WO2021142849A1 - 安全域的配置、发现和加入方法及装置、电子设备 - Google Patents

安全域的配置、发现和加入方法及装置、电子设备 Download PDF

Info

Publication number
WO2021142849A1
WO2021142849A1 PCT/CN2020/073059 CN2020073059W WO2021142849A1 WO 2021142849 A1 WO2021142849 A1 WO 2021142849A1 CN 2020073059 W CN2020073059 W CN 2020073059W WO 2021142849 A1 WO2021142849 A1 WO 2021142849A1
Authority
WO
WIPO (PCT)
Prior art keywords
security domain
security
identifier
network
module
Prior art date
Application number
PCT/CN2020/073059
Other languages
English (en)
French (fr)
Inventor
茹昭
吕小强
张军
Original Assignee
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Oppo广东移动通信有限公司 filed Critical Oppo广东移动通信有限公司
Priority to CN202080025258.0A priority Critical patent/CN113678421B/zh
Priority to PCT/CN2020/073059 priority patent/WO2021142849A1/zh
Publication of WO2021142849A1 publication Critical patent/WO2021142849A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • H04W4/08—User group management

Definitions

  • This application relates to the field of communications, in particular to methods for configuring, discovering and joining security domains, and electronic devices.
  • Internet of things Internet of things, referred to as "IoT" refers to the "Internet of Things Connected”. It is an extended and expanded network based on the Internet. It is a huge network formed by combining various information sensing devices with the Internet. The interconnection of people, machines and things at any time and any place. However, this "Internet of Everything” attribute of the Internet of Things also makes the data in the hardware, software and systems of the Internet of Things easily damaged, altered and leaked due to accidental or malicious reasons. With the rapid development of the Internet of Things technology, the security of the Internet of Things is becoming more and more important.
  • a security domain network is a specific Internet of Things network.
  • the security domain network has an independent security protocol (or security mechanism).
  • the Internet of Things devices in the security domain network can interconnect, communicate, discover each other, and transmit instructions to each other. Devices outside the secure domain network are restricted by the security protocol in the secure domain network, and therefore cannot access other IoT devices in the secure domain network.
  • the security domain network may be a sub-network of the local area network, the local area network may have at least one security domain network, the at least one security domain network is set in the local area network through an access point device, and the at least one security domain network may each have an independent security protocol .
  • the embodiments of the present application provide a method for configuring, discovering and joining a security domain, and an electronic device, and provide a solution for configuring the security domain of the Internet of Things existing in the network, which can simplify the resource discovery process and make the client The device can easily discover and obtain the security domain information in the network.
  • a method for configuring a security domain including: obtaining security domain information; and performing security domain configuration according to the obtained security domain information.
  • the security domain information includes at least: security domain identifier, security domain name, and security domain discoverability.
  • a method for discovering security domains including:
  • the IoT device has been configured with security domain information
  • the security domain information includes at least: a security domain identifier, a security domain name, and a security domain discoverability.
  • a security domain discovery method is provided, which is executed by an IoT device configured with security domain information through the security domain configuration method described in the first aspect, including: responding to received resources for execution The discovery request message feeds back the discovery resource; in response to the received request message for obtaining the security domain name corresponding to the security domain identifier, the security domain name is fed back; wherein the security domain information includes at least: a security domain identifier Security domain name, and security domain discoverability; when the attribute value of the security domain discoverability characterizes discovery, the discovery resource includes the security domain identifier.
  • a method for joining a security domain including:
  • an instance of the security domain is started.
  • a device for configuring a security domain including:
  • the configuration module is configured to perform security domain configuration according to the acquired security domain information
  • the security domain information includes at least: security domain identifier, security domain name, and security domain discoverability.
  • a discovery device for a security domain including:
  • the first acquisition module is used to acquire discovery resources of IoT devices in the network
  • the second obtaining module is configured to obtain a security domain identifier from the discovery resource
  • a determining module configured to determine the security domain corresponding to the security domain identifier in the network
  • the IoT device has been configured with security domain information
  • the security domain information includes at least: a security domain identifier, a security domain name, and a security domain discoverability.
  • a security domain discovery device is provided.
  • the security domain information is configured by the security domain configuration device described in the fifth aspect, including:
  • the first feedback module is configured to feed back the discovered resources in response to the received request message for performing resource discovery
  • the second feedback module is configured to feed back the security domain name in response to the received request message for obtaining the security domain name corresponding to the security domain identifier;
  • the security domain information includes at least: security domain identifier, security domain name, and security domain discoverability; when the attribute value of the security domain discoverability characterizes the discovery, the discovery resource includes the security Domain identifier.
  • a device for joining a security domain including:
  • the request module is used to request the user to select a security domain to join; wherein the security domain for the user to select is a security domain discovered by the device described in the sixth aspect;
  • the activation module is used to activate the instance of the security domain according to the security domain selected by the user.
  • an electronic device which is used to execute the method in the above-mentioned first aspect or each of its implementation manners.
  • the electronic device includes a functional module for executing the method in the foregoing first aspect or each of its implementation manners.
  • an electronic device including a processor and a memory.
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program stored in the memory to execute any one of the above-mentioned first to fourth aspects or the method in each implementation manner thereof.
  • a chip for implementing any one of the foregoing first to third aspects or the method in each implementation manner thereof.
  • the chip includes: a processor, configured to call and run a computer program from the memory, so that the device installed with the chip executes any one of the above-mentioned first to fourth aspects or any of the implementations thereof method.
  • a computer-readable storage medium for storing a computer program that enables a computer to execute any one of the above-mentioned first to fourth aspects or the method in each implementation manner thereof.
  • a computer program product including computer program instructions that cause a computer to execute any one of the first to fourth aspects above or the method in each implementation manner thereof.
  • a computer program which, when run on a computer, causes the computer to execute any one of the above-mentioned first to fourth aspects or the method in each of its implementation manners.
  • the security domain of the Internet of Things existing in the network can be configured, and the resource discovery process can be simplified, so that the client device can easily discover and obtain the security domain information in the network.
  • Fig. 1 is a schematic diagram of the Internet of Things applied in an embodiment of the present application.
  • Fig. 2 is a schematic diagram of a protocol architecture of an Internet of Things device provided according to an embodiment of the present application.
  • Fig. 3 is a schematic flowchart of a method for configuring a security domain according to a specific embodiment of the present application.
  • Fig. 4 is a schematic flowchart of a method for configuring a security domain according to another specific embodiment of the present application.
  • Fig. 5 is a schematic flowchart of a method for configuring a security domain according to another specific embodiment of the present application.
  • Fig. 6 is a schematic flowchart of a method for configuring a security domain according to still another specific embodiment of the present application.
  • Fig. 7 is a schematic flowchart of a method for configuring a security domain according to still another specific embodiment of the present application.
  • Fig. 8 is a schematic flowchart of a method for discovering a security domain according to a specific embodiment of the present application.
  • Fig. 9 is a schematic flowchart of a method for discovering a security domain according to another specific embodiment of the present application.
  • Fig. 10 is a schematic flowchart of a method for joining a security domain according to a specific embodiment of the present application.
  • Fig. 11 is a schematic flowchart of a method for discovering a security domain according to another specific embodiment of the present application.
  • Fig. 12 is a schematic diagram of an interaction scenario between IoT devices according to an embodiment of the present application.
  • Fig. 13 is a schematic diagram of another interaction scenario between IoT devices according to an embodiment of the present application.
  • Fig. 14 is a schematic diagram of another interaction scenario between IoT devices according to an embodiment of the present application.
  • Fig. 15 is a schematic diagram of yet another interaction scenario between IoT devices according to an embodiment of the present application.
  • Fig. 16 is a schematic block diagram of an apparatus for configuring a security domain according to a specific embodiment of the present application.
  • Fig. 17 is a schematic block diagram of an apparatus for discovering a security domain according to a specific embodiment of the present application.
  • FIG. 18 is a schematic block diagram of an apparatus for discovering a security domain according to another specific embodiment of the present application.
  • Fig. 19 is a schematic block diagram of an apparatus for joining a security domain according to a specific embodiment of the present application.
  • FIG. 20 is a schematic block diagram of an electronic device according to an embodiment of the present application.
  • FIG. 21 is a schematic block diagram of a chip provided by an embodiment of the present application.
  • FIG. 1 shows an example Internet of Things in block diagram form.
  • the Internet of Things can be a peer-to-peer network.
  • Electronic devices that run instances of the Internet of Things protocol can join the Internet of Things.
  • Such electronic devices can be referred to as Internet of Things devices (hereinafter referred to as "IoT devices").
  • IoT devices follow the core protocol of IoT devices.
  • Figure 2 shows an example of the core protocol architecture of IoT devices.
  • the RESTful architecture represents an architectural style network system, which refers to a set of architectural constraints and Principles, applications or designs that meet these constraints and principles are RESTful).
  • the service layer defines the service framework of the device and uniformly standardizes the IoT device model.
  • the resources are used to express the physical devices of the Internet of Things, as well as information such as the functional services provided by the devices and the status of the devices.
  • the device that provides the resource is the server, and the device that accesses the resource is the client.
  • Client and server are logical functional entities.
  • a device can be a client or a server, or a device can be both a client and a server.
  • a device (such as a light bulb) that implements a certain basic function can only be a server, and it can be provided to the client for query and control, and it has no control or query requirements for other devices.
  • the business interaction between the client and the server is through RESTful operations on resources, such as create (Create), read (Retrieve), update (Update), delete (Delete) and notify (Notify) (these operation methods are collectively referred to as "CRUDN” Operation"), to achieve.
  • the client is the initiator of the RESTful operation
  • the server is the responder of the RESTful operation.
  • the client sends a resource operation request to the server, requesting operations on the resources on the server.
  • the server performs resource operations and returns a response to the client.
  • the response carries the content and description of the resource.
  • the description of resources is the resource model layer, and each resource corresponds to a specific Uniform Resource Identifier ("URI"), which can be accessed through the URI of the resource.
  • Resources and each resource has a corresponding interface that supports Restful operations. It is the transmission protocol layer that transmits resource content and description information. By mapping resource operations to specific transmission protocols, the Restful operation of each resource is transformed into an entity message to be transmitted between devices, providing a means for interconnection and intercommunication between devices.
  • a Constrained Application Protocol (“CoAP”) protocol can be used to carry resource operations.
  • Each CRUDN operation is mapped to a request/response message of the CoAP protocol.
  • the client device can use the four methods of CoAP protocol to obtain (GET), create (POST), update (PUT), and delete (DELETE).
  • the resource is operated to realize the transition of the resource state.
  • the bearer protocol used in this application is not limited to the CoAP protocol.
  • Other protocols can also be used, such as the Message Queuing Telemetry Transport (“MQTT”) protocol and the Hypertext Transfer Protocol (Hyper Text Transfer Protocol, "HTTP for short”). ") and other mainstream bearer protocols, not one by one.
  • MQTT Message Queuing Telemetry Transport
  • HTTP Hypertext Transfer Protocol
  • IoT devices can be connected to each other using appropriate communication technologies, and the communication technologies can include wired and wireless communication technologies.
  • This communication follows protocols related to the Internet of Things.
  • the connection layer can support a variety of different low-level networks such as WiFi, Ethernet, Thread, Bluetooth, and Zigbee.
  • this application should not be limited by the examples here, and other communication protocols related to the Internet of Things should also fall within the protection scope of this application.
  • OBT Onboarding Tool
  • OBT is a role in the security protocol, and is a tool for configuring IoT devices in the security domain network where the security protocol is set.
  • the OBT can run on at least one IoT device in the secure domain network, and the IoT device provided with the OBT can be referred to as an OBT device (for example, as shown in FIG. 1).
  • the OBT device can be used to configure itself, or it can be used to configure other IoT devices in the security domain network where it is located.
  • the IoT devices configured with the OBT device can form a secure domain network. In a security domain network, there is only one master OBT, and there can be multiple slave OBTs.
  • Each IoT device can include one or more logical devices (Device), and each logical device can have multiple device instances (Device instances), and only one device instance in each logical device is in the active state. Other device instances in the logical device are in an inactive state.
  • An activated device instance enables its logical device to be discovered, configured, and accessed by the logical devices of other IoT devices under the secure domain network. Conversely, the logical device where an inactive device instance is located cannot be accessed by the secure domain network. Logical device discovery, configuration, and access of other IoT devices under.
  • the logical device can be established according to the use requirements of the security domain.
  • one function in the IoT device can be a logical device, and the logical device can be understood as controlling the IoT device
  • the functional entity of the software, an IoT device can have at least one functional entity.
  • Each logical device can have multiple states, such as factory state, configuration state, and working state.
  • the factory state refers to the state of the logical device in the newly purchased IoT device after being powered on.
  • the configuration state refers to the state in which the IoT device can use the OBT tool of the secure domain network to configure the logical device in the IoT device before entering a secure domain network.
  • the configuration state can be the factory state.
  • the working state refers to the state after the logical device in the IoT device is configured by the OBT of the security domain network.
  • the IoT device configured by the OBT device can enter the security domain network and interconnect with the IoT devices in the security domain network. .
  • the logical device in the working state can receive business instructions to change the function settings corresponding to the logical device.
  • the IoT device is an air conditioner, and the air conditioner can correspond to multiple logical devices. Each logical device can correspond to a function of the air conditioner, and the corresponding temperature
  • the logic device can receive temperature commands to change the temperature setting.
  • the logical device in the configuration state is used to wait to be configured by the OBT tool to make it enter the working state.
  • the logical device in the working state can be reset to restore the configuration state.
  • the logical device in the configuration state is in the active state, it can be discovered by the OBT device and configured by the OBT device.
  • the active state When in the active state, When the logical device in the configuration state is in the inactive state, it cannot be discovered by the OBT device and cannot be configured by the OBT device.
  • FIG. 1 exemplarily shows 4 IoT devices.
  • the Internet of Things 100 may include multiple IoT devices, which is not limited in the embodiment of the present application.
  • system and “network” in this article are often used interchangeably in this article.
  • the term “and/or” in this article is only an association relationship describing the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, exist alone B these three situations.
  • the character "/" in this text generally means that the associated objects before and after are in an "or” relationship.
  • the embodiment of the present application proposes a method for configuring, discovering, and joining a security domain.
  • a security domain (SecDomain) resource is added to the logical device to configure and manage the security domain to which the logical device belongs.
  • OBT can configure the security domain information for the logical device by configuring the secDomain resource.
  • the security domain information is discoverable, other logical devices can easily discover the security domain of the logical device by mapping the attribute value to the discovery resource ("res resource" for short) of the logical device.
  • res resource for short
  • Table 1 below shows the characteristics of secDomain resources, which mainly include uniform resource identifier, resource type title, resource type identifier, interface, and description.
  • URI is used to identify and address secDomain resources.
  • the resource type title is used to describe the function of the resource.
  • the resource type identifier is used to distinguish resource types.
  • Interface indicates the resource expression and acquisition mechanism, different interfaces correspond to different resource expressions and corresponding operation mechanisms, such as the baseline type given in Table 1.
  • the description is used to describe the function of the resource.
  • the format of the attribute is determined by the encoding method. For example, in JSON, the attribute is expressed as "attribute name”: value (for example, "sdid”: e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9).
  • the value type defines the value that the attribute value may take.
  • the value type can be a simple data type, such as string, boolean, etc.
  • Value types can also be complex data types defined by a schema.
  • the value type can define the attribute value rules, and the attribute value will adopt these rules and use them in the attribute value.
  • the attribute value rules can define the value range, maximum/minimum value, formula, enumeration value range, mode, and condition These rules can be used to verify the value of the attribute. As shown in Table 2, for example, the value type of the security domain identifier and the security domain name are both "string", and the value type of the security domain discoverability is "boolean".
  • the access mode specifies whether the attribute can be read, written, or readable and writable. For example, “R” means readable, “W” means writable, and “RW” means readable and writable. "W” being writable does not automatically mean that the attribute must be readable.
  • the access mode of the security domain identifier, the security domain name, and the security domain discoverability are all "RW”.
  • the readability description information of the attribute describing the function and use of the attribute.
  • the description of the security domain identifier indicates that the security domain identifier is a universally unique identifier of the security domain and can be accessed through multicast.
  • the description of the discoverability of the security domain indicates: whether the security domain is discoverable; when the property of the security domain discoverability is true (TRUE), the security domain can be discovered; and when the property of the security domain discoverability is false (FALSE) ), the security domain is not discoverable.
  • the secDomain resource can include more than 3 attributes, or less than 3 attributes (for example, it only contains one of the security domain identifier and the security domain name). And security domain discoverability), which is not limited in the embodiment of this application.
