WO2024078313A1 - Procédé d'authentification et d'autorisation et appareil de communication - Google Patents

Procédé d'authentification et d'autorisation et appareil de communication Download PDF

Info

Publication number
WO2024078313A1
WO2024078313A1 PCT/CN2023/121110 CN2023121110W WO2024078313A1 WO 2024078313 A1 WO2024078313 A1 WO 2024078313A1 CN 2023121110 W CN2023121110 W CN 2023121110W WO 2024078313 A1 WO2024078313 A1 WO 2024078313A1
Authority
WO
WIPO (PCT)
Prior art keywords
internet
things
iot
information
authentication
Prior art date
Application number
PCT/CN2023/121110
Other languages
English (en)
Chinese (zh)
Inventor
葛翠丽
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024078313A1 publication Critical patent/WO2024078313A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
    • G16Y40/00—IoT characterised by the purpose of the information processing
    • G16Y40/50—Safety; Security of things, users, data or systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent

Definitions

  • the present application relates to the field of communication technology, and more specifically, to an authentication and authorization method and a communication device.
  • the 3rd generation partnership project (3GPP) is exploring the topic of personal internet of things networks (PIN).
  • PIN mainly includes three functions: PIN element management capability (PEMC), PIN element (PINE) and PIN element gateway capability (PEGC).
  • PMC PIN element management capability
  • PINE PIN element
  • PEGC PIN element gateway capability
  • the IoT gateway device can be used to perform other functions in PIN and exchange information with the core network (CN) of the fifth generation mobile communication technology (5th generation, 5G), and the IoT management device can be used to perform management such as adding and removing IoT devices.
  • the present application provides an authentication and authorization method and a communication device, which can support the completion of authentication and authorization of Internet of Things devices.
  • a method for authentication and authorization comprising: an Internet of Things gateway device receives request information from an Internet of Things device, the request information comprising a device identification and a device credential of the Internet of Things device; the Internet of Things gateway device determines that the request information is used to request authentication and authorization for the Internet of Things device; the Internet of Things gateway device sends request information to an Internet of Things authentication device, and the Internet of Things authentication device is used to authenticate and authorize the Internet of Things device; the Internet of Things gateway device sends response information to the Internet of Things device, the response information is used to indicate that the Internet of Things device has passed the authentication and authorization, the response information comprising a first identification and a first security credential configured by the Internet of Things authentication device for the Internet of Things device, and the first identification and the first security credential are used to indicate that the Internet of Things device has passed the authentication and authorization.
  • the present application supports the IoT gateway device forwarding specific types of information sent by the IoT device when the IoT device is not yet a member of the IoT (also understood as PIN), such as request information for requesting authentication and authorization of the IoT device.
  • the present application supports the completion of authentication and authorization of the IoT device, so that the IoT device can perform IoT-related services.
  • the method also includes: the Internet of Things gateway device receives first information from the Internet of Things device, the first information is used to instruct the Internet of Things operation of the Internet of Things management device or the Internet of Things server; the Internet of Things gateway device determines that the Internet of Things device is in a non-authentication and authorization state; the Internet of Things gateway device sends first indication information to the Internet of Things device, and the first indication information is used to instruct the Internet of Things device to send request information.
  • the IoT gateway device may refuse to forward the first information and send a first indication information to indicate that the IoT device needs to complete authentication and authorization. Accordingly, the IoT device performs authentication and authorization under the instruction of the first indication information.
  • this application supports IoT devices to perform authentication and authorization of IoT devices under the instruction of IoT gateway devices.
  • the method also includes: the Internet of Things gateway device receives second information from the Internet of Things device, the second information includes a first identifier and a first security credential, and the second information is used to indicate the Internet of Things operation of the Internet of Things management device or the Internet of Things server; the Internet of Things gateway device determines that the Internet of Things device passes the authentication authorization; the Internet of Things gateway device sends the second information to the Internet of Things management device or the Internet of Things server.
  • this application supports performing IoT related operations (or related services) after the IoT device completes authentication and authorization.
  • the IoT gateway device determines that the IoT device has passed authentication and authorization, including: the IoT gateway device sends a first identification and a first security credential to the IoT authentication device; the IoT gateway device receives feedback information from the IoT authentication device, and the feedback information is used to indicate that the IoT device has passed authentication and authorization; the IoT gateway device determines that the IoT device has passed authentication and authorization based on the feedback information.
  • the IoT gateway device determines whether the IoT device has passed authentication and authorization through information interaction with the IoT server.
  • the IoT gateway device determines that the IoT device has passed authentication and authorization, including: or, the IoT gateway device receives a second security credential from the IoT authentication device, the second security credential is used to indicate that the IoT device has passed authentication and authorization; the IoT gateway device determines that the IoT device has passed authentication and authorization based on the second security credential.
  • the IoT gateway device determines whether the IoT device has passed authentication and authorization through information interaction with the IoT server.
  • the Internet of Things authentication device includes at least one of an Internet of Things management device and an Internet of Things server.
  • both the IoT management device and the IoT server can implement authentication and authorization for the IoT device. Therefore, the IoT gateway device can forward the request information sent by the IoT device to the IoT management device or the IoT server.
  • the second information also includes at least one of the following: an Internet of Things identifier, or second indication information; the second indication information is used to instruct the Internet of Things gateway device to send the second information to the Internet of Things server; or the second indication information is used to instruct the Internet of Things gateway device to send the second information to the Internet of Things management device.
  • a method for authentication and authorization comprising: an Internet of Things gateway device receives first information from an Internet of Things device, the first information comprising a device identification and a device credential of the Internet of Things device; the Internet of Things gateway device determines that the Internet of Things device is in a non-authentication and authorization state; the Internet of Things gateway device sends a request message to an Internet of Things server, the request message being used to request the Internet of Things server to authenticate and authorize the Internet of Things device, the request message comprising a device identification and a device credential.
  • the IoT gateway device when the IoT gateway device determines that the IoT device has not passed or completed authentication and authorization, it can proxy the IoT device to send request information to the IoT server, thereby completing the authentication and authorization of the IoT device.
  • the method further includes: the Internet of Things gateway device receives response information from the Internet of Things server, where the response information is used to indicate that the Internet of Things device has passed the authentication authorization.
  • the first information is used to indicate the IoT operation of the IoT device, and the method also includes: the IoT gateway device sends the first information to the IoT management device; or, the IoT gateway device sends the first information to the IoT server.
  • the method further includes: the Internet of Things gateway device receives the address of the Internet of Things server from the Internet of Things management device.
  • a method for authentication and authorization comprising: an Internet of Things management device receives first information from an Internet of Things gateway device, the first information is used to indicate an Internet of Things operation of the Internet of Things management device, the first information comprises a first identifier and a first security credential, the first identifier and the first security credential are used to indicate that the Internet of Things device passes the authentication and authorization; the Internet of Things management device determines that the Internet of Things device passes the authentication and authorization; the Internet of Things management device performs the Internet of Things operation according to the first information.
  • this application supports the IoT management device to complete the confirmation of whether the IoT device has passed the authentication authorization, thereby ensuring the security of information interaction between other devices in the IoT.
  • the method before the Internet of Things management device receives the first information from the Internet of Things gateway device, the method also includes: the Internet of Things management device sends the address of the Internet of Things server to the Internet of Things device, the address of the Internet of Things server is used by the Internet of Things device to determine the receiving target of the first request information, and the first request information is used to request the Internet of Things server to authenticate and authorize the Internet of Things device; the Internet of Things management device determines that the Internet of Things device passes the authentication and authorization, including: the Internet of Things management device sends a first identifier and a first security credential to the Internet of Things server; the Internet of Things management device receives first feedback information from the Internet of Things server, the first feedback information is used to indicate that the Internet of Things device passes the authentication and authorization; the Internet of Things management device determines that the Internet of Things device passes the authentication and authorization based on the feedback information; or, the Internet of Things management device receives a second security credential from the Internet of Things server, the second security credential is used to indicate that the Internet of
  • the present application supports the IoT device to send request information to the IoT server for requesting authentication and authorization of the IoT device. Accordingly, the IoT management device determines whether the IoT device has passed the authentication and authorization of the IoT server through interaction with the IoT server, thereby ensuring the security of information interaction between other devices in the IoT.
  • the method before the Internet of Things management device receives the first information from the Internet of Things gateway device, the method also includes: the Internet of Things management device sends the address of the Internet of Things server to the Internet of Things device, the address of the Internet of Things server is used by the Internet of Things device to determine the receiving target of the first request information, and the first request information is used to request the Internet of Things server to authenticate and authorize the Internet of Things device; the Internet of Things management device determines that the Internet of Things device passes the authentication and authorization, including: the Internet of Things management device receives the second security credential from the Internet of Things server, the second security credential is used to indicate that the Internet of Things device passes the authentication and authorization; the Internet of Things management device determines that the Internet of Things device passes the authentication and authorization based on the second security credential.
  • the present application supports the IoT device to send request information to the IoT server for requesting authentication and authorization of the IoT device. Accordingly, the IoT management device determines whether the IoT device has passed the authentication and authorization of the IoT server through interaction with the IoT server, thereby ensuring the security of information interaction between other devices in the IoT.
  • the aforementioned Internet of Things operation for instructing the Internet of Things management device is an Internet of Things operation that the Internet of Things device requests the Internet of Things management device to perform.
  • the IoT device can request the IoT management device to execute the IoT operation requested by the IoT device, which can enhance the flexibility of executing the IoT operation of the IoT device.
  • the first information is used to indicate an IoT invitation confirmation operation of the IoT management device.
  • the method also includes: the IoT management device sends IoT invitation information to the IoT device, and the IoT invitation information is used to indicate the IoT device to join the IoT managed by the IoT management device; the IoT management device performs IoT operations according to the first information, including: the IoT management device adds the IoT device to the IoT.
  • the operation of IoT devices can be simplified, and the IoT management device can actively control the IoT devices to join the IoT, thereby enhancing the centralized management function of the IoT management device.
  • the method before the Internet of Things management device receives the first information from the Internet of Things gateway device, the method also includes: the Internet of Things management device receives the second information from the Internet of Things device, and the second information is used to indicate the Internet of Things operation of the Internet of Things management device; the Internet of Things management device determines that the Internet of Things device is in a non-authentication and authorization state; the Internet of Things management device sends the first indication information to the Internet of Things device, and the first indication information is used to instruct the Internet of Things device to send the first request information.
  • the present application supports the IoT management device to send instruction information to the IoT device after confirming that the IoT device has not completed authentication and authorization.
  • the IoT device completes the authentication and authorization process of the IoT device under the instruction of the instruction information sent by the IoT management device, so that the IoT device can perform related operations of the IoT.
  • the first indication information includes an address of the Internet of Things server.
  • the method before the Internet of Things management device receives the first information from the Internet of Things gateway device, the method also includes: the Internet of Things management device receives third information from the Internet of Things device, the third information is used to indicate the Internet of Things operation of the Internet of Things management device, and the third information includes the device identification and device credentials of the Internet of Things device; the Internet of Things management device determines that the Internet of Things device is in a non-authentication and authorization state; the Internet of Things management device sends a second request information to the Internet of Things server, the second request information is used to request the Internet of Things server to authenticate and authorize the Internet of Things device, and the second request information includes the device identification and device credentials; the Internet of Things management device receives a response information from the Internet of Things server, the response information is used to indicate that the Internet of Things device has passed the authentication and authorization, and the response information includes the first identification and first security credential configured by the Internet of Things server for the Internet of Things device, and the first identification and first security credential are used to indicate that the Internet of Things device has passed
  • the IoT management device when the IoT management device determines that the IoT device has not passed or completed authentication and authorization, it can proxy the IoT device to send request information to the IoT server, thereby completing the authentication and authorization of the IoT device.
  • the first information also includes at least one of the following: an Internet of Things identifier, or second indication information; the second indication information is used to instruct the Internet of Things management device to send the first information to the Internet of Things server.
  • the method before the Internet of Things management device receives the first information from the Internet of Things gateway device, the method also includes: the Internet of Things management device receives verification information from the Internet of Things gateway device, the verification information is used to request the Internet of Things management device to determine that the Internet of Things device has passed the authentication authorization, and the verification information includes a first identifier and a first security credential; the Internet of Things management device sends second feedback information to the Internet of Things gateway device, and the second feedback information is used to indicate that the Internet of Things device has passed the authentication authorization.
  • an authentication and authorization method which includes: an Internet of Things device sends a request message to an Internet of Things gateway device, the request message is used to request authentication and authorization for the Internet of Things device, and the request message includes a device identification and a device credential of the Internet of Things device; the Internet of Things device receives a response message from the Internet of Things gateway device, the response message is used to indicate that the Internet of Things device has passed the authentication and authorization, and the response message includes a first identification and a first security credential configured by the Internet of Things authentication device for the Internet of Things device.
  • the present application supports the IoT gateway device forwarding specific types of information sent by the IoT device when the IoT device is not yet a member of the IoT, such as request information for requesting authentication and authorization of the IoT device.
  • the present application supports the completion of authentication and authorization of the IoT device, so that the IoT device can perform IoT-related services.
