WO2022147843A1

WO2022147843A1 - Access authentication method and apparatus

Info

Publication number: WO2022147843A1
Application number: PCT/CN2021/071140
Authority: WO
Inventors: 包永明; 罗朝明; 茹昭
Original assignee: Oppo广东移动通信有限公司
Priority date: 2021-01-11
Filing date: 2021-01-11
Publication date: 2022-07-14
Also published as: CN116547998A

Abstract

An access authentication method and apparatus. The method comprises: a Zigbee device generating a second random number; according to the second random number and a license key, generating a second device-end key, wherein the license key is a key stored in the Zigbee device and a device platform cloud of the Zigbee device; and performing second access authentication on the Zigbee device according to the second device-end key.

Description

Method and device for access authentication

technical field

The embodiments of the present application relate to the field of communications, and in particular, to a method and an apparatus for access authentication.

Background technique

Zigbee (Zigbee Protocol) technology is a wireless communication technology. Zigbee devices based on Zigbee technology can perform access authentication across different platforms.

Exemplarily, for networking Zigbee devices, a Zigbee network is constructed by the A platform gateway, the platform cloud corresponding to the A platform gateway is the A platform cloud, and the platform cloud corresponding to the manufacturer of the Zigbee device is the B platform cloud.

How to realize the cross-platform access authentication of Zigbee devices is an urgent problem to be solved.

SUMMARY OF THE INVENTION

The present application provides an access authentication method and apparatus, which can realize cross-platform access authentication of Zigbee devices.

A first aspect provides an access authentication method, comprising: generating a second random number by a Zigbee device of Zifeng protocol; generating a second device-side key according to the second random number and a license key, the license key is the key stored in the Zigbee device and the device platform cloud of the Zigbee device; the second access authentication of the Zigbee device is performed according to the second device-side key.

In a second aspect, an access authentication method is provided, including: a device platform cloud generating a first cloud key according to a first random number and a license key, wherein the device platform cloud belongs to the Zigbee device of the Zigbee protocol The cloud server of the manufacturer, the license key is a key stored in the Zigbee device and the device platform cloud of the Zigbee device, the first random number is generated by the device platform cloud, or the first random number is A random number is obtained from the distribution network platform cloud, which is the cloud server corresponding to the distribution network platform gateway supporting the construction of Zigbee networks; the first connection of the Zigbee device is performed according to the first cloud key. Enter certification.

In a third aspect, a method for access authentication is provided, including: a distribution network platform gateway receiving a second random number and a first device-side key sent by a Zigbee device of Zifeng protocol, wherein the distribution network platform gateway supports the construction of Zigbee network, the first device-side key is generated by the Zigbee device according to the first random number and the license key of the Zigbee device, and the second random number is used by the device platform cloud of the Zigbee device to determine the first Two cloud keys, the second cloud keys are used for the second access authentication of the Zigbee device;

The distribution network platform gateway sends a first access authentication request to the distribution network platform cloud, where the first access authentication request includes the second random number, or the first access authentication request includes the second random number number and the first device-side key, the first device-side key is used for the first access authentication of the Zigbee device by the device platform cloud, and the distribution network platform cloud is the distribution network platform The cloud server corresponding to the gateway.

In a fourth aspect, an access authentication method is provided, including: acquiring device information of a Zigbee device with a Zigbee protocol, wherein the device information of the Zigbee device includes a device protocol type of the Zigbee device, the device of the Zigbee device The address identifier and the manufacturer identifier of the Zigbee device; the network distribution platform gateway is determined according to the device protocol type to which the Zigbee device belongs, wherein the distribution network platform gateway supports building a Zigbee network; Device information for Zigbee devices.

In a fifth aspect, an access authentication apparatus is provided, which is configured to execute the method in the above-mentioned first aspect or each implementation manner thereof. Specifically, the apparatus includes functional modules for executing the methods in the above-mentioned first aspect or each implementation manner thereof.

In a sixth aspect, an access authentication apparatus is provided, which is configured to execute the method in the second aspect or each of its implementations. Specifically, the apparatus includes functional modules for executing the methods in the second aspect or the respective implementation manners thereof.

In a seventh aspect, an access authentication apparatus is provided, which is configured to execute the method in the third aspect or each of its implementations. Specifically, the apparatus includes functional modules for executing the methods in the third aspect or each of its implementations.

In an eighth aspect, an access authentication apparatus is provided, which is configured to execute the method in the above-mentioned fourth aspect or each implementation manner thereof. Specifically, the apparatus includes functional modules for executing the methods in the fourth aspect or the respective implementation manners thereof.

In a ninth aspect, an access authentication apparatus is provided, including a processor and a memory. The memory is used for storing a computer program, and the processor is used for calling and running the computer program stored in the memory to execute any one of the implementation manners of the first aspect to the fourth aspect or the method in each implementation manner thereof.

According to a tenth aspect, a chip is provided for implementing any one of the above-mentioned first to fourth aspects or the method in each implementation manner thereof. Specifically, the chip includes: a processor for invoking and running a computer program from a memory, so that a device on which the device is installed executes any one of the above-mentioned first to fourth aspects or each of its implementations method.

In an eleventh aspect, a computer-readable storage medium is provided for storing a computer program, the computer program causing a computer to execute the method in any one of the above-mentioned first to fourth aspects or each of its implementations.

In a twelfth aspect, a computer program product is provided, comprising computer program instructions, the computer program instructions causing a computer to perform the method in any one of the above-mentioned first to fourth aspects or the implementations thereof.

A thirteenth aspect provides a computer program that, when run on a computer, causes the computer to perform the method in any one of the above-mentioned first to fourth aspects or the implementations thereof.

Through the above technical solution, the device protocol type field is defined in the OLA device format to indicate the protocol type corresponding to the OLA device. For example, if the indicated protocol type is a Zigbee device, the network distribution platform gateway that supports the Zigbee protocol, The distribution network platform cloud and the device platform cloud corresponding to the Zigbee device perform access authentication for the Zigbee device, thereby enabling cross-platform access authentication.

Description of drawings

FIG. 1 is a block diagram of a Zigbee device cross-platform access authentication system provided by an exemplary embodiment of the present application.

FIG. 2 to FIG. 10 are flowcharts of the access authentication method provided by the exemplary embodiment of the present application.

FIG. 11 is a schematic block diagram of an access authentication apparatus provided according to an embodiment of the present application.

FIG. 12 is a schematic block diagram of an access authentication apparatus provided according to an embodiment of the present application.

FIG. 13 is a schematic block diagram of an access authentication apparatus provided according to an embodiment of the present application.

FIG. 14 is a schematic block diagram of an access authentication apparatus provided according to an embodiment of the present application.

FIG. 15 is a schematic structural diagram of a computer device provided by an exemplary embodiment of the present application.

Detailed ways

In order to facilitate the understanding of the technical solutions of the embodiments of the present application, the technical solutions of the present application are described in detail below through specific embodiments. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, which all belong to the protection scope of the embodiments of the present application. The embodiments of the present application include at least part of the following contents.

First, the terms involved in the embodiments of this application are briefly introduced:

Zigbee (Zigbee Protocol) technology:

Zigbee is a low-power local area network protocol based on the Institute of Electrical and Electronics Engineers (IEEE) 802.15.4 standard. According to international standards, ZigBee technology is a short-range, low-power wireless communication technology.

Since the usual transmission distance of ZigBee technology is less than 1 km (ie short distance), it is mainly used in Personal Area Network (PAN).

Beacon frame:

According to the beacon specification in IEEE802.15.4, two beacon frame formats are specified, one is a conventional beacon frame, and the other is an enhanced beacon (Enhance Beacon) frame.

Among them, the difference between the enhanced beacon frame and the conventional beacon frame is that there are more Information Elements (Information Elements, IEs) fields in the variable (variable) data, and there are fewer Guaranteed Time Slots (GTS) fields and Pending Address field.

Refer to Table 1 below.

Table 1: Enhanced Beacon Frames

As shown in Table 1, in the enhanced beacon frame, the information element field is further divided into header information elements (Header IEs) and payload information elements (Payload IEs);

In the header information unit, when the unit ID (Element ID) is 0, it means that the content is filled with the manufacturer-defined information, where the data length ranges from 0 to 127 bytes, and the first 3 bytes can be the supplier ( Vendor) Organizationally Unique Identifier (OUI), the remaining bytes can be customized according to the needs of the manufacturer. In this embodiment of the present application, the header information unit is filled with the first random number, the device identifier and the manufacturer identifier.

The device that supports the Zigbee protocol is a Zigbee device, and the Zigbee device corresponds to a unique installation code (Install Code). The Zigbee gateway needs to obtain the installation code of the Zigbee device, so as to connect the Zigbee device to the Zigbee network created by the Zigbee gateway.

In the related art, the installation code of the Zigbee device is obtained by scanning the QR code of the Zigbee device with the mobile phone or manually inputting the mobile phone, and then the mobile phone sends the installation code to the Zigbee gateway, which requires more human interaction.