  • FIG. 3 is a schematic flowchart of a method for configuring a security domain according to an embodiment of the application. This method can be executed by OBT equipment. By executing the method shown in Figure 3, the security domain configuration of the OBT device itself can be completed.
  • the security domain configuration method includes:
  • Step S310 obtain security domain information
  • Step S320 Perform security domain configuration according to the acquired security domain information.
  • logical devices need to be activated before they can operate on the network or interact with other logical devices.
  • the first step in activating a logical device is to configure device ownership.
  • a legitimate user uses an Owner Transfer Method (Owner Transfer Method, "OTM") to establish equipment ownership through the activation tool (OBT).
  • OBT Owner Transfer Method
  • OBT activation tool
  • OBT can obtain security domain information, such as security domain identifier, security domain name, and security domain discoverability.
  • security domain information can be set by the user, or can be set by loading pre-configured information.
  • OBT can automatically generate a random number as the security domain identifier.
  • OBT can generate a random number based on its own certificate (Certificate Authority, "CA") root certificate, and use the random number as a security domain identifier.
  • CA Certificate Authority
  • the user may be requested to set the security domain identifier, security domain name, and security domain discoverability.
  • an input box may be presented for the user to input a security domain identifier and/or a security domain name.
  • a check box may be presented for the user to select the discoverability of the security domain.
  • this application should not be limited to the examples here, and the existing human-computer interaction methods can be used for the user to set the security domain name and security domain discoverability.
  • the secDomain resource of the OBT device can be configured as follows:
  • the attribute value of the security domain identifier can be mapped to the secdomainuuid of the res resource of the OBT device.
  • the representation of the security domain identifier in the res resource can be:
  • FIG. 4 is a schematic flowchart of a method for configuring a security domain according to an embodiment of the application. This method can be executed by OBT equipment. By executing the method shown in Figure 4, the OBT device can configure the security domain of other IoT devices.
  • the configuration method of the security domain includes:
  • Step S410 obtain security domain information
  • Step S420 Set the security domain information to the device to be configured by sending an instruction carrying the security domain information to the device to be configured.
  • OBT finds the device that needs to be configured in the network (hereinafter referred to as the "device to be configured"), and the device to be configured returns to OBT the owner transfer method it supports, and OBT uses the owner's transfer method and the device to be configured Establish a communication connection.
  • a secure communication connection is established between the OBT device and the device to be configured. This process is similar to the process of activating and establishing a communication connection in the prior art, and will not be repeated here.
  • the security domain information is set in the device to be configured by sending an instruction carrying the security domain information to the device to be configured.
  • the OBT obtains the security domain information configured by itself from the secDomain resource, and sends instructions to the device to be configured.
  • OBT acts as a client
  • the device to be configured acts as a server
  • OBT initiates an Update operation.
  • the Update request message (that is, the aforementioned "instruction") is sent by the OBT to the device to be configured to update the secDomain resource information on the device to be configured.
  • the instruction can be of the following form:
  • This instruction sets the uuid (e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9), name (my home) and discoverability (discoverable) of the security domain to the device to be configured.
  • this instruction is referred to as the "first instruction”
  • the device to be configured using the first instruction is referred to as the "first device”.
  • the instruction can also be in the following form:
  • This instruction sets the uuid (e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9), name (my home), and discoverability (undiscoverable) of the security domain to the device to be configured.
  • this instruction is referred to as the "second instruction”
  • the device to be configured using the second instruction is referred to as the "second device”.
  • OBT In addition to setting the security domain information to the device to be configured, OBT also configures the attributes of other resources of the device to be configured, for example, /oic/sec/doxm resource (used to configure supported OTM modes, selected OTM modes, supported Credential type, identification whether the device owner, device ID, device owner ID, resource owner ID, etc. are created), /oic/sec/cred resource (used to configure the selected credential (including the credential for establishing a secure connection with the CMS, and other equipment Credentials for establishing a secure connection to the local area network), resource owner ID, etc.), etc.
  • /oic/sec/doxm resource used to configure supported OTM modes, selected OTM modes, supported Credential type, identification whether the device owner, device ID, device owner ID, resource owner ID, etc. are created
  • /oic/sec/cred resource used to configure the selected credential (including the credential for establishing a secure connection with the CMS, and other equipment Credentials for establishing a secure connection to the local area network), resource
  • the OBT After completing the configuration of all resources (the device that completes the resource configuration may be referred to as the "configured device” for short), the OBT changes the state of the device to be configured to the working state.
  • OBT is the master of the network, and can configure the interconnection between the client (Client) equipment and the server (Server equipment) in the network. After configuration, the OBT is the owner of the configured device.
  • FIG. 5 is a schematic flowchart of a method for configuring a security domain according to an embodiment of the application. This method can be executed by the device to be configured and executed in conjunction with the security domain configuration method shown in FIG. 4 to complete the configuration of the security domain of the device to be configured.
  • the configuration method of the security domain shown in Figure 5 includes:
  • Step S510 receiving an instruction carrying security domain information
  • Step S520 Perform security domain configuration according to the security domain information in the instruction.
  • the device to be configured executes the owner's transfer handshake and establishes a communication connection with OBT. After the communication connection is established, the instruction carrying the security domain information sent by the OBT via the communication connection is received.
  • the device to be configured serves as the server to receive the UPDATE request message (that is, the above-mentioned "instruction").
  • the device to be configured verifies whether the OBT sending the request has the authority to update related resources. If so, the device to be configured updates the information of the secDomain resource according to the attribute value of the secDomain resource included in the UPDATE request message that needs to be updated.
  • the security domain configuration is performed according to the security domain information in the instruction.
  • the device to be configured maps the sdid attribute to the res resource according to the discoverable attribute value being true.
  • the representation of sdid in res resources can be:
  • the device to be configured since the attribute value of discoverable is false, the device to be configured will not map the sdid attribute to the res resource. In other words, the security domain of the device to be configured that receives the second instruction cannot be discovered by other devices.
  • the device to be configured After receiving the UPDATE request, the device to be configured also caches the identifier of the UPDATE request in the UPDATE request for use in the UPDATE response.
  • the UPDATE response message is sent to the OBT by the device to be configured.
  • the UPDATE response contains at least the identifier of the cached UPDATE request and the updated secDomain resource expression.
  • the security domain configuration methods shown in FIG. 4 and FIG. 5 are executed in cooperation with each other, so that the OBT and the device to be configured can form a security domain network. It is worth noting that in the above example, the OBT and the device to be configured have the same security domain identifier and security domain name. Therefore, the OBT and the device to be configured are in the same security domain network.
  • FIG. 6 is a schematic flowchart of a method for configuring a security domain according to an embodiment of the application. This method can be executed by the main OBT device. In this situation, the master OBT device in the security domain network can perform a security domain configuration on the slave OBT device by executing a configuration method similar to the security domain shown in FIG. 4.
  • the configuration method of the security domain as shown in Figure 6 includes:
  • Step 610 Obtain security domain information
  • Step 620 Set the security domain information to the slave OBT device by sending an instruction carrying the security domain information to the slave OBT device.
  • the main OBT device After the main OBT device is self-activated, when/after the device ownership is configured, the main OBT also creates different roles in various security domain networks, and different roles have different permissions. For example, there are various user roles such as administrator (admin), family member (family), and guest (guest). For another example, an administrator (admin) has the authority to configure and manage other IoT devices in the same secure domain network, and family members (family) have the authority to control other IoT devices in the same secure domain network. In practice, this example should not be used as a limitation. Users can create different roles according to their needs and set different permissions for different roles.
  • the master OBT After the master OBT discovers the slave OBT, it can configure the slave OBT to grant the slave OBT the authority to configure and manage other IoT devices, so that the devices configured from the OBT can also access the secure domain network. It is worth noting that the process of the master OBT granting the slave OBT the authority to configure and manage other IoT devices can be implemented by any process that can implement secondary functions in the prior art, and will not be repeated here.
  • the master OBT device can set the security domain information to the slave OBT device by sending an instruction carrying the security domain information to the slave OBT device. Similar to the security domain configuration method shown in FIG. 4, the master OBT device obtains the security domain information configured by itself from the secDomain resource, and sends instructions to the slave OBT device. At this time, the master OBT device is the client, and the slave OBT device is the server. The request and response process between the master OBT device and the slave OBT device is consistent with the existing CRUDN operation process, and will not be repeated here.
  • FIG. 7 is a schematic flowchart of a method for configuring a security domain according to an embodiment of the application. This method can be executed by the slave OBT device and executed in conjunction with the security domain configuration method shown in FIG. 6 to complete the configuration of the security domain of the slave OBT device. In addition, the slave OBT can also execute a security domain configuration method similar to that shown in FIG. 4 to configure security domains for other devices to be configured.
  • the security domain configuration method includes:
  • Step 710 Receive an instruction carrying security domain information
  • Step 720 Perform security domain configuration according to the security domain information in the instruction
  • Step 730 Obtain security domain information
  • Step 740 Set the security domain information to the device to be configured by sending an instruction carrying the security domain information to the device to be configured.
  • steps 710 and 720 are respectively similar to steps 510 and 520 of the security domain configuration method shown in FIG. 5, and the foregoing steps 730 and 740 are respectively similar to steps 410 and 420 of the security domain configuration method shown in FIG. , I will not repeat them here.
  • the secDomain resource of the slave OBT device can be configured as the same secDomain resource as the master OBT device.
  • it has the following form:
  • the security domain configuration methods shown in FIG. 6 and FIG. 7 are executed in cooperation with each other, so that the master OBT device and the slave OBT device can form a security domain network.
  • the master OBT device and the slave OBT device can use the security domain configuration method shown in FIG. 4 to configure other IoT devices respectively, so that other IoT devices can also access the security domain network.
  • the master OBT device sends the security domain information to the slave OBT device, and the slave OBT device also configures the security domain of itself and other IoT devices based on the security domain information. Therefore, the master OBT device and its configuration Other IoT devices from OBT devices and other IoT devices configured have the same security domain identifier and security domain name.
  • the master OBT device and other IoT devices configured by the slave OBT device and other IoT devices configured by the slave OBT device are in the same secure domain network.
  • the secDomain resource of the OBT device and its configured IoT device (hereinafter referred to as the "third device") can be configured in the following form, for example:
  • the slave OBT device When configuring the security domain, maps the sdid attribute to the res resource according to the discoverable attribute value in the security domain information.
  • the representation of the sdid of the slave OBT device in the res resource can be:
  • the discoverable attribute value in the security domain information is false, and the security domain of the slave OBT device cannot be discovered by other devices.
  • OBT1 and OBT2 can respectively generate random numbers according to their own authentication root certificates, and use the random numbers as security domain identifiers, and users can set the security domain names of OBT1 and OBT2 to be the same or different.
  • the security domain identifier of OBT1 and the security domain identifier of OBT2 are different.
  • OBT1 and its configured IoT devices include slave OBT devices and devices to be configured
  • OBT2 and its configured IoT devices include the slave OBT device and the device to be configured
  • the security domain network is an independent security domain network.
  • the secDomain resource of OBT1 and its configured IoT device (hereinafter referred to as the "fourth device") can be configured in the following form, for example:
  • the secDomain resources of OBT2 and its configured IoT device (hereinafter referred to as the "fifth device") can be configured in the following form, for example:
  • the secDomain resources of OBT2 and its configured IoT device (hereinafter referred to as the "sixth device") can be configured, for example, in the following form:
  • OBT2 maps the sdid attribute to the res resource according to the value of the discoverable attribute in the security domain information.
  • the representation of the sdid of OBT2 in the res resource can be:
  • the Internet of Things devices in the network configure security domain information by executing part or all of the security domain configuration methods in FIGS. 3 to 7 to form at least one security domain network.
  • a new IoT device hereinafter referred to as “discovery device”
  • the security domain discovery method provided in the embodiment of the present application can be executed.
  • FIG. 8 is a schematic flowchart of a method for discovering a security domain provided by an embodiment of this application. This method can be performed by the discovery device.
  • the method for discovering the security domain includes in step S810, obtaining discovery resources of IoT devices in the network.
  • any existing execution resource discovery process can be used. For example, first send a request message for performing resource discovery to other IoT devices in the network, and then receive resource discovery feedback from other IoT devices.
  • the discovery device can send broadcast/multicast messages to other IoT devices in the network to perform resource discovery.
  • the broadcast/multicast message can be a RETRIEVE request message to request the secDomain resource expression on the server.
  • Broadcast/multicast messages can be in the following forms:
  • RETRIEVE RETRIEVE response message carrying res resources to the discovery device.
  • the method for discovering a security domain in this embodiment includes in step S820, obtaining a security domain identifier from a discovery resource.
  • the discovery device receives the RETRIEVE response message carrying the res resource, and obtains the security domain identifier from the res resource in the RETRIEVE response message.
  • the security domain of the second device in the foregoing example cannot be discovered, the discovery device cannot obtain the security domain identifier of the second device from the res resource of the second device.
  • the discovery device After the discovery device obtains the security domain identifier, it can determine the security domain corresponding to the security domain identifier in the network in step 830. After determining the security domains that exist in the network, the security domains can be saved for subsequent use, or displayed for users to view.
  • the security domain identifier can be directly saved or displayed for the user to choose whether to join.
  • the security domain identifiers can be compared. When the security domain identifiers are the same, it is determined that a security domain exists in the network. When the security domain identifiers are different, it is determined that there are multiple security domains in the network. There are as many security domains as there are different security domain identifiers. Further, the security domain identifier can be used to indicate the security domain existing in the network, and the security domain identifier can be displayed for the user to view or select the security domain to join.
  • FIG. 9 is a schematic flowchart of a method for discovering a security domain according to an embodiment of this application. This method can be performed by the discovery device. In order to facilitate the user to view the security domains existing in the network, the corresponding security domain name may be further obtained according to the security domain identifier.
  • the discovery method of the security domain includes:
  • Step S910 Obtain discovery resources of IoT devices in the network
  • Step S920 Obtain a security domain identifier from the discovery resource
  • Step S930 Determine the security domain existing in the network according to the security domain identifier
  • Step S940 Acquire the security domain name corresponding to the security domain identifier from the IoT device according to the security domain identifier;
  • Step S950 according to the security domain identifier and the corresponding security domain name, indicate the security domain existing in the network.
  • steps 910 to 930 are respectively consistent with steps 810 to 830 of the security domain discovery method shown in FIG. 8 and will not be repeated here.
  • the discovery device After the discovery device obtains the security domain identifier, it can also obtain the security domain name corresponding to the security domain identifier from the IoT device according to the obtained security domain identifier. Specifically, a request message for obtaining the security domain name corresponding to the security domain identifier may be sent to other IoT devices. For example, the discovery device sends a RETRIEVE request message to the first device to request the security domain name in the secDomain resource on the first device. At this time, the RETRIEVE request message can be in the following form:
  • the first device After receiving the RETRIEVE request, the first device sends a RETRIEVE response message carrying its own security domain name to the discovery device. For example, send "my home" to the discovered device.
  • the discovery device also receives the security domain name fed back by other IoT devices.
  • the security domain name can be used to indicate the security domain existing in the network. Because, as mentioned above, the security domain name is generally set by the user and is easier to be recognized by the user. Therefore, using the security domain name to indicate the security domain existing in the network can facilitate the user to view or select the security domain to join. Specifically, when it is determined that there is a security domain in the network, the security domain name can be used to represent the security domain. When it is determined that there are multiple security domains in the network, and the multiple security domains have different security domain names, each security domain name can be used to represent the multiple security domains. When it is determined that there are multiple security domains in the network, and the multiple security domains have the same security domain name, the security domain identifier and the corresponding security domain name are used to indicate the multiple security domains.
  • the security domain names can be directly presented to the user. As mentioned above, if only the first device sends "my home” to the discovered device, then “my home” can be directly presented to the user.
  • the security domain name can be directly presented to the user.
  • the first device and the third device can respectively send "e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9" and the corresponding "my home" to the discovered device. Since the security domain identifier and the security domain name are respectively the same, although there are two sets of security domain identifiers and their corresponding security domain names, the security domain name ("my home") can also be directly presented to the user.
