WO2024103257A1 - 用于访问控制的方法和装置 - Google Patents

用于访问控制的方法和装置 Download PDF

Info

Publication number
WO2024103257A1
WO2024103257A1 PCT/CN2022/131991 CN2022131991W WO2024103257A1 WO 2024103257 A1 WO2024103257 A1 WO 2024103257A1 CN 2022131991 W CN2022131991 W CN 2022131991W WO 2024103257 A1 WO2024103257 A1 WO 2024103257A1
Authority
WO
WIPO (PCT)
Prior art keywords
client device
access control
proxy
server device
command
Prior art date
Application number
PCT/CN2022/131991
Other languages
English (en)
French (fr)
Inventor
吕小强
Original Assignee
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Oppo广东移动通信有限公司 filed Critical Oppo广东移动通信有限公司
Priority to PCT/CN2022/131991 priority Critical patent/WO2024103257A1/zh
Publication of WO2024103257A1 publication Critical patent/WO2024103257A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L27/00—Modulated-carrier systems

Definitions

  • the present application relates to the field of communication technology, and more specifically, to a method for access control, a server device, a proxy device, and a client device.
  • the client device can subscribe to the resources of the server device through the proxy device.
  • the proxy device To facilitate the proxy device to determine whether the client device has the authority to subscribe to the resources of the server device, the proxy device has the proxy view permission on the server device.
  • a proxy device with proxy view permissions can obtain all access control information of the server device. As a result, once the proxy device is compromised, it is easy to cause the access control information of the server device to be leaked, increasing the risk of data privacy leakage.
  • the present application provides a method, a server device, a proxy device and a client device for access control.
  • the following introduces various aspects involved in the present application.
  • a method for access control comprising: a server device controlling access control information that a proxy device can obtain according to binding relationship information, wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and a client device.
  • a method for access control comprising: a proxy device sends a first request to a server device, the first request being used to query whether a client device has access rights to a target resource of the server device; in response to binding relationship information, the proxy device receives a first response sent by the server device; wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device, and the binding relationship information is used to control the access control information that the proxy device can obtain.
  • a method for access control comprising: a client device sends binding relationship information to a server device, wherein the binding relationship information is used to indicate that there is a binding relationship between the client device and a proxy device, and the binding relationship information is used to control access control information that the proxy device can obtain.
  • a server device comprising: a control module, configured to control access control information that a proxy device can obtain according to binding relationship information, wherein the binding relationship information is used to indicate that a binding relationship exists between the proxy device and a client device.
  • a proxy device comprising: a first sending module, used to send a first request to a server device, the first request being used to query whether a client device has access rights to a target resource of the server device; a first receiving module, used to receive a first response sent by the server device in response to binding relationship information; wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device, and the binding relationship information is used to control the access control information that the proxy device can obtain.
  • a client device comprising: a sending module, used to send binding relationship information to a server device, wherein the binding relationship information is used to indicate that there is a binding relationship between the client device and the proxy device, and the binding relationship information is used to control access control information that the proxy device can obtain.
  • a server device comprising a processor, a memory and a communication interface, wherein the memory is used to store one or more computer programs, and the processor is used to call the computer program in the memory so that the server device executes part or all of the steps in the method of the first aspect.
  • an agent device comprising a processor, a memory and a communication interface, wherein the memory is used to store one or more computer programs, and the processor is used to call the computer program in the memory so that the agent device executes part or all of the steps in the method of the second aspect.
  • a client device comprising a processor, a memory and a communication interface, wherein the memory is used to store one or more computer programs, and the processor is used to call the computer program in the memory so that the client device executes part or all of the steps in the method of the third aspect.
  • an embodiment of the present application provides a communication system, which includes one or more of the above-mentioned server device, proxy device, and client device.
  • the system may also include other devices that interact with the server device, proxy device, or client device in the solution provided by the embodiment of the present application.
  • an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program enables a server device, a proxy device or a client device to execute part or all of the steps in the methods of the above aspects.
  • an embodiment of the present application provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a server device, an agent device, or a client device to perform some or all of the steps in the above-mentioned various aspects of the method.
  • the computer program product can be a software installation package.
  • an embodiment of the present application provides a chip, which includes a memory and a processor.
  • the processor can call and run a computer program from the memory to implement some or all of the steps described in the methods of the above aspects.
  • the server device can control the access control information that the proxy device can obtain according to the binding relationship information.
  • the proxy device with the proxy view permission can only obtain the access control information corresponding to the client device with which it has a binding relationship, reducing the risk of data privacy leakage.
  • FIG1 is a model structure of a Matter device to which an embodiment of the present application can be applied.
  • FIG. 2 is a diagram showing an example of a system architecture of a communication system to which an embodiment of the present application can be applied.
  • FIG3 is an example diagram of the level relationship of access control permissions provided in an embodiment of the present application.
  • FIG. 4 is a diagram showing an example of a system architecture of a communication system to which a proxy mechanism can be applied.
  • FIG5 is a schematic diagram of a process of proxy subscription provided in an embodiment of the present application.
  • FIG6 is a flow chart of a method for access control provided in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a process for establishing binding relationship information provided in an embodiment of the present application.
  • FIG8 is a flow chart of a method for access control provided in another embodiment of the present application.
  • FIG9 is a flow chart of a method for access control provided in yet another embodiment of the present application.
  • FIG10 is a flow chart of a method for access control provided in yet another embodiment of the present application.
  • FIG. 11 is a flow chart of the process of discovering and establishing a connection of a proxy device according to an embodiment of the present application.
  • FIG12 is a flow chart of a method for access control provided in yet another embodiment of the present application.
  • FIG13 is a flow chart of a method for access control provided in yet another embodiment of the present application.
  • FIG14 is a flow chart of a method for access control provided in yet another embodiment of the present application.
  • FIG. 15 is a schematic diagram of the structure of the server device provided in an embodiment of the present application.
  • FIG. 16 is a schematic diagram of the structure of the proxy device provided in an embodiment of the present application.
  • FIG. 17 is a schematic diagram of the structure of a client device provided in an embodiment of the present application.
  • FIG18 is a schematic structural diagram of a communication device provided in an embodiment of the present application.
  • the Internet of Things is the "Internet of Everything Connected". It is a network that extends and expands on the basis of the Internet. It can connect any object to the Internet through various information sensing devices (such as radio frequency identification, global positioning system, etc.) to form a huge network for information exchange and communication to achieve interconnection between all things.
  • the IoT device can be a smart home device.
  • the IoT device can include smart air conditioners, smart refrigerators, washing machines, rice cookers, sweeping robots and other devices.
  • the IoT device can be a smart monitoring device.
  • the IoT device can include monitoring cameras, temperature sensors, sound sensors, etc.
  • the Connectivity Standards Alliance launched an IoT application layer technology standard - Matter standard protocol, which can provide an interoperable application layer solution for smart home devices based on the Internet Protocol (IP).
  • IP Internet Protocol
  • Matter standard can also be called the connected home over IP (CHIP) standard.
  • the Matter standard can support three underlying communication protocols: Ethernet, Wi-Fi, and Thread, and can allow IoT devices with different protocols to communicate with each other.
  • the data model structure 100 of the Matter device includes a node 110 , an endpoint 120 , and a function cluster 130 .
  • Node 110 encapsulates an addressable and unique resource on the network, has a set of functions and capabilities, and can be clearly viewed by users as a functional whole.
  • node 110 can be the highest or outermost first-order element in the data model. In other words, node 110 is the only addressable element at the outermost layer of the data model.
  • a physical entity may be a node 110, or in other words, a node 110 may refer to a Matter device node.
  • a node may have multiple node identifiers (IDs), and the scope of each node ID is a specific network (fabric). For example, when a node ID is used as a target address for an interaction, the network that specifies the scope of the node ID is the access network for the interaction.
  • IDs node identifiers
  • a node may include one or more endpoints 120.
  • An endpoint 120 is an instance, which may be a service or a virtual device, indicated by a device type. Each endpoint 120 conforms to one or more device type definitions, which define the functional clusters supported by the endpoint. In some embodiments, an endpoint may be understood as a service/virtual device indicated by a device type.
  • a functional cluster is an object class instantiated on an endpoint.
  • the device type can be the highest semantic element.
  • the device type defines the conformance of a set of endpoints 120.
  • the device type defines a set of requirements for a node 110 or an endpoint 120.
  • Function cluster 130 is a functional building block element of the data model.
  • function cluster can also be referred to as function set, cluster, cluster, etc., which is not limited by the embodiments of the present application.
  • Function cluster specification defines clients and servers that correspond to each other through interaction.
  • Function cluster 130 can be regarded as an interface, service or object class, which is the lowest independent functional element in the data model.
  • Each function cluster 130 can be defined by a function cluster specification, which defines the elements of function cluster 130, including attributes, events, commands and behaviors related to the interaction of these elements.
  • attributes, commands, and events can also be referred to as interface units of function cluster 130, and corresponding functions can be provided by these three interface units.
  • the properties, events, commands, and behaviors in a functional cluster 130 are mandatory or optional, depending on the definition of the functional cluster 130 .
  • the above functional clusters can be divided into two categories: utility functional clusters (utility cluster) and application functional clusters (application cluster).
  • Utility function clusters are not part of the primary application operation of the endpoint. Utility function clusters can be used for configuration, discovery, addressing, diagnostics, monitoring device health, software updates, etc. A utility function cluster may have a temporary relationship with its function cluster counterpart. Exemplarily, utility function clusters may include descriptor function clusters, binding function clusters, proxy configuration function clusters, etc.
  • the application function cluster supports the main operations of the endpoint.
  • the application function cluster can also be called a business function cluster.
  • the application function cluster can support the interaction of one or more persistent applications between the client and the server.
  • the switch function cluster On/Off cluster
  • the client can send a control command to the server (i.e., the switch function cluster) to control the switch of the smart light.
  • the business function cluster may refer to a function cluster on other endpoints except endpoint 0 in the node (which may be understood as the first endpoint in the node, and the device type of the endpoint is a "root node").
  • An application functionality cluster is not a utility functionality cluster, even though it may itself support utility functionality such as calibration, operation modes, etc.
  • An application functionality cluster specification should not refer to layers and processes outside its domain of application.
  • a functional cluster command (also called a "command") is a set of data fields, each of which is passed between client and server functional cluster instances to invoke the behavior of the command recipient.
  • the protocol stipulates that each command can be listed in a table, which can contain data quality columns for the command: ID, name, direction, response, access, and conformance. Accordingly, a command can indicate zero or more fields defined in a table. Each command field is defined as a row in the table.
  • Attributes are functional cluster data.
  • the protocol stipulates that each attribute can be listed in a table, and the data quality columns of the attribute defined in the table can include: ID, name, (data) type, constraint, other qualities, access, default (value) and compliance.
  • attributes can also define their related semantics and behaviors. Attributes can reflect the queryable/settable state, configuration, and capabilities of the device. In some cases, if no permissions are explicitly defined for an attribute, the default access permissions are in effect.
  • An event defines a record of something that happened in the past.
  • an event record can be thought of as a log entry that provides a chronological view of events on a node through a stream of event records.
  • attributes which do not provide any edge-preserving functionality (that is, there is no guarantee that every attribute change will be delivered to the observer)
  • events allow every individual edge or change to be captured and reliably delivered to the observer. This is critical for safety and security applications that rely on guarantees of correct behavior.
  • the protocol specifies that each functional cluster event can be listed in a table, and the data quality columns of the event defined in the table can include: ID, priority, access, and compliance.
  • commands, attributes, and events For ease of understanding, the following describes the meanings of several common data qualities contained in commands, attributes, and events. It should be noted that the commands, attributes, and events in the embodiments of the present application may also include other data qualities, or include parts of the above data qualities. The embodiments of the present application are not limited to this.
  • Identifier which indicates the unique field ID of a field, or the unique identifier of a command (or attribute, event).
  • Name which indicates the unique name of the field, or the name of the command (or attribute).
  • Type indicates the data type of the field, or the data type of the command parameter (or attribute parameter).
  • Direction usually present in the command list, is used to define the transmission direction of the command, for example, it can be defined as from the client to the server. For another example, it can be defined as from the server to the client.
  • Access permissions which define how an element can be accessed (e.g., read or write) and what permissions are required to access the data.
  • access permissions may include V, which indicates that view permissions are required for read access or call access.
  • Access permissions may also include O, which indicates that operation permissions are required for "read access,” "write access,” or “call access.”
  • Access permissions may also include R, which indicates read access.
  • Access permissions may also include W, which indicates write access.
  • Response usually exists in the command list, and is used to define the response message of the command.
  • Default used to define the default value. It should be noted that the default value is not the value used when the server returns the factory refresh settings. The default value can indicate that the compliance specified for the data field can be optional or can change over time. When the actual data field value does not exist, a default value can be defined to complete the dependency.
  • Conformance defines the optionality and dependencies of any data model element or set of elements. Typically, this column is valid for attributes, commands, events, enumerations, and fields of commands, events, or structures.
  • “M” indicates that the corresponding command is part of the basic mandatory feature set
  • "O” indicates that the corresponding command is part of the optional feature set.
  • client-to-server command conformance means that the server should recognize and support client-to-server commands and generate responses as defined.
  • Server-to-client command conformance means that the server should send commands in the manner defined by the functional cluster behavior, i.e., respond to client-to-server commands.
  • Command conformance depends on supported server features. Clients should not be required to support optional commands or commands that depend on optional features.
  • Constraints include all and desc. All is defined in a numeric data type to allow all values. desc indicates that the constraint is defined in the description part.
  • Range which indicates the value range of a field.
  • Range can support two forms: explicit constraint and width constraint.
  • the explicit constraint can give the minimum and maximum values corresponding to the value of the field, for example, the value range of a field is (0,128).
  • the width constraint can limit the value of a field to a specific number of bytes, for example, the value of a field is limited to 8 bytes.
  • the value of the range can include "N/A" to indicate not applicable. Of course, "N/A" can also appear in other parts (other data quality), such as defaults, constraints, etc.
  • Each event record has an associated priority. This priority can be used to describe the usage semantics of the event.
  • the communication system shown in Figure 2 includes a Matter client device 210, a Matter server device 220, and a configuration device 230. It should be noted that the data structure model of the Matter client device 210 and the Matter server device 220 can be as shown in Figure 1.
  • Matter client device 210 is a client device on the user side, and Matter client device 210 can communicate with Matter server device 220. In some implementations, Matter client device 210 can send control information to Matter server device 220 to control Matter server device 220. For example, when Matter server device 220 is a smart air conditioner, Matter client device 210 can control the temperature of Matter server device 220 by sending control information to Matter server device 220.
  • the Matter client device 210 may refer to a terminal device with a Matter client installed, wherein the terminal device may be a mobile phone, a computer, a tablet computer, a smart bracelet, a smart watch, etc., which is not limited in the embodiments of the present application. It should be understood that the Matter client may be an application (APP) or a mini-program, etc., which is not limited in the embodiments of the present application.
  • APP application
  • mini-program etc.
  • Matter server device 220 may refer to an IoT device that supports the Matter standard protocol. Matter server device 220 may communicate directly with Matter client device 210 so that Matter client device 210 controls Matter server device 220.
  • the Matter server device 220 when the Matter server device 220 is a smart air conditioner that supports the Matter standard protocol, the Matter client device 210 can control the smart air conditioner's switch and set the air conditioner temperature, wind speed, etc.
  • the Matter server device 220 is a sweeping robot that supports the Matter standard protocol
  • the Matter client device 210 can control the sweeping robot to start or stop working, control the sweeping robot's working mode, etc.
  • control interfaces supported by the Matter server device 220 mainly include control and subscribe and report.
  • control can be understood as a set of function clusters corresponding to one or more attribute values of the Matter server device that can be modified or retrieved.
  • the Matter client device is a smart speaker
  • the Matter server device is a smart air conditioner. The user can say "cool down" to the smart speaker, and then the smart speaker sends a control command to lower the temperature to the smart air conditioner.
  • a subscription interaction model can be used to define attributes that can be subscribed to and subscription requirements, such as trigger thresholds, report intervals, and durations.
  • the Matter client device is a smart speaker
  • the Matter server device is a smart air conditioner. The user can subscribe to the indoor temperature measured by the air conditioning sensor of the smart air conditioner through the smart speaker, so that the user can monitor the indoor temperature by receiving reports regularly.
  • the configuration (commissioner) device 230 can be used to configure the Matter server device 220.
  • the configuration device can be understood as a terminal device with a configuration terminal installed, and the user can configure the Matter server device 220 through the configuration terminal.
  • the terminal device can be a mobile phone, a computer, a tablet computer, a smart bracelet, a smart watch, etc., which is not limited in the embodiment of the present application.
  • the configuration terminal can be an application or a small program, etc., which is not limited in the embodiment of the present application.
  • configuration end may be the same APP or applet as the Matter client, and of course, the configuration end may be a different APP or applet from the Matter client. This embodiment of the application does not limit this.
  • the access control feature is designed to ensure that only authorized nodes are allowed to access specific application layer functions exposed by the data model through the interaction model. Access control is the fundamental connection between the secure channel and the interaction model.
  • the administrator on the network creates and maintains a consistent distributed configuration of the ACL on all nodes, or in other words, creates and maintains an ACL function cluster.
  • the ACL function cluster may also be referred to as an access control function cluster (access control cluster), and the embodiments of the present application do not make a clear distinction between the two.
  • the ACL function cluster is a function cluster that controls device access rights. It is deployed on each node and has only one instance. In other words, each node includes an ACL. When the node receives a request, it first checks whether the requester has permission in the ACL.
  • ACLs can contain access control entries (ACEs) that encode policies.
  • the access control system can check and validate all attempted accesses against the rules in the ACEs contained in the node's ACL.
  • Each ACE can encode a separate permission grant on that node and is used by the access control permission grant algorithm to determine whether a subject has permission to interact with a target on a node.
  • the attributes included in the ACL function cluster can be found in Table 1.
  • the type of this attribute is a structure of list type (e.g., AccessControlEntryStruct).
  • the quality corresponding to this attribute is "N", indicating that the attribute data value is non-volatile and remains unchanged during restart.
  • the access data quality corresponding to this attribute includes RWA, indicating that read access and write access require administrator privileges.
  • FabricIndex can limit the scope of ACE to the associated fabric.
  • the Privilege field can be used to specify the permission level granted by the ACE.
  • the Privilege can be used to determine the permission of the Subjects corresponding to the ACE to access the Targets.
  • Privileges can be listed in an enumerated manner, and can belong to one or more items in AccessControlEntryPrivilegeEnum.
  • the definition of AccessControlEntryPrivilegeEnum can include the following permissions.
  • View permission A device granted with view permission can read and subscribe to resources of the server device, except for the ACL function cluster. In some embodiments, view permission can also be used to indicate that the target of the server device can be seen by non-proxy devices.
  • Proxyview permission A device granted with proxyview permission can read and subscribe to resources of the server device, including the ACL function cluster. In some embodiments, proxyview can also be used to indicate that the target and ACL of the server device can be seen by the proxy device.
  • Operate permission A device granted the operate permission can obtain the view permission and can execute the main functions of the node, except for the ACL function cluster.
  • Devices granted manage permissions can obtain operate permissions and can modify and configure data on the node, except for ACL function clusters.
  • Administrator privileges Devices granted with administrator privileges can obtain manage privileges and can subscribe to and modify ACL function clusters.
  • administer is the highest permission, and it is special in that it manages the permissions itself through the ACL function cluster.
  • Figure 3 illustrates how higher permission levels subsume lower permission levels.
  • the AuthMode field can be used to specify the authentication mode required by the ACE.
  • AuthMode can be listed in an enumerated manner, and can belong to one or more items in AccessControlEntryAuthmodeEnum. Among them, the definition of AccessControlEntryAuthmodeEnum can include several authentication modes listed in Table 3.
  • the Subjects field can be used to specify a list of subjects to which the ACE grants access rights.
  • the meaning of Subject is mainly to describe the source of an operation that uses a given authentication method provided by the secure channel architecture.
  • the Subject can be a source node (e.g., a client device node) authenticated through a CASE session.
  • the subjects field may include a device ID (node ID) of the client device. In some embodiments, the subjects field may include a CASE authenticated tag (CAT) corresponding to the client device.
  • CAT CASE authenticated tag
  • the Subjects list when the Subjects list is empty, it indicates a wildcard, that is, the ACE will grant access to any node that has successfully passed the AuthMode authentication. In some embodiments, if the AuthMode of the ACE is PASE, the Subjects list cannot be empty.
  • the Targets field can be used to specify a list of target structures that define the clusters on the node to which this ACE grants access.
  • a single target should contain at least one field (functional cluster, endpoint, or device type) and should not contain both endpoint and device type fields.
  • Targets list when the Targets list is empty, it represents a wildcard, that is, the ACE will grant access rights to all functional cluster instances on all endpoints of the node.
  • the node with subjects 0xAAAA_AAAA_AAAA_AAAA has the administrator permission for all functional cluster instances on all endpoints of the server device.
  • the node with subjects 0x0000_0000_0000_0001 has the manage permission for all functional cluster instances on endpoints 1 and 3 on the server device.
  • the server device cannot directly process the subscription request, so a proxy mechanism (or proxy service) can be used to help the server device process the subscription request.
  • the proxy mechanism can implement the proxy capability of subscribing to resources in the server device.
  • the proxy mechanism generally involves a client device, a server device, and a proxy device.
  • the server device may refer to a node that is the original source of a set of data authenticity.
  • the server device may act as a publisher of data.
  • the client device may refer to a node that wishes to subscribe to a server device.
  • the proxy device may present a “mirror” of the data of the server device to the client device, and for the client device, whether it interacts with the proxy device or the server device, the client device does not need to change its interaction.
  • the proxy process may include the following steps: discovering that the server device needs a proxy; finding a proxy device on the network that can handle its subscription request; and setting the proxy device to subscribe to the server device.
  • a proxy device can indicate its ability to act as an authenticated proxy by declaring support for subscribed proxy device types.
  • the configuration device should recognize this capability and write the node IDs of all server devices that need to be proxied to the proxy configuration function cluster on the proxy device.
  • the configuration device can configure the proxy device as a wildcard to proxy all server devices, eliminating the need to specify a specific set of node IDs.
  • the configuration device can write the node ID of the newly added proxy device to the validproxylist cluster on the server device that needs the proxy.
  • This cluster can store a static list of candidate proxies for a given device. Typically, this configuration needs to be written for server devices that support this cluster.
  • FIG. 5 shows a schematic diagram of a proxy subscription process.
  • the proxy subscription process shown in Figure 5 may include steps 1 to 10.
  • step 1 the client device sends a request to the proxy device to subscribe to the C1 resource on the server device.
  • the proxy device sends a report data (ReportData) message to the client device, notifying the client device that it is temporarily not subscribed to the resource of the server device (ie, the proxy device is temporarily not subscribed to the C1 resource).
  • ReportData report data
  • step 3 the client device responds to the ReportData message sent by the proxy device.
  • step 4 the proxy device returns a subscription response to the client device.
  • step 5-8 the proxy device initiates a subscription to the C1 resource on the server device and completes the subscription to the C1 resource.
