WO2023134557A1

WO2023134557A1 - Processing method and apparatus based on industrial internet identifier

Info

Publication number: WO2023134557A1
Application number: PCT/CN2023/070847
Authority: WO
Inventors: 张镇伟
Original assignee: 华为技术有限公司
Priority date: 2022-01-13
Filing date: 2023-01-06
Publication date: 2023-07-20
Also published as: CN116489123A

Abstract

Provided in the embodiments of the present application is a processing method based on an industrial Internet identifier. The method comprises: a first device can send a first message to a second device, wherein the first message is used for applying for an industrial Internet identifier for the first device, and the second device is a network administrator or a network access controller; then, the first device can receive a second message, which is sent by the second device, wherein the second message indicates a result of applying for the industrial Internet identifier for the first device; and after receiving the second message, the first device can write a target industrial Internet identifier into the first device on the basis of the second message. Since a second device is a network administrator or a network access controller, by means of the present solution, there is no need to purchase a private active identifier carrier service platform, and there is no risk of it being impossible to obtain an industrial Internet identifier; and in addition, an enterprise node does not need to manage a very large amount of secure access accounts, and a first device can write a target industrial Internet identifier into the first device.

Description

A processing method and device based on industrial Internet identification

This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office of China on January 13, 2022, with the application number 202210038368.1 and the application name "A Processing Method and Device Based on Industrial Internet Marks", the entire content of which is passed References are incorporated in this application.

technical field

The present application relates to the communication field, and in particular to a processing method and device based on industrial Internet identification.

Background technique

Industrial Internet identifiers refer to identifiers that can uniquely identify physical resources and virtual resources. Physical resources include but are not limited to machines and products, and virtual resources include but not limited to algorithms and processes. The data corresponding to the Industrial Internet logo can be managed in an organized manner through the Industrial Internet logo, so as to realize cross-enterprise, cross-industry, cross-regional, and even cross-country data sharing.

In an example, the industrial Internet identity can be carried by an active identity carrier, and the active identity carrier can embed the industrial Internet identity of the device into the device. The Industrial Internet logo consists of two parts, namely the logo prefix and the logo suffix. An ID prefix is used to identify a unique business principal, and an ID suffix is used to identify a unique resource.

After the enterprise purchases the equipment, it needs to write the industrial Internet logo of the equipment corresponding to the enterprise into the equipment. How to write the device corresponding to the enterprise's industrial Internet logo into the device is a problem that has yet to be solved.

Contents of the invention

The embodiment of this application provides a processing method based on the Industrial Internet ID, which can write the Industrial Internet ID corresponding to the device into the device.

In the first aspect, the embodiment of the present application provides a processing method based on an Industrial Internet ID, which can be executed by a first device, and the first device can correspond to a device that needs to write an Industrial Internet ID. The first device may send a first message to the second device, where the first message is used to apply for an Industrial Internet ID for the first device, where the second device is a network manager or a network admission controller. Then, the first device may receive a second message sent by the second device, where the second message indicates a result of applying for an Industrial Internet ID for the first device. After receiving the second message, the first device may write the target industrial Internet identifier into the first device based on the second message. It is precisely because the second device is a network management or network access controller, so using this solution, there is no need to purchase a private active identification carrier service platform, and there is no risk of being unable to apply for an industrial Internet identification. In addition, enterprise nodes also The first device can write the target industrial Internet identifier into the device without managing a very large number of secure access accounts.

In a possible implementation manner, the first message sent by the first device to the second device may include the target Industrial Internet identifier. For example, the first device may first obtain the target Industrial Internet identifier, then obtain the first message including the target Industrial Internet identifier, and then send the first message to the second device. In this case, the first message is used to request to register the target industrial internet identifier for the first device. In an example, the first device may send the first message including the target Industrial Internet identifier to the second device when it has an initial Industrial Internet identifier.

In a possible implementation manner, when the first device obtains the target industrial Internet identifier, it may first obtain the first prefix during specific implementation, where the first prefix may be, for example, the prefix corresponding to the enterprise that purchased the first device. Then, the first device may obtain the target Industrial Internet identifier based on the first prefix and the initial Industrial Internet identifier of the first device. For example, the prefix in the initial Industrial Internet identifier is replaced with the first prefix, so as to obtain the target Industrial Internet identifier. In an example, the first device may obtain the first prefix from extended information of a Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol, DHCP) option (option). Specifically, the first device may obtain the extended information of the DHCP option when obtaining an Internet Protocol (Internet Protocol, IP) address through a DHCP server, so as to obtain the first prefix.

In a possible implementation manner, the first message carries the initial Industrial Internet identifier of the first device. In this case, the second device may determine the target Industrial Internet identity based on the initial Industrial Internet identity, and request to register the target Industrial Internet identity. In an example, the second device may be pre-configured with a first prefix, and after receiving the first message, the second device may, based on the initial Industrial Internet identifier in the first message and the first prefix , obtain the target Industrial Internet ID, and then request to register the target Industrial Internet ID. After the target Industrial Internet ID is successfully registered, the second device may send a second message carrying the target Industrial Internet ID to the first device.

In a possible implementation manner, the first message is used to request allocation of an industrial Internet identifier for the first device. For example, if the first device does not have an initial Industrial Internet ID, the first device sends to the second device a first message for requesting allocation of an Industrial Internet ID for the first device.

In a possible implementation manner, the second message includes the target Industrial Internet identifier, and after receiving the second message, the first device may parse the second message to obtain the target Industrial Internet ID, so as to further write the target industrial Internet ID into the first device. In an example, the first device does not have an initial Industrial Internet ID, the first device sends a first message to the second device requesting to assign an Industrial Internet ID to the first device, and receives the first message The second message carrying the target Industrial Internet identifier sent by the second device. In yet another example, the first device has an initial Industrial Internet ID, the second device may be pre-configured with a first prefix, and after receiving the first message including the initial Industrial Internet ID, the second device may Based on the initial industrial internet identifier in the first message and the first prefix, a target industrial internet identifier is obtained, and then registration of the target industrial internet identifier is requested. After the target Industrial Internet ID is successfully registered, the second device may send a second message carrying the target Industrial Internet ID to the first device.

In a possible implementation manner, when the second device is a network admission controller, when the first device does not write the target Industrial Internet identifier into the first device, the second device may be the The first device determines the corresponding network access right. In this case, before sending the first message to the second device, the first device may also send a first authentication message to the second device, so as to obtain permission to access the network.

In a possible implementation manner, the first authentication message includes the initial Industrial Internet identifier. Correspondingly, the second device determines the network access right of the first device based on the initial industrial Internet identifier.

In a possible implementation manner, when the second device is a network admission controller, after the first device writes the target Industrial Internet identifier into the first device, the first device may The target Industrial Internet ID performs re-authentication, so as to obtain the network access authority corresponding to the target Industrial Internet ID. In this case, after the first device writes the target industrial Internet identifier into the first device, it can send a second authentication message to the second device, and the second authentication message includes the target industrial Internet Internet identifier, so as to obtain the network access authority corresponding to the target industrial Internet identifier.

In a possible implementation manner, before sending the first message to the second device, the first device may also obtain indication information, where the indication information is used to indicate to apply for an industrial Internet identifier for the first device. After the first device obtains the indication information, it may trigger the operation of applying for an Industrial Internet ID (that is, send the first message) based on the indication information. In this way, the first device can actively trigger the operation of applying for an Industrial Internet ID based on the indication information without manual configuration.

In a possible implementation manner, the indication information may be carried in DHCP option extension information. Specifically, the first device may obtain the extended information of the DHCP option when obtaining the IP address through the DHCP server. Further, the first device can obtain the indication information by parsing the extension information of the DHCP option.