  • security domain identifier and the security domain name are both different, it is determined that there are two security domain networks, and different security domain identifiers and their corresponding security domain names can be presented to the user.
  • the above fourth device sends "e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9” and the corresponding "my home” to the discovered device
  • the above fifth device sends "61c74915-6491-12d2-7934-1da81f1ce27d” and the corresponding to the discovered device.
  • "My room" Since the security domain identifier and security domain name are not the same, the comparison result (including "e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9” and the corresponding "my home", 61c74915-6491-12d2-7934-1da81f1ce27d" and The corresponding "my room") is presented to the user.
  • the security domain identifier may not be presented, and only the security domain names, namely "my home” and "my room", are presented to the user.
  • the above fourth device sends "e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9" and the corresponding "my home” to the discovered device, and the above sixth device sends "61c74915-6491-12d2-7934-1da81f1ce27d” and the corresponding to the discovered device. "My home”.
  • FIG. 10 is a schematic flowchart of a method for joining a security domain provided by an embodiment of this application. This method can be performed by the discovery device. After the discovery device obtains the security domain information (including the security domain identifier or the security domain name) of the security domain existing in the network, it can present the security domain information for the user to select.
  • the security domain information including the security domain identifier or the security domain name
  • the joining method of a security domain includes:
  • Step 1010 request the user to select the security domain to join
  • Step 1020 Start an instance of the security domain according to the security domain selected by the user.
  • the discovery device obtains the security domain information of the security domain existing in the network.
  • the discovery device can present the security domain information to the user, requesting the user to select which security domain network the discovery device joins.
  • the discovery device After receiving the user's selection, start the instance of the security domain. Specifically, if the instance of the security domain selected by the user exists in the configured instance of the security domain, switch to the instance of the security domain. If there is no instance of the security domain selected by the user among the configured security domain instances, an instance that can be used for the security domain selected by the user is generated. In other words, the discovery device checks the security domain information of the instance that it has opened, and if it determines that there is an instance of the security domain selected by the user, it switches to that instance. Or, the discovery device determines that the instance of the security domain selected by the user is inconsistent with the configured security domain itself, and generates a new client instance that can be used in the security domain selected by the user.
  • Each of the above instances is an independent logical client device.
  • a client application can run multiple logical client devices, and each device can correspond to a different security domain.
  • the client instance is in the initialization state, waiting for activation and configuration.
  • the OBT in the network can activate and configure the client instance to join the security domain where the OBT is located.
  • FIG. 11 is a schematic flowchart of a method for discovering a security domain according to an embodiment of this application. This method can be executed by an IoT device that has completed the security domain configuration in the network, and feeds back the security domain information to the discovery device that executes the security domain discovery method shown in FIG. 8.
  • the discovery method of the security domain includes:
  • Step S1110 in response to the received request message for performing resource discovery, feed back the resource discovery
  • Step S1120 in response to the received request message for obtaining the security domain name corresponding to the security domain identifier, feed back the security domain name.
  • the IoT device in the network acts as a server to verify whether the client sending the request has the authority to obtain the required resource and whether the relevant attributes of the resource are readable. If so, the server sends a RETRIEVE response message carrying res resources to the discovery device. After receiving the request to obtain the security domain name, the security domain name of its own is fed back to the discovery device.
  • the example of the instruction involves the UPDATE operation, which is for the situation where the secDomain resource has been set in the IoT device.
  • the OBT can use the CREATE operation in the CRUDN operation to initiate the request, and the device to be configured responds to the CREATE request message, according to the first security domain information carried in the CREATE request message, Create a secDomain resource.
  • the communication process of the aforementioned CRUDN operation is similar to the prior art, except that the request message and the corresponding message carry parameters related to the secDomain resource.
  • the communication process of CRUDN operation is not described in detail here.
  • the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not correspond to the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • FIG. 12 is a first schematic interaction scenario between IoT devices according to an embodiment of the present application.
  • Mom’s mobile phone APP is used as an OBT, then it will first activate and configure itself.
  • Device1 and Device2 There are two devices in the network, Device1 and Device2, and OBT configures the two devices separately and sets the security domain information.
  • OBT and Device1 and Device2 form a secure domain network in the home.
  • Dad's mobile app entered the home network.
  • Dad's mobile app discovers controllable devices and finds their corresponding security domains.
  • FIG. 13 shows a second schematic interaction scenario between IoT devices according to an embodiment of the present application.
  • Mom's mobile phone APP is used as the main OBT, and it will first self-activate and configure itself.
  • Son’s mobile app is configured as a slave OBT by Mom’s mobile app.
  • Mom’s mobile app configures its own security domain information to Son’s mobile app.
  • the master and slave OBT configure the two devices and set the security domain information.
  • the master OBT, slave OBT and Device1 and Device2 form a secure domain network in the home.
  • Dad's mobile app entered the home network.
  • Dad's mobile app discovers controllable devices and finds their corresponding security domains.
  • FIG. 14 illustrates a third schematic interaction scenario between IoT devices according to an embodiment of the present application.
  • Mom’s mobile phone APP is used as OBT1, and it will first self-activate and configure itself.
  • Son's mobile APP is also used as OBT2, self-activating and configuring itself.
  • Mom’s mobile phone APP and Son’s mobile phone APP respectively configure the two devices and set the security domain information.
  • OBT1 and Device1, OBT2 and Device2 respectively form two independent security domain networks in the family.
  • Dad's mobile app entered the home network.
  • Dad's mobile app discovers controllable devices and finds their corresponding security domains.
  • FIG. 15 shows a fourth schematic interaction scenario between IoT devices according to an embodiment of the present application.
  • Mom’s mobile phone APP is used as OBT1, and it will first self-activate and configure itself.
  • Son's mobile APP is also used as OBT2, self-activating and configuring itself.
  • Mom’s mobile phone APP and Son’s mobile phone APP respectively configure the two devices and set the security domain information.
  • OBT1 and Device1, OBT2 and Device2 respectively form two independent security domain networks in the family.
  • Dad's mobile app entered the home network.
  • Dad's mobile app discovers controllable devices and finds their corresponding security domains.
  • the device for configuring a security domain includes: an acquisition module 1610 and a configuration module 1620.
  • the obtaining module 1610 is used to obtain security domain information.
  • the configuration module 1620 is configured to perform security domain configuration according to the acquired security domain information.
  • the security domain information includes at least: security domain identifier, security domain name, and security domain discoverability.
  • the obtaining module is further configured to obtain the security domain information in the following methods:
  • the user is requested to set the discoverability of the security domain.
  • the acquiring module is further configured to: when automatically generating a random number as the security domain identifier, generate a random number according to its own authentication root certificate, and use the random number as the Security domain identifier.
  • the acquisition module is further configured to: receive an instruction carrying the security domain information; accordingly, the configuration module is further configured to: according to the security domain information in the instruction, Perform security domain configuration.
  • the configuration module is further configured to: map the security domain identifier to a discovery resource according to the attribute value of the security domain discoverability as discoverable.
  • the configuration module is further configured to set the security domain information in the device to be configured by sending an instruction carrying the security domain information to the device to be configured.
  • the device for discovering a security domain includes: a first acquiring module 1710, a second acquiring module 1720, and a determining module 1730.
  • the first obtaining module 1710 is used to: obtain the discovery resource of the Internet of Things (IoT) device in the network; the second obtaining module 1720 is used to: obtain the security domain identifier from the discovery resource; the determining module 1730 is used to determine the The security domain corresponding to the security domain identifier in the network.
  • the IoT device has been configured with security domain information, and the security domain information includes at least: a security domain identifier, a security domain name, and a security domain discoverability.
  • the device further includes a third acquiring module 1740.
  • the third obtaining module is configured to obtain the security domain name corresponding to the security domain identifier from the IoT device according to the security domain identifier obtained by the second obtaining module.
  • the third acquiring module 1740 includes a sending sub-module 1741 and a receiving sub-module 1742.
  • the sending submodule 1741 is configured to send a request message for obtaining the security domain name corresponding to the security domain identifier to the IoT device.
  • the receiving submodule 1742 is configured to receive the security domain name fed back by the IoT device.
  • the determination module includes a comparison sub-module 1731 and a determination sub-module 1732.
  • the comparison submodule 1731 is configured to compare the security domain identifiers when the security domain identifiers are obtained from at least two IoT devices.
  • the determining sub-module 1732 is configured to determine that one security domain exists in the network when the security domain identifiers are the same; when the security domain identifiers are different, determine that there are multiple security domains in the network.
  • the determining module further includes a presentation submodule 1733.
  • the sub-module 1733 is used to:
  • the security domain identifier and the corresponding security domain name are used to represent the multiple security domains.
  • the security domain discovery apparatus discovers that the security domain information is configured through some or all of the methods shown in FIGS. 3 to 7.
  • the discovery device of the security domain includes: a first feedback module 1810 and a second feedback module 1820.
  • the first feedback module 1810 is configured to: in response to a received request message for performing resource discovery, feed back the discovered resource; the second feedback module 1820 is configured to: respond to the received request message for performing resource discovery; The request message of the security domain name is fed back to the security domain name.
  • the security domain information includes at least: security domain identifier, security domain name, and security domain discoverability; when the attribute value of the security domain discoverability characterizes the discovery, the discovery resource includes the security Domain identifier.
  • the device for joining a security domain includes a request module 1910 and an activation module 1920.
  • the request module 1910 is used to request the user to select the security domain to join.
  • the activation module 1920 is configured to activate an instance of the security domain according to the security domain selected by the user. Wherein, the security domain is discovered by the method shown in FIG. 8 or 9.
  • the starting module 1820 is further configured to:
  • FIG. 20 is a schematic structural diagram of an electronic device 2000 provided by an embodiment of the present application.
  • the electronic device shown in FIG. 20 includes a processor 2010, and the processor 2010 can call and run a computer program from the memory to implement the method in the embodiment of the present application.
  • the electronic device 2000 may further include a memory 2020.
  • the processor 2010 can call and run a computer program from the memory 2020 to implement the method in the embodiment of the present application.
  • the memory 2020 may be a separate device independent of the processor 2010, or may be integrated in the processor 2010.
  • the electronic device 2000 may further include a transceiver 2030, and the processor 2010 may control the transceiver 2030 to communicate with other devices. Specifically, it may send information or data to other devices, or receive other devices. Information or data sent by the device.
  • the transceiver 2030 may include a transmitter and a receiver.
  • the transceiver 2030 may further include an antenna, and the number of antennas may be one or more.
  • the electronic device 2000 may specifically be an Internet of Things device of an embodiment of the present application, and the electronic device 2000 may implement corresponding processes in each method of the embodiments of the present application. For brevity, details are not described herein again.
  • the electronic device in this embodiment may be, but is not limited to, a terminal device or a network device.
  • the "terminal device” used here includes, but is not limited to, via wireless interfaces, such as cellular networks, wireless local area networks (WLAN), digital TV networks such as DVB-H networks, satellite networks, AM-FM Broadcast transmitter; and/or another terminal device that is set to receive/send communication signals; and/or Internet of Things (IoT) equipment.
  • a terminal device set to communicate through a wireless interface may be referred to as a "wireless communication terminal", a “wireless terminal” or a "mobile terminal".
  • Examples of mobile terminals include, but are not limited to, satellite or cellular phones; Personal Communications System (PCS) terminals that can combine cellular radio phones with data processing, fax, and data communication capabilities; can include radio phones, pagers, Internet/intranet PDA with internet access, web browser, memo pad, calendar, and/or Global Positioning System (GPS) receiver; and conventional laptop and/or palmtop receivers or others including radio telephone transceivers Electronic device.
  • Terminal equipment can refer to access terminals, user equipment (UE), user units, user stations, mobile stations, mobile stations, remote stations, remote terminals, mobile equipment, user terminals, terminals, wireless communication equipment, user agents, or User device.
  • the access terminal can be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a wireless local loop (Wireless Local Loop, WLL) station, a personal digital processing (Personal Digital Assistant, PDA), with wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in 5G networks, or terminal devices in the future evolution of PLMN, etc.
  • the network device can provide communication coverage for a specific geographic area, and can communicate with terminal devices located in the coverage area.
  • the network equipment may be a base station (Base Transceiver Station, BTS) in a GSM system or a CDMA system, a base station (NodeB, NB) in a WCDMA system, or an evolved base station (Evolutional Base Station) in an LTE system.
  • BTS Base Transceiver Station
  • Node B, eNB or eNodeB or a wireless controller in Cloud Radio Access Network (CRAN)
  • the network equipment can be a mobile switching center, a relay station, an access point, a vehicle-mounted device, or a wearable Devices, hubs, switches, bridges, routers, network-side devices in 5G networks, or network devices in the future evolution of the Public Land Mobile Network (PLMN), etc.
  • PLMN Public Land Mobile Network
  • FIG. 21 is a schematic structural diagram of a chip of an embodiment of the present application.
  • the chip 2100 shown in FIG. 21 includes a processor 2110, and the processor 2110 can call and run a computer program from the memory to implement the method in the embodiment of the present application.
  • the chip 2100 may further include a memory 2120.
  • the processor 2110 may call and run a computer program from the memory 2120 to implement the method in the embodiment of the present application.
  • the memory 2120 may be a separate device independent of the processor 2110, or may be integrated in the processor 2110.
  • the chip 2100 may further include an input interface 2130.
  • the processor 2110 can control the input interface 2130 to communicate with other devices or chips, and specifically, can obtain information or data sent by other devices or chips.
  • the chip 2100 may further include an output interface 2140.
  • the processor 2110 can control the output interface 2140 to communicate with other devices or chips, and specifically, can output information or data to other devices or chips.
  • the chip can be applied to the Internet of Things devices in the embodiments of the present application, and the chip can implement the corresponding processes in the various methods of the embodiments of the present application.
  • the chip can implement the corresponding processes in the various methods of the embodiments of the present application.
  • the chip mentioned in the embodiment of the present application may also be called a system-level chip, a system-on-chip, a system-on-chip, or a system-on-chip.
  • the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capability.
  • the steps of the foregoing method embodiments may be completed by hardware integrated logic circuits in the processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (ASIC), a ready-made programmable gate array (Field Programmable Gate Array, FPGA) or other Programming logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • DSP Digital Signal Processor
  • ASIC application specific integrated circuit
  • FPGA Field Programmable Gate Array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), and electrically available Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be a random access memory (Random Access Memory, RAM), which is used as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • DDR SDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • Enhanced SDRAM, ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • Synchronous Link Dynamic Random Access Memory Synchronous Link Dynamic Random Access Memory
  • DR RAM Direct Rambus RAM
  • the memory in the embodiment of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), Synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection Dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM) and so on. That is to say, the memory in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.
  • the embodiments of the present application also provide a computer-readable storage medium for storing computer programs.
  • the computer-readable storage medium can be applied to the network device in the embodiment of the present application, and the computer program causes the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • the computer program causes the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • the computer-readable storage medium can be applied to the mobile terminal/terminal device in the embodiment of the present application, and the computer program causes the computer to execute the corresponding process implemented by the mobile terminal/terminal device in each method of the embodiment of the present application , For the sake of brevity, I won’t repeat it here.
  • the embodiments of the present application also provide a computer program product, including computer program instructions.
  • the computer program product can be applied to the network device in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application. Repeat it again.
  • the computer program product can be applied to the mobile terminal/terminal device in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding process implemented by the mobile terminal/terminal device in each method of the embodiment of the present application, For the sake of brevity, I will not repeat them here.
  • the embodiment of the present application also provides a computer program.
  • the computer program can be applied to the network device in the embodiment of the present application.
  • the computer program runs on the computer, it causes the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • I won’t repeat it here.
  • the computer program can be applied to the mobile terminal/terminal device in the embodiment of the present application.
  • the computer program runs on the computer, the computer can execute each method in the embodiment of the present application. For the sake of brevity, the corresponding process will not be repeated here.
  • the disclosed system, device, and method can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the present application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory,) ROM, random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Small-Scale Networks (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例涉及安全域的配置和发现方法以及装置、电子设备。本申请的实施例中，通过在物联网设备中增加安全域资源，用以配置和管理设备所归属的安全域，提供了一种对网络中存在的物联网安全域进行配置的解决方案。当安全域信息可发现时，可通过将属性值映射到设备的发现资源，可以简化资源发现过程，使其他设备可便捷地发现和获得网络中的安全域信息。此外，网络中存在多个安全域时，可通过发现的安全域信息区分不同的安全域。

