to the mobile device.

Mom’s OBT configures the mobile device and writes the role certificate for Home CMS, that is, the Trust Anchor (TA1) of the role certificate. TA1 is used to verify the legality of the role certificate of Home CMS. For example, TA1 is the public key signature certificate of the certification authority CA, from which the CA public key can be extracted to verify the signature of the role certificate.

At this time, Mom's OBT completes the OTM configuration, and the mobile device starts to configure the P2P credential with Home CMS.

Step S807: The Home CMS establishes a role-based secure connection with the mobile device.

The mobile device uses TA1 to authenticate the role certificate of the Home CMS and confirm the identity of the oic.owner role of the Home CMS, thereby establishing a role-based connection with the mobile device.

Here, the establishment of a role-based security connection is a connection established using a role certificate, including: the role of the peer device confirmed by the role certificate. Here, if you are authenticated as different roles, you have different access control permissions.

Step S808: The Home CMS configures the security credential Cred1 to the /oic/sec/cred resource of the mobile device.

For example, configure the security credential Cred1 through the following update request.

Step S809: The mobile device allows the Home CMS to configure the /oic/sec/cred resource according to the preset ACL and the oic.owner role of the Home CMS.

Step S8010, Home CMS configures the mobile device to enter a normal working state.

Step S8011, the mobile device enters the office network.

Dad enters the office network (Network 2) with his mobile device. The owner of the office network is the OBT of Boss. The Office CMS manages and configures the credentials of the devices in the office network.

Step S8012, the mobile device enters the configuration state.

Dad sets the mobile device into the configuration state.

Step S8013: The mobile device confirms whether to retain the previous configuration information.

The mobile device asks the user Dad through the man-machine interface whether to retain the previous configuration information, and the user responds yes, and all the configuration information needs to be retained.

Step S8014: The mobile device retains the existing configuration information.

Dad confirms to keep the previous configuration information, the mobile device does not clear the configuration information, and allows the establishment of a new OTM connection.

Step S8015, the OBT of the Boss establishes an OTM connection with the mobile device.

Step S8016: The OBT of the Boss configures TA2 to the mobile device.

The OBT of Boss configures the mobile device and writes the role certificate Trust Anchor (TA2) of Office CMS. The TA2 is used to verify the legitimacy of the role certificate of Office CMS.

At this point, the OBT of the Boss completes the OTM configuration, and the mobile device starts to configure the P2P credential with the Office CMS.

Step S8017: The Office CMS establishes a role-based secure connection with the mobile device.

The Office CMS establishes a role-based connection with the mobile device, and the mobile device uses TA2 to authenticate the role certificate of the Office CMS to confirm the role identity of the oic.owner of the Office CMS.

Step S8018, Office CMS configures the security credential Cred2 to the /oic/sec/cred resource of the mobile device.

E.g:

Step S8019: The mobile device allows the configuration of /oic/sec/cred resources according to the preset ACL and the oic.owner role of Office CMS.

Step S8020, Office CMS configures the mobile device to enter a normal working state.

At this point, the mobile device of the user Dad can be interconnected with other smart devices in the security domain of the office network to realize various intelligent scenarios. When the user Dad brings the mobile device home, the mobile device is connected to the home network and can be interconnected with other smart devices in the security domain of the home to realize various intelligent scenarios.

Example two

The mobile device does not preset the ACL access control list for the owner role (oic.owner).

OBT and CMS have pre-built role certificates. The public and private key of the role certificate adopts the public and private key of the corresponding device, and the public field of the certificate indicates the role ID of the certificate, such as "oic.owner". The role certificate preset by Mom’s OBT and Home CMS corresponds to the role of oic.owner.home, that is, the role ID of the certificate is indicated as oic.owner.home in the certificate public field. The role certificate preset by Boss OBT and Boss CMS corresponds to the role of oic.owner.office, that is, the role ID of the certificate is indicated as oic.owner.office in the certificate public field.

The configuration process of mobile devices in the two networks is shown in Figure 9, including:

Step S901: The mobile device enters the home network.