In a possible implementation manner, the first message is an authentication message. In other words, in addition to requesting security authentication, the first message may also be used to apply for an Industrial Internet ID for the first device. In an example, the security authentication of the first device may be divided into two stages, and the authentication message mentioned here may be the authentication message of the first stage.

In a possible implementation, the security authentication of the first device is divided into two stages, and after the first stage of security authentication is passed, the first device can apply to the second device (network admission controller) for a second Stage security authentication information, such as the certificate required for the second stage security authentication. In this case, the second device may include the target Industrial Internet identifier in the security authentication information and send it to the first device. In other words, for this case, the aforementioned second message may be security authentication information carrying the target industrial Internet information. Wherein, the second device may determine the target industrial Internet identifier before carrying the target industrial Internet identifier in the security authentication information and sending it to the first device. There are many ways for the second device to determine the target Industrial Internet ID. In one example, the second device may request the third device (corresponding to the enterprise node) to assign an Industrial Internet ID to the first device, so as to obtain the target Industrial Internet ID; in yet another example, the first message may include an initial Industrial Internet ID, and the second device is configured with a first prefix, then the second device may be based on the initial Industrial Internet ID and the first prefix to obtain the target industrial Internet identifier. Of course, after the second device obtains the target Industrial Internet ID, it also needs to request registration of the target Industrial Internet ID from the third device, and after the target Industrial Internet ID is successfully registered, the target Industrial Internet ID carried in the security authentication information and sent to the first device.

In a second aspect, the embodiment of the present application provides a processing method based on industrial Internet identification, which is applied to a second device, and the second device is a network manager or a network admission controller. The second device may receive the first message sent by the first device, the first message is used to apply for an Industrial Internet ID for the first device, and then the second device sends a second message to the third device, the The second message is used to apply for an Industrial Internet identifier for the first device, and the second message includes device information of the first device. After the second device sends the second message to the third device, it may receive a third message sent by the third device for the second message, and send the third message to the first device. The third message indicates a result of applying for an Industrial Internet ID for the first device. It can be seen that with this solution, since the second device is a network management or network access controller, there is no need to purchase a private active identification carrier service platform, and there is no risk of being unable to apply for an industrial Internet identification. In addition, enterprises The node does not need to manage a very large number of secure access accounts, and the first device can write the target industrial Internet identifier into the device.

In a possible implementation manner, the first message includes the target Industrial Internet identifier.

In a possible implementation manner, the third message includes the target Industrial Internet identifier. After receiving the third message, the first device may parse the third message to obtain the target Industrial Internet identifier, so as to further write the target Industrial Internet identifier into the first device.

In a possible implementation manner, before receiving the first message, the second device may also receive a first authentication message sent by the first device, and determine the first authentication message according to the first authentication message 1st network access for .

In a possible implementation manner, after the second device sends the third message to the first device, the second device may also receive a second authentication message sent by the first device, and the second authentication message Including the target Industrial Internet identifier, and determining the second network access right of the first device according to the second authentication message.

In a possible implementation manner, the first message carries the initial Industrial Internet identifier of the first device.

In a possible implementation manner, the first message is an authentication message.

In a possible implementation manner, if the first device does not have an initial Industrial Internet ID, then the first device may send a first message to the second device to request the allocation of an Industrial Internet ID for the first device, The second device may process the first message, for example, add the device information of the first device to the first message to obtain a second message, and the second message is used to request the allocation of an industrial Internet identifier for the first device .

In a possible implementation manner, the first device has an initial Industrial Internet ID, and the second device can obtain a second message including the target Industrial Internet ID based on the first message, and send the second message to Send it to the third device, thereby requesting the third device to register the target industrial Internet identifier for the first device.

In a possible implementation manner, before sending the second message to the third device, the second device may obtain the second message including the target industrial Internet identifier based on the first message. Wherein, the second message including the target Industrial Internet identifier is obtained based on the first message. During specific implementation, the second device may obtain the pre-configured first prefix and the device information of the first device, and based on the The first prefix and the initial Industrial Internet ID obtain the target Industrial Internet ID, and then, based on the target Industrial Internet ID and the device information, obtain the second IP address including the device information and the target Industrial Internet ID. information.

In the third aspect, the embodiment of the present application provides a processing device based on industrial Internet identification, which is applied to the first device, and the device includes: a sending unit, configured to send a first message to the second device, and the first message It is used to apply for an industrial Internet identifier for the first device, and the second device is a network manager or a network admission controller; a receiving unit is used to receive a second message sent by the second device, and the second message indicates A result of applying for an Industrial Internet ID for the first device; a processing unit configured to write a target Industrial Internet ID into the first device based on the second message.

In a possible implementation manner, the sending unit is configured to: send a first message carrying the target industrial Internet identifier to the second device, where the first message is used to request registration of the target industrial Internet Internet logo.

In a possible implementation manner, the processing unit is further configured to: obtain the first prefix in the extended information of the DHCP option option of the Dynamic Host Configuration Protocol; Internet identifier, to obtain the target industrial Internet identifier.

In a possible implementation manner, the first message is used to request allocation of an industrial internet identifier for the first device.

In a possible implementation manner, the second message includes the target Industrial Internet identifier.

In a possible implementation manner, the sending unit is further configured to: before sending the first message, send a first authentication message to the second device, so as to obtain a network access permission.

In a possible implementation manner, the first authentication message includes the initial Industrial Internet identifier.

In a possible implementation manner, the sending unit is further configured to: send a second authentication message to the second device, where the second authentication message includes the target industrial Internet identifier.

In a possible implementation manner, the processing unit is further configured to: acquire indication information, where the indication information is used to instruct to apply for an industrial Internet identifier for the first device.

In a possible implementation manner, the indication information is carried in DHCP option extension information.

In a possible implementation manner, the receiving unit is configured to: receive security authentication information sent by the network admission controller, where the security authentication information includes the target industrial Internet identifier.

In a fourth aspect, the embodiment of the present application provides a processing device based on industrial Internet identification, which is applied to a second device, the second device is a network manager or a network admission controller, and the device includes: a receiving unit configured to receiving a first message sent by the first device, the first message is used to apply for an Industrial Internet ID for the first device; a sending unit is used to send the second message to a third device, and the second message uses For applying for an Industrial Internet ID for the first device, the second message includes device information of the first device; the receiving unit is further configured to receive a third message, the third message indicates that the first device is A result of a device applying for an Industrial Internet ID; the sending unit is further configured to send the third message to the first device.

In a possible implementation manner, the third message includes the target Industrial Internet identifier.

In a possible implementation manner, the receiving unit is further configured to: receive a first authentication message sent by the first device before receiving the first message; the apparatus further includes a processing unit configured to Determine the first network access right of the first device according to the first authentication message.

In a possible implementation manner, the receiving unit is further configured to receive a second authentication message sent by the first device, where the second authentication message includes the target Industrial Internet identifier; the device includes The processing unit is configured to determine the second network access right of the first device according to the second authentication message.

In a possible implementation manner, the first message includes an initial Industrial Internet identifier of the first device.

In a possible implementation manner, the second message is used to request to assign an industrial internet identifier to the first device.

In a possible implementation manner, the second message is used to request to register the target industrial internet identifier for the first device.

In a possible implementation manner, the second message is obtained based on the following methods: obtaining a pre-configured first prefix and the device information of the first device; based on the first prefix and the initial Industrial Internet identifier , to obtain the target Industrial Internet ID; based on the target Industrial Internet ID and the device information, obtain a second message including the device information and the target Industrial Internet ID, and the second message is used to request for the The first device registers the target industrial Internet identifier.