Description

安全域的配置、发现和加入方法及装置、电子设备 技术领域
本申请涉及通信领域，尤其涉及安全域的配置、发现和加入方法、电子设备。
背景技术
物联网(Internet of things，简称"IoT")即"万物相连的互联网"，是互联网基础上的延伸和扩展的网络，将各种信息传感设备与互联网结合起来而形成的一个巨大网络，实现在任何时间、任何地点，人、机、物的互联互通。但是，物联网的这种"万物互联"的属性，也使物联网硬件、软件及其系统中的数据极易由于偶然的或者恶意的原因而遭到破坏、更改和泄露。随着物联网技术的快速发展，物联网安全也显得愈发的重要。
安全域网络是一种具体的物联网的网络，该安全域网络具有独立的安全协议(或安全机制)，在该安全域网络中的物联网设备可以互联、互通、互相发现以及相互传输指令。在该安全域网络之外的设备，由于受到该安全域网络中的安全协议限制，因此无法访问该安全域网络内的其他物联网设备。安全域网络可以是局域网的子网络，局域网可以具有至少一个安全域网络，该至少一个安全域网络通过一个接入点设备设置于该局域网中，该至少一个安全域网络可以分别具有独立的安全协议。
现有方案中，客户端设备在进入局域网网络时，需要经过多次设备交互，无法方便快捷地找到网络中存在的物联网安全域。并且，在同一网络中存在多个安全域的情况下，较难对这些安全域加以区分。
发明内容
本申请实施例提供一种安全域的配置、发现和加入方法、电子设备，给出了一种对网络中存在的物联网安全域进行配置的解决方案，可以简化资源的发现过程，使得客户端设备可便捷地发现和获得网络中的安全域信息。
第一方面，提供了一种安全域的配置方法，包括：获取安全域信息；并根据获取的所述安全域信息进行安全域配置。其中，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性。
第二方面，提供了一种安全域的发现方法，包括：
获取网络中物联网IoT设备的发现资源；
从所述发现资源中获取安全域标识符；
确定存所述网络中安全域标识符对应的安全域；
其中，所述IoT设备已配置安全域信息，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性。
第三方面，提供了一种安全域的发现方法，由通过前述第一方面所述的安全域的配置方法配置了安全域信息的物联网设备执行，包括：响应于接收到的用于执行资源发现的请求消息，反馈发现资源；响应于接收到的用于获得安全域标识符对应的安全域名称的请求消息，反馈所述安全域名称；其中，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性；在所述安全域可发现性的属性值表征可发现时，所述发现资源中包括所述安全域标识符。
第四方面，提供了一种安全域的加入方法，包括：
请求用户选择欲加入的安全域；其中，供所述用户选择的安全域为通过前述第二方面所述的方法发现的安全域；
根据用户选择的所述安全域，启动所述安全域的实例。
第五方面，提供了一种安全域的配置装置，包括：
获取模块，用于获取安全域信息；
配置模块，用于根据获取的所述安全域信息进行安全域配置；
其中，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性。
第六方面，提供了一种安全域的发现装置，包括：
第一获取模块，用于获取网络中物联网IoT设备的发现资源；
第二获取模块，用于从所述发现资源中获取安全域标识符；
确定模块，用于确定所述网络中所述安全域标识符对应的安全域；
其中，所述IoT设备已配置安全域信息，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性。
第七方面，提供了一种安全域的发现装置，通过前述第五方面所述的安全域的配置装置配置了安全域信息，包括：
第一反馈模块，用于响应于接收到的用于执行资源发现的请求消息，反馈发现资源；
第二反馈模块，用于响应于接收到的用于获得安全域标识符对应的安全域名称的请求消息，反馈所述安全域名称；
其中，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性；在所述安全域可发现性的属性值表征可发现时，所述发现资源中包括所述安全域标识符。
第八方面，提供了一种安全域的加入装置，包括：
请求模块，用于请求用户选择欲加入的安全域；其中，供所述用户选择的安全域为通过前述第六方面所述的装置发现的安全域；
启动模块，用于根据用户选择的所述安全域，启动所述安全域的实例。
第九方面，提供了一种电子设备，用于执行上述第一方面或其各实现方式中的方法。具体地，该电子设备包括用于执行上述第一方面或其各实现方式中的方法的功能模块。
第十方面，提供了一种电子设备，包括处理器和存储器。该存储器用于存储计算机程序，该处理器用于调用并运行该存储器中存储的计算机程序，执行上述第一方面至第四方面中的任一方面或其各实现方式中的方法。
第十一方面，提供了一种芯片，用于实现上述第一方面至第三方面中的任一方面或其各实现方式中的方法。具体地，该芯片包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有该芯片的设备执行如上述第一方面至第四方面中的任一方面或其各实现方式中的方法。
第十二方面，提供了一种计算机可读存储介质，用于存储计算机程序，该计算机程序使得计算机执行上述第一方面至第四方面中的任一方面或其各实现方式中的方法。
第十三方面，提供了一种计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行上述第一方面至第四方面中的任一方面或其各实现方式中的方法。
第十四方面，提供了一种计算机程序，当其在计算机上运行时，使得计算机执行上述第一方面至第四方面中的任一方面或其各实现方式中的方法。
通过上述技术方案，可以对网络中存在的物联网安全域进行配置，可以简化资源发现过程，使得客户端设备可便捷地发现和获得网络中的安全域信息。
附图说明
图1是本申请实施例应用的物联网的示意图。
图2是根据本申请实施例提供的物联网设备的协议架构的示意图。
图3是根据本申请一个具体实施例的安全域的配置方法的示意性流程图。
图4是根据本申请的另一个具体实施例的安全域的配置方法的示意性流程图。
图5是根据本申请的又一个具体实施例的安全域的配置方法的示意性流程图。
图6是根据本申请的再一个具体实施例的安全域的配置方法的示意性流程图。
图7是根据本申请的还一个具体实施例的安全域的配置方法的示意性流程图。
图8是根据本申请的一个具体实施例的安全域的发现方法的示意性流程图。
图9是根据本申请的另一个具体实施例的安全域的发现方法的示意性流程图。
图10是根据本申请的一个具体实施例的安全域的加入方法的示意性流程图。
图11是根据本申请的另一个具体实施例的安全域的发现方法的示意性流程图。
图12是根据本申请实施例的各IoT设备之间的一种交互场景示意图。
图13是根据本申请实施例的各IoT设备之间的另一种交互场景示意图。
图14是根据本申请实施例的各IoT设备之间的又一种交互场景示意图。
图15是根据本申请实施例的各IoT设备之间的再一种交互场景示意图。
图16是根据本申请的一个具体实施例的安全域的配置装置的示意性框图。
图17是根据本申请的一个具体实施例的安全域的发现装置的示意性框图。
图18是根据本申请的又一个具体实施例的安全域的发现装置的示意性框图。
图19是根据本申请的一个具体实施例的安全域的加入装置的示意性框图。
图20是本申请实施例提供的一种电子设备的示意性框图。
图21是本申请实施例提供的一种芯片的示意性框图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
参考图1，图1以框图形式示出了示例物联网。该物联网可以是一个点对点的网络。运行物联网协议实例的电子设备可以加入物联网，这种电子设备可以称为物联网设备(以下简称"IoT设备")。
IoT设备遵循物联网设备核心协议。图2所示为示例的IoT设备核心协议架构，例如，RESTful架构(表述性状态转移(英文：Representational State Transfer，简称REST)描述了一个架构样式的网络系统，指的是一组架构约束条件和原则，满足这些约束条件和原则的应用程序或设计就是RESTful)。
在图2所示的协议架构中，服务层定义设备的服务框架，统一规范IoT设备模型。具体地，通过资源来表述物联网实体设备，以及设备提供的功能服务和设备的状态等信息。提供资源的设备是服务端，访问资源的设备是客户端。客户端和服务端是逻辑功能实体。一个设备可以是客户端或服务端，或者一个设备既是客户端又是服务端。例如，实现某项最基本功能的设备(例如灯泡)可以只做服务端，提供给客户端进行查询和控制，本身无控制或者查询其他设备的需求。
客户端和服务端的业务交互是通过对资源进行RESTful操作，例如，创建(Create)、读取(Retrieve)、更新(Update)、删除(Delete)和通知(Notify)(这些操作方法统称为"CRUDN操作")，来实现。客户端是RESTful操作的发起方，服务端是RESTful操作的响应方。客户端向服务端发送资源操作请求，请求对服务端上的资源进行操作。服务端执行资源操作，并向客户端返回响应，响应中携带资源的内容及描述信息。
在图2所示的协议架构中，对资源的描述为资源模型层，每个资源对应一个特定的统一资源标识符(Uniform Resource Identifier，简称"URI")，可通过访问资源的URI来访问这个资源，另外每个资源具有支持Restful操作的相应接口。传输资源内容及描述信息的是传输协议层，通过把资源操作映射到具体的传输协议中，使每个资源的Restful操作转变为实体消息在设备间传递，为设备间的互联互通提供手段。
在图2所示的协议架构中，可以采用，例如，受限应用程序(Constrained Application Protocol，简称"CoAP")协议，来承载资源操作。每个CRUDN操作都映射为CoAP协议的请求/响应消息，客户端设备可以通过CoAP协议中的获取(GET)、新建(POST)、更新(PUT)、删除(DELETE)这四种方法对服务端的资源进行操作，从而实现资源状态的转换。但本申请采用的承载协议并不限于CoAP协议，还可以采用其他协议，例如消息队列遥测传输(Message Queuing Telemetry Transport，简称"MQTT")协议和超文本传输协议(Hyper Text Transfer Protocol，简称"HTTP")等主流承载协议，在此不一一举例说明。
IoT设备之间可以使用合适的通信技术彼此连接，所述通信技术可以包括有线和无线通信技术。这种通信遵循与物联网相关的协议。在图2所示的协议架构中，连接层可以支持例如WiFi、以太网、无线网状网络(Thread)、蓝牙(bluetooth)和紫蜂(zigbee)等多种不同的低层网络。但本申请不应以此处的举例为限制，其他与物联网相关的通信协议也应落入本申请的保护范围之内。
至少一些IoT设备上可以设置有激活工具(Onboarding Tool，简称"OBT")。OBT是安全协议中的一个角色，是用于配置该安全协议所设置在的安全域网络中IoT设备的工具。OBT可以在安全域网络中的至少一个IoT设备上运行，设置有OBT的IoT设备可以称为OBT设备(例如图1所示)。该OBT设备可以用于配置其自身，也可以用于配置其所在的安全域网络中的其他IoT设备。该OBT设备配置的IoT设备可以组成一个安全域网络。在一个安全域网络中，主OBT只有一个，可以有多个从OBT。
每个IoT设备中均可以包括一个或多个逻辑设备(Device)，每个逻辑设备可以具有多个设备实例(Device instance)，每个逻辑设备中只有一个设备实例处于激活(active)态，该逻辑设备中的其他设备实例处于非激活(inactive)态。处于激活态的设备实例使其所在的逻辑设备能被安全域网络下的其他IoT设备的逻辑设备发现、配置以及访问，相反的，非激活态的设备实例所在的逻辑设备则无法被安全域网络下的其他IoT设备的逻辑设备发现、配置以及访问。
逻辑设备可以根据安全域的使用需求建立，在本申请实施例中，IoT设备(复合型的多功能设备或者单一功能设备)中的一个功能可以是一个逻辑设备，逻辑设备可以理解为控制IoT设备的软件的功能实体，一个IoT设备上可以具有至少一个功能实体。
每个逻辑设备可以具有多种状态，例如出厂状态、配置状态以及工作状态。其中，出厂状态指的是新购买的IoT设备中的逻辑设备在加电之后所处的状态。配置状态指的是IoT设备在进入一个安全域网络之前，能够使用该安全域网络的OBT工具对该IoT设备中的逻辑设备进行配置的状态，配置状态可以为出厂状态。工作状态指的是IoT设备中的逻辑设备被该安全域网络的OBT配置好之后的状态，被OBT设备配置好的IoT设备能够进入该安全域网络，与该安全域网络中的IoT设备互联互通。处于工作状态的逻辑设备可以接收业务指令，以改变该逻辑设备对应的功能设置，例如，IoT设备为空调，空调可以对应多个逻辑设备，每个逻辑设备可以对应空调的一个功能，对应温度的逻辑设备可以接收温度指令来改变温度设置。处于配置状态的逻辑设备用于等待被OBT工具配置以使其进入工作状态。处于工作状态的逻辑设备可以通过重置(reset)来恢复配置状态，当处于配置状态的逻辑设备处于激活态的时候，其可以被OBT设备发现并可被该OBT设备配置，相反的，当处于配置状态的逻辑设备处于非激活态的时候，其则无法被OBT设备发现并无法被该OBT设备配置。
图1示例性地示出了4个IoT设备，可选地，物联网100可以包括多个IoT设备，本申请实施例对此不做限定。
应理解，本文中术语"系统"和"网络"在本文中常被可互换使用。本文中术语"和/或"，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符"/"，一般 表示前后关联对象是一种"或"的关系。
在上述相关技术的基础上，如何对网络中存在的物联网安全域进行配置，以简化资源发现过程，使得客户端设备可便捷地发现和获得网络中的安全域信息，是目前需要解决的问题。
因此，本申请实施例提出了一种安全域的配置、发现和加入方法。
在本申请提供的实施例中，在逻辑设备中增加一个安全域(SecDomain)资源，用以配置和管理逻辑设备所归属的安全域。逻辑设备激活(onboarding)后，OBT可通过配置secDomain资源为逻辑设备配置安全域信息。当安全域信息可发现时，可通过将属性值映射到逻辑设备的发现资源(简称"res资源")使其他逻辑设备可以方便地发现该逻辑设备的安全域。网络中存在多个安全域时，可通过发现的安全域信息区分不同的安全域。
以下表1所示为secDomain资源的特征，主要包括统一资源标识符、资源类型标题、资源类型标识符、接口和描述。其中，URI用于对secDomain资源进行标识和寻址。资源类型标题用于说明资源的功能。资源类型标识符用于区分资源类型。接口(interface)表明资源的表述和获取的机制，不同的接口对应资源不同的表述以及对应的操作机制，例如表1中给出的基线(baseline)类型。描述用于说明资源的功能。
表1
Figure PCTCN2020073059-appb-000001
示例地，secDomain资源的属性定义如表2所示。属性用于描述资源的相关信息，包括该资源的元数据。属性以<属性名>＝<属性值>键值对的形式出现。例如，"安全域标识符"属性有一个属性名"sdid"和一个属性值"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"，则该属性就表达为"sdid＝e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"。属性的格式是由编码方式决定的，例如在JSON中属性表示为"属性名":值(例如，"sdid":e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9)。
表2
Figure PCTCN2020073059-appb-000002
除此之外，值类型定义了属性值可能采用的值。值类型可为简单数据的类型，如字符串(string)，布尔值(boolean)等。值类型也可以是由一个架构(schema)定义的复杂数据类型。值类型可以定义属性值规则，属性值会采用这些规则，将其用于属性值中，属性值规则可以定义值的范围、最大/最小值、公式、枚举值的取值范围、模式、条件值、甚至对其他属性的属性值的依赖关系，这些规则可以用于验证属性值。如表2所示，示例地， 安全域标识符和安全域名称的值类型均为"string"，而安全域可发现性的值类型为"boolean"。
访问模式指定属性是否可以被读取、写入、或者可读可写。比如，"R"代表可读、"W"代表可写，"RW"代表可读可写。"W"可写并不自动表示该属性一定可读。示例地，安全域标识符、安全域名称和安全域可发现性的访问模式均为"RW"。
属性的可读性描述信息，描述属性的作用和使用。例如，安全域标识符的描述表明：安全域标识符是安全域的通用唯一标识符，可通过多播(multicast)访问。安全域可发现性的描述表明：安全域是否可发现；当安全域可发现性的属性值为真(TRUE)时，安全域可发现；而当安全域可发现性的属性值为假(FALSE)时，安全域不可发现。
表2所示secDomain资源的属性有3个，可选地，secDomain资源可以包括比3个多的属性，或者比3个少的属性(例如，仅包含安全域标识符和安全域名称中的一个和安全域可发现性)，本申请实施例对此不做限定。
图3为本申请实施例提供的一种安全域的配置方法的示意性流程图。该方法可以由OBT设备执行。通过执行图3所示的方法，可以完成OBT设备自身的安全域配置。
如图3所示，安全域的配置方法包括：
步骤S310，获取安全域信息；
步骤S320，根据获取的安全域信息进行安全域配置。
如上所述，逻辑设备需要激活后才能在网络中操作或与其他逻辑设备进行交互。激活逻辑设备的第一步是配置设备所有权。合法用户通过激活工具(OBT)使用一种业主转移方法(Owner Transfer Method，简称"OTM")建立设备所有权。所有权建立后，再使用OBT进行设备配置，最终使该逻辑设备能够正常操作并与其他逻辑设备交互。
在OBT设备自激活后，配置设备所有权时/之后，OBT可以获取安全域信息，例如安全域标识符、安全域名称以及安全域可发现性。可选地，安全域信息可以由用户设置，或者可以通过加载预先配置的信息进行设置。
对于安全域标识符，为了安全性，可以由OBT自动生成随机数作为安全域标识符。例如，OBT可以根据自身的认证(Certificate Authority，简称"CA")根证书产生随机数，并将该随机数作为安全域标识符。
示例地，可以请求用户设置安全域标识符、安全域名称及安全域可发现性。例如，可以呈现输入框供用户输入安全域标识符和/或安全域名称。又例如，可以呈现复选框供用户选择安全域可发现性。然而，本申请不应以此处举例为限制，现有的人机交互的方式均可用于用户设置安全域名称及安全域可发现性。