The user Dad makes the mobile device enter the home network, namely network 1. The owner of the home network is Mom’s mobile phone APP (OBT), and the credential management server in the home network is Home CMS, which is responsible for managing and configuring the credentials of the devices in the home network.

Step S902: The mobile device enters a configuration state.

Dad sets the mobile device into the configuration state.

Step S903: The mobile device confirms whether to retain the previous configuration information.

Step S904: The mobile device clears all configuration information.

Step S905, Mom's OBT establishes an OTM connection with the mobile device.

Step S906, Mom’s OBT configures TA1 and ACL1 to the mobile device.

Mom’s OBT configures the mobile device and writes the Trust Anchor (TA1) and ACL1 of the role certificate of the Home CMS. Among them, TA1 is used to verify the legality of the role certificate of Home CMS. For example, TA1 is the public key signature certificate of the certification authority CA, from which the CA public key can be extracted to verify the signature of the role certificate. ACL1 is the peer device that authenticates the role of oic.owner and is allowed to fully control the local "/oic/sec/doxm", "/oic/sec/cred" and "/oic/sec/pstat" resources.

In an example, ACL1 is:

Step S907: The Home CMS establishes a role-based secure connection with the mobile device.

The Home CMS establishes a role-based connection with the mobile device. The mobile device uses TA1 to authenticate the role certificate of the Home CMS to confirm the role identity of the oic.owner.home of the Home CMS.

Step S908: The Home CMS configures the security credential Cred1 to the /oic/sec/cred resource of the mobile device.

Step S909: The mobile device allows the Home CMS to configure the /oic/sec/cred resource according to the configured ACL and the oic.owner.home role of the Home CMS.

Step S9010, Home CMS configures the mobile device to enter a normal working state.

Step S9011, the mobile device enters the office network.

Step S9012, the mobile device enters the configuration state.

Dad sets the mobile device into the configuration state.

Step S9013: The mobile device confirms whether to retain the previous configuration information.

Step S9014: The mobile device retains the existing configuration information.

The user Dad confirms to keep the previous configuration information, and the mobile device does not clear the configuration information, allowing the establishment of a new OTM connection.

Step S9015, the OBT of the Boss establishes an OTM connection with the mobile device.

Step S9016: The OBT of the Boss configures TA2 and ACL2 to the mobile device.

The OBT of Boss configures the mobile device and writes the Trust Anchor (TA2) and ACL2 of the role certificate of Office CMS. The TA2 is used to verify the legality of the role certificate of Home CMS. For example, TA2 is the public key signature certificate of the certification authority CA, from which the CA public key can be extracted to verify the signature of the role certificate. ACL2 authenticates the peer device with the role of oic.owner and is allowed to fully control the "/oic/sec/doxm", "/oic/sec/cred" and "/oic/sec/pstat" resources of the machine.

In an example, ACL2 is:

Step S9017: The Office CMS establishes a role-based secure connection with the mobile device.

The Office CMS establishes a role-based connection with the mobile device. The mobile device uses TA2 to authenticate the role certificate of the Office CMS to confirm the identity of the oic.owner.office role of the Office CMS.

Step S9018. Office CMS configures the security credential Cred2 to the /oic/sec/cred resource of the mobile device. E.g:

Step S9019: The mobile device allows the Office CMS to configure the /oic/sec/cred resource according to the configured ACL and the oic.owner.office role of the Office CMS.

Step S9020, Office CMS makes the mobile device enter a normal working state.

At this time, the mobile device of the user Dad can be interconnected with other smart devices in the security domain in the office network to realize various intelligent scenarios. When the user Dad brings the mobile device home, the mobile device is connected to the home network and can be interconnected with other smart devices in the security zone of the home to realize various intelligent scenarios.

Example three

The universal TA and ACL are preset in the mobile device.

Assume that all OBT and CMS role certificates are issued by the same certificate authority CA. The device presets the TA for the role certificate corresponding to the private key of the role certificate by the CA, and the TA can be used to verify the signature of the role certificate to verify the legality of the role certificate.

The device is preset with ACL for the owner role (oic.owner). When the connected peer device is authenticated as oic.owner, the device allows the peer device to access its secure resources.

