WO2023125147A1

WO2023125147A1 - Internet of things directional access management and control method and system

Info

Publication number: WO2023125147A1
Application number: PCT/CN2022/140374
Authority: WO
Inventors: 陈洲; 陈冯; 沈江兵; 赵翔; 兰卓睿
Original assignee: 天翼物联科技有限公司
Priority date: 2021-12-30
Filing date: 2022-12-20
Publication date: 2023-07-06
Also published as: CN114338177A; CN114338177B

Abstract

An embodiment of the present invention relates to the technical field of Internet of Things. Disclosed are an Internet of Things directional access management and control method and system. The method comprises: if an Internet of Things terminal receives an application access request, intercepting the application access request by means of an authentication SDK and extracting application information; according to the application information, determining whether an application is present in a local cache of the authentication SDK; if the application is not present in the local cache of the authentication SDK, sending the application information to an Internet of Things platform for dual authentication, and marking the application access request corresponding to the application information which passes dual authentication; and sending all application access requests to a network resource module so as to enable the network resource module to determine whether to switch on. By means of marking the application access request that has passed dual authentication and taking same as the basis for a network element to switch on, the time a user spends performing directional repeated configuration is shortened, and the matching time of the network element is also shortened, thus increasing the efficiency of data transmission and access of the application.

Description

Internet of things directional access control method and system

technical field

The present invention relates to the technical field of the Internet of Things, in particular to a method and system for directional access control of the Internet of Things.

Background technique

At present, the access control of the directional Internet of Things is generally through the directional access configuration on the gateway to realize the release of the directional access of the client equipment to the Internet service. In order to order targeted access services, customers must provide various application services based on customer equipment and configure a series of targeted access targets. However, it is cumbersome to configure and manage these targeted access targets, and the control and matching of network elements is also troublesome. The acquisition of the target is also more troublesome. For example, most IoT devices install and use a variety of the same applications, and there are also different applications accessing the same Internet services. For example, the audio-visual services of Internet of Vehicles companies may often access Baidu Navigation, AutoNavi, Tencent Video, QQ Music, etc. Third-party apps. Since the directional access configuration on the network is a customer-level configuration, many of the same directional configurations need to be set repeatedly and the number of directional addresses is limited in order to allow these applications of different customers and different devices; this results in operators needing to spend on network elements It takes time to do repeated configuration of customer-level orientation, which consumes the matching time of network elements, resulting in low efficiency of application data transmission and access.

Contents of the invention

Embodiments of the present invention provide a method and system for directional access control of the Internet of Things, aiming at solving the problem of inefficiency in data transmission and access of applications caused by existing directional access control methods of the Internet of Things.

In the first aspect, the embodiment of the present invention provides a method for directional access management and control of the Internet of Things, which is applied to a directional access management and control system of the Internet of Things. The directional access management and control system of the Internet of Things includes an Internet of Things terminal, an Internet of Things platform, and a network resource module. The IoT terminal includes an authentication SDK, and the authentication SDK has cached application information and application identifiers that have been accessed; the method includes: if the IoT terminal receives an application access request, intercepting the An application access request and extracting the application information, wherein the application access request includes at least one access request initiated by the application; judging whether the application exists in the local cache of the authentication SDK according to the application information; if In the local cache of the authentication SDK, the application uses the application identifier corresponding to the application to mark the application access request; if the application does not exist in the local cache of the authentication SDK, the application The information is sent to the Internet of Things platform to enable the Internet of Things platform to perform double authentication, and the application access request corresponding to the application information that has passed the double authentication is marked with the corresponding application identification; all the application access requests Send to the network resource module, so that the network resource module judges whether to allow it according to whether the application access request is marked and whether the application is an application configured for pre-directed access.

In the second aspect, the embodiment of the present invention also provides a directional access management and control system for the Internet of Things, the system includes: an Internet of Things terminal, an Internet of Things platform, and network resources, the Internet of Things terminal includes an authentication SDK, and the Internet of Things terminal, The Internet of Things platform and network resources communicate with each other to realize the above method together.

