WO2023240587A1 - 一种设备权限配置方法及装置、终端设备 - Google Patents

一种设备权限配置方法及装置、终端设备 Download PDF

Info

Publication number
WO2023240587A1
WO2023240587A1 PCT/CN2022/099398 CN2022099398W WO2023240587A1 WO 2023240587 A1 WO2023240587 A1 WO 2023240587A1 CN 2022099398 W CN2022099398 W CN 2022099398W WO 2023240587 A1 WO2023240587 A1 WO 2023240587A1
Authority
WO
WIPO (PCT)
Prior art keywords
client
target device
certificate
message
information
Prior art date
Application number
PCT/CN2022/099398
Other languages
English (en)
French (fr)
Inventor
吕小强
包永明
茹昭
张军
杨宁
Original Assignee
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Oppo广东移动通信有限公司 filed Critical Oppo广东移动通信有限公司
Priority to PCT/CN2022/099398 priority Critical patent/WO2023240587A1/zh
Publication of WO2023240587A1 publication Critical patent/WO2023240587A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol

Definitions

  • the embodiments of this application relate to the technical field of the Internet of Things, and specifically relate to a device permission configuration method and device, and terminal equipment.
  • the administrator device After the IoT device is connected to the network, the administrator device will configure the IoT device so that the administrator device can control the IoT device. For a client, if the client wants to access the Internet of Things device, the client must be configured through an administrator device (that is, the administrator device that configures the Internet of Things device). However, the method of using the administrator device to configure the client does not provide a good user experience for the scenario of temporarily sharing access rights of IoT devices.
  • Embodiments of the present application provide a device permission configuration method and device, terminal equipment, chips, computer-readable storage media, computer program products, and computer programs.
  • the first client obtains the first certificate and sends the first certificate to the second client.
  • the first certificate is the identity certificate for the second client to obtain the first certificate.
  • the first certificate is used for the first certificate.
  • the second client performs authentication with the target device during the process of establishing a connection with the target device; wherein, after the authentication is completed, the second client can generate a shared key and generate a shared key based on the shared key. Access the target device through a connection to the target device.
  • the second client receives the first certificate sent by the first client, and the first certificate is the identity certificate for the second client to obtain the first certificate;
  • the second client sends the first certificate to the server and receives the first certificate sent by the server.
  • the first certificate is sent after the server verifies that the first certificate passes;
  • the second client discovers the target device, and in the process of establishing a connection with the target device, uses the first certificate to perform authentication between the second client and the target device; wherein, after the authentication is completed Finally, the second client can generate a shared key and access the target device through a connection with the target device based on the shared key.
  • the device permission configuration device provided by the embodiment of this application is applied to the first client.
  • the device includes:
  • a communication unit configured to obtain a first credential and send the first credential to a second client.
  • the first credential is the identity credential for the second client to obtain a first certificate.
  • the first certificate is used to obtain a first certificate for the second client.
  • the second client performs authentication with the target device during the process of establishing a connection with the target device; wherein, after the authentication is completed, the second client can generate a shared secret key and perform authentication based on the shared secret key.
  • the key accesses the target device through a connection to the target device.
  • the device permission configuration device provided by the embodiment of this application is applied to the second client, and the device includes:
  • the communication unit is used to receive the first certificate sent by the first client, the first certificate is the identity certificate for the second client to obtain the first certificate; send the first certificate to the server, and receive the first certificate from the server.
  • the first certificate sent, the first certificate is sent after the server verifies that the first certificate passes;
  • An establishment unit used to discover a target device and establish a connection with the target device
  • An authentication unit configured to use the first certificate to perform authentication between the second client and the target device during the process of establishing a connection with the target device; wherein, after the authentication is completed, the third The two clients can generate a shared key and access the target device through a connection with the target device based on the shared key.
  • the terminal device provided by the embodiment of the present application includes a processor and a memory.
  • the memory is used to store computer programs, and the processor is used to call and run the computer programs stored in the memory to execute the above device permission configuration method.
  • the chip provided by the embodiment of this application is used to implement the above device permission configuration method.
  • the chip includes: a processor, configured to call and run a computer program from the memory, so that the device installed with the chip executes the above device permission configuration method.
  • the computer-readable storage medium provided by the embodiment of the present application is used to store a computer program.
  • the computer program causes the computer to execute the above-mentioned device permission configuration method.
  • the computer program product provided by the embodiment of the present application includes computer program instructions, which cause the computer to execute the above device permission configuration method.
  • the computer program provided by the embodiment of the present application when run on a computer, causes the computer to execute the above device permission configuration method.
  • the first client is the owner device of the target device, and the first client sends the first certificate to the second client, so that the second client can obtain the first certificate based on the first certificate, Authentication with the target device is achieved through the first certificate. After the authentication is passed, the second client can access the target device based on the connection with the target device. In this way, the first client can share the access rights of the target device to the second client.
  • This access rights sharing method is suitable for the scenario where the first client temporarily shares the target device with the second client, improving the user experience. .
  • Figure 1 is a schematic diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart 1 of the device permission configuration method provided by the embodiment of the present application.
  • FIG. 3 is a schematic flowchart 2 of the device permission configuration method provided by the embodiment of the present application.
  • Figure 4 is a flowchart three of the device permission configuration method provided by the embodiment of the present application.
  • Figure 5 is a schematic structural diagram of a device permission configuration device provided by an embodiment of the present application.
  • Figure 6 is a schematic diagram 2 of the structural composition of the device permission configuration device provided by the embodiment of the present application.
  • Figure 7 is a schematic structural diagram of a terminal device provided by an embodiment of the present application.
  • Figure 8 is a schematic structural diagram of a chip according to an embodiment of the present application.
  • the administrator device After the IoT device is connected to the network, the administrator device will configure the IoT device so that the administrator device can control the IoT device.
  • the administrator device is also an activation tool (Onboarding Tool, OBT).
  • OBT Onboarding Tool
  • the administrator device needs to configure the owner ID (Owner ID) of the IoT device to be the device ID (Device_ID) of the administrator device.
  • the administrator device also needs to configure the IoT device.
  • the access credential of the device which is used for mutual authentication when the IoT device establishes a connection with other devices.
  • the access credential can be a symmetric key, an asymmetric key, or a certificate, etc.
  • the IoT device and other devices can establish application connections and perform interconnection operations. Only devices with the same Owner ID can establish application connections and perform interconnection operations. It can be seen that for a client, if the client wants to access the Internet of Things device, the client must be configured through the same administrator device (that is, the administrator device that configures the Internet of Things device). However, the method of using the administrator device to configure the client is only suitable for long-term sharing of access rights to IoT devices, and does not provide a good user experience for temporary sharing of access rights to IoT devices. Taking the IoT device as a car as an example, the sharing of car access permissions is a temporary sharing. For example, the car owner (the client) can temporarily share the car permissions with family members, friends, or the driver (the client). The way the client is configured using the administrator device does not provide a good user experience.
  • the technical solution of the embodiment of this application realizes that the first client shares the access rights of the target device to the second client by introducing an interface between clients.
  • This access rights sharing method is suitable for the first client to share the target device's access rights.
  • the scenario where the device is temporarily shared with the second client improves the user experience.
  • the "client” in the embodiment of this application is installed on a terminal device.
  • the terminal device can be a mobile phone, a tablet computer, a wearable device, etc.
  • client in the embodiment of this application may also be called an “application (APP)”.
  • APP application
  • server in the embodiments of this application can also be replaced by other names, such as service equipment, management equipment, cloud platform, etc., as long as the functions of the server described in the solutions of the embodiments of this application can be realized.
  • FIG 1 is a schematic diagram of a communication system provided by an embodiment of the present application.
  • the communication system includes a first client 101, a second client 102, a target device 103 and a server 104, where the first client 101 is the target
  • the owner (Owner) device of the device 103 also called an administrator device
  • the owner of the target device can manage and control the target device 103 through the first client 101.
  • the second client 102 is a client that needs to access the target device 103 .
  • the target device can be an IoT device such as a car or a home appliance.
  • the first client 101 applies for a first certificate from the server 104 for the second client 102, and sends the first certificate to the second client 102, so that the second client 102 can obtain the first certificate from the server 104 based on the first certificate.
  • the first certificate is used to achieve authentication with the target device 103.
  • the second client 102 can access the target device 103 based on the connection with the target device 103. In this way, the first client shares the access rights of the target device to the second client.
  • FIG. 2 is a schematic flowchart 1 of the device permission configuration method provided by the embodiment of the present application. As shown in Figure 2, the device permission configuration method includes the following steps:
  • Step 201 The first client obtains the first voucher and sends the first voucher to the second client; the second client receives the first voucher sent by the first client.
  • the first client is the owner device (also known as the administrator device) of the target device, and the owner of the target device can manage and control the target device through the first client.
  • the second client is the client that needs to access the target device.
  • the target device can be an IoT device such as a car or a home appliance.
  • the first client configures the target device.
  • the first client configures the owner ID (Owner ID) of the target device to be the device ID (Device_ID) of the first client.
  • the first client can also configure other information of the target device, such as password information.
  • the first client becomes the master device of the target device, and the first client can manage and control the target device.
  • the first client wants to share the access rights of the target device to the second client.
  • the first client obtains the first credential for the second client and sends the second client One voucher.
  • the first certificate is the identity certificate for the second client to obtain the first certificate.
  • the first credential may be a token.
  • the first client can obtain the first credential in the following manner: the first client sends a first message to the server, and the first message is used to request the server to generate the first credential for the second client; A client receives a second message sent by the server, and the second message carries the first certificate.
  • the first message carries first information, and the first information includes at least one of the following: an identity of the first client, an identity of the second client, and an identity of the target device;
  • the identification of the first client is used by the server to determine that the applicant for the first certificate is the first client;
  • the identifier of the second client is used by the server to determine that the user of the first certificate is the second client;
  • the identification of the target device is used by the server to determine that the object to be connected by the user of the first credential is the target device.
  • the identification of the first client refers to the device identification (Device_ID) or application identification (APP_ID) of the first client.
  • the device identification (Device_ID) of the first client refers to the identification of the device where the first client is located.
  • the identification of the second client refers to the device identification (Device_ID) or application identification (APP_ID) of the second client.
  • the device identification (Device_ID) of the second client refers to the identification of the device where the second client is located.
  • the first client obtains the identity of the second client in an out-of-band manner. For example: the first client obtains the identity of the second client by scanning the QR code of the second client. Another example: the first client can obtain the identity of the second client through an address link (such as a Uniform Resource Locator (URL)).
  • URL Uniform Resource Locator
  • the identification of the target device refers to the device identification of the target device.
  • the first client can obtain the device identification (Device_ID) of the target device when configuring the target device.
  • the first message also carries a first signature
  • the first signature is obtained by signing the first information using the private key of the first client.
  • the first client after obtaining the first credential, sends the first credential to the second client.
  • the first credential is carried in the third message. That is: the first client sends the third message to the second client; the second client receives the third message sent by the first client; the third message carries the first certificate.
  • the third message also carries at least one of the following: the identification of the target device and the first password information; the identification of the target device is used by the second client to determine that the object to be connected is the target device; the first password The information is used by the second client to establish a connection with the target device.
  • the first password information includes at least one of the following: password index, password.
  • the password index may be a pairing code index (pincodeindex), and the password index is used to indicate the password.
  • the password can be determined through the password index.
  • the password is a pincode.
  • the information carried in the third message is encrypted using the public key of the second client; alternatively, the information carried in the third message is not encrypted.
  • the first client obtains the public key of the second client in an out-of-band manner.
  • the first client obtains the public key of the second client by scanning the QR code of the second client.
  • the first client can obtain the public key of the second client through an address link (such as a URL).
  • the first client obtains the public key of the second client through an interface with the second client.
  • the second client uses the private key of the second client to decrypt the information carried in the third message, and After successful decryption, the information carried in the third message is obtained.
  • the first client sends the third message to the second client in a manner that may be, but is not limited to, the following:
  • the first client can send the third message to the second client through the interface with the second client.
  • the first client can send the third message to the second client in an out-of-band manner.
  • the first client provides a QR code or an address link (such as a URL) to the second client, so that the second client obtains the information provided by the first client by scanning the QR code or address link (such as a URL).
  • Third message For another example: the first client provides the third message to the second client through forwarding by the server.
  • Step 202 The second client sends the first certificate to the server and receives the first certificate sent by the server.
  • the first certificate is sent after the server verifies that the first certificate passes.
  • the second client after obtaining the first certificate, sends the first certificate to the server.
  • the server passes the first certificate verification, it generates a first certificate for the second client and sends the first certificate to the second client; the second client receives the first certificate sent by the server.
  • the second client sends the public key of the second client to the server, and the public key of the second client is used by the server to generate the first certificate.
  • the first certificate is used by the second client to authenticate with the target device during the process of establishing a connection with the target device; wherein, after passing the authentication, the second client can access based on the connection with the target device.
  • target device The first certificate may also be called an operation certificate, that is, a certificate that operates the target device.
  • the first certificate generated by the server contains the first signature
  • the first client after determining that the second client has successfully obtained the first certificate, performs some configurations on the target device and triggers the target device to enter the pairing state.
  • the first client performs some configurations for the target device, which may include:
  • the first client sends first configuration information to the target device, and the first configuration information is used to configure at least one of the following of the target device: binding information and access information.
  • the binding information is used to set the binding relationship between the second password information and the identity of the second client; the access information is used to set the second client to be able to access resources of the target device, that is, the authorized second client Access control permission information for the target device.
  • the binding information can be implemented through a cluster.
  • it can be implemented through the following cluster: "pin_binding cluster”.
  • the binding relationship set by the binding information is used by the target device to determine the second password information used when establishing a connection with the second client.
  • the second password information is used for the target device to establish a connection with the second client.
  • the second password information includes at least one of the following: password index, password.
  • the password index may be a pairing code index (pincodeindex), and the password index is used to indicate the password.
  • the password can be determined through the password index.
  • the password is a pincode.
  • the first password information configured by the first client for the second client is consistent with the second password information configured by the first client for the target device that has a binding relationship with the identity of the second client.
  • both parties use consistent password information for matching, and the connection is established after the matching is successful.
  • access information can be implemented through a cluster.
  • ACL Cluster Access Control List Cluster
  • the resources set in the access information are resources that the second client can access after establishing a connection with the target device.
  • the resources that the second client can access are indicated by an access control list (Access Control List, ACL), that is, the ACL indicates which resources of the target device can be accessed by the second client and/or which resources cannot be accessed by the second client. Second client access.
  • ACL access control List
  • the above configuration of the target device by the first client may not be performed after the second client obtains the first certificate, but may be performed at any time, such as when the first client serves as an administrator device and initiates configuration of the target device. time execution.
  • the first client acts as the owner device to configure the target device, if binding information and/or access information is configured for the target device, after the second client obtains the first certificate, A client no longer needs to configure binding information and/or access information for the target device.
  • the first client before the first client sends the first configuration information to the target device, the first client first establishes a connection with the target device, and the first client sends the first configuration information to the target device based on the connection with the target device.
  • Configuration information refers to an application connection.
  • the application connection is a connection located above the physical connection (that is, the underlying connection).
  • the application connection is established based on the physical connection after the physical connection is established.