For example, the terminal equipment is preset with the following ACLs:

The above ACL resource indicates that the peer device authenticated as the oic.owner role is allowed to fully control the local "/oic/sec/doxm", "/oic/sec/cred" and "/oic/sec/pstat" resources.

When the mobile device purchased by the user Dad enters the home network and the office network respectively, it is configured so that the mobile device can work in the security domains of the two networks. In addition, mobile devices can seamlessly switch after moving from one network to another.

The configuration process of mobile devices in the two networks is shown in Figure 10, including:

Step S1001, the mobile device enters the home network.

The user Dad allows the mobile device to enter the home network. The owner of the home network is Mom's mobile phone APP (OBT), and the credential management server in the home network is Home CMS, which is responsible for managing and configuring the credentials of the devices in the home network.

Here, before step S1001, it further includes: step S1000: preset ACL and TA.

Step S1002, the mobile device enters a configuration state.

Dad sets the mobile device into the configuration state.

Step S1003, Mom's OBT establishes an OTM connection with the mobile device, and performs owner configuration.

Step S1004. The OBT of Mom completes the OTM configuration and instructs Home CMS to start configuring the mobile device P2P credential.

Step S1005: The Home CMS establishes a role-based secure connection with the mobile device.

Step S1006. Home CMS configures the security credential Cred1 to the /oic/sec/cred resource of the mobile device.

For example, configure the security credential Cred1 with the following update request:

Step S1007: The mobile device allows the Home CMS to configure the /oic/sec/cred resource according to the preset ACL and the oic.owner role of the Home CMS.

Step S1008, Home CMS makes the mobile device enter a normal working state.

Step S1009: The mobile device enters the office network.

Dad enters the office network (Network 2) with his mobile device. The owner of the office network is the OBT of Boss. The Office CMS manages and configures the credentials of the devices in the office network. After the mobile device enters the office network, find the OBT of the office network, that is, the OBT of Boss.

Step S10010: The mobile device enters a configuration state.

The user Dad sets the mobile device into the P2P credential configuration state.

Here, a unified TA is used and there is no need to configure the TA. Therefore, the OBT step between the mobile device and the OBT of the Boss can be skipped.

Step S10011: The OBT of the Boss instructs Office CMS to start configuring the P2P credential of the mobile device.

Step S10012: The Office CMS establishes a role-based secure connection with the mobile device.

The Office CMS establishes a role-based connection with the mobile device. The mobile device uses the pre-configured TA (each CMS role certificate can be authenticated by TA) to authenticate the Office CMS role certificate to confirm the Office CMS's oic.owner role identity .

Step S10013: The CMS configures the security credential Cred2 to the /oic/sec/cred resource of the mobile device.

For example, configure the security credential Cred2 through the following update request.

In step S10014, the preparation allows the Office CMS to configure the /oic/sec/cred resource according to the preset ACL and the oic.owner role of the Office CMS.

Step S10015, Office CMS makes the mobile device enter a normal working state.

At this time, Dad's mobile devices can be interconnected with other smart devices in the security domain of the office network to realize various intelligent scenarios. When Dad brings the mobile device home, the mobile device is connected to the home network, and can be interconnected with other smart devices in the security zone of the home to realize various intelligent scenarios.

To implement the above access control method, an embodiment of the present invention also provides a terminal device 1101, as shown in FIG. 11, including:

The role determination module 1101 is configured to determine the role of the access device in the security domain;

The authority management module 1102 is configured to include the role of the access device in at least one access control role in the access control list of the terminal device, and allow the access device to configure the security resources in the terminal device, and the access The control role is a role that is allowed to configure the security resource.

In the embodiment of the present invention, the role management module 1101 is further configured to be further configured to determine the role of the access device by the public field in the role certificate of the access device.

In the embodiment of the present invention, the access list includes: security resources that are allowed to be accessed corresponding to the access control role;

The authority management module 1102 is further configured to allow the access device to configure a target security resource in the terminal device, where the target security resource is a security resource that is allowed to be accessed corresponding to the role of the access device.