  • the method also includes: the Internet of Things device sends first information to the Internet of Things gateway device, and the first information is used to instruct the Internet of Things management or the Internet of Things operation of the Internet of Things server device; the Internet of Things device receives the first indication information from the Internet of Things gateway device, and the first indication information is used to instruct the Internet of Things device to send request information.
  • the method also includes: the Internet of Things device sends second information to the Internet of Things gateway device, the second information includes a first identifier and a first security credential, and the second information is used to indicate the Internet of Things operation of the Internet of Things management device or the Internet of Things server.
  • the second information also includes at least one of the following: an Internet of Things identifier, or second indication information; the second indication information is used to instruct the Internet of Things gateway device to send the second information to the Internet of Things server; or the second indication information is used to instruct the Internet of Things gateway device to send the second information to the Internet of Things entity management function.
  • a method for authentication and authorization comprising: an Internet of Things device sends second information to an Internet of Things management device, the second information is used to instruct the Internet of Things operation of the Internet of Things management device; the Internet of Things device receives first indication information from the Internet of Things management device, the first indication information is used to instruct the Internet of Things device to send first request information to an Internet of Things server, the first request information is used to request the Internet of Things server to authenticate and authorize the Internet of Things device.
  • the method further includes: the Internet of Things device receives the address of the Internet of Things server from the Internet of Things management device, and the address of the Internet of Things server is used by the Internet of Things device to determine the receiving target of the first request information.
  • the first indication information includes an address of an Internet of Things server.
  • the method includes: the Internet of Things device sends third information to the Internet of Things management device, where the third information is used to indicate the Internet of Things operation of the Internet of Things management device, and the third information includes a device identification and a device credential of the Internet of Things device.
  • a communication device comprising: a transceiver unit for receiving request information from an Internet of Things device, the request information including a device identification and a device credential of the Internet of Things device; a processing unit for determining that the request information is used to request authentication and authorization for the Internet of Things device; a transceiver unit for sending request information to an Internet of Things authentication device, the Internet of Things authentication device being used to authenticate and authorize the Internet of Things device; a transceiver unit for sending response information to the Internet of Things device, the response information being used to indicate that the Internet of Things device has passed the authentication and authorization, the response information including a first identification and a first security credential configured by the Internet of Things authentication device for the Internet of Things device, the first identification and the first security credential being used to indicate that the communication device has passed the authentication and authorization.
  • the transceiver unit is used to receive first information from an Internet of Things device, and the first information is used to instruct the Internet of Things operation of an Internet of Things management device or an Internet of Things server; the processing unit is used to determine that the Internet of Things device is in a non-authentication and authorization state; the transceiver unit is used to send first indication information to the Internet of Things device, and the first indication information is used to instruct the Internet of Things device to send request information.
  • the transceiver unit is used to receive second information from the Internet of Things device, the second information includes a first identifier and a first security credential, and the second information is used to indicate the Internet of Things operation of the Internet of Things management device or the Internet of Things server; the processing unit is used to determine whether the Internet of Things device has passed the authentication authorization; the transceiver unit is used to send the second information to the Internet of Things management device or the Internet of Things server.
  • the transceiver unit is used to send a first identification and a first security credential to an Internet of Things authentication device; the transceiver unit is used to receive feedback information from the Internet of Things authentication device, and the feedback information is used to indicate that the Internet of Things device has passed the authentication authorization; the processing unit is used to determine whether the Internet of Things device has passed the authentication authorization based on the feedback information.
  • the transceiver unit is used to receive a second security credential from an IoT authentication device, where the second security credential is used to indicate that the IoT device has passed the authentication authorization; and the processing unit is used to determine whether the IoT device has passed the authentication authorization based on the second security credential.
  • the Internet of Things authentication device includes at least one of an Internet of Things management device and an Internet of Things server.
  • the second information also includes at least one of the following: an Internet of Things identifier, or second indication information; the second indication information is used to instruct the communication device to send the second information to the Internet of Things server; or the second indication information is used to instruct the communication device to send the second information to the Internet of Things management device.
  • a communication device comprising: a transceiver unit, configured to receive first information from an Internet of Things device, the first information comprising a device identification and a device credential of the Internet of Things device; a processing unit, configured to determine that the Internet of Things device is in a non-authentication and authorization state; The transceiver unit is used to send a request message to the Internet of Things server, where the request message is used to request the Internet of Things server to authenticate and authorize the Internet of Things device, and the request message includes a device identifier and a device credential.
  • the transceiver unit is used to receive response information from the Internet of Things server, and the response information is used to indicate that the Internet of Things device has passed the authentication authorization.
  • the first information is used to indicate the Internet of Things operation of the Internet of Things device, and the transceiver unit is used to send the first information to the Internet of Things management device; or, the transceiver unit is used to send the first information to the Internet of Things server.
  • the transceiver unit is used to receive the address of the Internet of Things server from the Internet of Things management device.
  • a communication device including: a transceiver unit, used to receive first information from an Internet of Things gateway device, the first information is used to indicate an Internet of Things operation of an Internet of Things management device, the first information includes a first identifier and a first security credential, the first identifier and the first security credential are used to indicate that the Internet of Things device has passed the authentication authorization; a processing unit, used to determine that the Internet of Things device has passed the authentication authorization; a processing unit, used to execute the Internet of Things operation according to the first information.
  • the transceiver unit is used to send the address of the Internet of Things server to the Internet of Things device, the address of the Internet of Things server is used by the Internet of Things device to determine the receiving target of the first request information, and the first request information is used to request the Internet of Things server to authenticate and authorize the Internet of Things device;
  • the transceiver unit is used to send a first identifier and a first security credential to the Internet of Things server;
  • the transceiver unit is used to receive first feedback information from the Internet of Things server, and the first feedback information is used to indicate that the Internet of Things device has passed the authentication and authorization;
  • the processing unit is used to determine whether the Internet of Things device has passed the authentication and authorization based on the feedback information.
  • the transceiver unit is used to send the address of the IoT server to the IoT device, the address of the IoT server is used by the IoT device to determine the receiving target of the first request information, the first request information is used to request the IoT server to authenticate and authorize the IoT device; the transceiver unit is used to receive the second security credential from the IoT server, the second security credential is used to indicate that the IoT device has passed the authentication and authorization; the processing unit is used to determine whether the IoT device has passed the authentication and authorization based on the second security credential.
  • the transceiver unit is used to receive second information from the Internet of Things device, and the second information is used to indicate the Internet of Things operation of the communication device; the processing unit is used to determine that the Internet of Things device is in a non-authentication and authorization state; the transceiver unit is used to send first indication information to the Internet of Things device, and the first indication information is used to instruct the Internet of Things device to send first request information.
  • the first indication information includes an address of the Internet of Things server.
  • the transceiver unit is used to receive third information from the Internet of Things device, the third information is used to indicate the Internet of Things operation of the communication device, and the third information includes the device identification and device credentials of the Internet of Things device;
  • the processing unit is used to determine that the Internet of Things device is in a non-authentication and authorization state;
  • the transceiver unit is used to send second request information to the Internet of Things server, the second request information is used to request the Internet of Things server to authenticate and authorize the Internet of Things device, and the second request information includes the device identification and device credentials;
  • the transceiver unit is used to receive response information from the Internet of Things server, the response information is used to indicate that the Internet of Things device has passed the authentication and authorization, and the response information includes the first identification and first security credential configured by the Internet of Things server for the Internet of Things device.
  • the aforementioned Internet of Things operation for indicating the communication device is an Internet of Things operation that the Internet of Things device requests the communication device to perform.
  • the first information is used to indicate the Internet of Things invitation confirmation operation of the communication device, and the whether unit is also used to send Internet of Things invitation information to the Internet of Things device, and the Internet of Things invitation information is used to instruct the Internet of Things device to join the Internet of Things managed by the communication device; the processing unit is also used to add the Internet of Things device to the Internet of Things.
  • the first information also includes at least one of the following: an Internet of Things identifier, or second indication information; the second indication information is used to instruct the communication device to send the first information to the Internet of Things server.
  • the transceiver unit is used to receive verification information from the Internet of Things gateway device, the verification information is used to request the Internet of Things management device to determine that the Internet of Things device has passed the authentication authorization, and the verification information includes a first identifier and a first security credential; the transceiver unit is used to send second feedback information to the Internet of Things gateway device, and the second feedback information is used to indicate that the Internet of Things device has passed the authentication authorization.
  • a communication device including: a transceiver unit, used to send request information to an Internet of Things gateway device, the request information is used to request authentication and authorization for the communication device, the request information includes a device identification and device credentials of the communication device; a transceiver unit, used to receive response information from the Internet of Things gateway device, the response information is used to indicate that the communication device has passed the authentication and authorization, and the response information includes a first identification and security credential configured for the communication device by the Internet of Things authentication device.
  • the transceiver unit is used to send first information to the Internet of Things gateway device, and the first information is used to instruct the Internet of Things operation of the Internet of Things management device or the Internet of Things server; the transceiver unit is used to receive first indication information from the Internet of Things gateway device, and the first indication information is used to instruct the communication device to send request information.
  • the transceiver unit is used to send second information to the Internet of Things gateway device, where the second information includes a first identifier and a security credential, and the second information is used to indicate the Internet of Things operation of the Internet of Things management device or the Internet of Things server.
  • the second information also includes at least one of the following: an Internet of Things identifier, or second indication information; the second indication information is used to instruct the Internet of Things gateway device to send the second information to the Internet of Things server; or the second indication information is used to instruct the Internet of Things gateway device to send the second information to the Internet of Things entity management function.
  • a communication device including: a transceiver unit, used to send second information to an Internet of Things management device, the second information is used to instruct the Internet of Things operation of the Internet of Things management device or the Internet of Things server; a transceiver unit, used to receive first indication information from the Internet of Things management device, the first indication information is used to instruct the communication device to send first request information to the Internet of Things server, the first request information is used to request the Internet of Things server to authenticate and authorize the communication device.
  • the transceiver unit is used to receive the address of an Internet of Things server from an Internet of Things management device, and the address of the Internet of Things server is used by the communication device to determine a receiving target of the first request information.
  • the first indication information includes an address of an Internet of Things server.
  • the transceiver unit is used to send third information to the Internet of Things management device, where the third information is used to indicate the Internet of Things operation of the Internet of Things management device or the Internet of Things server, and the third information includes the device identification and device credentials of the communication device.
  • a communication device comprising a processor, the processor being used to, by executing a computer program or instruction, or, through a logic circuit, enable the communication device to perform any method in the first aspect and any possible implementation of the first aspect; or, enable the communication device to perform any method in the second aspect and any possible implementation of the second aspect; or, enable the communication device to perform any method in the third aspect and any possible implementation of the third aspect; or, enable the communication device to perform any method in the fourth aspect and any possible implementation of the fourth aspect; or, enable the communication device to perform any method in the fifth aspect and any possible implementation of the fifth aspect.
  • the communication device further includes a memory, and the memory is used to store the computer program or instruction.
  • the communication device further includes a communication interface, and the communication interface is used to input and/or output signals.
  • a communication device comprising a logic circuit and an input-output interface, the input-output interface being used to input and/or output signals, the logic circuit being used to execute the method described in the first aspect and any possible implementation of the first aspect; or, the logic circuit being used to execute the method described in the second aspect and any possible implementation of the second aspect; or, the logic circuit being used to execute the method described in the third aspect and any possible implementation of the third aspect; or, the logic circuit being used to execute the method described in the fourth aspect and any possible implementation of the fourth aspect; or, the logic circuit being used to execute the method described in the fifth aspect and any possible implementation of the fifth aspect.
  • a computer-readable storage medium comprising a computer program or instructions, which, when the computer program or the instructions are run on a computer, causes the method described in the first aspect and any one of its possible implementations to be executed; or causes the method described in the second aspect and any one of its possible implementations to be executed; or causes the method described in the third aspect and any one of its possible implementations to be executed; or causes the method described in the fourth aspect and any one of its possible implementations to be executed; or causes the method described in the fifth aspect and any one of its possible implementations to be executed.
  • a computer program product comprising instructions, which, when executed on a computer, cause the method described in the first aspect and any one of its possible implementations to be executed; or, cause the method described in the second aspect and any one of its possible implementations to be executed; or, cause the method described in the third aspect and any one of its possible implementations to be executed; or, cause the method described in the fourth aspect and any one of its possible implementations to be executed; or, cause the method described in the fifth aspect and any one of its possible implementations to be executed.
