WO2023092497A1

WO2023092497A1 - Groupcast message processing method and related apparatus

Info

Publication number: WO2023092497A1
Application number: PCT/CN2021/133694
Authority: WO
Inventors: 吕小强; 茹昭
Original assignee: Oppo广东移动通信有限公司
Priority date: 2021-11-26
Filing date: 2021-11-26
Publication date: 2023-06-01
Also published as: CN117643040A

Abstract

Disclosed in the present application are a groupcast message processing method and a related apparatus. The groupcast message processing method comprises: a target node device receiving a groupcast message, which groupcast message is a group command and comprises group identification information and identification information of a source node device; and according to the group identification information, the identification information of the source node device and topic information in an access control list (ACL) of the target node device, the target node device determining whether to execute the group command. In this way, the source of a group command is limited by means of topic information, such that the situation where a certain node device in a multicast group controls, after being illegally controlled, other node devices in the group by means of the group command is avoided, thereby improving the security of communication between the node devices in the multicast group.

Description

Multicast message processing method and related device

technical field

The present application relates to the technical field of communications, and in particular to a method for processing a multicast message and a related device.

Background technique

A multicast group is a collection of all node devices registered under the same multicast group identifier. After a multicast message is sent to a multicast group, it will be received by all node devices in the group.

Each multicast group corresponds to a shared group key, and the group key is managed by the group key management function set of each node device in the multicast group, and is used for encrypting and decrypting message transmission within the group. Each node device in the multicast group does not know the situation of other node devices, and can only ensure the security of communication within the group through the group key. However, if a node device in the multicast group is illegally controlled, the node device can control other node devices in the group by constructing a group command, and other node devices cannot distinguish whether the received group command is a legal operation or an illegal operation , the security of communication between node devices in the multicast group is poor.

Contents of the invention

The present application provides a multicast message processing method and a related device, which improve the security of communication between node devices in a multicast group.

In a first aspect, the present application provides a method for processing a multicast message, the method is applied to a target node device, and includes: receiving a multicast message, the multicast message is a group command, and the multicast message includes a group identifier Information and identification information of the source node device; according to the group identification information, the identification information of the source node device and the topic information in the access control list ACL of the target node device, determine whether to execute the group command.

In the above method, the target node device receives the multicast message, the multicast message is a group command, including group identification information and the identification information of the source node device, and the target node device Information to judge whether to execute the group command. In the multicast group, the source of the group command is restricted through the topic information in the ACL, so that the group command issued by the control node device can be executed by other devices in the group. After the target node device receives the group command, it checks the topic information in the ACL and combines the identification information of the source node device to determine whether the group command from the source node device can be executed. In this way, it is avoided that a certain node device in the multicast group is illegally controlled and then controls other node devices in the group through group commands, and the security of communication between node devices in the multicast group is improved.

With reference to the first aspect, in a possible implementation manner of the first aspect, according to the group identification information, the identification information of the source node device, and the subject in the access control list ACL of the target node device information, before judging whether to execute the group command, the method further includes: receiving ACL configuration information from a configurator, where the ACL configuration information includes the group identification information and identification information of at least one control node device; according to the The group identification information and the identification information of the at least one control node device configure the ACL.

With reference to the first aspect, in a possible implementation manner of the first aspect, the configuring the ACL according to the group identification information and the identification information of the at least one control node device includes: setting the group identification information Configured in the first information of the first access control entity ACE of the ACL; configure the identification information of the at least one control node device in at least one topic information of the first ACE, and the at least one control node device The identification information of is in one-to-one correspondence with the at least one subject information.

With reference to the first aspect, in a possible implementation manner of the first aspect, configuring the ACL according to the group identification information and the identification information of the at least one control node device further includes: configuring the at least The number n of identification information of one control node device is configured in the first information.

With reference to the first aspect, in a possible implementation manner of the first aspect, the configuring the ACL according to the group identification information and the identification information of the at least one control node device includes: setting the group identification information Respectively configured in at least one subject information of the first ACE of the ACL; compressing the identification information of each control node device in the identification information of the at least one control node device to obtain the compressed identification of at least one control node device information; configure the compressed identification information of the at least one control node device in at least one subject information including the group identification information, and the compressed identification information of the at least one control node device corresponds to the at least one subject information one-to-one .

With reference to the first aspect, in a possible implementation manner of the first aspect, the configuring the ACL according to the group identification information and the identification information of the at least one control node device includes: setting the group identification information and compressing the identification information of each control node device in the identification information of the at least one control node device to obtain at least one first compressed information; configuring the at least one first compressed information in at least one topic of the ACL Among the information, the at least one piece of first compressed information is in one-to-one correspondence with the at least one theme information.

With reference to the first aspect, in a possible implementation manner of the first aspect, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device , judging whether to execute the group command includes: according to the group identification information, determining the first ACE in the ACL; searching in the first ACE whether there is an ACE that matches the identification information of the source node device Topic information; if present, executes the set of commands.

With reference to the first aspect, in a possible implementation manner of the first aspect, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device , judging whether to execute the group command includes: according to the group identification information, determining the first information in the ACL; finding whether there is a link with the source node in the last n topic information of the first information Information matching the identification information of the device; if present, execute the set of commands.

With reference to the first aspect, in a possible implementation manner of the first aspect, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device , judging whether to execute the group command includes: according to the group identification information, determining at least one topic information that includes the group identification information in the ACL; compressing the identification information of the source node device to obtain the source node device The compressed identification information of the source node device; check whether there is information matching the compressed identification information of the source node device in at least one subject information containing the group identification information; if yes, execute the group command.

With reference to the first aspect, in a possible implementation manner of the first aspect, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device , judging whether to execute the group command includes: according to the group identification information, determining at least one topic information including the group identification information in the ACL; decompressing at least one topic information including the group identification information, Obtain at least one piece of first decompressed information; check whether there is information matching the identification information of the source node device in the at least one piece of first decompressed information; if so, execute the set of commands.

With reference to the first aspect, in a possible implementation manner of the first aspect, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device , judging whether to execute the group command includes: compressing the group identification information and the identification information of the source node device to obtain second compressed information; searching whether there is a match with the second compressed information in the ACL The topic information of the ; if present, the set of commands is executed.

With reference to the first aspect, in a possible implementation manner of the first aspect, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device , judging whether to execute the set of commands includes: decompressing at least one topic information in the ACL to obtain at least one second decompression information; finding whether there is any information related to the at least one second decompression information in the at least one second decompression information Information that matches the group identification information with the identification information of the source node device; if it exists, execute the group command.

With reference to the first aspect, in a possible implementation manner of the first aspect, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device , judging whether to execute the group of commands, further comprising: if not, not executing the group of commands.

With reference to the first aspect, in a possible implementation manner of the first aspect, the method further includes: receiving group table configuration information from a configurator, where the group table configuration information includes first indication information, and the first The indication information is used to indicate whether the target node device is a control node device; and the first indication information is configured in the group table of the target node device.

With reference to the first aspect, in a possible implementation manner of the first aspect, the ACL configuration information further includes authentication mode configuration information, and the method further includes: according to the authentication mode configuration information, configuring the ACL The authentication mode of the ACE is configured as enhanced group-based secure connection.

In a second aspect, the present application provides a method for processing a multicast message. The method is applied to a configurator, and includes: sending access control list ACL configuration information to a target node device, and the ACL configuration information includes group identification information and at least Identification information of a control node device, the ACL configuration information is used to instruct the target node device to configure the ACL according to the group identification information and the identification information of the at least one control node device, and the subject in the ACL The information is used by the target node device to judge whether to execute the group command.

In the above method, the configurator sends ACL configuration information to the target node device, the ACL configuration information includes group identification information and identification information of at least one control node device, and the target node device configures according to the group identification information and the identification information of at least one control node device ACLs. In the multicast group, the source of the group command is restricted through the topic information in the ACL, so that the group command issued by the control node device can be executed by other devices in the group. After the target node device receives the group command, it checks the topic information in the ACL and combines the identification information of the source node device to determine whether the group command from the source node device can be executed. In this way, it is avoided that a certain node device in the multicast group is illegally controlled and then controls other node devices in the group through group commands, and the security of communication between node devices in the multicast group is improved.

With reference to the second aspect, in a possible implementation manner of the second aspect, the method further includes: sending group table configuration information to multiple node devices in the multicast group, where the group table configuration information includes a first indication information, the group table configuration information is used to instruct each of the multiple node devices to configure the first indication information in the group table, and the first indication information is used to indicate that each node Whether the device is a control node device.

With reference to the second aspect, in a possible implementation manner of the second aspect, before sending the access control list ACL configuration information to the target node device, the method further includes: according to the first The indication information determines the ACL configuration information.

In a third aspect, the present application provides a communication device, which is applied to a target node device, and includes: a transceiver unit for receiving a multicast message, the multicast message is a group command, and the multicast message includes a group Identification information and identification information of the source node device; a processing unit configured to determine whether to execute the set group commands.

