WO2023000967A1 - 一种设备管理方法、***以及装置 - Google Patents

一种设备管理方法、***以及装置 Download PDF

Info

Publication number
WO2023000967A1
WO2023000967A1 PCT/CN2022/103564 CN2022103564W WO2023000967A1 WO 2023000967 A1 WO2023000967 A1 WO 2023000967A1 CN 2022103564 W CN2022103564 W CN 2022103564W WO 2023000967 A1 WO2023000967 A1 WO 2023000967A1
Authority
WO
WIPO (PCT)
Prior art keywords
identity
access control
file
node
information
Prior art date
Application number
PCT/CN2022/103564
Other languages
English (en)
French (fr)
Inventor
王海光
康鑫
李铁岩
朱成康
雷中定
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22845132.4A priority Critical patent/EP4357950A1/en
Publication of WO2023000967A1 publication Critical patent/WO2023000967A1/zh
Priority to US18/416,938 priority patent/US20240163119A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of artificial intelligence, in particular to an equipment management method, system and device.
  • IoT Internet of Things
  • the present application provides a device management method, system and device, which can effectively protect data privacy and security of the device by realizing automatic management of the device.
  • the first aspect of the present application provides a device management system, including: a first device, a second device, a first access control node, a file system, a database node and a block chain node, and the database node is deployed for database for storing data;
  • the second device is configured to send an identity file to the first access control node, where the identity file includes the identity information of the first device and the public key of the second device;
  • the first access control node is configured to request the database node for associated information of the first device based on the identity file, the associated information includes the public key of the device associated with the first device, and the associated information is obtained by the database node from the blockchain node;
  • the first access control node determines that the first device is associated with the second device through the association information, the first access control node is further configured to send the identity file to the file system;
  • the file system is used to save the identity file and feed back the first identifier corresponding to the identity file to the first access control node, and the first identifier is used to read the identity file from the file system.
  • the database node can obtain the association information of the first device from the data stored in the blockchain node, and the association information includes the information of the equipment associated with the first device, which is equivalent to The block chain service provider registers.
  • the first access control node After the first access control node receives the identity file of the first device, it can request the associated information of the first device from the database node and perform verification. After the verification is successful, the first device can be Save the identity file of the file system to the file system, and send the first identifier fed back by the file system to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system.
  • the access control node can be used to control the access of the device or the second device connected to the system, verify the permission of the device accessing the system, and only allow it when it has the permission to access the system
  • the device performs further processing, such as data storage or data reading, thereby improving the privacy and security of data transmission in the system.
  • the second device before sending the identity file to the first access control node, the second device is also used to send registration information to the blockchain node.
  • the registration information includes the public key of the first device and the public key of the second device. public key;
  • the block chain node is used to write the public key of the first device and the public key of the second device into the block chain through the smart contract corresponding to the first device after the verification of the public key of the second device is successful.
  • the first device has been registered in the information;
  • the database node is configured to obtain transaction information of the blockchain node, and save the public key of the first device and the public key of the second device included in the transaction information into the associated information.
  • the first device before the second device saves the identity file of the first device to the file system, the first device is also registered in the blockchain node, so that the blockchain node can choose to match the first device
  • the smart contract of the first device is used to write the information of the first device into the transaction information of the block chain, so that the database node can generate the associated information of the first device after obtaining the transaction information of the block chain node, and the associated information can be used to indicate that the first device A device associated with a device. Therefore, in the subsequent process, the access control node can verify the ownership of the first device according to the associated information stored in the database, thereby improving the security of the data of the first device.
  • it can be combined with the smart contract of the blockchain to automatically register the first device, which can be applied to scenarios with a large number of devices, and has strong generalization ability.
  • the second device is also used to send the first identification to the blockchain node
  • the block chain node is further configured to update the first identification to the locally stored transaction information of the first device through the smart contract corresponding to the first device.
  • the second device after the second device saves the identity file of the first device to the file system, it also saves the first identifier fed back by the file system to the blockchain node, so that the blockchain node can pass the smart contract Save the first identifier to the transaction information of the first device, so that when the database node obtains the transaction information again, it can update the first identifier to the associated information of the first device, so that the associated information of the first device Having more complete information of the first device.