  • the application connection is used to transmit the application layer.
  • Information such as the first configuration information in the above solution.
  • the first client triggers the target device to enter the pairing state, which may include:
  • the first client sends a first instruction to the target device.
  • the first instruction is used to instruct the target device to enter the pairing state. After the target device enters the pairing state, the target device can be discovered by the second client and establish a connection with the second client. .
  • the first client determines that the second client has successfully obtained the first certificate in a manner that may be, but is not limited to, the following:
  • the information related to the first certificate may be indication information indicating that the first certificate has been issued to the second client, etc.
  • the first client After sending the third message, the first client starts a timer. When the timer times out, it is determined that the second client has successfully obtained the first certificate.
  • the first client determines that the second client has successfully obtained the first certificate through an out-of-band method. For example, if the first client can obtain the relevant information of the first certificate by scanning the QR code of the second client or through an address link (such as a URL), then it is determined that the second client has successfully obtained the first certificate.
  • the information related to the first certificate may be indication information indicating that the first certificate has been issued to the second client, etc.
  • Step 203 The second client discovers the target device, and in the process of establishing a connection with the target device, uses the first certificate to perform authentication between the second client and the target device; where, after the authentication is completed, the second client can Generate a shared secret and access the target device through a connection to the target device based on the shared secret.
  • the communication method between the target device and the client is Bluetooth or other short-range communication methods. It is not limited to this, the communication method between the target device and the client can also be other communication methods.
  • the target device sends a broadcast packet after it is in the configuration state, and the second client can discover the broadcast packet and thereby discover the target device.
  • the second client After the second client discovers the target device, it establishes a physical connection with the target device (that is, the underlying connection); the second client establishes an application connection with the target device based on the physical connection (that is, the underlying connection).
  • a first certificate is sent to the target device, and the first certificate is used by the target device to authenticate the second client.
  • the second client can access the target device based on the application connection with the target device. Specifically, after the authentication is completed, the second client generates a shared key based on its own private key and the public key of the target device, and accesses the target device through a connection with the target device based on the shared key.
  • the second client sends the first certificate to the target device during the process of establishing an application connection with the target device. Since the first certificate is generated based on the public key of the second client, after the target device obtains the first certificate, The public key of the second client can be obtained from the first certificate, thus completing the authentication of the second client. Similarly, the target device will also send its own certificate (hereinafter referred to as the second certificate) to the second client. Since the second certificate is generated based on the public key of the target device, after the second client obtains the second certificate, The public key of the target device can be obtained from the second certificate, thus completing the authentication of the target device. It should be noted that the second certificate of the target device may be configured by the first client for the target device.
  • the second client can access the target device based on the application connection with the target device.
  • the target device can access the target device based on the application connection with the target device.
  • the connection between the two clients responds to the access of the target device.
  • the second client uses its own private key and the public key of the target device to generate a first shared key, uses the first shared key to encrypt the access request, and converts the encrypted
  • the access request is sent to the target device; the target device uses its own private key and the public key of the second client to generate a second shared key, uses the second shared key to decrypt the encrypted access request, and processes the decrypted access request. ask.
  • the target device uses its own private key and the public key of the second client to generate a second shared key, uses the second shared key to encrypt the access response, and sends the encrypted access response to
  • the second client uses its own private key and the public key of the target device to generate a first shared key, uses the first shared key to decrypt the access response, and processes the decrypted access response.
  • the access request may carry control instructions for the target device.
  • the first certificate includes a first signature
  • the first signature is obtained by signing the first information using the private key of the first client
  • the first information includes at least one of the following: an identity of the first client, a second The identity of the client and the identity of the target device; the first signature is used by the target device to confirm whether the second client's access to the target device is authorized by the first client.
  • the target device uses the public key of the first client to verify the first signature in the first certificate. If the signature verification is correct, the target device confirms the first signature in the first certificate. The second client's access to itself is authorized by the first client. If the signature verification is incorrect, the target device confirms that the second client's access to itself is not authorized by the first client.
  • the target device uses the public key of the first client to verify the first signature in the first certificate. If the signature verification is correct, the target device starts from The first information can be obtained from the first signature, and the target device can determine that the first client authorizes the second client to perform operations on the target device based on the identity of the first client, the identity of the second client, and the identity of the target device in the first information. Access, that is, the target device can confirm that the second client's access to itself is authorized by the first client.
  • the first information includes APP ID1, APP ID2, and Device ID. Based on the first information, the target device can determine that the first client identified by APP ID1 authorizes the second client identified by APP ID2 to target the target identified by Device ID. device to access.
  • the target device can obtain the public key of the first client during mutual authentication with the first client.
  • the first client sends a certificate generated based on its own public key to the target device, and the target device obtains the first client's public key from the certificate; similarly, the target device The device sends a certificate generated based on its own public key to the first client, and the first client obtains the public key of the target device from the certificate.
  • the first client is the owner (Owner) of the target device, and the first client sends the first credential to the second client, so that the second client can obtain the first credential based on the first credential. Certificate, the first certificate is used to achieve authentication with the target device. After the authentication is passed, the second client can access the target device based on the connection with the target device. In this way, the first client can share the access rights of the target device to the second client.
  • This access rights sharing method is suitable for the scenario where the first client temporarily shares the target device with the second client, improving the user experience. .
  • FIG. 3 is a flow diagram 2 of the device permission configuration method provided by the embodiment of the present application.
  • "APP_A” in Figure 3 corresponds to the "first client” in the above solution
  • "APP_B” corresponds to the “second client” in the above solution.
  • Client "operation certificate” corresponds to the “first certificate” in the above scheme
  • “token” corresponds to the "first credential” in the above scheme.
  • the device permission configuration method includes Following steps:
  • Step 301 APP_A sends a first message to the server.
  • the first message carries at least one of the following: APP_A_ID, APP_B_ID, and the ID of the target device.
  • APP_A is the owner device of the target device, and APP_A applies for a token for APP_B to access the server and obtain the operation certificate through the first message.
  • This token is the identity credential for APP_B to access the server to obtain the operation certificate.
  • the first message carries at least one of the following: APP_A_ID, APP_B_ID, and the ID of the target device.
  • APP_A_ID is the ID of APP_A
  • APP_B_ID is the ID of APP_B.
  • APP_A obtains APP_B_ID through out-of-band method. For example: APP_A obtains APP_B_ID by scanning APP_B's QR code. Another example: APP_A can obtain APP_B_ID through an address link (such as URL).
  • APP_A obtains the ID of the target device when configuring the target device.
  • Step 302 The server sends a second message to APP_A, and the second message carries the token.
  • the server After receiving the first message sent by APP_A, the server generates a token for APP_B and sends the token to APP_A through the second message.
  • the server can record the correspondence between APP_B_ID and token.
  • Step 303 APP_A sends a third message to APP_B, and the third message carries the token.
  • the third message also carries at least one of the following: ID of the target device, password information (such as pincodeindex, pincode).
  • APP_A sends the third message to APP_B can be but is not limited to the following ways:
  • APP_A can send the third message to APP_B through the interface with APP_B.
  • APP_A can send the third message to APP_B in an out-of-band manner.
  • APP_A provides a QR code or an address link (such as URL) to APP_B, so that APP_B obtains the third message provided by APP_A by scanning the QR code or address link (such as URL).
  • APP_A provides the third message to APP_B through forwarding by the server.
  • Step 304 APP_B sends APP_B's public key and token to the server.
  • the server authenticates APP_B's identity based on the token. After passing the authentication, it generates an operation certificate based on APP_B's public key. Specifically, after the server generates a token for APP_B, it records the correspondence between APP_B_ID and the token, and determines whether the token provided by APP_B corresponds to APP_B_ID based on the correspondence. If it corresponds, it determines that APP_B's identity authentication has passed. , if it does not correspond, it is determined that the identity authentication of APP_B has failed. After it is determined that APP_B's identity authentication has passed, an operation certificate is generated based on APP_B's public key.
  • Step 305 The server sends the operation certificate to APP_B.
  • Step 306 APP_A determines that APP_B has successfully obtained the operation certificate.
  • step 306 is an optional step, and step 306 may be performed or may not be performed.
  • APP_A may, but is not limited to, determine that APP_B has successfully obtained the operation certificate through the following methods:
  • APP_A receives the response message sent by APP_B to the third message, and then determines that APP_B has successfully obtained the operation certificate.
  • the information related to the operation certificate may be indication information indicating that the operation certificate has been issued to APP_B, etc.
  • APP_A After sending the third message, APP_A starts a timer. When the timer times out, it is determined that APP_B has successfully obtained the operation certificate.
  • APP_A confirms that APP_B has successfully obtained the operation certificate through out-of-band methods. For example: APP_A can obtain relevant information about the operation certificate by scanning the QR code of APP_B or through an address link (such as URL), then it is determined that APP_B has successfully obtained the operation certificate.
  • the information related to the operation certificate may be indication information indicating that the operation certificate has been issued to APP_B, etc.
  • Step 307 APP_A establishes an application connection with the target device.
  • Step 308 APP_A configures binding information and/or access information of the target device based on the application connection with the target device.
  • binding information can be implemented through clusters. As an example, it can be implemented through the following cluster: "pin_binding cluster”. Binding information is used to set the binding relationship between password information (such as pincodeindex, pincode) and APP_B_ID. The binding relationship set by the binding information is used by the target device to determine the password information (such as pincodeindex, pincode).
  • password information such as pincodeindex, pincode
  • the password information configured by APP_A for APP_B is consistent with the password information configured by APP_A for the target device that is bound to APP_B_ID. In this way, when APP_B establishes a connection with the target device, both parties use the same password information. A match is made and a connection is established after the match is successful.
  • access information can be implemented through a cluster.
  • ACL Cluster The resources set by the access information are the resources that APP_B can access after establishing a connection with the target device.
  • the resources that APP_B can access are indicated by ACL, that is, the ACL indicates which resources of the target device can be accessed by APP_B and/or which resources cannot be accessed by APP_B.
  • steps 307 and 308 are optional steps, and steps 307 and 308 may be performed or may not be performed.
  • APP_A serves as the owner device to configure the target device, if binding information and/or access information is configured for the target device, steps 307 and 308 may not be performed.
  • Step 309 APP_A sends an instruction to the target device, and the instruction is used to instruct the target device to enter the pairing state.
  • the target device can be discovered by APP_B and establish a connection with APP_B.
  • Step 310 APP_B discovers the target device and establishes a physical connection (ie, bottom layer connection) with the target device.
  • Step 311 APP_B establishes an application connection with the target device based on the physical connection with the target device. During the process of establishing the application connection, APP_B uses the operation certificate to complete authentication with the target device. After the authentication is completed, perform the following step 312, otherwise, APP_B cannot access the target device.
  • Step 312 APP_B accesses the target device based on the application connection.
  • APP_B sends the operation certificate (i.e., the first certificate) to the target device. Since the first certificate is generated based on the public key of APP_B, the target device After obtaining the first certificate, you can obtain the public key of APP_B from the first certificate, thus completing the authentication of APP_B. Similarly, the target device will also send its own operation certificate (hereinafter referred to as the second certificate) to APP_B. Since the second certificate is generated based on the public key of the target device, APP_B can obtain the second certificate from the second certificate. Obtain the public key of the target device, thus completing the authentication of the target device.
  • the operation certificate i.e., the first certificate
  • the second certificate of the target device may be configured by APP_A for the target device.
  • APP_B can access the target device based on the application connection with the target device.
  • the target device can respond to the target device's access based on the connection with APP_B.
  • APP_B uses its own private key and the public key of the target device to generate a first shared key, uses the first shared key to encrypt the access request, and sends the encrypted access request to the target device.
  • the target device uses its own private key and the public key of APP_B to generate a second shared key, uses the second shared key to decrypt the encrypted access request, and processes the decrypted access request.
  • the target device uses its own private key and the public key of APP_B to generate a second shared key, uses the second shared key to encrypt the access response, and sends the encrypted access response to APP_B;
  • APP_B uses its own private key and the public key of the target device to generate a first shared key, uses the first shared key to decrypt the access response, and processes the decrypted access response.
  • the access request may carry control instructions for the target device.
  • FIG. 4 is a flowchart three of the device permission configuration method provided by the embodiment of the present application.
  • "APP_A” in Figure 4 corresponds to the "first client” in the above solution
  • "APP_B” corresponds to the "second client” in the above solution.
  • Client "operation certificate” corresponds to the “first certificate” in the above scheme
  • token corresponds to the "first credential” in the above scheme.
  • the device permission configuration method includes Following steps:
  • Step 401 APP_A sends a first message to the server.
  • the first message carries at least one of the following: APP_A_ID, APP_B_ID, the ID of the target device, and the first signature.
  • APP_A is the owner device of the target device, and APP_A applies for a token for APP_B to access the server and obtain the operation certificate through the first message.
  • This token is the identity credential for APP_B to access the server to obtain the operation certificate.
  • the first message carries at least one of the following: APP_A_ID, APP_B_ID, the ID of the target device, and the first signature.
  • APP_A_ID is the ID of APP_A
  • APP_B_ID is the ID of APP_B.
  • the first signature is obtained by using the private key of APP_A to sign at least one of the following information: APP_A_ID, APP_B_ID, and the ID of the target device.
  • APP_A obtains APP_B_ID through out-of-band method. For example: APP_A obtains APP_B_ID by scanning APP_B's QR code. Another example: APP_A can obtain APP_B_ID through an address link (such as URL).
  • APP_A obtains the ID of the target device when configuring the target device.
  • token_applicaiton Struct As an example, the content of token_applicaiton Struct is as follows:
  • target ID of the target device // Operation certificate is used to access the device
  • APP_A uses APP_A.privatekey (that is, APP_A's private key) to sign information such as APP_A_ID, APP_B_ID, and the ID of the target device, and generates token_application_Sign (that is, the first signature).
  • token_application_Sign that is, the first signature.
  • other information such as timestamp can also be added.
  • Step 402 The server sends a second message to APP_A, and the second message carries the token.
  • the server After receiving the first message sent by APP_A, the server generates a token for APP_B and sends the token to APP_A through the second message.
  • the server can record the correspondence between APP_B_ID and token.
  • Step 403 APP_A establishes an application connection with the target device.
  • Step 404 APP_A configures binding information and/or access information of the target device based on the application connection with the target device, and instructs the target device to enter the pairing state.
  • binding information can be implemented through clusters.
  • pin_binding cluster can be implemented through the following cluster.
  • the binding information is used to set the binding relationship between password information (such as pincodeindex, pincode) and APP_B_ID.
  • the binding relationship set by the binding information is used by the target device to determine the password information used when establishing a connection with APP_B. (such as pincodeindex, pincode).
  • the password information configured by APP_A for APP_B is consistent with the password information configured by APP_A for the target device that is bound to APP_B_ID. In this way, when APP_B establishes a connection with the target device, both parties use the same password information. A match is made and a connection is established after the match is successful.
  • access information can be implemented through a cluster.
  • ACL Cluster The resources set by the access information are the resources that APP_B can access after establishing a connection with the target device.
  • the resources that APP_B can access are indicated by ACL, that is, the ACL indicates which resources of the target device can be accessed by APP_B and/or which resources cannot be accessed by APP_B.
  • APP_A sends an instruction to the target device, and the instruction is used to instruct the target device to enter the pairing state. After the target device enters the pairing state, the target device can be discovered by APP_B and establish a connection with APP_B.
  • steps 403 and 404 are optional steps, and steps 403 and 404 may be performed or may not be performed.
  • steps 403 and 404 may be performed or may not be performed.
  • APP_A serves as the owner device to configure the target device, if binding information and/or access information is configured for the target device, steps 403 and 404 may not be performed.
  • Step 405 The target device sends a 200OK message to APP_A.
  • the 200OK message represents a successful response message.
  • Step 406 APP_A sends a third message to APP_B, and the third message carries the token.
  • the third message also carries at least one of the following: the ID of the target device, password information (such as pincodeindex, pincode).
  • the information carried in the third message is encrypted using the public key of APP_B; or the information carried in the third message is not encrypted.
  • APP_B uses the private key of APP_B to decrypt the information carried in the third message, and obtains the third message after the decryption is successful. information carried in it.
  • APP_A sends the third message to APP_B can be but is not limited to the following ways:
  • APP_A can send the third message to APP_B through the interface with APP_B.
  • APP_A can send the third message to APP_B in an out-of-band manner.
  • APP_A provides a QR code or an address link (such as URL) to APP_B, so that APP_B obtains the third message provided by APP_A by scanning the QR code or address link (such as URL).