In the fifth aspect, the embodiment of the present application provides a processing system based on Industrial Internet identification, the system includes a first device and a second device; the first device is used to send a first message to the second device, and the The first message is used to apply for an Industrial Internet ID for the first device, and the second device is a network manager or network admission controller; the second device sends a second message to the first device, and the second The message indicates the result of applying for the Industrial Internet ID for the first device; the first device writes the target Industrial Internet ID into the first device according to the second message.

In a possible implementation manner, the second message is security authentication information including the target Internet identifier.

In a sixth aspect, the embodiment of the present application provides a device. The device includes a processor and memory. The memory is used to store instructions or computer programs. The processor is configured to execute the instructions or computer programs in the memory, execute the method described in any one of the above first aspects, or execute the method described in any one of the above second aspects.

In the seventh aspect, the embodiment of the present application provides a computer-readable storage medium, including instructions or computer programs, which, when run on a computer, cause the computer to perform the method described in any one of the above first aspects, or to perform the above The method according to any one of the second aspect.

In the eighth aspect, the embodiments of the present application provide a computer program product including instructions or computer programs, which, when run on a computer, cause the computer to execute the method described in any one of the above first aspects, or to execute the above second aspect. The method described in any one of the aspects.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments described in this application. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Figure 1 is a schematic diagram of an Industrial Internet logo;

FIG. 2 is a schematic diagram of an exemplary application scenario provided by an embodiment of the present application;

FIG. 3 is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application;

FIG. 4 is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application;

FIG. 5 is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application;

FIG. 6 is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application;

Fig. 7 is a schematic flowchart of a processing method based on industrial Internet identification provided by the embodiment of the present application;

FIG. 8 is a schematic flowchart of another processing method based on industrial Internet identification provided by the embodiment of the present application;

FIG. 9 is a schematic structural diagram of a processing device based on industrial Internet identification provided by an embodiment of the present application;

Fig. 10 is a schematic structural diagram of another processing device based on industrial Internet identification provided by the embodiment of the present application;

FIG. 11 is a schematic structural diagram of a device provided by an embodiment of the present application.

Detailed ways

The embodiment of the present application provides a processing method based on the Industrial Internet ID, which can write the Industrial Internet ID corresponding to the enterprise into the device after the enterprise purchases the device.

For the convenience of understanding, first introduce the relevant content of the Industrial Internet logo.

See Figure 1, which is a schematic diagram of an Industrial Internet logo. As shown in Figure 1, the Industrial Internet logo includes a logo prefix and a logo suffix, and the logo prefix can reflect a unique corporate entity. An identification suffix is used to identify a unique resource (such as a device). Among them: the identification prefix can include multiple levels, as shown in Figure 1, the A in the identification prefix is used to identify the country, the A.B in the identification prefix is used to identify the B region of the country A, and the entire identification prefix A.B.C is used to identify a specific An enterprise (that is, an enterprise located in region B in country A). The identification suffix block_data is used to identify unique resources.

After the enterprise purchases the equipment, it needs to write the industrial Internet logo of the equipment corresponding to the enterprise into the equipment.

In one scenario, the device does not have an Industrial Internet logo. At this time, the company that purchased the device needs to assign its own Industrial Internet logo to it.

In another scenario, the device has an initial Industrial Internet ID, and the initial Industrial Internet ID may be the Industrial Internet ID corresponding to the enterprise that produced the device. In this case, the company that purchased the device needs to replace the logo prefix in the initial Industrial Internet logo with the company's logo prefix to form the device corresponding to the company's Industrial Internet logo. For example, the identification prefix corresponding to equipment manufacturer A is: 88.103.1, and the industrial Internet identification is written for the equipment when it leaves the factory; then the equipment is purchased by enterprise B, and the identification prefix corresponding to enterprise B is: 88.103.2. After the device is purchased by enterprise B, the identification prefix in its Industrial Internet identification needs to be changed to 88.103.2.

In addition to writing the device corresponding to the company's Industrial Internet ID into the device, the enterprise node can also store the device information of the device and the device's Industrial Internet ID in the company. The enterprise nodes mentioned here refer to the nodes used by enterprises to deal with matters related to the Industrial Internet.

In one example, an enterprise that manufactures equipment can develop its own private active identification carrier service platform. After purchasing the equipment, the enterprise that purchases the equipment can also purchase the active identification carrier service platform developed by the equipment manufacturing enterprise, so as to use the active identification The carrier service platform writes the industrial Internet logo corresponding to the enterprise into the device.

However, for a certain enterprise, it can purchase equipment manufactured by multiple enterprises. If the above solution is adopted, it needs to purchase the active identification carrier service platform developed by the above-mentioned multiple enterprises, and the cost is high. Therefore, the feasibility of this scheme is not very high.

In yet another example, the active identification carrier may directly apply for an industrial Internet identification from the enterprise node that purchased the device. However, this approach also has certain drawbacks:

First, under normal circumstances, the enterprise node that purchases the device will assign an accessible account password or access token to each connected device (such as a terminal, corresponding to an active identification carrier). When a large number of terminals need to communicate with the When the enterprise nodes are connected, the account management for secure access will become very large and difficult to maintain.

Second, enterprise nodes are usually deployed in the cloud (public cloud or private cloud). For industrial data security considerations, industrial network devices may be restricted from directly accessing external services. Therefore, the active identification carrier may not be able to directly access the aforementioned enterprise nodes, resulting in the inability to apply for an industrial Internet identification.

Third, the active identification carrier cannot automatically know when to apply for an industrial Internet identification from the enterprise node that purchased the device, and manual configuration is required.

Therefore, the feasibility of this scheme is not very high.

In view of this, the embodiment of this application provides a processing method based on industrial Internet identification, which does not need to purchase a private active identification carrier service platform, and there is no risk of being unable to apply for an industrial Internet identification. In addition, enterprise nodes do not need to be managed A very large account for secure access.

The processing method based on the industrial Internet identification provided by the embodiment of this application can be applied to the scenario shown in FIG. 2 . Fig. 2 is a schematic diagram of an exemplary application scenario provided by the embodiment of the present application.

In the scenario shown in FIG. 2 , for a device 100 that needs to write an Industrial Internet ID into itself, it can apply for an Industrial Internet ID from the enterprise node 300 through the ID proxy 200 . Wherein, the identification agent 200 may run in a necessary network administrator or network admission controller of the enterprise network to which the enterprise node 300 belongs. On the one hand, since the identification agent 200 runs in the necessary network management or network admission controller of the enterprise network, the network investment can be reduced. In addition, it can also avoid network security problems that may be caused by direct external interaction of enterprise nodes, and can also greatly simplify the management scale of enterprise nodes 300 for devices that need to apply for industrial Internet identification.

Next, the processing method based on the industrial Internet identification provided by the embodiment of the present application is introduced with reference to the accompanying drawings.

First, when the active identification device has an initial industrial Internet identification, the processing method based on the industrial Internet identification provided by the embodiment of this application is introduced.

Referring to FIG. 3 , this figure is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application. in:

The active identification device is a device that needs to write the industrial Internet identification into itself, and the active identification device may be, for example, the device 100 shown in FIG. 2 . The identification proxy server is a device that runs the identification proxy. The identification proxy may be the identification proxy 200 described in FIG. 2 , and the identification proxy server may be a network manager or a network admission controller. The identifier resolution node is an identifier resolution node of an enterprise, and the identifier resolution node may be, for example, the enterprise node 300 shown in FIG. 2 . A DHCP server can assign an IP address to an actively identified device.

The method 100 shown in FIG. 3 can be applied to a scenario where the active identification device has an initial industrial Internet identification.

The method 100 may include, for example, the following S101-S109.