In the embodiment of the present invention, the access control list further includes: operation authority corresponding to the access control role;

The authority management module 1102 is further configured to allow the access device to perform configuration corresponding to a target operation authority on the secure resources in the terminal device, and the target operation authority is an operation authority corresponding to the role of the access device.

In the embodiment of the present invention, for access devices in different security domains, the access control list is the same access control list, and the roles of the access devices in the different security domains are the same; or

For access devices in different security domains, the access control lists are different access control lists, and the roles of the access devices in different security domains are different.

In the embodiment of the present invention, the access control list is preset in the terminal device;

Or the access control list is configured by the activation device.

In the embodiment of the present invention, the terminal device 1100 further includes:

The role authentication module is configured to authenticate the role certificate of the access device according to the root of trust to confirm the role of the access device.

In the embodiment of the present invention, for access devices in different security domains, the root of trust is the same root of trust, or

For access devices in different security domains, the trust roots are different trust roots.

In the embodiment of the present invention,

The root of trust is preset in the terminal device; or

The root of trust is configured by the activation device.

In the embodiment of the present invention, the activation device includes:

The activation device of the security domain where the terminal device is located; or

An activation device in a security domain other than the security domain where the terminal device is located.

In the embodiment of the present invention, the terminal device 1100 further includes: a configuration update module configured to: before the terminal device enters the security domain, retain the configuration information corresponding to the secure resource, or initialize the configuration information corresponding to the secure resource .

In the embodiment of the present invention, the reservation condition for the terminal device to reserve the configuration information corresponding to the secure resource includes at least one of the following:

Receiving a reservation instruction instructing to keep the configuration information; and

An initialization instruction indicating to initialize the configuration information is not received.

In the embodiment of the present invention, the initialization condition for the terminal device to initialize the configuration information corresponding to the secure resource includes at least one of the following:

Receiving an initialization instruction instructing to initialize the configuration information; and

The reservation instruction indicating that the configuration information is reserved is not received.

An embodiment of the present invention also provides a terminal device, including a processor and a memory for storing a computer program that can run on the processor, where the processor is used to execute the above-mentioned terminal device when the computer program is running. Steps of the access control method.

To implement the above access control method, an embodiment of the present invention also provides an access device 1200, including:

The sending module 1201 is configured to send the role of the access device to the terminal device in the security domain where it is located; when the role of the access device is included in at least one access control role in the access control list of the terminal device The terminal device allows the access device to configure the security resource in the terminal device, and the access control role is a role that is allowed to configure the security resource.

In the embodiment of the present invention, the sending module 1201 is further configured to send a role certificate to the terminal device, and the public field of the role certificate includes the role of the access device.

In the embodiment of the present invention, the roles of access devices in different security domains are the same; or the roles of access devices in different security domains are different.

An embodiment of the present invention also provides an access device, including a processor and a memory for storing a computer program that can run on the processor, where the processor is used to execute the computer program executed by the access device when the computer program is running. Steps of the access control method.

An embodiment of the present invention further provides an activation device 1300, including:

The list configuration module 1301 is configured to configure an access control list for a terminal device, where the access control list is used for the access control role of the access control list including the role of the access device, and the terminal device allows the access device to The security resource in the terminal device is configured, and the access control role is a role that is allowed to configure the security resource.

In the embodiment of the present invention, the access control list further includes at least one of the following:

The security resources and operation permissions that are allowed to be accessed corresponding to the access control role.

In the embodiment of the present invention, the activation device 1301 further includes:

The root configuration module is configured to configure a root of trust for the terminal device, and the root of trust is used by the terminal device to authenticate the role certificate of the access device to confirm the role of the access device.

An embodiment of the present invention also provides an activation device, including a processor and a memory for storing a computer program that can run on the processor, where the processor is used to execute the above-mentioned activation device when the computer program is running. Steps of the access control method.

14 is a schematic diagram of the hardware composition structure of an electronic device (terminal device, access device, or activation device) according to an embodiment of the present invention. The electronic device 1400 includes: at least one processor 1401, memory 1402, and at least one network interface 1404. The various components in the electronic device 1400 are coupled together through the bus system 1405. It can be understood that the bus system 1405 is used to implement connection and communication between these components. In addition to the data bus, the bus system 1405 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clear description, various buses are marked as the bus system 1405 in FIG. 14.