  • the second device is also used to send an identity request message to the first access control node, the identity request message carries the information of the first device and the public key of the second device, and the identity request message is used to request Identity file, the information of the first device may include the public key, name or other identification of the first device;
  • the first access control node is also used to obtain the first identifier
  • the first access control node is further configured to send the first identification to the file system, and receive the identity file fed back by the file system;
  • the first access control node is further configured to send the identity file to the second device.
  • the second device may also request the identity file of the first device from the access control node, and the access control node may verify the public key carried in the received identity file and the public key carried in the identity request message, If they match, it means that the device corresponding to the identity file belongs to the second device, and the identity file can be transferred to the second device. Therefore, in the embodiment of the present application, the access control node can verify the ownership of the device, thereby ensuring the security of the identity file of the device.
  • the first device is further configured to send an identity credential to the first access control node, where the identity credential includes the identifier of the first device, so as to request an identity file from the first access control node, and the first device
  • the identifier of the first device may include the name of the first device, a public key, or a unique identifier assigned to the first device, etc.;
  • the first access control node is further configured to send a second request message to the database node if the identity credential is verified and the verification is successful, and the second request message includes the identifier of the first device;
  • the database node is further configured to feed back the first identifier to the first access control node
  • the first access control node is further configured to send the first identification to the file system, and receive the identity file fed back by the file system;
  • the first access control node is further configured to send the identity file to the first device.
  • the first device can query the access control node for its own identity file, and the access control node can verify the identity certificate of the first device, and send the identity file to the first device only after the verification is successful, so that Data security of the first device is improved.
  • the device management system further includes: a registration server;
  • the first device is specifically configured to send the identity certificate to the registration server through an encrypted channel
  • Registration server for forwarding identity credentials to the access control server through an encrypted channel
  • the first access control node is specifically used to send the identity file to the registration server;
  • the registration server is specifically configured to forward the identity file to the first device.
  • the data transmitted between the first device and the first access control node can be transmitted through an encrypted channel with the registration server, thereby improving the efficiency of data transmission between the first device and the first access control node. security.
  • the device management system further includes: a second access control node;
  • the first device is configured to send a third request message to the second access control node
  • the second access control node is configured to obtain the second identification of the identity file after the third request message is verified and the verification is successful;
  • the second access control node is further configured to feed back the second identifier to the first device
  • the first device is further configured to save the identity file when it is verified that the first identification matches the second identification.
  • multiple access control nodes can be set in the device management system, and after the identity file is obtained through the first access control node, the second identification can also be obtained through the second access control node. Then verify whether the first identification and the second identification match, and if they match, it is determined that the identity file is correct, and the identity file can be saved, thereby ensuring the accuracy of the obtained identity file.
  • the first access control node is specifically configured to send a first request message to the database node and receive a first identifier fed back by the database node, where the first request message includes the public key of the first device.
  • the first access control node can obtain the first identification from the database, so that it can request the identity file of the first device from the file system based on the first identification, and obtain the identity file successfully.
  • the first identifier may also be sent by the second device to the first access control node, or during the registration process of the first device, the first access control node may save the first identifier, Furthermore, when querying the identity file, the first identifier can be extracted from locally stored data.
  • the device management system further includes: a third device;
  • the second device is also used to add the information of the third device to the identity file to obtain an updated identity file, and the information of the third device includes the public key of the third device;
  • the second device is also used to send the updated identity file to the first access control node
  • the first access control node is also used to send the updated identity file to the file system and receive the third identifier fed back by the file system;
  • the first access control node is further configured to send the third identifier to the second device;
  • the second device is further configured to send a third identification to the third device, and the third identification is used to request an updated identity file from the file system;
  • the second device is also used to send update information to the blockchain node, the update information includes the public key of the first device, the public key of the third device, and the third identification;
  • the blockchain node uses the updated information to update the transaction information to obtain the updated transaction information
  • the database node is also used to obtain updated transaction information, and update associated information according to the updated transaction information to obtain updated associated information.
  • the second device can transfer the first device to the third device, and the second device writes the information of the third device into the identity file of the first device and sends it to the access control node to inform the blockchain
  • the node has transferred the first device, so that the database node obtains the transaction information of the blockchain node and updates the associated information of the first device. Therefore, in the embodiment of the present application, the transfer of the device can be completed by the second device by modifying the identity file of the first device, and the ownership transfer of the device can be completed without manual operation.