  • a computer program which, when executed on a computer, enables the method described in the first aspect and any one of its possible implementations to be executed; or enables the method described in the second aspect and any one of its possible implementations to be executed; or enables the method described in the third aspect and any one of its possible implementations to be executed; or enables the method described in the fourth aspect and any one of its possible implementations to be executed; or enables the method described in the fifth aspect and any one of its possible implementations to be executed.
  • a communication system which includes an Internet of Things gateway device and an Internet of Things management device, the Internet of Things gateway device is used to execute the method described in the first aspect and any one of any possible implementations of the first aspect, or the Internet of Things gateway device is used to execute the method described in the second aspect and any one of any possible implementations of the second aspect, and the Internet of Things management device is used to execute the method described in the third aspect and any one of any possible implementations of the third aspect.
  • the communication system also includes an Internet of Things device, which is used to execute the method described in the fourth aspect and any one of the possible implementations of the fourth aspect; or, the Internet of Things device is used to execute the method described in the fifth aspect and any one of the possible implementations of the fifth aspect.
  • FIG. 1 is a schematic diagram of a communication system 100 applicable to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of an interaction flow of a method 200 for authentication and authorization.
  • FIG. 3 is a schematic diagram of an interaction flow of a method 300 for authentication and authorization according to an embodiment of the present application.
  • FIG. 4 is a schematic diagram of an interaction flow of a method 400 for authentication and authorization according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of an interaction flow of a method 500 for authentication and authorization according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of an interactive process of a method 600 for authentication and authorization according to an embodiment of the present application.
  • FIG. 7 is a schematic block diagram of the structure of a communication device 700 according to an embodiment of the present application.
  • FIG8 is a schematic block diagram of the structure of a communication device 800 according to an embodiment of the present application.
  • FIG. 9 is a schematic block diagram of the structure of a communication device 900 according to an embodiment of the present application.
  • FIG. 10 is a schematic block diagram of the structure of a communication device 1000 according to an embodiment of the present application.
  • FIG. 11 is a schematic block diagram of the structure of a communication device 1100 according to an embodiment of the present application.
  • GSM global system of mobile communication
  • CDMA code division multiple access
  • WCDMA wideband code division multiple access
  • GPRS general packet radio service
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX worldwide interoperability for microwave access
  • 5G fifth generation
  • NR new radio
  • the terminal device in the embodiments of the present application may refer to user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device.
  • the terminal device may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a 5G network or a terminal device in a public land mobile network (PLMN), etc., and the embodiments of the present application are not limited to this.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • the network device in the embodiments of the present application may be a device for communicating with a terminal device.
  • the network device may be a base station (base transceiver station, BTS) in a GSM system or a CDMA system, or a base station (nodeB, NB) in a WCDMA system, or an evolved base station (evolutional nodeB, eNB or eNodeB) in an LTE system, or a wireless controller in a cloud radio access network (cloud radio access network, CRAN) scenario, or the network device may be a relay station, an access point, an in-vehicle device, a wearable device, a network device in a 5G network, a network device in a PLMN network, or a network device in a non-public network, etc., and the embodiments of the present application are not limited thereto.
  • FIG1 is a schematic diagram of a communication system 100 applicable to an embodiment of the present application.
  • the communication system 100 includes 5GC and a personal IoT network (PIN).
  • 5GC mainly includes access and mobility management function (AMF), capability exposure function (NEF), user data User data repository (UDR), network repository function (NRF), unified data management (UDM), next generation (NG)-radio access network (RAN) equipment, policy control function (PCF), user plane function (UPF), data network (DN), etc.
  • AMF access and mobility management function
  • NEF capability exposure function
  • UDR user data User data repository
  • NRF network repository function
  • UDM unified data management
  • NG next generation
  • RAN radio access network
  • PCF policy control function
  • UPF user plane function
  • DN data network
  • PIN mainly includes PEGC, PEMC and PINE.
  • PEMC and PINE exchange information through P1 (based on non-3GPP or 3GPP access technology)
  • PINE and PEGC exchange information through P2 (based on non-3GPP access technology, 3GPP access technology or the Internet)
  • PEGC and PEMC exchange information through P3 (based on non-3GPP access technology or 3GPP short-distance communication technology such as 5G prose technology).
  • P1 based on non-3GPP or 3GPP access technology
  • PINE and PEGC exchange information through P2 (based on non-3GPP access technology, 3GPP access technology or the Internet)
  • PEGC and PEMC exchange information through P3 (based on non-3GPP access technology or 3GPP short-distance communication technology such as 5G prose technology).
  • Figure 1 is only a schematic description diagram, and the embodiment of the present application does not limit the number and types of network elements and functions (or devices) actually deployed in the communication system 100.
  • Radio access network equipment corresponds to different access networks in 5G, such as wired access, wireless base station access and other methods.
  • the RAN equipment in this application includes but is not limited to: next-generation base stations (gnodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), base band unit (base band unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.
  • next-generation base stations nodeB, gNB
  • evolved node B evolved node B
  • eNB radio network controller
  • RNC radio network controller
  • node B node B
  • base station controller base station controller
  • BTS base transceiver
  • Unified data management (also called unified data management network element, unified data management entity, data management device, unified data management equipment) is a type of core network equipment, mainly used to process terminal equipment identification, access authentication, registration and mobility management. Unified data management equipment is a control plane device.
  • PCF Policy control function
  • policy control network element also known as policy control network element, policy control function network element, policy control equipment, policy control function entity, etc.
  • QoS quality of service
  • Session management function mainly performs session management, execution of control policies issued by PCF, UPF selection, UE IP address allocation and other functions.
  • Access and mobility management function (also known as access and mobility management function entity, access and mobility management equipment, access and mobility management network element, access management equipment, mobility management equipment) is a type of core network equipment, mainly used for mobility management and access management, etc., and can be used to implement other functions of mobility management entity (MME) functions except session management, such as lawful interception, or access authorization (or authentication), user equipment registration, mobility management, tracking area update process, reachability detection, selection of session management network element, mobile state transition management and other functions.
  • MME mobility management entity
  • session management such as lawful interception, or access authorization (or authentication), user equipment registration, mobility management, tracking area update process, reachability detection, selection of session management network element, mobile state transition management and other functions.
  • the access and mobility management network element can be an AMF network element.
  • future communications such as 6G
  • the access and mobility management network element can still be an AMF network element, or have other names, which are not limited in this application.
  • the AMF can provide Namf services.
  • User plane function (also known as user plane equipment, user plane function network element, user plane network element, user plane function entity): mainly includes the following functions: data packet routing and transmission, packet detection, service usage reporting, QoS processing, legal monitoring, uplink packet detection, downlink data packet storage and other user-plane related functions.
  • Network repository function (also known as network storage device, network repository function network element, network repository function entity): mainly used to support service discovery function. Receives a network element discovery request from a network element function or service communication proxy (SCP), and can feedback the network element discovery request information. At the same time, NRF is also responsible for maintaining information about available network functions and the services they support. It can also be understood as a network storage device. Among them, the discovery process is the process of addressing a specific NF or a specific service by the demand network element function (NF) with the help of NRF. NRF provides the IP address or fully qualified domain name (FQDN) or unified resource identifier (URI) of the corresponding NF instance or NF service instance.
  • FQDN fully qualified domain name
  • URI unified resource identifier
  • NRF can also implement the cross-PLMN discovery process by providing a network identifier (such as PLMN ID).
  • a network identifier such as PLMN ID
  • each network element needs to be registered in NRF, and some network element functions can be registered in NRF when they are first run.
  • the network repository function device can be a core network device.
  • Network exposure function (also called network exposure device, network exposure function entity, Network open function network element, network capability open function entity, network capability open function equipment, network capability open function network element, network capability open equipment, etc.): mainly used to support the opening of capabilities and events, such as securely opening the services and capabilities provided by 3GPP network functions to the outside world.
  • User database (user data repository, UDR) (also known as user database entity, user database network element, user database equipment, etc.) can have different data access authentication mechanisms for different types of data such as contract data and policy data to ensure the security of data access.
  • UDR user data repository
  • PIN element An IoT device in a PIN, which can be a 3GPP UE or a non-3GPP device, can discover a PIN or other PINEs in a PIN, and join or leave a PIN.
  • PIN element PINE
  • PINE gateway capability It is a role or capability of PINE, which can also be understood as PINE with gateway function, used to realize information interaction between other PINEs in PIN and 5GC, and provide data routing and forwarding for PINE.
  • PIN management capability It is a role or capability of PINE. It can also be understood as PINE with management function, which is used to implement PIN management, such as PIN creation, update, deletion, PINE addition and removal, and PEGC configuration management.
  • PINE, PGEC, and PEMC can be software modules running on UE devices or IoT devices.
  • a UE or device can have one or more of the above capabilities.
  • a UE can have the capabilities of PINE, PEGC, and PEMC. It can also be understood that a UE can serve as PINE, PEGC, and PEMC at the same time.
  • the PINE, PEGC and PEMC in the embodiments of the present application may also refer to PINE client, PEGC client and PEMC client.
  • PEMC client can be understood as PINE with PEMC capability
  • PEGC client can be understood as PINE with PEGC capability.
  • network elements and functions are independent physical devices.
  • the present application does not limit the specific forms of the above-mentioned network elements and functions. For example, they can be integrated in the same physical device, or they can be different physical devices.
  • network elements or devices can be combined.
  • the access and mobility management network element can be combined with the session management network element; the session management network element can be combined with the user plane network element.
  • the above functions and network elements may be network elements in hardware devices, or software functions running on dedicated hardware, or a combination of hardware and software, or virtualized functions instantiated on a platform (e.g., a cloud platform).
  • a platform e.g., a cloud platform
  • FIG2 is an interactive flow chart of an authentication and authorization method 200.
  • the method 200 shown in FIG2 can be applied to the above-mentioned communication system 100.
  • the method 200 includes:
  • An application layer connection is established between S210, PINE1 and PEMC.
  • PEMC sends the local PIN configuration information (profile) to PINE1.
  • the PIN configuration information includes PIN identification (ID), PIN description (such as company name, location, or business type) and PEMC Internet protocol (IP) address and other information.
  • ID PIN identification
  • PIN description such as company name, location, or business type
  • IP Internet protocol
  • PINE1 sends a request message 1 to PEMC, which is used to request to join PIN.
  • the PEMC receives the request message 1 from the PINE1 and determines based on the request message 1 that the PINE1 requests to join the PIN.
  • the request message 1 sent by PINE1 to PEMC is used to request PEMC to add PINE1 to the PIN.
  • the request message 1 includes the security credentials assigned by the PIN server to PINE1 and the identification information of PINE1.
  • the identification information of PINE1 may include a generic public subscription identifier (GPSI), an application layer identifier (client ID) of PINE1, a location of PINE1, a PIN ID, and PIN configuration information.
  • the request information 1 also includes information about services that PINE1 can provide.
  • PEMC After receiving the request information 1, PEMC performs authentication and authorization on PINE1, and confirms whether PINE1 has the authority to join the PIN.
  • the authority of PEMC to perform authentication and authorization on PINE1 may be granted by the PIN server, and this application does not limit this.
  • PINE1 receives the response information 1 sent by the PEMC, and determines whether PINE1 can join the PIN based on the response information 1.
  • PEMC After determining that PINE1 can join the PIN, PEMC sends a response message 1 to PINE1 indicating that PINE1 has passed the authentication authorization.
  • Response message 1 includes access information of PINE1 (eg, user plane, WIFI name and password, etc.), which can be used by PINE1 to access services in the DN.
  • response information 1 may also include information such as PIN ID and IP address of PEGC.
  • PEMC notifies PEGC and PIN server that PINE1 joins PIN.
  • PEGC determines that PINE1 is a new member of PIN based on the notification information sent by PEMC
  • PINE1 can allow PINE1 to access the 5G server.
  • the PIN server determines that PINE1 is a new member of PIN based on the notification information sent by PEMC
  • PIN-related services include: PIN joining, PIN discovery, etc.
  • S260, PEMC, PEGC and PIN server update PIN configuration information.
  • the PEMC, PEGC, and PIN server After determining that PINE1 can join the PIN, the PEMC, PEGC, and PIN server update the local PIN configuration information and add PINE1 to the member list of the PIN.
  • PEMC in order to realize the authentication and authorization of PINE1 by PEMC, there needs to be direct communication between PINE1 and PEMC. If there is no direct communication between PINE1 and PEMC, PEMC cannot complete the authentication and authorization of PINE1. At this time, if PEGC receives PIN information sent by PINE1 (such as PIN discovery, PIN joining, etc.), PEGC directly discards the PIN information sent by PINE1 because PINE1 is not a member of PIN, resulting in PINE1 being unable to perform PIN-related services.
  • PIN information sent by PINE1 such as PIN discovery, PIN joining, etc.
  • the present application provides an authentication and authorization method and a communication device, which can support the completion of authentication and authorization of PINE1.
  • FIG3 is a schematic diagram of the interaction flow of the authentication and authorization method 300 of the embodiment of the present application.
  • the method 300 shown in FIG3 can be applied to the above-mentioned communication system 100, and can also be applied to other communication systems involving PIN.
  • the present application takes PIN as the Internet of Things as an example for description.
  • the PINE in the PIN is an Internet of Things device
  • the PEGC is an Internet of Things gateway device
  • the PEMC is an Internet of Things management device.
  • the method 300 includes:
  • the Internet of Things device 1 sends a request message A to the Internet of Things gateway device, which is used to request authentication and authorization for the Internet of Things device 1.
  • the IoT gateway device receives request information A from IoT device 1.
  • the request information A can be the Internet of Things registration information, the Internet of Things authentication information, the Internet of Things authorization information, or the request information A can also be a combination of the above-mentioned information, for example, the request information A is the Internet of Things authentication and authorization information, or the request information A is the Internet of Things registration and authentication information, or the request information A is the Internet of Things registration authentication and authorization information, etc.
  • the request information A is used to request authentication and authorization for the Internet of Things device 1 (which can also be understood as allowing the Internet of Things device 1 to perform specific Internet of Things operations), wherein the Internet of Things device 1 is any Internet of Things device that establishes a direct communication connection with the Internet of Things gateway device.
  • the request information A includes the device identification and device credentials of the IoT device 1.
  • the device identification and device credentials of the IoT device 1 can be used to represent the identity of the IoT device 1. It should be understood that the device identification and device credentials of the IoT device 1 are configured for the IoT device 1 by the device authentication server of the IoT device 1.
  • the device credentials can be a certificate and are set in the IoT device 1 by the manufacturer of the IoT device 1.
  • the Internet of Things gateway device determines that the request information A is used to request authentication authorization for the Internet of Things device 1.
  • the IoT gateway device when the IoT gateway device determines that the request information A is an information type (or data type) that the IoT gateway device can forward, the IoT gateway device can determine to forward the request information A instead of rejecting or discarding the request information A.
  • the present application supports allowing the IoT gateway device to identify and forward IoT information sent to it by IoT device 1.