An embodiment of the present invention provides a method and system for directional access management and control of the Internet of Things, wherein the method includes: if the Internet of Things terminal receives an application access request, intercepting the application access request through the authentication SDK and extracting the Application information, wherein the application access request includes at least one access request initiated by the application; judging whether the application exists in the local cache of the authentication SDK according to the application information; if the application is in the authentication SDK's In the local cache, use the application identifier corresponding to the application to mark the application access request; if the application does not exist in the local cache of the authentication SDK, send the application information to the IoT The platform enables the Internet of Things platform to perform double authentication, and marks the application access request corresponding to the application information that has passed the double authentication with the corresponding application identification; sends all the application access requests to the network resource module , so that the network resource module judges whether to allow access according to whether the application access request is marked and whether the application is configured for pre-directed access. On the basis of retaining the directional access configuration to control application access to the network, by setting the application access request through two-factor authentication to be marked and used as the basis for network element release, the time for users to perform directional and repeated configuration is reduced, and at the same time The matching time of network elements improves the efficiency of application data transmission and access.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present invention. Ordinary technicians can also obtain other drawings based on these drawings on the premise of not paying creative work.

FIG. 1 is a schematic diagram of an architecture of an Internet of Things directional access management and control system provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a method for directional access control of the Internet of Things provided by an embodiment of the present invention;

FIG. 3 is a schematic subflow diagram of a method for directional access control of the Internet of Things provided by an embodiment of the present invention;

FIG. 4 is a schematic subflow diagram of a method for directional access control of the Internet of Things provided by an embodiment of the present invention;

FIG. 5 is a schematic diagram of an interaction process of an application accessing a network in a method for directional access control of the Internet of Things provided by an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

It should be understood that when used in this specification and the appended claims, the terms "comprising" and "comprises" indicate the presence of described features, integers, operations, elements and/or components, but do not exclude one or more The presence or addition of other features, integers, operations, elements, components and/or collections thereof.

It should also be understood that the terminology used in the description of the present invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the present invention. As used in this specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural referents unless the context clearly dictates otherwise.

It should also be further understood that the term "and/or" used in the description of the present invention and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations .

As used in this specification and the appended claims, the term "if" may be construed as "when" or "once" or "in response to determining" or "in response to detecting" depending on the context . Similarly, the phrase "if determined" or "if [the described condition or event] is detected" may be construed, depending on the context, to mean "once determined" or "in response to the determination" or "once detected [the described condition or event] ]” or “in response to detection of [described condition or event]”.

An embodiment of the present invention provides a directional access management and control method for the Internet of Things, which is applied to a directional access management and control system for the Internet of Things. Please refer to FIG. 1 . FIG. 1 is a schematic diagram of an architecture of an Internet of Things directional access management and control system provided by an embodiment of the present invention. The Internet of Things directional access control system includes an Internet of Things terminal, an Internet of Things platform, and a network resource module, the Internet of Things terminal includes an application and an authentication SDK, and the Internet of Things platform includes an application management module, an application authentication module, and a behavior library module, The network resource module includes network elements and Internet services.

Among them, the authentication SDK is used to intercept application access requests and extract application information, mark application requests that have passed the double verification, and cache the application information and application identification that have been accessed. The application identification refers to the application used to uniquely identify the application ID, application information refers to the characteristics of the application and the access behavior of the application, such as application name, application version, application size, directory structure, target address, service link, etc. The application management module in the IoT platform is used to manage registered applications, and store the registered application information in the application management module. The application authentication module registers and authenticates the application information registered in the application management module. The behavior library module is used to authenticate the access behavior of registered and authenticated application information and establish normal access behavior records. The network element is used to judge whether to allow the packet corresponding to the application access request to access the Internet service according to the application access request.

Please refer to FIG. 5 , which is a schematic diagram of an interaction process of an application accessing a network in a method for directional access control of the Internet of Things provided by an embodiment of the present invention, in which APPId is an application identifier.