  • the first identifier is obtained by the file system operating the identity file through a hash algorithm.
  • the present application provides a device management method, which is applied to a device management system.
  • the device management system includes: a second device, a first access control node, a file system, a first device, a database node and a blockchain node, and the database A database for storing data is deployed in the node, the first device is associated with the second device, and the method includes:
  • the second device sends the identity file to the first access control node to instruct the first access control node to save the identity file in the file system, and the identity file includes the public key of the first device and the public key of the second device; the second device Receive the first identifier sent by the first access control node, the first identifier is used to read the identity file from the file system, wherein the first identifier is generated by the file system after the first access control node sends the identity file to the file system, and the identity
  • the file is sent to the file system by the first access control node after verifying the information of the second device and the device associated with the first device in the association information and the verification is successful.
  • the association information is obtained by the first access control node from the block chain node. Information is kept in the database node.
  • the database node can obtain the associated information of the first device from the data stored in the blockchain node, and the associated information includes the information of the device associated with the first device, which is equivalent to
  • the first access control node After registering with the blockchain service provider, after the first access control node receives the identity file of the first device, it can request the associated information of the first device from the database node and verify it. Save the identity file of a device to the file system, and send the first identifier fed back by the file system to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system .
  • the device management method provided by this application can use the access control node to perform access control on the device or the second device connected to the system, verify the permission of the device to access the system, and allow the device only when it has the permission to access the system.
  • the device performs further processing, such as data storage or data reading, thereby improving the privacy and security of data transmission in the system.
  • the above method may further include: the second device sends registration information to the blockchain node, and the registration information includes the information of the first device (such as the public key, name or other identification of the first device, etc.) and the public key of the second device, the registration information is used to instruct the blockchain node to save the transaction information of the first device through the smart contract corresponding to the first device.
  • the information of the first device, the public key of the second device, and the transaction information are used by the database node to generate the associated information of the first device.
  • the second device before the second device uploads the device's identity file, it can also register the device with the blockchain node, so that the database node has the device's associated information, and the access control server can verify the second device's identity file based on the device's associated information. 2. Whether the device has the authority to upload identity files, so that unauthorized devices can be prevented from modifying the identity files of the device, and the data security of the device can be improved.
  • the above method may further include: the second device sends the first identifier to the blockchain node, so as to instruct the blockchain node to update the first identifier into the transaction information of the first device.
  • the first block chain indicating the identity file can also be updated to the associated information of the device, so that the associated information of the device includes more complete information.
  • the above method may further include: the second device sends the first identification to the first access control node; the second device receives the identity file sent by the first access control node, the identity file is the first access control node The node obtains it by requesting the file system through the first identifier.
  • the second device can query the identity file through the first identification, so that the second device can query the identity file of the device.
  • the device management system further includes: a second access control node; the above method may further include: the second device sends a third request message to the second access control node; the second device receives the second access control node The second identifier sent by the node; if the second identifier matches the first identifier, the second device saves the identity file.
  • the second device can request the identity file and the corresponding identification of the identity file from multiple access control nodes, and when the identifications fed back by the multiple access control nodes match, it means that the received identity file is accurate. , to save accurate identity documents.
  • the above method may further include: the second device receives the information of the third device, and the information of the third device includes the public key of the third device; the second device adds the third device's public key to the identity file. public key to obtain an updated identity file, and the updated identity file indicates that the first device is associated with the third device; the second device sends the updated identity file to the first access control node to instruct the first access control node to file
  • the system sends the updated identity file and receives the third identifier fed back by the file system; the second device receives the third identifier sent by the first access control node, and the third identifier is used to request the updated identity file from the file system.
  • the access control node when the device itself requests its identity file, the access control node can verify whether the device has the right to access the identity file according to the identity certificate of the requester. After the verification is successful, the identity can be fed back to the requester. file, thereby increasing the security of the device's identity file.
  • the present application provides a device management method, which is applied to a device management system.
  • the device management system includes: a second device, a first access control node, a file system, a first device, a database node and a blockchain node, and the database A database for storing data is deployed in the node, and the first device is associated with the second device.