  • APP_A provides the third message to APP_B through forwarding by the server.
  • Step 407 APP_B sends APP_B's public key and token to the server.
  • the server authenticates APP_B's identity based on the token. After passing the authentication, it generates an operation certificate based on APP_B's public key. Specifically, after the server generates the token for APP_B, it records the correspondence between APP_B_ID and the token. According to the corresponding relationship, it is determined whether the token provided by APP_B corresponds to the APP_B_ID. If it corresponds, it is determined that the identity authentication of APP_B has passed. If it does not correspond, it is determined that the identity authentication of APP_B has not passed. After confirming that APP_B's identity authentication has passed, an operation certificate is generated based on APP_B's public key.
  • the operation certificate generated by the server contains the first signature.
  • Step 408 The server sends the operation certificate to APP_B.
  • Step 409 APP_B discovers the target device and establishes a physical connection with the target device.
  • APP_B can identify the pairing message broadcast by the target device through the obtained ID of the target device, and establish a physical connection with the target device.
  • Step 410 APP_B establishes an application connection with the target device based on the physical connection with the target device. During the process of establishing the application connection, APP_B uses the operation certificate to complete authentication with the target device.
  • the authentication process it is necessary to determine whether the first signature carried in the operation certificate is correct, that is, it is necessary to confirm whether APP_B's access to the target device is authorized by APP_A. If the first signature is correct, it means that APP_B's access to the target device is authorized by APP_A; if the first signature is wrong, it means that APP_B's access to the target device is not authorized by APP_A.
  • the authentication is completed and the first signature is correct, perform the following step 411. Otherwise, APP_B cannot access the target device.
  • the target device uses the public key of APP_A to verify the first signature in the operation certificate. If the signature verification is correct (that is, the first signature is correct), the target device confirms APP_B The access to itself is authorized by APP_A. If the signature verification is wrong (that is, the first signature is wrong), the target device confirms that APP_B's access to itself is not authorized by APP_A.
  • the target device uses the public key of APP_A to verify the first signature in the operation certificate. If the signature is correct, the target device can obtain the APP_A_ID from the first signature. , APP_B_ID, and the ID of the target device. The target device can determine that APP_A authorizes APP_B to access the target device based on APP_A_ID, APP_B_ID, and the ID of the target device. That is, the target device can confirm that APP_B's access to itself is authorized by APP_A.
  • the target device can obtain the public key of APP_A during the mutual authentication process with APP_A.
  • APP_A sends a certificate generated based on its own public key to the target device, and the target device obtains APP_A's public key from the certificate; similarly, the target device sends a certificate based on its own public key to APP_A.
  • the certificate generated by the key, APP_A obtains the public key of the target device from the certificate.
  • Step 411 APP_B accesses the target device based on the application connection.
  • APP_B sends the operation certificate (i.e., the first certificate) to the target device. Since the first certificate is generated based on the public key of APP_B, the target device After obtaining the first certificate, you can obtain the public key of APP_B from the first certificate, thus completing the authentication of APP_B. Similarly, the target device will also send its own operation certificate (hereinafter referred to as the second certificate) to APP_B. Since the second certificate is generated based on the public key of the target device, APP_B can obtain the second certificate from the second certificate. Obtain the public key of the target device, thus completing the authentication of the target device.
  • the operation certificate i.e., the first certificate
  • the second certificate of the target device may be configured by APP_A for the target device.
  • APP_B can access the target device based on the application connection with the target device.
  • the target device can respond to the target device's access based on the connection with APP_B.
  • APP_B uses its own private key and the public key of the target device to generate a first shared key, uses the first shared key to encrypt the access request, and sends the encrypted access request to the target device.
  • the target device uses its own private key and the public key of APP_B to generate a second shared key, uses the second shared key to decrypt the encrypted access request, and processes the decrypted access request.
  • the target device uses its own private key and the public key of APP_B to generate a second shared key, uses the second shared key to encrypt the access response, and sends the encrypted access response to APP_B;
  • APP_B uses its own private key and the public key of the target device to generate a first shared key, uses the first shared key to decrypt the access response, and processes the decrypted access response.
  • the access request may carry control instructions for the target device.
  • the size of the sequence numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its functions and internal logic, and should not be used in this application.
  • the implementation of the examples does not constitute any limitations.
  • the terms “downlink”, “uplink” and “sidelink” are used to indicate the transmission direction of signals or data, where “downlink” is used to indicate that the transmission direction of signals or data is from the station.
  • uplink is used to indicate that the transmission direction of the signal or data is the second direction from the user equipment of the cell to the site
  • sidelink is used to indicate that the transmission direction of the signal or data is A third direction sent from User Device 1 to User Device 2.
  • downlink signal indicates that the transmission direction of the signal is the first direction.
  • the term “and/or” is only an association relationship describing associated objects, indicating that three relationships can exist. Specifically, A and/or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" in this article generally indicates that the related objects are an "or" relationship.
  • FIG. 5 is a schematic structural diagram of the device permission configuration device provided by the embodiment of the present application. It is applied to the first client. As shown in Figure 5, the device permission configuration device includes:
  • the communication unit 501 is used to obtain the first certificate and send the first certificate to the second client.
  • the first certificate is the identity certificate for the second client to obtain the first certificate.
  • the first certificate is used for the second client to communicate with the target.
  • the device performs authentication with the target device; after the authentication is completed, the second client can generate a shared key and access the target device through the connection with the target device based on the shared key.
  • the communication unit 501 is used to send a first message to the server, the first message is used to request the server to generate a first credential for the second client; and receive a second message sent by the server, the second message carries the first certificate.
  • the first message carries first information, and the first information includes at least one of the following: an identity of the first client, an identity of the second client, and an identity of the target device;
  • the identification of the first client is used by the server to determine that the applicant for the first certificate is the first client;
  • the identifier of the second client is used by the server to determine that the user of the first certificate is the second client;
  • the identification of the target device is used by the server to determine that the object to be connected by the user of the first credential is the target device.
  • the first message also carries a first signature
  • the first signature is obtained by signing the first information using the private key of the first client.
  • the first certificate generated by the server contains the first signature.
  • the communication unit 501 is configured to send a third message to the second client, where the third message carries the first credential.
  • the third message also carries at least one of the following: the identification of the target device and the first password information;
  • the identification of the target device is used by the second client to determine that the object to be connected is the target device
  • the first password information is used by the second client to establish a connection with the target device.
  • the information carried in the third message is encrypted using the public key of the second client; alternatively, the information carried in the third message is not encrypted.
  • the device further includes: a configuration unit 502, configured to generate first configuration information;
  • the communication unit 501 is also configured to send first configuration information to the target device, where the first configuration information is used to configure at least one of the following of the target device:
  • Binding information the binding information is used to set the binding relationship between the second password information and the identity of the second client;
  • Access information which is used to set the second client to be able to access resources of the target device.
  • the binding relationship is used by the target device to determine the second password information used when establishing a connection with the second client.
  • the device further includes: an establishing unit 503, configured to establish a connection with the target device;
  • the communication unit 501 is configured to send first configuration information to the target device based on the connection with the target device.
  • the password information includes at least one of the following: password index, password.
  • the communication unit 501 is used to send a first instruction to the target device, and the first instruction is used to instruct the target device to enter the pairing state; wherein, after the target device enters the pairing state, the target device can be discovered by the second client And establish a connection with the second client.
  • FIG 6 is a schematic diagram 2 of the structural composition of the device permission configuration device provided by the embodiment of the present application. It is applied to the second client.
  • the device permission configuration device includes:
  • the communication unit 601 is used to receive the first certificate sent by the first client, and the first certificate is the identity certificate for the second client to obtain the first certificate; send the first certificate to the server, and receive the first certificate sent by the server.
  • the first certificate is sent after the server verifies that the first certificate passes;
  • the establishment unit 602 is used to discover the target device and establish a connection with the target device;
  • the authentication unit 603 is configured to use the first certificate to authenticate between the second client and the target device during the process of establishing a connection with the target device; wherein, after the authentication is completed, the second client can generate a shared key and The target device is accessed through a connection to the target device based on the shared secret key.
  • the first certificate includes a first signature
  • the first signature is obtained by signing the first information using the private key of the first client
  • the first information includes at least one of the following: an identification of the first client, an identification of the second client Identity, identification of the target device;
  • the first signature is used by the target device to confirm whether the second client's access to the target device is authorized by the first client.
  • the second client is authorized by the first client to access the target device; if the first signature is verified by the target device using the first client If the client's public key signature verification is incorrect, the second client's access to the target device is not authorized by the first client.
  • the communication unit 601 is used to send the public key of the second client to the server, and the public key of the second client is used by the server to generate the first certificate.
  • the communication unit 601 is configured to receive a third message sent by the first client, where the third message carries the first credential.
  • the third message also carries at least one of the following: the identification of the target device and the first password information; the identification of the target device is used by the second client to determine that the object to be connected is the target device; the first password information is Establish a connection between the second client and the target device.
  • the information carried in the third message is encrypted using the public key of the second client; alternatively, the information carried in the third message is not encrypted.
  • the device further includes: a decryption unit configured to use the second client's private key to decrypt the information carried in the third message when the information carried in the third message is encrypted using the public key of the second client. The information is decrypted, and the information carried in the third message is obtained after the decryption is successful.
  • a decryption unit configured to use the second client's private key to decrypt the information carried in the third message when the information carried in the third message is encrypted using the public key of the second client. The information is decrypted, and the information carried in the third message is obtained after the decryption is successful.
  • the establishment unit 602 is used to discover the target device and establish a physical connection with the target device; based on the physical connection, establish an application connection with the target device;
  • the authentication unit 603 is configured to send a first certificate to the target device during the process of establishing an application connection with the target device.
  • the first certificate is used by the target device to authenticate the second client.
  • the device further includes: a generating unit 604, configured to generate a shared key based on its own private key and the public key of the target device after the authentication is completed;
  • the communication unit 601 is used to access the target device through a connection with the target device based on the shared key.
  • Figure 7 is a schematic structural diagram of a terminal device 700 provided by an embodiment of the present application.
  • the terminal device may have the first client or the second client in the above solution.
  • the terminal device 700 shown in Figure 7 includes a processor 710.
  • the processor 710 can call and run a computer program from the memory to implement the method in the embodiment of the present application.
  • the terminal device 700 may also include a memory 720 .
  • the processor 710 can call and run the computer program from the memory 720 to implement the method in the embodiment of the present application.
  • the memory 720 may be a separate device independent of the processor 710 , or may be integrated into the processor 710 .
  • the terminal device 700 may also include a transceiver 730, and the processor 710 may control the transceiver 730 to communicate with other devices. Specifically, it may send information or data to other devices, or receive other devices. Information or data sent by the device.
  • the transceiver 730 may include a transmitter and a receiver.
  • the transceiver 730 may further include an antenna, and the number of antennas may be one or more.
  • the terminal device 700 may specifically include the first client of the embodiment of the present application, and the terminal device 700 may implement the corresponding processes implemented by the first client in the various methods of the embodiment of the present application. For simplicity, in This will not be described again.
  • the terminal device 700 may specifically include the second client of the embodiment of the present application, and the terminal device 700 may implement the corresponding processes implemented by the second client in the various methods of the embodiment of the present application. For simplicity, in This will not be described again.
  • FIG 8 is a schematic structural diagram of a chip according to an embodiment of the present application.
  • the chip 800 shown in Figure 8 includes a processor 810.
  • the processor 810 can call and run a computer program from the memory to implement the method in the embodiment of the present application.
  • the chip 800 may also include a memory 820 .
  • the processor 810 can call and run the computer program from the memory 820 to implement the method in the embodiment of the present application.
  • the memory 820 may be a separate device independent of the processor 810 , or may be integrated into the processor 810 .
  • the chip 800 may also include an input interface 830.
  • the processor 810 can control the input interface 830 to communicate with other devices or chips. Specifically, it can obtain information or data sent by other devices or chips.
  • the chip 800 may also include an output interface 840.
  • the processor 810 can control the output interface 840 to communicate with other devices or chips. Specifically, it can output information or data to other devices or chips.
  • the chip can be applied to the first client in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the first client in the various methods of the embodiment of the present application. For the sake of brevity, they will not be described here. Repeat.
  • the chip can be applied to the second client in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the second client in the various methods of the embodiment of the present application. For the sake of simplicity, they will not be described here. Repeat.
  • chips mentioned in the embodiments of this application may also be called system-on-chip, system-on-a-chip, system-on-chip or system-on-chip, etc.
  • the processor in the embodiment of the present application may be an integrated circuit chip and has signal processing capabilities.
  • each step of the above method embodiment can be completed through an integrated logic circuit of hardware in the processor or instructions in the form of software.
  • the above-mentioned processor can be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), an off-the-shelf programmable gate array (Field Programmable Gate Array, FPGA) or other available processors.
  • DSP Digital Signal Processor
  • ASIC Application Specific Integrated Circuit
  • FPGA Field Programmable Gate Array
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the method disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in this field.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electrically removable memory. Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory. Volatile memory may be Random Access Memory (RAM), which is used as an external cache.
  • RAM Random Access Memory
  • RAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Rate SDRAM Double Data Rate SDRAM
  • ESDRAM enhanced synchronous dynamic random access memory
  • Synchlink DRAM SLDRAM
  • Direct Rambus RAM Direct Rambus RAM
  • the memory in the embodiment of the present application can also be a static random access memory (static RAM, SRAM), a dynamic random access memory (dynamic RAM, DRAM), Synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection Dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM) and so on. That is, memories in embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.
  • Embodiments of the present application also provide a computer-readable storage medium for storing computer programs.
  • the computer-readable storage medium can be applied to the first client in the embodiment of the present application, and the computer program causes the computer to execute the corresponding processes implemented by the first client in the various methods of the embodiment of the present application, in order to It’s concise and I won’t go into details here.
  • the computer-readable storage medium can be applied to the second client in the embodiment of the present application, and the computer program causes the computer to execute the corresponding processes implemented by the second client in the various methods of the embodiment of the present application, in order to It’s concise and I won’t go into details here.
  • An embodiment of the present application also provides a computer program product, including computer program instructions.
  • the computer program product can be applied to the first client in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding processes implemented by the first client in the various methods of the embodiment of the present application.
  • the computer program instructions cause the computer to execute the corresponding processes implemented by the first client in the various methods of the embodiment of the present application.
  • the computer program product can be applied to the second client in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding processes implemented by the second client in the various methods of the embodiment of the present application.
  • the computer program instructions cause the computer to execute the corresponding processes implemented by the second client in the various methods of the embodiment of the present application.
  • An embodiment of the present application also provides a computer program.
  • the computer program can be applied to the first client in the embodiment of the present application.
  • the computer program When the computer program is run on the computer, it causes the computer to execute the corresponding steps implemented by the first client in each method of the embodiment of the present application. The process, for the sake of brevity, will not be repeated here.
  • the computer program can be applied to the second client in the embodiment of the present application.
  • the computer program When the computer program is run on the computer, it causes the computer to execute the corresponding steps implemented by the second client in the various methods of the embodiment of the present application. The process, for the sake of brevity, will not be repeated here.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory,) ROM, random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例提供一种设备权限配置方法及装置、终端设备，该方法包括：第一客户端获取第一凭证，并向第二客户端发送所述第一凭证，所述第一凭证为所述第二客户端获取第一证书的身份凭证，所述第一证书用于所述第二客户端在与目标设备建立连接的过程中进行与所述目标设备之间的认证；其中，在认证完成后，所述第二客户端能够生成共享密钥并基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。