获得用户设置的安全域名称及安全域可发现性之后，OBT设备的secDomain资源可配置为以下形式：
Figure PCTCN2020073059-appb-000003
当属性discoverable值为TRUE时，安全域标识符属性值可以映射到OBT设备的res资源的secdomainuuid中。例如，安全域标识符在res资源中的表示形式可以为：
"secdomainuuid":"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"
图4为本申请实施例提供的一种安全域的配置方法的示意性流程图。该方法可以由OBT设备执行。通过执行图4所示的方法，OBT设备可以对其他IoT设备的安全域进行配置。
如图4所示，安全域的配置方法包括：
步骤S410，获取安全域信息；
步骤S420，通过向待配置设备发送携带有安全域信息的指令，将安全域信息设置到 待配置设备中。
在OBT设备完成自身的配置之后，OBT发现网络中需要配置的设备(以下简称"待配置设备")，待配置设备向OBT返回其支持的业主转让方法，OBT根据该业主转让方法与待配置设备建立通信连接。可选地，OBT设备与待配置设备之间建立安全地通信连接。这一过程与现有技术中激活和建立通信连接的过程类似，在此不一一赘述。
在建立通信连接之后，通过向待配置设备发送携带有安全域信息的指令，将安全域信息设置到待配置设备中。具体地，OBT从secDomain资源中获取自身配置的安全域信息，并向待配置设备发送指令。比如，如上所述，OBT作为客户端，待配置设备作为服务端，OBT发起Update操作。Update请求消息(即上述的"指令")由OBT发送到待配置设备，以更新待配置设备上的secDomain资源信息。
例如，指令可以是如下形式的：
Figure PCTCN2020073059-appb-000004
这一指令，将安全域的uuid(e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9)、名称(my home)和可发现性(可发现)设置到待配置设备中。为便于下文的解释和说明，将这一指令称为"第一指令"，将采用第一指令配置的待配置设备称为"第一设备"。
又例如，指令也可以是如下形式的：
Figure PCTCN2020073059-appb-000005
这一指令，将安全域的uuid(e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9)、名称(my home)和可发现性(不可发现)设置到待配置设备中。为便于下文的解释和说明，将这一指令称为"第二指令"，将采用第二指令配置的待配置设备称为"第二设备"。
除了将安全域信息设置到待配置设备中之外，OBT还配置待配置设备其他资源的属性，例如，/oic/sec/doxm资源(用于配置支持的OTM模式、选择的OTM模式、支持的凭证类型、标识是否创建了设备主人、设备ID、设备业主ID以及资源主人ID等)，/oic/sec/cred资源(用于配置选择的凭证(包括与CMS建立安全连接的凭证、与其他设备建立局域网安全连接的凭证)、资源的主人ID等)，等。这些资源配置过程可采用现有配置过程，在此不一一赘述。
在完成所有资源的配置(完成资源配置的设备可以简称为"被配置设备")之后，OBT改变待配置设备的状态为工作状态。OBT是网络的主人，可以配置网络中的客户端(Client)设备和服务端(Server设备)互联互通。配置后，该OBT为被配置设备的主人(owner)。
图5为本申请实施例提供的一种安全域的配置方法的示意性流程图。该方法可以由待配置设备执行，与图4所示的安全域的配置方法配合执行以完成对待配置设备的安全域的配置。
图5所示的安全域的配置方法包括：
步骤S510，接收携带有安全域信息的指令；
步骤S520，根据指令中的安全域信息，进行安全域配置。
如上所述，待配置设备被OBT发现后，执行业主转让握手，与OBT建立通信连接。在建立通信连接之后，接收OBT经由通信连接发送的携带有安全域信息的指令。
具体地，如上所述，待配置设备作为服务端接收UPDATE请求消息(即上述的"指令")。在收到UPDATE请求之后，待配置设备验证发送请求的OBT是否具有更新有关资源的权限。如果有，待配置设备根据UPDATE请求消息中包括的secDomain资源需要更新的属性值来更新secDomain资源的信息。也就是说，在接收到来自OBT的指令之后，根据指令中的安全域信息，进行安全域配置。
例如，针对上述的第一指令，待配置设备根据discoverable的属性值为true，将sdid属性映射到res资源。sdid在res资源中的表示形式可以为：
"secdomainuuid":"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"
相反地，针对上述的第二指令，由于discoverable的属性值为false，待配置设备不将将sdid属性映射到res资源。也就是说，接收到第二指令的待配置设备的安全域不可被其他设备发现。
在收到UPDATE请求之后，待配置设备还缓存UPDATE请求中的UPDATE请求的标识符，以便在UPDATE响应中使用。UPDATE响应消息由待配置设备发送到OBT。UPDATE响应中至少包含缓存的UPDATE请求的标识符和更新后的secDomain资源表述。
图4和图5所示的安全域的配置方法相互配合执行，使得OBT与待配置设备可以形成安全域网络。值得说明的是，在上述举例中，OBT和待配置设备具有相同的安全域标识符和安全域名称，因此，OBT和待配置设备处在同一安全域网络中。
图6为本申请实施例提供的一种安全域的配置方法的示意性流程图。该方法可以由主OBT设备执行。在此种情形下，安全域网络中的主OBT设备可以执行类似于图4所示的安全域的配置方法对从OBT设备进行安全域配置。
如图6所示的安全域的配置方法包括：
步骤610，获取安全域信息；
步骤620，通过向从OBT设备发送携带有安全域信息的指令，将安全域信息设置到从OBT设备中。
在主OBT设备自激活后，配置设备所有权时/之后，主OBT还创建各种安全域网络中的不同角色，不同的角色具有不同的权限。例如，有管理员(admin)、家庭成员(family)、客人(guest)等各种用户角色。又例如，管理员(admin)具有配置和管理同一安全域网络中其他IoT设备的权限，而家庭成员(family)具有控制同一安全域网络中其他IoT设备的权限。在实际中，不应以此处举例为限制，用户可以根据需要创建不同的角色，并给不同的角色设定不同的权限。
主OBT发现从OBT后，可以通过对从OBT进行配置，赋予从OBT配置和管理其他IoT设备的权限，以使得从OBT配置的设备也可以接入安全域网络。值得注意的是，主OBT赋予从OBT配置和管理其他IoT设备的权限的过程可以采用现有技术中可实现次功能的任意过程实现，在此不一一赘述。
主OBT设备可以通过向从OBT设备发送携带有安全域信息的指令，将安全域信息设置到从OBT设备中。与图4所示的安全域的配置方法类似，主OBT设备从secDomain资源中获取自身配置的安全域信息，并向从OBT设备发送指令。此时，主OBT设备为客户端，从OBT设备为服务端。主OBT设备与从OBT设备之间的请求和响应过程与现有CRUDN操作过程一致，在此不一一赘述。
图7为本申请实施例提供的一种安全域的配置方法的示意性流程图。该方法可以由从OBT设备执行，与图6所示的安全域的配置方法配合执行以完成对从OBT设备的安全域的配置。此外，从OBT还可以执行类似于图4所示的安全域的配置方法对其他待配置设备进行安全域配置。
如图7所示，安全域的配置方法包括：
步骤710，接收携带有安全域信息的指令；
步骤720，根据指令中的安全域信息，进行安全域配置；
步骤730，获取安全域信息；
步骤740，通过向待配置设备发送携带有安全域信息的指令，将安全域信息设置到待配置设备中。
上述步骤710和720分别与图5所示安全域的配置方法的步骤510和520类似，并且上述步骤730和740分别与图4所示安全域的配置方法的步骤410和420类似，为避免重复，在此不一一赘述。
在从OBT设备完成安全域配置之后，从OBT设备的secDomain资源可配置为与主OBT设备相同的secDomain资源。例如，具有以下形式：
Figure PCTCN2020073059-appb-000006
图6和图7所示的安全域的配置方法相互配合执行，使得主OBT设备与从OBT设备可以形成安全域网络。此外，主OBT设备与从OBT设备可以采用图4所示安全域的配置方法，分别配置其他IoT设备，以使得其他IoT设备也可以接入安全域网络。值得说明的是，在上述举例中，主OBT设备将安全域信息发送给从OBT设备，从OBT设备也根据安全域信息对自身和其他IoT设备进行安全域配置，因此，主OBT设备及其配置的其他IoT设备，从OBT设备及其配置的其他IoT设备具有相同的安全域标识符和安全域名称。也就是说，主OBT设备及其配置的其他IoT设备，从OBT设备及其配置的其他IoT设备处在同一安全域网络中。在这种情形下，例如，从OBT设备及其配置的IoT设备(以下简称"第三设备")的secDomain资源可例如配置为以下形式：
Figure PCTCN2020073059-appb-000007
在进行安全域配置时，从OBT设备根据安全域信息中discoverable的属性值为true，将sdid属性映射到res资源。例如，，从OBT设备的sdid在res资源中的表示形式可以为：
"secdomainuuid":"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"
在安全域信息中discoverable的属性值为false，从OBT设备的安全域不可被其他设备发现。
在实际中，在同一网络中可以存在不止一个OBT设备，比如，存在OBT1和OBT2。OBT1和OBT2可以分别根据自身的认证根证书产生随机数，并将该随机数作为安全域标识符，而用户可以将OBT1和OBT2的安全域名称设置成相同或不同。在这种情形下，由于OBT1的认证根证书和OBT2的认证根证书不同，因此，OBT1的安全域标识符和OBT2的安全域标识符不同。也就是说，OBT1及其配置的IoT设备(包括从OBT设备和待配置设备)具有相同的安全域标识符和安全域名称，形成了第一安全域网络，而OBT2及其配置的IoT设备(包括从OBT设备和待配置设备)具有相同的安全域标识符和安全域名称，形成了第二安全域网络。无论第一安全域网络和第二安全域网络是否具有相同的安全域名称，由于第一安全域网络和第二安全域网络具有不同的安全域标识符，因此，第一安全域网络和第二安全域网络为独立的安全域网络。
例如，OBT1及其配置的IoT设备(以下简称"第四设备")的secDomain资源可例如配置为以下形式：
Figure PCTCN2020073059-appb-000008
Figure PCTCN2020073059-appb-000009
OBT2及其配置的IoT设备(以下简称"第五设备")的secDomain资源可例如配置为以下形式：
Figure PCTCN2020073059-appb-000010
OBT2及其配置的IoT设备(以下简称"第六设备")的secDomain资源可例如配置为以下形式：
Figure PCTCN2020073059-appb-000011
在进行安全域配置时，OBT2根据安全域信息中discoverable的属性值为true，将sdid属性映射到res资源。例如，OBT2的sdid在res资源中的表示形式可以为：
"secdomainuuid":"61c74915-6491-12d2-7934-1da81f1ce27d"
上述表示形式中的"61c74915-6491-12d2-7934-1da81f1ce27d"不同于前述举例中的OBT1的安全域标识符"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"，因此，OBT1和OBT2分别形成了独立的安全域网络。
网络中的物联网设备通过执行图3至图7中部分或全部的安全域配置方法配置了安全域信息，形成了至少一个安全域网络。此时，如果有新的IoT设备(以下简称"发现设备")进入网络，想要发现网络中已经存在的安全域网络，可执行本申请实施例提供的安全域的发现方法。
图8所示为本申请实施例提供的一种安全域的发现方法的示意性流程图。该方法可以由发现设备执行。
如图8所示，安全域的发现方法包括在步骤S810，获取网络中IoT设备的发现资源。
在此步骤中，获取网络中IoT设备的发现资源可以采用现有的任意执行资源发现过程。比如，先向网络中其他IoT设备发送用于执行资源发现的请求消息，然后接收其他IoT设备反馈的发现资源。
具体地，发现设备作为客户端，可以向网络中其他IoT设备发送广播/组播消息来执行资源发现。例如，广播/组播消息可以为RETRIEVE请求消息，以请求服务端上的secDomain资源表述。广播/组播消息可以是如下形式的：
RETRIEVE/oic/res？if＝oic.if.baseline
在收到RETRIEVE请求之后，网络中其他IoT设备作为服务端验证发送请求的客户端是否具有获取所需资源的权限以及资源的有关属性是否可读。如果有，服务端将携带res资源的RETRIEVE响应消息发送给发现设备。
本实施例的安全域的发现方法包括在步骤S820，从发现资源中获取安全域标识符。
接着，发现设备接收携带res资源的RETRIEVE响应消息，并从RETRIEVE响应消息中的res资源中获取安全域标识符。比如，可以从前述举例中的第一设备获得 "e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"。由于前述举例中的第二设备的安全域不可被发现，因此，发现设备无法从第二设备的res资源中获取第二设备的安全域标识符。又比如，可以从前述举例中的第四设备获得"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"，从上述第五设备向发现设备发送"61c74915-6491-12d2-7934-1da81f1ce27d"。
发现设备在得到安全域标识符之后，就可以在步骤830，确定网络中安全域标识符对应的安全域。在确定网络中存在的安全域之后，可以保存安全域以备后续使用，或者显示供用户查看。
举例来说，如果仅从一个IoT设备获取到安全域标识符，则可直接保存这个安全域或者显示这个安全域供用户选择是否加入。或者，在从至少两个IoT设备获取到所述安全域标识符时，可以比较安全域标识符。在安全域标识符相同时，判定网络中存在一个安全域。在安全域标识符不同时，判定网络中存在多个安全域。有多少不同的安全域标识符就存在多少个安全域。进一步地，可以用安全域标识符表示网络中存在的安全域，将安全域标识符显示出来供用户查看或选择要加入的安全域。
图9所示为本申请实施例提供的一种安全域的发现方法的示意性流程图。该方法可以由发现设备执行。为了方便用户查看网络中存在的安全域，可以进一步根据安全域标识符获取对应的安全域名称。
如图9所示，安全域的发现方法包括：
步骤S910，获取网络中IoT设备的发现资源；
步骤S920，从发现资源中获取安全域标识符；
步骤S930，根据安全域标识符，确定存在于网络中的安全域；
步骤S940，根据安全域标识符，从IoT设备获取该安全域标识符对应的安全域名称；
步骤S950，根据安全域标识符和对应的安全域名称，表示存在于网络中的安全域。
上述步骤910至930分别与图8所示的安全域的发现方法的步骤810至830一致，在此不再赘述。
在发现设备获得安全域标识符之后，还可以根据获取到的安全域标识符，从IoT设备获取该安全域标识符对应的安全域名称。具体地，可以向其他IoT设备发送用于获得安全域标识符对应的安全域名称的请求消息。例如，发现设备向第一设备发送RETRIEVE请求消息，以请求第一设备上的secDomain资源中的安全域名称。此时，RETRIEVE请求消息可以是如下形式的：
RETRIEVE/oic/sec/secDomain
在收到RETRIEVE请求之后，第一设备将携带自身安全域名称的RETRIEVE响应消息发送给发现设备。例如，将"my home"发送给发现设备。相应地，发现设备还接收其他IoT设备反馈的安全域名称。
在本实施例中，在获取到安全域标识符对应的安全域名称之后，就可以用安全域名称来表示网络中存在的安全域了。因为，如上所述，安全域名称一般是由用户设置的，比较容易被用户识别，因此，用安全域名称来表示网络中存在的安全域可以方便用户查看或选择要加入的安全域。具体地，在判定网络中存在一个安全域时，可以用安全域名称表示安全域。在判定网络中存在多个安全域，并且多个安全域具有不同的安全域名称时，可以用各自的安全域名称表示多个安全域。在判定网络中存在多个安全域，并且多个安全域具有相同的安全域名称时，用安全域标识符和对应的安全域名称表示多个安全域。
以前述安全域得配置方法的举例中涉及的第一至第六设备为例进行如下说明：
当仅存在一组安全域标识符及其对应的安全域名称时，可直接将安全域名称呈现给用户。如上所述，仅有第一设备将"my home"发送给发现设备，则可直接将"my home"呈现给用户。
当存在两组安全域标识符及其对应的安全域名称时，比较安全域标识符和安全域名称 是否相同。当安全域标识符和安全域名称分别相同时，可直接将安全域名称呈现给用户。例如，上述第一设备和第三设备可分别向发现设备发送"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"和对应的"my home"。由于安全域标识符和安全域名称分别相同，虽然存在两组安全域标识符及其对应的安全域名称，也可直接将安全域名称("my home")呈现给用户。
当安全域标识符和安全域名称均不同时，则判定存在两个安全域网络，可以将不同的安全域标识符及其对应的安全域名称呈现给用户。
例如，上述第四设备向发现设备发送"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"和对应的"my home"，上述第五设备向发现设备发送"61c74915-6491-12d2-7934-1da81f1ce27d"和对应的"my room"。由于安全域标识符和安全域名称均不相同，因此，将比较结果(包括"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"和对应的"my home"、61c74915-6491-12d2-7934-1da81f1ce27d"和对应的"my room")呈现给用户。在另一示例中，也可以不呈现安全域标识符，仅将安全域名称，即"my home"和"my room"，呈现给用户。