  • the method includes: the first access control node receives the identity file sent by the second device, and the identity file includes the identity information of the first device and the second The public key of the device, the identity file can indicate that the first device is associated with the second device; the first access control node requests the database node for the association information of the first device based on the identity file, and the association information includes the device associated with the first device
  • the public key and the associated information are obtained by the database node from the blockchain node; if the first access control node determines that the first device is associated with the second device through the associated information, the first access control node requests the file system to send the identity file, To instruct the file system to save the identity file; the first access control node receives the first identifier fed back by the file system, and sends the first identifier to the second device, where the first identifier is used to read the identity file from the file system.
  • the database node can obtain the associated information of the first device from the data stored in the blockchain node, and the associated information includes the information of the device associated with the first device, which is equivalent to
  • the first access control node After registering with the blockchain service provider, after the first access control node receives the identity file of the first device, it can request the associated information of the first device from the database node and verify it. Save the identity file of a device to the file system, and send the first identifier fed back by the file system to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system .
  • the device management method provided by this application can use the access control node to perform access control on the device or the second device connected to the system, verify the permission of the device to access the system, and allow the device only when it has the permission to access the system.
  • the device performs further processing, such as data storage or data reading, thereby improving the privacy and security of data transmission in the system.
  • the first access control node requests the database node for the association information of the first device based on the identity file, which may include: if the first access control node determines that the identity file is complete according to the signature carried in the identity file, then Association information of the first device is requested from the database node based on the identity file.
  • the access control node determines that the identity file is complete, it requests the associated information of the device from the database node, which is equivalent to requesting the associated information of the device only when the identity file is ensured to be complete.
  • the above method may further include: the first access control node receives an identity request message sent by the second device, the identity request message carries the public key of the first device and the public key of the second device, and the identity request The message is used to request an identity file; the first access control node sends a first request message to the database node, and the first request message includes the information of the first device, such as the public key, name or other identification of the first device; the first access control node The node receives the first identification sent by the database node; the first access control node sends the first identification to the file system, and receives the identity file fed back by the file system; if the public key included in the identity file matches the public key of the second device, then The first access control node sends the identity file to the second device.
  • the access control node may request the first identification from the database node, so that the identity file may be read from the file system based on the first identification.
  • the above method may further include: the first access control node receives the identity credential sent by the first device, and the identity credential includes the identity of the first device; the first access control node verifies the identity credential; if If the identity credential verification is successful, the first access control node sends a second request message to the database node, and the second request message includes the identification of the first device; the first access control node receives the first identification sent by the database node; the first access control node Sending the first identification to the file system, and receiving the identity file fed back by the file system; if the identification included in the identity file is identified with the public key of the first device, the first access control node sends the identity file to the first device.
  • the access control node can perform access control on the device querying its own identity file, and transmit the identity file to the device only after the identity certificate is successfully verified, so as to improve the data security of the device.
  • the device management system further includes: a registration server;
  • the first access control node receives the identity certificate sent by the first device, including: the first access control node receives the identity certificate forwarded by the registration server, and the identity certificate is sent to the registration server by the first device through an encrypted channel with the registration server;
  • Sending the identity file to the first device by the first access control node may include: sending the identity file to the first device by the first access control node through a registration server.
  • the data transmitted between the first device and the first access control node can be transmitted through an encrypted channel with the registration server, thereby improving the efficiency of data transmission between the first device and the first access control node. security.
  • the above method may further include: the first access control node receives the updated identity file sent by the second device; the first access control node sends the updated identity file to the file system, and receives the file The third identifier fed back by the system; the first access control node sends the third identifier to the second device, and the third identifier is used to request an updated identity file.
  • the second device can transfer the first device to the third device, and the second device writes the information of the third device into the identity file of the first device and sends it to the access control node to inform the blockchain
  • the node has transferred the first device, so that the database node obtains the transaction information of the blockchain node and updates the associated information of the first device. Therefore, in the embodiment of the present application, the transfer of the device can be completed by the second device by modifying the identity file of the first device, and the ownership transfer of the device can be completed without manual operation.
  • the present application provides a device management method, which is applied to a device management system.
  • the device management system includes: a second device, a first access control node, a file system, a first device, a database node and a blockchain node, and the database A database for storing data is deployed in the node, and the first device is associated with the second device.
  • the method includes: the block chain node receives the registration information sent by the second device, and the registration information includes the public key of the first device and the registration information of the second device.