  • IoT information is the signaling of IoT applications or IoT services, which may include IoT registration information, IoT login information, IoT authentication information, IoT authorization information, IoT connection information, IoT discovery information, IoT discovery information, or IoT joining information.
  • the IoT information described above may be IoT application layer information, which includes IoT header information and payload.
  • the IoT header information includes an information element (IE) for indicating the IoT information type.
  • IE information element
  • the above-mentioned IoT information is information obtained by extending application layer information such as hypertext transfer protocol (HTTP) or session initiation protocol (SIP).
  • HTTP or SIP information includes an IE for indicating the type of IoT information.
  • the IoT gateway device receives request information A from the IoT device, the IoT gateway device parses the received request information A.
  • the IoT gateway device can determine to forward the request information A.
  • the IoT gateway device 1 does not complete the authentication and authorization, and the IoT gateway device rejects or discards any IoT information sent by the IoT device 1 to the IoT gateway device because the IoT device 1 is not a member of the IoT, resulting in the inability to perform IoT-related operations (or IoT-related services).
  • the IoT gateway device sends a request message A to the IoT authentication device.
  • the IoT authentication device can be used to perform authentication and authorization on the IoT device 1. Therefore, the IoT gateway device forwards the request information A sent by the IoT device 1 to the IoT authentication device, and the IoT authentication device performs authentication and authorization on the IoT device 1.
  • the Internet of Things authentication device can be an Internet of Things management device or an Internet of Things server, which is not limited in this application.
  • the IoT gateway device sends a request message A to the IoT authentication device, including:
  • the IoT gateway device sends request information A to the IoT server.
  • the IoT gateway device determines that the IoT is not local, or understands that the IoT is not a local business (for example, when the IoT gateway device receives the address of the IoT server configured by the IoT management device, or the request information A carries the address of the IoT server (for example, the destination address in the request information A is the address of the IoT server), or the request message A carries the identification information of the application or business (such as domain name, uniform resource locator (URL), etc.) which can be further parsed to obtain the address of the IoT server), the IoT gateway device determines the IoT server according to the request information A or the local IoT configuration information, and sends the request information A to the IoT server, and the IoT server performs the authentication and authorization of the IoT device 1. For example, the IoT server completes the legitimacy check of the IoT device 1 by interacting with the device authentication server of the IoT device 1.
  • the IoT server configures the IoT device 1 with a first identifier and a security credential 1 (e.g., a token, a service code, or a credential, etc.), and carries the first identifier and the security credential 1, etc. in the response information A.
  • the first identifier is used to identify the IoT device 1.
  • the first identifier may be an application layer identifier (application layer id) 1, which is used to identify the IoT device 1 at the application layer (through authentication and authorization), and may be a PINE client ID, a PINE ID, or a PIN user ID, etc.
  • the first identifier may also be other identifiers, such as a physical layer identifier, a link layer identifier, etc., which is not limited in this application.
  • first identification and security credential 1 configured by the IoT server for the IoT device 1 can be used to indicate that the IoT device 1 has passed the authentication and authorization of the IoT server for the IoT device 1.
  • first identification and security credential 2 can also be used as credentials for the IoT device 1 to access other devices in the IoT.
  • the IoT server After completing the authentication and authorization of the IoT device 1, the IoT server sends a response message A to the IoT gateway device, which is used to indicate that the IoT device 1 has passed the authentication and authorization of the IoT server.
  • the IoT gateway device sends a request message A, including:
  • the Internet of Things gateway device sends a request message A to the Internet of Things management device.
  • the IoT gateway device determines that the IoT is local, or understands that the IoT is a local service (for example, when the IoT gateway device has never received the address of the IoT server configured by the IoT management device, or the request information A carries the identifier of the IoT management device (for example, IP address, generic public subscription identifier (GPSI), medium access control (MAC) address, domain name or other information that can be used to identify the IoT management device) (for example, the destination address in the request information A is the address of the IoT management device, or the request message A carries the identification information of the application or service (such as domain name, URL, etc.) which can be further parsed to obtain the address of the IoT management device), the IoT gateway device sends request information A to the IoT management device, and the IoT management device performs authentication and authorization on the IoT device 1.
  • the description of the IoT management device performing authentication and authorization on the IoT device 1 can refer to
  • the Internet of Things management device After completing the authentication and authorization of the Internet of Things device 1, the Internet of Things management device sends a response message A to the Internet of Things gateway device, which is used to indicate that the Internet of Things device 1 has passed the authentication and authorization of the Internet of Things management device for the Internet of Things device 1.
  • the IoT gateway device sends response information A to IoT device 1, which is used to indicate that IoT device 1 has passed the authentication authorization.
  • the IoT device 1 receives the response information A from the IoT gateway device, and determines that the IoT device 1 has passed the authentication authorization based on the response information A.
  • the response information A includes the security credential 1 and the first identifier.
  • the present application supports the IoT gateway device forwarding specific types of IoT information sent by IoT device 1 when IoT device 1 is not yet a member of the IoT, such as request information A for requesting authentication and authorization for IoT device 1.
  • request information A for requesting authentication and authorization for IoT device 1.
  • the present application supports the completion of authentication and authorization for IoT device 1, so that IoT device 1 can perform related operations of the IoT.
  • method 300 further includes:
  • Internet of Things device 1 sends Internet of Things information #1 (eg, first information) to an Internet of Things gateway device.
  • Internet of Things information #1 eg, first information
  • the IoT gateway device receives IoT information #1 from IoT device 1.
  • the IoT information #1 is used to indicate the IoT operation of the IoT management device or IoT server.
  • IoT information #1 includes information of IoT operation.
  • IoT operation includes: IoT join (PIN join), IoT discovery (PIN discovery), or IoT invite confirmation (PIN invite ack), etc.
  • the information of IoT operation indicates IoT operation.
  • IoT information #1 may be an IoT join request message (carrying at least one of the device identification or the first identification of IoT 1), an IoT discovery request message (carrying at least one of the device identification or the first identification of IoT 1), and an IoT invite confirmation message (carrying at least one of the device identification or the first identification of IoT 1), etc.
  • the IoT gateway device determines that the IoT device 1 is in a non-authentication and authorization state.
  • the IoT gateway device After receiving IoT information #1, the IoT gateway device determines that IoT device 1 is in a non-authentication and authorization state (for example, when the IoT gateway device finds that IoT information #1 does not carry the first identification and/or security credential 1, the IoT gateway device determines that IoT device 1 is in a non-authentication and authorization state), that is, the IoT gateway device determines that IoT device 1 has not completed the authentication and authorization at the IoT authentication device, which can be further understood as: the IoT gateway device determines that IoT device 1 is not allowed to perform the IoT operation indicated by IoT information #1. Accordingly, the IoT gateway device refuses to forward IoT information #1.
  • a non-authentication and authorization state for example, when the IoT gateway device finds that IoT information #1 does not carry the first identification and/or security credential 1, the IoT gateway device determines that IoT device 1 is in a non-authentication and authorization state
  • the IoT gateway device sends indication information 1 (for example, first indication information) to IoT device 1, which is used to instruct IoT device 1 to send request information A.
  • indication information 1 for example, first indication information
  • IoT device 1 receives indication information 1, and determines based on indication information 1 that request information A needs to be sent.
  • the IoT gateway device may refuse to forward IoT information #1 and send indication information 1 to IoT device 1, which is used to indicate to IoT device 1 that it needs to complete authentication and authorization. Accordingly, IoT device 1 performs authentication and authorization under the instruction of indication information 1.
  • IoT device 1 sends the aforementioned request information A to the IoT gateway device, and the IoT gateway device forwards the request information A.
  • the IoT gateway device may carry indication information 1 in the response information of IoT information #1 sent to IoT device 1, for example, the indication information 1 is carried in the response information of IoT joining request information, the response information of IoT discovery request information, or the response information of IoT invitation confirmation information.
  • the indication information 1 may be an indicator in the above information, and in specific encoding, may be a bit value in the information, or may be a parameter occupying several bits.
  • IoT device 1 when there is direct communication between IoT device 1 and IoT management device, IoT device 1 sends request information A to IoT management device, and IoT management device performs authentication and authorization on IoT device 1.
  • IoT device 1 when there is no direct communication between IoT device 1 and the IoT management device, IoT device 1 sends request information A to the IoT gateway device, and the IoT gateway device forwards the request information A, thereby completing the authentication and authorization of IoT device 1, so that IoT device 1 can perform related operations of the IoT.
  • the present application supports the IoT device 1 to perform authentication and authorization of the IoT device 1 under the instruction of the IoT gateway device.
  • method 300 further includes:
  • IoT device 1 sends IoT information #2 (eg, second information) to the IoT gateway device, which includes the first identifier and security credential 1.
  • IoT information #2 eg, second information
  • IoT gateway device receives IoT information #2.
  • IoT information #2 is used to indicate the IoT operation of the IoT management device or IoT server.
  • IoT information #2 includes information about IoT operations.
  • IoT operations include: IoT joining, IoT discovery, or IoT invitation confirmation, etc.
  • the information about IoT operations indicates IoT operations.
  • IoT information #2 can be an IoT joining request message (carrying the device identifier of IoT 1 or the first identifier of IoT 1).
  • an Internet of Things discovery request message (carrying at least one of the device identifier or the first identifier of Internet of Things 1) and an Internet of Things invitation confirmation message (carrying at least one of the device identifier or the first identifier of Internet of Things 1), etc.
  • S350 The IoT gateway device determines that the IoT device 1 passes the authentication and authorization.
  • the IoT gateway device determines that the IoT device 1 passes the authentication authorization, which can be further understood as: the IoT gateway device determines that the IoT device 1 is allowed to perform the IoT operation indicated by the IoT information #2, which can be implemented in the following two ways:
  • the Internet of Things gateway device sends a first identification and security credential 1 to the Internet of Things authentication device (which includes an Internet of Things management device or an Internet of Things server).
  • the Internet of Things authentication device which includes an Internet of Things management device or an Internet of Things server.
  • the IoT authentication device can be used to perform authentication and authorization on the IoT device 1, and after completing the authentication and authorization on the IoT device 1, the IoT authentication device configures the first identification and security credential 1 for the IoT device 1.
  • the IoT gateway device sends a first identification and security credential 1 to the IoT authentication device in an IoT request message, where the IoT request message may be any one or more of IoT authorization information, IoT authentication information, and IoT authentication authorization request information.
  • the IoT gateway device receives feedback information 1 from the IoT authentication device, and determines that the IoT device 1 passes the authentication authorization based on the feedback information 1.
  • the IoT authentication device determines that the IoT device 1 has passed the authentication authorization of the IoT authentication device for the IoT device 1 based on the first identification and security credential 1 sent by the IoT gateway device. Further, the IoT authentication device determines that the IoT device 1 is allowed to perform the IoT operation indicated by the IoT information #2.
  • the IoT authentication device sends feedback information 1 to the IoT gateway device, which is used to indicate to the IoT gateway device that the IoT device 1 has passed the authentication authorization of the IoT authentication device for the IoT device 1.
  • the feedback information 1 includes authorization for the IoT device 1 to perform the IoT operation indicated by the IoT information #2, that is, the security credential 1 and/or the first identifier can indicate that the IoT device 1 is allowed to perform the IoT operation indicated by the IoT information #2.
  • the IoT authentication device carries feedback information 1 in the response information of the IoT request information sent to the IoT gateway device.
  • the feedback information 1 may be a set of parameters, an indicator, or a value of a specific bit in the information.
  • the IoT gateway device obtains feedback information 1 through interaction with the IoT authentication device, and completes the confirmation of whether the IoT device 1 has passed the authentication authorization according to the feedback information 1. Further, the IoT gateway device can determine, according to the feedback information 1, whether the IoT device 1 is allowed to perform the IoT operation indicated by the IoT information #2.
  • the IoT gateway device receives security credential 2 (eg, second security credential) from the IoT authentication device, which is used to indicate that the IoT device 1 has passed the authentication authorization of the IoT authentication device for the IoT device 1.
  • security credential 2 eg, second security credential
  • the security credential 2 is used to indicate that the IoT device 1 has passed the authentication and authorization of the IoT authentication device to the IoT device 1.
  • it may further include allowing the IoT device 1 to perform the IoT operation indicated by the IoT information #2.
  • the IoT authentication device configures the security credential 2 for the IoT device 1, which is used to indicate to the IoT gateway device that the IoT device 1 has passed the authentication and authorization of the IoT authentication device to the IoT device 1.
  • the IoT authentication device sends the security credential 2 associated with the IoT device 1 to the IoT gateway device.
  • the IoT gateway device may also request the IoT authentication device for the security credential 2 associated with the IoT device 1 after receiving the IoT information #2 of the IoT device 1, and the IoT authentication device sends the security credential 2 to the IoT gateway device; or the IoT authentication device actively sends the security credential 2 associated with the IoT device 1 to the IoT gateway device serving the IoT device 1 after completing the authentication and authorization of the IoT device 1.
  • the IoT authentication device may also send security credentials 2 to the IoT device 1. Accordingly, the IoT device 1 carries security credentials 2 in the IoT information (e.g., IoT information #2) sent to the IoT gateway device, so that the IoT gateway device determines that the IoT device 1 has passed the authentication authorization.
  • the IoT information e.g., IoT information #2
  • the security credential 2 is associated with a device identification and/or a device credential of the IoT device 1 .
  • the IoT gateway device determines that the IoT device 1 has passed the authentication authorization based on the security certificate 2.
  • security certificate 2 is used to indicate that IoT device 1 has passed the authentication and authorization of IoT device 1 by IoT authentication device, which further includes allowing IoT device 1 to execute IoT operation indicated by IoT information #2.
  • the IoT gateway device determines whether the IoT device 1 has passed the authentication authorization based on the security certificate 2 issued by the IoT authentication device. For example, the IoT gateway device determines whether the IoT device 1 is the IoT device associated with the security certificate 2 based on the security certificate 2. If so, it is determined that the IoT device 1 has passed the authentication authorization. If not, it is determined that the IoT device 1 has not passed or completed the authentication authorization.
  • the IoT gateway device completes the confirmation of whether the IoT device 1 has passed the authentication authorization by interacting with the IoT authentication device.
  • the IoT gateway device sends IoT information #2 to the IoT management device or the IoT server.
  • the IoT gateway device can forward the IoT information #2 to the IoT authentication device.
  • the IoT information #2 includes at least one of an IoT identifier and indication information 2 (e.g., second indication information).
  • the IoT identifier and indication information 2 can both be used to indicate whether the IoT gateway device forwards the IoT information #2 to the IoT management device or the IoT server.
  • the IoT gateway device sends IoT information #2 to the IoT authentication device, including:
  • the IoT gateway device sends IoT information #2 to the IoT server.
  • IoT information #2 when IoT information #2 indicates IoT discovery, IoT information #2 includes indication information 2 (which may not include an IoT identifier), which is used to instruct the IoT gateway device to send IoT information #2 to the IoT server; when IoT information #2 indicates IoT joining or IoT invitation confirmation, IoT information #2 includes indication information 2 and/or an IoT identifier, and indication information 2 and/or an IoT identifier are used to instruct the IoT gateway device to send IoT operation information #2 to the IoT server.
  • indication information 2 which may not include an IoT identifier