  • step 9-10 after the proxy device successfully subscribes to the C1 resource, it continues to process the subscription process of the client device.
  • the proxy device Before the proxy device sends ReportData to the client device, the proxy device needs to check whether the client device has the permission to subscribe to the C1 resource of the server device (view permission). If the client device has the permission to subscribe to the C1 resource, the proxy device can return the content of the subscribed C1 resource to the client device through ReportData, or if the proxy device has not subscribed to the C1 resource, it first returns a message to the client device that it has not subscribed to the C1 resource temporarily, and then subscribes to the C1 resource and returns the content of the subscribed C1 resource to the client device.
  • the proxy device In order to facilitate the proxy device to determine whether the client device has the authority to subscribe to the resources of the server device (i.e., the target resource below), the proxy device has the proxyview permission on the server device and can obtain all access control information of the server device. In other words, the proxy device has the proxyview permission on the ACL function cluster resources of the server device and can subscribe to or read the ACL function cluster. Based on this, the proxy device can obtain the permission of the client device on the target resource (e.g., C1 resource) on the server device, and then determine whether the client device can subscribe to the target resource.
  • the target resource e.g., C1 resource
  • the client device subscribes to the target resource of the server device directly or through a proxy device, it must have the permission to subscribe to the target resource of the server device, that is, the ACL function cluster of the server device must have the ACE corresponding to the client device.
  • the proxy device can access (read and/or subscribe to) the ACL function cluster through this permission. If the proxy device is not configured with the permission to access the ACL function cluster, the proxy device will not work.
  • the relevant technology grants the proxyview permission to the entire proxy device node, so that the proxy device can obtain all access control information of the server device.
  • a proxy device with proxyview permission can obtain the ACL information of the server device without restriction in the same fabric. In this way, once the proxy device is compromised, it is very easy to cause the access control information of the server device to be leaked, increasing the risk of data privacy leakage.
  • the embodiments of the present application provide a method for access control, a server device, a proxy device and a client device, which can reduce the risk of data privacy leakage.
  • the method for access control provided by the embodiments of the present application is introduced below.
  • Figure 6 is a flow chart of a method for access control provided by an embodiment of the present application.
  • the method shown in Figure 6 can be executed by a server device, which can be, for example, the Matter server device 220 shown in Figure 2 above.
  • the method shown in Figure 6 can include step S610, which is described in detail below.
  • step S610 the server device controls the access control information that the proxy device can obtain according to the binding relationship information.
  • the binding relationship information can be used to indicate that there is a binding relationship between the proxy device and the client device, that is, the binding relationship information can be used to indicate (or record) the binding relationship between the proxy device and the client device that the proxy device subscribes to.
  • the binding relationship information it can be known which client devices a certain proxy device has a binding relationship with, or it can be known which client devices a certain proxy device provides proxy services for.
  • the server device controls the access control information that the proxy device can obtain based on the binding relationship between the proxy device and the client device, which may mean that if the server device determines that there is a binding relationship between the proxy device and the client device, the server device may tell (e.g., send or notify) the proxy device relevant information or content about the access control information corresponding to the client device (e.g., the access control information of the client device to the target resource of the server device).
  • the server device may tell the proxy device whether the client device has the access right to the target resource of the server device, or the server device may tell the proxy device whether the access right of the client device to the target resource has changed, etc.
  • the server device controls the access control information that the proxy device can obtain based on the binding relationship between the proxy device and the client device, which may mean that if the server device determines that there is no binding relationship between the proxy device and the client device, the server device will not tell the proxy device relevant information or content about the access control information corresponding to the client device (for example, the access control information of the client device to the target resource of the server device). For example, the server device will not tell the proxy device whether the client device has the access right to the target resource of the server device, or the server device will not tell the proxy device whether the access right of the client device to the target resource has changed, etc.
  • the access rights of the client device to the target resources of the server device may refer to view permissions, or may be permissions with a higher level than view permissions, for example, operation permissions, management permissions, administrator permissions, etc.
  • the client device when the client device has access rights to the target resource of the server device, the client device can read or subscribe to the target resource of the server device.
  • the access control information can be used to determine whether the client device has access rights to the target resource of the server device. In other words, by knowing the access control information corresponding to a client device, it can be determined whether the client device can read or subscribe to the target resource corresponding to the access control information.
  • the access control information may be recorded in the ACL of the server device, for example, in the ACL function cluster of the server device.
  • the ACL function cluster of the server device has one and only one instance.
  • the ACL function cluster of the server device may be deployed on endpoint 0 of the server device.
  • the binding relationship between the proxy device and the client device can be understood as essentially the binding relationship between the proxy device and the client device's subjects roles in the ACL function cluster, that is, the binding relationship between the proxy device and the subjects corresponding to the client device.
  • the access control information may refer to ACE, and the server device may check and verify whether the client device has access rights to the target resource of the server device according to the rules in the ACE.
  • the access control information that the server device controls the proxy device to obtain according to the binding relationship information may refer to the ACE that the server device controls the proxy device to obtain according to the binding relationship information.
  • the proxy device is only interested in the access control information corresponding to the client device to which it subscribes (for example, only the access rights of the client device to the target resource on the server device), while other access control information in the server device is irrelevant to the proxy device. Therefore, the embodiment of the present application can control the access control information that the proxy device can obtain according to the binding relationship information, so that the proxy device can only obtain the access control information corresponding to the client device with which it has a binding relationship, thereby reducing the risk of data privacy leakage.
  • Fig. 7 is a schematic diagram of a process of establishing binding relationship information provided by an embodiment of the present application. As shown in Fig. 7, the process of establishing binding relationship information may include step S710.
  • step S710 the server device receives a registration request, where the registration request is used to register binding relationship information.
  • the registration request may be sent by a proxy device.
  • the proxy device may send binding relationship information to the server device, or the binding relationship information may be set by the proxy device.
  • the registration request may be sent by the client device.
  • the client device may send the binding relationship information to the server device, or the binding relationship information may be set by the client device.
  • the server device may also pre-register the binding relationship information.
  • the server device may pre-save the device identification of the client device (for example, the device ID of the client device and/or the CATs corresponding to the client device), so that the client device or the proxy device can then set the binding relationship between the proxy device and the client device based on the pre-registration information. For example, after the server device pre-saves the device identification of the client device, the client device or the proxy device may subsequently initiate a registration request to associate the device identification of the proxy device corresponding to the client device with the device identification of the client device.
  • the proxy device or client device may register the binding relationship information through a registration request command.
  • the registration request sent by the proxy device or client device may be a registration request command, and the proxy device or client device may set the binding relationship information through a registration request command interface provided by the server device.
  • the input parameters of the registration request command may include the device identification of the proxy device and the device identification of the corresponding client device.
  • an implementation method of the registration request command is given below in conjunction with Table 4.
  • the registration request command is a RegisterProxyNode command
  • the client device or proxy device can set the binding relationship between the client device and the proxy device through the RegisterProxyNode command.
  • the client device or proxy device can use the RegisterProxyNode command to input the device identification of the client device to be bound and the device identification of the proxy device to register the binding relationship information to the functional cluster corresponding to the server device (for example, the first functional cluster mentioned below, or other functional clusters).
  • the attribute that carries the binding relationship information can be, for example, the first attribute mentioned below (for example, the obsrelationship attribute).
  • the RegisterProxyNode command is only an example and can be any other name as long as the command can be used to register or set the binding relationship information between the proxy device and the client device.
  • step S720 may be further included.
  • the server device stores the binding relationship information.
  • the binding relationship information can be stored (saved) in a functional cluster of the server-side device, for example, stored in a first functional cluster of the server-side device.
  • the embodiment of the present application does not specifically limit the first functional cluster.
  • the first functional cluster can be an existing functional cluster, and an attribute is added to an existing functional cluster, and the added attribute is used to record the binding relationship information between the proxy device and the client device.
  • a new attribute can be added to the functional cluster where the valid proxy list attribute is located, and the new attribute is used to record the binding relationship information between the proxy device and the client device.
  • the first functional cluster can be a newly added functional cluster, for example, a dedicated functional cluster can be added to specifically record the binding relationship between the proxy device and the client device.
  • the embodiment of the present application does not limit the name of the first functional cluster.
  • the first functional cluster may be called a proxyobserveACL functional cluster.
  • the proxyobserveACL functional cluster may be the name of a newly added functional cluster or a name redefined after modifying an existing functional cluster.
  • the first function cluster includes a first attribute, and the first attribute is used to record binding relationship information (ie, record the binding relationship between the proxy device and the client device).
  • the binding relationship information may use the device identification of the proxy device and the device identification of the client device to indicate the binding relationship between the proxy device and the client device.
  • the first attribute may record the device identification of the proxy device and the device identification of the client device to indicate that there is a binding relationship between the proxy device and the client device (the proxy device can perform proxy subscription for the client device).
  • the device identification of the proxy device may refer to the device ID of the proxy device. In some embodiments, the device identification of the proxy device may refer to the indication information of the proxy device, which is used to indicate the identity information of the proxy device, that is, the device identification of the proxy device may be used to obtain the device ID of the proxy device.
  • the device identification of the client device may refer to the device ID of the client device.
  • the device identification of the client device may be indication information of the client device, and the indication information is used to indicate the identity information of the client device, that is, the device identification of the client device may be used to obtain the device ID of the client device.
  • the device identification of the client device may refer to a first identification corresponding to the client device, and the first identification is an identification shared by a group of client devices with the same authority.
  • the first identification may be a CAT.
  • one client device may correspond to multiple CATs, and the first identifier may be any one or more of the multiple CATs.
  • the device identification of the proxy device may be the device ID of the proxy device
  • the device identification of the client device may be the device ID of the client device. This approach is simple and clear to implement and easy to control.
  • the device identification of the proxy device may be a device ID of the proxy device
  • the device identification of the client device may be one or more CATs corresponding to the client device.
  • one proxy device in the binding relationship information recorded in the first attribute, may correspond to one or more client devices, so as to indicate that a binding relationship exists between the proxy device and the one or more client devices.
  • the binding relationship information is non-volatile data. In some embodiments, the binding relationship information remains unchanged when the server device is restarted.
  • Table 5 provides an implementation manner of the first attribute.
  • the first attribute is obsrelationship.
  • the type of the first attribute is a structure of list type, which can be used to record the binding relationship between the proxy device and the client device, for example, by identifying the binding relationship between them through the device identification of the proxy device and the device identification of the client device (for example, subjects corresponding to the client device).
  • the binding relationship between them can be identified by the device ID of the proxy device and the device ID of the client device.
  • the binding relationship between them can be identified by the device ID of the proxy device and the CATs corresponding to the client device.
  • a proxy device can correspond to one or more client devices.
  • the quality corresponding to the first attribute is "N", indicating that the attribute data value is non-volatile and remains unchanged during restart.
  • the clientsubjectID in the list may be a device ID (node ID of the device) or CATs. In some embodiments, there may be multiple CATs, that is, one client device may correspond to multiple CATs.
  • the data types of the node ID and CAT of the device may be the same, but the value ranges are different. In this case, it can be determined whether the value represents the node ID or CAT of the device based on the value range.
  • the device identification of the proxy device in the input parameter can be omitted. In some embodiments, if the device identification of the proxy device is omitted, it can be considered that the device identification is the device identification corresponding to the initiator in the message packet header.
  • the first functional cluster may also include some commands for the proxy device to obtain and subscribe to access control information. That is, the commands for the proxy device to obtain and subscribe to access control information may be in the same functional cluster as the attributes for recording binding relationship information.
  • the embodiments of the present application are not limited thereto, and the commands for the proxy device to obtain and subscribe to access control information may be in different functional clusters than the attributes for recording binding relationship information.
  • the binding relationship between the proxy device and the client device can be recorded in the function cluster of the server device, so that the server device can control the access control information that the proxy device can obtain according to the binding relationship information.
  • the process of establishing the binding relationship information may occur. For example, after a client device selects a proxy device (either before or after the client device and the proxy device establish a connection), the client device may initiate a registration request to the server device to register the binding relationship information between it and the selected proxy device. Alternatively, after a client device selects a proxy device, the proxy device may initiate a registration request to the server device to register the binding relationship information between it and a client device.
  • the previous article introduced the process of establishing binding relationship information.
  • the following article introduces how to use the binding relationship information to control the access control information that the proxy device can obtain during the proxy subscription process.
  • the server device controls the access control information that the proxy device can obtain according to the binding relationship information based on the request of the proxy device.
  • Fig. 8 is a flow chart of a method for access control provided by another embodiment of the present application. As shown in Fig. 8, the method may include step S810 and step S820. These steps are introduced below.
  • step S810 the proxy device sends a first request to the server device, wherein the first request is used to query whether the client device has access rights to the target resource of the server device.
  • the first request may be a read request, that is, the proxy device may send a read request message to the server device to read the access control information of the client device to the target resource, thereby determining whether the client device has permission to access the target resource.
  • the proxy device may use a read command interface provided by the server device to obtain the access control information of the client device to the target resource.
  • an existing read command interface can be used to obtain the access control information of the client device to the target resource.
  • the server device can determine whether the proxy device has the authority to obtain the access control information of the client device to the target resource based on the binding relationship information. If the proxy device has the authority to obtain the access control information of the client device to the target resource, the server device can return a corresponding response message to the proxy device.
  • a new command interface can be used to obtain access control information of a client device to a target resource.
  • the new command interface can be used to obtain ACE information associated with the client device.
  • the proxy device may use the getACE command to request corresponding access control information (eg, ACE information), and the getACE command may obtain ACE information associated with the device identifier of the client device in the input parameter of getACE.
  • access control information eg, ACE information
  • Table 6 provides an implementation of the getACE command.
  • the embodiment of the present application does not specifically limit the name of the read command for obtaining the access control information of the client device to the target resource.
  • the getACE command is only an example. As long as the access control information associated with the client device (for example, ACE information) can be obtained through the read command, it will be sufficient.
  • the getACE command and the first attribute may be located in the first functional cluster together. In some embodiments, getACE may also be located in other functional clusters, which is not limited in the embodiments of the present application.
  • the response method for getACE may include multiple methods, for example, the corresponding ACE may be returned, and the proxy device may determine whether the client device has the authority to access the target resource; or, an indication of whether the client device has the authority to access the target resource may be directly returned (for example, "yes" may be returned to indicate that the client device has the authority to access the target resource, or "no" may be returned to indicate that the client device does not have the authority to access the target resource), etc.
  • the first request may be a subscription request, that is, the proxy device may send a subscription request message to the server device to request to subscribe to the access control information of the client device to the target resource, thereby determining whether the client device has the authority to access the target resource.
  • the proxy device may use the subscription command interface provided by the server device to obtain the access control information of the client device to the target resource.
  • the proxy device may use the existing subscription command interface to obtain the access control information of the client device to the target resource.
  • the proxy device may use a new subscription command interface to obtain the access control information of the client device to the target resource, such as using the first command mentioned later to obtain the access control information of the client device to the target resource.
  • step S820 the server device sends a first response to the proxy device according to the binding relationship information.
  • the first response may include access control information of the client device to the target resource.
  • the first response may include corresponding ACE information, and the proxy device determines whether the client device has the authority to subscribe to the target resource based on the ACE information returned by the server device.
  • the first response may be used to indicate whether the client device has access rights to the target resource.
  • the first response may directly indicate whether the client device has the right to subscribe to the target resource by returning "yes" or "no" indication information.
  • the first response may return corresponding ACE information, or the first response may return information indicating whether the client device has permission to access the target resource.
  • the first response may return corresponding ACE information.
  • the server device needs to check the binding relationship information between the proxy device and the client device during the proxy device reading process or subscription process to determine whether the proxy device has the read permission or subscription permission.
  • the server device can send the changed access control information of the client device to the proxy device based on the binding relationship information. This is described in detail below in conjunction with Figure 9.
  • Fig. 9 is a flow chart of a method for access control provided by another embodiment of the present application. As shown in Fig. 9, the method may include steps S910 to S930.
  • step S910 the proxy device requests to subscribe to access control information corresponding to the client device.
  • the proxy device may utilize the aforementioned first request to request to subscribe to the access control information corresponding to the client device. For example, utilize an existing subscription request to request to subscribe to the access control information corresponding to the client device.
  • step S920 the server device determines whether the proxy device has the authority to subscribe to the access control information corresponding to the client device according to the binding relationship information.
  • the server device may authorize the proxy device to subscribe to the access control information corresponding to the client device, for example, the access control information corresponding to the subscription request may be returned to the proxy device.
  • the server device may reject the subscription request of the proxy device, for example, by returning indication information indicating that the subscription is invalid to the proxy device.
  • step S930 when the proxy device has the authority to subscribe to the access control information corresponding to the client device, the server device sends the changed access control information of the client device to the proxy device according to the binding relationship information.
  • the server device can determine whether to send the changed access control information of the client device to the proxy device based on the binding relationship information. In other words, in some embodiments, the server device can determine whether to send the changed access control information of the client device to the proxy device based on the binding relationship information and the subscription information.
  • the server device determines whether to send the changed access control information of the client device to the proxy device according to the binding relationship information, which can avoid the proxy device receiving too many irrelevant messages due to the server device sending the changed access control information to the proxy device as long as there is an access control information change. In other words, it can limit the sending of too many irrelevant messages to the proxy device due to too many ACE changes.
  • the method may further include step S925.
  • step S925 the proxy device sends a second request to the server device, the second request being used to request the server device to generate a notification message when the access control information corresponding to the client device changes.
  • the second request may be used to indicate that a notification message is generated only when access control information corresponding to a client device associated with the second request changes.
  • the second request may be sent through a newly added command interface (first command).
  • first command is described in detail below.
  • the input parameters of the first command may include a device identification of the client device (for example, the device ID of the client device and/or CATs corresponding to the client device), and the first command may be used to indicate that a notification message is generated only when the access control information corresponding to the client device associated with the first command changes.
  • a device identification of the client device for example, the device ID of the client device and/or CATs corresponding to the client device
  • the first command can also be used to subscribe to the access control information corresponding to the client device.
  • the first command can be used to subscribe to the access control information corresponding to the client device, and a notification message is generated only when the access control information corresponding to the client device changes.
  • the first command is ProxyObserveACEreq.
  • ProxyObserveACEreq is only an example. As long as the first command can be used to indicate that the access control information corresponding to the associated client device changes, a notification message will be generated.
  • the first command may be included in a second functional cluster of the server device.
  • the second functional cluster may be the same functional cluster as the first functional cluster.
  • the second functional cluster and the first functional cluster may be different functional clusters, which is not limited in the embodiments of the present application.
  • the second functional cluster may further include a second command, and the second command may be used to generate a response message to the first command.
  • the second command may include the changed content and the change type of the access control information corresponding to the client device associated with the first command.
  • An implementation of the second command is given below in conjunction with Table 8.
  • the second command is ProxyObserveACEresp, and changetype indicates the change type of ACE.
  • the embodiment of the present application does not limit the name of the second command, and ProxyObserveACEresp is only an example.
  • the change type of ACE may include addition, deletion, and modification.
  • the server device may send a response message corresponding to the second command to the proxy device.
  • the server device may send a response message corresponding to the second command to the proxy device.
  • step S930 may be sent based on the second command.
  • the changed access control information sent in step S930 may include the changed content and the change type.
  • the change in access control information includes: a change in the access rights of the client device to the target resource, for example, the rights are reduced or lost.
  • the first command may be used to generate a notification message only when the access rights of the client device to the target resource are changed.
  • the reduced access rights corresponding to the client device mentioned in the embodiments of the present application means that the access rights corresponding to the client device become lower, for example, the access rights corresponding to the client device change from manage to operate, or the access rights corresponding to the client device change from manage to view, etc.
  • the change in access control information does not include resource changes caused by merging or reducing ACE content.
  • the server device may not return the changed access control information of the client to the proxy device.
  • the change of access control information may include not only the change of the access rights of the client device to the target resource, but also other changes, such as the change of the content of the access control information.
  • the proxy device may terminate the downstream subscription relationship (ie, the proxy subscription relationship between the proxy device and the client device).