Before the application accesses the network, the user needs to register the application on the Internet of Things platform through the client or store the application directional access configuration information in the network element through the Internet of Things platform. The registration process may specifically include the following steps S1A-S1B:

S1A, if the IoT platform receives an application registration request sent by the client, extract the application information in the registration request and store it in the application management module.

In a specific implementation, if the IoT platform receives an application registration request sent by the client, it extracts the application information in the registration request and stores it in the application management module. In one embodiment, the application that accesses network resources through authentication marking requires the user to register the application information with the Internet of Things platform in advance, so as to pass the registration authentication of the application authentication module subsequently.

S1B, if the IoT platform receives an application-oriented access configuration request sent by the client, extract the application-oriented access configuration information in the application-oriented access configuration request and store it in the network element.

In a specific implementation, if the IoT platform receives an application-oriented access configuration request sent by a client, it extracts the application-oriented access configuration information in the application-oriented access configuration request and stores it in the network element. Specifically, in one embodiment, reserved applications access network resources through directional access configuration, so for applications with special needs for users, users can store the directional access configuration information of the applications in network elements in advance, so that subsequent network The element allows the application to access network resources according to the directional access configuration information.

After steps S1A-S1B are completed, the IoT terminal can process the received application access request. The specific implementation process of the Internet of Things directional access management and control method according to the embodiment of the present invention will be described in detail below with reference to FIG. 5 . As shown in Fig. 2, the method of the present invention includes the following steps S1-S6.

S1. If the IoT terminal receives an application access request, intercept the application access request through the authentication SDK and extract the application information.

In specific implementation, if the IoT terminal receives an application access request, the authentication SDK intercepts the application access request and extracts the application information, wherein the application access request includes at least one access request initiated by the application ask. Specifically, four applications APP1, APP2, APP3, and APP4 are installed on the Internet of Things terminal, wherein APP1 and APP2 have been pre-registered on the Internet of Things platform, and APP1 has accessed network resources. APP3 and APP4 are not pre-registered on the IoT platform, but APP3 has pre-configured directional access configuration information on the network element. In one embodiment, the four applications APP1, APP2, APP3, and APP4 all initiate application access requests to the IoT terminal .

S2. Determine whether the application exists in the local cache of the authentication SDK according to the application information.

In a specific implementation, it is judged according to the application information whether the application exists in the local cache of the authentication SDK. Specifically, in one embodiment, for an application that has accessed network resources, its application information and application identification are cached in the authentication SDK for use when the application accesses the next time.

S3. If the application is in the local cache of the authentication SDK, mark the application access request with the application identifier corresponding to the application.

In a specific implementation, if the application is in the local cache of the authentication SDK, the application access request is marked with the application identifier corresponding to the application. Specifically, in one embodiment, APP1 has accessed network resources, so the application information and application ID of APP1 are cached in the local cache of the authentication SDK. When it is determined that APP1 is in the local cache of the authentication SDK, the application using the cached APP1 The identifier marks the access request of APP1. It avoids the authentication of the Internet of Things platform every time an application accesses network resources, thereby improving the speed and efficiency of application access to network resources.

S4. If the application does not exist in the local cache of the authentication SDK, send the application information to the IoT platform to enable the IoT platform to perform double authentication.

In a specific implementation, if the application does not exist in the local cache of the authentication SDK, the application information is sent to the IoT platform so that the IoT platform performs double authentication. Specifically, in one embodiment, the application information corresponding to APP2, APP3 and APP4 is sent to the Internet of Things platform for double authentication.

In one embodiment, the Internet of Things platform includes an application authentication module and a behavior library module, please refer to FIG. 3 , and the dual authentication includes: steps S41-S43.

S41. The application authentication module performs registration authentication on the received application information.