With reference to the third aspect, in a possible implementation manner of the third aspect, the transceiver unit is further configured to receive ACL configuration information from a configurator, where the ACL configuration information includes the group identification information and at least one control node Identification information of the device; the processing unit is further configured to configure the ACL according to the group identification information and the identification information of the at least one control node device.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is specifically configured to: configure the group identification information in the first information of the first access control entity ACE of the ACL; The identification information of the at least one control node device is configured in at least one topic information of the first ACE, and the identification information of the at least one control node device corresponds to the at least one topic information one by one.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is further configured to: configure the number n of identification information of the at least one control node device in the first information.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is specifically configured to: respectively configure the group identification information in at least one subject information of the first ACE of the ACL; The identification information of each control node device in the identification information of the at least one control node device is compressed to obtain the compressed identification information of at least one control node device; the compressed identification information of the at least one control node device is configured in the In the at least one subject information of the group identification information, the compressed identification information of the at least one control node device corresponds to the at least one subject information one by one.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is specifically configured to: use each control node device in the group identification information and the identification information of the at least one control node device The identification information of the ACL is compressed to obtain at least one first compressed information; the at least one first compressed information is configured in the at least one subject information of the ACL, and the at least one first compressed information and the at least one subject information One to one correspondence.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is specifically configured to: determine the first ACE in the ACL according to the group identification information; Check whether there is subject information matching the identification information of the source node device in the ACE; if yes, execute the group command.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is specifically configured to: determine the first information in the ACL according to the group identification information; Check whether there is information matching the identification information of the source node device in the last n topic information of the information; if yes, execute the group command.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is specifically configured to: determine at least one subject information in the ACL that includes the group identification information according to the group identification information; Compressing the identification information of the source node device to obtain the compressed identification information of the source node device; searching whether there is information matching the compressed identification information of the source node device in at least one topic information containing the group identification information ; If present, execute the set of commands.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is specifically configured to: determine at least one subject information in the ACL that includes the group identification information according to the group identification information; Decompressing at least one subject information containing the group identification information to obtain at least one first decompressed information; finding whether there is a match with the identification information of the source node device in the at least one first decompressed information info; if present, execute the set of commands.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is specifically configured to: compress the group identification information and the identification information of the source node device to obtain second compressed information; Check whether there is subject information matching the second compressed information in the ACL; if yes, execute the set of commands.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is specifically configured to: decompress at least one subject information in the ACL to obtain at least one second decompressed information; Check whether there is information matching the group identification information and the identification information of the source node device in the at least one second decompressed information; if yes, execute the group command.

With reference to the third aspect, in a possible implementation manner of the third aspect, the processing unit is further configured to: if not exist, not execute the set of commands.

With reference to the third aspect, in a possible implementation manner of the third aspect, the transceiver unit is further configured to receive group table configuration information from a configurator, where the group table configuration information includes first indication information, and the second The indication information is used to indicate whether the target node device is a control node device; the processing unit is further configured to configure the first indication information in the group table of the target node device.

With reference to the third aspect, in a possible implementation manner of the third aspect, the ACL configuration information further includes authentication mode configuration information, and the processing unit is further configured to: according to the authentication mode configuration information, set the The authentication mode of ACE in the above ACL is configured as enhanced group-based security connection.

In a fourth aspect, the present application provides a communication device, which is applied to a configurator, and includes: a transceiver unit, configured to send access control list ACL configuration information to a target node device, and the ACL configuration information includes group identification information and Identification information of at least one control node device, the ACL configuration information is used to instruct the target node device to configure the ACL according to the group identification information and the identification information of the at least one control node device, and the ACL in the ACL The topic information is used by the target node device to judge whether to execute the group command.

With reference to the fourth aspect, in a possible implementation manner of the fourth aspect, the transceiver unit is further configured to: send group table configuration information to multiple node devices in the multicast group, where the group table configuration information includes the first Instruction information, the group table configuration information is used to instruct each node device in the plurality of node devices to configure the first instruction information in the group table, and the first instruction information is used to indicate that each Whether a node device is a control node device.

With reference to the fourth aspect, in a possible implementation manner of the fourth aspect, the apparatus further includes a processing unit configured to: determine the ACL according to the first indication information of the plurality of node devices configuration information.

In a fifth aspect, the present application provides a target node device, including a memory, a processor, and a program stored in the memory and operable on the processor, and the processor implements the first Aspect or a method in any possible implementation of the first aspect.

In a sixth aspect, the present application provides a configurator, including a memory, a processor, and a program stored in the memory and operable on the processor, and the second aspect is realized when the processor executes the program Or the method in any possible implementation manner of the second aspect.

In a seventh aspect, the present application provides a computer-readable storage medium, the computer-readable storage medium is used to store instructions, and when the instructions are executed by a processor, the first aspect or any one of the first aspects may A method of an embodiment, or a method of the second aspect or any possible embodiment of the second aspect is performed.

In an eighth aspect, the present application provides a computer program product containing instructions. When it is run on a computer, the method in the first aspect or any possible implementation of the first aspect, or the second aspect or the first aspect The method in any possible implementation manner of the two aspects is carried out.

Description of drawings

FIG. 1 is a schematic diagram of a method for processing a group command provided in an embodiment of the present application;

FIG. 2 is a schematic diagram of another group command processing method provided by the embodiment of the present application;

FIG. 3 is a schematic diagram of another group command processing method provided by the embodiment of the present application;

FIG. 4 is a schematic diagram of another group command processing method provided by the embodiment of the present application;

FIG. 5 is a schematic diagram of another group command processing method provided by the embodiment of the present application;

FIG. 6 is a schematic diagram of another group command processing method provided by the embodiment of the present application;

FIG. 7 is a schematic diagram of a communication device provided by an embodiment of the present application;

FIG. 8 is a schematic diagram of another communication device provided by an embodiment of the present application;

FIG. 9 is a schematic diagram of a target node device provided in an embodiment of the present application;

FIG. 10 is a schematic diagram of a configurator provided by an embodiment of the present application.

Detailed ways

The technical solution in this application will be described below with reference to the accompanying drawings.

In the following, some terms used in the embodiments of the present application are explained, so as to facilitate the understanding of those skilled in the art.

"At least one" referred to in the embodiments of the present application refers to one or more, and "multiple" refers to two or more. "And/or" describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist at the same time, and B exists alone, where A, B can be singular or plural. The character "/" generally indicates that the contextual objects are an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .

And, unless otherwise stated, the ordinal numerals such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or priority of multiple objects. Importance. For example, the first information and the second information are only for distinguishing different information, and do not indicate the difference in content, priority, sending order, or degree of importance of the two kinds of information.

In order to facilitate understanding of the present application, the concepts involved in the present application are explained first.

Matter protocol: Matter is an application layer protocol launched by the connectivity standards alliance (CSA), and it is a new connection standard based on the Internet protocol (Internet protocol, IP). The Matter protocol defines the IPv6-based application layer deployed on devices to achieve interoperability architecture goals.

Multicast group: refers to the collection of all node devices registered under the same multicast group identifier (identifier, ID). After the multicast message is sent to the multicast group, all nodes in the group The device receives.

Group session: formed by one or more multicast messages, including the following information:

1. Domain index (fabric index), indicating the fabric domain to which the group session belongs.

2. Group ID (group ID), which is the unique identifier of a multicast group.

3. Source node ID (source node ID), indicating the source node device ID of the group session.

4. A source Internet protocol (Internet protocol, IP) address (source IP address), indicating the IP address of the source node device of the sending device of the group session message.

5. Source port (source port), indicating the source port of the source node device of the group session message.

6. Operational group key (operational group key), which represents the encryption key for group conversation messages.

7. Group session ID (group session ID).

Group table (group table): In a multicast group supporting the Matter protocol, each node device has a group table indicating group membership, and one or more endpoints on the node device can belong to the same multicast group. Any endpoint on the node device can also belong to one or more multicast groups.

Group key management function set (group key management cluster): In a multicast group that supports the Matter protocol, each node device has a group key management function set for managing group keys, including attributes and methods ( command), wherein, the attributes in the group key management function set are shown in Table 1, and the commands in the group key management function set are shown in Table 2.

Table 1 Attributes of the group key management function set

Among them, desc means refer to the detailed description part.

Table 2 Commands for group key management function set

Among them, F A indicates that access is distinguished according to the fabric, and administrator privileges are required.

The attributes of the group key management function set are used to maintain the group table of the node device, and the information included in the group table is shown in Table 3.

Table 3 Information contained in the group table

Wherein, FabricIndex indicates the fabric domain to which the group session belongs. GroupID is the unique identifier of a multicast group. GroupKeySetIndex points to the shared group key of the multicast group, which is used to encrypt and decrypt message transmission within the group. Endpoints are endpoints belonging to the multicast group on the node device. GroupName is the name of the multicast group. fabric-idx represents the data type of the domain index defined by the standard. group-id represents the data type of the group identifier defined by the standard. desc means refer to the detailed description section. all means that all values are allowed in the numeric data type.

If the message received by the node device is a multicast message, the node device will check the group table after receiving the message to determine which endpoints in the group table correspond to the same group ID as the group ID in the multicast message, and correspond to the endpoints with the same group ID Then belong to the multicast group corresponding to the multicast message. Then, the multicast message will be delivered to each end point belonging to the multicast group on the node device.

Access control list (ACL): specifies the access rights of other node devices to this node device.

ACL function set (ACL cluster): It is used to control the access rights of node devices. Each node device has an ACL function set. When a node device receives a request, it first checks whether the requester has permission in the ACL. The ACL feature set includes attributes, and the attributes in the ACL feature set are shown in Table 4.

Table 4 Attributes of the ACL feature set

Among them, among the attributes of the ACL function set, the information included in the access control entity structure is shown in Table 5.

Table 5 Information included in the access control entity structure

Among them, the privileges in the access control entity structure include:

View (view), which means read and subscribe (except ACL feature set) permissions.

Proxy view, which means read and subscribe permissions.