Description

一种设备权限配置方法及装置、终端设备 技术领域
本申请实施例涉及物联网技术领域，具体涉及一种设备权限配置方法及装置、终端设备。
背景技术
物联网设备在接入网络之后，管理员设备会对该物联网设备进行配置，从而实现管理员设备对该物联网设备的管控。对于一个客户端来说，客户端想要对该物联网设备进行访问，必须通过管理员设备(即对该物联网设备进行配置的管理员设备)对客户端进行配置。然而，使用管理员设备对客户端进行配置的方式，对于临时分享物联网设备的访问权限的场景并不能提供很好的用户体验。
发明内容
本申请实施例提供一种设备权限配置方法及装置、终端设备、芯片、计算机可读存储介质、计算机程序产品、计算机程序。
本申请实施例提供的设备权限配置方法，包括：
第一客户端获取第一凭证，并向第二客户端发送所述第一凭证，所述第一凭证为所述第二客户端获取第一证书的身份凭证，所述第一证书用于所述第二客户端在与目标设备建立连接的过程中进行与所述目标设备之间的认证；其中，在认证完成后，所述第二客户端能够生成共享密钥并基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
本申请实施例提供的设备权限配置方法，包括：
第二客户端接收第一客户端发送的第一凭证，所述第一凭证为所述第二客户端获取第一证书的身份凭证；
所述第二客户端向服务器发送所述第一凭证，并接收所述服务器发送的第一证书，所述第一证书是在所述服务器验证所述第一凭证通过后发送的；
所述第二客户端发现目标设备，在与所述目标设备建立连接的过程中，使用所述第一证书进行所述第二客户端与所述目标设备之间的认证；其中，在认证完成后，所述第二客户端能够生成共享密钥并基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
本申请实施例提供的设备权限配置装置，应用于第一客户端，所述装置包括：
通信单元，用于获取第一凭证，并向第二客户端发送所述第一凭证，所述第一凭证为所述第二客户端获取第一证书的身份凭证，所述第一证书用于所述第二客户端在与目标设备建立连接的过程中进行与所述目标设备之间的认证；其中，在认证完成后，所述第二客户端能够生成共享密钥并基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
本申请实施例提供的设备权限配置装置，应用于第二客户端，所述装置包括：
通信单元，用于接收第一客户端发送的第一凭证，所述第一凭证为所述第二客户端获取第一证书的身份凭证；向服务器发送所述第一凭证，并接收所述服务器发送的第一证书，所述第一证书是在所述服务器验证所述第一凭证通过后发送的；
建立单元，用于发现目标设备，与所述目标设备建立连接；
认证单元，用于在与所述目标设备建立连接的过程中，使用所述第一证书进行所述第二客户端与所述目标设备之间的认证；其中，在认证完成后，所述第二客户端能够生成共享密钥并基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
本申请实施例提供的终端设备，包括处理器和存储器。该存储器用于存储计算机程序，该处理器用于调用并运行该存储器中存储的计算机程序，执行上述的设备权限配置方法。
本申请实施例提供的芯片，用于实现上述的设备权限配置方法。
具体地，该芯片包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有该芯片的设备执行上述的设备权限配置方法。
本申请实施例提供的计算机可读存储介质，用于存储计算机程序，该计算机程序使得计算机 执行上述的设备权限配置方法。
本申请实施例提供的计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行上述的设备权限配置方法。
本申请实施例提供的计算机程序，当其在计算机上运行时，使得计算机执行上述的设备权限配置方法。
通过上述技术方案，第一客户端为目标设备的主人(Owner)设备，第一客户端将第一凭证发送给第二客户端，从而第二客户端可以基于第一凭证获取到第一证书，通过该第一证书实现与目标设备之间的认证，在认证通过后，第二客户端能够基于与目标设备之间的连接访问目标设备。如此，实现了第一客户端将目标设备的访问权限分享给了第二客户端，这种访问权限分享方式适用于第一客户端将目标设备临时分享给第二客户端的场景，提高了用户体验。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是本申请实施例提供的通信系统示意图；
图2是本申请实施例提供的设备权限配置方法的流程示意图一；
图3是本申请实施例提供的设备权限配置方法的流程示意图二；
图4是本申请实施例提供的设备权限配置方法的流程示意图三；
图5是本申请实施例提供的设备权限配置装置的结构组成示意图一；
图6是本申请实施例提供的设备权限配置装置的结构组成示意图二；
图7是本申请实施例提供的一种终端设备示意性结构图；
图8是本申请实施例的芯片的示意性结构图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
为便于理解本申请实施例的技术方案，以下对本申请实施例的相关技术进行说明，以下相关技术作为可选方案与本申请实施例的技术方案可以进行任意结合，其均属于本申请实施例的保护范围。
物联网设备在接入网络之后，管理员设备会对该物联网设备进行配置，从而实现管理员设备对该物联网设备的管控，管理员设备也即是激活工具(Onboarding Tool，OBT)。在管理员设备对物联网设备进行配置的过程中，管理员设备需要配置物联网设备的主人标识(Owner ID)为管理员设备的设备标识(Device_ID)，另外，管理员设备还需要配置物联网设备的访问接入凭证，该访问接入凭证用于该物联网设备与其他设备建立连接时进行相互认证，作为示例，访问接入凭证可以是对称密钥、或非对称密钥、或证书等，通过相互认证后，该物联网设备与其他设备可以建立应用连接，进行互联互通操作。只有具有相同Owner ID的设备之间能够建立应用连接，进行互联互通操作。可见，对于一个客户端来说，客户端想要对该物联网设备进行访问，必须通过同一管理员设备(即对该物联网设备进行配置的管理员设备)对客户端进行配置。然而，使用管理员设备对客户端进行配置的方式，仅适用于长期分享物联网设备的访问权限的场景，对于临时分享物联网设备的访问权限的场景并不能提供很好的用户体验。以物联网设备为车进行举例，车的访问权限的分享是一种临时分享，例如车主(的客户端)可以将车的权限临时分享给家人、或朋友、或代驾(的客户端)，使用管理员设备对客户端进行配置的方式并不能提供很好的用户体验。
为此，提出了本申请实施例的以下技术方案。本申请实施例的技术方案，通过引入客户端之间的接口，实现了第一客户端将目标设备的访问权限分享给第二客户端，这种访问权限分享方式适用于第一客户端将目标设备临时分享给第二客户端的场景，提高了用户体验。
为便于理解本申请实施例的技术方案，以下通过具体实施例详述本申请的技术方案。以上相关技术作为可选方案与本申请实施例的技术方案可以进行任意结合，其均属于本申请实施例的保护范围。本申请实施例包括以下内容中的至少部分内容。
需要说明的是，本申请实施例中的“客户端”安装于终端设备上，作为示例，终端设备可以是 手机、平板电脑、可穿戴式设备等。
需要说明的是，本申请实施例中的“客户端”也可以称为“应用(APP)”。
需要说明的是，本申请实施例中的“服务器”也可以替换为其他名称，例如服务设备、管理设备，云平台等，只要能够实现本申请实施例的方案中描述的服务器的功能即可。
图1是本申请实施例提供的通信系统示意图，如图1所示，通信系统包括第一客户端101、第二客户端102、目标设备103以及服务器104，其中，第一客户端101是目标设备103的主人(Owner)设备(又称为管理员设备)，目标设备的主人通过第一客户端101可以对目标设备103进行管控。第二客户端102是有需求访问目标设备103的客户端。作为示例：目标设备可以是车、家电等物联网设备。第一客户端101为第二客户端102向服务器104申请第一凭证，将第一凭证发送给第二客户端102，从而第二客户端102可以基于第一凭证从服务器104获取到第一证书，通过该第一证书实现与目标设备103之间的认证，在认证通过后，第二客户端102能够基于与目标设备103之间的连接访问目标设备103。如此，实现了第一客户端将目标设备的访问权限分享给了第二客户端。
图2是本申请实施例提供的设备权限配置方法的流程示意图一，如图2所示，设备权限配置方法包括以下步骤：
步骤201：第一客户端获取第一凭证，并向第二客户端发送第一凭证；第二客户端接收第一客户端发送的第一凭证。
本申请实施例中，第一客户端是目标设备的主人(Owner)设备(又称为管理员设备)，目标设备的主人通过第一客户端可以对目标设备进行管控。第二客户端是有需求访问目标设备的客户端。作为示例：目标设备可以是车、家电等物联网设备。
在一些可选实施方式中，在步骤201之前，第一客户端对目标设备进行配置。这里，第一客户端配置目标设备的主人标识(Owner ID)为第一客户端的设备标识(Device_ID)。可选地，第一客户端还可以配置目标设备的其他信息，例如密码信息。第一客户端对目标设备进行配置后，第一客户端便成为了目标设备的主人设备，第一客户端可以对目标设备进行管控。
本申请实施例中，第一客户端想要将目标设备的访问权限分享给第二客户端，为此，第一客户端为第二客户端获取第一凭证，并向第二客户端发送第一凭证。这里，第一凭证为第二客户端获取第一证书的身份凭证。作为示例：第一凭证可以是令牌(token)。
在一些可选实施方式中，第一客户端可以通过以下方式获取第一凭证：第一客户端向服务器发送第一消息，第一消息用于请求服务器为第二客户端生成第一凭证；第一客户端接收服务器发送的第二消息，第二消息携带第一凭证。
在一些可选实施方式中，第一消息携带第一信息，第一信息包括以下至少之一：第一客户端的标识、第二客户端的标识、目标设备的标识；
第一客户端的标识用于服务器确定第一凭证的申请方为第一客户端；
第二客户端的标识用于服务器确定第一凭证的使用方为第二客户端；
目标设备的标识用于服务器确定第一凭证的使用方待连接的对象为目标设备。
这里，第一客户端的标识是指第一客户端的设备标识(Device_ID)或者应用标识(APP_ID)。第一客户端的设备标识(Device_ID)是指第一客户端所在的设备的标识。
这里，第二客户端的标识是指第二客户端的设备标识(Device_ID)或者应用标识(APP_ID)。第二客户端的设备标识(Device_ID)是指第二客户端所在的设备的标识。作为一种实现方式，第一客户端通过带外方式获取第二客户端的标识。例如：第一客户端通过扫描第二客户端的二维码来获取第二客户端的标识。又例如：第一客户端可以通过一个地址链接(如统一资源定位系统(Uniform Resource Locator，URL))来获取第二客户端的标识。
这里，目标设备的标识是指目标设备的设备标识。作为一种实现方式，第一客户端可以在配置目标设备的时候，获取目标设备的设备标识(Device_ID)。
在一些可选实施方式中，第一消息还携带第一签名，第一签名使用第一客户端的私钥对第一信息签名得到。
本申请实施例中，第一客户端获取第一凭证后，向第二客户端发送第一凭证。这里，第一凭证携带在第三消息中。即：第一客户端向第二客户端发送第三消息；第二客户端接收第一客户端发送的第三消息；第三消息携带第一凭证。
在一些可选实施方式中，第三消息还携带以下至少之一：目标设备的标识、第一密码信息；目标设备的标识用于第二客户端确定待连接的对象为目标设备；第一密码信息用于第二客户端与目标设备建立连接。
这里，可选地，第一密码信息包括以下至少之一：密码索引、密码。作为示例：密码索引可以是配对码索引(pincodeindex)，密码索引用于指示密码，换句话说，通过密码索引可以确定密码。作为示例：密码为配对码(pincode)。
在一些可选实施方式中，第三消息中携带的信息使用第二客户端的公钥进行加密；或者，第三消息中携带的信息未加密。作为一种实现方式，第一客户端通过带外方式获取第二客户端的公钥。例如：第一客户端通过扫描第二客户端的二维码来获取第二客户端的公钥。又例如：第一客户端可以通过一个地址链接(如URL)来获取第二客户端的公钥。作为另一种实现方式，第一客户端通过与第二客户端之间的接口来获取第二客户端的公钥。
作为一种实现方式，第三消息中携带的信息使用第二客户端的公钥进行加密的情况下，第二客户端使用第二客户端的私钥对第三消息中携带的信息进行解密，并在解密成功后获得第三消息中携带的信息。
本申请实施例中，第一客户端向第二客户端发送第三消息的方式可以但不局限于以下方式：
1)第一客户端可以通过与第二客户端之间的接口向第二客户端发送第三消息。