S101: The active identification device obtains a DHCP option through a DHCP server, the DHCP option includes an IP address, and the extended information of the DHCP option includes a prefix 1 and an address of an identification proxy server.

Wherein, the prefix 1 is a prefix corresponding to the enterprise to which the identification resolution node belongs.

In an example, the extended information of the DHCP option further includes indication information, and the indication information is used to instruct the active identification device to apply for an industrial Internet identification. Since the extended information includes indication information, the active identification device can apply for an industrial Internet identification based on the indication information without manual configuration.

In an example, the information included in the extended information of the DHCP option may be pre-configured on the DHCP server.

S102: The active identification device obtains the target Industrial Internet identification based on the initial Industrial Internet identification and the prefix 1.

The active identification device may replace the prefix in the initial industrial Internet identification with the prefix 1, so as to obtain the target industrial Internet identification.

S103: The active identification device sends a message 1 to the identification proxy server, where the message 1 includes the target Industrial Internet ID, and the message 1 is used to request registration of the target Industrial Internet ID.

After the active identification device obtains the target industrial Internet identification, it can obtain message 1 based on the target industrial Internet identification, and then send the message 1 to the address of the identification proxy server included in the extension information of the DHCP option. The above identifies the proxy server.

S104: The identification proxy server obtains message 2 according to message 1, wherein message 2 includes the target industrial Internet identification and device information of the active identification device.

In an example, the device information of the active identification device may be configured on the identification proxy server in advance by an administrator. In yet another example, when the identification proxy server is a network administrator, the network administrator already has the device information of the active identification device.

The device information of the active identification device may include, for example, a media access control (media access control, MAC) address of the active identification device, a name of the active identification device, an initial industrial Internet identification of the active identification device, etc. , not listed here.

S105: The ID proxy server sends message 2 to the ID resolution node, so as to apply for registration of the target industrial Internet ID with the ID resolution node.

S106: The identity resolution node verifies the target industrial Internet identity.

After the identifier parsing node receives the message 2, it can parse the message 2 to obtain the target industrial Internet identifier included in the message 2. Then, verify the target Industrial Internet ID. In an example, the identity resolution node may determine that the target Industrial Internet identity has passed the verification when the target Industrial Internet identity has not been registered.

S107: The identity resolution node sends a message 3 to the identity proxy server when the target industrial Internet identity passes the verification, and the message 3 is used to indicate that the registration of the target industrial Internet identity is successful.

In addition, the identity resolution node may also save the correspondence between the target industrial Internet identity and the device information of the actively-identified device when the target industrial Internet identity passes the verification.

S108: The identification proxy server sends message 3 to the active identification device.

S109: Based on the message 3, the active identification device writes the target industrial Internet identification into the active identification device.

After the active identification device receives the message 3, it may determine that the registration of the target industrial Internet identification is successful. Therefore, the active identification device can write the target industrial Internet identification into the active identification device.

From the above description, it can be seen that for an active identification device with an initial Industrial Internet identification, it can determine the prefix 1 and the address of the identification proxy server applying for the Industrial Internet identification while obtaining the IP address, so as to use the prefix 1 to obtain the target Industrial Internet ID, and apply for registration of the target Industrial Internet ID through the ID proxy server.

In the above method 100, the active identification device obtains the target Industrial Internet ID based on the prefix 1 and the initial Industrial Internet ID, and sends message 1 including the target Industrial Internet ID to the ID proxy server. However, in another example, the message 1 may include an initial industrial Internet identifier. Correspondingly, the identification proxy server can be configured with a prefix 1, and the identification proxy server can obtain the target industrial Internet identification based on the initial industrial Internet identification and prefix 1 included in the message 1, and then, the identification proxy server can be based on the target The Industrial Internet ID and the device information of the actively identified device obtain the aforementioned message 2, and further execute S105 and subsequent steps.

In an example, when the identification proxy server in method 100 is a network admission controller, method 100 may also be combined with a network access control (network access control, NAC) solution. Specifically: when the active identification device does not update the initial Industrial Internet identification to the target Industrial Internet identification, determine the network access authority of the active identification device based on the initial Industrial Internet identification. After the active identification device updates the initial Industrial Internet identification to the target Industrial Internet identification, re-authentication is performed based on the target Industrial Internet identification, so as to obtain the network access authority corresponding to the target Industrial Internet identification.

In an example, a prefix-based authentication and authorization policy may be pre-configured on the network admission controller. For example, configure network authority 1 for prefixes not intended for the enterprise, and configure network authority 2 for prefixes aimed at the enterprise, where network resources accessible by network authority 1 are less than network resources accessible by network authority 2.

For this case, before S101, the active identification device may send an authentication message 1 to the network admission controller, where the authentication message 1 includes an initial industrial Internet identification. As an example, the active identification device may send the authentication message 1 to a network authentication device, and the network authentication device forwards the authentication message 1 to a network admission controller. The network admission controller determines the network authority 1 based on the initial industrial Internet identification in the authentication message 1, and sends the network authority 1 to the network authentication device, so that the active identification device obtains the network authority 1. in:

The authentication message 1 may be a message based on MAC authentication, or a message based on 802.1X authentication. The authentication message 1 can be obtained by extending an existing protocol message, for example, by extending an existing protocol message, the extended type length value (type length value, TLV) field is used to carry the initial Industrial Internet logo. Among them, the existing protocol packets include but are not limited to Link Layer Discovery Protocol (LLDP) packets, Extensible Authentication Protocol (EAP) packets, 802.11 association protocol packets, etc. etc., not listed here.

After S107, the identification proxy server may send a re-authentication message to the network authentication device. Correspondingly, after S109, the active identification device may send an authentication message 2 carrying the target Industrial Internet identifier to the network authentication device, and the network authentication device sends the authentication message 2 to the network based on the re-authentication message Admission controller. The network admission controller determines the network authority 2 based on the target industrial Internet identifier in the authentication message 2, and sends the network authority 2 to the network authentication device, so that the active identification device obtains the network authority 2. in:

Similar to the authentication message 1, the authentication message 2 may be a message based on MAC authentication, or a message based on 802.1X authentication. The authentication message 2 can be obtained by extending an existing protocol packet, for example, extending an existing protocol packet, and the extended TLV field is used to carry the target industrial Internet identifier. Wherein, the existing protocol packets include but not limited to LLDP packets, EAP packets, 802.11 associated protocol packets, etc., which are not listed here for description.

Referring to FIG. 4 , this figure is a signaling interaction diagram of another industrial Internet identification-based processing method provided by the embodiment of the present application. in:

The active identification device is a device that needs to write the industrial Internet identification into itself, and the active identification device may be, for example, the device 100 shown in FIG. 2 . The network admission controller is a device that runs an identification agent, and the identification agent may be the identification agent 200 described in FIG. 2 . The identifier resolution node is an identifier resolution node of an enterprise, and the identifier resolution node may be, for example, the enterprise node 300 shown in FIG. 2 .

The method 200 shown in FIG. 4 may also be applied to a scenario where the active identification device has an initial industrial Internet identification.

The method 200 may include, for example, the following S201-S211.

S201: The active identification device sends an authentication message 3 to the network admission controller, where the authentication message 3 includes the initial industrial Internet identification of the active identification device.

In an example, accessing the network by an active identification device may include two-stage authentication, and the authentication message 3 is used to perform the first-stage authentication, and the authentication message 3 may include device information of the active identification device. In an example, the authentication at the first stage may be authentication with weak security such as MAC authentication. As for the authentication message 3, it is similar to the authentication message 1. For the authentication message 3, reference may be made to the foregoing description of the authentication message 1, and details are not described here.

Regarding the device information of the active identification device, reference may be made to the above description, and the description will not be repeated here.