Operation (operate), which means the right to read and execute the main functions of the device (except the ACL function set).

Management (manage), indicating the authority to operate and modify the configuration data (except ACL function set).

The administrator (administrator) represents the management authority and the authority to subscribe and modify the ACL function set.

Among them, the authentication mode (AuthMode) in the access control entity structure includes:

PASE (passcode authenticated session), which means a key-based secure connection.

CASE (certificate authenticated session), which means a secure connection based on a certificate.

GROUP (group authenticated session), which means a group-based secure connection.

When the node device in the multicast group receives the multicast message and checks the ACL, the content of the subject (Subjects) in the ACL is the group ID (group ID), that is to say, after any node device in the multicast group sends the group command, All other node devices that receive the group command must execute it. If a node device in the multicast group is illegally controlled, the node device can control other node devices in the group by constructing a group command, and other node devices cannot distinguish whether the received group command is a legal operation or an illegal operation. The communication security between node devices in the broadcast group is poor.

The background technology of the present application is described above, and the technical features of the embodiments of the present application are introduced below.

Referring to FIG. 1 , FIG. 1 is a schematic diagram of a method for processing group commands provided by an embodiment of the present application. As shown in Figure 1, the processing methods of this group of commands include:

S101. The target node device receives a multicast message, where the multicast message is a group command, and the multicast message includes group identification information and identification information of a source node device.

Specifically, the target node device and the source node device belong to the first multicast group. In the multicast group, the source node device sends a multicast message, and the multicast message is a group command. Correspondingly, the target node device receives the multicast message . Wherein, the group identification information included in the multicast message is group identification information of the first multicast group.

S102. The target node device judges whether to execute the group command according to the group identification information, the identification information of the source node device, and the subject information in the ACL of the target node device.

Optionally, before judging whether to execute the group command according to the group identification information, the identification information of the source node device, and the topic information in the ACL, it also includes: receiving ACL configuration information from the configurator, the ACL configuration information includes group identification information and Identification information of at least one control node device; ACL is configured according to the group identification information and the identification information of at least one control node device.

Specifically, the target node device receives ACL configuration information from the configurator, where the ACL configuration information includes group identification information and identification information of at least one control node device. The target node device configures the ACL according to the group identification information and the identification information of the at least one control node device. Optionally, in addition to including the group identification information and the identification information of the at least one control node device, the ACL configuration information may also include other information, such as domain index (FabricIndex), authority (Privilege), authentication mode (AuthMode) etc., the target node device also configures other information in the ACL.

The configurator is used to configure the node devices in the multicast group, and the node devices in the same multicast group are configured by one configurator. Specifically, the group identification information in the ACL configuration information is group identification information of the first multicast group, and the identification information of at least one control node device is used to indicate at least one control node device in the first multicast group. Wherein, when configuring the node devices in the multicast group, the configurator determines one or more node devices as control node devices, and the group commands sent by the control node devices will be executed by other node devices in the group.

In a possible implementation manner, according to the group identification information and the identification information of at least one control node device, configuring the ACL includes: configuring the group identification information in the first information of the first access control entity ACE of the ACL; configuring at least one The identification information of the control node device is configured in at least one topic information of the first ACE, and the identification information of the at least one control node device is in one-to-one correspondence with the at least one topic information.

Specifically, the ACL of the target node device includes one or more access control entities (access control entity, ACE), and each ACE includes a piece of first information and one or more subject information (subject ID). In a possible implementation manner, the first information may be subject information in the ACE. After receiving the ACL configuration information, the target node device configures the group identification information in the ACL configuration information in the first information of the first ACE, and configures the identification information of at least one control node device in the ACL configuration information in the first information of the first ACE. One ACE. For example, the control node devices in the first multicast group include node device 1, node device 2 and node device 3, the group commands sent by node device 1, node device 2 and node device 3 will be executed by other node devices in the group, The identification information of the node device 1, the node device 2, and the node device 3 are respectively configured in the three subject information in the first ACE, and one identification information corresponds to one subject information. It should be noted that, in this embodiment, one ACE corresponds to one multicast group, and group identification information of other multicast groups and identification information of control node devices need to be configured in other ACEs.

In a possible implementation manner, configuring the ACL according to the group identification information and the identification information of the at least one control node device further includes: configuring the number n of the identification information of the at least one control node device in the first information.

Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more first information and one or more topic information. In a possible implementation manner, the first information may be subject information in the ACE. After receiving the ACL configuration information, the target node device configures the group identification information in the ACL configuration information in the first information of the first ACE, and configures the identification information of at least one control node device in the ACL configuration information in the first information of the first ACE. In an ACE, the number n of identification information of at least one control node device is also configured in the first information. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3, and the identification information of node device 1, node device 2, and node device 3 are respectively configured in three ACEs in the first ACE. In the topic information, one identification information corresponds to one topic information. At this time, the number n of identification information is 3, and n is 3 also configured in the first information. It should be noted that, in this embodiment, one ACE corresponds to one or more multicast groups, and group identification information of other multicast groups and identification information of control node devices may also be configured in the first ACE.

In a possible implementation manner, configuring the ACL according to the group identification information and the identification information of at least one control node device includes: respectively configuring the group identification information in at least one subject information of the first ACE of the ACL; The identification information of each control node device in the identification information of the node device is compressed to obtain the compressed identification information of at least one control node device; the compressed identification information of at least one control node device is configured in at least one topic containing the group identification information In the information, the compressed identification information of at least one control node device is in one-to-one correspondence with at least one subject information.

Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more subject information. After receiving the ACL configuration information, the target node device configures the group identification information in the ACL configuration information in at least one subject information of the first ACE, and configures the identification information of each control node device in the identification information of at least one control node device The information is compressed to obtain compressed identification information of at least one control node device, and the compressed identification information of at least one control node device is also respectively configured in at least one subject information including group identification information. For example, the control node devices in the first multicast group include node device 1, node device 2 and node device 3, group identification information is respectively configured in three topic information, and node device 1, node device 2 and node device The compression identification information of 3 is also respectively configured in the three topic information, that is to say, in the three topic information, each topic information includes group identification information and one piece of compression identification information. It should be noted that, in this embodiment, one ACE corresponds to one or more multicast groups, and the group identification information of other multicast groups and the compression identification information of the control node device may also be configured in the first ACE.

In a possible implementation manner, according to the group identification information and the identification information of at least one control node device, configuring the ACL includes: combining the identification information of each control node device in the group identification information and the identification information of at least one control node device performing compression to obtain at least one first compressed information; configuring the at least one first compressed information in at least one subject information of the ACL, where the at least one first compressed information corresponds to the at least one subject information one by one.

Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more subject information. After receiving the ACL configuration information, the target node device compresses the group identification information in the ACL configuration information and the identification information of each control node device in the identification information of at least one control node device to obtain at least one first compressed information, and compresses The at least one first compressed information is configured in at least one subject information of the ACL. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3, and the group identification information is respectively combined with the identification information of node device 1, the identification information of node device 2, and the identification information of node device 3. The information is compressed to obtain three first compressed information. Then configure the three first compressed information in the three topic information respectively, that is to say, in the three topic information, each topic information includes a first compressed information, and a first compressed information consists of the group identification information and The identification information of a control node device is compressed. It should be noted that, in this embodiment, one ACE corresponds to one or more multicast groups, and information obtained by compressing the group identification information and the identification information of the control node device for other multicast groups may also be configured in the first ACE.

Optionally, according to the subject information in the group identification information, the identification information of the source node device and the access control list ACL of the target node device, judging whether to execute the group command includes: determining the first ACE in the ACL according to the group identification information; Check in the first ACE whether there is subject information matching the identification information of the source node device; if yes, execute the group command. In a possible implementation manner, if it does not exist, the group command is not executed.

Specifically, the first ACE in the ACL of the target node device is determined according to the group identification information, and the first ACE also includes at least one topic information, and the topic information configures the identification information of the control node device in the multicast group. In the first ACE, find whether there is topic information matching the identification information of the source node device. If it exists, it means that the source node device is the control node device in the multicast group, so the group command sent by the source node device can be executed. The target node device executes this group of commands, otherwise it does not execute.

Optionally, according to the group identification information, the identification information of the source node device, and the subject information in the access control list ACL of the target node device, judging whether to execute the group command includes: determining the first information in the ACL according to the group identification information; Check whether there is information matching the identification information of the source node device in the last n topic information of the first information; if yes, execute the group command. In a possible implementation manner, if it does not exist, the group command is not executed.

Specifically, according to the group identification information, determine the first information in the ACL of the target node device, obtain the number n of identification information in the first information, and the last n topic information of the first information configure the control nodes in the multicast group Identification information for the device. Check whether there is topic information matching the identification information of the source node device in the last n topic information of the first message, if it exists, it means that the source node device is the control node device in the multicast group, so the source node device sends A group of commands can be executed, and the target node device executes the group of commands, otherwise it does not execute.

Optionally, according to the group identification information, the identification information of the source node device and the subject information in the access control list ACL of the target node device, judging whether to execute the group command includes: according to the group identification information, determining the group identification information in the ACL At least one topic information; compressing the identification information of the source node device to obtain the compressed identification information of the source node device; searching whether there is information matching the compressed identification information of the source node device in at least one topic information including group identification information; If present, the group command is executed. In a possible implementation manner, if it does not exist, the group command is not executed.