  • the server device can send a status report message to the proxy device so that the proxy device generates a corresponding status report message and sends it to the client device. It should be noted that in some embodiments, before sending the status report message to the client device, the proxy device also needs to confirm whether the client device still has the authority to subscribe to the target resource of the server device. Only when the client device still has the authority to subscribe to the target resource, the proxy device sends the corresponding status report message to the client device.
  • the proxy device requests the access control information corresponding to the client device from the server device based on the first request.
  • the first request sent by the proxy device to the server device is based on the request sent by the client device to the proxy device to subscribe to the target resource.
  • the client device can send a request message to the proxy device to subscribe to the target resource on the server device, and the proxy device checks whether the client device has access rights to the target resource based on the subscription request message. This is described below in conjunction with FIG. 10.
  • Fig. 10 is a flow chart of a method for access control provided by another embodiment of the present application.
  • the method of Fig. 10 may include steps S1010 to S1050.
  • step S1010 the client device sends a request for subscribing to a target resource to the proxy device, where the request is used to request to subscribe to a target resource of the server device.
  • step S1020 the proxy device sends a first request to the server device, where the first request is used to query whether the client device has access rights to the target resource.
  • step S1030 the server device sends a first response to the proxy device according to the binding relationship information.
  • step S1020 and step S1030 please refer to the previous description of step S810 and step S820, which will not be repeated here.
  • step S1040 after the server device returns the access control information of the client device to the target resource to the proxy device, the proxy device completes the subscription process for the target resource.
  • step S1050 the proxy device returns information related to the subscription of the target resource to the client device.
  • the server device determines, based on the binding relationship information, that the proxy device has the authority to obtain the access control information corresponding to the client device, it also needs to check whether the proxy device has the proxyview authority to access the ACL of the server device.
  • the server device can return access control information corresponding to the client device to the proxy device.
  • the client device before the client device sends a subscription request message to the proxy device, it needs to first perform a discovery process of the proxy device and a process of establishing a connection with the proxy device. This process is described below in conjunction with FIG.
  • Fig. 11 is a flow chart of the process of discovering and establishing a connection of a proxy device according to an embodiment of the present application. As shown in Fig. 11, the method may include steps S1110 to S1140.
  • step S1110 the client device obtains a valid proxy list of the server device.
  • the server device After the client device fails to subscribe to the target resource of the server device directly, the server device will prompt the client device that it needs to find a proxy device to subscribe to the target resource. In this case, the client device can send a message to the server device to obtain the valid proxy list of the server device, that is, to obtain the proxy devices supported by the server device.
  • step S1120 the server device returns a valid proxy list supported by the server device to the client device.
  • step S1130 the client device discovers and selects a proxy device.
  • step S1140 the client device establishes a CASE connection with the proxy device.
  • the two can establish a secure channel, for example, through a CASE connection.
  • the proxy device may obtain a device identification of the client device (eg, a device ID of the client device and/or CATs corresponding to the client device).
  • a device identification of the client device eg, a device ID of the client device and/or CATs corresponding to the client device.
  • the client device or the proxy device can register the binding relationship information.
  • the client device or the proxy device can register the binding relationship information. For the content of registering the binding relationship information, please refer to the above description, which will not be repeated here.
  • the proxy device may save the device identification of the client device (such as the device ID of the client device and/or CATs corresponding to the client device) to facilitate subsequent registration of binding relationship information.
  • the client device may send a subscription request to the proxy device.
  • the subsequent subscription process may refer to the above description and will not be described again here.
  • Figures 12 to 14 to introduce the method flow of an embodiment of the present application by taking the Matter protocol communication scenario as an example. It should be noted that the method flow is only a schematic flow and is not intended to limit the embodiment of the present application. It should also be noted that the embodiment of the present application does not specifically limit the execution order of the steps of the method shown in Figures 12 to 14. For example, the order of some steps can be swapped, or some steps can be executed simultaneously. In addition, the functional clusters involved in the methods shown in Figures 12 to 14 are described in detail above, and for the sake of brevity, they will not be repeated below.
  • Fig. 12 is a flow chart of a method for access control provided by another embodiment of the present application.
  • the method shown in Fig. 12 includes steps S1201 to S1214.
  • step S1201 the client device requests to obtain a valid proxy list.
  • the server device After the client device fails to subscribe to the target resource of the server device directly, the server device will prompt the client device that it needs to find a proxy device to subscribe to the target resource. Therefore, the client device will initiate a request to the server device to obtain a valid proxy list to find out which proxy devices the server device supports.
  • step S1202 the server device registers the information of the client device as being in a queryable ACL state.
  • the server device may perform a pre-registration and save the information of the client device (eg, the node ID of the client device and/or the CATs corresponding to the client device).
  • step S1202 may be merged into step S1207 mentioned later and processed together.
  • step S1203 the server device returns the valid proxy list corresponding to step S1201 to the client device.
  • step S1204 the client device discovers and selects the proxy device.
  • step S1205 the client device and the proxy device establish a secure channel.
  • the proxy device may obtain the device ID of the client device and/or CATs corresponding to the client device.
  • step S1206 the proxy device saves the device ID of the client device and/or the CATs corresponding to the client device.
  • step S1207 after the client device selects the proxy device (before or after establishing a connection with the proxy device), the client device may establish a connection with the server device and set binding relationship information between the proxy device and the client device.
  • the binding relationship information may be stored in a proxyobserveACL function cluster.
  • the proxyobserveACL function cluster includes some methods for proxy devices to obtain and subscribe to access control information (such as ACE), as well as binding relationship information between proxy devices and client devices.
  • the binding relationship between the proxy device and the client device is actually the binding relationship between the proxy device and the client device in the subjects role in the ACL function cluster.
  • the simplest case is the binding relationship between the device ID of the proxy device and the device ID of the client device.
  • step S1207 the RegisterProxyNode command mentioned above can be used to register the binding relationship information.
  • step S1208 the client device sends a request message to the proxy device to subscribe to the target resource on the server device.
  • step S1209 the proxy device sends a first request to the server device to obtain corresponding access control information.
  • the proxy device may use the getACE command to request the corresponding access control information.
  • the access control information obtained in this step may be access control information related only to the client device, which is different from the existing method of obtaining access control information.
  • step S1210 the server device checks whether there is a binding relationship between the proxy device and the client device.
  • the server device may check in the first attribute (eg, the obsrelationship attribute) whether there is a binding relationship between the proxy device and the client device (eg, the device ID of the proxy device and the subjects of the client device).
  • the first attribute eg, the obsrelationship attribute
  • the server device can return corresponding access control information to the proxy device only when there is a binding relationship between the proxy device and the client device.
  • step S1211 the server device checks whether the proxy device has the proxyview permission to access the access control information.
  • step S1212 when there is a binding relationship between the proxy device and the client device and the proxy device has the proxyview permission to access the access control information, the server device returns the access control information corresponding to the client device to the proxy device.
  • step S1213-step S1214 the subsequent subscription process is completed.
  • FIG13 is a flow chart of a method for access control provided by another embodiment of the present application.
  • the method shown in FIG13 includes steps S1301 to S1314.
  • the methods shown in FIG12 and FIG13 are mainly used to prevent the proxy device from having excessive authority to obtain access control information.
  • the main difference between the method shown in FIG13 and the method shown in FIG12 is that the method shown in FIG13 is for the proxy device to register the binding relationship information between the proxy device and the client device, while the method shown in FIG12 is for the client device to register the binding relationship information between the proxy device and the client device.
  • step S1301 the client device requests to obtain a valid proxy list.
  • the server device After the client device fails to subscribe to the target resource of the server device directly, the server device will prompt the client device that it needs to find a proxy device to subscribe to the target resource. Therefore, the client device will initiate a request to the server device to obtain a valid proxy list to find out which proxy devices the server device supports.
  • step S1302 the server device registers the information of the client device as being in a queryable ACL state.
  • the server device may perform a pre-registration and save the information of the client device (eg, the node ID of the client device and/or the CATs corresponding to the client device).
  • step S1302 may be merged into step S1307 mentioned later and processed together.
  • step S1303 the server device returns the valid proxy list corresponding to step S1301 to the client device.
  • step S1304 the client device discovers and selects the proxy device.
  • step S1305 the client device and the proxy device establish a secure channel.
  • the proxy device may obtain the device ID of the client device and/or CATs corresponding to the client device.
  • the proxy device saves the device ID of the client device and/or the CATs corresponding to the client device.
  • step S1307 after the client device selects the proxy device (before or after establishing a connection with the proxy device), the proxy device may establish a connection with the server device and set binding relationship information between the proxy device and the client device.
  • the binding relationship information may be stored in a proxyobserveACL function cluster.
  • the proxyobserveACL function cluster includes some methods for proxy devices to obtain and subscribe to access control information (such as ACE), as well as binding relationship information between proxy devices and client devices.
  • the binding relationship between the proxy device and the client device is actually the binding relationship between the proxy device and the client device in the subjects role in the ACL function cluster.
  • the simplest case is the binding relationship between the device ID of the proxy device and the device ID of the client device.
  • the aforementioned RegisterProxyNode command can be used to register the binding relationship information in step S1307. It should be noted that when the RegisterProxyNode command is used to register the binding relationship information in step S1307, the device identifier of the proxy device in the input parameter can be omitted, that is, the device identifier of the proxy device is optional.
  • step S1308 the client device sends a request message to the proxy device to subscribe to the target resource on the server device.
  • step S1309 the proxy device sends a first request to the server device to obtain corresponding access control information.
  • the proxy device may use the getACE command to request the corresponding access control information.
  • the access control information obtained in this step may be access control information related only to the client device, which is different from the existing method of obtaining access control information.
  • step S1310 the server device checks whether there is a binding relationship between the proxy device and the client device.
  • the server device may check in the first attribute (eg, the obsrelationship attribute) whether there is a binding relationship between the proxy device and the client device (eg, the device ID of the proxy device and the subjects of the client device).
  • the first attribute eg, the obsrelationship attribute
  • the server device can return corresponding access control information to the proxy device only when there is a binding relationship between the proxy device and the client device.
  • step S1311 the server device checks whether the proxy device has the proxyview permission to access the access control information.
  • step S1312 when there is a binding relationship between the proxy device and the client device and the proxy device has the proxyview permission to access the access control information, the server device returns the access control information corresponding to the client device to the proxy device.
  • step S1313-step S1314 the subsequent subscription process is completed.
  • Figure 14 is a flow chart of a method for access control provided by another embodiment of the present application.
  • the method shown in Figure 14 includes steps S1401 to S1409. It should be noted that the scheme shown in Figure 14 is mainly to limit the sending of too many irrelevant messages to the proxy device due to too many changes in access control information.
  • step S1401 the proxy device subscribes to the access control information corresponding to the client device.
  • the proxy device may use the first command described above to subscribe to the access control information corresponding to the client device.
  • step S1402 the server device completes the subscription registration and determines whether the proxy device has the authority to subscribe to the access control information according to the binding relationship information.
  • the proxy device can actively obtain or subscribe to the access control information on the server device (for example, ACL function cluster resources), and the process of actively obtaining or subscribing to the access control information is limited by the binding relationship information between the proxy device and the client device.
  • the access control information returned by the server device to the proxy device is only the access control information related to the client device that the proxy device subscribes to.
  • step S1403 the server device returns a request response message to the proxy device.
  • step S1404 if the access control information corresponding to the client device changes, the proxy device is notified so that the proxy device determines whether to continue to maintain the subscription relationship with the client device.
  • step S1404 can reuse an existing ReportData message.
  • step S1404 can formulate a new subscription ReportData message. It should be noted that, regardless of reusing an existing ReportData message or formulating a new subscription ReportData message, the server device only feeds back to the proxy device the content of the actual permission change. For example, the server device only feeds back to the proxy device the access permission information corresponding to the client device that has a binding relationship with the proxy device, or the server device only feeds back to the proxy device when the permissions of the client device change (for example, the permissions become smaller or the permissions are lost).
  • step S1405 the proxy device determines that if the authority of the client device is lost, then the downstream subscription relationship is terminated.
  • the proxy device determines that the client device has lost the subscription authority to the target resource on the server device during the subscription process, the proxy device needs to terminate the downstream subscription relationship (ie, the proxy subscription relationship between the proxy device and the client device).
  • step S1406 when the target resource subscribed by the client device changes, the server device sends a notification message to the proxy device.
  • step S1407 the proxy device generates a ReportData message according to the notification message of the subscription resource change sent by the server device in step S1406, so as to send the ReportData message to the client device.
  • step S1408 the proxy device determines whether to check the access control information corresponding to the client device to determine whether the client device still has the authority to subscribe to the target resource. It should be noted that step S1408 is an optional step.
  • step S1409 the proxy device sends a ReportData message to the client device to indicate that the target resource subscribed by the client device has changed.
  • FIG15 is a schematic diagram of the structure of a server device provided in an embodiment of the present application.
  • the server device shown in FIG15 can execute any of the methods that can be executed by the server device described above.
  • the server device 1500 shown in FIG15 may include a control module 1510.
  • the control module 1510 may be used to control the access control information that the proxy device can obtain according to the binding relationship information, wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device.
  • the server device 1500 further includes: a first receiving module 1520.
  • the first receiving module 1520 may be configured to receive a registration request, where the registration request is used to register the binding relationship information.
  • the registration request is sent by the proxy device, or the registration request is sent by the client device.
  • the server device 1500 further includes: a second receiving module, configured to receive a first request sent by the proxy device, wherein the first request is used to query whether the client device has access rights to a target resource of the server device.
  • a second receiving module configured to receive a first request sent by the proxy device, wherein the first request is used to query whether the client device has access rights to a target resource of the server device.
  • control module 1510 is further used to: send a first response to the proxy device based on the binding relationship information; wherein the first response includes access control information of the client device to the target resource, or the first response is used to indicate whether the client device has access rights to the target resource.
  • control module 1510 is further configured to: send the changed access control information of the client device to the proxy device according to the binding relationship information.
  • the change in the access control information includes: a change in access rights of the client device to a target resource of the server device.
  • the server device 1500 further includes: a third receiving module, configured to receive a second request sent by the proxy device, wherein the second request is configured to request the server device to generate a notification message when access control information corresponding to the client device changes.
  • a third receiving module configured to receive a second request sent by the proxy device, wherein the second request is configured to request the server device to generate a notification message when access control information corresponding to the client device changes.
  • the binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records a device identifier of the proxy device and a device identifier of the client device.
  • the device identification of the client device includes: the device ID of the client device, and/or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.
  • the server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.
  • the second functional cluster also includes a second command, which is used to generate a response message for the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.
  • the access control information is recorded in an access control list ACL of the server device.
  • control module 1510 may be a processor 1810, and the first receiving module 1520 may be a transceiver 1830.
  • the server device may further include a memory 1820, as specifically shown in FIG. 18 .
  • FIG16 is a schematic diagram of the structure of a proxy device provided in an embodiment of the present application.
  • the proxy device shown in FIG16 can execute any of the methods that can be executed by the proxy device described above.
  • the proxy device 1600 shown in FIG16 can include a first sending module 1610 and a first receiving module 1620.
  • the first sending module 1610 may be configured to send a first request to the server device, where the first request is configured to query whether the client device has access rights to a target resource of the server device.
  • the first receiving module 1620 can be used to receive a first response sent by the server device in response to binding relationship information; wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device, and the binding relationship information is used to control the access control information that the proxy device can obtain.
  • the proxy device 1600 further includes: a second sending module, configured to send a registration request to the server device, wherein the registration request is used to register the binding relationship information.
  • a second sending module configured to send a registration request to the server device, wherein the registration request is used to register the binding relationship information.
  • the first response includes access control information of the client device to the target resource, or the first response is used to indicate whether the client device has access rights to the target resource.
  • the proxy device 1600 further includes: a second receiving module, configured to receive the changed access control information of the client device sent by the server device in response to the binding relationship information.
  • the change in the access control information includes: a change in access rights of the client device to the target resource.
  • the proxy device 1600 further includes: a third sending module, configured to send a second request to the server device, wherein the second request is configured to request the server device to generate a notification message when the access control information corresponding to the client device changes.
  • a third sending module configured to send a second request to the server device, wherein the second request is configured to request the server device to generate a notification message when the access control information corresponding to the client device changes.
  • the binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records a device identifier of the proxy device and a device identifier of the client device.
  • the device identification of the client device includes: the device ID of the client device, and/or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.
  • the server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.
  • the second function cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes changed content and change type of access control information corresponding to the client device associated with the first command.
  • the access control information is recorded in an access control list ACL of the server device.
  • the first sending module 1610 and the first receiving module 1620 may be a transceiver 1830.
  • the proxy device may further include a processor 1810 and a memory 1820, as specifically shown in FIG. 18 .
  • FIG17 is a schematic diagram of the structure of a client device provided in an embodiment of the present application.
  • the client device shown in FIG17 can execute any method that can be executed by the client device described above.
  • the client device 1700 shown in FIG17 can include a sending module 1710.
  • the sending module 1710 may be used to send binding relationship information to the server device, where the binding relationship information is used to indicate that there is a binding relationship between the client device and the proxy device, and the binding relationship information is used to control the access control information that the proxy device can obtain.
  • the binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records a device identifier of the proxy device and a device identifier of the client device.
  • the device identification of the client device includes: the device ID of the client device, and/or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.
  • the server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.
  • the change in the access control information includes: a change in access rights of the client device to a target resource of the server device.
  • the second function cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes changed content and change type of access control information corresponding to the client device associated with the first command.
  • the access control information is recorded in an access control list ACL of the server device.
  • the sending module 1710 may be a transceiver 1830.
  • the client device may further include a processor 1810 and a memory 1820, as specifically shown in FIG. 18 .
  • FIG18 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • the dotted lines in FIG18 indicate that the unit or module is optional.
  • the device 1800 may be used to implement the method described in the above method embodiment.
  • the device 1800 may be a chip, a terminal device, or a network device.
  • the device 1800 may include one or more processors 1810.
  • the processor 1810 may support the device 1800 to implement the method described in the above method embodiment.
  • the processor 1810 may be a general-purpose processor or a special-purpose processor.
  • the processor may be a central processing unit (CPU).
  • the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • DSP digital signal processor
  • ASIC application specific integrated circuits
  • FPGA field programmable gate arrays
  • a general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.
  • the apparatus 1800 may further include one or more memories 1820.
  • the memory 1820 stores a program, which can be executed by the processor 1810, so that the processor 1810 executes the method described in the above method embodiment.
  • the memory 1820 may be independent of the processor 1810 or integrated in the processor 1810.
  • the apparatus 1800 may further include a transceiver 1830.
  • the processor 1810 may communicate with other devices or chips through the transceiver 1830.
  • the processor 1810 may transmit and receive data with other devices or chips through the transceiver 1830.
  • the present application also provides a computer-readable storage medium for storing a program.
  • the computer-readable storage medium can be applied to a terminal or network device provided in the present application, and the program enables a computer to execute the method performed by the terminal or network device in each embodiment of the present application.
  • the embodiment of the present application also provides a computer program product.
  • the computer program product includes a program.
  • the computer program product can be applied to the terminal or network device provided in the embodiment of the present application, and the program enables the computer to execute the method performed by the terminal or network device in each embodiment of the present application.
  • the embodiment of the present application also provides a computer program.
  • the computer program can be applied to the terminal or network device provided in the embodiment of the present application, and the computer program enables a computer to execute the method executed by the terminal or network device in each embodiment of the present application.
  • the "indication" mentioned can be a direct indication, an indirect indication, or an indication of an association relationship.
  • a indicates B which can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, B can be obtained through C; it can also mean that there is an association relationship between A and B.
  • B corresponding to A means that B is associated with A, and B can be determined according to A.
  • determining B according to A does not mean determining B only according to A, and B can also be determined according to A and/or other information.
  • the term "corresponding" may indicate that there is a direct or indirect correspondence between the two, or an association relationship between the two, or a relationship of indication and being indicated, configuration and being configured, etc.
  • pre-definition or “pre-configuration” can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in a device (for example, including a terminal device and a network device), and the present application does not limit the specific implementation method.
  • pre-definition can refer to what is defined in the protocol.
  • the “protocol” may refer to a standard protocol in the communication field, for example, it may include an LTE protocol, an NR protocol, and related protocols used in future communication systems, and the present application does not limit this.
  • the term "and/or" is only a description of the association relationship of the associated objects, indicating that there can be three relationships.
  • a and/or B can represent: A exists alone, A and B exist at the same time, and B exists alone.
  • the character "/" in this article generally indicates that the associated objects before and after are in an "or" relationship.
  • the size of the serial numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
  • Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.
  • the computer-readable storage medium may be any available medium that can be read by a computer or a data storage device such as a server or data center that includes one or more available media integrated.
  • the available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital versatile disk (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.
  • a magnetic medium e.g., a floppy disk, a hard disk, a magnetic tape
  • an optical medium e.g., a digital versatile disk (DVD)
  • DVD digital versatile disk
  • SSD solid state disk