It can be understood that the memory 1402 may be a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memory. Among them, the non-volatile memory can be ROM, Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), and electrically erasable Programmable read-only memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), magnetic random access memory (FRAM, ferromagnetic random access memory), flash memory (Flash Memory), magnetic surface memory, optical disk, or CD-ROM -ROM, Compact Disc Read-Only Memory); Magnetic surface memory can be disk storage or tape storage. The volatile memory may be a random access memory (RAM, Random Access Memory), which is used as an external cache. By way of exemplary but not restrictive description, many forms of RAM are available, such as static random access memory (SRAM, Static Random Access Memory), synchronous static random access memory (SSRAM, Synchronous Static Random Access Memory), and dynamic random access memory. Memory (DRAM, Dynamic Random Access Memory), Synchronous Dynamic Random Access Memory (SDRAM, Synchronous Dynamic Random Access Memory), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), enhanced Type synchronous dynamic random access memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), synchronous connection dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), direct memory bus random access memory (DRRAM, Direct Rambus Random Access Memory) ). The memory 1402 described in the embodiment of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

The memory 1402 in the embodiment of the present invention is used to store various types of data to support the operation of the electronic device 1400. Examples of such data include: any computer program used to operate on the electronic device 1400, such as an application program 14022. The program for implementing the method of the embodiment of the present invention may be included in the application program 14022.

The method disclosed in the foregoing embodiment of the present invention may be applied to the processor 1401 or implemented by the processor 1401. The processor 1401 may be an integrated circuit chip with signal processing capabilities. In the implementation process, the steps of the foregoing method can be completed by an integrated logic circuit of hardware in the processor 1401 or instructions in the form of software. The aforementioned processor 1401 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and the like. The processor 1401 may implement or execute various methods, steps, and logical block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present invention may be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the memory 1402. The processor 1401 reads the information in the memory 1402, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the electronic device 1400 may be used by one or more Application Specific Integrated Circuits (ASIC, Application Specific Integrated Circuit), DSP, Programmable Logic Device (PLD, Programmable Logic Device), and Complex Programmable Logic Device (CPLD). , Complex Programmable Logic Device), FPGA, general-purpose processor, controller, MCU, MPU, or other electronic components to implement the foregoing method.

The embodiment of the present invention also provides a storage medium for storing computer programs.

Optionally, the storage medium can be applied to the terminal device in the embodiment of the present invention, and the computer program causes the computer to execute the corresponding process in each method of the embodiment of the present invention. For brevity, details are not described herein again.

Optionally, the storage medium can be applied to the access device in the embodiment of the present invention, and the computer program causes the computer to execute the corresponding process in each method of the embodiment of the present invention. For brevity, details are not described herein again.

Optionally, the storage medium can be applied to the activation device in the embodiment of the present invention, and the computer program causes the computer to execute the corresponding process in each method of the embodiment of the present invention. For brevity, details are not described herein again.

The present invention is described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

The above are only the preferred embodiments of the present invention and are not used to limit the protection scope of the present invention. Any modification, equivalent replacement and improvement made within the spirit and principle of the present invention shall be included in Within the protection scope of the present invention.

Claims

An access control method, including:

The terminal device determines the role of the access device in the security domain in which it is located;

In the case that at least one access control role of the access control list of the terminal device includes the role of the access device, the terminal device allows the access device to configure the security resources in the terminal device, and The access control role is a role that is allowed to configure the security resource.
The method of claim 1, wherein:

The access control list is preset in the terminal device;

Or the access control list is configured by the activation device.
The method of claim 1 or 2, wherein:

For access devices in different security domains, the access control list is the same access control list, and the roles of the access devices in the different security domains are the same; or

For access devices in different security domains, the access control lists are different access control lists, and the roles of the access devices in different security domains are different.
The method according to any one of claims 1 to 3, wherein the access list further includes: security resources that are allowed to be accessed corresponding to the access control role;

The terminal device allowing the access device to configure the security resources in the terminal device includes:

The terminal device allows the access device to configure a target security resource in the terminal device, and the target security resource is a security resource that is allowed to be accessed corresponding to the role of the access device.
The method according to any one of claims 1 to 4, wherein the access control list further comprises: operation authority corresponding to the access control role;

The terminal device allowing the access device to configure the security resources in the terminal device includes:

The terminal device allows the access device to perform configuration corresponding to a target operation authority on the secure resources in the terminal device, and the target operation authority is an operation authority corresponding to the role of the access device.
The method according to any one of claims 1 to 5, wherein the method further comprises:

The terminal device authenticates the role certificate of the access device according to the root of trust to confirm the role of the access device.
The method according to claim 6, wherein:

For access devices in different security domains, the root of trust is the same root of trust, or

For access devices in different security domains, the trust roots are different trust roots.
The method according to claim 6, wherein:

The root of trust is preset in the terminal device; or

The root of trust is configured by the activation device.
The method according to claim 2 or 8, wherein the activation device comprises:

The activation device of the security domain where the terminal device is located; or

An activation device in a security domain other than the security domain where the terminal device is located.
The method according to any one of claims 1 to 9, wherein, before the terminal device enters the security domain, the method further comprises:

The terminal device retains the configuration information corresponding to the secure resource; or the terminal device initializes the configuration information corresponding to the secure resource.
The method according to claim 10, wherein the reservation condition for the terminal device to reserve the configuration information corresponding to the secure resource comprises at least one of the following:

Receiving a reservation instruction instructing to keep the configuration information; and

An initialization instruction indicating to initialize the configuration information is not received.
The method according to claim 10, wherein the initialization condition for the terminal device to initialize the configuration information corresponding to the secure resource includes at least one of the following:

Receiving an initialization instruction instructing to initialize the configuration information; and

The reservation instruction indicating that the configuration information is reserved is not received.
The method according to any one of claims 1 to 12, wherein determining the role of the access device in the security domain where the terminal device is located includes:

The terminal device determines the role of the access device from the public field in the role certificate sent by the access device.
An access control method, including:

The access device sends the role of the access device to the terminal device in the security domain; when the role of the access device is included in at least one access control role in the access control list of the terminal device, the terminal The device allows the access device to configure the security resource in the terminal device, and the access control role is a role that is allowed to configure the security resource.
The method according to claim 14, wherein the sending of the role of the access device to the terminal device of the security domain where the access device is located comprises:

The access device sends a role certificate to the terminal device in the security domain where it is located, and the public field of the role certificate includes the role of the access device.
The method according to claim 14 or 15, wherein:

The roles of access devices in different security domains are the same; or

The roles of access devices in different security domains are different.
An access control method, the method includes:

The activation device configures an access control list for the terminal device, where the access control list is used in at least one access control role of the access control list including the role of the access device, and the terminal device allows the access device to access the terminal device. The security resource is configured, and the access control role is a role that is allowed to configure the security resource.
The method according to claim 17, wherein the access control list further comprises at least one of the following:

The security resources and operation permissions that are allowed to be accessed corresponding to the access control role.
The method according to claim 17 or 18, wherein the method further comprises:

The activation device configures a root of trust for the terminal device, and the root of trust is used by the terminal device to authenticate the role certificate of the access device to confirm the role of the access device.
A terminal device, including:

The role determination module is configured to determine the role of the access device in the security domain;

An authority management module configured to allow the access device to configure the security resources in the terminal device when the role of the access device is included in at least one access control role in the access control list of the terminal device, The access control role is a role that is allowed to configure the security resource.
The terminal device according to claim 20, wherein:

The access control list is preset in the terminal device;

Or the access control list is configured by the activation device.
The terminal device according to claim 20 or 21, wherein:

For access devices in different security domains, the access control list is the same access control list, and the roles of the access devices in the different security domains are the same; or

For access devices in different security domains, the access control lists are different access control lists, and the roles of the access devices in different security domains are different.
The terminal device according to any one of claims 20 to 22, wherein the access list includes: security resources that are allowed to be accessed corresponding to the access control role;