Specifically, according to the group identification information, it is determined that the ACL of the target node device contains at least one topic information of the group identification information, the topic information configures the compression identification information of the control node device in the multicast group, and the compression identification information of the control node device Obtained by compressing the identification information of the control node device. The identification information of the source node device is compressed by the same algorithm as that of compressing the identification information of the control node device, to obtain the compressed identification information of the source node device. Check whether there is information matching the compressed identification information of the source node device in at least one topic information containing the group identification information. If it exists, it indicates that the source node device is the control node device in the multicast group, so the source node device sends The group commands of can be executed, and the target node device executes the group commands, otherwise it does not execute.

Optionally, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device, judging whether to execute the group command includes: according to the group identification information, determining at least A topic information; decompressing at least one topic information including group identification information to obtain at least one first decompressed information; searching whether there is information matching the identification information of the source node device in the at least one first decompressed information; If present, the group command is executed. In a possible implementation manner, if it does not exist, the group command is not executed.

Specifically, according to the group identification information, it is determined that the ACL of the target node device contains at least one topic information of the group identification information, the topic information configures the compression identification information of the control node device in the multicast group, and the compression identification information of the control node device Obtained by compressing the identification information of the control node device. Decompress at least one subject information including the group of identification information to obtain at least one first decompressed information, wherein the first decompressed information includes the identification information of the control node device. Find whether there is information matching the identification information of the source node device in at least one first decompressed information, if it exists, it indicates that the source node device is the control node device in the multicast group, so the group command sent by the source node device can be is executed, the target node device executes this group of commands, otherwise it does not execute.

Optionally, according to the group identification information, the identification information of the source node device and the topic information in the access control list ACL of the target node device, judging whether to execute the group command includes: compressing the group identification information and the identification information of the source node device, Obtain the second compressed information; check whether there is subject information matching the second compressed information in the ACL; if yes, execute the group command. In a possible implementation manner, if it does not exist, the group command is not executed.

Specifically, the ACL of the target node device includes at least one topic information, and the topic information is configured with first compressed information obtained by compressing the group identification information and the identification information of the control node device in the multicast group. The second compressed information is obtained by compressing the group identification information and the identification information of the source node device by using the same algorithm as compressing the group identification information and the identification information of the control node device in the multicast group. Check the ACL to see if there is topic information that matches the second compressed information. If it exists, it means that the source node device is the control node device in the multicast group. Therefore, the group command sent by the source node device can be executed, and the target node device executes This group of commands, otherwise not executed.

Optionally, according to the group identification information, the identification information of the source node device and the topic information in the access control list ACL of the target node device, judging whether to execute the group command includes: decompressing at least one topic information in the ACL to obtain at least A second decompression information; check whether there is information matching the group identification information and the identification information of the source node device in at least one second decompression information; if yes, execute the group command. In a possible implementation manner, if it does not exist, the group command is not executed.

Specifically, the ACL of the target node device includes at least one subject information, and the subject information is configured with first compressed information obtained by compressing the group identification information and the identification information of the control node device in the multicast group. At least one subject information is decompressed to obtain at least one second decompressed information, wherein the second decompressed information includes group identification information and identification information of the control node device. Find whether there is information matching the group identification information included in the group command and the identification information of the source node device in at least one second decompression information, if it exists, it indicates that the source node device is a control node device in the multicast group, so The group command issued by the source node device can be executed, and the target node device executes the group command, otherwise it does not execute it.

Optionally, the target node device receives group table configuration information from the configurator, the group table configuration information includes first indication information, and the first indication information is used to indicate whether the target node device is a control node device; configure the first indication information in In the group table of the target node device.

Specifically, when configuring the node devices in the multicast group, the configurator determines one or more devices as control node devices, and the group commands sent by the control node devices will be executed by other node devices in the group. The target node device receives the group table configuration information from the configurator, and the group table configuration information includes first indication information. After receiving the group table configuration information, the target node device configures the first indication information in the group table, wherein the first indication The information is used to indicate whether the target node device is a control node device. In this way, the group table of each node device in the multicast group has the first indication information, and the configurator obtains the first indication information in the group table of each node device, so that it can determine which node devices in the multicast group are control node device. When the configurator sends the ACL configuration information to the node devices in the multicast group, it may determine the control node device in the group according to the first indication information. The ACL configuration information sent by the configurator to the control node device includes the identification information of other control node devices in the multicast group except the control node device, and the ACL configuration information sent to other node devices includes the identification information of all control node devices in the multicast group information.

Optionally, the ACL configuration information also includes authentication mode configuration information, and the target node device configures the authentication mode of the ACE in the ACL as an enhanced group-based security connection according to the authentication mode configuration information.

Referring to FIG. 2 , FIG. 2 is a schematic diagram of another group command processing method provided by an embodiment of the present application. As shown in Figure 2, the processing methods of this group of commands include:

S201. The configurator sends group table configuration information to a target node device, where the group table configuration information includes first indication information, and correspondingly, the target node device receives the group table configuration information.

Wherein, the configurator is used to configure the node devices in the multicast group, and the node devices in the same multicast group are configured by one configurator.

Specifically, when configuring the node devices in the multicast group, the configurator determines one or more node devices as control node devices, and the group commands sent by the control node devices will be executed by other node devices in the group. Multiple node devices in the configurator multicast group send group table configuration information, the group table configuration information includes first indication information, and the group table configuration information is used to instruct each node device in the multiple node devices to configure the first indication information In the group table, the first indication information is used to indicate whether each node device is a control node device.

Optionally, the group table configuration information also includes other information, such as domain index, group ID, group key index, etc., and the target node device also configures the domain index, group ID, group key index, etc. in the group table.

S202. The target node device configures first indication information in the group table, where the first indication information is used to indicate whether the target node device is a control node device.

Specifically, the target node device receives the group table configuration information, configures the first indication information included in the group table configuration information in the group table, if the group table configuration information also includes other information, such as domain index, group identifier, group password key index, etc., the target node device also configures the domain index, group identifier, group key index, etc. in the group table.

In a possible implementation manner, the first indication information is added in the group table of the target node device, and the information contained in the group table of the target node device is shown in Table 6.

Table 6 Information contained in the group table of the target node device

Wherein, the data type of the first indication information is a boolean (Boolean) data type, and the boolean data type indicates that the first indication information is true or flase, and when the first indication information is true, it indicates that the target node device is a control node device, when When the first indication information is false or default, it indicates that the target node device is not a control node device.

S203. The configurator acquires the first indication information in the group table of the target node device, and judges whether the target node device is a control node device.

Specifically, before sending the ACL configuration information to the target node device, the configurator needs to first determine whether the target node device is a control node device in the multicast group. In a possible implementation manner, the configurator obtains the first indication information in the group table of each node device in the multicast group by sending a request message, so as to determine which devices in the multicast group are control node devices.

Optionally, the configurator may also save information about whether each node device is a control node device when adding each node device to the multicast group, and does not need to obtain information from each node device.

S204. The configurator sends ACL configuration information to the target node device. The ACL configuration information includes group identification information and identification information of at least one control node device. Correspondingly, the target node device receives the ACL configuration information.

Specifically, the group identification information in the ACL configuration information is the group identification information of the first multicast group to which the target node device belongs, and the identification information of at least one control node device indicates at least one control node device in the first multicast group.

If the target node device is a control node device in the multicast group, the ACL configuration information includes identification information of other control node devices in the multicast group except the target node device. If the target node device is not a control node device in the multicast group, the ACL configuration information includes identification information of all control node devices in the multicast group.

Optionally, the ACL configuration information may include other information, such as domain index, authority, authentication mode, etc., in addition to the group identification information and the identification information of the at least one control node device, and the target node device will also include other information Also configured in the ACL.

S205. The target node device configures the ACL according to the group identification information and the identification information of at least one control node device.

In a possible implementation manner, the target node device configures the group identification information in the first information of the first access control entity ACE of the ACL; configures the identification information of at least one control node device in at least one subject of the first ACE In the information, the identification information of at least one control node device is in one-to-one correspondence with at least one subject information.

In a possible implementation manner, the target node device configures the number n of identification information of at least one control node device in the first information.

In a possible implementation manner, the target node device configures group identification information in at least one topic information of the first ACE of the ACL; the identification information of each control node device in the identification information of at least one control node device Perform compression to obtain the compressed identification information of at least one control node device; configure the compressed identification information of at least one control node device in at least one topic information containing the group identification information, and at least one compressed identification information of the control node device and at least one One-to-one correspondence of subject information.

In a possible implementation manner, the target node device compresses the identification information of each control node device among the group identification information and the identification information of the at least one control node device, to obtain at least one piece of first compressed information; Configuring the at least one first compressed information in at least one subject information of the ACL, where the at least one first compressed information corresponds to the at least one subject information one by one.

In a possible implementation manner, an authentication mode is added in the access control entity structure of the target node device. The authentication modes in the access control entity structure of the target node device include: key-based security connection, certificate-based security connection, group-based security connection and enhanced group-based security connection. Among them, the enhanced group-based secure connection is a newly added authentication mode, which means that the group-based secure connection mode must be inherited, and the content of the subject information in the ACL in the above-mentioned embodiment must be satisfied.

S206. The target node device receives a group command, where the group command includes group identification information and identification information of the source node device.

Specifically, the target node device and the source node device belong to the same multicast group, in the multicast group, the source node device sends a group command, and correspondingly, the target node device receives the group command.

S207. The target node device judges whether to execute the group command according to the group identification information, the identification information of the source node device, and the subject information in the ACL of the target node device.