Meanwhile, the above-mentioned related technologies do not realize the cross-platform access authentication of Zigbee devices, and a solution for cross-platform access authentication of Zigbee devices is urgently needed.

It should be understood that, in this embodiment of the present application, the Zigbee device may be an open link association (Open link Association, OLA) device, and the information of the OLA device may be in a specific format. In this embodiment of the present application, a device protocol type field may be added to the format to indicate the protocol type to which the OLA device belongs, for example, the Zigbee protocol type or other protocol types.

Below, the solution provided by the present application is exemplarily described.

FIG. 1 shows a block diagram of a Zigbee device cross-platform access authentication system provided by an exemplary embodiment of the present application. The system may include: Zigbee device 12 , distribution network platform gateway 141 , distribution network platform cloud 142 and device platform cloud 16 .

The Zigbee device 12 is a device that supports the Zigbee technology and can access the Zigbee network. Optionally, the Zigbee device 12 is a smart device (such as VR (Virtual Reality, virtual reality) glasses, a smart wearable device, etc.), a terminal device, or other device with network access capability, which is not limited in this embodiment of the present application. . In an example, when the Zigbee device cross-platform access authentication system is applied to smart home life, the Zigbee device 12 can be smart TV, smart speaker, smart air conditioner, smart light, smart doors and windows, smart curtains, smart sockets, etc. home equipment. Optionally, there is one Zigbee device 12, or there are multiple Zigbee devices 12, which are not limited in this embodiment of the present application. In practical applications, the number of Zigbee devices 12 can be combined with application requirements or can be managed by the distribution network platform gateway 141. The maximum number of devices, etc. are determined.

The Zigbee device 12 is configured to access the network by the distribution network platform gateway 141 , and the cloud server corresponding to the distribution network platform gateway 141 is the distribution network platform cloud 142 . The distribution network platform gateway 141 and the distribution network platform cloud 142 are connected through a wired or wireless network.

The distribution network platform gateway 141 refers to a device capable of configuring a Zigbee network. Optionally, the network distribution platform gateway 141 may be a server, a terminal device, a router, a terminal device, a mobile phone, a tablet computer, a wearable device, or any other device capable of configuring network access, which is not limited in this embodiment of the present application, and practical application , the implementation form of the distribution network platform gateway 141 can be determined in combination with the application scenario of the Zigbee device cross-platform access authentication system. In an example, when the Zigbee device cross-platform access authentication system is applied to smart home life, considering that the home environment has the characteristics of small area and frequent activities, the use of the distribution network platform gateway 141 that occupies a large space will affect the normal operation. For the home life, the distribution network platform gateway 141 can be implemented as a router, a terminal device, a mobile phone, a tablet computer, a wearable device, and the like. Optionally, the number of distribution network platform gateways 141 may be one or multiple, which is not limited in this embodiment of the present application. Generally, for the consideration of resource saving and other aspects, the number of distribution network platform gateways 141 is one. .

The Zigbee device 12 is developed based on the device platform cloud 16 , and the license key Kc of the Zigbee device 12 is stored in the device platform cloud 16 .

A communication link exists between the distribution network platform cloud 142 and the device platform cloud 16 . Optionally, the distribution network platform cloud 142 sends the information required in the access authentication process of the Zigbee device 12 to the device platform cloud 16; or, forwards the information required in the access authentication process of the Zigbee device 12 to the distribution network platform gateway 141. information.

The above-mentioned distribution network platform cloud 142 and device platform cloud 16 are cloud computing resource pools in the field of cloud technology, and multiple types of virtual resources are deployed in the resource pools for external customers to choose and use. The cloud computing resource pool mainly includes: computing devices (which are virtualized machines, including operating systems), storage devices, and network devices. It can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or it can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, intermediate Cloud servers for basic cloud computing services such as software services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.

Optionally, the system may further include a control device 18, and the distribution network platform gateway 141 and the control device 18 are connected through a wired or wireless network. The control device 18 is a device for the user to operate to control the distribution network platform gateway 141 . For example, the user can activate the distribution network platform gateway 141 by using the application program (Application) on the control device 18 . The control device 18 can be implemented as a terminal device, a mobile phone, a tablet computer, a wearable device, and the like.

FIG. 2 shows a flowchart of an access authentication method provided by an exemplary embodiment of the present application. The method can be applied to the Zigbee device cross-platform access authentication system as shown in FIG. 1 .

It should be noted that, in this embodiment of the present application, a Zigbee device is a device that supports the Zigbee technology and can access a Zigbee network. Optionally, Zigbee devices include various types of household equipment (such as electric lights), industrial assets (such as inspection equipment in hospitals), and the like. The device platform cloud is the cloud server corresponding to Zigbee device development. That is, the device platform cloud is the cloud server corresponding to the manufacturer to which the Zigbee device belongs. The distribution network platform gateway supports the construction of a Zigbee network. The distribution network platform cloud is the cloud server corresponding to the distribution network platform gateway.

It should be understood that, in this embodiment of the present application, the access authentication process of the Zigbee device may include a first access authentication process and a second access authentication process, wherein the first access authentication process is a device platform cloud authentication process. The Zigbee device is authenticated, that is, the cloud authentication device. The second access authentication process is that the Zigbee device authenticates the device platform cloud, that is, the device authentication cloud. This embodiment of the present application does not limit the execution order of the two authentication processes.

Wherein, in the first access authentication process, the Zigbee device can generate the first device-side key according to the first random number and the Zigbee device license key, and the device platform cloud can generate the first device-side key according to the first random number and the license key. Cloud key, the first device-side key and the first cloud key can be used for the first access authentication.

Optionally, the first random number may be generated by a device cloud platform, or may also be generated by a distribution network platform cloud, which is not limited in this application.

In the second access authentication process, the Zigbee device can generate a second device-side key according to the second random number and the license key, and the device platform cloud can generate a second cloud key according to the second random number and the license key. The second device-side key and the second cloud key can be used for the second access authentication.

FIG. 2 shows a schematic interaction diagram of performing the first access authentication first and then performing the second access authentication process.

It should be understood that before executing the process shown in FIG. 2, the distribution network platform gateway and the Zigbee device have established a secure connection based on the authentication end trust center link key (Trust Center Link Key, TCLK), wherein TCLK is based on the installation code (Install Code). Code) and the key generated by the license key Kc. Exemplarily, TCLK=AES-MMO (Install Code).

As shown in Figure 2, the method includes at least part of the following:

S21, the Zigbee device generates a second random number R2.

S22, the Zigbee device generates a first device-side key according to the first random number R1 and the license key of the Zigbee device.

Optionally, after the first device-side key, the Zigbee device stores the first device-side key in the attribute of the custom cluster. The custom cluster includes at least one attribute (Attribute), which is a data entity that reflects the state or property of the Zigbee device. In this embodiment of the present application, the attribute is used to store the device-side key corresponding to the Zigbee device. Optionally, the access type of the custom cluster is return after write.

In some embodiments, the Zigbee device uses a key generation algorithm to process the first random number R1 and the license key Kc to generate the first device-side key Auth1. Optionally, the key generation algorithm is a symmetric encryption algorithm, and the key generation algorithm includes: an Advanced Encryption Standard (Advanced Encryption Standard, AES)-MMO (Matyas-Meyer-Oseas) hash algorithm. Exemplarily, Auth1=AES-MMO(Kc|R1).

S23, the Zigbee device sends the second random number R2 and the first device-side key Auth1 to the distribution network platform gateway.

S24: The distribution network platform gateway sends a first access authentication request to the distribution network platform cloud, where the first access authentication request includes the second random number R2 and the first device-side key Auth1.

Optionally, the first access authentication request may also include a device address identifier of the Zigbee device, and the device address identifier of the Zigbee device is used to identify the medium access control (Medium Access Control, MAC) layer of the Zigbee device. Address, the device address identifier is used to uniquely identify a Zigbee device, and the device address identifier can be a 64-bit address. Exemplarily, the device address is identified as an Extended Unique Identifier (EUI).

Optionally, the first access authentication request may further include a company identifier (Company Identifier, CID) of the Zigbee device, where the manufacturer identifier is used to identify the manufacturer to which the Zigbee device belongs, and the manufacturer identifier may be 3 bytes.

S25, the distribution network platform cloud determines the device platform cloud corresponding to the Zigbee device to the device platform cloud according to the manufacturer identifier in the first access authentication request, and further sends a second access authentication request to the device platform cloud, so The second access authentication request includes the second random number R2 and the first device-side key.

Optionally, the second access authentication request may further include a device address identifier of the Zigbee device, where the device address identifier of the Zigbee device is used to identify the MAC address of the Zigbee device. Exemplarily, the device address is identified as EUI.

S26, the device platform cloud determines the license key Kc of the Zigbee device according to the device address identifier in the second access authentication request, and further generates a first cloud key Auth1 according to the first random number and the license key '.