  • the blockchain node writes the public key of the first device and the public key of the second device into the transaction information of the blockchain through the smart contract corresponding to the first device, so that the database node can obtain the transaction information of the blockchain node After the information is traded, the public key of the first device and the public key of the second device included in the transaction information are stored in the associated information of the first device, where the associated information includes information about devices associated with the first device.
  • the database node can obtain the association information of the first device from the data stored in the blockchain node, and the association information includes the information of the equipment associated with the first device, which is equivalent to The block chain service provider registers.
  • the first access control node After the first access control node receives the identity file of the first device, it can request the associated information of the first device from the database node and perform verification. After the verification is successful, the first device can be Save the identity file of the file system to the file system, and send the first identifier fed back by the file system to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system.
  • the access control node can be used to control the access of the device or the second device connected to the system, verify the permission of the device accessing the system, and only allow it when it has the permission to access the system
  • the device performs further processing, such as data storage or data reading, thereby improving the privacy and security of data transmission in the system.
  • the above method may further include: the block chain node receives a first identification, the first identification is used to request the identity file of the first device, and the first identification is generated by the file system after saving the identity file;
  • the blockchain node writes the first identifier into the transaction information of the first device through the smart contract corresponding to the first device, so that the database node saves the first identifier into the associated information after obtaining the transaction information of the blockchain node.
  • the first device before the second device saves the identity file of the first device to the file system, the first device is also registered in the blockchain node, so that the blockchain node can choose to match the first device
  • the smart contract of the first device is used to write the information of the first device into the transaction information of the block chain, so that the database node can generate the associated information of the first device after obtaining the transaction information of the block chain node, and the associated information can be used to indicate that the first device A device associated with a device. Therefore, in the subsequent process, the access control node can verify the ownership of the first device according to the associated information stored in the database, thereby improving the security of the data of the first device.
  • it can be combined with the smart contract of the blockchain to automatically register the first device, which can be applied to scenarios with a large number of devices, and has strong generalization ability.
  • the present application provides a device management method, which is applied to a device management system.
  • the device management system includes: a second device, a first access control node, a file system, a first device, a database node and a blockchain node, and the database A database for storing data is deployed in the node, and the first device is associated with the second device.
  • the method includes: the database node obtains the transaction information in the block chain of the block chain node; the database node stores the first device included in the transaction information
  • the public key of the first device and the public key of the second device are stored in the association information of the first device, and the association information is used to indicate the information of the device associated with the first device.
  • the database node can obtain the association information of the first device from the data stored in the blockchain node, and the association information includes the information of the equipment associated with the first device, which is equivalent to The block chain service provider registers.
  • the first access control node After the first access control node receives the identity file of the first device, it can request the associated information of the first device from the database node and perform verification. After the verification is successful, the first device can be Save the identity file of the file system to the file system, and send the first identifier fed back by the file system to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system.
  • the access control node can be used to control the access of the device or the second device connected to the system, verify the permission of the device accessing the system, and only allow it when it has the permission to access the system
  • the device performs further processing, such as data storage or data reading, thereby improving the privacy and security of data transmission in the system.
  • the above method may further include: the database node receiving a home request message sent by the first access control node, where the home request message carries the identifier of the first device; An access control node sends association information of the first device.
  • the database node after receiving the attribution request message, searches for the corresponding association information according to the public key of the device carried in the message, and feeds it back to the access control node.
  • the embodiment of the present application provides a second device, where the second device has a function of implementing the device management method in the second aspect above.
  • This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the embodiment of the present application provides an access control node, where the access control node has a function of implementing the device management method in the third aspect above.
  • This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the embodiment of the present application provides a blockchain node, which has the function of implementing the device management method in the fourth aspect above.
  • This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the embodiment of the present application provides a database node, where the database node has a function of implementing the device management method in the fifth aspect.
  • This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the embodiment of the present application provides a second device, including: a processor and a memory, wherein the processor and the memory are interconnected through a line, and the processor calls the program code in the memory to execute any one of the above-mentioned second aspects Processing-related functions in the device management method shown.
  • the second device may be a chip.
  • the embodiment of the present application provides an access control node, including: a processor and a memory, wherein the processor and the memory are interconnected through a line, and the processor calls the program code in the memory to execute any one of the above third aspects.
  • the access control node may be a chip.