2)第一客户端可以通过带外方式向第二客户端发送第三消息。例如：第一客户端通过向第二客户端提供一个二维码或者一个地址链接(如URL)，使得第二客户端通过扫描二维码或者地址链接(如URL)获得第一客户端提供的第三消息。又例如：第一客户端通过服务器的转发向第二客户端提供第三消息。
步骤202：第二客户端向服务器发送第一凭证，并接收服务器发送的第一证书，第一证书是在服务器验证第一凭证通过后发送的。
本申请实施例中，第二客户端获取第一凭证后，向服务器发送第一凭证。服务器验证第一凭证通过后，为第二客户端生成第一证书，向第二客户端发送第一证书；第二客户端接收服务器发送的第一证书。
在一些可选实施方式中，第二客户端向服务器发送第二客户端的公钥，第二客户端的公钥用于服务器生成第一证书。
这里，第一证书用于第二客户端在与目标设备建立连接的过程中进行与目标设备之间的认证；其中，在认证通过后，第二客户端能够基于与目标设备之间的连接访问目标设备。第一证书也可以称为操作证书，即操作目标设备的证书。
在一些可选实施方式中，前述方案中的第一消息携带第一签名的情况下，由服务器生成的第一证书包含第一签名。
在一些可选实施方式中，第一客户端在确定第二客户端已成功获取第一证书的情况下，针对目标设备进行一些配置以及触发目标设备进入配对状态。
这里，第一客户端针对目标设备进行一些配置，可以包括：
第一客户端向目标设备发送第一配置信息，第一配置信息用于配置目标设备的以下至少之一：绑定信息、访问信息。绑定信息用于设定第二密码信息与第二客户端的标识之间的绑定关系；访问信息用于设定第二客户端能够访问目标设备的资源，即被授权后的第二客户端对目标设备的访问控制权限信息。
在一些可选实施方式中，绑定信息可以通过簇(cluster)来实现，作为示例，可以通过如下cluster来实现：“密码绑定簇(pin_binding cluster)”。绑定信息所设定的绑定关系用于目标设备确定与第二客户端建立连接时使用的第二密码信息。这里，第二密码信息用于目标设备与第二客户端建立连接。可选地，第二密码信息包括以下至少之一：密码索引、密码。作为示例：密码索引可以是配对码索引(pincodeindex)，密码索引用于指示密码，换句话说，通过密码索引可以确定密码。作为示例：密码为配对码(pincode)。
需要说明的是，第一客户端为第二客户端配置的第一密码信息，与第一客户端为目标设备配置的与第二客户端的标识具有绑定关系的第二密码信息是一致的，如此，当第二客户端与目标设备建立连接时，双方使用一致的密码信息进行匹配，并在匹配成功后建立连接。
在一些可选实施方式中，访问信息可以通过cluster来实现，作为示例，可以通过如下cluster来实现：“访问控制列表簇(ACL Cluster)”。访问信息所设定的资源是第二客户端在与目标设备建立连接后能够访问的资源。作为示例：第二客户端能够访问的资源通过访问控制列表(Access Control List，ACL)来指示，即通过ACL指示出目标设备的哪些资源能够被第二客户端访问和/或哪些资源不能够被第二客户端访问。
需要说明的是，第一客户端针对目标设备的上述配置也可以不在第二客户端获取第一证书之后 执行，而是在任意时间，如第一客户端作为管理员设备发起对目标设备进行配置时执行。换句话说，第一客户端作为主人(Owner)设备对目标设备进行配置的时候，如果为目标设备配置了绑定信息和/或访问信息，则在第二客户端获取第一证书之后，第一客户端不需要再为目标设备配置绑定信息和/或访问信息。
上述方案中，第一客户端向目标设备发送第一配置信息之前，第一客户端首先要建立与目标设备之间的连接，第一客户端基于与目标设备之间的连接向目标设备发送第一配置信息。这里，可选地，连接是指应用连接，应用连接是位于物理连接(也即底层连接)之上的连接，应用连接是在物理连接建立之后基于物理连接建立的，应用连接用于传输应用层信息，例如上述方案中的第一配置信息。
这里，第一客户端触发目标设备进行配对状态，可以包括：
第一客户端向目标设备发送第一指令，第一指令用于指示目标设备进入配对状态；其中，目标设备进入配对状态后，目标设备能够被第二客户端发现并与第二客户端建立连接。
上述方案中，第一客户端确定第二客户端已成功获取第一证书的方式可以但不局限于以下方式：
1)第一客户端接收到第二客户端发送的针对第三消息的应答消息，则确定第二客户端已成功获取第一证书。
2)第一客户端接收到服务器推送的第一证书的相关信息，则确定第二客户端已成功获取第一证书。这里，第一证书的相关信息可以是指示第一证书已下发给第二客户端的指示信息等。
3)第一客户端在发送第三消息后，启动一个计时器，当计时器超时，则确定第二客户端已成功获取第一证书。
4)第一客户端通过带外方式确定第二客户端已成功获取第一证书。例如：第一客户端可以通过扫描第二客户端的二维码或者通过一个地址链接(如URL)获得第一证书的相关信息，则确定第二客户端已成功获取第一证书。这里，第一证书的相关信息可以是指示第一证书已下发给第二客户端的指示信息等。
步骤203：第二客户端发现目标设备，在与目标设备建立连接的过程中，使用第一证书进行第二客户端与目标设备之间的认证；其中，在认证完成后，第二客户端能够生成共享密钥并基于共享密钥通过与目标设备之间的连接访问目标设备。
在一些可选实施方式中，目标设备与客户端之间的通信方式是蓝牙或其它短距离通信方式。不局限于此，目标设备与客户端之间的通信方式还可以是其他通信方式。
本申请实施例中，目标设备处于配置状态后发送广播包，第二客户端可以发现广播包从而发现目标设备。第二客户端发现目标设备后，建立与目标设备之间的物理连接(也即底层连接)；第二客户端基于物理连接(也即底层连接)，建立与目标设备之间的应用连接，在与目标设备建立应用连接的过程中，向目标设备发送第一证书，第一证书用于目标设备对第二客户端进行认证。在认证完成后，第二客户端能够基于与目标设备之间的应用连接访问目标设备。具体地，在认证完成后，第二客户端基于自身的私钥和目标设备的公钥生成共享密钥，并基于共享密钥通过与目标设备之间的连接访问目标设备。
这里，第二客户端在与目标设备建立应用连接的过程中，向目标设备发送第一证书，由于第一证书是基于第二客户端的公钥生成的，因此目标设备在获得第一证书后，可以从第一证书中获得第二客户端的公钥，如此完成对第二客户端的认证。同样，目标设备也会向第二客户端发送自身的证书(以下称为第二证书)，由于第二证书是基于目标设备的公钥生成的，因此第二客户端在获得第二证书后，可以从第二证书中获得目标设备的公钥，如此完成对目标设备的认证。需要指出的是，目标设备的第二证书可以是第一客户端为目标设备配置的。在目标设备对第二客户端认证完成后，第二客户端能够基于与目标设备之间的应用连接访问目标设备，同样，在第二客户端对目标设备认证完成后，目标设备能够基于与第二客户端之间的连接响应目标设备的访问。具体地，对于第二客户端来说，第二客户端利用自己的私钥和目标设备的公钥生成第一共享密钥，利用该第一共享密钥对访问请求进行加密，将加密后的访问请求发送给目标设备；目标设备利用自己的私钥和第二客户端的公钥生成第二共享密钥，利用该第二共享密钥对加密后的访问请求进行解密，并处理解密得到的访问请求。同样，对于目标设备来说，目标设备利用自己的私钥和第二客户端的公钥生成第二共享密钥，利用该第二共享密钥对访问响应进行加密，将加密后的访问响应发送给第二客户端；第二客户端利用自己的私钥和目标设备的公钥生成第一共享密钥，利用该第一共享密钥对访问响应进行解密，并处理解密得到的访问响应。作为示例，访问请求可以携带针对目标设备的控制指令。
在一些可选实施方式中，第一证书包含第一签名，第一签名使用第一客户端的私钥对第一信 息签名得到，第一信息包括以下至少之一：第一客户端的标识、第二客户端的标识、目标设备的标识；第一签名用于目标设备确认第二客户端访问目标设备是否经过第一客户端授权。
作为一种实现方式，目标设备接收第二客户端发送的第一证书后，使用第一客户端的公钥对第一证书中的第一签名进行验签，如果验签正确，则目标设备确认第二客户端对自身的访问是经过第一客户端授权的，如果验签错误，则目标设备确认第二客户端对自身的访问是未经过第一客户端授权的。
作为另一种实现方，目标设备接收第二客户端发送的第一证书后，使用第一客户端的公钥对第一证书中的第一签名进行验签，如果验签正确，则目标设备从第一签名中可以获得第一信息，目标设备可以根据第一信息中的第一客户端的标识、第二客户端的标识、目标设备的标识，确定第一客户端授权第二客户端对目标设备进行访问，也即目标设备可以确认第二客户端对自身的访问是经过第一客户端授权的。例如：第一信息中包括APP ID1、APP ID2、Device ID，目标设备根据第一信息可以确定APP ID1所标识的第一客户端授权APP ID2所标识的第二客户端对Device ID所标识的目标设备进行访问。
上述方案中，可选地，目标设备可以在与第一客户端进行相互认证的过程中获取第一客户端的公钥。例如：在目标设备与第一客户端相互认证的过程中，第一客户端向目标设备发送基于自身的公钥生成的证书，目标设备从该证书中获得第一客户端的公钥；同样，目标设备向第一客户端发送基于自身的公钥生成的证书，第一客户端从该证书中获得目标设备的公钥。
本申请实施例的技术方案，第一客户端为目标设备的主人(Owner)，第一客户端将第一凭证发送给第二客户端，从而第二客户端可以基于第一凭证获取到第一证书，通过该第一证书实现与目标设备之间的认证，在认证通过后，第二客户端能够基于与目标设备之间的连接访问目标设备。如此，实现了第一客户端将目标设备的访问权限分享给了第二客户端，这种访问权限分享方式适用于第一客户端将目标设备临时分享给第二客户端的场景，提高了用户体验。
图3是本申请实施例提供的设备权限配置方法的流程示意图二，图3中的“APP_A”对应于上述方案中的“第一客户端”，“APP_B”对应于上述方案中的“第二客户端”，“操作证书”对应于上述方案中的“第一证书”，“令牌(token)”对应于上述方案中的“第一凭证”，如图3所示，设备权限配置方法包括以下步骤：
步骤301：APP_A向服务器发送第一消息，第一消息携带以下至少之一：APP_A_ID、APP_B_ID、目标设备的ID。
这里，APP_A为目标设备的主人(Owner)设备，APP_A通过第一消息为APP_B申请一个访问服务器并获取操作证书的令牌。该令牌为APP_B访问服务器获取操作证书的身份凭证。
这里，第一消息携带以下至少之一：APP_A_ID、APP_B_ID、目标设备的ID。其中，APP_A_ID为APP_A的ID，APP_B_ID为APP_B的ID。
这里，APP_A通过带外方式获取APP_B_ID。例如：APP_A通过扫描APP_B的二维码来获取APP_B_ID。又例如：APP_A可以通过一个地址链接(如URL)来获取APP_B_ID。
这里，APP_A在配置目标设备的时候，获取目标设备的ID。
步骤302：服务器向APP_A发送第二消息，第二消息携带令牌。
这里，服务器接收到APP_A发送的第一消息后，为APP_B生成一个令牌，并将该令牌通过第二消息发送给APP_A。服务器可以记录APP_B_ID和令牌之间的对应关系。
步骤303：APP_A向APP_B发送第三消息，第三消息携带令牌。
在一些可选实施方式中，第三消息还携带以下至少之一：目标设备的ID、密码信息(如pincodeindex、pincode)。
这里，APP_A向APP_B发送第三消息的方式可以但不局限于以下方式：
1)APP_A可以通过与APP_B之间的接口向APP_B发送第三消息。
2)APP_A可以通过带外方式向APP_B发送第三消息。例如：APP_A通过向APP_B提供一个二维码或者一个地址链接(如URL)，使得APP_B通过扫描二维码或者地址链接(如URL)获得APP_A提供的第三消息。又例如：APP_A通过服务器的转发向APP_B提供第三消息。
步骤304：APP_B向服务器发送APP_B的公钥和令牌。
这里，服务器根据令牌对APP_B的身份进行认证，在认证通过后，根据APP_B的公钥生成一个操作证书。具体地，服务器在为APP_B生成令牌后，记录APP_B_ID和令牌之间的对应关系，根据该对应关系确定APP_B提供的令牌是否与APP_B_ID是对应的，如果对应，则确定APP_B的身份认证通过，如果不对应，则确定APP_B的身份认证不通过。在确定APP_B的身份认证通过后， 根据APP_B的公钥生成一个操作证书。
步骤305：服务器向APP_B发送操作证书。
步骤306：APP_A确定APP_B已成功获取操作证书。
这里，步骤306为可选步骤，可以执行步骤306或者也可以不执行步骤306。在执行步骤306的情况下，APP_A可以但不局限于通过以下方式确定APP_B已成功获取操作证书：
1)APP_A接收到APP_B发送的针对第三消息的应答消息，则确定APP_B已成功获取操作证书。
2)APP_A接收到服务器推送的操作证书的相关信息，则确定APP_B已成功获取操作证书。这里，操作证书的相关信息可以是指示操作证书已下发给APP_B的指示信息等。