In some embodiments, the device platform cloud uses a key generation algorithm to process the first random number R1 and the license key Kc to generate the first cloud-end key Auth1'. Optionally, the key generation algorithm is a symmetric encryption algorithm, and the key generation algorithm includes: an Advanced Encryption Standard (Advanced Encryption Standard, AES)-MMO (Matyas-Meyer-Oseas) hash algorithm. Exemplarily, Auth1'=AES-MMO(Kc|R1).

S27, the device platform cloud performs the first access authentication according to the first cloud key Auth1' and the first device-side key Auth1 in the authentication of the second access request.

For example, if the first cloud key Auth1' and the first device-side key Auth1 are equal, it is determined that the authentication is successful, otherwise the authentication fails.

Further optionally, in the case of successful authentication, a second cloud key Auth2' is generated according to the second random number R2 and the license key.

S28, the device platform cloud sends the second cloud key Auth2' and the authentication result of the second access authentication to the distribution network platform cloud.

S29, the distribution network platform cloud sends the second cloud key Auth2' and the authentication result of the second access authentication to the distribution network platform gateway.

If the authentication result is that the authentication is successful, execute S291; otherwise, execute S210.

S291, the distribution network platform gateway adds the Zigbee device to the device blacklist.

The device blacklist is used to record the devices that fail to configure the network. Optionally, the Zigbee devices in the device blacklist are removed from the Zigbee network constructed by the distribution network platform gateway.

It can be understood that, since the Zigbee device has joined the Zigbee network constructed by the distribution platform gateway during the first access authentication process, the distribution platform gateway after the authentication fails removes the Zigbee device from the Zigbee network.

S210, the distribution network platform gateway sends the second cloud key Auth2' to the Zigbee device.

In some embodiments, the write request sent by the distribution network platform gateway to the custom cluster of the Zigbee device, the write request carries the second cloud key Auth2'.

So far, the Zigbee device has obtained the second cloud key Auth2'.

Further, in S211, a second device-side key Auth2 is generated according to the second random number R2 and the license key Kc.

Optionally, after generating the second device-side key, the Zigbee device stores the second device-side key in the attribute of the custom cluster. The custom cluster includes at least one attribute (Attribute), and the attribute is a data entity that reflects the state or property of the Zigbee device. In this embodiment of the present application, the attribute is used to store the device-side key corresponding to the Zigbee device. Optionally, the access type of the custom cluster is return after write.

S212: Perform second access authentication according to the second device-side key Auth2 and the second cloud key Auth2'.

For example, if the second cloud key Auth2' and the second device-side key Auth2 are equal, it is determined that the authentication is successful, otherwise the authentication fails.

S213: Send the authentication result of the second access authentication to the network distribution platform gateway.

For example, if the authentication is successful, S213 is executed.

In the case of authentication failure, the Zigbee device actively leaves the Zigbee network. Further optionally, first indication information is sent to the distribution network platform gateway, which is used to instruct the Zigbee device to leave the Zigbee network.

S214, the distribution network platform gateway adds the Zigbee device to the device blacklist in the case that the authentication fails.

S215, in the case of successful authentication, the distribution network platform gateway and the Zigbee device establish a normal connection.

Optionally, the updated TCLK is used to encrypt application support layer (Application Support Sublayer, APS) data transmission.

FIG. 3 shows a schematic interaction diagram of performing the second access authentication first and then performing the first access authentication process.

It should be understood that, before executing the process shown in FIG. 3 , the network distribution platform gateway and the Zigbee device have established a secure connection based on TCLK, where TCLK is a key generated based on the first random number and the license key.

It should be understood that the same steps in the embodiment shown in FIG. 3 and the embodiment shown in FIG. 2 are not repeated here, and refer to the embodiment shown in FIG. 2 for specific implementation.

As shown in Figure 3, the method includes at least part of the following:

S21, the Zigbee device generates a second random number R2.

S23, the Zigbee device sends the second random number R2 and the first device-side key to the distribution network platform gateway.

Optionally, in some embodiments, S23 may also only send the second random number R2, and when the authentication result of the second access authentication is that the authentication is successful, then send the first device-side key.

S220: The distribution network platform gateway sends a first access authentication request to the distribution network platform cloud, where the first access authentication request includes the second random number R2.

Optionally, the first access authentication request may further include a device address identifier of the Zigbee device.

Optionally, the first access authentication request may further include the manufacturer identifier of the Zigbee device.

S221, the network distribution platform cloud determines the device platform cloud corresponding to the Zigbee device to the device platform cloud according to the manufacturer identifier in the first access authentication request, and further sends a second access authentication request to the device platform cloud, where The second access authentication request includes the second random number R2.

Optionally, the second access authentication request may further include a device address identifier of the Zigbee device.

S222, the device platform cloud generates a second cloud key Auth2' according to the second random number R2 and the license key.

S223, the device platform cloud sends the second cloud key Auth2' to the distribution network platform cloud.

S224, the distribution network platform cloud sends the second cloud key Auth2' to the distribution network platform gateway.

S225, the distribution network platform gateway sends the second cloud key Auth2' to the Zigbee device.

In some embodiments, the distribution network platform gateway sends a write request to the custom cluster of the Zigbee device, and the write request carries the second cloud key Auth2'.

So far, the Zigbee device has obtained the second cloud key Auth2'.

Further, in S226, a second device-side key Auth2 is generated according to the second random number R2 and the license key Kc.

S227: Perform second access authentication according to the second device-side key Auth2 and the second cloud key Auth2'.

S228, in the case of authentication failure, actively leave the Zigbee network.

Further optionally, first indication information is sent to the distribution network platform gateway, which is used to instruct the Zigbee device to leave the Zigbee network.

S229: Send the authentication result of the second access authentication to the network distribution platform gateway.

For example, if the authentication is successful, the Zigbee device executes S229.

S230 , when the authentication is successful, the distribution network platform gateway sends a third access authentication request to the distribution network platform cloud, where the third access authentication request includes the first device-side key Auth1.

Optionally, the third access authentication request may further include a device address identifier of the Zigbee device.

Optionally, the third access authentication request may further include the manufacturer identifier of the Zigbee device.

S231: The distribution network platform cloud sends a fourth access authentication request to the device platform cloud, where the fourth access authentication request includes the first device-side key Auth1.

S232, the device platform cloud generates a first cloud key Auth1' according to the first random number R1 and the license key.

S233, the device platform cloud performs first access authentication according to the first cloud key Auth1' and sending the first device-side key Auth1.

S234, the device platform cloud sends the authentication result of the first access authentication to the distribution network platform cloud.

S234, the distribution network platform cloud sends the authentication result of the first access authentication to the distribution network platform gateway.

S236, in the case that the authentication fails, the network distribution platform gateway adds the Zigbee device to the device blacklist.

Optionally, the Zigbee devices in the device blacklist are removed from the Zigbee network constructed by the distribution network platform gateway.

S237, in the case of successful authentication, establish a normal connection between the distribution network platform gateway and the Zigbee device.

Optionally, the updated TCLK is used to encrypt the data transmission of the APS.

Hereinafter, the installation code of the Zigbee device and the acquisition method of the first random number will be described with reference to FIG. 4 and FIG. 5 .

As shown in Figure 4, the following steps may be included:

S301: The distribution network platform gateway sends a first request to the distribution network platform cloud, where the first request is used to request an installation code and a first random number of the Zigbee device. Optionally, the first request may be referred to as an installation code request.

Optionally, the first request may include a device address identifier of the Zigbee device.

Optionally, the first request may include the manufacturer identifier of the Zigbee device.

S302, the distribution network platform cloud determines a device platform cloud corresponding to the Zigbee device according to the manufacturer identifier in the first request, and further sends an installation code request to the device platform cloud.

Optionally, the installation code request may include a device address identifier of the Zigbee device.

Optionally, the installation code request may include the manufacturer identification of the Zigbee device.

S303, the device platform cloud determines the installation code of the Zigbee device according to the device address identifier, and generates a first random number R1.

S304, the device platform cloud sends the installation code of the Zigbee device and the first random number to the distribution network platform cloud.

S305, the distribution network platform cloud sends the installation code of the Zigbee device and the first random number to the distribution network platform gateway.

S306, the distribution network platform gateway sends the first random number to the Zigbee device.

In the example shown in FIG. 5 , the installation code of the Zigbee device may be obtained from the Zigbee device, for example, the terminal device may obtain the device information of the Zigbee device from the Zigbee device, for example, by scanning the code of the Zigbee device However, this application is not limited to this. The device information of the Zigbee device may include an installation code. Further, the terminal device may send the device information of the Zigbee device to the distribution network platform gateway, so that the distribution network platform gateway can learn the installation code of the Zigbee device.

Optionally, the terminal device may correspond to the control device 18 in the foregoing.