  • the embodiment of the present application provides a block chain node, including: a processor and a memory, wherein the processor and the memory are interconnected through a line, and the processor calls the program code in the memory to perform any of the above fourth aspects. Processing-related functions in an illustrated device management method.
  • the blockchain node can be a chip.
  • the embodiment of the present application provides a database node, including: a processor and a memory, wherein the processor and the memory are interconnected through a line, and the processor calls the program code in the memory to execute any one of the fifth aspect above Processing-related functions in the device management method shown.
  • the database node may be a chip.
  • the embodiment of the present application provides a device, which can also be called a digital processing chip or a chip.
  • the chip includes a processing unit and a communication interface.
  • the processing unit obtains program instructions through the communication interface, and the program instructions are executed by the processing unit.
  • the processing unit is configured to execute processing-related functions in any optional implementation manner of the second aspect to the fifth aspect.
  • an embodiment of the present application provides a computer-readable storage medium, including instructions, which, when run on a computer, cause the computer to execute the method in any optional implementation manner of the first aspect to the fifth aspect above .
  • an embodiment of the present application provides a computer program product containing instructions, which, when run on a computer, cause the computer to execute the method in any optional implementation manner of the first aspect to the fifth aspect above.
  • FIG. 1 is a schematic structural diagram of an equipment management system provided by the present application
  • FIG. 2 is a schematic structural diagram of another equipment management system provided by the present application.
  • FIG. 3 is a schematic structural diagram of another equipment management system provided by the present application.
  • FIG. 4 is a schematic structural diagram of another equipment management system provided by the present application.
  • FIG. 5 is a schematic structural diagram of another equipment management system provided by the present application.
  • FIG. 6 is a schematic flowchart of a device management method provided by the present application.
  • FIG. 7 is a schematic flowchart of another device management method provided by the present application.
  • FIG. 8 is a schematic flowchart of another device management method provided by the present application.
  • FIG. 9 is a schematic flowchart of another device management method provided by the present application.
  • FIG. 10 is a schematic flowchart of another device management method provided by the present application.
  • FIG. 11 is a schematic flowchart of another device management method provided by the present application.
  • FIG. 12 is a schematic flowchart of another device management method provided by the present application.
  • Fig. 13 is a schematic structural diagram of a second device provided by the present application.
  • FIG. 14 is a schematic structural diagram of an access control node provided by the present application.
  • Fig. 15 is a schematic structural diagram of a block chain node provided by the present application.
  • FIG. 16 is a schematic structural diagram of a database node provided by the present application.
  • Fig. 17 is a schematic structural diagram of another second device provided by the present application.
  • FIG. 18 is a schematic structural diagram of another access control node provided by the present application.
  • FIG. 19 is a schematic structural diagram of another blockchain node provided by the present application.
  • FIG. 20 is a schematic structural diagram of another database node provided by the present application.
  • the system and method provided by the present application can be adapted to various communication networks, and the devices connected to the communication network will increase greatly, so realizing the management of the devices connected to the network becomes an important subject.
  • device identity management is performed manually, including identity issuance, recycling, identity transfer, etc., which is difficult to cope with the challenges brought about by massive device identity management.
  • Some platforms can be used to support the device to automatically obtain the startup identity, but these platforms are all private platforms, the protocols and platforms are all private, and the openness is insufficient. It is difficult for small-scale equipment manufacturers to replicate, and the requirements for users are relatively high. , so it is difficult to promote on a large scale.
  • multiple manufacturers, operators, and cloud service providers can use blockchain technology to jointly build a public identity management platform, and through the identity management platform, functions such as issuing device initialization identities and attribution transfers can be realized.
  • a blockchain consists of a growing series of records called blocks. These blocks are linked together through cryptography, and each block contains the hash value, timestamp, and transaction data of the previous block.
  • the blockchain is essentially a distributed multi-backup database, but the biggest difference from the database is that the data storage is formed through multi-party consensus, and the hash chain is used to protect the historical data, so that the data cannot be tampered with.
  • the feature of blockchain data that cannot be tampered with is easier to gain the trust of users, so it can better support multi-party cooperation.
  • Another feature of blockchain technology is its support for smart contracts, which are computer programs that are automatically executed on the blockchain. The use of smart contracts can reduce the intermediate links of transactions and realize transaction automation.
  • IPFS Interplanetary File System
  • IPFS is a file storage and content distribution network protocol that integrates a variety of distributed systems to provide users with unified addressable data storage.