3)APP_A在发送第三消息后，启动一个计时器，当计时器超时，则确定APP_B已成功获取操作证书。
4)APP_A通过带外方式确定APP_B已成功获取操作证书。例如：APP_A可以通过扫描APP_B的二维码或者通过一个地址链接(如URL)获得操作证书的相关信息，则确定APP_B已成功获取操作证书。这里，操作证书的相关信息可以是指示操作证书已下发给APP_B的指示信息等。
步骤307：APP_A与目标设备建立应用连接。
步骤308：APP_A基于与目标设备之间的应用连接配置目标设备的绑定信息和/或访问信息。
这里，绑定信息可以通过簇(cluster)来实现，作为示例，可以通过如下cluster来实现：“pin_binding cluster”。绑定信息用于设定密码信息(如pincodeindex、pincode)和APP_B_ID之间的绑定关系，绑定信息所设定的绑定关系用于目标设备确定与APP_B建立连接时使用的密码信息(如pincodeindex、pincode)。
需要说明的是，APP_A为APP_B配置的密码信息，与APP_A为目标设备配置的与APP_B_ID具有绑定关系的密码信息是一致的，如此，当APP_B与目标设备建立连接时，双方使用一致的密码信息进行匹配，并在匹配成功后建立连接。
这里，访问信息可以通过cluster来实现，作为示例，可以通过如下cluster来实现：“ACL Cluster”。访问信息所设定的资源是APP_B在与目标设备建立连接后能够访问的资源。作为示例：APP_B能够访问的资源通过ACL来指示，即通过ACL指示出目标设备的哪些资源能够被APP_B访问和/或哪些资源不能够被APP_B访问。
需要说明的是，步骤307和步骤308为可选步骤，可以执行步骤307和步骤308或者也可以不执行步骤307和步骤308。APP_A作为主人(Owner)设备对目标设备进行配置的时候，如果为目标设备配置了绑定信息和/或访问信息，则可以不执行步骤307和步骤308。
步骤309：APP_A向目标设备发送指令，指令用于指示目标设备进入配对状态。
这里，目标设备进入配对状态后，目标设备能够被APP_B发现并与APP_B建立连接。
步骤310：APP_B发现目标设备并与目标设备建立物理连接(也即底层连接)。
步骤311：APP_B基于与目标设备的物理连接建立与目标设备的应用连接，在建立应用连接的过程中，APP_B使用操作证书完成与目标设备之间的认证。在认证完成后，执行以下步骤312，否则，APP_B无法访问目标设备。
步骤312：APP_B基于应用连接访问目标设备。
对于上述步骤311和步骤312，APP_B在与目标设备建立应用连接的过程中，向目标设备发送操作证书(即第一证书)，由于第一证书是基于APP_B的公钥生成的，因此目标设备在获得第一证书后，可以从第一证书中获得APP_B的公钥，如此完成对APP_B的认证。同样，目标设备也会向APP_B发送自身的操作证书(以下称为第二证书)，由于第二证书是基于目标设备的公钥生成的，因此APP_B在获得第二证书后，可以从第二证书中获得目标设备的公钥，如此完成对目标设备的认证。需要指出的是，目标设备的第二证书可以是APP_A为目标设备配置的。在目标设备对APP_B认证完成后，APP_B能够基于与目标设备之间的应用连接访问目标设备，同样，在APP_B对目标设备认证完成后，目标设备能够基于与APP_B之间的连接响应目标设备的访问。具体地，对于APP_B来说，APP_B利用自己的私钥和目标设备的公钥生成第一共享密钥，利用该第一共享密钥对访问请求进行加密，将加密后的访问请求发送给目标设备；目标设备利用自己的私钥和APP_B的公钥生成第二共享密钥，利用该第二共享密钥对加密后的访问请求进行解密，并处理解密得到的访问请求。同样，对于目标设备来说，目标设备利用自己的私钥和APP_B的公钥生成第二共享密钥，利用该第二共享密钥对访问响应进行加密，将加密后的访问响应发送给APP_B；APP_B利用自己的私钥和目标设备的公钥生成第一共享密钥，利用该第一共享密钥对访问响应进行解密，并处理解密得到的访 问响应。作为示例，访问请求可以携带针对目标设备的控制指令。
图4是本申请实施例提供的设备权限配置方法的流程示意图三，图4中的“APP_A”对应于上述方案中的“第一客户端”，“APP_B”对应于上述方案中的“第二客户端”，“操作证书”对应于上述方案中的“第一证书”，“令牌(token)”对应于上述方案中的“第一凭证”，如图4所示，设备权限配置方法包括以下步骤：
步骤401：APP_A向服务器发送第一消息，第一消息携带以下至少之一：APP_A_ID、APP_B_ID、目标设备的ID、第一签名。
这里，APP_A为目标设备的主人(Owner)设备，APP_A通过第一消息为APP_B申请一个访问服务器并获取操作证书的令牌。该令牌为APP_B访问服务器获取操作证书的身份凭证。
这里，第一消息携带以下至少之一：APP_A_ID、APP_B_ID、目标设备的ID、第一签名。其中，APP_A_ID为APP_A的ID，APP_B_ID为APP_B的ID。第一签名是利用APP_A的私钥对以下至少一种信息进行签名得到：APP_A_ID、APP_B_ID、目标设备的ID。
这里，APP_A通过带外方式获取APP_B_ID。例如：APP_A通过扫描APP_B的二维码来获取APP_B_ID。又例如：APP_A可以通过一个地址链接(如URL)来获取APP_B_ID。
这里，APP_A在配置目标设备的时候，获取目标设备的ID。
这里，APP_A_ID、APP_B_ID、目标设备的ID这些信息可以通过一个令牌应用结构体(token_applicaiton Struct)来实现，作为示例，token_applicaiton Struct的内容如下：
{
target:目标设备的ID//操作证书用于访问该设备
Applicant:APP_A_ID//令牌的申请者
User:APP_B_ID//操作证书的使用者
}
进一步，APP_A使用APP_A.privatekey(即APP_A的私钥)对APP_A_ID、APP_B_ID、目标设备的ID这些信息进行签名，生成token_application_Sign(即第一签名)。可选地，在生成该token_application_Sign的过程中，还可以加入时间戳等其他信息。
步骤402：服务器向APP_A发送第二消息，第二消息携带令牌。
这里，服务器接收到APP_A发送的第一消息后，为APP_B生成一个令牌，并将该令牌通过第二消息发送给APP_A。服务器可以记录APP_B_ID和令牌之间的对应关系。
步骤403：APP_A与目标设备建立应用连接。
步骤404：APP_A基于与目标设备之间的应用连接配置目标设备的绑定信息和/或访问信息，以及指示目标设备进入配对状态。
这里，绑定信息可以通过簇(cluster)来实现，作为示例，可以通过如下cluster来实现“pin_binding cluster”。所述绑定信息用于设定密码信息(如pincodeindex、pincode)和APP_B_ID之间的绑定关系，绑定信息所设定的绑定关系用于目标设备确定与APP_B建立连接时使用的密码信息(如pincodeindex、pincode)。
需要说明的是，APP_A为APP_B配置的密码信息，与APP_A为目标设备配置的与APP_B_ID具有绑定关系的密码信息是一致的，如此，当APP_B与目标设备建立连接时，双方使用一致的密码信息进行匹配，并在匹配成功后建立连接。
这里，访问信息可以通过cluster来实现，作为示例，可以通过如下cluster来实现：“ACL Cluster”。访问信息所设定的资源是APP_B在与目标设备建立连接后能够访问的资源。作为示例：APP_B能够访问的资源通过ACL来指示，即通过ACL指示出目标设备的哪些资源能够被APP_B访问和/或哪些资源不能够被APP_B访问。
这里，APP_A向目标设备发送指令，指令用于指示目标设备进入配对状态。目标设备进入配对状态后，目标设备能够被APP_B发现并与APP_B建立连接。
需要说明的是，步骤403和步骤404为可选步骤，可以执行步骤403和步骤404或者也可以不执行步骤403和步骤404。APP_A作为主人(Owner)设备对目标设备进行配置的时候，如果为目标设备配置了绑定信息和/或访问信息，则可以不执行步骤403和步骤404。
步骤405：目标设备向APP_A发送200OK消息。
这里，200OK消息代表成功应答消息。
步骤406：APP_A向APP_B发送第三消息，第三消息携带令牌。
在一些可选实施方式中，第三消息还携带以下至少之一：目标设备的ID、密码信息(如 pincodeindex、pincode)。
在一些可选实施方式中，第三消息中携带的信息使用APP_B的公钥进行加密；或者，第三消息中携带的信息未加密。
作为一种实现方式，第三消息中携带的信息使用APP_B的公钥进行加密的情况下，APP_B使用APP_B的私钥对第三消息中携带的信息进行解密，并在解密成功后获得第三消息中携带的信息。
这里，APP_A向APP_B发送第三消息的方式可以但不局限于以下方式：
1)APP_A可以通过与APP_B之间的接口向APP_B发送第三消息。
2)APP_A可以通过带外方式向APP_B发送第三消息。例如：APP_A通过向APP_B提供一个二维码或者一个地址链接(如URL)，使得APP_B通过扫描二维码或者地址链接(如URL)获得APP_A提供的第三消息。又例如：APP_A通过服务器的转发向APP_B提供第三消息。
步骤407：APP_B向服务器发送APP_B的公钥和令牌。
这里，服务器根据令牌对APP_B的身份进行认证，在认证通过后，根据APP_B的公钥生成一个操作证书具体地，服务器在为APP_B生成令牌后，记录APP_B_ID和令牌之间的对应关系，根据该对应关系确定APP_B提供的令牌是否与APP_B_ID是对应的，如果对应，则确定APP_B的身份认证通过，如果不对应，则确定APP_B的身份认证不通过。在确定APP_B的身份认证通过后，根据APP_B的公钥生成一个操作证书。这里，前述方案中的第一消息携带第一签名的情况下，由服务器生成的操作证书包含第一签名。
步骤408：服务器向APP_B发送操作证书。
步骤409：APP_B发现目标设备并与目标设备建立物理连接。
这里，APP_B通过获取到的目标设备的ID可以识别出目标设备广播的配对消息，并与目标设备建立物理连接。
步骤410：APP_B基于与目标设备的物理连接建立与目标设备的应用连接，在建立应用连接的过程中，APP_B使用操作证书完成与目标设备之间的认证。
这里，在认证过程中，需要确定操作证书中携带的第一签名是否正确，也就是说，需要确认APP_B访问目标设备是否是经过APP_A授权的。若第一签名正确，则代表APP_B访问目标设备是经过APP_A授权的；若第一签名错误，则代表APP_B访问目标设备是未经过APP_A授权的。在认证完成，且第一签名正确的情况下，执行以下步骤411，否则，APP_B无法访问目标设备。
作为一种实现方式，目标设备接收APP_B发送的操作证书后，使用APP_A的公钥对操作证书中的第一签名进行验签，如果验签正确(即第一签名正确)，则目标设备确认APP_B对自身的访问是经过APP_A授权的，如果验签错误(即第一签名错误)，则目标设备确认APP_B对自身的访问是未经过APP_A授权的。
作为另一种实现方，目标设备接收APP_B发送的操作证书后，使用APP_A的公钥对操作证书中的第一签名进行验签，如果验签正确，则目标设备从第一签名中可以获得APP_A_ID、APP_B_ID、目标设备的ID这些信息，目标设备可以根据APP_A_ID、APP_B_ID、目标设备的ID，确定APP_A授权APP_B对目标设备进行访问，也即目标设备可以确认APP_B对自身的访问是经过APP_A授权的。
上述方案中，可选地，目标设备可以在与APP_A进行相互认证的过程中获取APP_A的公钥。例如：在目标设备与APP_A相互认证的过程中，APP_A向目标设备发送基于自身的公钥生成的证书，目标设备从该证书中获得APP_A的公钥；同样，目标设备向APP_A发送基于自身的公钥生成的证书，APP_A从该证书中获得目标设备的公钥。
步骤411：APP_B基于应用连接访问目标设备。