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

提供了一种用于访问控制的方法、服务端设备、代理设备和客户端设备。该用于访问控制的方法包括：服务端设备根据绑定关系信息，控制代理设备能够获取的访问控制信息，其中，绑定关系信息用于指示代理设备和客户端设备之间具有绑定关系。本申请实施例中，服务端设备能够根据绑定关系信息控制代理设备能够获取的访问控制信息。如此一来，具有代理视图权限的代理设备仅能够获取与其具有绑定关系的客户端设备对应的访问控制信息，降低数据隐私泄露的风险。

Description

用于访问控制的方法和装置 技术领域
本申请涉及通信技术领域，并且更为具体地，涉及一种用于访问控制的方法、服务端设备、代理设备和客户端设备。
背景技术
某些情况下，客户端设备可以通过代理设备订阅服务端设备的资源。为便于代理设备确定客户端设备是否具有订阅服务端设备的资源的权限，代理设备在服务端设备上具有代理视图(proxyview)权限。
具有代理视图权限的代理设备能够获取服务端设备的所有访问控制信息。如此一来，一旦代理设备被攻陷，容易造成服务端设备的访问控制信息泄露，增加数据隐私泄露的风险。
发明内容
本申请提供一种用于访问控制的方法、服务端设备、代理设备和客户端设备。下面对本申请涉及的各个方面进行介绍。
第一方面，提供了一种用于访问控制的方法，包括：服务端设备根据绑定关系信息，控制代理设备能够获取的访问控制信息，其中，所述绑定关系信息用于指示所述代理设备和客户端设备之间具有绑定关系。
第二方面，提供了一种用于访问控制的方法，包括：代理设备向服务端设备发送第一请求，所述第一请求用于查询客户端设备是否具有所述服务端设备的目标资源的访问权限；响应于绑定关系信息，所述代理设备接收所述服务端设备发送的第一响应；其中，所述绑定关系信息用于指示所述代理设备和所述客户端设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
第三方面，提供了一种用于访问控制的方法，包括：客户端设备向服务端设备发送绑定关系信息，所述绑定关系信息用于指示所述客户端设备和代理设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
第四方面，提供了一种服务端设备，包括：控制模块，用于根据绑定关系信息，控制代理设备能够获取的访问控制信息，其中，所述绑定关系信息用于指示所述代理设备和客户端设备之间具有绑定关系。
第五方面，提供了一种代理设备，包括：第一发送模块，用于向服务端设备发送第一请求，所述第一请求用于查询客户端设备是否具有所述服务端设备的目标资源的访问权限；第一接收模块，用于响应于绑定关系信息，接收所述服务端设备发送的第一响应；其中，所述绑定关系信息用于指示所述代理设备和所述客户端设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
第六方面，提供了一种客户端设备，包括：发送模块，用于向服务端设备发送绑定关系信息，所述绑定关系信息用于指示所述客户端设备和代理设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
第七方面，提供了一种服务端设备，包括处理器、存储器以及通信接口，所述存储器用于存储一个或多个计算机程序，所述处理器用于调用所述存储器中的计算机程序使得所述服务端设备执行第一方面的方法中的部分或全部步骤。
第八方面，提供了一种代理设备，包括处理器、存储器以及通信接口，所述存储器用于存储一个或多个计算机程序，所述处理器用于调用所述存储器中的计算机程序使得所述代理设备执行第二方面的方法中的部分或全部步骤。
第九方面，提供了一种客户端设备，包括处理器、存储器以及通信接口，所述存储器用于存储一个或多个计算机程序，所述处理器用于调用所述存储器中的计算机程序使得所述客户端设备执行第三方面的方法中的部分或全部步骤。
第十方面，本申请实施例提供了一种通信系统，该系统包括上述的服务端设备、代理设备和客户端设备中的一种或多种。在另一种可能的设计中，该系统还可以包括本申请实施例提供的方案中与该服务端设备、代理设备或客户端设备进行交互的其他设备。
第十一方面，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序使得服务端设备、代理设备或客户端设备执行上述各个方面的方法中的部分或全部步骤。
第十二方面，本申请实施例提供了一种计算机程序产品，其中，所述计算机程序产品包括存储了计 算机程序的非瞬时性计算机可读存储介质，所述计算机程序可操作来使服务端设备、代理设备或客户端设备执行上述各个方面的方法中的部分或全部步骤。在一些实现方式中，该计算机程序产品可以为一个软件安装包。
第十三方面，本申请实施例提供了一种芯片，该芯片包括存储器和处理器，处理器可以从存储器中调用并运行计算机程序，以实现上述各个方面的方法中所描述的部分或全部步骤。
本申请实施例中，服务端设备能够根据绑定关系信息控制代理设备能够获取的访问控制信息。如此一来，具有代理视图权限的代理设备仅能够获取与其具有绑定关系的客户端设备对应的访问控制信息，降低数据隐私泄露的风险。
附图说明
图1为可应用本申请实施例的Matter设备的模型结构。
图2为可应用本申请实施例的通信系统的系统架构示例图。
图3为本申请实施例提供的访问控制权限的级别关系的示例图。
图4为可应用代理机制的通信系统的系统架构示例图。
图5为本申请实施例提供的代理订阅的流程示意图。
图6为本申请一实施例提供的用于访问控制的方法的流程示意图。
图7为本申请实施例提供的建立绑定关系信息的流程示意图。
图8为本申请另一实施例提供的用于访问控制的方法的流程示意图。
图9为本申请又一实施例提供的用于访问控制的方法的流程示意图。
图10为本申请又一实施例提供的用于访问控制的方法的流程示意图。
图11为本申请实施例提供的代理设备发现和建立连接的过程的流程示意图。
图12为本申请又一实施例提供的用于访问控制的方法的流程示意图。
图13为本申请又一实施例提供的用于访问控制的方法的流程示意图。
图14为本申请又一实施例提供的用于访问控制的方法的流程示意图。
图15为本申请实施例提供的服务端设备的结构示意图。
图16为本申请实施例提供的代理设备的结构示意图。
图17为本申请实施例提供的客户端设备的结构示意图。
图18为本申请实施例提供的通信装置的示意性结构图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。为了便于理解，下文结合图1至图5介绍本申请实施例涉及的术语。需要说明的是，下文以Matter协议的场景为例，介绍本申请实施例涉及的术语，以及本申请实施例的方案。当然，本申请实施例的方案还可以应用于其他物联网协议。
物联网(internet of things，IoT)即“万物相连的互联网”，其是在互联网基础上延伸和扩展的网络，可以通过各种信息传感设备(如射频识别、全球定位系统等)将任何物品与互联网连接起来形成一个巨大的网络，进行信息交换和通信，以实现万物之间的互联互通。在一些实施例中，物联网设备可以是智能家居设备，例如，物联网设备可以包括智能空调、智能冰箱、洗衣机、电饭煲、扫地机器人等设备。在一些实施例中，物联网设备可以是智能监控设备，例如，物联网设备可以包括监控摄像头、温度传感器、声音传感器等。
目前，不同厂家可能使用不同的通信协议(也可以称为生态链协议)，实现支持该通信协议的物联网设备之间的互联互通，这样可能导致不同厂家生产的物联网设备之间不能通信，不能达到真正的万物互联。
基于此，连接标准联盟(connectivity standards alliance，CSA)推出一种物联网应用层技术标准—Matter标准协议，其可以提供基于互联网协议(internet protocol，IP)的智能家居设备的可互操作的应用层解决方案。在一些实施例中，Matter标准也可以称为基于IP的互联家居(connected home over IP，CHIP)标准。在一些实施例中，Matter标准可以支持以太网、Wi-Fi和Thread三种底层通信协议，并且可以让不同协议的物联网设备互相通信。
Matter设备的数据模型
图1是本申请实施例适用的Matter设备的数据模型结构。Matter设备的数据模型结构100包括节点(node)110、端点(endpoint)120、功能集群(cluster)130。
节点(node)110，封装了网络上可寻址的、唯一的资源，具有一组功能和能力，用户可以清楚地将其视为一个功能整体。通常，节点110可以是数据模型中最高或最外层的一阶元素。或者说，节点 110是数据模型最外层唯一的可寻址元素。
一个物理实体(例如，Matter设备)可以是一个节点110，或者说，节点110可以是指Matter设备节点。需要说明的是，一个节点可以有多个节点标识(identifier，ID)，每个节点ID的作用域是一个特定的网络(fabric)。例如，当节点ID被用作交互的目标地址时，指定节点ID作用域的网络就是交互的访问网络。
一个节点可以包括一个或多个端点120。端点120是一个实例，它可以是一个服务或虚拟设备，由设备类型指示。每个端点120都符合一个或多个设备类型定义，这些设备类型定义了端点支持的功能集群，在一些实施例中，端点可以理解为是由设备类型指示的服务/虚拟设备。而功能集群是在端点上实例化的对象类。
需要说明的是，在这个体系结构模型中，上述设备类型可以是最高语义元素。设备类型定义了一组端点120的符合性。设备类型为节点110或端点120定义了一组需求。
每个端点120可以是一类功能的集合，其可以包含一个或多个功能集群130。
功能集群130是数据模型的功能构建块元素，在一些实施例中，功能集群又可以称为功能集、集群、群集等，本申请实施例对此并不限定。功能集群规范定义了通过交互相互对应的客户端和服务端。功能集群130可以被视为接口、服务或对象类，是数据模型中最低的独立功能元素。每个功能集群130都可以由一个功能集群规范定义，该规范定义了功能集群130的元素，包括属性、事件、命令以及与这些元素交互相关的行为。在一些实施例中，属性、命令、事件也可以称为功能集群130的接口单元，可以通过这三种接口单元提供相应的功能。
在一些实施例中，功能集群130中的属性、事件、命令和行为是强制性的还是可选的，取决于功能集群130的定义。
通常，上述功能集群可以分为实用程序功能集群(utility cluster)和应用程序功能集群(application cluster)两类。
实用程序功能集群不是端点的主要应用程序操作的一部分。实用程序功能集群可以用于配置、发现、寻址、诊断、监视设备运行状况、软件更新等。实用程序功能集群可能与它的功能集群对等物(cluster counterpart)有一个临时的关系。示例性地，实用程序功能集群可以包括描述符功能集群(descriptor cluster)、绑定功能集群(binding cluster)、代理配置功能集群(proxy configuration cluster)等。
应用程序功能集群支持端点的主要操作，在一些实施例中，应用程序功能集群也可以称为业务功能集群。应用程序功能集群可以支持客户端和服务端之间的一个或多个持久应用程序的交互。例如，智能电灯中的开关功能集群(On/Off cluster)，客户端可以向服务端(即，开关功能集群)发送控制命令，以控制智能电灯的开关。
在一些实施例中，业务功能集群可以是指除节点中的端点0(可以理解为节点中的第一个端点，该端点的设备类型为“根节点”)之外的其他端点上的功能集群。
应用程序功能集群不是实用程序功能集群，即使它本身可能支持实用程序功能，例如校准、操作模式等。应用程序功能集群规范不应涉及其应用领域之外的层和进程。
下面对功能集群的命令、属性、以及事件等主要元素进行简单介绍。
功能集群命令(又称“命令”，command)是一组数据字段，每个数据类型在客户端和服务端功能集群实例之间传递，以调用命令接收者的行为。目前，协议中约定，每个命令都可以列在一个表中，该表可以包含命令的数据质量列：标识(ID)、名称(name)、方向(direction)、响应(response)、访问(access)、符合性(conformance)。相应地，一条命令可以指示一个表中定义的零个或多个字段。每个命令字段定义为表中的一行。
属性(attribute)是功能集群数据。目前，协议中约定，每个属性可以列在一个表中，该表定义的属性的数据质量列可以包括：ID、名称、(数据)类型(type)、约束(constraint)、其他质量、访问、默认(值)和符合性。在一些实现方式中，属性还可以定义其相关的语义和行为。属性可以反映设备的可查询/可设置的状态、配置和能力。在一些情况下，如果没有为属性显式定义权限，则默认的访问权限生效。
事件(event)定义了过去发生的事情的记录。在这方面，事件记录可以被认为是一个日志条目，该日志条目可以通过事件记录流提供节点上的事件的时间顺序视图。与属性不同，属性不提供任何临界点保留(edge-preserving)的功能(也就是说，不保证每一个属性的变化都会传递给观察者)，事件允许捕捉每一个单独的临界点或变化，并可靠地传递给观察者。这对于依赖于正确行为保证的安全和安全应用程序至关重要。目前，协议中规定，每个功能集群事件可以列在一个表中，该表定义的事件的数据质量列可以包括：ID、优先级(priority)、访问、符合性。
为了便于理解，下文介绍命令、属性和事件中包含的几种常见的数据质量的含义。需要说明的是， 本申请实施例中的命令、属性和事件中还可以包含其他数据质量，或者包含上述数据质量中的部分。本申请实施例对此不作限定。
标识，表示字段的唯一字段ID，或者说，是命令(或，属性、事件)的唯一标识。
名称，表示字段的唯一名称，或者说，表示命令(或，属性)的名称。
类型，表示字段的数据类型，或者说，表示命令参数(或，属性参数)的数据类型。
方向，通常存在于命令列表中，用于定义命令的传输方向，例如，可以定义为从客户端到服务端。又例如，可以定义为从服务端到客户端。
访问权限，用于定义一个元素如何被访问(例如读或写)以及访问该数据需要哪些权限。在一些实现方式中，访问权限可以包括V，V表示读取访问或调用访问需要视图权限。访问权限还可以包括O，O表示“读访问”、“写访问”或“调用访问”需要操作权限。访问权限还可以包括R，R表示读访问。访问权限还可以包括W，W表示写访问。
响应，通常存在于命令列表中，用于定义命令的响应消息。
质量，用于定义其他列中没有涉及的其他数据质量。
默认，用于定义的默认值。需要说明的是，默认值并不是服务端返回出厂刷新设置时使用的值。默认值可以指示为数据字段指定的符合性可以是可选的，也可以随时间变化。当实际数据字段值不存在时，可以定义默认值以完成依赖关系。
符合性，定义了任何数据模型元素或元素集的可选性和依赖性。通常，此列对属性、命令、事件、枚举以及命令、事件或结构的字段有效。在一些实现方式中，“M”表示对应的命令为基本的强制特性集的一部分，“O”表示对应的命令为可选的特性集的一部分。
对于命令而言，客户端到服务端命令的符合性意味着服务端应该识别并支持客户端到服务端的命令，并按照定义生成响应。服务端到客户端命令的符合性意味着服务端应该按照功能集群行为定义的方式发送命令，例如，响应客户端到服务端的命令。命令的符合性取决于所支持的服务端特性。客户端不应被要求支持可选命令或依赖于可选特性的命令。
约束，包含all和desc。其中，all定义在数值数据类型中表示允许所有值。desc表示约束是在描述部分定义的。
范围(range)，表示字段的取值范围。范围可以支持两种形式：显式约束(explicit constraint)和宽度约束(width constraint)。其中，显式约束可以给出字段的取值对应的最小值和最大值，例如，某个字段的取值范围为(0,128)。宽度约束可以将字段的取值限定在特定字节数内，例如，某个字段的取值限定在8个字节内。在一些实施例中，范围的取值可以包含“N/A”表示不适用。当然，“N/A”也可以出现在其他部分(其他数据质量中)，比如，默认、约束等。
优先级：每个事件记录都有一个相关的优先级。该优先级可以用于描述事件的使用语义。
基于Matter协议的通信系统
下文结合图2介绍本申请实施例适用的通信系统。图2所示的通信系统包含Matter客户端设备210、Matter服务端设备220、配置设备230。需要说明的是，Matter客户端设备210、Matter服务端设备220的数据结构模型可以为图1所示。
Matter客户端(client)设备210为用户侧的客户端设备，Matter客户端设备210可以与Matter服务端设备220进行通信。在一些实现方式中，Matter客户端设备210可以向Matter服务端设备220发送控制信息，以对Matter服务端设备220进行控制。例如当Matter服务端设备220为智能空调时，Matter客户端设备210可以通过向Matter服务端设备220发送控制信息，以控制Matter服务端设备220的调节温度。
在一些实施例中，上述Matter客户端设备210可以是指安装有Matter客户端的终端设备，其中，终端设备可以是手机、电脑、平板电脑、智能手环、智能手表等，本申请实施例对此并不进行限定。应该理解，Matter客户端可以为应用程序(application，APP)或者小程序等，本申请实施例对此并不限定。
Matter服务端(server)设备220可以指支持Matter标准协议的物联网设备。Matter服务端设备220可以直接和Matter客户端设备210进行通信，以便Matter客户端设备210对Matter服务端设备220进行控制。
示例性地，当Matter服务端设备220为支持Matter标准协议的智能空调时，Matter客户端设备210可以控制智能空调的开关以及设置空调温度、风速等。当Matter服务端设备220为支持Matter标准协议的扫地机器人时，Matter客户端设备210可以控制扫地机器人开始工作或停止工作、控制扫地机器人的工作模式等。
目前，Matter服务端设备220所支持的操控接口主要包含控制(control)、订阅上报(subscribe and  report)两类。其中，控制可以理解为可以修改或检索Matter服务端设备的一个或多个属性值对应的一组功能集群。例如，Matter客户端设备为智能扬声器，Matter服务端设备为智能空调，用户可以对智能扬声器说“降温”，然后，智能扬声器向智能空调发送降低温度的控制命令。
在一些实施例中，可以利用订阅交互模型来定义可以订阅的属性以及订阅的要求，例如触发阈值、报告间隔和持续时间等。作为一个具体示例，Matter客户端设备为智能扬声器，Matter服务端设备为智能空调，用户可以通过智能扬声器订阅智能空调的空调传感器测得的室内温度，以便用户可以通过定期接收报告来监测室内温度。
配置(commissioner)设备230可以用于对Matter服务端设备220进行配置。或者说，配置设备可以理解为安装有配置端的终端设备，用户可以通过该配置端对Matter服务端设备220进行配置。其中，终端设备可以是手机、电脑、平板电脑、智能手环、智能手表等，本申请实施例对此并不进行限定。在一些实施例中，配置端可以为应用程序或者小程序等，本申请实施例对此并不限定。
需要说明的是，上述配置端可以与Matter客户端是相同的APP或小程序，当然，配置端可以与Matter客户端是不同的APP或小程序。本申请实施例对此不作限定。
访问控制列表(access control list，ACL)功能集群
访问控制特性旨在确保只有经过授权的节点才被允许通过交互模型访问数据模型公开的特定应用层功能。访问控制是安全通道和交互模型之间的基本连接。
为了实现访问控制策略，网络(fabric)上的管理员在所有节点上创建并维护ACL的一致分布式配置，或者说，创建并维护ACL功能集群。在一些实施例中，ACL功能集群也可以称为访问控制功能集群(access control cluster)，本申请实施例对此并不做明确区分。
ACL功能集群是控制设备访问权限的一个功能集群，其部署在每一个节点上，且仅有一个实例。换句话说，每个节点都包括一个ACL。当该节点收到一个请求时，会首先在ACL中检查请求方是否有权限。
ACL中可以包含对策略进行编码的访问控制项(access control entry，ACE)。访问控制系统可以根据节点的ACL包含的ACE中的规则检查和验证所有尝试的访问。每条ACE都可以在该节点上编码一个单独的权限授予，并由访问控制权限授予算法使用该ACE以确定一个主体(subject)是否有权限与节点上的目标(target)进行交互。
ACL功能集群包含的属性可以参见表1。
表1
ID 名称 类型 约束 质量 访问 默认 符合性
0 ACL List[AccessControlEntryStruct] desc N RWA empty M
如表1所示，该属性的类型为列表类型的结构体(如，AccessControlEntryStruct)。该属性对应的质量为“N”，表示该属性数据值为非易失性的，并且在重新启动时保持不变。该属性对应的访问数据质量包括RWA，表示读访问和写访问需要管理员(administer)权限。
下面结合表2对ACL功能集群包含的该属性的类型进行介绍。或者说，该属性的类型的结构体(AccessControlEntryStruct)的定义可以如表2所示。
表2
Figure PCTCN2022131991-appb-000001
FabricIndex可以将ACE的作用域限定到关联的fabric。
Privilege字段可以用于指定该ACE授予的权限级别。换句话说，一条ACE中，可以通过Privilege确定该ACE对应的Subjects访问Targets的权限。Privilege可以通过枚举的方式列举出来，其可以属于AccessControlEntryPrivilegeEnum中的一项或多项。其中，AccessControlEntryPrivilegeEnum的定义可以包括下面列举的几项权限。
(1)视图(view)权限：授予view权限的设备可以读取和订阅服务端设备的资源，但ACL功能集群除外。在一些实施例中，view权限也可以用于指示可以被非代理设备看到服务端设备的target。
(2)代理视图(proxyview)权限：授予proxyview权限的设备可以读取和订阅服务端设备的资源，包括ACL功能集群。在一些实施例中，proxyview也可以用于指示可以被代理设备看到服务端设备的target和ACL。
(3)操作(operate)权限：授予operate权限的设备能够获取view权限以及能够执行节点的主要功能，但ACL功能集群除外。
(4)管理(manage)权限：授予manage权限的设备能够获取operate权限以及能够修改和配置节点上的数据，但ACL功能集群除外。
(5)管理员(administer)权限：授予administer权限的设备能够获取manage权限以及能够订阅和修改ACL功能集群。
可以看出，每个权限都建立在其前身的基础上，在前身的基础上扩展了可以在节点上执行的操作集。administer是最高权限，它的特殊之处在于它通过ACL功能集群管理权限本身。
当一个节点被授予特定的权限时，它也会被隐式地授予所有逻辑上较低的权限级别。图3说明了较高的权限级别如何包含较低的权限级别。
AuthMode字段可以用于指定该ACE所需的认证模式。AuthMode可以通过枚举的方式列举出来，其可以属于AccessControlEntryAuthmodeEnum中的一项或多项。其中，AccessControlEntryAuthmodeEnum的定义可以包括表3列举的几项认证模式。
表3
Figure PCTCN2022131991-appb-000002
Subjects字段可以用于指定该ACE授予访问权限的subjects列表。Subject的含义主要是描述操作的源，该操作使用安全通道架构提供的给定的认证方法。在一些实施例中，Subject可以是一个通过CASE会话认证的源节点(例如，客户端设备节点)。
在一些实施例中，subjects字段可以包括客户端设备的设备ID(节点ID)。在一些实施例中，subjects字段可以包括客户端设备对应的CASE认证标签(CASE authenticated tag，CAT)。
在一些实施例中，Subjects列表为空时表示通配符，即该ACE将授予任何通过AuthMode认证成功的节点访问权。在一些实施例中，如果ACE的AuthMode为PASE，则subjects列表不能为空。
Targets字段可以用于指定target结构体列表，该列表定义了该ACE授予访问权限的节点上的集群。
在一些实施例中，单一的target应该包含至少一个字段(功能集群，端点或设备类型)，并且不能同时包含端点和设备类型字段。
在一些实施例中，Targets列表为空时表示通配符，即该ACE将授予该节点所有端点上的所有功能集群实例的访问权。
为了便于理解，下面给出ACL功能集群的一个示例。
ACL功能集群:{
ACL:[
0:{
FabricIndex:1,
Privilege:Administer,
AuthMode:CASE,
Subjects:[0xAAAA_AAAA_AAAA_AAAA],
Targets:[]
}，
1:{
FabricIndex:1,
Privilege:Manage,
AuthMode:Group,
Subjects:[0x0000_0000_0000_0001],
Targets:[{Endpoint:1},{Endpoint:3}]
}
]
}
在该示例中，subjects为0xAAAA_AAAA_AAAA_AAAA的节点对服务端设备所有端点上的所有功能集群实例具有administer的权限。Subjects为0x0000_0000_0000_0001的节点对服务端设备上的端点1和端点3上的所有功能集群实例具有manage的权限。