  • IoT information #2 when IoT information #2 indicates IoT joining or IoT invitation confirmation, IoT information #2 includes indication information 2 and/or an IoT identifier, and indication information 2 and/or an IoT identifier are used to instruct the IoT gateway device to send IoT operation information #2 to the IoT server.
  • the IoT gateway device retrieves the local IoT configuration information according to the IoT identifier in IoT information #2, and searches in the IoT configuration information whether it contains indication information indicating whether the IoT is local. If it contains indication information indicating that the IoT is on the cloud or IoT server side, the IoT gateway device determines that the IoT is not local, and the IoT gateway device sends IoT information #2 to the IoT server.
  • the IoT server performs the IoT operation of the IoT server indicated by IoT information #2 according to IoT information #2. For example, if IoT information #2 indicates IoT discovery, the IoT server returns an IoT list; if IoT information #2 indicates IoT joining or IoT invitation confirmation, and IoT information #2 also includes at least one IoT identifier, the IoT server adds the IoT device to the IoT identified by the IoT identifier and adds it to the member list of the IoT. More specifically, the IoT server updates the IoT configuration information of the current IoT, and then adds the relevant information of IoT device 1.
  • the IoT gateway device determines whether to send IoT information #2 to the IoT server based on whether the IoT is local. For example, the IoT gateway device determines that the IoT is not local, or understands that the IoT is not a local service (for example, when the IoT gateway device receives the address of the IoT server configured by the IoT management device, or the IoT information #2 carries the address of the IoT server (for example, the destination address in IoT information #2 is the address of the IoT server), or the IoT information #2 carries the identification information of the application or service (such as domain name, URL, etc.) which can be further parsed to obtain the address of the IoT server), the IoT gateway device determines the IoT server based on IoT information #2 or the local IoT configuration information, and then sends IoT information #2 to the IoT server.
  • the IoT gateway device determines the IoT server based on IoT information #2 or the local
  • the IoT server performs the IoT operation of the IoT server indicated by IoT information #2 according to IoT information #2. For example, if IoT information #2 indicates IoT discovery, the IoT server returns the IoT list; if IoT information #2 indicates IoT joining or IoT invitation confirmation, and IoT information #2 also includes at least one IoT identifier, the IoT server adds IoT device 1 to the IoT identified by the IoT identifier and adds it to the member list of the IoT. More specifically, the IoT server updates the IoT configuration information of the current IoT, and then adds the relevant information of IoT device 1.
  • IoT device 1 indicates to the IoT gateway device through indication information 2 in IoT information #2 that it needs to send IoT information #2 to the IoT server.
  • indication information 2 can also be used to indicate whether the Internet of Things is local. For example, when indication information 2 is used to indicate that the Internet of Things is local, the Internet of Things gateway device sends Internet of Things information #2 to the Internet of Things management device; or, when indication information 2 is used to indicate that the Internet of Things is not local, the Internet of Things gateway device sends Internet of Things information #2 to the Internet of Things server.
  • the IoT gateway device sends IoT information #2, including:
  • the IoT gateway device sends IoT information #2 to the IoT management device.
  • the IoT information #2 when the IoT information #2 indicates that the IoT is discovered, the IoT information #2 includes indication information 2 (which may not include the IoT tag). Identification), which is used to instruct the IoT gateway device to send IoT information #2 to the IoT management device; when IoT information #2 indicates IoT joining or IoT invitation confirmation, IoT information #2 includes indication information 2 and/or IoT identification, and indication information 2 and/or IoT identification are used to instruct the IoT gateway device to send IoT information #2 to the IoT management device.
  • indication information 2 which may not include the IoT tag.
  • Identification which is used to instruct the IoT gateway device to send IoT information #2 to the IoT management device
  • IoT information #2 when IoT information #2 indicates IoT joining or IoT invitation confirmation, IoT information #2 includes indication information 2 and/or IoT identification, and indication information 2 and/or IoT identification are used to instruct the IoT gateway device to send IoT information
  • the IoT gateway device retrieves the local IoT configuration information according to the IoT identification in IoT information #2, and searches the IoT configuration information for whether it contains indication information of whether the IoT is local. If it does not contain indication information indicating that the IoT is on the cloud or server side, the IoT gateway device determines that the IoT is local, and the IoT gateway device sends IoT information #2 to the IoT management device.
  • the IoT management device performs the IoT operation of the IoT management device indicated by IoT information #2 according to IoT information #2. For example, if IoT information #2 indicates IoT discovery, the IoT management device returns the IoT list of the local or IoT server; if IoT information #2 indicates IoT joining or IoT invitation confirmation, and IoT information #2 also includes at least one IoT identifier, the IoT management device adds IoT device 1 to the IoT identified by the IoT identifier and adds it to the member list of the IoT. More specifically, the IoT management device updates the IoT configuration information of the current IoT, and then adds the relevant information of IoT device 1.
  • the IoT gateway device determines whether to send IoT information #2 to the IoT management device based on whether the IoT is local. For example, the IoT gateway device determines that the IoT is local, or understands that the IoT is a local service (for example, when the IoT gateway device has never received the address of the IoT server configured by the IoT management device, or the IoT information #2 carries the identifier of the IoT management device (IP address, generic public subscription identifier (GPSI), medium access control (MAC) address, domain name or other information that can be used to identify the IoT management device) (for example, the destination address in the IoT information #2 is the address of the IoT management device), or the IoT information #2 carries the identification information of the application or service (such as domain name, URL, etc.) which can be further parsed to obtain the address of the IoT management device), the IoT gateway device determines the IoT management device based on the IoT
  • IP address
  • the IoT management device performs the IoT operation of the IoT management device indicated by IoT information #2 according to IoT information #2. For example, if IoT information #2 indicates IoT discovery, the IoT management device returns the IoT list of the local or IoT server; if IoT information #2 indicates IoT joining or IoT invitation confirmation, and IoT information #2 also includes at least one IoT identifier, the IoT management device adds IoT device 1 to the IoT identified by the IoT identifier and adds it to the member list of the IoT. More specifically, the IoT management device updates the IoT configuration information of the current IoT, and then adds the relevant information of IoT device 1.
  • the IoT device indicates to the IoT gateway device through indication information 2 in IoT information #2 that it needs to send IoT information #2 to the IoT management device.
  • the IoT operation of the IoT management device indicated by the IoT information #2 is requested by IoT device 1 to be executed by the IoT management device.
  • the IoT device can request the IoT management device to execute the IoT operation requested by the IoT device, which can enhance the flexibility of executing the IoT operation of the IoT device.
  • IoT management device can directly send IoT invitation information to IoT device 1, and the IoT invitation information is used to indicate that IoT device 1 joins the IoT managed by the IoT management device; accordingly, the IoT management device can join IoT device 1 to the IoT according to IoT information #2.
  • the IoT management device can send the above-mentioned IoT invitation information to IoT device 1 through the forwarding of the IoT gateway device, which is not limited in this application. In this way, the operation of the IoT device can be simplified, and the IoT management device can actively control the IoT device to join the IoT, thereby enhancing the centralized management function of the IoT management device.
  • the actions performed by the IoT management device can also be performed by the IoT server, and this application does not limit this. A unified explanation is given here, and no further description is given later.
  • the present application supports the IoT gateway device to complete the confirmation of whether the IoT device 1 has passed the authentication authorization, thereby ensuring the security of information interaction between other devices in the IoT.
  • FIG. 3 The method shown in FIG. 3 will be further described below in conjunction with FIG. 4 .
  • FIG4 is an interactive flow chart of a method 400 for authentication and authorization in an embodiment of the present application.
  • the method 400 shown in FIG4 can be applied to the above-mentioned communication system 100, and can also be applied to other communication systems involving the Internet of Things.
  • the method 400 includes:
  • the Internet of Things management device performs registration authentication and authorization for the Internet of Things server.
  • the IoT management device first completes the authentication and authorization at the IoT server. After authorization, the IoT server configures the IoT management device with security credentials 3. Optionally, the IoT server also configures the IoT management device with an application layer identifier 3. The application layer identifier 3 may also be pre-configured in the IoT management device, which is not limited in this application.
  • S402 Establish a communication connection between the IoT management device and the IoT gateway device.
  • a communication connection is established between the IoT management device and the IoT gateway device.
  • a communication connection can be established between the IoT management device and the IoT gateway device based on PC5, Wi-Fi or Bluetooth (BT).
  • the IoT management device sends the address of the IoT server to the IoT gateway device.
  • the IoT management device may send the address of the IoT server to the IoT gateway device through the IoT server (PIN sever) configuration information, or may send the address of the IoT server to the IoT gateway device through the IoT announcement (PIN announcement) information (which includes the IoT ID, IoT server address, and IoT management device ID/address) or the IoT invitation (PIN invite) information (which includes the IoT ID, IoT server address, and other description information of the IoT).
  • PIN announcement which includes the IoT ID, IoT server address, and IoT management device ID/address
  • IoT invitation (PIN invite) information which includes the IoT ID, IoT server address, and other description information of the IoT.
  • the IoT gateway device performs authentication and authorization on the IoT server.
  • the IoT gateway device may send a request message S for authentication and authorization to the IoT server based on the address of the IoT server sent by the IoT management device.
  • the request information S sent by the IoT gateway device to the IoT server includes the device identification and device credentials of the IoT gateway device. After completing the registration, authentication and authorization of the IoT gateway device, the IoT server configures the security credentials 4 for the IoT gateway device.
  • the Internet of Things server further configures the Internet of Things gateway device with an application layer identifier 4.
  • the application layer identifier 4 may also be pre-configured in the Internet of Things gateway device, which is not limited in the present application.
  • IoT device 1 discovers the IoT management device and the IoT gateway device, and establishes a communication connection with the two (such as PC5, Wi-Fi or Bluetooth).
  • this application does not limit the order in which IoT device 1 discovers the IoT management device and the IoT gateway device.
  • IoT device 1 first discovers the IoT management device, obtains the information of the IoT gateway device from the IoT management device, and then establishes a communication connection with the IoT management device.
  • the communication between IoT device 1 and the IoT management device can be interrupted.
  • the Internet of Things management device sends the address of the Internet of Things server to the Internet of Things device 1.
  • the address of the Internet of Things server sent by the Internet of Things device 1 through the Internet of Things management device can send request information A to the Internet of Things server during authentication and authorization, and the request information A is forwarded by the Internet of Things gateway device.
  • the address of the Internet of Things server can be used by the Internet of Things device 1 to determine the receiving target of the request information A.
  • IoT device 1 sends request information A to the IoT gateway device.
  • the IoT gateway device determines that the request information A is used to request authentication authorization for the IoT device 1 .
  • the IoT gateway device sends request information A to the IoT authentication device.
  • the IoT gateway device sends response information A to IoT device 1.
  • IoT device 1 sends IoT information #2 to the IoT authentication device.
  • the IoT device After completing the authentication and authorization of the IoT device 1, the IoT device sends IoT information #2 to the IoT authentication device.
  • IoT information #2 can be found in the previous text, and will not be repeated here.
  • the method 400 further includes: include:
  • the IoT gateway device determines that IoT device 1 passes authentication and authorization.
  • the method 400 further includes:
  • the IoT gateway device sends IoT information #2 to the IoT server.
  • the IoT gateway device After the IoT gateway device determines that the IoT device 1 has passed the aforementioned authentication and authorization, the IoT gateway device sends IoT information #2 to the IoT server.
  • IoT information #2 For details, please refer to the description of S370a, which will not be repeated here.
  • the method 400 may further include:
  • the IoT gateway device sends IoT information #2 to the IoT management device.
  • the IoT gateway device After the IoT gateway device determines that the IoT device 1 has passed the aforementioned authentication and authorization, the IoT gateway device sends IoT information #2 to the IoT management device. For details, please refer to the description of S370b, which will not be repeated here.
  • IoT gateway device sends IoT information #2 to the IoT server or the IoT management device can be determined based on the indication information 2 and/or IoT identifier carried in the IoT information #2. For details, please refer to the previous description and will not be repeated here.
  • the method 400 further includes:
  • the IoT management device determines that IoT device 1 passes the authentication and authorization.
  • the IoT management device determines that IoT device 1 passes authentication and authorization, which can be further understood as: the IoT management device determines that IoT device 1 is allowed to perform the IoT operation indicated by IoT information #2, which can be implemented in the following two ways:
  • the Internet of Things management device sends a first identification and security certificate 1 to the Internet of Things server.
  • the IoT server can be used to perform authentication and authorization on the IoT device, and after completing the authentication and authorization of the IoT device 1, the IoT server configures the first identification and security credential 1 for the IoT device 1.
  • the IoT management device sends a first identification and security credentials to the IoT server in an IoT request message, where the IoT request message may be any one or more of IoT authorization information, IoT authentication information, IoT authentication authorization request information, etc.
  • the IoT management device receives feedback information 2 from the IoT server, and determines, based on the feedback information 2, that the IoT device 1 has passed the authentication and authorization.
  • the IoT server determines that the IoT device 1 has passed the IoT server's authentication and authorization of the IoT device 1 based on the first identification and security credential 1 sent by the IoT management device. Further, the IoT server determines that the IoT device 1 is allowed to perform the IoT operation indicated by the IoT information #2.
  • the IoT server sends feedback information 2 to the IoT management device, which is used to indicate to the IoT management device that the IoT device 1 has passed the authentication authorization of the IoT server for the IoT device 1.
  • the feedback information 2 includes the authorization for the IoT device 1 to perform the IoT operation indicated by the IoT information #2 (or, it can also be understood as including the authorization for the IoT operation that the IoT device 1 requests the IoT management device or the IoT server to perform, and this application does not limit this expression), that is, the security certificate 1 and/or the first identification indicate that the IoT device 1 is allowed to perform the IoT operation indicated by the IoT information #2.
  • the IoT server carries feedback information 2 in the response information of the IoT request information sent to the IoT management device.
  • the feedback information 2 may be a set of parameters, or an indicator, or a value of a specific bit in the information.
  • the IoT management device obtains feedback information 2 through interaction with the IoT server, and completes the confirmation of whether IoT device 1 has passed the authentication authorization according to feedback information 2. Further, the IoT management device can determine, according to feedback information 2, whether IoT device 1 is allowed to perform the IoT operation indicated by IoT information #2.
  • the IoT management device receives the security certificate 2 from the IoT server, which is used to indicate that the IoT device 1 has passed the authentication and authorization of the IoT server.
  • the security credential 2 is used to indicate that the IoT device 1 has passed the authentication and authorization of the IoT server. Among them, it may further include allowing the IoT device 1 to execute the IoT indicated by the IoT information #2. After completing the authentication and authorization of the IoT device 1, the IoT server configures the security credential 2 for the IoT device 1, which is used to indicate to the IoT management device that the IoT device 1 has passed the authentication and authorization of the IoT server to the IoT device 1.
  • the IoT server sends the security credential 2 associated with IoT device 1 to the IoT management device.
  • the IoT management device may also request the security credential 2 associated with IoT device 1 from the IoT server, and the IoT server sends the security credential 2 to the IoT management device; or after completing the authentication and authorization of IoT device 1, the IoT server actively sends the security credential 2 associated with IoT device 1 to the IoT management device serving IoT device 1.
  • the IoT server may also send security credentials 2 to the IoT device 1.