In an example, the authentication at the first stage may be handled by a network admission controller. In this case, the network admission controller may authenticate the active identification device based on the authentication message 3 . In yet another example, the first stage of certification may be manually approved. In this case, the administrator may approve the active identification device.

S202: If the network admission controller determines that the active identification device has passed the authentication, based on the initial industrial Internet identification and prefix 1, obtain a target industrial Internet identification.

If the authentication at the first stage can be processed by the network admission controller, the network admission controller can obtain a corresponding authentication result after authenticating the active identification device based on the authentication message 3 . If the authentication in the first stage is manually approved, the network admission controller may obtain the authentication result input by the user.

In an example, the prefix 1 may be pre-configured on the network admission controller. After the network admission controller receives the authentication message 3 including the initial Industrial Internet ID, it can obtain the target Industrial Internet ID based on the initial Industrial Internet ID and prefix 1.

S203: The network admission controller generates a message 4, the message 4 includes the target industrial Internet identity and the device information of the active identification device, and the message 4 is used to request registration of the target industrial Internet identity.

S204: The network admission controller sends message 4 to the identity resolution node, so as to apply to the identity resolution node for registration of the target industrial Internet identity.

S205: The identity resolution node verifies the target industrial Internet identity.

S206: The identity resolution node sends a message 5 to the network admission controller when the target industrial Internet identity passes the verification, and the message 5 is used to indicate that the registration of the target industrial Internet identity is successful.

Regarding S204-S206, its specific implementation is the same as that of S105-S107, and the identification proxy server in S105-S107 is equivalent to the network admission controller in S204-S206. For the specific implementation of S204-S206, reference may be made to the description of S105-S107, which will not be repeated here.

S207: The network admission controller sends a message 6 to the network authentication device, where the message 6 is used to indicate that the authentication of the active identification device is successful.

It should be noted that, when the network admission controller determines that the active identification device has passed the authentication, it can execute the "obtain the target industrial Internet identification based on the initial industrial Internet identification and prefix 1" in S202 and the subsequent S203- S207. In an example, S207 may be performed before the "obtain the target Industrial Internet ID based on the initial Industrial Internet ID and prefix 1" in S202 is executed, it may also be performed between S202-S206, and it may also be performed with the step in S202 "Get the target industrial internet identifier based on the initial industrial internet identifier and prefix 1" is executed at the same time, which is not specifically limited in this embodiment of the present application.

S208: After the active identification device obtains the IP address, it sends a message 7 to the network admission controller, where the message 7 is used to request security authentication information.

in:

The actively identified device can obtain an IP address through the DHCP server.

The security authentication information is information required for the active identification device to perform the second-stage security authentication. When the second-stage security authentication is 802.1X authentication, the security authentication information may include an 802.1X authentication certificate. Of course, the security authentication information may also include other information, which will not be listed here.

S209: The network admission controller sends the security authentication information including the target Industrial Internet ID to the active ID device.

After the network admission controller receives the message 5, it can determine that the registration of the target industrial Internet identifier is successful. Therefore, after receiving the message 7, the network admission controller may obtain the target industrial Internet identifier, and send the security authentication information including the target industrial Internet identifier to the active identification device.

S210: The active identification device writes the target industrial Internet identification into the active identification device.

After the active identification device receives the security authentication information, it can analyze the security authentication information to obtain the target industrial Internet identifier, and then write the target industrial Internet identifier into the active identification device.

S211: The active identification device sends an authentication message 4 to the network admission controller, where the authentication message 4 includes the security authentication information.

In an example, the authentication message 4 may be an authentication message corresponding to 802.1X authentication. After receiving the authentication message 4, the network admission controller may perform security authentication on the active identification device based on the security authentication information in the authentication message 4.

It can be seen from the above description that using the method 200, the security authentication of the active identification terminal can be divided into two stages of authentication. For the active identification device with the initial industrial Internet identification, it can be successfully authenticated in the first stage and obtain the second authentication. When applying for the security certification information required for phase certification, the target Industrial Internet logo is obtained.

Next, when the active identification device does not have the initial Industrial Internet identification, the processing method based on the Industrial Internet identification provided by the embodiment of this application is introduced.

Referring to FIG. 5 , this figure is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application. in:

Regarding the active identification device, the identification proxy server, and the identification resolution node, reference may be made to relevant descriptions in the method 100, and repeated descriptions are not repeated here.

The method 300 shown in FIG. 5 can be applied to a scenario where the active identification device does not have an initial industrial Internet identification.

The method 300 may include, for example, the following S301-S308.

S301: The active identification device obtains a DHCP option through a DHCP server, the DHCP option includes an IP address, and the extended information of the DHCP option includes an address of an identification proxy server.

In an example, the extended information of the DHCP option further includes indication information, and the indication information is used to instruct the active identification device to apply for an industrial Internet identification.

S302: The active identification device sends a message 1' to the identification proxy server, and the message 1' is used to request allocation of an industrial Internet identification.

S303: The identification proxy server obtains message 2' according to message 1', wherein message 2' includes the device information of the active identification device.

After receiving the message 1', the identification proxy server can obtain the message 2' based on the message 1' and the device information of the active identification device. For example, the identification proxy server may add the device information to the message 1' to obtain the message 2'.

S304: The identification proxy server sends the message 2' to the identification resolution node, so as to request the identification resolution node to allocate an industrial Internet identification for the active identification device.

S305: The identity resolution node determines the target industrial Internet identity as the industrial Internet identity allocated to the active identity device.

The identification resolution node can obtain the target industrial Internet identification according to certain rules, for example, randomly generate an identification suffix, and if the randomly generated identification suffix is not used, based on the identification suffix and the corresponding identification prefix of the enterprise , to obtain the target Industrial Internet ID.

S306: The identity resolution node sends the message 3' carrying the target industrial Internet identity to the identity proxy server.

S307: The identification proxy server sends the message 3' to the active identification device.

S308: The active identification device writes the target industrial Internet identification into the active identification device based on the message 3'.

After the active identification device receives the message 3', it can analyze the message 3' to obtain the target industrial Internet identification included in the message 3', so as to write the target industrial Internet identification into the active identification device.

From the above description, it can be seen that for an active identification device that does not have an initial Industrial Internet identification, it can determine the address of the identification proxy server that previously applied for an Industrial Internet identification based on the extended information of the DHCP option while obtaining an IP address , so as to request to assign an Industrial Internet ID to itself through the ID proxy server.

In an example, when the identification proxy server in method 300 is a network admission controller, method 300 may also be combined with a NAC solution. Specifically: when the active identification device does not have an industrial Internet identification, determine the corresponding network access authority for the active identification device. After the active identification device obtains the target Industrial Internet ID, re-authentication is performed based on the target Industrial Internet ID, so as to obtain the network access authority corresponding to the target Industrial Internet ID.

In an example, a prefix-based authentication and authorization policy may be pre-configured on the network admission controller. For example, configure network authority 1 for no prefix, and configure network authority 2 for the enterprise-specific prefix. The network resources accessible by network authority 1 are less than those accessible by network authority 2.

For this case, before S301, the active identification device may send an authentication message 1' to the network admission controller, and the authentication message 1' does not include the industrial Internet identification. As an example, the active identification device may send the authentication message 1' to the network authentication device, and the network authentication device sends the authentication message 1' to the network admission controller. The network admission controller determines the network authority 1 based on the authentication message 1', and sends the network authority 1 to the network authentication device, so that the active identification device obtains the network authority 1. in:

Similar to the authentication message 1, the authentication message 1' can also be a message based on MAC authentication, or a message based on 802.1X authentication. The authentication message 1' may be an existing protocol message. Among them, the existing protocol packets include but are not limited to Link Layer Discovery Protocol (LLDP) packets, Extensible Authentication Protocol (EAP) packets, 802.11 association protocol packets, etc. Etc., not enumerating and explaining one by one here.