In a possible implementation, the target node device determines the first ACE in the ACL according to the group identification information; checks in the first ACE whether there is subject information that matches the identification information of the source node device; if it exists, execute The set of commands. In a possible implementation manner, if it does not exist, the group command is not executed.

In a possible implementation manner, the target node device determines the first information in the ACL according to the group identification information; finds whether there is information matching the identification information of the source node device in the last n topic information of the first information; If present, the group command is executed. In a possible implementation manner, if it does not exist, the group command is not executed.

In a possible implementation manner, the target node device determines at least one topic information containing group identification information in the ACL according to the group identification information; compresses the identification information of the source node device to obtain the compressed identification information of the source node device; Check whether there is information matching the compressed identification information of the source node device in at least one topic information including the group identification information; if yes, execute the group command. In a possible implementation manner, if it does not exist, the group command is not executed.

In a possible implementation manner, the target node device determines at least one topic information containing group identification information in the ACL according to the group identification information; decompresses at least one topic information containing group identification information to obtain at least one first decompressed Compress information; check whether there is information matching the identification information of the source node device in at least one first decompressed information; if yes, execute the group command. In a possible implementation manner, if it does not exist, the group command is not executed.

In a possible implementation manner, the target node device compresses the group identification information and the identification information of the source node device to obtain the second compressed information; check whether there is subject information matching the second compressed information in the ACL; if there is , the group command is executed. In a possible implementation manner, if it does not exist, the group command is not executed.

In a possible implementation manner, the target node device decompresses at least one subject information in the ACL to obtain at least one second decompressed information; checks whether there is a group identification information and Information matching the identification information of the source node device; if it exists, execute the group command. In a possible implementation manner, if it does not exist, the group command is not executed.

In the above method, the configurator sends ACL configuration information to the target node device, the ACL configuration information includes group identification information and identification information of at least one control node device, and the target node device configures according to the group identification information and the identification information of at least one control node device ACLs. In the multicast group, the source of the group command is restricted through the topic information in the ACL, so that the group command issued by the control node device can be executed by other node devices in the group. After the target node device receives the group command, it checks the topic information in the ACL and combines the identification information of the source node device to determine whether the group command from the source node device can be executed. In this way, it is avoided that a certain node device in the multicast group is illegally controlled and then controls other node devices in the group through group commands, and the security of communication between node devices in the multicast group is improved.

Referring to FIG. 3 , FIG. 3 is a schematic diagram of another group command processing method provided by an embodiment of the present application. As shown in Figure 3, the processing methods of this group of commands include:

S301. The target node device receives ACL configuration information from a configurator, where the ACL configuration information includes group identification information and identification information of at least one control node device.

Specifically, the configurator is used to configure the node devices in the multicast group, and the node devices in the same multicast group are configured by one configurator. Specifically, the group identification information in the ACL configuration information is the group identification information of the first multicast group to which the target node device belongs, and the identification information of at least one control node device indicates at least one control node device in the first multicast group . Wherein, when configuring the node devices in the multicast group, the configurator determines one or more node devices as control node devices, and the group commands sent by the control node devices will be executed by other node devices in the group.

S302. The target node device configures the group identifier information in the first information of the first access control entity ACE of the ACL.

Specifically, the ACL of the target node device includes one or more access control entities (access control entity, ACE), and each ACE includes a piece of first information and one or more subject information. In a possible implementation manner, the first information may be subject information in the ACE. After receiving the ACL configuration information, the target node device configures the group identification information in the ACL configuration information in the first information of the first ACE.

S303. The target node device configures the identification information of at least one control node device in at least one subject information of the first ACE.

Specifically, the target node device also configures the identification information of at least one control node device in the ACL configuration information in at least one topic information of the first ACE, and the identification information of the at least one control node device and the at least one topic information are one by one correspond. For example, the control node devices in the first multicast group include node device 1, node device 2 and node device 3, the group commands sent by node device 1, node device 2 and node device 3 will be executed by other node devices in the group, The identification information of the node device 1, the node device 2, and the node device 3 are respectively configured in the three subject information in the first ACE, and one identification information corresponds to one subject information. It should be noted that, in this embodiment, one ACE corresponds to one multicast group, and group identification information of other multicast groups and identification information of control node devices need to be configured in other ACEs.

In a possible implementation manner, the subject (Subjects) structure of the first ACE of the target node device is shown in Table 7.

Table 7 The first topic structure of ACE

Specifically, in an ACE, the subject information has a length of 64 bits, and the first information is the subject information in the ACE. The group identification information has a length of 16 bits, and the identification information of the control node device has a length of 64 bits. In the structure shown in Table 7, the group identification information is configured in the lower 16 bits of the first information, and the identification information of the control node device is configured in the next 64 bits (ie, the next topic information). It should be noted that the structure shown in Table 7 is only an example, and the group identification information may also be configured in the upper 16 bits of the first information, or the group identification information may be configured in any 16 bits of the first information. If there is identification information of multiple control node devices, the identification information of multiple control node devices is configured in multiple pieces of subject information following the first information.

Optionally, the 16-23 bits in the first information may also configure the number n of identification information of at least one control node device. For example, if identification information of 3 control node devices is configured in the first ACE, then n is 3, and n is 3 configured in the first information.

S304. The target node device receives a group command, where the group command includes group identification information and identification information of the source node device.

Specifically, the target node device and the source node device belong to the first multicast group, and in the multicast group, the source node device sends a group command, and correspondingly, the target node device receives the group command.

S305. The target node device determines the first ACE in the ACL according to the group identification information.

Optionally, after the target node device receives the group command, it searches the ACL for an ACE that satisfies the following conditions: the authentication mode (AuthMode) in the ACE is GROUP; the target (Targets) in the ACE matches the target resource requested by the group command ; The domain index (FabricIndex) in the ACE matches the group identification information in the group command. The ACE that satisfies the foregoing conditions is the first ACE.

S306. The target node device searches in the first ACE whether there is subject information matching the identification information of the source node device.

Specifically, the first ACE further includes at least one topic information, and the topic information is configured with identification information of the control node device in the multicast group. The target node device checks in the first ACE whether there is topic information that matches the identification information of the source node device. If it exists, it indicates that the source node device is the control node device in the multicast group, so the group command sent by the source node device can be is executed, the target node device executes this group of commands, otherwise it does not execute.

S307. If it exists, the target node device executes the group command.

S308. If it does not exist, the target node device does not execute the group command.

In the above method, in the multicast group, the source of the group command is restricted through the topic information in the ACL, so that the group command issued by the control node device can be executed by other node devices in the group. After the target node device receives the group command, it checks the topic information in the ACL and combines the identification information of the source node device to determine whether the group command from the source node device can be executed. In this way, it is avoided that a certain node device in the multicast group is illegally controlled and then controls other node devices in the group through group commands, and the security of communication between node devices in the multicast group is improved.

Referring to FIG. 4 , FIG. 4 is a schematic diagram of another group command processing method provided by an embodiment of the present application. As shown in Figure 4, the processing methods of this group of commands include:

S401. The target node device receives ACL configuration information from a configurator, where the ACL configuration information includes group identification information and identification information of at least one control node device.

Specifically, the configurator is used to configure the node devices in the multicast group, and the node devices in the same multicast group are configured by one configurator. Specifically, the group identification information in the ACL configuration information is the group identification information of the first multicast group to which the target node device belongs, and the identification information of at least one control node device indicates at least one control node device in the first multicast group. Wherein, when configuring the node devices in the multicast group, the configurator determines one or more node devices as control node devices, and the group commands sent by the control node devices will be executed by other node devices in the group.

S402. The target node device configures the group identification information in the first information of the first access control entity ACE of the ACL.

Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more first information and one or more topic information. After receiving the ACL configuration information, the target node device configures the group identification information in the ACL configuration information in the first information of the first ACE.

S403. The target node device configures the number n of identification information of at least one control node device in the first information.

Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more first information and one or more second topic information. In a possible implementation manner, the first information may be subject information in the ACE. After receiving the ACL configuration information, the target node device configures the group identification information in the ACL configuration information in the first information of the first ACE, and also configures the number n of identification information of at least one control node device in the first information . For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3. At this time, the number n of identification information is 3, and the target node device configures n as 3 in the first information .

S404. The target node device configures the identification information of at least one control node device in at least one subject information of the first ACE.

Specifically, the target node device also configures the identification information of at least one control node device in the ACL configuration information in at least one subject information of the first ACE. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3, and the identification information of node device 1, node device 2, and node device 3 are respectively configured in three ACEs in the first ACE. In the topic information, one identification information corresponds to one topic information. It should be noted that, in this embodiment, one ACE corresponds to one or more multicast groups, and group identification information of other multicast groups and identification information of control node devices may also be configured in the first ACE.

In a possible implementation manner, the subject (Subjects) structure of the first ACE of the target node device is shown in Table 8.

Table 8 The second theme structure of ACE

Specifically, in an ACE, the subject information has a length of 64 bits, and the first information is the subject information in the ACE. The group identification information has a length of 16 bits, and the identification information of the control node device has a length of 64 bits. In the structure shown in Table 8, the group identification information is configured in the lower 16 bits of the first information, and the 16-23 bits in the first information configure the number of devices corresponding to the identification information of at least one control node device. It should be noted that the structure shown in Table 8 is only an example, the group identification information can be configured in any 16 bits of the first information, and the number n of identification information of the control node device can also be configured in the first information and the group identification A location where information is not repeated. For example, if 3 pieces of identification information are configured in the first ACE, then n is 3, and n is 3 configured in the first information.