为订阅操作提供的代理机制
在一些情况下(例如，服务端设备资源不足)，服务端设备无法直接处理订阅请求，则可以使用代理机制(或称，代理服务)来帮助服务端设备处理订阅请求。也就是说，代理机制可以实现对服务端设备中资源进行订阅的代理能力。
参见图4，代理机制通常涉及客户端设备、服务端设备以及代理设备。其中，服务端设备可以是指作为一组数据真实性原始来源的节点。服务端设备可以充当数据的发布者。客户端设备可以是指希望订阅某个服务端设备的节点。代理设备可以将服务端设备的数据“镜像”呈现给客户端设备，而对于客户端设备而言，无论其是与代理设备交互还是与服务端设备交互，客户端设备都无需改变其交互。
通常，从客户端设备的角度而言，代理的流程可以包含以下几个过程：发现服务端设备需要代理；在网络上找到能够处理其订阅请求的代理设备；设置代理设备以订阅服务端设备。
在代理设置过程中，代理设备可以通过声明对订阅代理设备类型的支持来表明其作为已经认证过的代理的能力。当此类代理设备被配置时，配置设备应识别此能力，并可将需要代理的所有服务端设备的节点ID写入代理设备上的代理配置功能集群。或者，配置设备可以将代理设备配置为通配符以代理所有服务端设备，从而无需指定一组特定的节点ID。
此外，配置设备可以将新添加的代理设备的节点ID写入需要代理的服务端设备上的有效代理功能集群(validproxylist cluster)。该功能集群可以存储给定设备的候选代理的静态列表。通常，对于支持该功能集群的服务端设备需要编写此配置。
客户端设备找到能够处理其订阅请求的代理设备并设置成功后，便可以通过该代理设备订阅服务端设备的资源。图5给出了一种代理订阅的流程的示意图。图5所示的代理订阅的流程可以包括步骤1至步骤10。
在步骤1，客户端设备向代理设备发送订阅服务端设备上的C1资源的请求。
在步骤2，代理设备向客户端设备发送报告数据(ReportData)消息，通知客户端设备其暂时没有订阅服务端设备的该资源(即，代理设备暂时没有订阅C1资源)。
在步骤3，客户端设备针对代理设备发送的ReportData消息进行响应。
在步骤4，代理设备向客户端设备返回订阅响应。
在步骤5-8，代理设备发起对服务端设备上C1资源的订阅，并完成C1资源的订阅。
在步骤9-10，代理设备成功订阅C1资源后，继续处理客户端设备的订阅流程。
在代理设备向客户端设备发送ReportData之前，代理设备需要检查客户端设备是否具有订阅服务端设备的C1资源的权限(view权限)。在客户端设备具有订阅C1资源的权限的情况下，代理设备可以通过ReportData向客户端设备返回订阅的C1资源的内容，或者在代理设备还未订阅C1资源的情况下，先向客户端设备返回其暂时没有订阅C1资源的消息，并后续订阅C1资源及向客户端设备返回订阅的C1资源的内容。
为便于代理设备确定客户端设备是否具有订阅服务端设备的资源(即，下文的目标资源)的权限，代理设备在服务端设备上具有proxyview权限，能够获取服务端设备的所有访问控制信息。或者说，代理设备在服务端设备ACL功能集群资源上具有proxyview权限，能够订阅或者读取ACL功能集群。基于此，代理设备可以通过获取客户端设备在服务端设备上的目标资源(例如，C1资源)的权限，进而判定客户端设备是否可以订阅目标资源。
需要说明的是，客户端设备无论直接订阅服务端设备的目标资源，还是通过代理设备代理订阅目标资源，都必须具有订阅服务端设备的目标资源的权限，即在服务端设备的ACL功能集群上需要具有客户端设备对应的ACE。
如前文所述，代理设备具有proxyview权限之后，代理设备可以通过该权限访问(读取和/或订阅)ACL功能集群。如果没有为代理设备配置访问ACL功能集群的权限，那么代理设备将无法工作。
由于代理设备和管理员都不能预测客户端设备可能订阅哪些服务端设备的目标资源，因此，为了保证代理最有效，相关技术中为整个代理设备节点授予了proxyview权限，使得代理设备能够获取服务端设备的所有访问控制信息。也就是说，具有proxyview权限的代理设备，可以在同一个fabric内无限制的获取服务端设备的ACL信息。如此一来，一旦代理设备被攻陷，极易造成服务端设备的访问控制信 息泄露，增加数据隐私泄露的风险。
为了解决上述问题，本申请实施例提供了一种用于访问控制的方法、服务端设备、代理设备和客户端设备，能够降低数据隐私泄露的风险。下面对本申请实施例提供的用于访问控制的方法进行介绍。
图6为本申请一实施例提供的用于访问控制的方法的流程示意图。图6所示的方法可以由服务端设备执行，该服务端设备例如可以是前文图2所示的Matter服务端设备220。图6所示的方法可以包括步骤S610，下面对该步骤进行详细介绍。
在步骤S610，服务端设备根据绑定关系信息，控制代理设备能够获取的访问控制信息。
该绑定关系信息可以用于指示代理设备和客户端设备之间具有绑定关系，即该绑定关系信息可以用于指示(或记录)代理设备与该代理设备代理订阅的客户端设备之间的绑定关系。换句话说，通过该绑定关系信息可以获知某个代理设备具体和哪些客户端设备具有绑定关系，或者获知某个代理设备为哪些客户端设备进行代理服务。
在一些实施例中，服务端设备根据代理设备和客户端设备之间的绑定关系，控制代理设备能够获取的访问控制信息可以是指，如果服务端设备确定代理设备和客户端设备之间具有绑定关系，则服务端设备可以告诉(例如，发送或通知)该代理设备有关该客户端设备对应的访问控制信息(例如，客户端设备对服务端设备的目标资源的访问控制信息)的相关信息或相关内容。例如，在服务端设备确定代理设备和客户端设备之间具有绑定关系的情况下，服务端设备可以告诉代理设备该客户端设备是否具有服务端设备的目标资源的访问权限，或者，服务端设备可以告诉代理设备该客户端设备对目标资源的访问权限是否发生变化等。
对应地，在一些实施例中，服务端设备根据代理设备和客户端设备之间的绑定关系，控制代理设备能够获取的访问控制信息可以是指，如果服务端设备确定代理设备和客户端设备之间不具有绑定关系，则服务端设备不会告诉该代理设备有关该客户端设备对应的访问控制信息(例如，客户端设备对服务端设备的目标资源的访问控制信息)的相关信息或相关内容。例如，服务端设备不会告诉代理设备该客户端设备是否具有服务端设备的目标资源的访问权限，或者，服务端设备不会告诉代理设备该客户端设备对目标资源的访问权限是否发生变化等。
在一些实施例中，客户端设备对服务端设备的目标资源的访问权限可以是指视图(view)权限，或者，也可以是比视图权限等级高的权限，例如，可以是操作(operate)权限、管理(manage)权限、管理员(administer)权限等。
在一些实施例中，在客户端设备具有服务端设备的目标资源的访问权限的情况下，客户端设备能够读取或订阅服务端设备的目标资源。
在一些实施例中，访问控制信息可以用于确定客户端设备是否具有服务端设备的目标资源的访问权限。换句话说，通过获知某一客户端设备对应的访问控制信息能够确定该客户端设备是否可以读取或订阅该访问控制信息对应的目标资源。
在一些实施例中，访问控制信息可以记录在服务端设备的ACL中，例如，记录在服务端设备的ACL功能集群中。在一些实施例中，服务端设备的ACL功能集群有且仅有一个实例。作为一种实现方式，服务端设备的ACL功能集群可以部署在服务端设备的端点0上。
在一些实施例中，当访问控制信息记录在ACL功能集群中时，代理设备和客户端设备之间的绑定关系可以理解为，实质是代理设备和客户端设备在ACL功能集群中subjects角色的绑定关系，即代理设备和客户端设备对应的subjects的绑定关系。
在一些实施例中，访问控制信息可以是指ACE，服务端设备可以根据ACE中的规则检查和验证客户端设备是否具有服务端设备的目标资源的访问权限。这种情况下，服务端设备根据绑定关系信息，控制代理设备能够获取的访问控制信息可以是指，服务端设备根据绑定关系信息，控制代理设备能够获取的ACE。
与具有proxyview权限的代理设备能够获取服务端设备的所有访问控制信息相比，实际上，申请人发现，理论上代理设备仅对其代理订阅的客户端设备对应的访问控制信息(例如，仅对客户端设备在服务端设备上的目标资源的访问权限)感兴趣，而服务端设备中其他的访问控制信息与代理设备是无关的。因此，本申请实施例能够根据绑定关系信息控制代理设备能够获取的访问控制信息，使得代理设备仅能够获取与其具有绑定关系的客户端设备对应的访问控制信息，降低数据隐私泄露的风险。
为了便于理解，下面先对绑定关系信息的建立过程进行介绍。
图7为本申请实施例提供的建立绑定关系信息的流程示意图。如图7所示，绑定关系信息的建立过程可以包括步骤S710。
在步骤S710，服务端设备接收注册请求，该注册请求用于注册绑定关系信息。
在一些实施例中，该注册请求可以是代理设备发送的。换句话说，代理设备可以向服务端设备发送 绑定关系信息，或者说，绑定关系信息可以是由代理设备设定的。
在一些实施例中，该注册请求可以是客户端设备发送的。换句话说，客户端设备可以向服务端设备发送绑定关系信息，或者说，绑定关系信息可以是由客户端设备设定的。
在一些实施例中，在代理设备或客户端设备发送注册请求之前，服务端设备还可以进行绑定关系信息的预注册。作为一种实现方式，在客户端设备直接订阅服务端设备的目标资源失败后，客户端设备请求获取服务端设备的有效代理列表之前或之后，服务端设备可以预先保存客户端设备的设备标识(比如，客户端设备的设备ID和/或客户端设备对应的CATs)，以便之后客户端设备或代理设备在预注册信息的基础上进行代理设备和客户端设备之间的绑定关系的设定。例如，服务端设备预先保存客户端设备的设备标识后，客户端设备或代理设备后续可以发起注册请求，将该客户端设备对应的代理设备的设备标识与该客户端设备的设备标识关联起来。
在一些实施例中，代理设备或客户端设备可以通过注册请求命令进行绑定关系信息的注册。换句话说，代理设备或客户端设备发送的注册请求可以是注册请求命令，代理设备或客户端设备可以通过服务端设备提供的注册请求命令接口来设定绑定关系信息。
作为一种实现方法，该注册请求命令的输入参数可以包括代理设备的设备标识和对应的客户端设备的设备标识。为了便于理解，下面结合表4给出注册请求命令的一种实现方式。
表4
Figure PCTCN2022131991-appb-000003
在表4的示例中，该注册请求命令为RegisterProxyNode命令，客户端设备或代理设备可以通过RegisterProxyNode命令设定该客户端设备和代理设备的绑定关系。作为一种实现方式，客户端设备或代理设备可以利用RegisterProxyNode命令输入需要绑定的客户端设备的设备标识和代理设备的设备标识，以将该绑定关系信息注册到服务端设备对应的功能集群(例如，下文提及的第一功能集群，或者其他功能集群)中。在表4的示例中，承载绑定关系信息的属性例如可以是下文提及的第一属性(比如，obsrelationship属性)。
需要说明的是，本申请实施例对注册请求命令的名称不做具体限定，RegisterProxyNode命令仅为一个示例，其可以是其他任意名称，只要能通过该命令来注册或设定代理设备和客户端设备的绑定关系信息即可。
在一些实施例中，在步骤S710之后，还可以包括步骤S720。在步骤S720，服务端设备存储该绑定关系信息。
在一些实施例中，该绑定关系信息可以存储(保存)在服务端设备的功能集群中，例如，存储在服务端设备的第一功能集群中。本申请实施例对第一功能集群不做具体限定，例如，第一功能集群可以是现有的功能集群，在现有的某个功能集群中增加一个属性，增加的该属性用于记录代理设备和客户端设备的绑定关系信息。作为一个具体示例，可以在有效代理列表属性所在的功能集群中增加一个新的属性，该新的属性用于记录代理设备和客户端设备的绑定关系信息。或者，第一功能集群可以是新增的一个功能集群，比如可以新增一个专用的功能集群，用于专门记录代理设备和客户端设备的绑定关系。
本申请实施例对第一功能集群的名称不做限定，示例性地，第一功能集群可以称为proxyobserveACL功能集群，proxyobserveACL功能集群可以是新增的功能集群的名称，也可以是对现有的功能集群进行修改后重新定义的名称。
在一些实施例中，第一功能集群包括第一属性，第一属性用于记录绑定关系信息(即，记录代理设备和客户端设备之间的绑定关系)。
在一些实施例中，该绑定关系信息可以利用代理设备的设备标识和客户端设备的设备标识来指示代理设备和客户端设备之间的绑定关系。作为一种实现方式，第一属性中可以记录代理设备的设备标识与客户端设备的设备标识，以表示该代理设备与该客户端设备之间存在绑定关系(该代理设备可以为该客户端设备进行代理订阅)。
在一些实施例中，代理设备的设备标识可以是指代理设备的设备ID。在一些实施例中，代理设备的设备标识可以是指代理设备的指示信息，该指示信息用于指示代理设备的身份信息，即代理设备的设备标识可以用于获取代理设备的设备ID。
在一些实施例中，客户端设备的设备标识可以是指客户端设备的设备ID。在一些实施例中，客户端设备的设备标识可以是客户端设备的指示信息，该指示信息用于指示客户端设备的身份信息，即客户端设备的设备标识可以用于获取客户端设备的设备ID。在一些实施例中，客户端设备的设备标识可以是指客户端设备对应的第一标识，该第一标识为一组具有相同权限的客户端设备共享的标识。例如，第 一标识可以是CAT。
需要说明的是，一个客户端设备可以对应多个CATs，第一标识可以是多个CATs中的任意一个或多个。
作为一个示例，代理设备的设备标识可以是代理设备的设备ID，客户端设备的设备标识可以是客户端设备的设备ID，这种方式实现简单明了，便于控制。
作为另一个示例，代理设备的设备标识可以是代理设备的设备ID，客户端设备的设备标识可以是客户端设备对应的一个或多个CATs。
在一些实施例中，第一属性中记录的绑定关系信息中，一个代理设备可以对应一个或多个客户端设备，以表示该代理设备与一个或多个客户端设备之间存在绑定关系。
在一些实施例中，绑定关系信息为非易失性数据。在一些实施例中，绑定关系信息在服务端设备重新启动时保持不变。
作为一种实现方式，表5给出了第一属性的一种实现方式。
表5
Figure PCTCN2022131991-appb-000004
在表5的示例中，第一属性为obsrelationship。第一属性的类型为列表类型的结构体，该列表可以用于记录代理设备和客户端设备之间的绑定关系，例如，通过代理设备的设备标识和客户端设备的设备标识(比如，客户端设备对应的subjects)来标识其之间的绑定关系。作为一个示例，可以通过代理设备的设备ID和客户端设备的设备ID标识其之间的绑定关系。作为另一个示例，可以通过代理设备的设备ID和客户端设备对应的CATs标识其之间的绑定关系。在第一属性中，一个代理设备可以对应一个或多个客户端设备。在第一属性中，该第一属性对应的质量为“N”，表示该属性数据值为非易失性的，并且在重新启动时保持不变。
在一些实施例中，该列表中的clientsubjectID可以是设备ID(设备的节点ID)，也可以是CATs。在一些实施例中，CATs可以是多个，也就是说，一个客户端设备可以对应多个CATs。
在一些实施例中，设备的节点ID和CAT的数据类型可以是相同的，不过取值范围不同。这种情况下，根据取值范围可以判定该取值代表的是设备的节点ID还是CAT。
在一些实施例中，如果该绑定关系信息是代理设备注册的，输入参数中的代理设备的设备标识可以省略。在一些实施例中，代理设备的设备标识省略的情况下可以认为，该设备标识为消息包头中的发起者对应的设备标识。
在一些实施例中，第一功能集群中还可以包含一些代理设备获取和订阅访问控制信息的命令。也就是说，代理设备获取和订阅访问控制信息的命令可以和记录绑定关系信息的属性在同一个功能集群中。不过本申请实施例并不限定于此，代理设备获取和订阅访问控制信息的命令可以和记录绑定关系信息的属性在不同的功能集群中。
基于此，代理设备和客户端设备的绑定关系可以记录在服务端设备的功能集群中，以便服务端设备根据该绑定关系信息控制代理设备能够获取的访问控制信息。
在一些实施例中，每当某个客户端设备选择了具体的代理设备以订阅服务端设备的目标资源时，该绑定关系信息的建立过程便可以发生，例如，在某个客户端设备选择了代理设备之后(客户端设备和代理设备建立连接之前或建立连接之后都可以)，客户端设备便可以向服务端设备发起注册请求，以注册其与选择的代理设备之间的绑定关系信息。或者，在某个客户端设备选择了代理设备之后，代理设备便可以向服务端设备发起注册请求，以注册其与某个客户端设备之间的绑定关系信息。
前文介绍了绑定关系信息的建立过程，下面对代理订阅过程中，如何利用绑定关系信息控制代理设备能够获取的访问控制信息进行介绍。
在一些实施例中，服务端设备根据绑定关系信息控制代理设备能够获取的访问控制信息是基于代理设备的请求进行的。
图8为本申请另一实施例提供的用于访问控制的方法的流程示意图。如图8所示，该方法可以包括步骤S810和步骤S820。下面对这些步骤进行介绍。
在步骤S810，代理设备向服务端设备发送第一请求。该第一请求用于查询客户端设备是否具有服务端设备的目标资源的访问权限。
在一些实施例中，第一请求可以是读取请求，即代理设备可以向服务端设备发送读取请求消息，以读取客户端设备对该目标资源的访问控制信息，从而确定客户端设备是否具有访问该目标资源的权限。
在一些实施例中，代理设备可以使用服务端设备提供的读取命令接口来获取客户端设备对目标资源的访问控制信息。
在一些实施例中，可以使用现有的读取命令接口来获取客户端设备对目标资源的访问控制信息，服务端设备接收到该命令后，可以根据绑定关系信息确定代理设备是否有权限获取该客户端设备对目标资源的访问控制信息。在代理设备有权限获取该客户端设备对目标资源的访问控制信息的情况下，服务端设备可以向代理设备返回对应的响应消息。
在一些实施例中，可以使用新的命令接口来获取客户端设备对目标资源的访问控制信息。该新的命令接口可以用于获取和客户端设备关联的ACE信息。
作为一个示例，代理设备可以使用getACE命令来请求获取对应的访问控制信息(比如，ACE信息)，该getACE命令能够获取和getACE的输入参数中的客户端设备的设备标识关联的ACE信息。为了便于理解，表6给出了getACE命令的一种实现方式。
表6
Figure PCTCN2022131991-appb-000005
需要说明的是，本申请实施例对获取客户端设备对目标资源的访问控制信息的读取命令的名称不做具体限定，getACE命令仅为一个示例，只要能够通过该读取命令获取与客户端设备关联的访问控制信息(例如，ACE信息)即可。
在一些实施例中，getACE命令可以和第一属性共同位于第一功能集群中。在一些实施例中，getACE也可以位于其他功能集群中，本申请实施例对此并不限定。
在一些实施例中，针对getACE的应答方式可以包括多种，例如，可以返回对应的ACE，由代理设备自行判定客户端设备是否有权限访问目标资源；或者，可以直接返回是否有权限访问目标资源的指示信息(比如，可以返回“是”以指示有权限访问目标资源，或者，可以返回“否”以指示没有权限访问目标资源)等。
在一些实施例中，第一请求可以是订阅请求，即代理设备可以向服务端设备发送订阅请求消息，以请求订阅客户端设备对该目标资源的访问控制信息，从而确定客户端设备是否具有访问该目标资源的权限。
在一些实施例中，代理设备可以使用服务端设备提供的订阅命令接口来获取客户端设备对目标资源的访问控制信息。例如，代理设备可以使用现有的订阅命令接口来获取客户端设备对目标资源的访问控制信息。或者，代理设备可以使用新的订阅命令接口来获取客户端设备对目标资源的访问控制信息，比如可以使用后文提及的第一命令来获取客户端设备对目标资源的访问控制信息。
在步骤S820，服务端设备根据绑定关系信息，向代理设备发送第一响应。
在一些实施例中，第一响应可以包含客户端设备对目标资源的访问控制信息。例如，第一响应可以包含对应的ACE信息，由代理设备根据服务端设备返回的ACE信息自行判定客户端设备是否有权限订阅目标资源。
在一些实施例中，第一响应可以用于指示客户端设备是否具有目标资源的访问权限。例如，第一响应可以通过返回“是”或“否”的指示信息，以直接指示客户端设备是否有权限订阅目标资源。
作为一个示例，当第一请求为读取请求(例如，getACE请求命令)时，第一响应可以返回对应的ACE信息，或者第一响应可以返回客户端设备是否有权限访问目标资源的指示信息。
作为另一个示例，当第一请求为订阅请求时，第一响应可以返回对应的ACE信息。
需要说明的是，不管在步骤S810采用现有的命令接口(即，采用现有的读取操作或订阅操作)，还是采用新增的命令接口，本申请实施例的核心在于，服务端设备在代理设备读取过程或订阅过程中需要检查代理设备和客户端设备的绑定关系信息，以确定代理设备是否具有读取权限或订阅权限。
在一些实施例中，如果代理设备订阅了服务端设备的访问控制信息(例如，代理设备订阅了服务端设备的ACL功能集群)，服务端设备可以根据绑定关系信息，向代理设备发送客户端设备的变化后的访问控制信息，下面结合图9对此进行详细介绍。
图9为本申请又一实施例提供的用于访问控制的方法的流程示意图。如图9所示，该方法可以包括步骤S910至步骤S930。
在步骤S910，代理设备请求订阅客户端设备对应的访问控制信息。
在一些实施例中，代理设备可以利用前文提及的第一请求来请求订阅客户端设备对应的访问控制信息。例如，利用现有的订阅请求来请求订阅客户端设备对应的访问控制信息。
在步骤S920，服务端设备根据绑定关系信息，确定代理设备是否有权限订阅客户端设备对应的访问控制信息。
在一些实施例中，在代理设备和客户端设备具有绑定关系的情况下，服务端设备可以授权代理设备订阅该客户端设备对应的访问控制信息，例如，可以向代理设备返回该订阅请求对应的访问控制信息。
在一些实施例中，在代理设备和客户端设备没有绑定关系的情况下，服务端设备可以拒绝代理设备的订阅请求，例如，可以向代理设备返回订阅无效的指示信息。
在步骤S930，在代理设备有权限订阅客户端设备对应的访问控制信息的情况下，服务端设备根据绑定关系信息，向代理设备发送客户端设备的变化后的访问控制信息。
也就是说，服务端设备可以根据绑定关系信息确定是否向代理设备发送客户端设备的变化后的访问控制信息。或者说，在一些实施例中，服务端设备可以根据绑定关系信息和订阅信息共同确定是否向代理设备发送客户端设备的变化后的访问控制信息。
服务端设备根据绑定关系信息确定是否向代理设备发送客户端设备的变化后的访问控制信息，可以避免服务端设备在只要存在访问控制信息变化时便发送给代理设备导致的代理设备接收过多无关消息。或者说，可以限制因为ACE变化过多给代理设备发送过多无关消息。
在一些实施例中，在步骤S930之前，该方法还可以包括步骤S925。在步骤S925，代理设备向服务端设备发送第二请求，该第二请求用于请求服务端设备针对客户端设备对应的访问控制信息变化时生成通知消息。
在一些实施例中，第二请求可以用于指示仅第二请求关联的客户端设备对应的访问控制信息发生变化时才生成通知消息。
在一些实施例中，第二请求可以是通过新增的命令接口(第一命令)来发送的。下面对第一命令进行详细介绍。
第一命令的输入参数可以包括客户端设备的设备标识(例如，客户端设备的设备ID和/或客户端设备对应的CATs)，第一命令可以用于指示仅第一命令中关联的客户端设备对应的访问控制信息发生变化时才生成通知消息。
在一些实施例中，第一命令还可以用于订阅客户端设备对应的访问控制信息。也就是说，第一命令可以用于订阅客户端设备对应的访问控制信息，且在客户端设备对应的访问控制信息发生变化时才生成通知消息。
下面结合表7给出第一命令的一种实现方式，在表7的示例中，第一命令为ProxyObserveACEreq。不过本申请实施例对第一命令的名称并不做限定，ProxyObserveACEreq仅为一个示例，只要第一命令能够用于指示其关联的客户端设备对应的访问控制信息发生变化时才生成通知消息即可。
表7
Figure PCTCN2022131991-appb-000006
在一些实施例中，第一命令可以包含在服务端设备的第二功能集群中。在一些实施例中，第二功能集群可以和第一功能集群是同一个功能集群。在一些实施例中，第二功能集群和第一功能集群可以是不同的功能集群，本申请实施例对此并不限定。
在一些实施例中，第二功能集群还可以包括第二命令，第二命令可以用于生成第一命令的应答消息。在一些实施例中，第二命令可以包括第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。下面结合表8给出第二命令的一种实现方式，在表8的示例中，第二命令为ProxyObserveACEresp，changetype表示ACE的变化类型。不过本申请实施例对第二命令的名称并不做限定，ProxyObserveACEresp仅为一个示例。
表8
Figure PCTCN2022131991-appb-000007
在一些实施例中，ACE的变化类型可以包括增删改。作为一种实现方式，ACE的变化类型为删除时，服务端设备可以向代理设备发送第二命令对应的应答消息。作为另一种实现方式，ACE的变化类型为改变(比如，客户端设备对应的访问权限变小)时，服务端设备可以向代理设备发送第二命令对应的应答消息。
也就是说，步骤S930的信息可以是基于第二命令发送的。步骤S930中发送的变化后的访问控制 信息可以包括变化后的内容和变化类型。
在一些实施例中，访问控制信息的变化包括：客户端设备对目标资源的访问权限发生变化，例如，权限变小或者丧失(丢失)权限。
在一些实施例中，第一命令可以用于仅在客户端设备对目标资源的访问权限发生变化时生成通知消息。