After S306, the identification proxy server may send a re-authentication message to the network authentication device. Correspondingly, after S308, the active identification device may send an authentication message 2' carrying the target Industrial Internet identifier to the network authentication device, and the network authentication device sends the authentication message 2' to the network authentication device based on the re-authentication message. The network admission controller described above. The network admission controller determines the network authority 2 based on the target industrial Internet identifier in the authentication message 2', and sends the network authority 2 to the network authentication device, so that the active identification device obtains the network authority 2 . in:

Similar to the authentication message 1', the authentication message 2' may be a message based on MAC authentication, or a message based on 802.1X authentication. , which will not be repeated here.

Referring to FIG. 6 , this figure is a signaling interaction diagram of another industrial Internet identification-based processing method provided by the embodiment of the present application. in:

Regarding the active identification device, the network admission controller and the identification resolution node, reference may be made to the description of the method 200 above, and the description will not be repeated here.

The method 400 shown in FIG. 6 may also be applied to a scenario where the active identification device does not have an initial industrial Internet identification.

The method 400 may include, for example, the following S401-S410.

S401: The active identification device sends an authentication message 3' to the network admission controller.

In an example, actively identifying the device to access the network may include two stages of authentication, the authentication message 3' is used to perform the first stage of authentication, and the authentication message 3' may include the device of the actively identifying device information. In an example, the authentication at the first stage may be authentication with weak security such as MAC authentication. As for the authentication message 3', it is similar to the authentication message 1'. For the authentication message 3', reference may be made to the description of the authentication message 1' above, and details will not be described here.

In an example, the authentication at the first stage may be handled by a network admission controller, and in this case, the network admission controller may authenticate the active identification device based on the authentication message 3'. In yet another example, the first stage of certification may be manually approved. In this case, the administrator may approve the active identification device.

S402: When the network admission controller determines that the active identification device has passed the authentication, generate a message 4', the message 4' includes the device information of the active identification device, and the message 4' is used to request for the active identification The device is assigned an Industrial Internet ID.

If the authentication at the first stage can be processed by the network admission controller, the network admission controller can obtain a corresponding authentication result after authenticating the active identification device based on the authentication message 3'. If the authentication at the first stage is manually approved, the network admission controller can obtain the authentication result input by the user.

S403: The network admission controller sends a message 4' to the identity resolution node, so as to request the identity resolution node to allocate an industrial Internet identity for the active identity device.

S404: The identity resolution node determines the target industrial Internet identity as the industrial Internet identity assigned to the active identity device based on the message 4'.

Regarding the specific implementation of the identification resolution node determining the target Industrial Internet ID as the Industrial Internet ID assigned to the active identification device, reference may be made to relevant descriptions in S305, and repeated descriptions are not repeated here.

The identifier resolution node may also store the correspondence between the target industrial Internet identifier and the device information of the active identifier device.

S405: The identifier resolution node sends a message 5' to the network admission controller, and the message 5' carries the target industrial Internet identifier.

After the network admission controller receives the message 5', it can save the target industrial Internet identifier. As an example, the network admission controller may save the correspondence between the target industrial Internet identifier and the identifier of the active identifier device. Wherein, the identifier of the active identification device may be, for example, the MAC address of the active identification device. S406: The network admission controller sends a message 6' to the network authentication device, where the message 6' is used to indicate that the authentication of the active identification device is successful.

S407: After the active identification device obtains the IP address, it sends a message 7' to the network admission controller, where the message 7' is used to request security authentication information.

in:

Said message 7' includes the identification of said active identification device.

S408: The network admission controller sends security authentication information including the target Industrial Internet ID to the active ID device. After receiving the message 7', the network admission controller may search for the correspondence between the aforementioned target industrial Internet identifier and the identifier of the active identifier device based on the identifier of the active identifier device in the message 7' relationship, so as to obtain the target industrial Internet identity, and then send the security authentication information including the target industrial Internet identity to the active identification device.

S409: The active identification device writes the target industrial Internet identification into the active identification device.

S410: The active identification device sends an authentication message 4' to the network admission controller, where the authentication message 4' includes the security authentication information.

In an example, the authentication message 4' may be an authentication message corresponding to 802.1X authentication. After receiving the authentication message 4', the network admission controller may perform security authentication on the active identification device based on the security authentication information in the authentication message 4'.

From the above description, it can be seen that using method 400, the security authentication of the active identification terminal can be divided into two stages of authentication. When applying for the security certification information required by the second-stage certification, the target industrial Internet logo is obtained.

Referring to FIG. 7 , this figure is a schematic flowchart of a processing method based on industrial Internet identification provided by an embodiment of the present application.

The first device is a device that needs to write the industrial Internet identifier into itself, and the first device may be, for example, the device 100 shown in FIG. 2 . The second device is a device running an identification agent. The identification agent may be the identification agent 200 described in FIG. 2 , and the second device may be a network manager or a network admission controller.

The method shown in FIG. 7 can be applied to the method 100 , method 200 , method 300 and method 400 provided in the above embodiments. The method 500 shown in FIG. 7 may include, for example, the following S501-S503.

S501: The first device sends a first message to a second device, where the first message is used to apply for an Industrial Internet ID for the first device, and the second device is a network manager or a network admission controller.

S502: The first device receives a second message sent by the second device, where the second message indicates a result of applying for an Industrial Internet ID for the first device.

S503: The first device writes the target Industrial Internet identifier into the first device based on the second message.

When the method 500 is applied to the above method 100, the first device corresponds to the active identification device in the method 100; the second device corresponds to the identification proxy server in the method 100. The first message corresponds to message 1 in method 100 ; the second message corresponds to message 3 in method 100 .

When the method 500 is applied to the above method 200, the first device corresponds to the active identification device in the method 200; the second device corresponds to the network admission server in the method 200. The first message corresponds to the authentication message 3 in the method 200; the second message corresponds to the security authentication information in the method 200.

When the method 500 is applied to the above method 300, the first device corresponds to the active identification device in the method 300; the second device corresponds to the identification proxy server in the method 300. The first message corresponds to message 1' in method 100; the second message corresponds to message 3' in method 100.

When the method 500 is applied to the above method 400, the first device corresponds to the active identification device in the method 400; the second device corresponds to the network admission server in the method 400. The first message corresponds to the authentication message 3' in the method 400; the second message corresponds to the security authentication information in the method 400.

In a possible implementation manner, the sending the first message to the second device includes:

Sending a first message carrying the target Industrial Internet identifier to the second device, where the first message is used to request registration of the target Industrial Internet identifier.

In a possible implementation, the method further includes:

Obtain the first prefix in the extended information of the Dynamic Host Configuration Protocol DHCP option option;

Obtain the target Industrial Internet identifier according to the first prefix and the initial Industrial Internet identifier of the first device.

In a possible implementation manner, before sending the first message, the method further includes:

Send a first authentication message to the second device, so as to obtain permission to access the network.

The first authentication message in method 500 may correspond to authentication message 1 in the above embodiment, or may correspond to authentication message 1' in the above embodiment.

In a possible implementation, the method further includes:

Sending a second authentication message to the second device, where the second authentication message includes the target Industrial Internet identifier.

The second authentication message in method 500 may correspond to authentication message 2 in the above embodiment, or may correspond to authentication message 2' in the above embodiment.

In a possible implementation, the method further includes:

Obtain instruction information, where the instruction information is used to instruct to apply for an Industrial Internet ID for the first device.