As shown in Figure 5, the following steps may be included:

S401, the distribution network platform gateway sends a first request to the distribution network platform cloud, where the first request is used to request a first random number. Optionally, the first request may be referred to as a random number request.

S402, the distribution network platform cloud generates a first random number R1.

S403, the distribution network platform cloud determines the device platform cloud corresponding to the Zigbee device according to the manufacturer identifier in the first request, and further sends the first random number R1 and the device address identifier of the Zigbee device to the device platform cloud.

S404, the device platform cloud establishes a corresponding relationship between the first random number R1 and the Zigbee device.

S405, the distribution network platform cloud sends a first random number to the distribution network platform gateway.

S406, the distribution network platform gateway sends the first random number to the Zigbee device.

Hereinafter, the specific process of acquiring the device information of the Zigbee device will be described with reference to FIG. 6 .

As shown in Figure 6, at least some of the following steps may be included:

S501, a terminal device acquires device information of the Zigbee device.

Optionally, the device information of the Zigbee device includes a device protocol type of the Zigbee device (for example, indicating Zigbee), a device address identifier of the Zigbee device, and a manufacturer identifier of the Zigbee device.

Optionally, it can be obtained by scanning the QR code of the Zigbee device, but the present application is not limited to this.

Optionally, in some embodiments, the device information of the Zigbee device may include an installation code of the Zigbee device.

Optionally, the installation code of the Zigbee device may be the PIN code of the Zigbee device.

S502, the terminal device determines the corresponding network distribution platform gateway according to the protocol type corresponding to the Zigbee device, wherein the network distribution platform gateway supports the protocol type corresponding to the Zigbee device, for example, if the protocol type indicates Zigbee, the network distribution platform gateway supports Build a Zigbee network.

Further, in S503, the terminal device sends the device information of the Zigbee device to the network distribution platform gateway, so that the network distribution platform gateway can learn the device information of the Zigbee device.

Hereinafter, the solutions shown in the present application will be exemplarily described with reference to the following examples.

In the following embodiment, CID is used to represent the manufacturer's identity, R1 to represent the first random number, EUI to represent the device address identifier, R2 to represent the second random number, Kc to represent the license key, Install Code to represent the device-side installation code, and Install Code' to represent Authenticator installation code, TCLK represents the device-side trust center link key, TCLK' represents the authenticator's trust center link key, Network Key represents the network key, Auth1 represents the first device-side key, Auth1' represents the first cloud key , Auth2 represents the second device-side key, and Auth2' represents the second cloud key for exemplary description.

FIG. 6 shows a flowchart of an access authentication method provided by an exemplary embodiment of the present application. The method can be applied to the Zigbee device cross-platform access authentication system as shown in FIG. 1 , and the method includes:

601, the distribution network platform gateway builds a Zigbee network;

602, the control device obtains the out-of-band information of the Zigbee device, which corresponds to the preceding device information;

For example, the user scans the QR code through the APP to obtain the out-of-band information of the Zigbee device.

603. As an example, the device information of the Zigbee device may include the following information:

Protocol field, used to indicate the device protocol type;

The MAC field, for example, can be the EUI information of the Zigbee device;

CATID, the field is used to indicate the manufacturer identification of the Zigbee device, such as CID;

604, the Zigbee device generates a broadcast beacon frame (Beacon);

605, the control device sends the device information to the distribution network platform gateway.

For example, the user sends the CID|EUI to the distribution network platform gateway through the APP;

606, the distribution network platform gateway stores CID|EUI information;

607, the distribution network platform gateway performs Permit Join;

608, the distribution network platform gateway starts scanning;

609, the Zigbee device sends the Beacon broadcast request channel by channel;

610, the distribution network platform gateway returns a Beacon reply;

611, the Zigbee device sends an association request to the distribution network platform gateway;

612, the distribution network platform gateway returns an association response to the ZIGBEE device;

613, the distribution network platform gateway sends a request for obtaining the installation code to the distribution network platform cloud, carrying the data CID|EUI;

6131, the distribution network platform cloud obtains the equipment cloud platform of the corresponding manufacturer through the CID;

6132: Send a request for obtaining the installation code to the device platform cloud of the Zigbee device;

6133, the device platform cloud queries the Install Code according to the EUI, and generates the first random number R1;

6134, the device platform cloud returns a response to the distribution network platform cloud, carrying the data Install Code and R1;

614, the distribution network platform cloud returns a response to the distribution network platform gateway, carrying the data Install Code and R1;

615. After the distribution network platform gateway gets the Install Code, it generates TCLK according to the Install Code;

For example, TCLK=AES-MMO(Install Code);

616. The Zigbee device generates TCLK' according to the installation code.

For example, TCLK'=AES-MMO(Install Code);

617. The distribution network platform gateway establishes a secure connection based on TCLK and TCLK' with the Zigbee device, and the distribution network platform gateway encrypts (Network Key) through TCLK' and sends the encrypted data to the Zigbee device;

618. If the Zigbee device does not have the Install Code consistent with the device platform cloud, it cannot access the network established by the distribution network platform gateway; only the Zigbee device has the Install Code consistent with the device platform cloud, the Zigbee device can get the correct Network Key;

619, the Zigbee device sends a device announcement broadcast.

Device announcement (Device announce) broadcast is used to indicate that Zigbee devices are connected to the Zigbee network constructed by the distribution network platform gateway;

620, the distribution network platform gateway obtains the customized cluster information of the Zigbee device, and the access type of the cluster is write-return (W*R), and the distribution network platform gateway sends a request to write R1 to the customized cluster of the Zigbee device ;

621. After receiving the request to write R1, the custom Cluster of the Zigbee device generates Auth1=AES-MMO(Kc|R1), generates a random number R2, and stores Auth1|R2 in the custom Cluster;

622, the Zigbee device returns Auth1|R2 to the distribution network platform gateway;

623, the distribution network platform gateway sends an authentication request to the distribution network platform cloud, carrying the CID|Auth1|EUI|R2 data;

6231, the distribution network platform cloud obtains the equipment cloud platform of the corresponding manufacturer through the CID;

6232, the distribution network platform cloud sends an authentication request to the device platform cloud, carrying the data Auth1|EUI|R2;

6233, the device platform cloud searches for the Kc of the Zigbee device according to the EUI, and generates Auth1'=AES-MMO(Kc|R1).

If Auth1'=Auth1 indicates that the authentication is successful, and calculate Auth2=AES-MMO(Kc|R2), if it is not equal, then the authentication fails Auth2=illegal value;

6234, the device platform cloud returns the authentication result and Auth2 to the distribution network platform cloud;

624, the distribution network platform cloud returns the authentication result and Auth2 to the distribution network platform gateway;

625, the network distribution platform gateway determines that the cloud authentication device fails, adds the Zigbee device to the device blacklist, and removes the Zigbee device from the network; the cloud authentication device succeeds, write Auth2 to the manufacturer-defined Cluster2, and the type is R*W for example;

626, the Zigbee device generates Auth2'=AES-MMO(Kc|R2), if Auth2'=Auth2 authentication succeeds, otherwise fails;

627, the Zigbee device returns the authentication result;

628, the device authentication cloud fails, the network distribution platform gateway adds the Zigbee device to the device blacklist and removes the Zigbee device from the network.

629, if the device authentication cloud is successful, then continue to perform the following process;

630, update TCLK, and establish a normal connection.

In the embodiment corresponding to FIG. 6 , the installation code of the Zigbee device is obtained from the device cloud platform. In the embodiment of FIG. 7 , the installation code of the Zigbee device is obtained from the Zigbee device. For the specific acquisition method, please refer to FIG. 5 Detailed description of examples.

FIG. 7 shows a flowchart of an access authentication method provided by an exemplary embodiment of the present application. The method can be applied to the Zigbee device cross-platform access authentication system as shown in FIG. 1 . On the basis of Figure 6, the following steps of the method are adjusted:

703. As an example, the device information of the Zigbee device may include the following information:

Protocol field, used to indicate the device protocol type;

The MAC field, for example, can be the EUI information of the Zigbee device;

installation code.

In this embodiment, the installation code may be the PIN code of the Zigbee device.

705, the control device sends the CID|EUI|Install Code to the distribution network platform gateway.

713 , the distribution network platform gateway sends an R1 request to the distribution network platform cloud, carrying the data CID|EUI.

715 , the device platform cloud establishes a corresponding relationship between the EUI and the R1.

It can be understood that, other steps in FIG. 7 refer to the above-mentioned embodiments, and are not repeated here.

In the embodiment corresponding to FIG. 7 , the Zigbee device obtains R1 before the Zigbee device and the distribution network platform gateway establish a TCLK-based secure connection. In the embodiment of FIG. 8 , the Zigbee device obtains R1 before the Zigbee device and the distribution network platform gateway establish After TCLK based secure connection. For the implementation of the specific steps in FIG. 8 , reference is made to the relevant steps in FIG. 7 , which will not be repeated here.