当安全域标识符不同，而安全域名称相同时，则判定存在两个安全域网络，可以将不同的安全域标识符及其对应的安全域名称呈现给用户。例如，上述第四设备向发现设备发送"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"和对应的"my home"，上述第六设备向发现设备发送"61c74915-6491-12d2-7934-1da81f1ce27d"和对应的"my home"。虽然安全域名称相同，由于安全域标识符不同，因此，将比较结果(包括"e61c3e6b-9c54-4b81-8ce5-f9039c1d04d9"和对应的"my home"、61c74915-6491-12d2-7934-1da81f1ce27d"和对应的"my home")呈现给用户。
应理解，对于超过两组的安全域标识符和对应的安全域名称，可以采用每次选择两组进行比较的方式，最终获得比较结果。但以上比较方法仅是为了方便理解而做的举例，本申请不应以此为限制，任何适用于比较各组中安全域标识符和对应的安全域名称是否相同的方法均应包含在本申请的保护范围之内。
图10所示为本申请实施例提供的一种安全域的加入方法的示意性流程图。该方法可以由发现设备执行。发现设备在获得网络中存在的安全域的安全域信息(包括安全域标识符或安全域名称)之后，可以呈现安全域信息以供用户选择。
如图10所示，安全域的加入方法包括：
步骤1010，请求用户选择欲加入的安全域；
步骤1020，根据用户选择的安全域，启动安全域的实例。
具体地，在执行图8或9所示的安全域的发现方法之后，发现设备获得了网络中存在的安全域的安全域信息。发现设备可将这些安全域信息呈现给用户，请求用户选择该发现设备加入哪一安全域网络。
待接收到用户的选择之后，启动安全域的实例。具体地，若用户选择的安全域的实例存在于已配置的安全域实例中，则切换到该安全域的实例。若已配置的安全域实例中没有用户选择的安全域的实例，则产生一个可用于用户选择的安全域的实例。也就是说，发现设备检查自身已开启实例的安全域信息，若判定其中有用户选择的安全域的实例，则切换到该实例。或者，发现设备判定用户选择的安全域的实例与自身已配置安全域不一致，则产生一个新的可用于用户选择的安全域的客户端实例。
上述每个实例是一个独立的逻辑客户端设备。一个客户端应用程序(APP)中可运行多个逻辑客户端设备，每个设备可对应不同的安全域。当产生一个新的客户端实例后，该客户端实例处于初始化状态，等待激活和配置，此时，网络中的OBT可以激活并配置该客户端实例加入OBT所在的安全域。
图11所示为本申请实施例提供的一种安全域的发现方法的示意性流程图。该方法可 以由网络中已完成安全域配置的IoT设备执行，向执行图8所示的安全域的发现方法的发现设备反馈安全域信息。
如图11所示，安全域的发现方法包括：
步骤S1110，响应于接收到的用于执行资源发现的请求消息，反馈发现资源；
步骤S1120，响应于接收到的用于获得安全域标识符对应的安全域名称的请求消息，反馈安全域名称。
如上所述，在收到广播/组播消息之后，网络中IoT设备作为服务端验证发送请求的客户端是否具有获取所需资源的权限以及资源的有关属性是否可读。如果有，服务端将携带res资源的RETRIEVE响应消息发送给发现设备。在收到获取安全域名称的请求之后，将自身的安全域名称反馈给发现设备。
在本申请的实施例中，关于指令的举例中，涉及了UPDATE操作，这是针对IoT设备中已经设置了secDomain资源的情形。在实际中，如果待配置设备中没有设置secDomain资源，则OBT可以采用CRUDN操作中的CREATE操作发起请求，待配置设备响应于该CREATE请求消息，根据CREATE请求消息中携带的第一安全域信息，创建一个secDomain资源。
此外，上述涉及的CRUDN操作的通信过程与现有技术类似，不同之处在于请求消息和相应消息中携带了与secDomain资源相关的参数。在此不再详细说明CRUDN操作的通信过程。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
上文中结合图1至图11，从不同的角度详细描述了根据本申请实施例的安全域的配置、发现和加入方法，下面将结合图12至图15，描述根据本申请实施例的各IoT设备之间的示意性交互场景。
图12所述为根据本申请实施例的各IoT设备之间的第一种示意性交互场景。假设在家庭网络中，Mom的手机APP作为OBT，则首先自激活并配置自己。网络有两台设备Device1和Device2，OBT分别对两台设备进行配置，并设置安全域信息。此时，OBT与Device1、Device2形成了家庭中的安全域网络。之后，Dad的手机APP进入了家庭网络。作为Client，Dad的手机APP发现可控制的设备，并找到其对应的安全域。
图13所述为根据本申请实施例的各IoT设备之间的第二种示意性交互场景。假设在家庭网络中，Mom的手机APP作为主OBT，则首先自激活并配置自己。Son的手机APP作为从OBT，被Mom的手机APP配置。Mom的手机APP将自身的安全域信息配置到Son的手机APP。网络有两台设备Device1和Device2，主从OBT分别对两台设备进行配置，并设置安全域信息。此时，主OBT、从OBT与Device1、Device2形成了家庭中的安全域网络。之后，Dad的手机APP进入了家庭网络。作为Client，Dad的手机APP发现可控制的设备，并找到其对应的安全域。
图14所述为根据本申请实施例的各IoT设备之间的第三种示意性交互场景。假设在家庭网络中，Mom的手机APP作为OBT1，则首先自激活并配置自己。Son的手机APP也作为OBT2，自激活并配置自己。网络有两台设备Device1和Device2，Mom的手机APP、Son的手机APP分别对两台设备进行配置，并设置安全域信息。此时，OBT1与Device1、OBT2与Device2分别形成了家庭中的两个独立安全域网络。之后，Dad的手机APP进入了家庭网络。作为Client，Dad的手机APP发现可控制的设备，并找到其对应的安全域。
图15所述为根据本申请实施例的各IoT设备之间的第四种示意性交互场景。假设在家庭网络中，Mom的手机APP作为OBT1，则首先自激活并配置自己。Son的手机APP也作为OBT2，自激活并配置自己。网络有两台设备Device1和Device2，Mom的手机APP、 Son的手机APP分别对两台设备进行配置，并设置安全域信息。此时，OBT1与Device1、OBT2与Device2分别形成了家庭中的两个独立安全域网络。之后，Dad的手机APP进入了家庭网络。作为Client，Dad的手机APP发现可控制的设备，并找到其对应的安全域。
上文中结合图1至图15，从各种不同的角度详细描述了根据本申请实施例的安全域的配置、发现和加入方法，下面将结合图16至图21，描述根据本申请实施例的装置。
如图16所示，根据本申请实施例的安全域的配置装置包括：获取模块1610和配置模块1620。
具体地，所述获取模块1610用于：获取安全域信息。所述配置模块1620用于：根据获取的所述安全域信息进行安全域配置。其中，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性。
可选地，作为一个实施例，所述获取模块还用于通过以下方法中来获取所述安全域信息：
自动生成随机数作为所述安全域标识符；
请求用户设置所述安全域名称；
请求用户设置所述安全域可发现性。
可选地，作为一个实施例，所述获取模块还用于：在自动生成随机数作为所述安全域标识符时，根据自身的认证根证书产生随机数，并将所述随机数作为所述安全域标识符。可选地，作为一个实施例，所述获取模块还用于：接收携带有所述安全域信息的指令；相应地，所述配置模块还用于：根据所述指令中所述安全域信息，进行安全域配置。
可选地，作为一个实施例，所述配置模块还用于：根据所述安全域可发现性的属性值为可发现，将所述安全域标识符映射到发现资源。
可选地，作为一个实施例，所述配置模块还用于：通过向所述待配置设备发送携带有所述安全域信息的指令，将所述安全域信息设置到所述待配置设备中。
如图17所示，根据本申请实施例的安全域的发现装置包括：第一获取模块1710、第二获取模块1720和确定模块1730。
具体地，第一获取模块1710用于：获取网络中物联网IoT设备的发现资源；第二获取模块1720用于：从所述发现资源中获取安全域标识符；确定模块1730用于确定所述网络中所述安全域标识符对应的安全域。其中，所述IoT设备已配置安全域信息，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性。
可选地，作为一个实施例，所述装置还包括第三获取模块1740。其中，所述第三获取模块用于根据所述第二获取模块获取的所述安全域标识符，从所述IoT设备获取所述安全域标识符对应的安全域名称。
可选地，作为一个实施例，所述第三获取模块1740包括发送子模块1741和接收子模块1742。其中，发送子模块1741用于向所述IoT设备发送用于获得所述安全域标识符对应的所述安全域名称的请求消息。接收子模块1742用于接收所述IoT设备反馈的所述安全域名称。
可选地，作为一个实施例，所述确定模块包括比较子模块1731和判定子模块1732。其中，比较子模块1731用于在从至少两个IoT设备获取到所述安全域标识符时，比较所述安全域标识符。判定子模块1732用于在所述安全域标识符相同时，判定网络中存在一个安全域；在所述安全域标识符不同时，判定网络中存在多个安全域。
可选地，作为一个实施例，所述确定模块还包括表示子模块1733。其中，表示子模块1733用于：
在判定网络中存在一个安全域时，用所述安全域名称表示所述安全域；
在判定网络中存在多个安全域，并且所述多个安全域具有不同的安全域名称时，用各自的安全域名称表示所述多个安全域；
在判定网络中存在多个安全域，并且所述多个安全域具有相同的安全域名称时，用所述安全域标识符和对应的安全域名称表示所述多个安全域。
如图18所示，根据本申请实施例的安全域的发现装置通过如图3至7所示的部分或全部方法发现配置了安全域信息。该安全域的发现装置包括：第一反馈模块1810和第二反馈模块1820。
具体地，第一反馈模块1810用于：响应于接收到的用于执行资源发现的请求消息，反馈发现资源；第二反馈模块1820用于：响应于接收到的用于获得安全域标识符对应的安全域名称的请求消息，反馈所述安全域名称。
其中，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性；在所述安全域可发现性的属性值表征可发现时，所述发现资源中包括所述安全域标识符。
如图19所示，根据本申请实施例的安全域的加入装置包括请求模块1910和启动模块1920。其中，请求模块1910用于请求用户选择欲加入的安全域。启动模块1920用于根据用户选择的所述安全域，启动所述安全域的实例。其中，所述安全域通过如图8或9所示的的方法发现。
可选地，作为一个实施例，所述启动模块1820还用于：
在所述用户选择的所述安全域的实例存在于已配置的安全域实例中时，切换到所述安全域的实例；
在已配置的安全域实例中没有所述用户选择的所述安全域的实例时，产生一个可用于所述用户选择的所述安全域的实例。
应理解，根据本申请实施例的安全域的配置、发现和加入装置中的各个模块的上述和其它操作和/或功能分别为了实现图1至图11中的各个方法中终端设备的相应流程，为了简洁，在此不再赘述。
图20是本申请实施例提供的一种电子设备2000示意性结构图。图20所示的电子设备包括处理器2010，处理器2010可以从存储器中调用并运行计算机程序，以实现本申请实施例中的方法。
可选地，如图20所示，电子设备2000还可以包括存储器2020。其中，处理器2010可以从存储器2020中调用并运行计算机程序，以实现本申请实施例中的方法。
其中，存储器2020可以是独立于处理器2010的一个单独的器件，也可以集成在处理器2010中。
可选地，如图20所示，电子设备2000还可以包括收发器2030，处理器2010可以控制该收发器2030与其他设备进行通信，具体地，可以向其他设备发送信息或数据，或接收其他设备发送的信息或数据。
其中，收发器2030可以包括发射机和接收机。收发器2030还可以进一步包括天线，天线的数量可以为一个或多个。
可选地，该电子设备2000具体可为本申请实施例的物联网设备，并且该电子设备2000可以实现本申请实施例的各个方法中的相应流程，为了简洁，在此不再赘述。
本实施例的电子设备可以为，但不限于，终端设备或者网络设备。作为在此使用的"终端设备"包括但不限于经由无线接口，如，针对蜂窝网络、无线局域网(Wireless Local Area Network，WLAN)、诸如DVB-H网络的数字电视网络、卫星网络、AM-FM广播发送器；和/或另一终端设备的被设置成接收/发送通信信号的装置；和/或物联网(Internet of Things，IoT)设备。被设置成通过无线接口通信的终端设备可以被称为"无线通信终端"、"无线终端"或"移动终端"。移动终端的示例包括但不限于卫星或蜂窝电话；可以组合蜂窝无线电电话与数据处理、传真以及数据通信能力的个人通信系统(Personal Communications System，PCS)终端；可以包括无线电电话、寻呼机、因特网/内联网接入、Web浏览器、记事簿、日历以及/或全球定位系统(Global Positioning System，GPS)接收器 的PDA；以及常规膝上型和/或掌上型接收器或包括无线电电话收发器的其它电子装置。终端设备可以指接入终端、用户设备(User Equipment，UE)、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。接入终端可以是蜂窝电话、无绳电话、会话启动协议(Session Initiation Protocol，SIP)电话、无线本地环路(Wireless Local Loop，WLL)站、个人数字处理(Personal Digital Assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备、5G网络中的终端设备或者未来演进的PLMN中的终端设备等。网络设备可以为特定的地理区域提供通信覆盖，并且可以与位于该覆盖区域内的终端设备进行通信。可选地，网络设备可以是GSM系统或CDMA系统中的基站(Base Transceiver Station，BTS)，也可以是WCDMA系统中的基站(NodeB，NB)，还可以是LTE系统中的演进型基站(Evolutional Node B，eNB或eNodeB)，或者是云无线接入网络(Cloud Radio Access Network，CRAN)中的无线控制器，或者该网络设备可以为移动交换中心、中继站、接入点、车载设备、可穿戴设备、集线器、交换机、网桥、路由器、5G网络中的网络侧设备或者未来演进的公共陆地移动网络(Public Land Mobile Network，PLMN)中的网络设备等。
图21是本申请实施例的芯片的示意性结构图。图21所示的芯片2100包括处理器2110，处理器2110可以从存储器中调用并运行计算机程序，以实现本申请实施例中的方法。
可选地，如图21所示，芯片2100还可以包括存储器2120。其中，处理器2110可以从存储器2120中调用并运行计算机程序，以实现本申请实施例中的方法。
其中，存储器2120可以是独立于处理器2110的一个单独的器件，也可以集成在处理器2110中。
可选地，该芯片2100还可以包括输入接口2130。其中，处理器2110可以控制该输入接口2130与其他设备或芯片进行通信，具体地，可以获取其他设备或芯片发送的信息或数据。
可选地，该芯片2100还可以包括输出接口2140。其中，处理器2110可以控制该输出接口2140与其他设备或芯片进行通信，具体地，可以向其他设备或芯片输出信息或数据。
可选地，该芯片可应用于本申请实施例中的物联网设备，并且该芯片可以实现本申请实施例的各个方法中的相应流程，为了简洁，在此不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片，系统芯片，芯片系统或片上系统芯片等。
应理解，本申请实施例的处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可 包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
应理解，上述存储器为示例性但不是限制性说明，例如，本申请实施例中的存储器还可以是静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synch link DRAM，SLDRAM)以及直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)等等。也就是说，本申请实施例中的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本申请实施例还提供了一种计算机可读存储介质，用于存储计算机程序。
可选的，该计算机可读存储介质可应用于本申请实施例中的网络设备，并且该计算机程序使得计算机执行本申请实施例的各个方法中由网络设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该计算机可读存储介质可应用于本申请实施例中的移动终端/终端设备，并且该计算机程序使得计算机执行本申请实施例的各个方法中由移动终端/终端设备实现的相应流程，为了简洁，在此不再赘述。
本申请实施例还提供了一种计算机程序产品，包括计算机程序指令。
可选的，该计算机程序产品可应用于本申请实施例中的网络设备，并且该计算机程序指令使得计算机执行本申请实施例的各个方法中由网络设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该计算机程序产品可应用于本申请实施例中的移动终端/终端设备，并且该计算机程序指令使得计算机执行本申请实施例的各个方法中由移动终端/终端设备实现的相应流程，为了简洁，在此不再赘述。
本申请实施例还提供了一种计算机程序。
可选的，该计算机程序可应用于本申请实施例中的网络设备，当该计算机程序在计算机上运行时，使得计算机执行本申请实施例的各个方法中由网络设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该计算机程序可应用于本申请实施例中的移动终端/终端设备，当该计算机程序在计算机上运行时，使得计算机执行本申请实施例的各个方法中由移动终端/终端设备实现的相应流程，为了简洁，在此不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，)ROM、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (33)