The identification information of the control node device is configured in the next 64 bits of the first information (that is, the next topic information). If there is identification information of multiple control node devices, the identification information of multiple control node devices is configured in multiple pieces of subject information following the first information. In the first ACE, multiple pieces of group identification information may be respectively configured in multiple pieces of first information.

S405. The target node device receives a group command, where the group command includes group identification information and identification information of the source node device.

S406. The target node device determines first information in the ACL according to the group identification information.

Specifically, the target node device configures the group identification information in the ACL configuration information in the first information of the first ACE, so the target node device can determine the first information according to the group identification information in the group command.

S407. The target node device searches whether there is information matching the identification information of the source node device in the last n topic information of the first information.

Specifically, after the first information is determined, the number n of identification information of control node devices in the first information is obtained, and the last n pieces of subject information of the first information are configured with identification information of control node devices in the multicast group. Check whether there is topic information matching the identification information of the source node device in the last n topic information of the first message, if it exists, it means that the source node device is the control node device in the multicast group, so the source node device sends A group of commands can be executed, and the target node device executes the group of commands, otherwise it does not execute.

S408. If it exists, the target node device executes the group command.

S409. If it does not exist, the target node device does not execute the group command.

Referring to FIG. 5 , FIG. 5 is a schematic diagram of another group command processing method provided by an embodiment of the present application. As shown in Figure 5, the processing methods of this group of commands include:

S501. The target node device receives ACL configuration information from a configurator, where the ACL configuration information includes group identification information and identification information of at least one control node device.

S502. The target node device respectively configures group identification information in at least one subject information of the first ACE of the ACL.

Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more subject information. After receiving the ACL configuration information, the target node device configures the group identification information in the ACL configuration information in at least one topic information of the first ACE respectively.

S503. The target node device compresses the identification information of each control node device in the identification information of at least one control node device to obtain the compressed identification information of at least one control node device.

S504. The target node device configures the compressed identification information of at least one control node device in at least one subject information including group identification information, and the compressed identification information of at least one control node device corresponds to the at least one subject information one by one.

Specifically, the target node device configures the compression identification information of at least one control node device in at least one topic information including group identification information. For example, the control node devices in the first multicast group include node device 1, node device 2 and node device 3, group identification information is respectively configured in three topic information, and node device 1, node device 2 and node device The compression identification information of 3 is also respectively configured in the three topic information, that is to say, in the three topic information, each topic information includes group identification information and one piece of compression identification information. It should be noted that, in this embodiment, one ACE corresponds to one or more multicast groups, and the group identification information of other multicast groups and the compression identification information of the control node device may also be configured in the first ACE.

In a possible implementation manner, the subject (Subjects) structure of the first ACE of the target node device is shown in Table 9.

Table 9 The third theme structure of ACE

Specifically, in an ACE, the subject information has a length of 64 bits, the group identification information has a length of 16 bits, and the identification information of the control node device has a length of 64 bits. In the structure shown in Table 9, the group identification information is configured in the lower 16 bits of the topic information, and the identification information of the 64-bit control node device is compressed to 48 bits, and configured in the upper 48 bits of the topic information. It should be noted that the structure shown in Table 9 is only an example, and the group identification information can also be configured in the upper 16 bits of the topic information, and the identification information of the 64-bit control node device is compressed to 48 bits, and configured in the lower 16 bits of the topic information. 48bits. If there are multiple identification information of control node devices, the identification information of each control node device is compressed separately, and the compressed identification information and group identification information of each control node device form the structure shown in Table 9 and are configured in the topic information . Optionally, in the first ACE, multiple pieces of group identification information may be respectively configured in multiple topic information, that is to say, group identification information 1 and group identification information 2 may be the same or different.

S505. The target node device receives a group command, where the group command includes group identification information and identification information of the source node device.

S506. The target node device determines at least one subject information in the ACL according to the group identification information.

Specifically, the target node device configures the group identification information in at least one topic information respectively, therefore, the target node device can determine the topic information including the group identification information in the ACL according to the group identification information in the group command.

S507. Compress the identification information of the source node device to obtain the compressed identification information of the source node device.

Specifically, the subject information configures the compressed identification information of the control node device in the multicast group, and the compressed identification information of the control node device is obtained by compressing the identification information of the control node device. The identification information of the source node device is compressed by the same algorithm as that of compressing the identification information of the control node device, to obtain the compressed identification information of the source node device.

S508. Search whether there is information matching the compressed identification information of the source node device in at least one subject information.

Specifically, the subject information configures the compressed identification information of the control node device in the multicast group, and the compressed identification information of the control node device is obtained by compressing the identification information of the control node device. Find whether there is information matching the compression identification information of the source node device in at least one topic information, if it exists, it means that the source node device is the control node device in the multicast group, so the group command issued by the source node device can be executed , the target node device executes this group of commands, otherwise it does not execute.

S509. If it exists, the target node device executes the group command.

S510. If it does not exist, the target node device does not execute the group command.

Referring to FIG. 6 , FIG. 6 is a schematic diagram of another group command processing method provided by an embodiment of the present application. As shown in Figure 6, the processing methods of this group of commands include:

S601. The target node device receives ACL configuration information from a configurator, where the ACL configuration information includes group identification information and identification information of at least one control node device.

S602. The target node device compresses the identification information of each control node device among the group identification information and the identification information of at least one control node device, to obtain at least one piece of first compressed information.

Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more subject information. After receiving the ACL configuration information, the target node device compresses the group identification information in the ACL configuration information and the identification information of each control node device among the identification information of at least one control node device to obtain at least one piece of first compressed information. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3, and the group identification information is respectively combined with the identification information of node device 1, the identification information of node device 2, and the identification information of node device 3. The information is compressed to obtain three first compressed information.

S603. The target node device configures at least one piece of first compressed information in at least one topic information of the ACL, where the at least one piece of first compressed information corresponds to at least one piece of topic information.

Specifically, the target node device configures the at least one piece of first compression information in at least one subject information of the ACL. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3, and the group identification information is respectively combined with the identification information of node device 1, the identification information of node device 2, and the identification information of node device 3. The information is compressed to obtain three first compressed information. Then configure the three first compressed information in the three topic information respectively, that is to say, in the three topic information, each topic information includes a first compressed information, and a first compressed information consists of the group identification information and The identification information of a control node device is compressed. It should be noted that, in this embodiment, one ACE corresponds to one or more multicast groups, and information obtained by compressing the group identification information and the identification information of the control node device for other multicast groups may also be configured in the first ACE.

In a possible implementation manner, the subject (Subjects) structure of the first ACE of the target node device is shown in Table 10.

Table 10 The fourth theme structure of ACE

subject information

0-63bit0-63bit
第一压缩信息first compressed information
……...

Specifically, in an ACE, the subject information has a length of 64 bits, the group identification information has a length of 16 bits, and the identification information of the control node device has a length of 64 bits. In the structure shown in Table 10, the identification information of the control node device of 64 bits and the group identification information of 16 bits are compressed into the first compressed information of 64 bits, and configured in the topic information. If there are multiple identification information of control node devices, the identification information and group identification information of each control node device are compressed to form the structure shown in Table 9 and configured in the topic information. Optionally, in the first ACE, the identification information of control node devices of other multicast groups and compressed information obtained by compressing the group identification information may be configured in different topic information.

S604. The target node device receives a group command, where the group command includes group identification information and identification information of the source node device.

S605. The target node device compresses the group identification information and the identification information of the source node device to obtain second compressed information.

Specifically, the ACL of the target node device includes at least one subject information, and the subject information is configured with first compressed information obtained by compressing the group identification information and the identification information of the control node device in the multicast group. The second compressed information is obtained by compressing the group identification information and the identification information of the source node device by using the same algorithm as compressing the group identification information and the identification information of the control node device in the multicast group.

S606. The target node device searches the ACL for whether there is subject information matching the second compressed information.

Specifically, the subject information is configured with first compressed information obtained by compressing the group identification information and the identification information of the control node device in the multicast group. The group identification information and the identification information of the source node device are compressed by using the same compression algorithm to obtain the second compressed information. Check the ACL to see if there is topic information that matches the second compressed information. If it exists, it means that the source node device is the control node device in the multicast group. Therefore, the group command sent by the source node device can be executed, and the target node device Execute the set of commands, otherwise not.

S607. If it exists, the target node device executes the group command.

S608. If it does not exist, the target node device does not execute the group command.

The method for processing the group command provided by the embodiment of the present application is described above, and the communication device provided by the embodiment of the present application will be described below.

Referring to FIG. 7 , FIG. 7 is a schematic diagram of a communication device provided by an embodiment of the present application. The communication device 700 is applied to a target node device and includes a transceiver unit 710 and a processing unit 720 . The communication device 700 may be a target node device, or a chip or an integrated circuit inside the target node device, wherein:

The transceiver unit 710 is configured to receive a multicast message, the multicast message is a group command, and the multicast message includes group identification information and source node device identification information.

The processing unit 720 is configured to judge whether to execute the group command according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device.

In the embodiment of this application, the target node device receives a multicast message, and the multicast message is a group command, including group identification information and source node device identification information, and the target node device The topic information determines whether to execute the group command. In the multicast group, the source of the group command is restricted through the topic information in the ACL, so that the group command issued by the control node device can be executed by other devices in the group. After the target node device receives the group command, it checks the topic information in the ACL and combines the identification information of the source node device to determine whether the group command from the source node device can be executed. In this way, it is avoided that a certain node device in the multicast group is illegally controlled and then controls other node devices in the group through group commands, and the security of communication between node devices in the multicast group is improved.