The authority management module is further configured to allow the access device to configure a target security resource in the terminal device, and the target security resource is a security resource that is allowed to be accessed corresponding to the role of the access device.
The terminal device according to any one of claims 20 to 23, wherein the access control list further comprises: operation authority corresponding to the access control role;

The authority management module is further configured to allow the access device to perform configuration corresponding to a target operation authority on the secure resources in the terminal device, and the target operation authority is an operation authority corresponding to the role of the access device.
The terminal device according to any one of claims 20 to 24, wherein the terminal device further comprises:

The role authentication module is configured to authenticate the role certificate of the access device according to the root of trust to confirm the role of the access device.
The terminal device according to claim 25, wherein:

For access devices in different security domains, the root of trust is the same root of trust, or

For access devices in different security domains, the trust roots are different trust roots.
The terminal device according to claim 25, wherein:

The root of trust is preset in the terminal device; or

The root of trust is configured by the activation device.
The terminal device according to claim 21 or 27, wherein the activation device comprises:

The activation device of the security domain where the terminal device is located; or

An activation device in a security domain other than the security domain where the terminal device is located.
The terminal device according to any one of claims 20 to 28, wherein the terminal device further comprises:

The configuration update module is configured to: before the terminal device enters the secure domain, retain the configuration information corresponding to the secure resource, or initialize the configuration information corresponding to the secure resource.
The terminal device according to claim 29, wherein the reservation condition for the terminal device to reserve the configuration information corresponding to the secure resource comprises at least one of the following:

Receiving a reservation instruction instructing to keep the configuration information; and

An initialization instruction indicating to initialize the configuration information is not received.
The terminal device according to claim 29, wherein the initialization condition for the terminal device to initialize the configuration information corresponding to the secure resource comprises at least one of the following:

Receiving an initialization instruction instructing to initialize the configuration information; and

The reservation instruction indicating that the configuration information is reserved is not received.
The terminal device according to any one of claims 20 to 31, wherein the role management module is further configured to determine the role of the access device from a public field in the role certificate sent by the access device.
An access device including:

The sending module is configured to send the role of the access device to the terminal device in the security domain; when the role of the access device is included in at least one access control role in the access control list of the terminal device, The terminal device allows the access device to configure the security resource in the terminal device, and the access control role is a role that is allowed to configure the security resource.
The access device according to claim 33, wherein the sending module is further configured to send a role certificate to the terminal device, and the public field of the role certificate includes the role of the access device.
The access device according to claim 33 or 34, wherein:

The roles of access devices in different security domains are the same; or

The roles of access devices in different security domains are different.
An activation device, including:

The list configuration module is configured to configure an access control list to a terminal device, where the access control list is used in at least one access control role of the access control list including the role of the access device, and the terminal device allows the access device to The security resource in the terminal device is configured, and the access control role is a role that is allowed to configure the security resource.
The activation device according to claim 36, wherein the access control list further comprises at least one of the following:

Corresponding to the security resources and operation permissions that the access control role is allowed to access.
The activation device according to claim 36 or 37, wherein the activation device further comprises:

The root configuration module is configured to configure a root of trust for the terminal device, and the root of trust is used by the terminal device to authenticate the role certificate of the access device to confirm the role of the access device.
A terminal device includes a processor and a memory for storing a computer program that can run on the processor, wherein:

When the processor is used to run the computer program, it executes the steps of the access control method according to any one of claims 1 to 13.
An access device, including a processor and a memory for storing a computer program that can run on the processor, wherein:

When the processor is used to run the computer program, it executes the steps of the access control method according to any one of claims 14 to 16.
An activation device includes a processor and a memory for storing a computer program that can run on the processor, wherein:

When the processor is used to run the computer program, it executes the steps of the access control method according to any one of claims 17 to 19.
A storage medium storing an executable program, and when the executable program is executed by a processor, the access control method according to any one of claims 1 to 13 is implemented.
A storage medium storing an executable program, and when the executable program is executed by a processor, the access control method according to any one of claims 14 to 16 is implemented.
A storage medium storing an executable program, and when the executable program is executed by a processor, the access control method according to any one of claims 17 to 19 is implemented.