对于上述步骤410和步骤411，APP_B在与目标设备建立应用连接的过程中，向目标设备发送操作证书(即第一证书)，由于第一证书是基于APP_B的公钥生成的，因此目标设备在获得第一证书后，可以从第一证书中获得APP_B的公钥，如此完成对APP_B的认证。同样，目标设备也会向APP_B发送自身的操作证书(以下称为第二证书)，由于第二证书是基于目标设备的公钥生成的，因此APP_B在获得第二证书后，可以从第二证书中获得目标设备的公钥，如此完成对目标设备的认证。需要指出的是，目标设备的第二证书可以是APP_A为目标设备配置的。在目标设备对APP_B认证完成后，APP_B能够基于与目标设备之间的应用连接访问目标设备，同样，在APP_B对目标设备认证完成后，目标设备能够基于与APP_B之间的连接响应目标设备的访问。具体地，对于APP_B来说，APP_B利用自己的私钥和目标设备的公钥生成第一共享密钥，利用该第一共享密钥对访问请求进行加密，将加密后的访问请求发送给目标设备；目标设备利用自己的私钥和APP_B的公钥生成 第二共享密钥，利用该第二共享密钥对加密后的访问请求进行解密，并处理解密得到的访问请求。同样，对于目标设备来说，目标设备利用自己的私钥和APP_B的公钥生成第二共享密钥，利用该第二共享密钥对访问响应进行加密，将加密后的访问响应发送给APP_B；APP_B利用自己的私钥和目标设备的公钥生成第一共享密钥，利用该第一共享密钥对访问响应进行解密，并处理解密得到的访问响应。作为示例，访问请求可以携带针对目标设备的控制指令。
以上结合附图详细描述了本申请的优选实施方式，但是，本申请并不限于上述实施方式中的具体细节，在本申请的技术构思范围内，可以对本申请的技术方案进行多种简单变型，这些简单变型均属于本申请的保护范围。例如，在上述具体实施方式中所描述的各个具体技术特征，在不矛盾的情况下，可以通过任何合适的方式进行组合，为了避免不必要的重复，本申请对各种可能的组合方式不再另行说明。又例如，本申请的各种不同的实施方式之间也可以进行任意组合，只要其不违背本申请的思想，其同样应当视为本申请所公开的内容。又例如，在不冲突的前提下，本申请描述的各个实施例和/或各个实施例中的技术特征可以和现有技术任意的相互组合，组合之后得到的技术方案也应落入本申请的保护范围。
还应理解，在本申请的各种方法实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。此外，在本申请实施例中，术语“下行”、“上行”和“侧行”用于表示信号或数据的传输方向，其中，“下行”用于表示信号或数据的传输方向为从站点发送至小区的用户设备的第一方向，“上行”用于表示信号或数据的传输方向为从小区的用户设备发送至站点的第二方向，“侧行”用于表示信号或数据的传输方向为从用户设备1发送至用户设备2的第三方向。例如，“下行信号”表示该信号的传输方向为第一方向。另外，本申请实施例中，术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系。具体地，A和/或B可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
图5是本申请实施例提供的设备权限配置装置的结构组成示意图一，应用于第一客户端，如图5所示，设备权限配置装置包括：
通信单元501，用于获取第一凭证，并向第二客户端发送第一凭证，第一凭证为第二客户端获取第一证书的身份凭证，第一证书用于第二客户端在与目标设备建立连接的过程中进行与目标设备之间的认证；其中，在认证完成后，第二客户端能够生成共享密钥并基于共享密钥通过与目标设备之间的连接访问目标设备。
在一些实施方式中，通信单元501，用于向服务器发送第一消息，第一消息用于请求服务器为第二客户端生成第一凭证；接收服务器发送的第二消息，第二消息携带第一凭证。
在一些实施方式中，第一消息携带第一信息，第一信息包括以下至少之一：第一客户端的标识、第二客户端的标识、目标设备的标识；
第一客户端的标识用于服务器确定第一凭证的申请方为所述第一客户端；
第二客户端的标识用于服务器确定第一凭证的使用方为所述第二客户端；
目标设备的标识用于服务器确定第一凭证的使用方待连接的对象为目标设备。
在一些实施方式中，第一消息还携带第一签名，第一签名使用第一客户端的私钥对第一信息签名得到。
在一些实施方式中，第一消息携带第一签名的情况下，由服务器生成的第一证书包含第一签名。
在一些实施方式中，通信单元501，用于向第二客户端发送第三消息，第三消息携带第一凭证。
在一些实施方式中，第三消息还携带以下至少之一：目标设备的标识、第一密码信息；
目标设备的标识用于第二客户端确定待连接的对象为目标设备；
第一密码信息用于第二客户端与目标设备建立连接。
在一些实施方式中，第三消息中携带的信息使用第二客户端的公钥进行加密；或者，第三消息中携带的信息未加密。
在一些实施方式中，装置还包括：配置单元502，用于生成第一配置信息；
通信单元501，还用于向目标设备发送第一配置信息，第一配置信息用于配置目标设备的以下至少之一：
绑定信息，绑定信息用于设定第二密码信息与第二客户端的标识之间的绑定关系；
访问信息，访问信息用于设定第二客户端能够访问目标设备的资源。
在一些实施方式中，绑定关系用于目标设备确定与第二客户端建立连接时使用的第二密码信息。
在一些实施方式中，装置还包括：建立单元503，用于建立与目标设备之间的连接；
通信单元501，用于基于与目标设备之间的连接向目标设备发送第一配置信息。
在一些实施方式中，密码信息包括以下至少之一：密码索引、密码。
在一些实施方式中，通信单元501，用于向目标设备发送第一指令，第一指令用于指示目标设备进入配对状态；其中，目标设备进入配对状态后，目标设备能够被第二客户端发现并与第二客户端建立连接。
本领域技术人员应当理解，本申请实施例的上述设备权限配置装置的相关描述可以参照本申请实施例的设备权限配置方法的相关描述进行理解。
图6是本申请实施例提供的设备权限配置装置的结构组成示意图二，应用于第二客户端，如图6所示，设备权限配置装置包括：
通信单元601，用于接收第一客户端发送的第一凭证，第一凭证为第二客户端获取第一证书的身份凭证；向服务器发送第一凭证，并接收服务器发送的第一证书，第一证书是在服务器验证第一凭证通过后发送的；
建立单元602，用于发现目标设备，与目标设备建立连接；
认证单元603，用于在与目标设备建立连接的过程中，使用第一证书进行第二客户端与目标设备之间的认证；其中，在认证完成后，第二客户端能够生成共享密钥并基于共享密钥通过与目标设备之间的连接访问所述目标设备。
在一些实施方式中，第一证书包含第一签名，第一签名使用第一客户端的私钥对第一信息签名得到，第一信息包括以下至少之一：第一客户端的标识、第二客户端的标识、目标设备的标识；
第一签名用于目标设备确认第二客户端访问目标设备是否经过第一客户端授权。
在一些实施方式中，若第一签名被目标设备使用第一客户端的公钥验签正确，则第二客户端访问目标设备经过第一客户端授权；若第一签名被目标设备使用第一客户端的公钥验签错误，则第二客户端访问目标设备未经过第一客户端授权。
在一些实施方式中，通信单元601，用于向服务器发送第二客户端的公钥，第二客户端的公钥用于服务器生成第一证书。
在一些实施方式中，通信单元601，用于接收第一客户端发送的第三消息，第三消息携带第一凭证。
在一些实施方式中，第三消息还携带以下至少之一：目标设备的标识、第一密码信息；目标设备的标识用于第二客户端确定待连接的对象为目标设备；第一密码信息用于第二客户端与目标设备建立连接。
在一些实施方式中，第三消息中携带的信息使用第二客户端的公钥进行加密；或者，第三消息中携带的信息未加密。
在一些实施方式中，装置还包括：解密单元，用于在第三消息中携带的信息使用第二客户端的公钥进行加密的情况下，使用第二客户端的私钥对第三消息中携带的信息进行解密，并在解密成功后获得第三消息中携带的信息。
在一些实施方式中，建立单元602，用于发现目标设备，建立与目标设备之间的物理连接；基于物理连接，建立与目标设备之间的应用连接；
认证单元603，用于在与目标设备建立应用连接的过程中，向目标设备发送第一证书，第一证书用于目标设备对第二客户端进行认证。
在一些实施方式中，所述装置还包括：生成单元604，用于在认证完成后，基于自身的私钥和目标设备的公钥生成共享密钥；
通信单元601，用于基于共享密钥通过与目标设备之间的连接访问目标设备。
本领域技术人员应当理解，本申请实施例的上述设备权限配置装置的相关描述可以参照本申请实施例的设备权限配置方法的相关描述进行理解。
图7是本申请实施例提供的一种终端设备700示意性结构图。该终端设备可以具有上述方案中的第一客户端或者第二客户端。图7所示的终端设备700包括处理器710，处理器710可以从存储器中调用并运行计算机程序，以实现本申请实施例中的方法。
可选地，如图7所示，终端设备700还可以包括存储器720。其中，处理器710可以从存储器720中调用并运行计算机程序，以实现本申请实施例中的方法。
其中，存储器720可以是独立于处理器710的一个单独的器件，也可以集成在处理器710中。
可选地，如图7所示，终端设备700还可以包括收发器730，处理器710可以控制该收发器730与其他设备进行通信，具体地，可以向其他设备发送信息或数据，或接收其他设备发送的信息或数 据。
其中，收发器730可以包括发射机和接收机。收发器730还可以进一步包括天线，天线的数量可以为一个或多个。
可选地，该终端设备700具体可包括本申请实施例的第一客户端，并且该终端设备700可以实现本申请实施例的各个方法中由第一客户端实现的相应流程，为了简洁，在此不再赘述。
可选地，该终端设备700具体可包括本申请实施例的第二客户端，并且该终端设备700可以实现本申请实施例的各个方法中由第二客户端实现的相应流程，为了简洁，在此不再赘述。
图8是本申请实施例的芯片的示意性结构图。图8所示的芯片800包括处理器810，处理器810可以从存储器中调用并运行计算机程序，以实现本申请实施例中的方法。
可选地，如图8所示，芯片800还可以包括存储器820。其中，处理器810可以从存储器820中调用并运行计算机程序，以实现本申请实施例中的方法。
其中，存储器820可以是独立于处理器810的一个单独的器件，也可以集成在处理器810中。
可选地，该芯片800还可以包括输入接口830。其中，处理器810可以控制该输入接口830与其他设备或芯片进行通信，具体地，可以获取其他设备或芯片发送的信息或数据。
可选地，该芯片800还可以包括输出接口840。其中，处理器810可以控制该输出接口840与其他设备或芯片进行通信，具体地，可以向其他设备或芯片输出信息或数据。
可选地，该芯片可应用于本申请实施例中的第一客户端，并且该芯片可以实现本申请实施例的各个方法中由第一客户端实现的相应流程，为了简洁，在此不再赘述。
可选地，该芯片可应用于本申请实施例中的第二客户端，并且该芯片可以实现本申请实施例的各个方法中由第二客户端实现的相应流程，为了简洁，在此不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片，系统芯片，芯片系统或片上系统芯片等。
应理解，本申请实施例的处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
应理解，上述存储器为示例性但不是限制性说明，例如，本申请实施例中的存储器还可以是静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synch link DRAM，SLDRAM)以及直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)等等。也就是说，本申请实施例中的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本申请实施例还提供了一种计算机可读存储介质，用于存储计算机程序。
可选的，该计算机可读存储介质可应用于本申请实施例中的第一客户端，并且该计算机程序使得计算机执行本申请实施例的各个方法中由第一客户端实现的相应流程，为了简洁，在此不再赘述。
可选地，该计算机可读存储介质可应用于本申请实施例中的第二客户端，并且该计算机程序使得计算机执行本申请实施例的各个方法中由第二客户端实现的相应流程，为了简洁，在此不再赘述。
本申请实施例还提供了一种计算机程序产品，包括计算机程序指令。
可选的，该计算机程序产品可应用于本申请实施例中的第一客户端，并且该计算机程序指令使得计算机执行本申请实施例的各个方法中由第一客户端实现的相应流程，为了简洁，在此不再赘述。
可选地，该计算机程序产品可应用于本申请实施例中的第二客户端，并且该计算机程序指令使得计算机执行本申请实施例的各个方法中由第二客户端实现的相应流程，为了简洁，在此不再赘述。
本申请实施例还提供了一种计算机程序。
可选的，该计算机程序可应用于本申请实施例中的第一客户端，当该计算机程序在计算机上运行时，使得计算机执行本申请实施例的各个方法中由第一客户端实现的相应流程，为了简洁，在此不再赘述。
可选地，该计算机程序可应用于本申请实施例中的第二客户端，当该计算机程序在计算机上运行时，使得计算机执行本申请实施例的各个方法中由第二客户端实现的相应流程，为了简洁，在此不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，)ROM、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应所述以权利要求的保护范围为准。