The indication information in method 500 may be the indication information mentioned in method 100 or the indication information mentioned in method 300 .

In a possible implementation manner, the first message is an authentication message. The authentication message mentioned here may correspond to the authentication message 3 in the method 200, and may also correspond to the authentication message 3' in the method 400.

In a possible implementation manner, the receiving the second message sent by the second device includes:

Receive security authentication information sent by the network admission controller, where the security authentication information includes the target industrial Internet identifier. The security authentication information mentioned here may correspond to the security authentication information in method 200 , and may also correspond to the security authentication information in method 400 .

Regarding the specific implementation of the method 500, reference may be made to the relevant descriptions of the method 100, the method 200, the method 300, and the method 400 above, and details are not described here.

Referring to FIG. 8 , this figure is a schematic flow chart of another industrial Internet identification-based processing method provided by the embodiment of the present application.

The method shown in FIG. 8 may be applied to the method 100 and the method 300 provided in the above embodiments. The method 600 shown in FIG. 8 may include, for example, the following S601-S604.

S601: The second device receives a first message sent by the first device, where the first message is used to apply for an Industrial Internet ID for the first device.

When method 600 is applied to method 100 , the first message corresponds to message 1 in method 100 .

When method 600 is applied to method 300, the first message corresponds to message 1' in method 300.

S602: The second device sends the second message to the third device, where the second message is used to apply for an Industrial Internet identifier for the first device, and the second message includes device information of the first device.

When method 600 is applied to method 100 , the second message corresponds to message 2 in method 100 .

When method 600 is applied to method 300, the second message corresponds to message 2' in method 300.

S603: The second device receives a third message sent by the third device, where the third message indicates a result of applying for an Industrial Internet ID for the first device.

When method 600 is applied to method 100 , the third message corresponds to message 3 in method 100 .

When method 600 is applied to method 300, the third message corresponds to message 3' in method 300.

S604: The second device sends the third message to the first device.

In a possible implementation manner, before receiving the first message, the method further includes: receiving a first authentication message sent by the first device; determining the first authentication message of the first device according to the first authentication message 1st network access for .

The first authentication message in method 600 may correspond to authentication message 1 in the above embodiment, or may correspond to authentication message 1' in the above embodiment.

In a possible implementation manner, the method further includes: receiving a second authentication message sent by the first device, where the second authentication message includes the target Industrial Internet identifier; A second network access right of the first device is determined.

The second authentication message in method 600 may correspond to authentication message 2 in the above embodiment, or may correspond to authentication message 2' in the above embodiment.

In a possible implementation manner, the second message is obtained based on the following manner: obtaining a pre-configured first prefix and device information of the first device; based on the first prefix and the initial industrial Internet identifier, Obtain the target Industrial Internet ID; based on the target Industrial Internet ID and the device information, obtain a second message including the device information and the target Industrial Internet ID, and the second message is used to request for the The first device registers the target Industrial Internet identifier. in:

Regarding the specific implementation of the method 600, reference may be made to the above relevant descriptions of the method 100 and the method 300, and details are not described here.

The embodiment of the present application also provides an Industrial Internet ID-based processing device, see FIG. 9 , which is a schematic structural diagram of an Industrial Internet ID-based processing device provided in the embodiment of the present application. The apparatus 900 shown in FIG. 9 may be applied to the first device, for executing the above method 500 performed by the first device. The apparatus 900 includes: a sending unit 901 , a receiving unit 902 and a processing unit 903 .

The sending unit 901 is configured to send a first message to a second device, the first message is used to apply for an Industrial Internet ID for the first device, and the second device is a network manager or a network admission controller; a receiving unit 902 , configured to receive a second message sent by the second device, the second message indicating the result of applying for an Industrial Internet ID for the first device; the processing unit 903 is configured to, based on the second message, assign the target industrial The Internet identifier is written into the first device.

In a possible implementation manner, the sending unit 901 is configured to: send a first message carrying the target Industrial Internet identifier to the second device, where the first message is used to request registration of the target Industrial internet logo.

In a possible implementation manner, the processing unit 903 is further configured to: obtain the first prefix in the extended information of the DHCP option option of the Dynamic Host Configuration Protocol; according to the first prefix and the initial Industrial Internet ID, to obtain the target Industrial Internet ID.

In a possible implementation manner, the sending unit 901 is further configured to: before sending the first message, send a first authentication message to the second device, so as to obtain a network access permission.

In a possible implementation manner, the sending unit 901 is further configured to: send a second authentication message to the second device, where the second authentication message includes the target industrial Internet identifier.

In a possible implementation manner, the processing unit 903 is further configured to: acquire indication information, where the indication information is used to instruct to apply for an industrial Internet identifier for the first device.

In a possible implementation manner, the receiving unit 903 is configured to: receive security authentication information sent by the network admission controller, where the security authentication information includes the target industrial Internet identifier.

Regarding the specific implementation of the apparatus 900, reference may be made to the relevant description of the method 500 above, and the description will not be repeated here.

The embodiment of the present application also provides an Industrial Internet ID-based processing device, see FIG. 10 , which is a schematic structural diagram of another Industrial Internet ID-based processing device provided in the embodiment of the present application. The apparatus 1000 shown in FIG. 10 may be applied to a second device, for executing the above method 600 performed by the second device. The apparatus 1000 includes: a receiving unit 1001 and a sending unit 1002 .

The receiving unit 1001 is configured to receive a first message sent by the first device, and the first message is used to apply for an Industrial Internet ID for the first device; the sending unit 1002 is configured to send the second message to a third device , the second message is used to apply for an Industrial Internet ID for the first device, the second message includes device information of the first device; the receiving unit 1001 is also used to receive a third message, the The third message indicates a result of applying for an Industrial Internet ID for the first device; the sending unit 1002 is further configured to send the third message to the first device.

In a possible implementation manner, the receiving unit 1001 is further configured to: before receiving the first message, receive a first authentication message sent by the first device; the apparatus further includes a processing unit configured to: Determine the first network access right of the first device according to the first authentication message.

In a possible implementation manner, the receiving unit 1001 is further configured to receive a second authentication message sent by the first device, where the second authentication message includes the target Industrial Internet identifier; the apparatus includes The processing unit is configured to determine the second network access right of the first device according to the second authentication message.

In a possible implementation manner, the second message is obtained based on the following methods: obtaining a pre-configured first prefix and the device information of the first device; based on the first prefix and the initial Industrial Internet identifier , to obtain the target Industrial Internet ID; based on the target Industrial Internet ID and the device information, obtain a second message including the device information and the target Industrial Internet ID, and the second message is used to request for the The first device registers the target industrial Internet identifier. Regarding the specific implementation of the apparatus 1000, reference may be made to the relevant description of the method 600 above, and the description will not be repeated here.

It should be noted that the hardware structure of the above-mentioned Industrial Internet ID-based processing device 900 and Industrial Internet ID-based processing device 1000 can be as shown in FIG. Schematic diagram of the structure of the device.

Referring to FIG. 11 , a device 1100 includes: a processor 1110 , a communication interface 1120 and a memory 1130 . The number of processors 1110 in the device 1100 may be one or more, and one processor is taken as an example in FIG. 11 . In the embodiment of the present application, the processor 1110, the communication interface 1120, and the memory 1130 may be connected through a bus system or other methods, wherein the connection through the bus system 1140 is taken as an example in FIG. 11 .

The processor 1110 may be a central processing unit (central processing unit, CPU), a network processor (network processor, NP) or a combination of CPU and NP. The processor 1110 may further include a hardware chip. The aforementioned hardware chip may be an application-specific integrated circuit (application-specific integrated circuit, ASIC), a programmable logic device (programmable logic device, PLD) or a combination thereof. The aforementioned PLD may be a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof.