In a specific implementation, the application authentication module performs registration authentication on the received application information. Specifically, the IoT platform further includes an application management module, which stores application information registered by the user, and the application authentication module combines the application information with the application information registered by the user in the application management module. The information is compared; if the comparison is successful, the registration authentication is passed, and if the comparison is unsuccessful, the registration authentication fails. In one embodiment, the Internet of Things platform registers and authenticates the application information corresponding to APP2, APP3, and APP4. Because APP2 has been pre-registered on the Internet of Things platform, there is application information registered by APP2 in the application management module. The application information comparison is successful, and the registration authentication is passed; because APP3 and APP4 are not pre-registered on the IoT platform, the registration authentication of APP3 and APP4 fails.

S42. If the registration authentication passes, the application authentication module sends the application information to the behavior library module for access behavior authentication.

In a specific implementation, if the registration authentication passes, the application authentication module sends the application information to the behavior library module for access behavior authentication. Specifically, in one embodiment, the behavior library module stores normal access behavior records, and the behavior library module searches whether the application information exists in the normal access behavior records; if the application information is in the If the application information does not exist in the normal access behavior record, then the access behavior authentication fails.

S43. If the behavior authentication passes, determine that the application information passes double authentication.

In a specific implementation, if the behavior authentication is passed, it is determined that the application information has passed two-factor authentication. Specifically, after the application information registration authentication is passed, the access behavior authentication is performed through the behavior library module to strengthen the authentication, so as to prevent APPs that are not in the normal access behavior records from accessing network resources. In one embodiment, the application information of APP2 is in the normal access behavior record, so APP2 passes the two-factor authentication.

It should be noted that after the application is registered and authenticated, the behavior library module receives the application information and stores it for establishing a normal access behavior record. Normal access behavior records are continuously updated historical data, which are established according to the target address or service link of application access in the application information, and users can set it according to the actual situation. In one embodiment, it is defined that if a target address that has never been visited appears in a large number of target addresses that are repeatedly accessed, the application information corresponding to the target address is listed in the application abnormal access behavior record; in a large number of target addresses that are repeatedly accessed A target access address with a probability of occurrence of more than 50% is a normal target address; a target access address with a probability of occurrence of less than 20% is an abnormal access address, and its corresponding application information is included in the application abnormal access behavior record; the occurrence probability is 20% -50% of the target access addresses are suspicious target addresses, and the application information corresponding to the suspicious target addresses can pass the access behavior authentication within a certain period of time, and subsequent manual audits or regular system automatic audits can be performed.

S5. Mark the application access request corresponding to the application information that has passed the double authentication using the corresponding application identifier.

In a specific implementation, the application access request corresponding to the application information that has passed the double authentication is marked with the corresponding application identification. Specifically, in one embodiment, if the application information passes the double authentication, the application authentication module generates an application identifier corresponding to the application information that passes the double authentication, and returns the application identifier to the authentication SDK. Further, the authentication SDK caches the application information and the corresponding application identifier after passing the double authentication into a local cache of the authentication SDK.

In one embodiment, after APP2 has passed two-factor authentication, the application authentication module generates the corresponding APPId and returns it to the authentication SDK. The authentication SDK uses the APPId to mark the application access request corresponding to APP2 and caches the application information and application identifier of APP2 to the authentication SDK. SDK's local cache, so that when APP2 visits next time, it will query APP2's application information in the authentication SDK's local cache and use APP2's application ID to mark APP2's application access request.

S6. Send all the application access requests to the network resource module, so that the network resource module judges whether to allow it according to whether the application access request is marked and whether the application is an application configured for pre-directed access.

In a specific implementation, all the application access requests are sent to the network resource module, so that the network resource module judges whether to allow it according to whether the application access request is marked and whether the application is a pre-directed access configuration application . Specifically, the application access requests of APP3 and APP4 that fail to be authenticated but not marked are directly sent to the network resource module, while the marked application access requests of APP1 and APP2 are sent to the network resource module.

In one embodiment, on the basis of retaining the original way for applications to access network resources through directional access configuration, an application access to network resources through marking and authentication is added. Therefore, the network resource module marks and the application Whether it is an application configured for pre-directed access to determine whether to allow it.