需要说明的是，本申请实施例提及的客户端设备对应的访问权限变小是指，客户端设备对应的访问权限级别变低，例如，客户端设备对应的访问权限由manage变为operate，或者，客户端设备对应的访问权限由manage变为view等。
在一些实施例中，访问控制信息的变化不包括ACE内容的合并、消减等引发的资源变化。或者说，如果访问控制信息发生变化，但该变化并未导致客户端设备对目标资源的访问权限发生变化，这种情况下，服务端设备可以不向代理设备返回客户端的变化后的访问控制信息。
不过本申请实施例也不限定于此，在一些实施例中，访问控制信息的变化除了包括客户端设备对目标资源的访问权限发生变化，还可以包括其他的变化，例如，访问控制信息的内容发生变化等。
在一些实施例中，如果代理设备判定在订阅过程中，客户端设备丢失了对服务端设备的目标资源的订阅权限，则代理设备可以结束下行订阅关系(即，代理设备对客户端设备的代理订阅关系)。
在一些实施例中，当订阅的服务端设备上的目标资源发生变化的时候，服务端设备可以向代理设备发送状态上报消息，以便代理设备生成对应的状态上报消息发送给客户端设备。需要说明的是，在一些实施例中，代理设备在向客户端设备发送状态上报消息之前，还需要确认客户端设备是否依然有权限订阅服务端设备的目标资源，仅在客户端设备依然有权限订阅目标资源的情况下，代理设备才向客户端设备发送对应的状态上报消息。
如前文所述，在一些实施例中，代理设备是基于第一请求向服务端设备请求客户端设备对应的访问控制信息的。在一些实施例中，代理设备向服务端设备发送的第一请求是基于客户端设备向代理设备发送的订阅目标资源的请求进行的。换句话说，在一些实施例中，客户端设备可以向代理设备发送订阅服务端设备上的目标资源的请求消息，代理设备基于该订阅请求消息检查客户端设备是否具有目标资源的访问权限。下面结合图10对此进行介绍。
图10为本申请又一实施例提供的用于访问控制的方法的流程示意图。图10的方法可以包括步骤S1010至步骤S1050。
在步骤S1010，客户端设备向代理设备发送订阅目标资源的请求，该请求用于请求订阅服务端设备的目标资源。
在步骤S1020，代理设备向服务端设备发送第一请求，第一请求用于查询客户端设备是否具有目标资源的访问权限。
在步骤S1030，服务端设备根据绑定关系信息，向代理设备发送第一响应。
关于步骤S1020和步骤S1030的详细描述，可以参见前文对步骤S810和步骤S820的相关描述，此处不再赘述。
在步骤S1040，服务端设备向代理设备返回客户端设备对目标资源的访问控制信息后，代理设备完成对目标资源的订阅流程。
在步骤S1050，代理设备向客户端设备返回目标资源的订阅的相关信息。
在一些实施例中，服务端设备根据绑定关系信息，确定代理设备有权限获取该客户端设备对应的访问控制信息后，还需要查看代理设备是否存在访问服务端设备的ACL的proxyview权限。
也就是说，在一些实施例中，在代理设备具有proxyview权限的情况下，且与客户端设备具有绑定关系的情况下，服务端设备可以返回给代理设备该客户端设备对应的访问控制信息。
在一些实施例中，客户端设备向代理设备发送订阅请求消息之前，需要先进行代理设备的发现过程，以及与代理设备建立连接的过程。下面结合图11对该过程进行介绍。
图11为本申请实施例提供的代理设备发现和建立连接的过程的流程示意图。如图11所示，该方法可以包括步骤S1110至步骤S1140。
在步骤S1110，客户端设备获取服务端设备的有效代理列表。
客户端设备在直接订阅服务端设备的目标资源失败之后，服务端设备会提示客户端设备其需要去寻找代理设备来订阅目标资源。这种情况下，客户端设备可以向服务端设备发送消息以获取服务端设备的有效代理列表，即获取服务端设备支持的代理设备。
在步骤S1120，服务端设备向客户端设备返回服务端设备支持的有效代理列表。
在步骤S1130，客户端设备发现并选择代理设备。
在步骤S1140，客户端设备与代理设备建立CASE连接。
客户端设备发现并选择代理设备之后，两者可以建立安全通道，例如，通过CASE连接建立安全通道。
在一些实施例中，在客户端设备和代理设备建立安全通道的过程中或建立安全通道之后，代理设备可以获取客户端设备的设备标识(例如，客户端设备的设备ID和/或客户端设备对应的CATs)。
关于客户端设备对代理设备的发现过程，以及与代理设备建立连接的过程的详细内容可以参见现有技术，本申请不再赘述。
在一些实施例中，在客户端设备发现并选择代理设备之后(例如，在两者建立连接前或建立连接后)，客户端设备或者代理设备可以注册绑定关系信息。关于注册绑定关系信息的内容可以参见前文的描述，此处不再赘述。
在一些实施例中，代理设备与客户端设备建立连接之后，代理设备可以保存客户端设备的设备标识(比如客户端设备的设备ID和/或客户端设备对应的CATs)，以便于后续注册绑定关系信息。
在一些实施例中，客户端设备和代理设备建立连接后，客户端设备可以向代理设备发送订阅请求，后续的订阅流程可以参见前文的描述，此处不再赘述。
为了便于理解，下文结合图12至图14，以基于Matter协议通信场景为例介绍本申请实施例的方法流程。需要说明的是，该方法流程仅为示意性流程，并不用于对本申请实施例造成限定。还需要说明的是，本申请实施例对图12至图14所示的方法的步骤的执行顺序不做具体限定，例如，有些步骤的顺序可以调换，或者，有些步骤可以同时执行。另外，图12至图14所示的方法中涉及的功能集群在上文中详细介绍，为了简洁，下文不再赘述。
图12是本申请又一实施例提供的用于访问控制的方法的流程示意图。图12所示的方法包括步骤S1201至步骤S1214。
在步骤S1201，客户端设备请求获取有效代理列表。
客户端设备在直接订阅服务端设备的目标资源失败之后，服务端设备会提示客户端设备其需要去寻找代理设备来订阅目标资源。因此，客户端设备会向服务端设备发起请求以获取有效代理列表，以得知服务端设备支持的代理设备包括哪些。
在步骤S1202，服务端设备注册客户端设备的信息为可查询ACL状态。
服务端设备收到步骤S1201的请求后，可以做个预注册，保存好客户端设备的信息(比如，客户端设备的节点ID和/或客户端设备对应的CATs)。
在一些实施例中，步骤S1202可以合并到后文提及的步骤S1207中一起处理。
在步骤S1203，服务端设备向客户端设备返回步骤S1201对应的有效代理列表。
在步骤S1204，客户端设备发现并选择到代理设备。
在步骤S1205，客户端设备和代理设备建立安全通道。
在客户端设备和代理设备建立安全通道的过程中或者建立安全通道之后，代理设备可以获取客户端设备的设备ID和/或客户端设备对应的CATs。
在步骤S1206，代理设备保存客户端设备的设备ID和/或客户端设备对应的CATs。
在步骤S1207，在客户端设备选择了代理设备之后(在与代理设备建立连接之前或之后)，客户端设备可以与服务端设备建立连接，并设定代理设备和客户端设备之间的绑定关系信息。
在一些实施例中，该绑定关系信息可以保存在proxyobserveACL功能集群中。
在一些实施例中，proxyobserveACL功能集群中包含了一些代理设备获取和订阅访问控制信息(如ACE)的方法，以及代理设备和客户端设备的绑定关系信息。在一些实施例中，代理设备和客户端设备的绑定关系其实是代理设备和客户端设备在ACL功能集群中的subjects角色的绑定关系。作为一个示例，最简单的情况下是代理设备的设备ID和客户端设备的设备ID的绑定关系。
需要说明的是，步骤S1207可以使用前文提及的RegisterProxyNode命令来注册绑定关系信息。
在步骤S1208，客户端设备向代理设备发送订阅服务端设备上的目标资源的请求消息。
在步骤S1209，代理设备向服务端设备发送第一请求去获取对应的访问控制信息。
在一些实施例中，代理设备可以使用getACE命令请求获取对应的访问控制信息。这里需要说明的是，该步骤获取的访问控制信息可以是仅和该客户端设备相关的访问控制信息，这与既有的获取访问控制信息的方法是有区别的。
在步骤S1210，服务端设备查看是否存在代理设备和客户端设备的绑定关系。
在一些实施例中，服务端设备可以在第一属性(如obsrelationship属性)中查看是否存在代理设备和客户端设备(比如，代理设备的设备ID和客户端设备的subjects)的绑定关系。
在一些实施例中，仅在代理设备和客户端设备之间存在绑定关系的情况下，服务端设备才可以为代理设备返回对应的访问控制信息。
在步骤S1211，服务端设备查看代理设备是否存在访问访问控制信息的proxyview权限。
在步骤S1212，在代理设备和客户端设备存在绑定关系且代理设备存在访问访问控制信息的proxyview权限的情况下，服务端设备向代理设备返回客户端设备对应的访问控制信息。
在步骤S1213-步骤S1214，完成后续的订阅流程。
图13是本申请又一实施例提供的用于访问控制的方法的流程示意图。图13所示的方法包括步骤S1301至步骤S1314。需要说明的是，图12和图13所示的方法主要是防止代理设备有过大的获取访问控制信息的权限。还需要说明的是，图13所示的方法与图12所示的方法的主要区别是，图13所示的方法是由代理设备来注册代理设备和客户端设备的绑定关系信息，而图12所示的方法是由客户端设备来注册代理设备和客户端设备的绑定关系信息。
在步骤S1301，客户端设备请求获取有效代理列表。
客户端设备在直接订阅服务端设备的目标资源失败之后，服务端设备会提示客户端设备其需要去寻找代理设备来订阅目标资源。因此，客户端设备会向服务端设备发起请求以获取有效代理列表，以得知服务端设备支持的代理设备包括哪些。
在步骤S1302，服务端设备注册客户端设备的信息为可查询ACL状态。
服务端设备收到步骤S1301的请求后，可以做个预注册，保存好客户端设备的信息(比如，客户端设备的节点ID和/或客户端设备对应的CATs)。
在一些实施例中，步骤S1302可以合并到后文提及的步骤S1307中一起处理。
在步骤S1303，服务端设备向客户端设备返回步骤S1301对应的有效代理列表。
在步骤S1304，客户端设备发现并选择到代理设备。
在步骤S1305，客户端设备和代理设备建立安全通道。
在客户端设备和代理设备建立安全通道的过程中或者建立安全通道之后，代理设备可以获取客户端设备的设备ID和/或客户端设备对应的CATs。
在步骤S1306，代理设备保存客户端设备的设备ID和/或客户端设备对应的CATs。
在步骤S1307，在客户端设备选择了代理设备之后(在与代理设备建立连接之前或之后)，代理设备可以与服务端设备建立连接，并设定代理设备和客户端设备之间的绑定关系信息。
在一些实施例中，该绑定关系信息可以保存在proxyobserveACL功能集群中。
在一些实施例中，proxyobserveACL功能集群中包含了一些代理设备获取和订阅访问控制信息(如ACE)的方法，以及代理设备和客户端设备的绑定关系信息。在一些实施例中，代理设备和客户端设备的绑定关系其实是代理设备和客户端设备在ACL功能集群中的subjects角色的绑定关系。作为一个示例，最简单的情况下是代理设备的设备ID和客户端设备的设备ID的绑定关系。
需要说明的是，步骤S1307可以使用前文提及的RegisterProxyNode命令来注册绑定关系信息。需要说明的是，步骤S1307使用RegisterProxyNode命令来注册绑定关系信息时，输入参数中的代理设备的设备标识可以省略，即代理设备的设备标识是可选的。
在步骤S1308，客户端设备向代理设备发送订阅服务端设备上的目标资源的请求消息。
在步骤S1309，代理设备向服务端设备发送第一请求去获取对应的访问控制信息。
在一些实施例中，代理设备可以使用getACE命令请求获取对应的访问控制信息。这里需要说明的是，该步骤获取的访问控制信息可以是仅和该客户端设备相关的访问控制信息，这与既有的获取访问控制信息的方法是有区别的。
在步骤S1310，服务端设备查看是否存在代理设备和客户端设备的绑定关系。
在一些实施例中，服务端设备可以在第一属性(如obsrelationship属性)中查看是否存在代理设备和客户端设备(比如，代理设备的设备ID和客户端设备的subjects)的绑定关系。
在一些实施例中，仅在代理设备和客户端设备之间存在绑定关系的情况下，服务端设备才可以为代理设备返回对应的访问控制信息。
在步骤S1311，服务端设备查看代理设备是否存在访问访问控制信息的proxyview权限。
在步骤S1312，在代理设备和客户端设备存在绑定关系且代理设备存在访问访问控制信息的proxyview权限的情况下，服务端设备向代理设备返回客户端设备对应的访问控制信息。
在步骤S1313-步骤S1314，完成后续的订阅流程。
图14为本申请又一实施例提供的用于访问控制的方法的流程示意图。图14所示的方法包括步骤S1401至步骤S1409。需要说明的是，图14所示的方案主要是限制因为访问控制信息变化太多，给代理设备发送过多无关消息。
在步骤S1401，代理设备订阅客户端设备对应的访问控制信息。
在一些实施例中，代理设备可以使用前文的第一命令来订阅客户端设备对应的访问控制信息。
在步骤S1402，服务端设备完成订阅登记，并根据绑定关系信息确定代理设备是否有权限订阅访问控制信息。
如前文所述，代理设备可以主动获取或订阅服务端设备上面的访问控制信息(比如，ACL功能集群资源)，该主动获取或订阅访问控制信息的过程是受代理设备和客户端设备的绑定关系信息的限制的。也就是说，服务端设备为代理设备返回的访问控制信息仅是与代理设备代理订阅的客户端设备相关的访问控制信息。
在步骤S1403，服务端设备向代理设备返回请求应答消息。
在步骤S1404，如果客户端设备对应的访问控制信息发生变化则通知代理设备，以便代理设备确定是否要继续维护与客户端设备的订阅关系。
在一些实施例中，步骤S1404可以复用现有的ReportData消息。在一些实施例中，步骤S1404可以新制定订阅的ReportData消息。需要说明的是，不管是复用现有的ReportData消息还是新制定订阅的ReportData消息，服务端设备仅向代理设备反馈确实权限发生变化的内容。例如，服务端设备仅向代理设备反馈与代理设备具有绑定关系的客户端设备对应的访问权限信息，或者，服务端设备仅在客户端设备的权限发生变化(比如，权限变小或权限丢失)时向代理设备进行反馈。
在步骤S1405，代理设备确定如果客户端设备的权限丢失，则结束下行订阅关系。
代理设备如果确定在订阅过程中客户端设备丢失了对服务端设备上的目标资源的订阅权限，则代理设备需要结束下行订阅关系(即，代理设备对客户端设备的代理订阅关系)。
在步骤S1406，客户端设备订阅的目标资源发生变化时，服务端设备向代理设备发送通知消息。
在步骤S1407，代理设备根据服务端设备在步骤S1406发送的订阅资源发生变化的通知消息，生成ReportData消息，以便向客户端设备发送该ReportData消息。
在步骤S1408，代理设备确定是否检查客户端设备对应的访问控制信息，以确定客户端设备是否依然有权限订阅目标资源。需要说明的是，步骤S1408为可选步骤。
在步骤S1409，代理设备向客户端设备发送ReportData消息，以指示客户端设备订阅的目标资源发生变化。
上文结合图1至图14，详细描述了本申请的方法实施例，下面结合图15至图18，详细描述本申请的装置实施例。应理解，方法实施例的描述与装置实施例的描述相互对应，因此，未详细描述的部分可以参见前面方法实施例。
图15为本申请实施例提供的服务端设备的结构示意图。图15所示的服务端设备可以执行前文所述的任一服务端设备能够执行的方法。图15所示的服务端设备1500可以包括控制模块1510。
控制模块1510可以用于根据绑定关系信息，控制代理设备能够获取的访问控制信息，其中，所述绑定关系信息用于指示所述代理设备和客户端设备之间具有绑定关系。
可选地，服务端设备1500还包括：第一接收模块1520。第一接收模块1520可以用于接收注册请求，所述注册请求用于注册所述绑定关系信息。
可选地，所述注册请求是所述代理设备发送的，或者，所述注册请求是所述客户端设备发送的。
可选地，服务端设备1500还包括：第二接收模块，用于接收所述代理设备发送的第一请求，所述第一请求用于查询所述客户端设备是否具有所述服务端设备的目标资源的访问权限。
可选地，控制模块1510进一步用于：根据所述绑定关系信息，向所述代理设备发送第一响应；其中，所述第一响应包含所述客户端设备对所述目标资源的访问控制信息，或者，所述第一响应用于指示所述客户端设备是否具有所述目标资源的访问权限。
可选地，控制模块1510进一步用于：根据所述绑定关系信息，向所述代理设备发送所述客户端设备的变化后的访问控制信息。
可选地，所述访问控制信息的变化包括：所述客户端设备对所述服务端设备的目标资源的访问权限发生变化。
可选地，服务端设备1500还包括：第三接收模块，用于接收所述代理设备发送的第二请求，所述第二请求用于请求所述服务端设备针对所述客户端设备对应的访问控制信息变化时生成通知消息。
可选地，所述绑定关系信息记录在第一功能集群中，所述第一功能集群包括第一属性，所述第一属性记录有所述代理设备的设备标识与所述客户端设备的设备标识。
可选地，所述客户端设备的设备标识包括：所述客户端设备的设备ID，和/或，所述客户端设备对应的第一标识，所述第一标识为一组具有相同权限的客户端设备共享的标识。
可选地，所述服务端设备包括第二功能集群，所述第二功能集群包括第一命令，所述第一命令用于指示所述服务端设备针对所述第一命令关联的客户端设备对应的访问控制信息变化时生成通知消息。
可选地，所述第二功能集群还包括第二命令，所述第二命令用于生成所述第一命令的应答消息，所 述第二命令包括所述第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。
可选地，所述访问控制信息记录在所述服务端设备的访问控制列表ACL中。
可选地，控制模块1510可以为处理器1810，第一接收模块1520可以为收发器1830。服务端设备还可以包括存储器1820，具体如图18所示。
图16为本申请实施例提供的代理设备的结构示意图。图16所示的代理设备可以执行前文所述的任一代理设备能够执行的方法。图16所示的代理设备1600可以包括第一发送模块1610和第一接收模块1620。
第一发送模块1610可以用于向服务端设备发送第一请求，所述第一请求用于查询客户端设备是否具有所述服务端设备的目标资源的访问权限。
第一接收模块1620可以用于响应于绑定关系信息，接收所述服务端设备发送的第一响应；其中，所述绑定关系信息用于指示所述代理设备和所述客户端设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
可选地，代理设备1600还包括：第二发送模块，用于向所述服务端设备发送注册请求，所述注册请求用于注册所述绑定关系信息。
可选地，所述第一响应包含所述客户端设备对所述目标资源的访问控制信息，或者，所述第一响应用于指示所述客户端设备是否具有所述目标资源的访问权限。
可选地，代理设备1600还包括：第二接收模块，用于响应于所述绑定关系信息，接收所述服务端设备发送的所述客户端设备的变化后的访问控制信息。
可选地，所述访问控制信息的变化包括：所述客户端设备对所述目标资源的访问权限发生变化。
可选地，代理设备1600还包括：第三发送模块，用于向所述服务端设备发送第二请求，所述第二请求用于请求所述服务端设备针对所述客户端设备对应的访问控制信息变化时生成通知消息。
可选地，所述绑定关系信息记录在第一功能集群中，所述第一功能集群包括第一属性，所述第一属性记录有所述代理设备的设备标识与所述客户端设备的设备标识。
可选地，所述客户端设备的设备标识包括：所述客户端设备的设备ID，和/或，所述客户端设备对应的第一标识，所述第一标识为一组具有相同权限的客户端设备共享的标识。
可选地，所述服务端设备包括第二功能集群，所述第二功能集群包括第一命令，所述第一命令用于指示所述服务端设备针对所述第一命令关联的客户端设备对应的访问控制信息变化时生成通知消息。
可选地，所述第二功能集群还包括第二命令，所述第二命令用于生成所述第一命令的应答消息，所述第二命令包括所述第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。
可选地，所述访问控制信息记录在所述服务端设备的访问控制列表ACL中。
可选地，第一发送模块1610和第一接收模块1620可以为收发器1830。代理设备还可以包括处理器1810和存储器1820，具体如图18所示。
图17为本申请实施例提供的客户端设备的结构示意图。图17所示的客户端设备可以执行前文所述的任一客户端设备能够执行的方法。图17所示的客户端设备1700可以包括发送模块1710。
发送模块1710可以用于向服务端设备发送绑定关系信息，所述绑定关系信息用于指示所述客户端设备和代理设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
可选地，所述绑定关系信息记录在第一功能集群中，所述第一功能集群包括第一属性，所述第一属性记录有所述代理设备的设备标识与所述客户端设备的设备标识。
可选地，所述客户端设备的设备标识包括：所述客户端设备的设备ID，和/或，所述客户端设备对应的第一标识，所述第一标识为一组具有相同权限的客户端设备共享的标识。
可选地，所述服务端设备包括第二功能集群，所述第二功能集群包括第一命令，所述第一命令用于指示所述服务端设备针对所述第一命令关联的客户端设备对应的访问控制信息变化时生成通知消息。
可选地，所述访问控制信息的变化包括：所述客户端设备对所述服务端设备的目标资源的访问权限发生变化。
可选地，所述第二功能集群还包括第二命令，所述第二命令用于生成所述第一命令的应答消息，所述第二命令包括所述第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。
可选地，所述访问控制信息记录在所述服务端设备的访问控制列表ACL中。
可选地，发送模块1710可以为收发器1830。客户端设备还可以包括处理器1810和存储器1820，具体如图18所示。
图18是本申请实施例的通信装置的示意性结构图。图18中的虚线表示该单元或模块为可选的。该装置1800可用于实现上述方法实施例中描述的方法。装置1800可以是芯片、终端设备或网络设备。
装置1800可以包括一个或多个处理器1810。该处理器1810可支持装置1800实现前文方法实施例所描述的方法。该处理器1810可以是通用处理器或者专用处理器。例如，该处理器可以为中央处理单元(central processing unit，CPU)。或者，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
装置1800还可以包括一个或多个存储器1820。存储器1820上存储有程序，该程序可以被处理器1810执行，使得处理器1810执行前文方法实施例所描述的方法。存储器1820可以独立于处理器1810也可以集成在处理器1810中。
装置1800还可以包括收发器1830。处理器1810可以通过收发器1830与其他设备或芯片进行通信。例如，处理器1810可以通过收发器1830与其他设备或芯片进行数据收发。
本申请实施例还提供一种计算机可读存储介质，用于存储程序。该计算机可读存储介质可应用于本申请实施例提供的终端或网络设备中，并且该程序使得计算机执行本申请各个实施例中的由终端或网络设备执行的方法。
本申请实施例还提供一种计算机程序产品。该计算机程序产品包括程序。该计算机程序产品可应用于本申请实施例提供的终端或网络设备中，并且该程序使得计算机执行本申请各个实施例中的由终端或网络设备执行的方法。
本申请实施例还提供一种计算机程序。该计算机程序可应用于本申请实施例提供的终端或网络设备中，并且该计算机程序使得计算机执行本申请各个实施例中的由终端或网络设备执行的方法。
应理解，本申请中术语“系统”和“网络”可以被可互换使用。另外，本申请使用的术语仅用于对本申请的具体实施例进行解释，而非旨在限定本申请。本申请的说明书和权利要求书及所述附图中的术语“第一”、“第二”、“第三”和“第四”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。
在本申请的实施例中，提到的“指示”可以是直接指示，也可以是间接指示，还可以是表示具有关联关系。举例说明，A指示B，可以表示A直接指示B，例如B可以通过A获取；也可以表示A间接指示B，例如A指示C，B可以通过C获取；还可以表示A和B之间具有关联关系。
在本申请实施例中，“与A相应的B”表示B与A相关联，根据A可以确定B。但还应理解，根据A确定B并不意味着仅仅根据A确定B，还可以根据A和/或其它信息确定B。
在本申请实施例中，术语“对应”可表示两者之间具有直接对应或间接对应的关系，也可以表示两者之间具有关联关系，也可以是指示与被指示、配置与被配置等关系。
本申请实施例中，“预定义”或“预配置”可以通过在设备(例如，包括终端设备和网络设备)中预先保存相应的代码、表格或其他可用于指示相关信息的方式来实现，本申请对于其具体的实现方式不做限定。比如预定义可以是指协议中定义的。
本申请实施例中，所述“协议”可以指通信领域的标准协议，例如可以包括LTE协议、NR协议以及应用于未来的通信系统中的相关协议，本申请对此不做限定。
本申请实施例中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指 令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够读取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(digital video disc，DVD))或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (70)