The memory 1130 may include a volatile memory (English: volatile memory), such as a random-access memory (random-access memory, RAM); the memory 1130 may also include a non-volatile memory (English: non-volatile memory), such as a fast Flash memory (English: flash memory), hard disk (hard disk drive, HDD) or solid-state drive (solid-state drive, SSD); the memory 1130 may also include a combination of the above types of memory. When the device 1100 corresponds to the aforementioned processing device 900 based on the Industrial Internet ID, the memory 1130 may, for example, store extended information of DHCP options including the first prefix; when the device 1100 corresponds to the processing device 1000 based on the Industrial Internet ID shown in FIG. 10 , The storage 1130 may, for example, store device information of the first device.

Optionally, the memory 1130 stores an operating system and programs, executable modules or data structures, or their subsets, or their extended sets, where the programs may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic services and processing hardware-based tasks. The processor 1110 can read the program in the memory 1130 to implement the processing method based on the Industrial Internet ID provided by the embodiment of the present application (such as the processing method based on the Industrial Internet ID executed by the first device, or the industrial Internet ID-based processing method executed by the second device). treatment of Internet identifiers).

The bus system 1140 may be a peripheral component interconnect standard (peripheral component interconnect, PCI) bus or an extended industry standard architecture (extended industry standard architecture, EISA) bus or the like. The bus system 1140 can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 11 , but it does not mean that there is only one bus or one type of bus.

The embodiment of the present application also provides a computer-readable storage medium, including an instruction or a computer program, which, when run on a computer, causes the computer to execute the industrial Internet identification-based processing method provided in the above embodiments.

The embodiment of the present application also provides a computer program product including an instruction or a computer program, which, when run on a computer, causes the computer to execute the industrial Internet identification-based processing method provided in the above embodiments.

The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above drawings are used to distinguish similar objects, and not necessarily Used to describe a specific sequence or sequence. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a sequence of steps or elements is not necessarily limited to the expressly listed instead, may include other steps or elements not explicitly listed or inherent to the process, method, product or apparatus.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of units is only a logical business division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

A unit described as a separate component may or may not be physically separated, and a component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each business unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software business units.

If the integrated unit is realized in the form of a software business unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods in various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Those skilled in the art should be aware that, in one or more examples above, the services described in the present invention may be implemented by hardware, software, firmware or any combination thereof. When implemented in software, the services may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a general purpose or special purpose computer.

The above specific implementation manners have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation manners of the present invention.

Above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be applied to the foregoing embodiments The technical solutions described in the examples are modified, or some of the technical features are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the application.

Claims

A processing method based on Industrial Internet identification, characterized in that it is applied to the first device, and the method includes:

Sending a first message to a second device, where the first message is used to apply for an Industrial Internet ID for the first device, where the second device is a network manager or a network admission controller;

receiving a second message sent by the second device, where the second message indicates a result of applying for an Industrial Internet ID for the first device;

Based on the second message, write the target Industrial Internet identifier into the first device.
The method according to claim 1, wherein the sending the first message to the second device comprises:

Sending a first message carrying the target Industrial Internet identifier to the second device, where the first message is used to request registration of the target Industrial Internet identifier.
The method according to claim 2, further comprising:

Obtain the first prefix in the extended information of the Dynamic Host Configuration Protocol DHCP option option;

Obtain the target Industrial Internet identifier according to the first prefix and the initial Industrial Internet identifier of the first device.
The method according to claim 1, wherein the first message carries the initial Industrial Internet identifier of the first device.
The method according to claim 1, wherein the first message is used to request to assign an Industrial Internet ID to the first device.
The method according to claim 1, 4 or 5, wherein the second message includes the target Industrial Internet identifier.
The method according to any one of claims 1-6, wherein before sending the first message, the method further comprises:

Send a first authentication message to the second device, so as to obtain permission to access the network.
The method according to claim 7, wherein the first authentication message includes the initial Industrial Internet ID.
The method according to any one of claims 1-8, wherein the method further comprises:

Sending a second authentication message to the second device, where the second authentication message includes the target Industrial Internet identifier.
The method according to any one of claims 1-9, wherein the method further comprises:

Obtain instruction information, where the instruction information is used to instruct to apply for an Industrial Internet ID for the first device.
The method according to claim 10, wherein the indication information is carried in DHCP option extension information.
The method according to claim 1 or 4, wherein the first message is an authentication message.
The method according to claim 1, 4 or 12, wherein the receiving the second message sent by the second device comprises:

Receive security authentication information sent by the network admission controller, where the security authentication information includes the target industrial Internet identifier.
A processing method based on Industrial Internet identification, characterized in that it is applied to a second device, and the second device is a network manager or a network admission controller, and the method includes:

receiving a first message sent by the first device, where the first message is used to apply for an Industrial Internet identifier for the first device;

Sending the second message to a third device, the second message is used to apply for an Industrial Internet identifier for the first device, and the second message includes device information of the first device;

receiving a third message, the third message indicating the result of applying for an Industrial Internet ID for the first device;

sending the third message to the first device.
The method according to claim 14, wherein the first message includes the target Industrial Internet identifier.
The method according to claim 14, wherein the third message includes the target Industrial Internet identifier.
The method according to any one of claims 14-16, wherein before receiving the first message, the method further comprises:

receiving a first authentication message sent by the first device;

Determine the first network access right of the first device according to the first authentication message.
The method according to any one of claims 14-17, wherein the method further comprises:

receiving a second authentication message sent by the first device, where the second authentication message includes the target Industrial Internet identifier;

Determine the second network access right of the first device according to the second authentication message.
The method according to claim 14 or 16, wherein the first message includes the initial Industrial Internet identifier of the first device.
The method according to claim 14 or 19, wherein the first message is an authentication message.
The method according to claim 14 or 16, wherein the second message is used to request to assign an Industrial Internet ID to the first device.
The method according to claim 14 or 15, wherein the second message is used to request registration of a target industrial internet identifier for the first device.
The method according to claim 19, wherein the second message is obtained based on the following manner:

Acquiring a pre-configured first prefix and device information of the first device;

Obtain the target Industrial Internet identifier based on the first prefix and the initial Industrial Internet identifier;

Based on the target industrial Internet identifier and the device information, obtain a second message including the device information and the target industrial Internet identifier, where the second message is used to request registration of the target industrial Internet for the first device Internet logo.
A processing system based on Industrial Internet identification, characterized in that the system includes a first device and a second device;

The first device is used to send a first message to a second device, the first message is used to apply for an Industrial Internet ID for the first device, and the second device is a network manager or a network admission controller;

The second device sends a second message to the first device, and the second message indicates a result of applying for an Industrial Internet ID for the first device;

The first device writes the target Industrial Internet identifier into the first device according to the second message.
The system according to claim 24, wherein the first message includes the target industrial internet identification.
The system according to claim 24, wherein the first message includes an initial Industrial Internet identification of the first device.
The system according to claim 24 or 26, wherein the second message includes the target Industrial Internet identifier.
The system according to claim 24 or 26 or 27, wherein the first message is an authentication message.
The system according to any one of claims 24 or 26-28, wherein the second message is security authentication information including the target Internet ID.
A device, characterized in that it includes: a processor and a memory;

said memory for storing instructions or computer programs;

The processor is configured to execute the instruction or the computer program to perform the method according to any one of claims 1-23.
A computer storage medium, characterized in that instructions are stored in the computer-readable storage medium, and when the instructions are run on a processor, the method according to any one of claims 1-23 is implemented.
A computer program product, characterized in that it includes a program, and when the program is run on a processor, the method according to any one of claims 1-23 is implemented.