  • the IoT device 1 carries security credentials 2 in the IoT information (e.g., IoT information #2) sent to the IoT management device, so that the IoT management device determines that the IoT device 1 has passed the authentication authorization.
  • the security credential 2 is associated with a device identification and/or a device credential of the IoT device 1 .
  • the IoT management device determines that the IoT device 1 has passed the authentication authorization based on the security certificate 2.
  • the security credential 2 is used to indicate that the IoT device 1 has passed the authentication and authorization of the IoT server, further including allowing the IoT device 1 to perform the IoT operation indicated by the IoT information #2.
  • the IoT management device determines whether the IoT device 1 has passed the authentication and authorization based on the security credential 2 issued by the IoT server. For example, the IoT management device determines whether the IoT device 1 is the IoT device associated with the security credential 2 based on the security credential 2. If so, it is determined that the IoT device 1 has passed the authentication and authorization. If not, it is determined that the IoT device 1 has not passed or completed the authentication and authorization.
  • the IoT management device can directly determine whether IoT device 1 has passed the authentication and authorization, and there is no need to interact with the IoT server to determine whether IoT device 1 has passed the authentication and authorization.
  • the IoT management device completes the confirmation of whether the IoT device 1 has passed the authentication and authorization by interacting with the IoT server.
  • the IoT management device performs IoT operations according to IoT information #2.
  • IoT management device if IoT information #2 includes IoT discovery, the IoT management device returns the IoT list of the local or IoT server; if IoT information #2 includes IoT joining or IoT invitation confirmation, the IoT management device adds IoT device 1 to the IoT and adds it to the member list of the IoT. More specifically, the IoT management device updates the current IoT configuration information and then adds the relevant information of IoT device 1 (e.g., the application layer client ID of IoT device 1, device identification, whether it can be discovered, and the services it can provide, etc.).
  • the relevant information of IoT device 1 e.g., the application layer client ID of IoT device 1, device identification, whether it can be discovered, and the services it can provide, etc.
  • the IoT management device can directly send IoT invitation information to IoT device 1, and the IoT invitation information is used to indicate that IoT device 1 joins the IoT managed by the IoT management device; accordingly, the IoT management device can join IoT device 1 to the IoT according to IoT information #2.
  • the IoT management device can send the above-mentioned IoT invitation information to IoT device 1 through the forwarding of the IoT gateway device, which is not limited in this application. In this way, the operation of the IoT device can be simplified, and the IoT management device can actively control the IoT device to join the IoT, thereby enhancing the centralized management function of the IoT management device.
  • FIG. 3 The method shown in FIG. 3 will be further described below in conjunction with FIG. 5 .
  • FIG5 is an interactive flow chart of a method 500 for authentication and authorization in an embodiment of the present application.
  • the method 500 shown in FIG5 can be applied to the above-mentioned communication system 100, and can also be applied to other communication systems involving the Internet of Things.
  • the method 500 includes:
  • IoT device 1 sends IoT information #1 to the IoT gateway device.
  • the IoT gateway device receives IoT information #1 from IoT device 1.
  • the IoT gateway device determines that the IoT device 1 is in a non-authentication and authorization state.
  • the IoT gateway device sends a request message B to the IoT server, which is used to request authentication and authorization for the IoT device 1.
  • the request information B sent by the IoT gateway device to the IoT server includes the device identification and device credentials of the IoT device 1.
  • the description of the request information B can be found in the aforementioned request information A, which will not be repeated here.
  • the IoT server sends a response message B to the IoT gateway device, which is used to indicate that the IoT device 1 has passed the authentication authorization.
  • the IoT gateway device sends IoT information #1 to the IoT authentication device.
  • the IoT gateway device forwards IoT information #1.
  • the IoT information #1 includes at least one of an IoT identifier and indication information 3.
  • the IoT identifier and indication information 3 are used to instruct the IoT gateway device to forward the IoT information #1 to the IoT management device/IoT server.
  • the IoT gateway device sends IoT information #1 to the IoT server.
  • IoT information #1 when IoT information #1 indicates IoT discovery, IoT information #1 includes indication information 3 (which may not include IoT identification), which is used to indicate that IoT information #1 is sent to the IoT server; when IoT information #1 indicates IoT joining or IoT invitation confirmation, IoT information #1 includes indication information 3 and/or IoT identification, which is used to indicate that IoT information #1 is sent to the IoT server.
  • the IoT gateway device retrieves the local IoT configuration information according to the IoT identification in IoT information #1, and searches the IoT configuration information for whether it contains indication information indicating whether the IoT is local. If it contains indication information indicating that the IoT is on the cloud or server side, the IoT gateway device determines that the IoT is not local, and the IoT gateway device sends IoT information #1 to the IoT server.
  • the IoT server performs the IoT operation of the IoT server indicated by IoT information #1 according to IoT information #1. For example, if IoT information #1 indicates IoT discovery, the IoT server returns the IoT list; if IoT information #1 indicates IoT joining or IoT invitation confirmation, and IoT information #1 also includes at least one IoT identifier, the IoT server adds IoT device 1 to the IoT identified by the IoT identifier and adds it to the member list of the IoT. More specifically, the IoT server updates the IoT configuration information of the current IoT, and then adds the relevant information of IoT device 1.
  • the IoT gateway device determines whether to send IoT information #1 to the IoT server based on whether the IoT is local. For example, the IoT gateway device determines that the IoT is not local, or understands that the IoT is not a local service (for example, when the IoT gateway device receives the address of the IoT server configured by the IoT management device, or the IoT information #1 carries the address of the IoT server (for example, the destination address in IoT information #1 is the address of the IoT server), or the IoT information #1 carries the identification information of the application or service (such as domain name, URL, etc.) which can be further parsed to obtain the address of the IoT server), the IoT gateway device determines the IoT server based on IoT information #1 or the local IoT configuration information, and sends IoT information #1 to the IoT server. Accordingly, the IoT server processes IoT information #1. Accordingly, the IoT management
  • the IoT device sends IoT information #1 to the IoT server through indication information 3 in IoT information #1.
  • the IoT gateway device sends IoT information #1 to the IoT management device.
  • IoT information #1 when IoT information #1 indicates IoT discovery, IoT information #1 includes indication information 3 (which may not include IoT identification), which is used to indicate that IoT information #1 is sent to the IoT management device; when IoT information #1 indicates IoT joining or IoT invitation confirmation, IoT information #1 includes indication information 3 and/or IoT identification, which is used to indicate that IoT information #1 is sent to the IoT management device.
  • the IoT gateway device retrieves the local IoT configuration information according to the IoT identification in IoT information #1, and searches the IoT configuration information for whether it contains indication information indicating whether the IoT is local. If it does not contain indication information indicating that the IoT is on the cloud or server side, the IoT gateway device determines that the IoT is local, and the IoT gateway device sends IoT information #1 to the IoT management device.
  • the IoT management device performs the IoT operation of the IoT management device indicated by IoT information #1 according to IoT information #1. For example, if IoT information #1 indicates IoT discovery, the IoT management device returns the IoT list of the local or IoT server; if IoT information #1 indicates IoT joining or IoT invitation confirmation, and IoT information #1 also includes at least one IoT identifier, the IoT management device adds IoT device 1 to the IoT identified by the IoT identifier and adds it to the member list of the IoT. More specifically, the IoT management device updates the IoT configuration information of the current IoT, and then adds the relevant information of IoT device 1.
  • the IoT gateway device determines whether to send IoT information #1 to the IoT management device based on whether the IoT is local. For example, the IoT gateway device determines that the IoT is local, or understands that the IoT is a local service (for example, when the IoT gateway device has never received the address of the IoT server configured by the IoT management device, or the IoT information #1 carries the identifier of the IoT management device (IP address, GPSI, MAC address, domain name or other information that can be used to identify the IoT management device) (for example, the destination address in IoT information #1 is the address of the IoT management device), or the IoT information #1 carries the identification information of the application or service (such as domain name, URL, etc.) which can be further parsed to obtain the address of the IoT management device), the IoT gateway device determines whether to send IoT information #1 to the IoT management device based on the IoT.
  • the Internet of Things information #1 or the local Internet of Things configuration information determines the Internet of Things management device
  • the Internet of Things information #1 is sent to the Internet of Things management device. Accordingly, the Internet of Things management device processes the Internet of Things information #1. The specific processing method can be seen above and will not be repeated here.
  • the IoT device instructs the IoT gateway device to send IoT information #1 to the IoT management device through indication information 3 in IoT information #1.
  • indication information 3 can also be used to indicate whether the Internet of Things is local.
  • the Internet of Things gateway device sends Internet of Things information #1 to the Internet of Things management device; or, when indication information 3 is used to indicate that the Internet of Things is not local, the Internet of Things gateway device sends Internet of Things information #1 to the Internet of Things server.
  • the IoT gateway device sends a request message B to the IoT management device, which is used to request authentication and authorization for the IoT device 1.
  • the specific content can be found in the above description, which will not be repeated here.
  • the present application supports that after the IoT gateway device confirms that IoT device 1 has not completed authentication and authorization, it can proxy IoT device 1 to send request information for authentication and authorization of IoT device 1 to the IoT server, support the completion of authentication and authorization of IoT device 1, and enable IoT device 1 to perform related operations of the IoT.
  • FIG6 is an interactive flow chart of a method 600 for authentication and authorization in an embodiment of the present application.
  • the method 600 shown in FIG6 can be applied to the above-mentioned communication system 100, and can also be applied to other communication systems involving the Internet of Things.
  • the method 600 includes:
  • the IoT gateway device sends IoT information #3 to the IoT management device.
  • the IoT management device receives IoT information #3 sent by IoT device 1 and forwarded by the IoT gateway device.
  • the description of IoT information #3 can be found in the description of IoT information #2, which will not be repeated here.
  • S620 The IoT management device determines that IoT device 1 passes authentication and authorization.
  • the IoT management device performs IoT operations according to IoT information #3.
  • the present application supports the Internet of Things management device to complete the confirmation of whether the Internet of Things device 1 has passed the authentication authorization, thereby ensuring the security of information interaction between other devices in the Internet of Things.
  • method 600 further includes:
  • the Internet of Things management device sends the address of the Internet of Things server to the Internet of Things device 1.
  • IoT device 1 sends IoT information #4 to the IoT management device.
  • the IoT management device receives IoT information #4 from IoT device 1.
  • the description of IoT information #4 can be found in the description of IoT information #1, which will not be repeated here.
  • the Internet of Things management device determines that the Internet of Things device 1 is in a non-authentication and authorization state.
  • the Internet of Things management device sends instruction information 2 to the Internet of Things device 1, which is used to instruct the Internet of Things device 1 to send request information A.
  • the present application supports that after the IoT management device confirms that IoT device 1 has not completed authentication and authorization, it can send instruction information to IoT device 1.
  • IoT device 1 completes the authentication and authorization process for IoT device 1 under the instruction of the instruction information sent by the IoT management device, so that IoT device 1 can perform related operations of the IoT.
  • the Internet of Things management device sends a request message C to the Internet of Things server, which is used to request authentication and authorization for the Internet of Things device 1.
  • the present application supports that after the IoT management device confirms that IoT device 1 has not completed authentication and authorization, it can proxy IoT device 1 to send request information for authentication and authorization of IoT device 1 to the IoT server, support the completion of authentication and authorization of IoT device 1, and enable IoT device 1 to perform related operations of the IoT.
  • the terminal and the network device may include a hardware structure and/or a software module, and implement the above functions in the form of a hardware structure, a software module, or a hardware structure plus a software module. Whether one of the above functions is executed in the form of a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraints of the technical solution.
  • Fig. 7 is a schematic block diagram of a communication device 700 according to an embodiment of the present application.
  • the communication device 700 includes a processor 710 and a communication interface 720, and the processor 710 and the communication interface 720 are interconnected via a bus 730.
  • the communication device 700 shown in Fig. 7 may be a network device or a terminal device.
  • the communication device 700 further includes a memory 740 .
  • the memory 740 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or portable read-only memory (CD-ROM), and the memory 740 is used for related instructions and data.
  • RAM random access memory
  • ROM read-only memory
  • EPROM erasable programmable read-only memory
  • CD-ROM portable read-only memory
  • Processor 710 may be one or more central processing units (CPUs). When processor 710 is a CPU, the CPU may be a single-core CPU or a multi-core CPU.
  • CPUs central processing units
  • the processor 710 in the communication device 700 is used to read the computer program or instructions stored in the memory 740, and illustratively, perform the following operations: receive request information A from the Internet of Things device 1, the request information A includes the device identification and device credentials of the Internet of Things device 1; determine that the request information A is used to request authentication and authorization for the Internet of Things device 1; send the request information A to the Internet of Things authentication device; send response information A to the Internet of Things device 1, the response information A is used to indicate that the Internet of Things device 1 has passed the authentication and authorization, and the response information A includes the first identification and security credential 1 configured by the Internet of Things authentication device for the Internet of Things device 1.
  • the following operations can be performed: receiving IoT information #1 from IoT device 1; determining that IoT device 1 is in a non-authentication and authorization state; and sending indication information 1 to IoT device 1, which is used to instruct IoT device 1 to send request information A.
  • the following operations may be performed: receiving IoT information #2 from IoT device 1, which includes a first identifier and security credential 1; determining that IoT device 1 passes authentication authorization; and sending IoT information #2 to an IoT authentication device.
  • the communication device 700 is an Internet of Things gateway device, it will be responsible for executing the methods or steps related to the Internet of Things gateway device in the above method embodiments.
  • the processor 710 in the communication device 700 is used to read the computer program or instructions stored in the memory 740, and illustratively, perform the following operations: receive Internet of Things information #3 from the Internet of Things gateway device, the Internet of Things information #3 includes a first identifier and a security credential 1, the first identifier and the security credential 1 are used to indicate that the Internet of Things device 1 has passed the authentication authorization; determine that the Internet of Things device 1 has passed the authentication authorization; and perform corresponding Internet of Things operations according to the Internet of Things information #3.
  • the communication device 700 is an Internet of Things management device, it will be responsible for executing the methods or steps related to the Internet of Things management device in the above method embodiments.
  • the processor 710 in the communication device 700 is used to read the computer program or instructions stored in the memory 740, and illustratively, perform the following operations: send a request message A to the Internet of Things gateway device, the request message A is used to request authentication authorization for the Internet of Things device 1, and the request message A includes the device identification and device certificate of the Internet of Things device 1; receive a response message A sent from the Internet of Things gateway device, the response message A is used to indicate that the Internet of Things device 1 has passed the authentication authorization, and the response message A includes the first identification and security certificate 1 configured by the Internet of Things authentication device for the Internet of Things device 1.
  • the communication device 700 is an IoT device 1, it will be responsible for executing the methods or steps related to the IoT device 1 in the above method embodiments.
  • Fig. 8 is a schematic block diagram of a communication device 800 according to an embodiment of the present application.
  • the communication device 800 includes a transceiver unit 810 and a processing unit 820.
  • the transceiver unit 810 and the processing unit 820 are exemplarily introduced below.