  1. 一种安全域的配置方法，包括：
    获取安全域信息；
    根据获取的所述安全域信息进行安全域配置；
    其中，所述安全域信息包括：安全域标识符和安全域名称中至少之一以及安全域可发现性。
  2. 根据权利要求1所述的方法，其中，所述获取安全域信息包括：
    自动生成随机数作为所述安全域标识符；
    请求用户设置所述安全域名称；
    请求用户设置所述安全域可发现性。
  3. 根据权利要求2所述的方法，其中，所述自动生成随机数作为所述安全域标识符包括：
    根据自身的认证根证书产生随机数，并将所述随机数作为所述安全域标识符。
  4. 根据权利要求1至3中任意一项所述的方法，其中，所述根据获取的所述安全域信息进行安全域配置包括：
    通过向待配置设备发送携带有所述安全域信息的指令，将所述安全域信息设置到所述待配置设备中。
  5. 根据权利要求1所述的方法，其中，所述获取安全域信息包括：
    接收携带有所述安全域信息的指令；
    所述根据获取的所述安全域信息进行安全域配置包括：
    根据所述指令中所述安全域信息，进行安全域配置。
  6. 根据权利要求1至5中任意一项所述的方法，其中，所述根据获取的所述安全域信息进行安全域配置包括：
    若所述安全域可发现性的属性值表征可发现，将所述安全域标识符映射到发现资源。
  7. 一种安全域的发现方法，包括：
    获取网络中物联网IoT设备的发现资源；
    从所述发现资源中获取安全域标识符；
    确定所述网络中所述安全域标识符对应的安全域；
    其中，所述IoT设备已配置安全域信息，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性。
  8. 根据权利要求7所述的方法，其中，确定所述网络中所述安全域标识符对应的安全域，包括：
    在从至少两个IoT设备获取到所述安全域标识符时，比较所述安全域标识符；
    在所述安全域标识符相同时，判定网络中存在一个安全域；
    在所述安全域标识符不同时，判定网络中存在多个安全域。
  9. 根据权利要求7或8所述的方法，其中，在从所述发现资源中获取安全域标识符之后，还包括：
    根据所述安全域标识符，从所述IoT设备获取所述安全域标识符对应的安全域名称。
  10. 根据权利要求9所述的方法，其中，所述根据所述安全域标识符，从所述IoT设备获取所述安全域标识符对应的安全域名称，包括：
    向所述IoT设备发送用于获得所述安全域标识符对应的所述安全域名称的请求消息；
    接收所述IoT设备反馈的所述安全域名称。
  11. 根据权利要求9或10所述的方法，其中，在根据所述安全域标识符，从所述IoT设备获取所述安全域标识符对应的安全域名称之后，所述方法还包括：
    在判定网络中存在一个安全域时，用所述安全域名称表示所述安全域；
    在判定网络中存在多个安全域，并且所述多个安全域具有不同的安全域名称时，用 各自的安全域名称表示所述多个安全域；
    在判定网络中存在多个安全域，并且所述多个安全域具有相同的安全域名称时，用所述安全域标识符和对应的安全域名称表示所述多个安全域。
  12. 一种安全域的发现方法，由通过权利要求1至6中任意一项所述的安全域的配置方法配置了安全域信息的物联网设备执行，包括：
    响应于接收到的用于执行资源发现的请求消息，反馈发现资源；
    响应于接收到的用于获得安全域标识符对应的安全域名称的请求消息，反馈所述安全域名称；
    其中，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性；
    在所述安全域可发现性的属性值表征可发现时，所述发现资源中包括所述安全域标识符。
  13. 一种安全域的加入方法，包括：
    请求用户选择欲加入的安全域；其中，供所述用户选择的安全域为通过权利要求7至11中任意一项所述的方法发现的安全域；
    根据用户选择的所述安全域，启动所述安全域的实例。
  14. 根据权利要求13所述的方法，其中，所述根据用户选择的所述安全域，启动所述安全域的实例，包括：
    若所述用户选择的所述安全域的实例存在于已配置的安全域实例中，则切换到所述安全域的实例；
    若已配置的安全域实例中没有所述用户选择的所述安全域的实例，则产生一个可用于所述用户选择的所述安全域的实例。
  15. 一种安全域的配置装置，包括：
    获取模块，用于获取安全域信息；
    配置模块，用于根据获取的所述安全域信息进行安全域配置；
    其中，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性。
  16. 根据权利要求15所述的装置，其中，所述获取模块还用于通过以下方法来获取所述安全域信息：
    自动生成随机数作为所述安全域标识符；
    请求用户设置所述安全域名称；
    请求用户设置所述安全域可发现性。
  17. 根据权利要求16所述的装置，其中，所述获取模块还用于：
    在自动生成随机数作为所述安全域标识符时，根据自身的认证根证书产生随机数，并将所述随机数作为所述安全域标识符。
  18. 根据权利要求15至17中任意一项所述的装置，其中，所述配置模块还用于：通过向所述待配置设备发送携带有所述安全域信息的指令，将所述安全域信息设置到所述待配置设备中。
  19. 根据权利要求15所述的装置，其中，所述获取模块还用于：接收携带有所述安全域信息的指令；
    所述配置模块还用于：根据所述指令中所述安全域信息，进行安全域配置。
  20. 根据权利要求15至19中任意一项所述的装置，其中，所述配置模块还用于：在所述安全域可发现性的属性值表征可发现时，将所述安全域标识符映射到发现资源。
  21. 一种安全域的发现装置，包括：
    第一获取模块，用于获取网络中物联网IoT设备的发现资源；
    第二获取模块，用于从所述发现资源中获取安全域标识符；
    确定模块，用于确定所述网络中所述安全域标识符对应的安全域；
    其中，所述IoT设备已配置安全域信息，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性。
  22. 根据权利要求21所述的装置，其中，所述确定模块包括：
    比较子模块，用于在从至少两个IoT设备获取到所述安全域标识符时，比较所述安全域标识符；
    判定子模块，用于在所述安全域标识符相同时，判定网络中存在一个安全域；在所述安全域标识符不同时，判定网络中存在多个安全域。
  23. 根据权利要求21或22所述的装置，其中，所述装置还包括：
    第三获取模块，用于根据所述第二获取模块获取的所述安全域标识符，从所述IoT设备获取所述安全域标识符对应的安全域名称。
  24. 根据权利要求23所述的装置，其中，所述第三获取模块包括：发送子模块，用于向所述IoT设备发送用于获得所述安全域标识符对应的所述安全域名称的请求消息；
    接收子模块，用于接收所述IoT设备反馈的所述安全域名称。
  25. 根据权利要求23或24所述的装置，其中，所述确定模块还包括：
    表示子模块，用于：
    在判定网络中存在一个安全域时，用所述安全域名称表示所述安全域；
    在判定网络中存在多个安全域，并且所述多个安全域具有不同的安全域名称时，用各自的安全域名称表示所述多个安全域；
    在判定网络中存在多个安全域，并且所述多个安全域具有相同的安全域名称时，用所述安全域标识符和对应的安全域名称表示所述多个安全域。
  26. 一种安全域的发现装置，通过权利要求1至6中任意一项所述的安全域的配置方法配置了安全域信息，包括：
    第一反馈模块，用于响应于接收到的用于执行资源发现的请求消息，反馈发现资源；
    第二反馈模块，用于响应于接收到的用于获得安全域标识符对应的安全域名称的请求消息，反馈所述安全域名称；
    其中，所述安全域信息至少包括：安全域标识符、安全域名称以及安全域可发现性；在所述安全域可发现性的属性值表征可发现时，所述发现资源中包括所述安全域标识符。
  27. 一种安全域的加入装置，包括：
    请求模块，用于请求用户选择欲加入的安全域；其中，供所述用户选择的安全域为通过权利要求7至11中任意一项所述的装置发现的安全域；
    启动模块，用于根据用户选择的所述安全域，启动所述安全域的实例。
  28. 根据权利要求27所述的装置，其中，所述启动模块还用于：
    在所述用户选择的所述安全域的实例存在于已配置的安全域实例中时，切换到所述安全域的实例；
    在已配置的安全域实例中没有所述用户选择的所述安全域的实例时，产生一个可用于所述用户选择的所述安全域的实例。
  29. 一种电子设备，其特征在于，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行如权利要求1至14中任一项所述的方法。
  30. 一种芯片，其特征在于，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如权利要求1至14中任一项所述的方法。
  31. 一种计算机可读存储介质，其特征在于，用于存储计算机程序，所述计算机程序使得计算机执行如权利要求1至14中任一项所述的方法。
  32. 一种计算机程序产品，其特征在于，包括计算机程序指令，该计算机程序指令使得计算机执行如权利要求1至14中任一项所述的方法。
  33. 一种计算机程序，其特征在于，所述计算机程序使得计算机执行如权利要求1至14中任一项所述的方法。
PCT/CN2020/073059 2020-01-19 2020-01-19 安全域的配置、发现和加入方法及装置、电子设备 WO2021142849A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080025258.0A CN113678421B (zh) 2020-01-19 2020-01-19 安全域的配置、发现和加入方法及装置、电子设备
PCT/CN2020/073059 WO2021142849A1 (zh) 2020-01-19 2020-01-19 安全域的配置、发现和加入方法及装置、电子设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/073059 WO2021142849A1 (zh) 2020-01-19 2020-01-19 安全域的配置、发现和加入方法及装置、电子设备