In the embodiment corresponding to FIG. 7 , the first access authentication is before the second access authentication. In the embodiment of FIG. 9 , the first access authentication is after the second access authentication, that is, the device authenticates the cloud first. The device is authenticated by the cloud.

921, the distribution network platform gateway obtains the customized cluster (Cluster) information of the Zigbee device, the access type of the Cluster is write-return (W*R), and the distribution network platform gateway sends a request to write R1 to the customized Cluster1 of the Zigbee device;

922. After receiving the request to write R1, the custom Cluster1 of the Zigbee device generates Auth1=AES-MMO(Kc|R1), generates a random number R2, and stores Auth1|R2 in the custom Cluster;

923, the Zigbee device returns Auth1|R2 to the distribution network platform gateway;

924, the distribution network platform gateway sends an authentication request to the distribution network platform cloud, carrying the CID|EUI|R2 data;

9241, the distribution network platform cloud obtains the equipment cloud platform of the corresponding manufacturer through the CID;

9242, the distribution network platform cloud sends an authentication request to the device platform cloud, carrying the data EUI|R2;

9243, the device platform cloud obtains the Kc of the device according to the EUI, and then generates Auth2 according to Kc and R2, for example, Auth2=AES-MMO(Kc|R2);

9244, the device platform cloud returns Auth2 to the distribution network platform cloud;

925, the distribution network platform cloud returns Auth2 to the distribution network platform gateway;

926, the distribution network platform gateway writes Auth2 to the manufacturer-defined Cluster2, for example, the type is R*W;

927, the Zigbee device generates Auth2'=AES-MMO(Kc|R2), if Auth2'=Auth2 authentication succeeds, otherwise fails;

9271, if the authentication fails, it will take the initiative to leave the Zigbee network. Optionally, the first indication information can also be sent to indicate leaving the Zigbee network;

928, the distribution network platform gateway receives the first indication information of the Zigbee device, and adds the Zigbee device to the device blacklist.

9272, the authentication is successful, and the Zigbee device determines to return the authentication result;

929, the Zigbee device returns the authentication result;

930, the device authentication cloud succeeds, the distribution network platform gateway sends an authentication request to the distribution network platform cloud, carrying the data CID|EUI|Auth1;

9301, the distribution network platform cloud sends to the corresponding device platform cloud according to the CID.

9302, the distribution network platform cloud sends an authentication request to the corresponding device platform cloud according to the CID, carrying the data EUI|Auth1.

9303. The device platform cloud determines the Kc of the device according to the EUI, and generates Auth1' according to the first random number R1 and Kc.

The first access authentication is performed according to Auth1 and Auth1'. If the two are equal, it is determined that the authentication is successful, otherwise, it is determined that the authentication fails.

9304, the authentication result of the first access authentication from the device platform cloud to the distribution network platform cloud.

931. The distribution network platform cloud returns the authentication result of the first access authentication to the distribution network platform gateway.

932, the cloud authentication device fails, then the Zigbee device is added to the device blacklist, and the Zigbee device is removed from the network.

932, the cloud authenticates the device, updates the TCLK, and establishes a normal connection.

It should be noted that, the foregoing method embodiments may be implemented separately, or may be implemented in combination, which is not limited in this application.

FIG. 11 shows a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application. The apparatus can be implemented as a Zigbee device, or be implemented as a part of a Zigbee device. The apparatus 1000 includes:

a processing unit 1010, configured to generate a second random number;

generating a second device-side key according to the second random number and a license key, the license key being a key stored in the Zigbee device and the device platform cloud of the Zigbee device; and

The second access authentication of the Zigbee device is performed according to the second device-side key.

In an optional embodiment, the apparatus 1000 further includes:

a communication unit, configured to receive the first random number sent by the distribution network platform gateway, wherein the distribution network platform gateway supports the construction of a Zigbee network;

The processing unit 1010 is further configured to: generate a first device-side key according to the first random number and the license key, where the first device-side key is used for first access authentication of the Zigbee device .

In an optional embodiment, the apparatus 1000 further includes:

A communication unit, configured to receive a random number write request sent by the network distribution platform gateway to the custom cluster of the Zigbee device, where the random number write request carries the first random number.

In an optional embodiment, the processing unit 1010 is further configured to:

Using a first key generation algorithm, the first random number and the license key are processed to generate the first device-side key.

In an optional embodiment, the first key generation algorithm includes: an AES-MMO hash algorithm.

In an optional embodiment, the apparatus 1000 further includes:

A communication unit, configured to send the second random number and the first device-side key to the device platform cloud through the distribution network platform gateway and the distribution network platform cloud, wherein the distribution network platform cloud is the The cloud server corresponding to the distribution network platform gateway, the second random number is used for the device platform cloud to generate a second cloud key, and the second cloud key is used for the second access authentication of the Zigbee device.

In an optional embodiment, the apparatus 1000 further includes:

a communication unit, configured to receive the authentication result of the first access authentication and the second cloud key sent by the network distribution platform gateway in the case that the authentication result of the first access authentication is authentication successful, The authentication result of the first access authentication is determined by the device cloud platform according to the first device-side key and the first cloud key, and the first cloud key is determined by the device cloud platform according to the The first random number and the license key are generated.

In an optional embodiment, the processing unit 1010 is further configured to:

The authentication result of the second access authentication is determined according to the second device-side key and the second cloud key.

In an optional embodiment, the apparatus 1000 further includes:

A communication unit, configured to send the authentication result of the second access authentication to the network distribution platform gateway.

In an optional embodiment, the apparatus 1000 further includes:

A communication unit, configured to send the second random number to the device platform cloud of the Zigbee device through the distribution network platform gateway and the distribution network platform cloud, wherein the distribution network platform cloud corresponds to the distribution network platform gateway the cloud server, the second random number is used for the device platform cloud to generate a second cloud key, and the second cloud key is used for the second access authentication of the Zigbee device.

In an optional embodiment, the apparatus 1000 further includes:

A communication unit, configured to receive the second cloud key sent by the distribution network platform gateway.

In an optional embodiment, the apparatus 1000 further includes:

A communication unit, configured to receive a write request sent by the distribution network platform gateway to the custom cluster of the Zigbee device, where the write request carries the second cloud key.

In an optional embodiment, the processing unit 1010 is further configured to:

In an optional embodiment, the apparatus 1000 further includes:

A communication unit, configured to send the authentication result of the second access authentication to the network distribution platform gateway when the authentication result of the second access authentication is authentication success.

In an optional embodiment, the processing unit 1010 is further configured to:

If the authentication result of the second access authentication is authentication failure, leave the Zigbee network.

In an optional embodiment, the apparatus 1000 further includes:

a communication unit, configured to send first indication information to the distribution network platform gateway, where the first indication information is used to indicate

In an optional embodiment, the first device-side key is stored in a custom cluster of the Zigbee device, and the second device-side key is stored in the custom cluster of the Zigbee device, so The access type of the described custom cluster is return after write.

In an optional embodiment, the processing unit 1010 is further configured to:

Using a second key generation algorithm, the second random number and the license key are processed to generate the second device-side key.

In an optional embodiment, the second key generation algorithm includes: an AES-MMO hash algorithm.

12 shows a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application. The apparatus 1100 may be implemented as a device platform cloud, or may be implemented as a part of the device platform cloud. The apparatus 1100 includes:

The processing unit 1110 is configured to generate the first cloud key according to the first random number and the license key, wherein the device platform cloud is the cloud server of the manufacturer to which the Zigbee device of the Zigbee protocol belongs, and the license key is stored in the cloud server. The Zigbee device and the key in the device platform cloud of the Zigbee device, the first random number is generated by the device platform cloud, or the first random number is obtained from the distribution network platform cloud, so The distribution network platform cloud is a cloud server corresponding to the distribution network platform gateway that supports the construction of Zigbee networks; and

The first access authentication of the Zigbee device is performed according to the first cloud key.

In an optional embodiment, the apparatus 1100 further includes:

A communication unit, configured to receive a first access authentication request sent by the distribution network platform cloud, where the first access authentication request includes a second random number and a first device-side key, and the second random number is Generated by the Zigbee device, and the first device-side key is generated by the Zigbee device according to the first random number and the license key;

The processing unit 1110 is further configured to: generate a second cloud key according to the second random number and the license key, where the second cloud key is used for the second access authentication of the Zigbee device.

In some optional embodiments, the processing unit 1110 is further configured to:

When the authentication result of the first access authentication is that the authentication is successful, the second cloud key is generated according to the second random number and the license key.

In an optional embodiment, the apparatus 1100 further includes:

A communication unit, configured to send the authentication result of the first access authentication and the second cloud key to the distribution network platform cloud.

In an optional embodiment, the apparatus 1100 further includes:

a communication unit, configured to receive a second random number sent by the distribution network platform cloud, where the second random number is generated by the Zigbee device;

In an optional embodiment, the apparatus 1100 further includes:

A communication unit, configured to send the second cloud key to the distribution network platform cloud.