  • the transceiver unit 810 may include a sending unit and a receiving unit, which are respectively used to implement the sending or receiving functions in the above method embodiments; it may further include a processing unit, which is used to implement functions other than sending or receiving.
  • the transceiver unit 810 is used to receive a request from an IoT device.
  • Information A request information A includes the device identification and device credentials of the Internet of Things device 1; the processing unit 820 is used to determine that the request information A is used to request authentication and authorization for the Internet of Things device 1; the transceiver unit 810 is also used to send the request information A to the Internet of Things authentication device; the transceiver unit 810 is also used to send the response information A to the Internet of Things device 1, the response information A is used to indicate that the Internet of Things device 1 has passed the authentication and authorization, and the response information A includes the first identification and security credential 1 configured by the Internet of Things authentication device for the Internet of Things device 1.
  • the processing unit 820 is used to execute the contents of the steps involving processing, coordination, etc. in the IoT gateway device. For example, the processing unit 820 is used to determine whether the IoT device 1 passes the authentication authorization.
  • the transceiver unit 810 is used to receive IoT information #3 from the IoT gateway device, where the IoT information #3 includes a first identifier and a security credential 1, and the first identifier and the security credential 1 are used to indicate that the IoT device 1 has passed the authentication authorization; the processing unit 820 is used to determine that the IoT device 1 has passed the authentication authorization; the processing unit 820 is also used to perform corresponding IoT operations according to the IoT information #3.
  • the transceiver unit 810 When the communication device 800 is an Internet of Things device 1, the transceiver unit 810 is used to send a request message A to the Internet of Things gateway device, where the request message A is used to request authentication and authorization for the Internet of Things device 1, and the request message A includes the device identification and device certificate of the Internet of Things device 1; the transceiver unit 810 is also used to receive a response message A sent from the Internet of Things gateway device, where the response message A is used to indicate that the Internet of Things device 1 has passed the authentication and authorization, and the response message A includes the first identification and security certificate 1 configured for the Internet of Things device 1.
  • the communication device 800 further includes a storage unit 830, and the storage unit 830 is used to store a program or code for executing the aforementioned method.
  • the communication device 800 when the communication device 800 is an IoT gateway device, it will be responsible for executing the methods or steps related to the IoT gateway device in the aforementioned method embodiment; when the communication device 800 is an IoT management device, it will be responsible for executing the methods or steps related to the IoT management device in the aforementioned method embodiment; when the communication device 800 is an IoT device 1, it will be responsible for executing the methods or steps related to the IoT device 1 in the aforementioned method embodiment.
  • each operation of FIG. 8 may also refer to the corresponding description of the method shown in the above embodiment, which will not be repeated here.
  • the device embodiments shown in Figures 7 and 8 are used to implement the contents described in the aforementioned method embodiments Figures 3 to 6. Therefore, the specific execution steps and methods of the devices shown in Figures 7 and 8 can refer to the contents described in the aforementioned method embodiments.
  • the above-mentioned transceiver unit may include a sending unit and a receiving unit.
  • the sending unit is used to perform a sending action of the communication device
  • the receiving unit is used to perform a receiving action of the communication device.
  • the embodiment of the present application combines the sending unit and the receiving unit into one transceiver unit. A unified description is given here, and no further description is given later.
  • Fig. 9 is a schematic diagram of a communication device 900 according to an embodiment of the present application.
  • the communication device 900 may be used to implement the functions of the PECG/IoT management device or the IoT device in the above method.
  • the communication device 900 includes: an input/output interface 920 and a processor 910.
  • the input/output interface 920 may be an input/output circuit.
  • the processor 910 may be a signal processor, a chip, or other integrated circuit that can implement the method of the present application.
  • the input/output interface 920 is used for inputting or outputting signals or data.
  • the input/output interface 920 is used to receive request information A from the IoT device, the request information A includes the device identification and device credentials of the IoT device 1; send request information A to the IoT authentication device; send response information A to the IoT device 1, the response information A is used to indicate that the IoT device 1 has passed the authentication authorization, and the response information A includes the first identification and security credentials 1 configured for the IoT device 1.
  • the processor 910 is used to execute some or all steps of any one of the methods provided in the embodiments of the present application. Exemplarily, the processor 910 is used to determine that the request information A is used to request authentication authorization for the IoT device 1 and that the IoT device 1 has passed the authentication authorization, and so on.
  • the input/output interface 920 is used to receive IoT information #3 from the IoT gateway device, where IoT information #3 includes a first identifier and a security credential 1, and the first identifier and security credential 1 are used to indicate that the IoT device 1 has passed the authentication authorization.
  • the processor 910 is used to execute some or all of the steps of any one of the methods provided in the embodiments of the present application. Exemplarily, the processor 910 is used to determine that the IoT device 1 has passed the authentication authorization and to perform corresponding IoT operations according to the IoT information #3, etc.
  • the input-output interface 920 is used to send a request message A to the Internet of Things gateway device, the request message A is used to request authentication and authorization for the Internet of Things device 1, and the request message A includes the device identification and device certificate of the Internet of Things device 1; the input-output interface 920 is used to receive a response message A sent from the Internet of Things gateway device, the response message A is used to indicate that the Internet of Things device 1 has passed the authentication and authorization, and the response message A includes the first identification and security certificate 1 configured for the Internet of Things device 1.
  • the processor 910 executes instructions stored in the memory to implement the network device or terminal device to implement function.
  • the communication device 900 also includes a memory.
  • processor and memory are integrated together.
  • the memory is outside the communication device 900 .
  • the processor 910 may be a logic circuit, and the processor 910 inputs/outputs messages or signals through the input/output interface 920.
  • the logic circuit may be a signal processor, a chip, or other integrated circuit that can implement the method of the embodiment of the present application.
  • FIG. 9 The above description of the device in FIG. 9 is only an exemplary description.
  • the device can be used to execute the method described in the above embodiment.
  • FIG10 is a schematic block diagram of a communication device 1000 of an embodiment of the present application.
  • the communication device 1000 may be a network device or a chip (if the IoT gateway device/IoT management device/IoT device is a network device).
  • the communication device 1000 may be used to perform the operations performed by the network device in the method embodiments shown in FIGS. 3 to 6 above.
  • FIG. 10 shows a simplified schematic diagram of the base station structure.
  • the base station includes a part 1010, a part 1020, and a part 1030.
  • Part 1010 is mainly used for baseband processing, controlling the base station, etc.;
  • Part 1010 is usually the control center of the base station, which can usually be called a processor, and is used to control the base station to perform the processing operations on the network device side in the above method embodiment.
  • Part 1020 is mainly used to store computer program code and data.
  • Part 1030 is mainly used for receiving and transmitting radio frequency signals and converting radio frequency signals into baseband signals; Part 1030 can usually be called a transceiver module, a transceiver, a transceiver circuit, or a transceiver, etc.
  • the transceiver module of part 1030 which can also be called a transceiver or a transceiver, etc., includes an antenna 1033 and a radio frequency circuit (not shown in FIG. 10), wherein the radio frequency circuit is mainly used for radio frequency processing.
  • the device for implementing the receiving function in part 1030 may be regarded as a receiver, and the device for implementing the transmitting function may be regarded as a transmitter, that is, part 1030 includes a receiver 1032 and a transmitter 1031.
  • the receiver may also be referred to as a receiving module, a receiver, or a receiving circuit, etc.
  • the transmitter may be referred to as a transmitting module, a transmitter, or a transmitting circuit, etc.
  • Part 1010 and part 1020 may include one or more single boards, each of which may include one or more processors and one or more memories.
  • the processor is used to read and execute the program in the memory to realize the baseband processing function and the control of the base station. If there are multiple single boards, each single board can be interconnected to enhance the processing capability. As an optional implementation, multiple single boards may share one or more processors, or multiple single boards may share one or more memories, or multiple single boards may share one or more processors at the same time.
  • the transceiver module of part 1030 is used to execute the transceiver-related processes executed by the network device in the embodiments shown in Figures 3 to 6.
  • the processor of part 1010 is used to execute the processing-related processes executed by the network device in the embodiments shown in Figures 3 to 6.
  • the processor of part 1010 is used to execute processes related to the processing performed by the communication device in the embodiments shown in Figures 3 to 6.
  • the transceiver module of part 1030 is used to execute the transceiver-related processes performed by the communication device in the embodiments shown in Figures 3 to 6.
  • FIG. 10 is merely an example and not a limitation, and the network device including the processor, memory, and transceiver described above may not rely on the structures shown in FIG. 7 to FIG. 9 .
  • the chip When the communication device 1000 is a chip, the chip includes a transceiver, a memory and a processor.
  • the transceiver may be an input/output circuit or a communication interface;
  • the processor may be a processor, a microprocessor or an integrated circuit integrated on the chip.
  • the sending operation of the network device in the above method embodiment may be understood as the output of the chip, and the receiving operation of the network device in the above method embodiment may be understood as the input of the chip.
  • FIG11 is a schematic block diagram of a communication device 1100 of an embodiment of the present application.
  • the communication device 1100 may be a terminal device, a processor of a terminal device, or a chip (if the IoT gateway device/IoT management device/IoT device is a terminal device).
  • the communication device 1100 may be used to perform the operations performed by the terminal device or the communication device in the above method embodiment.
  • FIG11 shows a simplified schematic diagram of the structure of the terminal device.
  • the terminal device includes a processor, a memory, and a transceiver.
  • the memory can store computer program codes
  • the transceiver includes a transmitter 1131, a receiver 1132, a radio frequency circuit (not shown in FIG11), an antenna 1133, and an input/output device (not shown in FIG11).
  • the processor is mainly used to process communication protocols and communication data, control terminal equipment, execute software programs, process software program data, etc.
  • the memory is mainly used to store software programs and data.
  • the RF circuit is mainly used to convert baseband signals and RF signals and process RF signals.
  • the antenna is mainly used to send and receive RF signals in the form of electromagnetic waves.
  • Input and output devices For example, Touch screens, display screens, keyboards, etc. are mainly used to receive data input by users and output data to users. It should be noted that some types of terminal devices may not have input and output devices.
  • the processor When data needs to be sent, the processor performs baseband processing on the data to be sent, and then outputs the baseband signal to the RF circuit.
  • the RF circuit performs RF processing on the baseband signal and then sends the RF signal outward in the form of electromagnetic waves through the antenna.
  • the RF circuit receives the RF signal through the antenna, converts the RF signal into a baseband signal, and outputs the baseband signal to the processor.
  • the processor converts the baseband signal into data and processes the data.
  • the memory may also be referred to as a storage medium or a storage device, etc.
  • the memory may be set independently of the processor or integrated with the processor, and the embodiments of the present application do not limit this.
  • the antenna and the radio frequency circuit with transceiver functions can be regarded as the transceiver module of the terminal device, and the processor with processing function can be regarded as the processing module of the terminal device.
  • the terminal device includes a processor 1110, a memory 1120 and a transceiver 1130.
  • the processor 1110 may also be referred to as a processing unit, a processing board, a processing module, a processing device, etc.
  • the transceiver 1130 may also be referred to as a transceiver unit, a transceiver, a transceiver device, etc.
  • the device for implementing the receiving function in the transceiver 1130 may be regarded as a receiving module, and the device for implementing the transmitting function in the transceiver 1130 may be regarded as a transmitting module, that is, the transceiver 1130 includes a receiver and a transmitter.
  • a transceiver may sometimes be referred to as a transceiver, a transceiver module, or a transceiver circuit, etc.
  • a receiver may sometimes be referred to as a receiver, a receiving module, or a receiving circuit, etc.
  • a transmitter may sometimes be referred to as a transmitter, a transmitting module, or a transmitting circuit, etc.
  • the processor 1110 is used to perform processing actions on the terminal device side in the embodiments shown in Figures 3 to 6 and the transceiver 1130 is used to perform transceiver actions on the terminal device side in Figures 3 to 6.
  • the processor 1110 is used to perform processing actions on the terminal device side in the embodiments shown in Figures 3 to 6 and the transceiver 1130 is used to perform transceiver actions on the terminal device side in Figures 3 to 6.
  • FIG. 11 is merely an example and not a limitation, and the above-mentioned terminal device including the transceiver module and the processing module may not rely on the structures shown in FIG. 7 to FIG. 9 .
  • the chip When the communication device 1100 is a chip, the chip includes a processor, a memory and a transceiver.
  • the transceiver may be an input/output circuit or a communication interface;
  • the processor may be a processing module or a microprocessor or an integrated circuit integrated on the chip.
  • the sending operation of the terminal device in the above method embodiment may be understood as the output of the chip, and the receiving operation of the terminal device in the above method embodiment may be understood as the input of the chip.
  • the present application also provides a chip, including a processor, for calling and executing instructions stored in a memory from the memory, so that a communication device equipped with the chip executes the methods in the above examples.
  • the present application also provides another chip, including: an input interface, an output interface, and a processor, wherein the input interface, the output interface, and the processor are connected via an internal connection path, and the processor is used to execute the code in the memory, and when the code is executed, the processor is used to execute the method in each of the above examples.
  • the chip also includes a memory, and the memory is used to store computer programs or codes.
  • the present application also provides a processor, which is coupled to a memory and is used to execute the methods and functions involving a network device or a terminal device in any of the above embodiments.
  • a computer program product including instructions is provided.
  • the method of the above embodiment is implemented.
  • the present application also provides a computer program.
  • the computer program is executed in a computer, the method of the above embodiment is implemented.
  • a computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method described in the above embodiment is implemented.
  • a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.
  • the size of the serial numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • the size of the serial number of each process does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present application.
  • the aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente demande concerne un procédé d'authentification et d'autorisation ainsi qu'un appareil de communication. Le procédé peut être appliqué à l'authentification et à l'autorisation de l'Internet des objets. Le procédé comprend : la détermination, par un dispositif de passerelle de l'Internet des objets, que des informations de demande envoyées par un dispositif de l'Internet des objets sont utilisées pour demander une authentification et une autorisation pour le dispositif de l'Internet des objets, les informations de demande comprenant un identifiant de dispositif et un certificat de dispositif du dispositif de l'Internet des objets ; le transfert, par le dispositif de passerelle de l'Internet des objets, des informations de demande à un dispositif d'authentification de l'Internet des objets, le dispositif d'authentification de l'Internet des objets étant utilisé pour mettre en œuvre une authentification et une autorisation sur le dispositif de l'Internet des objets ; et l'envoi, par le dispositif de passerelle de l'Internet des objets, d'informations de réponse au dispositif de l'Internet des objets, les informations de réponse étant utilisées pour indiquer que le dispositif de l'Internet des objets réussit l'authentification et l'autorisation, et les informations de réponse comprenant un premier identifiant et un premier certificat de sécurité, qui sont configurés pour le dispositif de l'Internet des objets par le dispositif d'authentification de l'Internet des objets. Au moyen de la solution technique, la présente demande peut prendre en charge la terminaison de l'authentification et de l'autorisation d'un dispositif de l'Internet des objets.
PCT/CN2023/121110 2022-10-10 2023-09-25 Procédé d'authentification et d'autorisation et appareil de communication WO2024078313A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211234895.6 2022-10-10
CN202211234895.6A CN117880808A (zh) 2022-10-10 2022-10-10 认证授权的方法与通信装置