Publications (1)

Publication Number Publication Date
WO2021142849A1 true WO2021142849A1 (zh) 2021-07-22

Family

ID=76863417

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/073059 WO2021142849A1 (zh) 2020-01-19 2020-01-19 安全域的配置、发现和加入方法及装置、电子设备

Country Status (2)

Country Link
CN (1) CN113678421B (zh)
WO (1) WO2021142849A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230216810A1 (en) * 2020-10-09 2023-07-06 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Information processing method and apparatus, and storage medium
WO2023216035A1 (zh) * 2022-05-07 2023-11-16 Oppo广东移动通信有限公司 安全域管理方法、装置、设备、存储介质及程序产品

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105591953A (zh) * 2015-09-18 2016-05-18 杭州华三通信技术有限公司 一种OpenFlow实例的实现方法和装置
CN109218981A (zh) * 2018-11-20 2019-01-15 太原理工大学 基于位置信号特征共识的Wi-Fi接入认证方法
EP3432535A1 (en) * 2017-07-18 2019-01-23 Deutsche Telekom AG Applying filter rules in lpwa communication networks
CN109314694A (zh) * 2016-07-01 2019-02-05 英特尔公司 可重配置的机器对机器系统中的组管理

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100461690C (zh) * 2005-07-21 2009-02-11 华为技术有限公司 通用网管安全管理系统及其方法
US20160205082A1 (en) * 2013-08-12 2016-07-14 Graphite Software Corporation Secure authentication and switching to encrypted domains
KR102132218B1 (ko) * 2013-09-24 2020-07-09 삼성전자 주식회사 신뢰하는 실행 환경에서의 보안 도메인 관리 방법 및 장치
CN103607375A (zh) * 2013-10-28 2014-02-26 天津大学 一种网络的n-1安全域边界计算及安全性评价方法
CN104660578B (zh) * 2014-04-22 2017-12-19 董唯元 一种实现数据安全存储及数据访问控制的系统及其方法
CN106031119B (zh) * 2014-08-13 2019-06-21 华为技术有限公司 一种安全域管理方法、装置及系统
CN107153565B (zh) * 2016-03-03 2020-06-16 华为技术有限公司 配置资源的方法及其网络设备
CN107769938B (zh) * 2016-08-16 2021-01-22 北京金山云网络技术有限公司 一种Openstack平台支持多网络区域的系统和方法
CN107196906A (zh) * 2017-03-31 2017-09-22 山东超越数控电子有限公司 一种安全域网络接入控制方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105591953A (zh) * 2015-09-18 2016-05-18 杭州华三通信技术有限公司 一种OpenFlow实例的实现方法和装置
CN109314694A (zh) * 2016-07-01 2019-02-05 英特尔公司 可重配置的机器对机器系统中的组管理
EP3432535A1 (en) * 2017-07-18 2019-01-23 Deutsche Telekom AG Applying filter rules in lpwa communication networks
CN109218981A (zh) * 2018-11-20 2019-01-15 太原理工大学 基于位置信号特征共识的Wi-Fi接入认证方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230216810A1 (en) * 2020-10-09 2023-07-06 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Information processing method and apparatus, and storage medium
US11991093B2 (en) * 2020-10-09 2024-05-21 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Information processing method and apparatus, and storage medium
WO2023216035A1 (zh) * 2022-05-07 2023-11-16 Oppo广东移动通信有限公司 安全域管理方法、装置、设备、存储介质及程序产品

Also Published As

Publication number Publication date
CN113678421B (zh) 2023-06-09
CN113678421A (zh) 2021-11-19

Similar Documents

Publication Publication Date Title
KR102391819B1 (ko) 이동통신 시스템에서 네트워크 슬라이싱을 이용하는 방법 및 장치
US11133985B2 (en) Systems and methods for intuitive home networking
US11362898B2 (en) Network policy configuration
WO2019242574A1 (zh) 一种物联网业务路由的方法
US11936743B2 (en) Device management services based on restful messaging
TWI533740B (zh) 經由點對點鏈結存取的分享網路
US10110706B2 (en) Remote access method and device
CN111406425A (zh) 根据os特定的连接能力确定网络连接的类型
WO2018024121A1 (zh) 一种网络功能nf管理方法及nf管理设备
WO2021142849A1 (zh) 安全域的配置、发现和加入方法及装置、电子设备
KR102500594B1 (ko) 통신 네트워크에서의 서비스 계층 메시지 템플릿들
CN107003981B (zh) 与本地配对的设备同步以使用点到点通信从远程服务器获得数据
US20220353239A1 (en) Security information discovery method, security information configuration method, and device
WO2007045134A1 (fr) Systeme de communication et procede de communication
US20240121840A1 (en) Network connection method, related apparatus, and system
WO2022142792A1 (zh) 用于传输数据的方法和装置
WO2021217631A1 (zh) 服务分享方法、通信设备和云平台
WO2021072685A1 (zh) 设备连接方法、装置、设备及可读存储介质
WO2020258099A1 (zh) 配置物联网设备的方法和物联网设备
WO2021035587A1 (zh) 一种配置客户端的方法及装置、终端设备
WO2023123400A1 (zh) 无线通信的方法及设备
WO2024022182A1 (zh) 信息查询方法、装置、终端及网络侧设备
WO2021012236A1 (zh) 一种资源发布方法和设备
WO2024051547A1 (zh) 网络选择信息配置方法、装置及通信设备
WO2023155804A1 (en) System and methods for providing priority network access for a multi-link wlan entity

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20914453

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20914453

Country of ref document: EP

Kind code of ref document: A1