In an embodiment, the network resource module includes network elements and Internet services, please refer to FIG. 4 , and the step S6 includes: steps S61-S65.

S61. The network element detects whether all the application access requests are marked.

In a specific implementation, the network element detects whether all the application access requests are marked. Specifically, in an embodiment, the marked application access request is an application access request of an application registered in advance on the IoT platform side.

S62. If the application access request has been marked, release the packet of the application access request to the Internet service.

In a specific implementation, if the application access request has been marked, the packet of the application access request is released to the Internet service. Specifically, in one embodiment, the application access requests of APP1 and APP2 are sent to the network element after processing the above steps to mark the application access request, so the network element releases the application access request messages of APP1 and APP2 to said Internet service.

S63. If the application access request is not marked, determine whether the application is an application configured for pre-directed access.

In a specific implementation, if the application access request is not marked, it is judged whether the application is an application configured for pre-directed access. Specifically, in one embodiment, the registration and authentication of APP3 and APP4 failed, so the application access requests of APP3 and APP4 are processed by the above steps and then sent to the unmarked application access request of the network element, so it is necessary to further determine whether the application Apps configured for pre-directed access.

S64. If the application is configured for pre-directed access, release the application access request packet to the Internet service.

In a specific implementation, if the application is configured for pre-directed access, the packet of the application access request is released to the Internet service. Specifically, in one embodiment, APP3 pre-configures directional access configuration information on the network element, so the network element releases the application access request message of APP3 to the Internet service.

S65, if the application is not an application configured with pre-directed access, block the packet of the application access request.

In a specific implementation, if the application is not a pre-directed access configuration application and the application access request is not marked, the packet of the application access request is blocked from being sent to the Internet service. Specifically, in one embodiment, APP4 does not pre-configure directional access configuration information on the network element and the application access request of APP4 is not marked, then the network element blocks the packet of the application access request to the Internet service.

An embodiment of the present invention provides a method for directional access control of the Internet of Things, the method includes: if the Internet of Things terminal receives an application access request, intercepting the application access request through the authentication SDK and extracting the application information, wherein , the application access request includes at least one access request initiated by the application; judging whether the application exists in the local cache of the authentication SDK according to the application information; if the application is in the local cache of the authentication SDK, Use the application identification corresponding to the application to mark the application access request; if the application does not exist in the local cache of the authentication SDK, send the application information to the Internet of Things platform to enable the The Internet of Things platform performs double authentication, and uses the corresponding application identifier to mark the application access request corresponding to the application information that has passed the double authentication; sends all the application access requests to the network resource module, so that all The network resource module judges whether to allow access according to whether the application access request is marked and whether the application is configured for pre-directed access. On the basis of retaining the directional access configuration to control application access to the network, by setting the application access request through two-factor authentication to be marked and used as the basis for network element release, the time for users to perform directional and repeated configuration is reduced, and at the same time The matching time of network elements improves the efficiency of application data transmission and access.

Fig. 1 is a schematic diagram of an architecture of an Internet of Things directional access management and control system provided by an embodiment of the present invention. As shown in FIG. 1 , corresponding to the above method for managing and controlling directional access to the Internet of Things, the present invention also provides a system for controlling directional access to the Internet of Things. Specifically, referring to Fig. 1, the system includes: an Internet of Things terminal 10, an Internet of Things platform 20 and a network resource module 30, the Internet of Things terminal 10 includes an authentication SDK 12 and an application 11, and the Internet of Things platform 20 includes an application management module 21. An application authentication module 22 and a behavior library module 23. The network resource module 30 includes a network element 31 and an Internet service 32. The Internet of Things terminal 10, the Internet of Things platform 20, and the network resource module 30 communicate with each other to jointly implement the above-mentioned Internet of Things directional access control method.