  1. 一种用于访问控制的方法，其特征在于，包括：
    服务端设备根据绑定关系信息，控制代理设备能够获取的访问控制信息，其中，所述绑定关系信息用于指示所述代理设备和客户端设备之间具有绑定关系。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述服务端设备接收注册请求，所述注册请求用于注册所述绑定关系信息。
  3. 根据权利要求2所述的方法，其特征在于，所述注册请求是所述代理设备发送的，或者，所述注册请求是所述客户端设备发送的。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，在所述服务端设备根据绑定关系信息，控制代理设备能够获取的访问控制信息之前，所述方法还包括：
    所述服务端设备接收所述代理设备发送的第一请求，所述第一请求用于查询所述客户端设备是否具有所述服务端设备的目标资源的访问权限。
  5. 根据权利要求4所述的方法，其特征在于，所述服务端设备根据绑定关系信息，控制代理设备能够获取的访问控制信息，包括：
    所述服务端设备根据所述绑定关系信息，向所述代理设备发送第一响应；
    其中，所述第一响应包含所述客户端设备对所述目标资源的访问控制信息，或者，所述第一响应用于指示所述客户端设备是否具有所述目标资源的访问权限。
  6. 根据权利要求1-4中任一项所述的方法，其特征在于，所述服务端设备根据绑定关系信息，控制代理设备能够获取的访问控制信息，包括：
    所述服务端设备根据所述绑定关系信息，向所述代理设备发送所述客户端设备的变化后的访问控制信息。
  7. 根据权利要求6所述的方法，其特征在于，所述访问控制信息的变化包括：所述客户端设备对所述服务端设备的目标资源的访问权限发生变化。
  8. 根据权利要求6或7所述的方法，其特征在于，在所述服务端设备根据绑定关系信息，向所述代理设备发送所述客户端设备的变化后的访问控制信息之前，所述方法还包括：
    所述服务端设备接收所述代理设备发送的第二请求，所述第二请求用于请求所述服务端设备针对所述客户端设备对应的访问控制信息变化时生成通知消息。
  9. 根据权利要求1-8中任一项所述的方法，其特征在于，所述绑定关系信息记录在第一功能集群中，所述第一功能集群包括第一属性，所述第一属性记录有所述代理设备的设备标识与所述客户端设备的设备标识。
  10. 根据权利要求9所述的方法，其特征在于，所述客户端设备的设备标识包括：所述客户端设备的设备ID，和/或，所述客户端设备对应的第一标识，所述第一标识为一组具有相同权限的客户端设备共享的标识。
  11. 根据权利要求1-10中任一项所述的方法，其特征在于，所述服务端设备包括第二功能集群，所述第二功能集群包括第一命令，所述第一命令用于指示所述服务端设备针对所述第一命令关联的客户端设备对应的访问控制信息变化时生成通知消息。
  12. 根据权利要求11所述的方法，其特征在于，所述第二功能集群还包括第二命令，所述第二命令用于生成所述第一命令的应答消息，所述第二命令包括所述第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。
  13. 根据权利要求1-12中任一项所述的方法，其特征在于，所述访问控制信息记录在所述服务端设备的访问控制列表ACL中。
  14. 一种用于访问控制的方法，其特征在于，包括：
    代理设备向服务端设备发送第一请求，所述第一请求用于查询客户端设备是否具有所述服务端设备的目标资源的访问权限；
    响应于绑定关系信息，所述代理设备接收所述服务端设备发送的第一响应；
    其中，所述绑定关系信息用于指示所述代理设备和所述客户端设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    所述代理设备向所述服务端设备发送注册请求，所述注册请求用于注册所述绑定关系信息。
  16. 根据权利要求14或15所述的方法，其特征在于，所述第一响应包含所述客户端设备对所述目标资源的访问控制信息，或者，所述第一响应用于指示所述客户端设备是否具有所述目标资源的访问权 限。
  17. 根据权利要求14-16中任一项所述的方法，其特征在于，所述方法还包括：
    响应于所述绑定关系信息，所述代理设备接收所述服务端设备发送的所述客户端设备的变化后的访问控制信息。
  18. 根据权利要求17所述的方法，其特征在于，所述访问控制信息的变化包括：所述客户端设备对所述目标资源的访问权限发生变化。
  19. 根据权利要求17或18所述的方法，其特征在于，在所述响应于所述绑定关系信息，所述代理设备接收所述服务端设备发送的所述客户端设备的变化后的访问控制信息之前，所述方法还包括：
    所述代理设备向所述服务端设备发送第二请求，所述第二请求用于请求所述服务端设备针对所述客户端设备对应的访问控制信息变化时生成通知消息。
  20. 根据权利要求14-19中任一项所述的方法，其特征在于，所述绑定关系信息记录在第一功能集群中，所述第一功能集群包括第一属性，所述第一属性记录有所述代理设备的设备标识与所述客户端设备的设备标识。
  21. 根据权利要求20所述的方法，其特征在于，所述客户端设备的设备标识包括：所述客户端设备的设备ID，和/或，所述客户端设备对应的第一标识，所述第一标识为一组具有相同权限的客户端设备共享的标识。
  22. 根据权利要求14-21中任一项所述的方法，其特征在于，所述服务端设备包括第二功能集群，所述第二功能集群包括第一命令，所述第一命令用于指示所述服务端设备针对所述第一命令关联的客户端设备对应的访问控制信息变化时生成通知消息。
  23. 根据权利要求22所述的方法，其特征在于，所述第二功能集群还包括第二命令，所述第二命令用于生成所述第一命令的应答消息，所述第二命令包括所述第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。
  24. 根据权利要求14-23中任一项所述的方法，其特征在于，所述访问控制信息记录在所述服务端设备的访问控制列表ACL中。
  25. 一种用于访问控制的方法，其特征在于，包括：
    客户端设备向服务端设备发送绑定关系信息，所述绑定关系信息用于指示所述客户端设备和代理设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
  26. 根据权利要求25所述的方法，其特征在于，所述绑定关系信息记录在第一功能集群中，所述第一功能集群包括第一属性，所述第一属性记录有所述代理设备的设备标识与所述客户端设备的设备标识。
  27. 根据权利要求26所述的方法，其特征在于，所述客户端设备的设备标识包括：所述客户端设备的设备ID，和/或，所述客户端设备对应的第一标识，所述第一标识为一组具有相同权限的客户端设备共享的标识。
  28. 根据权利要求25-27中任一项所述的方法，其特征在于，所述服务端设备包括第二功能集群，所述第二功能集群包括第一命令，所述第一命令用于指示所述服务端设备针对所述第一命令关联的客户端设备对应的访问控制信息变化时生成通知消息。
  29. 根据权利要求28所述的方法，其特征在于，所述访问控制信息的变化包括：所述客户端设备对所述服务端设备的目标资源的访问权限发生变化。
  30. 根据权利要求28或29所述的方法，其特征在于，所述第二功能集群还包括第二命令，所述第二命令用于生成所述第一命令的应答消息，所述第二命令包括所述第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。
  31. 根据权利要求25-30中任一项所述的方法，其特征在于，所述访问控制信息记录在所述服务端设备的访问控制列表ACL中。
  32. 一种服务端设备，其特征在于，包括：
    控制模块，用于根据绑定关系信息，控制代理设备能够获取的访问控制信息，其中，所述绑定关系信息用于指示所述代理设备和客户端设备之间具有绑定关系。
  33. 根据权利要求32所述的服务端设备，其特征在于，所述服务端设备还包括：
    第一接收模块，用于接收注册请求，所述注册请求用于注册所述绑定关系信息。
  34. 根据权利要求33所述的服务端设备，其特征在于，所述注册请求是所述代理设备发送的，或者，所述注册请求是所述客户端设备发送的。
  35. 根据权利要求32-34中任一项所述的服务端设备，其特征在于，所述服务端设备还包括：
    第二接收模块，用于接收所述代理设备发送的第一请求，所述第一请求用于查询所述客户端设备是 否具有所述服务端设备的目标资源的访问权限。
  36. 根据权利要求35所述的服务端设备，其特征在于，所述控制模块进一步用于：
    根据所述绑定关系信息，向所述代理设备发送第一响应；
    其中，所述第一响应包含所述客户端设备对所述目标资源的访问控制信息，或者，所述第一响应用于指示所述客户端设备是否具有所述目标资源的访问权限。
  37. 根据权利要求32-35中任一项所述的服务端设备，其特征在于，所述控制模块进一步用于：
    根据所述绑定关系信息，向所述代理设备发送所述客户端设备的变化后的访问控制信息。
  38. 根据权利要求37所述的服务端设备，其特征在于，所述访问控制信息的变化包括：所述客户端设备对所述服务端设备的目标资源的访问权限发生变化。
  39. 根据权利要求37或38所述的服务端设备，其特征在于，所述服务端设备还包括：
    第三接收模块，用于接收所述代理设备发送的第二请求，所述第二请求用于请求所述服务端设备针对所述客户端设备对应的访问控制信息变化时生成通知消息。
  40. 根据权利要求32-39中任一项所述的服务端设备，其特征在于，所述绑定关系信息记录在第一功能集群中，所述第一功能集群包括第一属性，所述第一属性记录有所述代理设备的设备标识与所述客户端设备的设备标识。
  41. 根据权利要求40所述的服务端设备，其特征在于，所述客户端设备的设备标识包括：所述客户端设备的设备ID，和/或，所述客户端设备对应的第一标识，所述第一标识为一组具有相同权限的客户端设备共享的标识。
  42. 根据权利要求32-41中任一项所述的服务端设备，其特征在于，所述服务端设备包括第二功能集群，所述第二功能集群包括第一命令，所述第一命令用于指示所述服务端设备针对所述第一命令关联的客户端设备对应的访问控制信息变化时生成通知消息。
  43. 根据权利要求42所述的服务端设备，其特征在于，所述第二功能集群还包括第二命令，所述第二命令用于生成所述第一命令的应答消息，所述第二命令包括所述第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。
  44. 根据权利要求32-43中任一项所述的服务端设备，其特征在于，所述访问控制信息记录在所述服务端设备的访问控制列表ACL中。
  45. 一种代理设备，其特征在于，包括：
    第一发送模块，用于向服务端设备发送第一请求，所述第一请求用于查询客户端设备是否具有所述服务端设备的目标资源的访问权限；
    第一接收模块，用于响应于绑定关系信息，接收所述服务端设备发送的第一响应；
    其中，所述绑定关系信息用于指示所述代理设备和所述客户端设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
  46. 根据权利要求45所述的代理设备，其特征在于，所述代理设备还包括：
    第二发送模块，用于向所述服务端设备发送注册请求，所述注册请求用于注册所述绑定关系信息。
  47. 根据权利要求45或46所述的代理设备，其特征在于，所述第一响应包含所述客户端设备对所述目标资源的访问控制信息，或者，所述第一响应用于指示所述客户端设备是否具有所述目标资源的访问权限。
  48. 根据权利要求45-47中任一项所述的代理设备，其特征在于，所述代理设备还包括：
    第二接收模块，用于响应于所述绑定关系信息，接收所述服务端设备发送的所述客户端设备的变化后的访问控制信息。
  49. 根据权利要求48所述的代理设备，其特征在于，所述访问控制信息的变化包括：所述客户端设备对所述目标资源的访问权限发生变化。
  50. 根据权利要求48或49所述的代理设备，其特征在于，所述代理设备还包括：
    第三发送模块，用于向所述服务端设备发送第二请求，所述第二请求用于请求所述服务端设备针对所述客户端设备对应的访问控制信息变化时生成通知消息。
  51. 根据权利要求45-50中任一项所述的代理设备，其特征在于，所述绑定关系信息记录在第一功能集群中，所述第一功能集群包括第一属性，所述第一属性记录有所述代理设备的设备标识与所述客户端设备的设备标识。
  52. 根据权利要求51所述的代理设备，其特征在于，所述客户端设备的设备标识包括：所述客户端设备的设备ID，和/或，所述客户端设备对应的第一标识，所述第一标识为一组具有相同权限的客户端设备共享的标识。
  53. 根据权利要求45-52中任一项所述的代理设备，其特征在于，所述服务端设备包括第二功能集 群，所述第二功能集群包括第一命令，所述第一命令用于指示所述服务端设备针对所述第一命令关联的客户端设备对应的访问控制信息变化时生成通知消息。
  54. 根据权利要求53所述的代理设备，其特征在于，所述第二功能集群还包括第二命令，所述第二命令用于生成所述第一命令的应答消息，所述第二命令包括所述第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。
  55. 根据权利要求45-54中任一项所述的代理设备，其特征在于，所述访问控制信息记录在所述服务端设备的访问控制列表ACL中。
  56. 一种客户端设备，其特征在于，包括：
    发送模块，用于向服务端设备发送绑定关系信息，所述绑定关系信息用于指示所述客户端设备和代理设备之间具有绑定关系，所述绑定关系信息用于控制所述代理设备能够获取的访问控制信息。
  57. 根据权利要求56所述的客户端设备，其特征在于，所述绑定关系信息记录在第一功能集群中，所述第一功能集群包括第一属性，所述第一属性记录有所述代理设备的设备标识与所述客户端设备的设备标识。
  58. 根据权利要求57所述的客户端设备，其特征在于，所述客户端设备的设备标识包括：所述客户端设备的设备ID，和/或，所述客户端设备对应的第一标识，所述第一标识为一组具有相同权限的客户端设备共享的标识。
  59. 根据权利要求56-58中任一项所述的客户端设备，其特征在于，所述服务端设备包括第二功能集群，所述第二功能集群包括第一命令，所述第一命令用于指示所述服务端设备针对所述第一命令关联的客户端设备对应的访问控制信息变化时生成通知消息。
  60. 根据权利要求59所述的客户端设备，其特征在于，所述访问控制信息的变化包括：所述客户端设备对所述服务端设备的目标资源的访问权限发生变化。
  61. 根据权利要求59或60所述的客户端设备，其特征在于，所述第二功能集群还包括第二命令，所述第二命令用于生成所述第一命令的应答消息，所述第二命令包括所述第一命令关联的客户端设备对应的访问控制信息变化后的内容以及变化类型。
  62. 根据权利要求56-61中任一项所述的客户端设备，其特征在于，所述访问控制信息记录在所述服务端设备的访问控制列表ACL中。
  63. 一种服务端设备，其特征在于，包括存储器和处理器，所述存储器用于存储程序，所述处理器用于调用所述存储器中的程序，以使所述服务端设备执行如权利要求1-13中任一项所述的方法。
  64. 一种代理设备，其特征在于，包括存储器和处理器，所述存储器用于存储程序，所述处理器用于调用所述存储器中的程序，以使所述代理设备执行如权利要求14-24中任一项所述的方法。
  65. 一种客户端设备，其特征在于，包括存储器和处理器，所述存储器用于存储程序，所述处理器用于调用所述存储器中的程序，以使所述客户端设备执行如权利要求25-31中任一项所述的方法。
  66. 一种装置，其特征在于，包括处理器，用于从存储器中调用程序，以使所述装置执行如权利要求1-31中任一项所述的方法。
  67. 一种芯片，其特征在于，包括处理器，用于从存储器调用程序，使得安装有所述芯片的设备执行如权利要求1-31中任一项所述的方法。
  68. 一种计算机可读存储介质，其特征在于，其上存储有程序，所述程序使得计算机执行如权利要求1-31中任一项所述的方法。
  69. 一种计算机程序产品，其特征在于，包括程序，所述程序使得计算机执行如权利要求1-31中任一项所述的方法。
  70. 一种计算机程序，其特征在于，所述计算机程序使得计算机执行如权利要求1-31中任一项所述的方法。
PCT/CN2022/131991 2022-11-15 2022-11-15 用于访问控制的方法和装置 WO2024103257A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/131991 WO2024103257A1 (zh) 2022-11-15 2022-11-15 用于访问控制的方法和装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/131991 WO2024103257A1 (zh) 2022-11-15 2022-11-15 用于访问控制的方法和装置