Claims (49)

  1. 一种设备权限配置方法，所述方法包括：
    第一客户端获取第一凭证，并向第二客户端发送所述第一凭证，所述第一凭证为所述第二客户端获取第一证书的身份凭证，所述第一证书用于所述第二客户端在与目标设备建立连接的过程中进行与所述目标设备之间的认证；其中，在认证完成后，所述第二客户端能够生成共享密钥并基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
  2. 根据权利要求1所述的方法，其中，所述第一客户端获取第一凭证，包括：
    所述第一客户端向服务器发送第一消息，所述第一消息用于请求所述服务器为第二客户端生成第一凭证；
    所述第一客户端接收所述服务器发送的第二消息，所述第二消息携带第一凭证。
  3. 根据权利要求2所述的方法，其中，所述第一消息携带第一信息，所述第一信息包括以下至少之一：所述第一客户端的标识、所述第二客户端的标识、所述目标设备的标识；
    所述第一客户端的标识用于所述服务器确定所述第一凭证的申请方为所述第一客户端；
    所述第二客户端的标识用于所述服务器确定所述第一凭证的使用方为所述第二客户端；
    所述目标设备的标识用于所述服务器确定所述第一凭证的使用方待连接的对象为所述目标设备。
  4. 根据权利要求3所述的方法，其中，所述第一消息还携带第一签名，所述第一签名使用所述第一客户端的私钥对所述第一信息签名得到。
  5. 根据权利要求4所述的方法，其中，所述第一消息携带所述第一签名的情况下，由所述服务器生成的所述第一证书包含所述第一签名。
  6. 根据权利要求1至5中任一项所述的方法，其中，所述向第二客户端发送所述第一凭证，包括：
    向第二客户端发送第三消息，所述第三消息携带所述第一凭证。
  7. 根据权利要求6所述的方法，其中，所述第三消息还携带以下至少之一：所述目标设备的标识、第一密码信息；
    所述目标设备的标识用于所述第二客户端确定待连接的对象为所述目标设备；
    所述第一密码信息用于所述第二客户端与目标设备建立连接。
  8. 根据权利要求6或7所述的方法，其中，
    所述第三消息中携带的信息使用所述第二客户端的公钥进行加密；或者，
    所述第三消息中携带的信息未加密。
  9. 根据权利要求1至8中任一项所述的方法，其中，所述方法还包括：
    所述第一客户端向所述目标设备发送第一配置信息，所述第一配置信息用于配置所述目标设备的以下至少之一：
    绑定信息，所述绑定信息用于设定第二密码信息与所述第二客户端的标识之间的绑定关系；
    访问信息，所述访问信息用于设定所述第二客户端能够访问所述目标设备的资源。
  10. 根据权利要求9所述的方法，其中，所述绑定关系用于所述目标设备确定与所述第二客户端建立连接时使用的第二密码信息。
  11. 根据权利要求9或10所述的方法，其中，
    所述第一客户端向所述目标设备发送第一配置信息之前，所述方法还包括：所述第一客户端建立与所述目标设备之间的连接；
    所述第一客户端向所述目标设备发送第一配置信息，包括：所述第一客户端基于与所述目标设备之间的连接向所述目标设备发送第一配置信息。
  12. 根据权利要求1至11中任一项所述的方法，其中，所述方法还包括：
    所述第一客户端向所述目标设备发送第一指令，所述第一指令用于指示所述目标设备进入配对状态；其中，所述目标设备进入配对状态后，所述目标设备能够被所述第二客户端发现并与所述第二客户端建立连接。
  13. 一种设备权限配置方法，所述方法包括：
    第二客户端接收第一客户端发送的第一凭证，所述第一凭证为所述第二客户端获取第一证书 的身份凭证；
    所述第二客户端向服务器发送所述第一凭证，并接收所述服务器发送的第一证书，所述第一证书是在所述服务器验证所述第一凭证通过后发送的；
    所述第二客户端发现目标设备，在与所述目标设备建立连接的过程中，使用所述第一证书进行所述第二客户端与所述目标设备之间的认证；其中，在认证完成后，所述第二客户端能够生成共享密钥基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
  14. 根据权利要求13所述的方法，其中，所述第一证书包含第一签名，所述第一签名使用所述第一客户端的私钥对第一信息签名得到，所述第一信息包括以下至少之一：所述第一客户端的标识、所述第二客户端的标识、所述目标设备的标识；
    所述第一签名用于所述目标设备确认所述第二客户端访问所述目标设备是否经过所述第一客户端授权。
  15. 根据权利要求14所述的方法，其中，
    若所述第一签名被所述目标设备使用所述第一客户端的公钥验签正确，则所述第二客户端访问所述目标设备经过所述第一客户端授权；
    若所述第一签名被所述目标设备使用所述第一客户端的公钥验签错误，则所述第二客户端访问所述目标设备未经过所述第一客户端授权。
  16. 根据权利要求13至15中任一项所述的方法，其中，所述方法还包括：
    所述第二客户端向服务器发送所述第二客户端的公钥，所述第二客户端的公钥用于所述服务器生成所述第一证书。
  17. 根据权利要求13至16中任一项所述的方法，其中，所述第二客户端接收第一客户端发送的第一凭证，包括：
    第二客户端接收第一客户端发送的第三消息，所述第三消息携带所述第一凭证。
  18. 根据权利要求17所述的方法，其中，所述第三消息还携带以下至少之一：所述目标设备的标识、第一密码信息；
    所述目标设备的标识用于所述第二客户端确定待连接的对象为所述目标设备；
    所述第一密码信息用于所述第二客户端与目标设备建立连接。
  19. 根据权利要求17或18所述的方法，其中，
    所述第三消息中携带的信息使用所述第二客户端的公钥进行加密；或者，
    所述第三消息中携带的信息未加密。
  20. 根据权利要求19所述的方法，其中，所述第三消息中携带的信息使用所述第二客户端的公钥进行加密的情况下，所述方法还包括：
    所述第二客户端使用所述第二客户端的私钥对所述第三消息中携带的信息进行解密，并在解密成功后获得所述第三消息中携带的信息。
  21. 根据权利要求13至20中任一项所述的方法，其中，所述第二客户端发现目标设备，在与所述目标设备建立连接的过程中，使用所述第一证书进行所述第二客户端与所述目标设备之间的认证，包括：
    所述第二客户端发现目标设备，建立与所述目标设备之间的物理连接；
    所述第二客户端基于所述物理连接，建立与所述目标设备之间的应用连接，在与所述目标设备建立应用连接的过程中，向所述目标设备发送所述第一证书，所述第一证书用于所述目标设备对所述第二客户端进行认证。
  22. 根据权利要求13至21中任一项所述的方法，其中，所述方法还包括：
    在认证完成后，所述第二客户端基于自身的私钥和所述目标设备的公钥生成共享密钥，并基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
  23. 一种设备权限配置装置，应用于第一客户端，所述装置包括：
    通信单元，用于获取第一凭证，并向第二客户端发送所述第一凭证，所述第一凭证为所述第二客户端获取第一证书的身份凭证，所述第一证书用于所述第二客户端在与目标设备建立连接的过程中进行与所述目标设备之间的认证；其中，在认证完成后，所述第二客户端能够生成共享密钥并基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
  24. 根据权利要求23所述的装置，其中，所述通信单元，用于向服务器发送第一消息，所述第一消息用于请求所述服务器为第二客户端生成第一凭证；接收所述服务器发送的第二消息，所述第二消息携带第一凭证。
  25. 根据权利要求24所述的装置，其中，所述第一消息携带第一信息，所述第一信息包括以下至少之一：所述第一客户端的标识、所述第二客户端的标识、所述目标设备的标识；
    所述第一客户端的标识用于所述服务器确定所述第一凭证的申请方为所述第一客户端；
    所述第二客户端的标识用于所述服务器确定所述第一凭证的使用方为所述第二客户端；
    所述目标设备的标识用于所述服务器确定所述第一凭证的使用方待连接的对象为所述目标设备。
  26. 根据权利要求25所述的装置，其中，所述第一消息还携带第一签名，所述第一签名使用所述第一客户端的私钥对所述第一信息签名得到。
  27. 根据权利要求26所述的装置，其中，所述第一消息携带所述第一签名的情况下，由所述服务器生成的所述第一证书包含所述第一签名。
  28. 根据权利要求23至27中任一项所述的装置，其中，所述通信单元，用于向第二客户端发送第三消息，所述第三消息携带所述第一凭证。
  29. 根据权利要求28所述的装置，其中，所述第三消息还携带以下至少之一：所述目标设备的标识、第一密码信息；
    所述目标设备的标识用于所述第二客户端确定待连接的对象为所述目标设备；
    所述第一密码信息用于所述第二客户端与目标设备建立连接。
  30. 根据权利要求28或29所述的装置，其中，
    所述第三消息中携带的信息使用所述第二客户端的公钥进行加密；或者，
    所述第三消息中携带的信息未加密。
  31. 根据权利要求23至30中任一项所述的装置，其中，
    所述装置还包括：配置单元，用于生成第一配置信息；
    所述通信单元，还用于向所述目标设备发送第一配置信息，所述第一配置信息用于配置所述目标设备的以下至少之一：
    绑定信息，所述绑定信息用于设定第二密码信息与所述第二客户端的标识之间的绑定关系；
    访问信息，所述访问信息用于设定所述第二客户端能够访问所述目标设备的资源。
  32. 根据权利要求31所述的装置，其中，所述绑定关系用于所述目标设备确定与所述第二客户端建立连接时使用的第二密码信息。
  33. 根据权利要求31或32所述的装置，其中，
    所述装置还包括：建立单元，用于建立与所述目标设备之间的连接；
    所述通信单元，用于基于与所述目标设备之间的连接向所述目标设备发送第一配置信息。
  34. 根据权利要求23至33中任一项所述的装置，其中，所述通信单元，用于向所述目标设备发送第一指令，所述第一指令用于指示所述目标设备进入配对状态；其中，所述目标设备进入配对状态后，所述目标设备能够被所述第二客户端发现并与所述第二客户端建立连接。
  35. 一种设备权限配置装置，应用于第二客户端，所述装置包括：
    通信单元，用于接收第一客户端发送的第一凭证，所述第一凭证为所述第二客户端获取第一证书的身份凭证；向服务器发送所述第一凭证，并接收所述服务器发送的第一证书，所述第一证书是在所述服务器验证所述第一凭证通过后发送的；
    建立单元，用于发现目标设备，与所述目标设备建立连接；
    认证单元，用于在与所述目标设备建立连接的过程中，使用所述第一证书进行所述第二客户端与所述目标设备之间的认证；其中，在认证完成后，所述第二客户端能够生成共享密钥并基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
  36. 根据权利要求35所述的装置，其中，所述第一证书包含第一签名，所述第一签名使用所述第一客户端的私钥对第一信息签名得到，所述第一信息包括以下至少之一：所述第一客户端的标识、所述第二客户端的标识、所述目标设备的标识；
    所述第一签名用于所述目标设备确认所述第二客户端访问所述目标设备是否经过所述第一客户端授权。
  37. 根据权利要求36所述的装置，其中，
    若所述第一签名被所述目标设备使用所述第一客户端的公钥验签正确，则所述第二客户端访问所述目标设备经过所述第一客户端授权；
    若所述第一签名被所述目标设备使用所述第一客户端的公钥验签错误，则所述第二客户端访问所述目标设备未经过所述第一客户端授权。
  38. 根据权利要求35至37中任一项所述的装置，其中，所述通信单元，用于向服务器发送所述第二客户端的公钥，所述第二客户端的公钥用于所述服务器生成所述第一证书。
  39. 根据权利要求35至38中任一项所述的装置，其中，所述通信单元，用于接收第一客户端发送的第三消息，所述第三消息携带所述第一凭证。
  40. 根据权利要求39所述的装置，其中，所述第三消息还携带以下至少之一：所述目标设备的标识、第一密码信息；
    所述目标设备的标识用于所述第二客户端确定待连接的对象为所述目标设备；
    所述第一密码信息用于所述第二客户端与目标设备建立连接。
  41. 根据权利要求39或40所述的装置，其中，
    所述第三消息中携带的信息使用所述第二客户端的公钥进行加密；或者，
    所述第三消息中携带的信息未加密。
  42. 根据权利要求41所述的装置，其中，所述装置还包括：解密单元，用于在所述第三消息中携带的信息使用所述第二客户端的公钥进行加密的情况下，使用所述第二客户端的私钥对所述第三消息中携带的信息进行解密，并在解密成功后获得所述第三消息中携带的信息。
  43. 根据权利要求35至42中任一项所述的装置，其中，
    所述建立单元，用于发现目标设备，建立与所述目标设备之间的物理连接；基于所述物理连接，建立与所述目标设备之间的应用连接；
    所述认证单元，用于在与所述目标设备建立应用连接的过程中，向所述目标设备发送所述第一证书，所述第一证书用于所述目标设备对所述第二客户端进行认证。
  44. 根据权利要求35至43中任一项所述的装置，其中，
    所述装置还包括：生成单元，用于在认证完成后，基于自身的私钥和所述目标设备的公钥生成共享密钥；
    所述通信单元，用于基于所述共享密钥通过与所述目标设备之间的连接访问所述目标设备。
  45. 一种终端设备，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行如权利要求1至12中任一项所述的方法，或者权利要求13至22中任一项所述的方法。
  46. 一种芯片，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如权利要求1至12中任一项所述的方法，或者权利要求13至22中任一项所述的方法。
  47. 一种计算机可读存储介质，用于存储计算机程序，所述计算机程序使得计算机执行如权利要求1至12中任一项所述的方法，或者权利要求13至22中任一项所述的方法。
  48. 一种计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行如权利要求1至12中任一项所述的方法，或者权利要求13至22中任一项所述的方法。
  49. 一种计算机程序，所述计算机程序使得计算机执行如权利要求1至12中任一项所述的方法，或者权利要求13至22中任一项所述的方法。
PCT/CN2022/099398 2022-06-17 2022-06-17 一种设备权限配置方法及装置、终端设备 WO2023240587A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/099398 WO2023240587A1 (zh) 2022-06-17 2022-06-17 一种设备权限配置方法及装置、终端设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/099398 WO2023240587A1 (zh) 2022-06-17 2022-06-17 一种设备权限配置方法及装置、终端设备

Publications (1)

Publication Number Publication Date
WO2023240587A1 true WO2023240587A1 (zh) 2023-12-21

Family

ID=89192853

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/099398 WO2023240587A1 (zh) 2022-06-17 2022-06-17 一种设备权限配置方法及装置、终端设备

Country Status (1)

Country Link
WO (1) WO2023240587A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118101350A (zh) * 2024-04-26 2024-05-28 中国人民解放军总医院第一医学中心 一种监测生命体征的穿戴设备和控制方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107846390A (zh) * 2016-09-21 2018-03-27 阿里巴巴集团控股有限公司 应用程序的认证方法及装置
CN109788005A (zh) * 2017-11-10 2019-05-21 中兴通讯股份有限公司 设备控制权限共享方法、装置、系统及计算机存储介质
CN111970306A (zh) * 2020-08-31 2020-11-20 Oppo广东移动通信有限公司 权限认证方法、服务器、客户端及存储介质
WO2021035740A1 (zh) * 2019-08-30 2021-03-04 Oppo广东移动通信有限公司 访问控制方法、服务器、访问设备及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107846390A (zh) * 2016-09-21 2018-03-27 阿里巴巴集团控股有限公司 应用程序的认证方法及装置
CN109788005A (zh) * 2017-11-10 2019-05-21 中兴通讯股份有限公司 设备控制权限共享方法、装置、系统及计算机存储介质
WO2021035740A1 (zh) * 2019-08-30 2021-03-04 Oppo广东移动通信有限公司 访问控制方法、服务器、访问设备及存储介质
CN111970306A (zh) * 2020-08-31 2020-11-20 Oppo广东移动通信有限公司 权限认证方法、服务器、客户端及存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118101350A (zh) * 2024-04-26 2024-05-28 中国人民解放军总医院第一医学中心 一种监测生命体征的穿戴设备和控制方法

Similar Documents

Publication Publication Date Title
US11777936B2 (en) Friend key sharing
EP3723399A1 (en) Identity verification method and apparatus
WO2019041802A1 (zh) 基于服务化架构的发现方法及装置
WO2017150270A1 (ja) 通信システム、ハードウェアセキュリティモジュール、端末装置、通信方法、及びプログラム
JP2008099267A (ja) ネットワーク内で無線端末と設備との間のセッションを保護する方法
WO2021109963A1 (zh) 初始安全配置方法、安全模块及终端
CN108809907B (zh) 一种证书请求消息发送方法、接收方法和装置
WO2021120924A1 (zh) 一种证书申请方法及设备
RU2685975C2 (ru) Обеспечение безопасности связи с расширенными мультимедийными платформами
WO2021109967A1 (zh) 初始配置方法及终端设备
WO2023241176A1 (zh) 通信方法、装置、设备、存储介质及程序产品
WO2023030009A1 (zh) 智能设备的跨平台绑定方法、系统及相关设备
WO2023030014A1 (zh) 智能设备的绑定方法、系统及相关设备
CN112449323A (zh) 一种通信方法、装置和系统
WO2023240587A1 (zh) 一种设备权限配置方法及装置、终端设备
JP2024501326A (ja) アクセス制御方法、装置、ネットワーク側機器、端末及びブロックチェーンノード
WO2022041151A1 (zh) 设备验证方法、设备和云端
US20230327869A1 (en) Authentication method and apparatus
KR20190078154A (ko) 차량용 통합 인증 장치 및 방법
WO2023207113A1 (zh) 一种设备互联安全认证系统、方法、装置、服务器及介质
JP7312279B2 (ja) モバイルネットワークアクセスシステム、方法、記憶媒体及び電子機器
WO2022094936A1 (zh) 接入方法、设备和云平台设备
WO2016176902A1 (zh) 一种终端认证方法、管理终端及申请终端
CN113535852A (zh) 基于区块链的文件处理方法、文件访问方法、装置及系统
WO2024016124A1 (zh) 一种设备配置方法及装置、通信设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22946276

Country of ref document: EP

Kind code of ref document: A1