The IoT terminal 10 is configured to, if the IoT terminal 10 receives an application access request, intercept the application access request through the authentication SDK12 and extract the application information, wherein the application access request includes at least one of the The access request initiated by the application; judge whether the application exists in the local cache of the authentication SDK12 according to the application information; if the application is in the local cache of the authentication SDK12, use the application identification corresponding to the application to The application access request is marked; if the application does not exist in the local cache of the authentication SDK12, the application information is sent to the Internet of Things platform 20 so that the Internet of Things platform 20 performs double authentication, mark the application access request corresponding to the application information that has passed the double authentication with the corresponding application identification; send all the application access requests to the network resource module 30 so that the network resource module 30 can use the corresponding Whether the application access request is marked and whether the application is a pre-directed access configuration application determines whether it is allowed.

In one embodiment, the Internet of Things platform 20 includes an application authentication module 22 and a behavior library module 23; the Internet of Things platform 20 is also used for: the application authentication module 22 is used for the application information received Registration authentication; if the registration authentication is passed, the application authentication module 22 sends the application information to the behavior storehouse module 23 for access behavior authentication; if the behavior authentication is passed, then it is determined that the application information passes double authentication .

In one embodiment, the IoT platform 20 also includes an application management module 21, and the application management module 21 stores the application information registered by the user; the IoT platform 20 is also used for: the application authentication module 22 It is used to compare the application information with the application information registered by the user in the application management module 21; if the comparison is successful, it is determined that the registration authentication is passed; if the comparison is unsuccessful, it is determined that the registration authentication fails.

In one embodiment, normal access behavior records are stored in the behavior library module 23; the behavior library module 23 is used to find whether the application information exists in the normal access behavior records; if the application information exists In the normal access behavior record, it is determined that the access behavior authentication is passed, and if the application information does not exist in the normal access behavior record, it is determined that the access behavior authentication fails.

In an embodiment, the application authentication module 22 is further configured to: if the application information passes the double authentication, the application authentication module 22 is configured to generate an application identifier corresponding to the application information that passes the double authentication, And return the application identification to the authentication SDK.

In an embodiment, the authentication SDK 12 is configured to cache the application information and the corresponding application identifier after passing the double authentication into a local cache of the authentication SDK.

In one embodiment, the network resource module 30 includes a network element 31 and an Internet service 32; wherein the network element 31 is used to detect whether all the application access requests are marked; if the application access request has been marked, then Release the message of the application access request to the Internet service 32; if the application access request is not marked, then judge whether the application is an application with pre-directed access configuration; if the application is an application with pre-directed access configuration, release Pass the packet of the application access request to the Internet service 32; if the application is not a pre-directed access configuration application, then block the packet of the application access request.

In one embodiment, the behavior library module 23 is configured to receive the application information and store it for establishing a normal access behavior record. .

In one embodiment, the IoT platform 20 is further configured to: if the IoT platform 20 receives an application registration request sent by the client, extract the application information in the registration request and store it in the application management module middle; if the IoT platform 20 receives the application-oriented access configuration request sent by the client, extract the application-oriented access configuration information in the application-oriented access configuration request and store it in the network element 31 .

Those of ordinary skill in the art can realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the relationship between hardware and software Interchangeability. In the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are illustrative only. For example, the division of each unit is only a logical function division, and there may be another division method in actual implementation. For example, several units or components may be combined or integrated into another system, or some features may be omitted, or not implemented.

The steps in the methods of the embodiments of the present invention can be adjusted, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of software products, and the computer software products are stored in a storage medium In the above, several instructions are included to make a computer device (which may be a personal computer, a terminal, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, even if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies, the present invention is also intended to include these modifications and variations.