Optionally, as an embodiment, the transceiver unit 710 is further configured to receive ACL configuration information from the configurator, where the ACL configuration information includes the group identification information and identification information of at least one control node device; the processing unit 720 further uses The ACL is configured according to the group identification information and the identification information of the at least one control node device.

Optionally, as an embodiment, the processing unit 720 is specifically configured to: configure the group identification information in the first information of the first access control entity ACE of the ACL; configure the identification of the at least one control node device The information is configured in at least one topic information of the first ACE, and the identification information of the at least one control node device is in one-to-one correspondence with the at least one topic information.

Optionally, as an embodiment, the processing unit 720 is further configured to: configure the number n of identification information of the at least one control node device in the first information.

Optionally, as an embodiment, the processing unit 720 is specifically configured to: respectively configure the group identification information in at least one subject information of the first ACE of the ACL; configure the identification information of the at least one control node device Compress the identification information of each control node device in the group to obtain the compressed identification information of at least one control node device; configure the compressed identification information of the at least one control node device in at least one subject information containing the group identification information , the compressed identification information of the at least one control node device is in one-to-one correspondence with the at least one subject information.

Optionally, as an embodiment, the processing unit 720 is specifically configured to: compress the identification information of each control node device in the group identification information and the identification information of the at least one control node device, to obtain at least one first Compressed information: configure the at least one first compressed information in at least one subject information of the ACL, where the at least one first compressed information is in one-to-one correspondence with the at least one subject information.

Optionally, as an embodiment, the processing unit 720 is specifically configured to: determine the first ACE in the ACL according to the group identification information; check whether there is an ACE related to the source node in the first ACE The subject information that matches the device's identification information; if present, execute the set of commands.

Optionally, as an embodiment, the processing unit 720 is specifically configured to: determine the first information in the ACL according to the group identification information; find whether There is information matching the identification information of the source node device; if there is, the set of commands is executed.

Optionally, as an embodiment, the processing unit 720 is specifically configured to: determine at least one subject information in the ACL that includes the group identification information according to the group identification information; Compress to obtain the compressed identification information of the source node device; find whether there is information matching the compressed identification information of the source node device in at least one topic information containing the group identification information; if so, execute the group command .

Optionally, as an embodiment, the processing unit 720 is specifically configured to: according to the group identification information, determine at least one subject information in the ACL that includes the group identification information; Decompress the subject information to obtain at least one first decompressed information; find whether there is information matching the identification information of the source node device in the at least one first decompressed information; if so, execute the set Order.

Optionally, as an embodiment, the processing unit 720 is specifically configured to: compress the group identification information and the identification information of the source node device to obtain second compressed information; check whether there is an The subject information matching the second compression information; if it exists, execute the set of commands.

Optionally, as an embodiment, the processing unit 720 is specifically configured to: decompress at least one subject information in the ACL to obtain at least one second decompressed information; in the at least one second decompressed information Finding whether there is information matching the group identification information and the identification information of the source node device; if yes, executing the group command.

Optionally, as an embodiment, the processing unit 720 is further configured to: if not exist, not execute the set of commands.

Optionally, as an embodiment, the transceiver unit 710 is further configured to receive group table configuration information from the configurator, where the group table configuration information includes first indication information, and the first indication information is used to indicate that the target node Whether the device is a control node device; the processing unit 720 is further configured to configure the first indication information in the group table of the target node device.

Optionally, as an embodiment, the ACL configuration information further includes authentication mode configuration information, and the processing unit 720 is further configured to: according to the authentication mode configuration information, configure the authentication mode of the ACE in the ACL as Enhanced group-based secure connections.

It should be understood that the transceiver unit 710 in the embodiment of the present application may be implemented by a transceiver or a transceiver-related circuit component, and the processing unit 720 may be implemented by a processor or a processor-related component.

Referring to FIG. 8 , FIG. 8 is a schematic diagram of another communication device provided by an embodiment of the present application. The communication device 800 is applied to a configurator and includes a transceiver unit 810 . The communication device 800 may be a configurator, or a chip or an integrated circuit inside the configurator, wherein:

The transceiver unit 810 is configured to send access control list ACL configuration information to the target node device, the ACL configuration information includes group identification information and identification information of at least one control node device, and the ACL configuration information is used to indicate the target node device The ACL is configured according to the group identification information and the identification information of the at least one control node device, and the subject information in the ACL is used by the target node device to determine whether to execute a group command.

In the embodiment of the present application, the configurator sends ACL configuration information to the target node device, the ACL configuration information includes group identification information and identification information of at least one control node device, and the target node device uses the group identification information and identification information of at least one control node device , configure the ACL. In the multicast group, the source of the group command is restricted through the topic information in the ACL, so that the group command issued by the control node device can be executed by other devices in the group. After the target node device receives the group command, it checks the topic information in the ACL and combines the identification information of the source node device to determine whether the group command from the source node device can be executed. In this way, it is avoided that a certain node device in the multicast group is illegally controlled and then controls other node devices in the group through group commands, and the security of communication between node devices in the multicast group is improved.

Optionally, as an embodiment, the transceiver unit 810 is further configured to: send group table configuration information to multiple node devices in the multicast group, the group table configuration information includes first indication information, and the group table configuration information It is used to instruct each node device among the plurality of node devices to configure the first indication information in the group table, where the first indication information is used to indicate whether each node device is a control node device.

Optionally, as an embodiment, the apparatus further includes a processing unit 820, and the processing unit 820 is configured to: determine the ACL configuration information according to the first indication information of the plurality of node devices.

It should be understood that the transceiver unit 810 in the embodiment of the present application may be implemented by a transceiver or a transceiver-related circuit component, and the processing unit 820 may be implemented by a processor or a processor-related component.

Referring to FIG. 9, FIG. 9 is a schematic diagram of a target node device provided in an embodiment of the present application. The target node device 900 includes a processor 910, a memory 920, and a transceiver 930, wherein the memory 920 stores instructions or programs, and the processor 910 is used to execute instructions or programs stored in memory 920 . When the instructions or programs stored in the memory 920 are executed, the processor 910 is used to perform the operations performed by the processing unit 720 in the above embodiments, and the transceiver 930 is used to perform the operations performed by the transceiver unit 710 in the above embodiments.

It should be understood that the communication device 700 in the embodiment of the present application may correspond to the target node device in the group command processing method in the embodiment of the present application, and the operations and/or functions of each unit in the communication device 700 or the target node device 900 are respectively In order to realize the corresponding flow of the method for processing the above-mentioned group commands, for the sake of brevity, details are not repeated here.

Referring to FIG. 10, FIG. 10 is a schematic diagram of a configurator provided in an embodiment of the present application. The configurator 1000 includes a processor 1010, a memory 1020, and a transceiver 1030, wherein the memory 1020 stores instructions or programs, and the processor 1010 uses Instructions or programs stored in the memory 1020 are executed. When the instructions or programs stored in the memory 1020 are executed, the processor 1010 is used to perform the operations performed by the processing unit 820 in the above embodiments, and the transceiver 1030 is used to perform the operations performed by the transceiver unit 810 in the above embodiments.

It should be understood that the communication device 800 in the embodiment of the present application may correspond to the configurator in the method for processing group commands in the embodiment of the present application, and the operations and/or functions of each unit in the communication device 800 or the configurator 1000 are respectively for realizing For the sake of brevity, the corresponding flow of the method for processing the above group commands will not be repeated here.

The embodiment of the present application also provides a computer-readable storage medium, where the computer-readable storage medium is used to store instructions, and when the instructions are executed by a processor, the procedures related to the target node device in the foregoing method embodiments can be implemented.

The embodiment of the present application also provides a computer-readable storage medium, where the computer-readable storage medium is used to store instructions, and when the instructions are executed by a processor, the processes related to the configurator in the above method embodiments can be implemented.

The embodiment of the present application also provides a computer program product containing instructions, which when run on a computer or a processor, causes the computer or processor to execute one or more steps in the above method embodiments. If each component module of the above-mentioned device is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in the computer-readable storage medium.

It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

It should be understood that, in various embodiments of the present application, the sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application. The implementation process constitutes any limitation.