Publications (1)

Publication Number Publication Date
WO2024078313A1 true WO2024078313A1 (fr) 2024-04-18

Family

ID=90592334

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/121110 WO2024078313A1 (fr) 2022-10-10 2023-09-25 Procédé d'authentification et d'autorisation et appareil de communication

Country Status (3)

Country Link
CN (1) CN117880808A (fr)
TW (1) TW202416740A (fr)
WO (1) WO2024078313A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108650212A (zh) * 2018-03-14 2018-10-12 北京云信万致科技有限公司 一种物联网认证和访问控制方法及物联网安全网关系统
CN110995759A (zh) * 2019-12-23 2020-04-10 中国联合网络通信集团有限公司 物联网的接入方法以及装置
CN112512045A (zh) * 2019-08-27 2021-03-16 华为技术有限公司 一种通信系统、方法及装置
CN113015165A (zh) * 2021-03-11 2021-06-22 青岛海信智能商用系统股份有限公司 物联网平台设备接入方法、设备及系统
CN114567650A (zh) * 2021-12-29 2022-05-31 西安天和防务技术股份有限公司 一种数据处理方法及物联网平台系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108650212A (zh) * 2018-03-14 2018-10-12 北京云信万致科技有限公司 一种物联网认证和访问控制方法及物联网安全网关系统
CN112512045A (zh) * 2019-08-27 2021-03-16 华为技术有限公司 一种通信系统、方法及装置
CN110995759A (zh) * 2019-12-23 2020-04-10 中国联合网络通信集团有限公司 物联网的接入方法以及装置
CN113015165A (zh) * 2021-03-11 2021-06-22 青岛海信智能商用系统股份有限公司 物联网平台设备接入方法、设备及系统
CN114567650A (zh) * 2021-12-29 2022-05-31 西安天和防务技术股份有限公司 一种数据处理方法及物联网平台系统

Also Published As

Publication number Publication date
TW202416740A (zh) 2024-04-16
CN117880808A (zh) 2024-04-12

Similar Documents

Publication Publication Date Title
EP3627793B1 (fr) Procédé et dispositif de traitement de session
KR102345932B1 (ko) 네트워크 보안 관리 방법 및 장치
US20220095111A1 (en) Flexible authorization in 5g service based core network
US12058139B2 (en) Method for implementing user plane security policy, apparatus, and system
CN112449315B (zh) 一种网络切片的管理方法及相关装置
US20240171647A1 (en) Method and apparatus for discovering edge application server
CN118413351A (zh) 委托数据连接
JP7535067B2 (ja) マルチユーザモバイル端末のためのサービス配信を実行するための装置、システム、方法、およびコンピュータ可読媒体
US11558813B2 (en) Apparatus and method for network automation in wireless communication system
WO2020141355A1 (fr) Optimisation de la découverte d'un service nf
US20230099786A1 (en) Methods and Apparatus for Provisioning Private Network Devices During Onboarding
US20230132454A1 (en) Method and apparatus for supporting edge computing service for roaming ue in wireless communication system
CN113498217A (zh) 一种通信方法和通信装置
WO2020217224A1 (fr) Comportement amf et scp dans la découverte déléguée de pcf
WO2021218878A1 (fr) Procédé et appareil d'authentification de tranche
US20220272577A1 (en) Communication method and communication apparatus
EP3972142B1 (fr) Repli d'une fonction de contrôle de politique
WO2024078313A1 (fr) Procédé d'authentification et d'autorisation et appareil de communication
WO2022001972A1 (fr) Procédé de résolution de demande dns, appareil de communication et système de communication
WO2023015973A1 (fr) Procédé et appareil de commande d'admission à une tranche de réseau
WO2024067398A1 (fr) Procédé et dispositif de traitement de service d'urgence
WO2024032226A1 (fr) Procédé de communication et appareil de communication
WO2023142887A1 (fr) Procédé de communication et appareil de communication
WO2023143212A1 (fr) Procédé et appareil de communication
WO2023142717A1 (fr) Procédé et appareil pour déterminer une politique de sélection d'itinéraire d'équipement utilisateur

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23876517

Country of ref document: EP

Kind code of ref document: A1