The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person familiar with the technical field can easily think of various equivalents within the technical scope disclosed in the present invention. Modifications or replacements shall all fall within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

A directional access management and control method for the Internet of Things, characterized in that it is applied to a directional access management and control system for the Internet of Things, the directional access management and control system for the Internet of Things includes an Internet of Things terminal, an Internet of Things platform, and a network resource module, and the Internet of Things terminal includes an authentication SDK, cached application information and application identifiers that have been visited in the authentication SDK; the method includes:

If the IoT terminal receives an application access request, the authentication SDK intercepts the application access request and extracts the application information, wherein the application access request includes at least one access request initiated by the application;

judging whether the application exists in the local cache of the authentication SDK according to the application information;

If the application is in the local cache of the authentication SDK, use the application identifier corresponding to the application to mark the application access request;

If the application does not exist in the local cache of the authentication SDK, sending the application information to the IoT platform to enable the IoT platform to perform double authentication;

Marking the application access request corresponding to the application information that has passed the double authentication with the corresponding application identification;

All the application access requests are sent to the network resource module, so that the network resource module judges whether to allow it according to whether the application access request is marked and whether the application is an application configured for pre-directed access.
The Internet of Things directional access control method according to claim 1, wherein the Internet of Things platform includes an application authentication module and a behavior library module; the Internet of Things platform performs dual authentication, including:

The application authentication module performs registration authentication on the received application information;

If the registration authentication passes, the application authentication module sends the application information to the behavior library module for access behavior authentication;

If the behavior authentication passes, it is determined that the application information passes two-factor authentication.
The Internet of Things directional access management and control method according to claim 2, wherein the Internet of Things platform further includes an application management module, and the application management module stores application information registered by users; the application authentication module is responsible for receiving Register and authenticate the application information obtained, including:

The application authentication module compares the application information with the application information registered by the user in the application management module;

If the comparison is successful, it is determined that the registration authentication is passed, and if the comparison is unsuccessful, it is determined that the registration authentication fails.
The Internet of Things directional access control method according to claim 3, wherein the behavior library module stores normal access behavior records; the application authentication module sends the application information to the behavior library module for access Conduct certification, including:

The behavior library module searches whether the application information exists in the normal access behavior record;

If the application information is in the normal access behavior record, it is determined that the access behavior authentication has passed, and if the application information does not exist in the normal access behavior record, it is determined that the access behavior authentication has failed.
The Internet of Things directional access management and control method according to claim 4, characterized in that before marking the application access request corresponding to the application information that has passed the double authentication with the corresponding application identification, the method further includes :

If the application information passes the double authentication, the application authentication module generates an application identifier corresponding to the application information that passes the double authentication, and returns the application identifier to the authentication SDK.
The Internet of Things directional access control method according to claim 5, characterized in that, after marking the application access request corresponding to the application information that has passed the double authentication with a corresponding application identification, it further includes:

The authentication SDK caches the application information and the corresponding application identifier after passing the double authentication into a local cache of the authentication SDK.
The Internet of Things directional access control method according to claim 6, wherein the network resource module includes network elements and Internet services; and sending all the application access requests to the network resource module, so that all The network resource module judges whether to allow access according to whether the application access request is marked and whether the application is configured for pre-directed access, including:

The network element detects whether all the application access requests are marked;

If the application access request has been marked, release the application access request message to the Internet service;

If the application access request is not marked, it is judged whether the application is an application configured for pre-directed access;

If the application is an application configured for pre-directed access, the packet of the application access request is released to the Internet service;

If the application is not a pre-directed access configuration application, the packet of the application access request is blocked.
The Internet of Things directional access control method according to claim 7, wherein the method further comprises:

The behavior library module receives the application information and stores it for establishing a normal access behavior record.
The Internet of Things directional access control method according to claim 8, wherein the method further comprises:

If the IoT platform receives an application registration request sent by the client, extract the application information in the registration request and store it in the application management module;

If the Internet of Things platform receives the application-oriented access configuration request sent by the client, it extracts the application-oriented access configuration information in the application-oriented access configuration request and stores it in the network element.
A directional access control system for the Internet of Things, characterized in that it includes: an Internet of Things terminal, an Internet of Things platform, and a network resource module, the Internet of Things terminal includes an authentication SDK, and the Internet of Things terminal, the Internet of Things platform, and the network resource module communicate with each other to jointly implement the method described in any one of claims 1-9.