Publications (1)

Publication Number Publication Date
WO2024103257A1 true WO2024103257A1 (zh) 2024-05-23

Family

ID=91083664

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/131991 WO2024103257A1 (zh) 2022-11-15 2022-11-15 用于访问控制的方法和装置

Country Status (1)

Country Link
WO (1) WO2024103257A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110417776A (zh) * 2019-07-29 2019-11-05 大唐高鸿信安（浙江）信息科技有限公司 一种身份认证方法及装置
CN111488595A (zh) * 2020-03-27 2020-08-04 腾讯科技（深圳）有限公司 用于实现权限控制的方法及相关设备
US20200403976A1 (en) * 2019-06-18 2020-12-24 Microsoft Technology Licensing, Llc Web server request identification
CN114021089A (zh) * 2021-09-29 2022-02-08 苏州浪潮智能科技有限公司 一种目录访问控制方法、装置、设备及可读存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200403976A1 (en) * 2019-06-18 2020-12-24 Microsoft Technology Licensing, Llc Web server request identification
CN110417776A (zh) * 2019-07-29 2019-11-05 大唐高鸿信安（浙江）信息科技有限公司 一种身份认证方法及装置
CN111488595A (zh) * 2020-03-27 2020-08-04 腾讯科技（深圳）有限公司 用于实现权限控制的方法及相关设备
CN114021089A (zh) * 2021-09-29 2022-02-08 苏州浪潮智能科技有限公司 一种目录访问控制方法、装置、设备及可读存储介质

Similar Documents

Publication Publication Date Title
US20230319534A1 (en) Cross-resource subscription for m2m service layer
JP5509334B2 (ja) コンピュータネットワーク内の保護リソースへのアクセスを管理するための方法と、そのための物理エンティティおよびコンピュータプログラム
KR102245367B1 (ko) 무선 통신 시스템에서 특정 리소스에 대한 접근 권한을 인증하기 위한 방법 및 장치
JP4441249B2 (ja) ネットワークコンピューティング環境においてコンテキストプロパティメタデータを利用するための装置
KR102145741B1 (ko) 무선 통신 시스템에서 접근 제어를 위한 방법 및 장치
JP7179836B2 (ja) 通信ネットワークにおける自動サービス登録
EP2733909B1 (en) Terminal control method and device, and terminal
KR102048909B1 (ko) 허가 기반 리소스 및 서비스 발견
KR20150092108A (ko) 무선 통신 시스템에서 정보 변경 통지를 위한 방법 및 장치
JP2016541082A (ja) 接続管理方法、装置、電子設備、プログラム、及び記録媒体
KR20150088787A (ko) 무선 통신 시스템에서 특정 리소스에 대한 정보 갱신을 위한 방법 및 장치
WO2017157176A1 (zh) 一种资源分发方法及装置
WO2020156135A1 (zh) 一种访问控制策略的处理方法、装置及计算机可读存储介质
WO2020228751A1 (zh) 一种通信方法和装置
JPWO2007077615A1 (ja) ソフトウェア実行管理装置、その方法及びプログラム
JP2015525384A (ja) メディア情報アクセス制御のための方法及び装置、並びにディジタル・ホーム・マルチメディア・システム
WO2024103257A1 (zh) 用于访问控制的方法和装置
US20160099928A1 (en) Systems and methods for managing connections for universal plug-and-play devices
US20140169354A1 (en) Access Control Method for WiFi Device and WiFi Device
WO2020093742A1 (zh) 一种api发布方法及装置
WO2024050832A1 (zh) 命令的传输方法、装置、芯片、存储介质和计算机程序
JP5064126B2 (ja) 利用されるサービスを制御するサーバシステム
WO2024130508A1 (zh) 设备配网方法、配置器、服务器、设备和用户终端
US20230262142A1 (en) Service layer methods for offloading iot application message generation and response handling
WO2024130729A1 (zh) 传输信息的方法、客户端设备及云平台