Those skilled in the art can appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims

A method for processing a multicast message, wherein the method is applied to a target node device, comprising:

receiving a multicast message, the multicast message is a group command, and the multicast message includes group identification information and identification information of a source node device;

Whether to execute the group command is determined according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device.
The method according to claim 1, wherein, according to the group identification information, the identification information of the source node device, and the subject information in the access control list (ACL) of the target node device, it is judged whether to execute Before the set of commands, the method also includes:

receiving ACL configuration information from a configurator, where the ACL configuration information includes the group identification information and identification information of at least one control node device;

Configuring the ACL according to the group identification information and the identification information of the at least one control node device.
The method according to claim 2, wherein the configuring the ACL according to the group identification information and the identification information of the at least one control node device comprises:

Configuring the group identification information in the first information of the first access control entity ACE of the ACL;

The identification information of the at least one control node device is configured in at least one topic information of the first ACE, and the identification information of the at least one control node device corresponds to the at least one topic information one by one.
The method according to claim 3, wherein the configuring the ACL according to the group identification information and the identification information of the at least one control node device further comprises:

The number n of identification information of the at least one control node device is configured in the first information.
The method according to claim 2, wherein the configuring the ACL according to the group identification information and the identification information of the at least one control node device comprises:

Configuring the group identification information in at least one subject information of the first ACE of the ACL;

Compressing the identification information of each control node device in the identification information of the at least one control node device to obtain the compressed identification information of at least one control node device;

The compressed identification information of the at least one control node device is configured in at least one topic information including the group identification information, and the compressed identification information of the at least one control node device is in one-to-one correspondence with the at least one topic information.
The method according to claim 2, wherein the configuring the ACL according to the group identification information and the identification information of the at least one control node device comprises:

Compressing the identification information of each control node device in the group identification information and the identification information of the at least one control node device to obtain at least one piece of first compressed information;

Configuring the at least one first compressed information in at least one subject information of the ACL, where the at least one first compressed information corresponds to the at least one subject information one by one.
The method according to claim 3, wherein, according to the group identification information, the identification information of the source node device, and the subject information in the access control list (ACL) of the target node device, it is judged whether to execute the The above group commands include:

determining the first ACE in the ACL according to the group identification information;

Finding whether there is subject information matching the identification information of the source node device in the first ACE;

If present, execute the set of commands.
The method according to claim 4, wherein, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device, it is judged whether to execute the The above group commands include:

determining the first information in the ACL according to the group identification information;

Finding whether there is information matching the identification information of the source node device in the last n subject information of the first information;

If present, execute the set of commands.
The method according to claim 5, wherein, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device, it is judged whether to execute the The above group commands include:

According to the group identification information, determine at least one topic information including the group identification information in the ACL;

Compressing the identification information of the source node device to obtain the compressed identification information of the source node device;

Finding whether there is information matching the compressed identification information of the source node device in at least one subject information including the group identification information;

If present, execute the set of commands.
The method according to claim 5, wherein, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device, it is judged whether to execute the The above group commands include:

According to the group identification information, determine at least one topic information including the group identification information in the ACL;

Decompress at least one topic information including the group identification information to obtain at least one first decompressed information;

Finding whether there is information matching the identification information of the source node device in the at least one first decompressed information;

If present, execute the set of commands.
The method according to claim 6, wherein, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device, it is judged whether to execute the The above group commands include:

Compressing the group identification information and the identification information of the source node device to obtain second compressed information;

Finding whether there is subject information matching the second compressed information in the ACL;

If present, execute the set of commands.
The method according to claim 6, wherein, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device, it is judged whether to execute the The above group commands include:

Decompress at least one subject information in the ACL to obtain at least one second decompressed information;

Finding whether there is information matching the group identification information and the identification information of the source node device in the at least one second decompressed information;

If present, execute the set of commands.
The method according to any one of claims 7-12, wherein, according to the group identification information, the identification information of the source node device, and the topic information in the access control list ACL of the target node device , to determine whether to execute the set of commands, and also include:

If not present, the set of commands is not executed.
The method according to claim 1, further comprising:

receiving group table configuration information from a configurator, where the group table configuration information includes first indication information, and the first indication information is used to indicate whether the target node device is a control node device;

Configuring the first indication information in the group table of the target node device.
The method according to claim 2, wherein the ACL configuration information also includes authentication mode configuration information, and the method further includes:

According to the authentication mode configuration information, the authentication mode of the ACE in the ACL is configured as an enhanced group-based security connection.
A method for processing multicast messages, characterized in that the method is applied to a configurator, including:

Sending access control list ACL configuration information to the target node device, the ACL configuration information includes group identification information and identification information of at least one control node device, and the ACL configuration information is used to instruct the target node device according to the group identification information The ACL is configured with the identification information of the at least one control node device, and the topic information in the ACL is used by the target node device to determine whether to execute the group command.
The method according to claim 16, further comprising:

sending group table configuration information to multiple node devices in the multicast group, where the group table configuration information includes first indication information, and the group table configuration information is used to indicate that each node device in the multiple node devices will The first indication information is configured in a group table, and the first indication information is used to indicate whether each node device is a control node device.
The method according to claim 17, wherein, before sending the access control list ACL configuration information to the target node device, the method further comprises:

Determine the ACL configuration information according to the first indication information of the plurality of node devices.
A communication device, characterized in that the device is applied to a target node device, including:

A transceiver unit, configured to receive a multicast message, the multicast message is a group command, and the multicast message includes group identification information and identification information of a source node device;

A processing unit, configured to judge whether to execute the group command according to the group identification information, the identification information of the source node device, and the subject information in the ACL of the target node device.
The device according to claim 19, wherein the transceiver unit is further configured to receive ACL configuration information from a configurator, the ACL configuration information including the group identification information and identification information of at least one control node device; The processing unit is further configured to configure the ACL according to the group identification information and the identification information of the at least one control node device.
The device according to claim 20, wherein the processing unit is specifically used for:

Configuring the group identification information in the first information of the first access control entity ACE of the ACL;

Configuring the identification information of the at least one control node device in at least one topic information of the first ACE, where the identification information of the at least one control node device corresponds to the at least one topic information.
The device according to claim 21, wherein the processing unit is further used for:

The number n of identification information of the at least one control node device is configured in the first information.
The device according to claim 20, wherein the processing unit is specifically used for:

configuring the group identification information in at least one subject information of the first ACE of the ACL;

Compressing the identification information of each control node device in the identification information of the at least one control node device to obtain the compressed identification information of at least one control node device;

The compressed identification information of the at least one control node device is configured in at least one topic information including the group identification information, and the compressed identification information of the at least one control node device is in one-to-one correspondence with the at least one topic information.
The device according to claim 20, wherein the processing unit is specifically used for:

Compressing the identification information of each control node device in the group identification information and the identification information of the at least one control node device to obtain at least one piece of first compressed information;

Configuring the at least one first compressed information in at least one subject information of the ACL, where the at least one first compressed information corresponds to the at least one subject information one by one.
The device according to claim 21, wherein the processing unit is specifically used for:

determining the first ACE in the ACL according to the group identification information;

Finding whether there is subject information matching the identification information of the source node device in the first ACE;

If present, execute the set of commands.
The device according to claim 22, wherein the processing unit is specifically used for:

determining the first information in the ACL according to the group identification information;

Finding whether there is information matching the identification information of the source node device in the last n subject information of the first information;

If present, execute the set of commands.
The device according to claim 23, wherein the processing unit is specifically used for:

According to the group identification information, determine at least one topic information including the group identification information in the ACL;

Compressing the identification information of the source node device to obtain the compressed identification information of the source node device;

Finding whether there is information matching the compressed identification information of the source node device in at least one subject information including the group identification information;

If present, execute the set of commands.
The device according to claim 23, wherein the processing unit is specifically used for:

According to the group identification information, determine at least one topic information including the group identification information in the ACL;

Decompress at least one topic information including the group identification information to obtain at least one first decompressed information;

Finding whether there is information matching the identification information of the source node device in the at least one first decompressed information;

If present, execute the set of commands.
The device according to claim 24, wherein the processing unit is specifically used for:

Compressing the group identification information and the identification information of the source node device to obtain second compressed information;

Finding whether there is subject information matching the second compressed information in the ACL;

If present, execute the set of commands.
The device according to claim 24, wherein the processing unit is specifically used for:

Decompress at least one subject information in the ACL to obtain at least one second decompressed information;

Finding whether there is information matching the group identification information and the identification information of the source node device in the at least one second decompressed information;

If present, execute the set of commands.
The device according to any one of claims 25-30, wherein the processing unit is further configured to:

If not present, the set of commands is not executed.
The device according to claim 19, wherein the transceiver unit is further configured to receive group table configuration information from a configurator, the group table configuration information includes first indication information, and the first indication information is used to Indicating whether the target node device is a control node device; the processing unit is further configured to configure the first indication information in a group table of the target node device.
The device according to claim 20, wherein the ACL configuration information further includes authentication mode configuration information, and the processing unit is further configured to:

According to the authentication mode configuration information, the authentication mode of the ACE in the ACL is configured as an enhanced group-based security connection.
A communication device, characterized in that the device is applied to a configurator, comprising:

A transceiver unit, configured to send access control list ACL configuration information to the target node device, the ACL configuration information includes group identification information and identification information of at least one control node device, and the ACL configuration information is used to instruct the target node device according to The group identification information and the identification information of the at least one control node device configure the ACL, and the subject information in the ACL is used by the target node device to determine whether to execute a group command.
The device according to claim 34, wherein the transceiver unit is also used for:

sending group table configuration information to multiple node devices in the multicast group, where the group table configuration information includes first indication information, and the group table configuration information is used to indicate that each node device in the multiple node devices will The first indication information is configured in a group table, and the first indication information is used to indicate whether each node device is a control node device.
The device according to claim 35, wherein the device further comprises a processing unit configured to:

Determine the ACL configuration information according to the first indication information of the plurality of node devices.
A target node device, characterized in that it includes a memory, a processor, and a program stored on the memory and operable on the processor, when the processor executes the program, it implements claims 1 to 15 any one of the methods described.
A configurator, characterized by comprising a memory, a processor, and a program stored on the memory and operable on the processor, when the processor executes the program, any one of the methods described.
A computer-readable storage medium, characterized in that the computer-readable storage medium is used to store instructions, and when the instructions are executed by a processor, such that any one of claims 1 to 15, or any one of claims 16 to 15 The method described in any one of 18 is carried out.
A computer program product comprising instructions, characterized in that, when it is run on a computer, the method according to any one of claims 1 to 15 or any one of claims 16 to 18 is executed.