In an optional embodiment, the apparatus 1100 further includes:

A communication unit, configured to receive a first access authentication request sent by the distribution network platform cloud, where the first access authentication request includes the first device-side key.

In an optional embodiment, the apparatus 1100 further includes:

A communication unit, configured to receive a first request sent by the distribution network platform cloud, where the first request is used to request the installation code and the first random number of the Zigbee device, or the first request is used to request all the first random number.

In an optional embodiment, the apparatus 1100 further includes:

A communication unit, configured to send the installation code of the Zigbee device and the first random number to the distribution network platform cloud, or send the first random number to the distribution network platform cloud.

In an optional embodiment, the first request further includes: a device address identifier of the Zigbee device and a manufacturer identifier of the Zigbee device.

13 shows a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application. The apparatus 1200 may be implemented as a distribution network platform gateway, or may be implemented as a part of the distribution network platform gateway. The apparatus 1200 includes:

The communication unit 1200 is configured to receive the second random number and the first device-side key sent by the Zigbee device of the Zifeng protocol, wherein the network distribution platform gateway supports the construction of a Zigbee network, and the first device-side key is the Zigbee network The device is generated according to the first random number and the license key of the Zigbee device, the second random number is used for the device platform cloud of the Zigbee device to determine the second cloud key, and the second cloud key is used for a second access authentication for the Zigbee device; and

Send a first access authentication request to the distribution network platform cloud, where the first access authentication request includes the second random number, or the first access authentication request includes the second random number and the first A device-side key, where the first device-side key is used for the device platform cloud to perform first access authentication for the Zigbee device, and the distribution network platform cloud is a cloud server corresponding to the distribution network platform gateway.

In an optional embodiment, the communication unit 1200 is further configured to:

Receive the second cloud key sent by the distribution network platform cloud, or the authentication result of the first access authentication and the second cloud key, where the authentication result of the first access authentication is The device cloud platform is determined according to the first device end key and the first cloud key, and the first cloud key is generated by the device cloud platform according to the first random number and the license key. of.

In an optional embodiment, the communication unit 1200 is further configured to: send a write request to the custom cluster of the Zigbee device, where the write request carries the second cloud key.

In an optional embodiment, the communication unit 1200 is further configured to: send the write to the custom cluster of the Zigbee device when the authentication result of the first access authentication is successful authentication ask.

In an optional embodiment, the apparatus further includes:

A processing unit, configured to add the Zigbee device to a device blacklist and remove the Zigbee device from the Zigbee network when the first authentication result is an authentication failure.

In an optional embodiment, the communication unit 1200 is further configured to: in the case that the authentication result of the second access authentication is authentication failure, receive the first indication information sent by the Zigbee device, the The first indication information is used to instruct the Zigbee device to leave the Zigbee network;

In an optional embodiment, the apparatus further includes:

The processing unit is configured to add the Zigbee device to the device blacklist.

In an optional embodiment, the communication unit 1200 is further configured to: send a first request to the distribution network platform cloud, where the first request is used to request the installation code of the Zigbee device and the first request A random number, or the first request is for requesting the first random number.

In an optional embodiment, the communication unit 1200 is further configured to: receive the installation code and the first random number of the Zigbee device sent by the distribution network platform cloud, or,

Receive the first random number sent by the distribution network platform cloud.

In an optional embodiment, the first access authentication request further includes a device address identifier of the Zigbee device and a manufacturer identifier of the Zigbee device.

FIG. 14 shows a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application. The apparatus 1300 may be implemented as a control device, or may be implemented as a part of the control device. The apparatus 1300 includes:

The communication unit 1310 is used to obtain the device information of the Zigbee device of the Zigbee protocol, wherein the device information of the Zigbee device includes the device protocol type of the Zigbee device, the device address identifier of the Zigbee device and the manufacturer identifier of the Zigbee device. ;

a processing unit 1320, configured to determine a distribution network platform gateway according to the device protocol type to which the Zigbee device belongs, wherein the distribution network platform gateway supports the construction of a Zigbee network;

The communication unit 1310 is further configured to: send the device information of the Zigbee device to the distribution network platform gateway.

In an optional embodiment, the device address identifier of the Zigbee device includes a media access control MAC address of the Zigbee device.

In an optional embodiment, the device information of the Zigbee device further includes: an installation code of the Zigbee device.

In an optional embodiment, the installation code of the Zigbee device is the PIN code of the Zigbee device.

FIG. 15 shows a schematic structural diagram of a computer device (such as a Zigbee device, a distribution network platform gateway, or a device platform cloud) provided by an exemplary embodiment of the present application. The computer device includes: a processor 101 , a receiver 102 , and a transmitter 103 , memory 104 and bus 105 .

The processor 101 includes one or more processing cores, and the processor 101 executes various functional applications and information processing by running software programs and modules.

The receiver 102 and the transmitter 103 may be implemented as a communication component, which may be a communication chip.

The memory 104 is connected to the processor 101 through the bus 105 .

The memory 104 may be configured to store at least one instruction, and the processor 101 may be configured to execute the at least one instruction, so as to implement various steps in the foregoing method embodiments.

Additionally, memory 104 may be implemented by any type or combination of volatile or non-volatile storage devices including, but not limited to, magnetic or optical disks, electrically erasable programmable Read Only Memory (Electrically-Erasable Programmable Read Only Memory, EEPROM), Erasable Programmable Read Only Memory (EPROM), Static Random Access Memory (SRAM), Read Only Memory (Read-Only Memory, ROM), magnetic memory, flash memory, programmable read-only memory (Programmable Read-Only Memory, PROM).

In an exemplary embodiment, the computer device includes a processor, a memory, and a transceiver (the transceiver may include a receiver for receiving information and a transmitter for transmitting information) and a transmitter.

In a possible implementation, when the computer device is implemented as a Zigbee device,

The processor is used to generate a second random number; a second device-side key is generated according to the second random number and a license key, and the license key is stored in the Zigbee device and the Zigbee device. The key in the device platform cloud; and the second access authentication of the Zigbee device is performed according to the second device-side key.

Wherein, when the computer device is implemented as a Zigbee device, the processor and transceiver in the computer device involved in the embodiments of the present application may perform the steps performed by the Zigbee device in any of the methods shown in the above-mentioned FIG. 2 to FIG. 10 , It will not be repeated here.

In a possible implementation, when the computer device is implemented as a distribution network platform gateway,

The transceiver is configured to receive the second random number and the first device-side key sent by the Zigbee device of the Zifeng protocol; and send the first access authentication request to the distribution network platform cloud, where the first access authentication request includes all the second random number, or the first access authentication request includes the second random number and the first device-side key.

Wherein, when the computer device is implemented as a distribution network platform gateway, the processor and transceiver in the computer device involved in the embodiments of the present application may perform any of the methods shown in the above-mentioned FIG. 2 to FIG. 10 , and the distribution network platform gateway The steps to be performed are not repeated here.

In one possible implementation, when the computer device is implemented as a device platform cloud,

The processor is configured to generate a first cloud key according to the first random number and the license key; and perform first access authentication of the Zigbee device according to the first cloud key.

Wherein, when the computer device is implemented as a device platform cloud, the processors and transceivers in the computer device involved in the embodiments of the present application may perform any of the methods shown in the foregoing FIG. 2 to FIG. 10 . The steps are not repeated here.

In a possible implementation, when the computer device is implemented as a control device,

The transceiver is used to obtain the device information of the Zigbee device of Zigbee protocol, wherein the device information of the Zigbee device includes the device protocol type of the Zigbee device, the device address identifier of the Zigbee device and the manufacturer identifier of the Zigbee device;

The processor is configured to determine a distribution network platform gateway according to the device protocol type to which the Zigbee device belongs, wherein the distribution network platform gateway supports building a Zigbee network;

The transceiver is further configured to send the device information of the Zigbee device to the distribution network platform gateway.

Wherein, when the computer device is implemented as a control device, the processor and transceiver in the computer device involved in the embodiments of the present application may execute any of the methods shown in FIG. 2 to FIG. 10 above, and be executed by the control device or the terminal device. steps, which are not repeated here.

In an exemplary embodiment, a computer-readable storage medium is also provided, and a computer program is stored in the computer-readable storage medium, and the computer program is loaded and executed by a processor to implement the methods provided by the foregoing method embodiments. An access authentication method performed by a computer device.

In an exemplary embodiment, a computer program product is also provided, which, when running on the processor of the computer device, causes the network device to execute the access authentication method described in the above aspects.

In an exemplary embodiment, a chip is also provided, the chip includes a programmable logic circuit and/or program instructions, and when the chip runs on a computer device, is used to implement the access authentication described in the above aspects method.

The above descriptions are only optional embodiments of the present application, and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the protection of the present application. within the range.

It should be understood that the processor in this embodiment of the present application may be an integrated circuit chip, which has a signal processing capability. In the implementation process, each step of the above method embodiments may be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software. The above-mentioned processor can be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), an off-the-shelf programmable gate array (Field Programmable Gate Array, FPGA) or other available Programming logic devices, discrete gate or transistor logic devices, discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.

It can be understood that the memory in this embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Wherein, the non-volatile memory may be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically programmable read-only memory (Erasable PROM, EPROM). Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory. Volatile memory may be Random Access Memory (RAM), which acts as an external cache. By way of illustration and not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synchlink DRAM, SLDRAM) ) and direct memory bus random access memory (Direct Rambus RAM, DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but not be limited to, these and any other suitable types of memory.

It should be understood that the above memory is an example but not a limitative description, for example, the memory in the embodiment of the present application may also be a static random access memory (static RAM, SRAM), a dynamic random access memory (dynamic RAM, DRAM), Synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection Dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM) and so on. That is, the memory in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

Embodiments of the present application further provide a computer-readable storage medium for storing a computer program.

Optionally, the computer-readable storage medium can be applied to the network device in the embodiments of the present application, and the computer program enables the computer to execute the corresponding processes implemented by the network device in each method of the embodiments of the present application. For brevity, here No longer.

Optionally, the computer-readable storage medium can be applied to the mobile terminal/terminal device in the embodiments of the present application, and the computer program enables the computer to execute the corresponding processes implemented by the mobile terminal/terminal device in each method of the embodiments of the present application. , and are not repeated here for brevity.

Embodiments of the present application also provide a computer program product, including computer program instructions.

Optionally, the computer program product can be applied to the network device in the embodiments of the present application, and the computer program instructions cause the computer to execute the corresponding processes implemented by the network device in each method of the embodiments of the present application. Repeat.

Optionally, the computer program product can be applied to the mobile terminal/terminal device in the embodiments of the present application, and the computer program instructions cause the computer to execute the corresponding processes implemented by the mobile terminal/terminal device in each method of the embodiments of the present application, For brevity, details are not repeated here.

The embodiments of the present application also provide a computer program.

Optionally, the computer program can be applied to the network device in the embodiments of the present application. When the computer program is run on the computer, it causes the computer to execute the corresponding processes implemented by the network device in each method of the embodiments of the present application. For the sake of brevity. , and will not be repeated here.

Optionally, the computer program can be applied to the mobile terminal/terminal device in the embodiments of the present application, and when the computer program runs on the computer, the computer program is implemented by the mobile terminal/terminal device in each method of the embodiments of the present application. The corresponding process, for the sake of brevity, will not be repeated here.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above may refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution, and the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited to this. should be covered within the scope of protection of this application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

A method for access authentication, comprising:

The Zigbee device of Zifeng protocol generates the second random number;

Generate a second device-side key according to the second random number and a license key, where the license key is a key stored in the Zigbee device and the device platform cloud of the Zigbee device;

The second access authentication of the Zigbee device is performed according to the second device-side key.
The method according to claim 1, wherein the method further comprises:

The Zigbee device receives the first random number sent by the distribution network platform gateway, wherein the distribution network platform gateway supports the construction of a Zigbee network;

A first device-side key is generated according to the first random number and the license key, where the first device-side key is used for first access authentication of the Zigbee device.
The method according to claim 2, wherein the Zigbee device receives the first random number sent by the distribution network platform gateway, comprising:

The Zigbee device receives a random number write request sent by the distribution network platform gateway to the custom cluster of the Zigbee device, where the random number write request carries the first random number.
The method according to claim 2 or 3, wherein the generating a first device-side key according to the first random number and the license key comprises:

Using a first key generation algorithm, the first random number and the license key are processed to generate the first device-side key.
The method according to claim 4, wherein the first key generation algorithm comprises: AES-MMO hash algorithm.
The method according to any one of claims 2-5, wherein the method further comprises:

The Zigbee device sends the second random number and the first device key to the device platform cloud through the distribution network platform gateway and the distribution network platform cloud, wherein the distribution network platform cloud is the The cloud server corresponding to the distribution network platform gateway, the second random number is used for the device platform cloud to generate a second cloud key, and the second cloud key is used for the second access authentication of the Zigbee device.
The method according to claim 6, wherein the method further comprises:

The Zigbee device receives the authentication result of the first access authentication and the second cloud key that are sent by the network distribution platform gateway under the condition that the authentication result of the first access authentication is successful authentication, wherein , the authentication result of the first access authentication is determined by the device cloud platform according to the first device end key and the first cloud key, and the first cloud key is determined by the device cloud platform according to the generated from the first random number and the license key.
The method according to claim 7, wherein the performing the second access authentication on the distribution network platform gateway according to the second device-side key comprises:

The Zigbee device determines the authentication result of the second access authentication according to the second device-side key and the second cloud key.
The method according to claim 8, wherein the method further comprises:

The Zigbee device sends the authentication result of the second access authentication to the network distribution platform gateway.
The method according to any one of claims 2-5, wherein the method further comprises:

The Zigbee device sends the second random number to the device platform cloud of the Zigbee device through the distribution network platform gateway and the distribution network platform cloud, wherein the distribution network platform cloud is the one corresponding to the distribution network platform gateway. a cloud server, where the second random number is used for the device platform cloud to generate a second cloud key, and the second cloud key is used for the second access authentication of the Zigbee device.
The method of claim 10, wherein the method further comprises:

The Zigbee device receives the second cloud key sent by the distribution network platform gateway.
The method according to claim 11, wherein the Zigbee device receiving the second cloud key sent by the distribution network platform gateway comprises:

The Zigbee device receives a write request sent by the distribution network platform gateway to the custom cluster of the Zigbee device, where the write request carries the second cloud key.
The method according to claim 12, wherein the performing the second access authentication on the distribution network platform gateway according to the second device-side key comprises:

The authentication result of the second access authentication is determined according to the second device-side key and the second cloud key.
The method of claim 13, wherein the method further comprises:

The Zigbee device sends the authentication result of the second access authentication to the network distribution platform gateway.
The method according to claim 14, wherein the Zigbee device sends the authentication result of the second access authentication to the network distribution platform gateway, comprising:

When the authentication result of the second access authentication is that the authentication is successful, the Zigbee device sends the authentication result of the second access authentication to the network distribution platform gateway.
The method according to claim 13 or 14, wherein the method further comprises:

The Zigbee device leaves the Zigbee network when the authentication result of the second access authentication is authentication failure.
The method according to any one of claims 13-16, wherein the method further comprises:

Send first indication information to the distribution network platform gateway, where the first indication information is used to instruct the Zigbee device to leave the Zigbee network.
The method according to any one of claims 2-17, wherein the first device-side key is stored in a custom cluster of the Zigbee device, and the second device-side key is stored in a In the self-defined cluster of the Zigbee device, the access type of the self-defined cluster is return after writing.
The method according to any one of claims 1-18, wherein the generating the second device-side key according to the second random number and the license key comprises:

Using a second key generation algorithm, the second random number and the license key are processed to generate the second device-side key.
The method of claim 19, wherein the second key generation algorithm comprises: an AES-MMO hash algorithm.
An access authentication method, comprising:

The device platform cloud generates the first cloud key according to the first random number and the license key, wherein the device platform cloud is the cloud server of the manufacturer to which the Zigbee device of the Zigbee protocol belongs, and the license key is stored in the Zigbee device. The device and the key in the device platform cloud of the Zigbee device, the first random number is generated by the device platform cloud, or the first random number is obtained from the distribution network platform cloud, the distribution network The platform cloud is the cloud server corresponding to the distribution network platform gateway that supports the construction of Zigbee network;

The first access authentication of the Zigbee device is performed according to the first cloud key.
The method of claim 21, wherein the method further comprises:

The device platform cloud receives the first access authentication request sent by the distribution network platform cloud, the first access authentication request includes a second random number and a first device-side key, and the second random number is the Generated by the Zigbee device, and the first device-side key is generated by the Zigbee device according to the first random number and the license key;

A second cloud key is generated according to the second random number and the license key, and the second cloud key is used for the second access authentication of the Zigbee device.
The method according to claim 22, wherein the generating a second device-side key according to the second random number and the license key comprises:

The device platform cloud generates the second cloud key according to the second random number and the license key when the authentication result of the first access authentication is that the authentication is successful.
The method of claim 23, wherein the method further comprises:

The device platform cloud sends the authentication result of the first access authentication and the second cloud key to the distribution network platform cloud.
The method of claim 21, wherein the method further comprises:

The device platform cloud receives a second random number sent by the distribution network platform cloud, where the second random number is generated by the Zigbee device;

A second cloud key is generated according to the second random number and the license key, and the second cloud key is used for the second access authentication of the Zigbee device.
The method of claim 25, wherein the method further comprises:

The device platform cloud sends the second cloud key to the distribution network platform cloud.
The method of claim 26, wherein the method further comprises:

The device platform cloud receives a first access authentication request sent by the distribution network platform cloud, where the first access authentication request includes a first device-side key, and the first device-side key is the Zigbee device generated according to the first random number and the license key.
The method according to any one of claims 21-27, wherein the method further comprises:

The device platform cloud receives the first request sent by the distribution network platform cloud, where the first request is used to request the installation code and the first random number of the Zigbee device, or the first request is used to request the installation code of the Zigbee device and the first random number. the first random number.
The method of claim 28, wherein the method further comprises:

The device platform cloud sends the installation code of the Zigbee device and the first random number to the distribution network platform cloud, or,

The device platform cloud sends the first random number to the distribution network platform cloud.
The method according to claim 28 or 29, wherein the first request further comprises: a device address identifier of the Zigbee device and a manufacturer identifier of the Zigbee device.
An access authentication method, comprising:

The distribution network platform gateway receives the second random number and the first device-side key sent by the Zigbee device of the Zifeng protocol, wherein the distribution network platform gateway supports the construction of a Zigbee network, and the first device-side key is the Zigbee device according to The first random number is generated from the license key of the Zigbee device, the second random number is used for the device platform cloud of the Zigbee device to determine the second cloud key, and the second cloud key is used for the Second access authentication for Zigbee devices;

The distribution network platform gateway sends a first access authentication request to the distribution network platform cloud, where the first access authentication request includes the second random number, or the first access authentication request includes the second random number number and the first device-side key, the first device-side key is used for the first access authentication of the Zigbee device by the device platform cloud, and the distribution network platform cloud is the distribution network platform The cloud server corresponding to the gateway.
The method of claim 31, wherein the method further comprises:

The distribution network platform gateway receives the second cloud key sent by the distribution network platform cloud, or the authentication result of the first access authentication and the second cloud key, wherein the first access authentication The authentication result of the incoming authentication is determined by the device cloud platform according to the first device-side key and the first cloud key, and the first cloud key is determined by the device cloud platform according to the first random number and the first cloud key. the license key is generated.
The method of claim 32, wherein the method further comprises:

The distribution network platform gateway sends a write request to the custom cluster of the Zigbee device, where the write request carries the second cloud key.
The method according to claim 33, wherein the distribution network platform gateway sends a write request to the self-defined cluster of the Zigbee device, comprising:

When the authentication result of the first access authentication is that the authentication is successful, the network configuration platform gateway sends the write request to the custom cluster of the Zigbee device.
The method of claim 33, wherein the method further comprises:

In the case that the authentication result of the first access authentication is authentication failure, the network distribution platform gateway adds the Zigbee device to the device blacklist, and removes the Zigbee device from the Zigbee network.
The method according to claim 32 or 33, wherein the method further comprises:

In the case that the authentication result of the second access authentication is an authentication failure, receive first indication information sent by the Zigbee device, where the first indication information is used to instruct the Zigbee device to leave the Zigbee network;

The distribution network platform gateway adds the Zigbee device to a device blacklist.
The method according to any one of claims 31-36, wherein the method further comprises:

The first request sent by the distribution network platform gateway to the distribution network platform cloud, where the first request is used to request the installation code of the Zigbee device and the first random number, or the first request uses for requesting the first random number.
The method of claim 37, wherein the method further comprises:

The distribution network platform gateway receives the installation code and the first random number of the Zigbee device sent by the distribution network platform cloud, or,

The distribution network platform gateway receives the first random number sent by the distribution network platform cloud.
The method according to claim 37 or 38, wherein the first request further comprises: a device address identifier of the Zigbee device and a manufacturer identifier of the Zigbee device.
The method according to any one of claims 31-39, wherein the first access authentication request further includes a device address identifier of the Zigbee device and a manufacturer identifier of the Zigbee device.
A method for access authentication, comprising:

Obtain the device information of the Zigbee device of the Zigbee protocol, wherein the device information of the Zigbee device includes the device protocol type of the Zigbee device, the device address identifier of the Zigbee device and the manufacturer identifier of the Zigbee device;

The distribution network platform gateway is determined according to the device protocol type to which the Zigbee device belongs, wherein the distribution network platform gateway supports the construction of a Zigbee network;

Send the device information of the Zigbee device to the distribution network platform gateway.
The method according to claim 41, wherein the device address identifier of the Zigbee device comprises a media access control MAC address of the Zigbee device.
The method according to claim 41 or 42, wherein the device information of the Zigbee device further comprises: an installation code of the Zigbee device.
The method according to claim 43, wherein the installation code of the Zigbee device is a PIN code of the Zigbee device.
An access authentication device, characterized in that it is used to be implemented as a Zigbee device, or used to be implemented as a part of the Zigbee device, comprising:

a processing unit for generating a second random number;

generating a second device-side key according to the second random number and a license key, the license key being a key stored in the Zigbee device and the device platform cloud of the Zigbee device; and

The second access authentication of the Zigbee device is performed according to the second device-side key.
An access authentication device, characterized in that it is implemented as the device platform cloud, or implemented as a part of the device platform cloud, comprising:

The processing unit is configured to generate the first cloud key according to the first random number and the license key, wherein the device platform cloud is the cloud server of the manufacturer to which the Zigbee device of the Zigbee protocol belongs, and the license key is stored in the cloud server. The Zigbee device and the key in the device platform cloud, the first random number is generated by the device platform cloud, or the first random number is obtained from the distribution network platform cloud, the distribution network platform Cloud is the cloud server corresponding to the distribution platform gateway that supports building Zigbee networks; and

The first access authentication of the Zigbee device is performed according to the first cloud key.
An access authentication device, characterized in that it is used to be implemented as the distribution network platform gateway, or to be implemented as a part of the distribution network platform gateway, comprising:

The communication unit is used to receive the second random number and the first device-side key sent by Zigbee device of Zifeng protocol, wherein, the network distribution platform gateway supports the construction of Zigbee network, and the first device-side key is the Zigbee device Generated according to the first random number and the license key of the Zigbee device, the second random number is used for the device platform cloud of the Zigbee device to determine the second cloud key, and the second cloud key is used for all the second access authentication of the Zigbee device; and

Send a first access authentication request to the distribution network platform cloud, where the first access authentication request includes the second random number, or the first access authentication request includes the second random number and the first A device-side key, where the first device-side key is used for the device platform cloud to perform first access authentication for the Zigbee device, and the distribution network platform cloud is a cloud server corresponding to the distribution network platform gateway.
An access authentication device, comprising:

The communication unit is used to obtain the device information of Zigbee device of Zigbee protocol, wherein, the device information of said Zigbee device includes the device protocol type of said Zigbee device, the device address identification of said Zigbee device and the manufacturer identification of said Zigbee device;

a processing unit, configured to determine a distribution network platform gateway according to the device protocol type to which the Zigbee device belongs, wherein the distribution network platform gateway supports the construction of a Zigbee network;

The communication unit is further configured to send the device information of the Zigbee device to the distribution network platform gateway.
An access authentication device, characterized in that it comprises: a processor and a memory, the memory is used for storing a computer program, the processor is used for calling and running the computer program stored in the memory, and executes the computer program according to claims 1 to 20 The method of any of the above.
An access authentication device, characterized in that it comprises: a processor and a memory, the memory is used for storing a computer program, the processor is used for calling and running the computer program stored in the memory, and executes the computer program according to claims 21 to 30 The method of any of the above.
An access authentication device, characterized in that it comprises: a processor and a memory, the memory is used for storing a computer program, the processor is used for calling and running the computer program stored in the memory, and executes the computer program according to claims 31 to 40 The method of any of the above.
An access authentication device, characterized in that it comprises: a processor and a memory, the memory is used to store a computer program, the processor is used to call and run the computer program stored in the memory, and execute the computer program as claimed in claims 41 to 44 The method of any of the above.
A chip, characterized in that it includes: a processor for calling and running a computer program from a memory, so that a device installed with the chip executes the method according to any one of claims 1 to 20, or, A method as claimed in any one of claims 21 to 30, or a method as claimed in any one of claims 31 to 40, or a method as claimed in any one of claims 41 to 44.
A computer-readable storage medium, characterized by being used for storing a computer program, the computer program causing a computer to execute the method according to any one of claims 1 to 20, or, as in any one of claims 21 to 30 A method as claimed in any one of claims 31 to 40 or as a method as claimed in any one of claims 41 to 44.
A computer program product, characterized by comprising computer program instructions that cause a computer to perform a method as claimed in any one of claims 1 to 20, or, as claimed in any one of claims 21 to 30 The method described above, or the method of any one of claims 31 to 40, or the method of any one of claims 41 to 44.
A computer program, characterized in that the computer program causes a computer to perform the method as claimed in any one of claims 1 to 20, or, the method as claimed in any one of claims 21 to 30, or, A method as claimed in any one of claims 31 to 40, or a method as claimed in any one of claims 41 to 44.