  • IPFS is essentially a P2P distributed storage system, which accesses file resources in the network through a unique code generated based on file content.
  • IPFS can be combined with decentralized blockchain technology to solve the problems of data storage security, user collaboration timeliness, and storage and bandwidth costs under the centralized Internet architecture.
  • the redundant backup technology adopted by the IPFS system is Erasure coding (EC, erasure code). With n copies of original data and m copies of verification data added, the original data can be restored by any n copies of data in n+m copies of data, that is, the maximum number of data failures that can be tolerated is m.
  • EC Erasure coding
  • IPFS_Proxy can obtain the file information stored by the user.
  • IPFS_Proxy the ability to record files on the chain also depends on IPFS_Proxy. Excessive power of IPFS_Proxy can easily cause system security risks, such as data content leakage and other threats.
  • this application provides a device management system and a device management method, which are used to automatically complete device access combined with blockchain smart contracts, which can be applied to scenarios where a large number of devices are connected, and are more conducive to data privacy protection.
  • the device management system and device management method provided in this application can be applied to various communication networks with multiple access devices, such as distributed networks, Internet of Things, and the like.
  • This application exemplarily uses the Internet of Things as an example for illustration.
  • the customer needs to issue an identity to the device through manual configuration, such as purchasing a SIM card from the operator and inserting it into the SIM card slot on the device, and then the device can access the network with the above-mentioned identity.
  • This application provides a credible identity information sharing platform for equipment manufacturers, users, operators, equipment, etc., so that equipment can automatically obtain network access and business identity, attribution confirmation, etc., and realize zero-touch network access of equipment.
  • the device management system provided by this application is shown in Figure 1.
  • the manufacturer manufactures the device, it can embed the identity of the device in the device, and the manufacturer can register or transfer the ownership of the device to the device management platform. Both the owner of the device and the device itself can obtain the identity file of the device from the device management platform.
  • the device can be transferred from the manufacturer to the user, and the user can provide the user's own identity information to the device management platform, and the device management platform can update the owner of the device to the user in the associated information of the device.
  • the owner of the device such as the user, can purchase services from the operator or IoT server, such as the device can be connected to the network through the operator, and data can be uploaded through the IoT service provider.
  • various devices can communicate through limited or wireless networks, such as the fifth-generation mobile communication technology (5th-Generation, 5G) system, long-term evolution (long term evolution, LTE) system, global system for mobile communication (global system for mobile communication (GSM) or code division multiple access (CDMA) network, wideband code division multiple access (WCDMA) network, wireless fidelity (Wireless Fidelity, WiFi), Bluetooth (bluetooth) , Zigbee protocol (Zigbee), radio frequency identification technology (radio frequency identification, RFID), long-range (Long Range, Lora) wireless communication, short-range wireless communication (near field communication, NFC) in any one or more combination Wait.
  • 5G fifth-generation mobile communication technology
  • LTE long-term evolution
  • GSM global system for mobile communication
  • CDMA code division multiple access
  • WCDMA wideband code division multiple access
  • WiFi wireless fidelity
  • WiFi wireless Fidelity
  • Bluetooth blue-bluetooth
  • Zigbee protocol Zigbee protocol
  • RFID radio frequency
  • the functions of the device management platform may be shown in FIG. 2 .
  • the device management platform can be divided into multiple parts, such as a blockchain part, an IPFS storage part (not shown in FIG. 2 ), a database part and an access control part.
  • Blockchain part Usually, the identity file saved on the device management platform is the core of device management, so it is necessary to ensure that the information is credible. Therefore, this application ensures the credible attributes of the device information recorded on the shared platform by adopting the non-tamperable feature of the blockchain, and uses smart contracts to ensure that key data are recorded on the blockchain.
  • IPFS part In order to overcome the limitation of the storage capacity of the blockchain, this application can use the IPFS decentralized file system to store the identity file of the color palette, and use the blockchain to save the identity, attribution and hash of the identity file of the device Values, etc. occupy less data, so as to achieve a reasonable distribution of data and maximize the use of resources in each part.
  • this application uses a decentralized database system to filter the correctness of device information. Multiple nodes run independent databases to save device identity information obtained from the database.
  • the database information comes from the device identity management information stored on the blockchain. The insertion of data does not depend on manual modification, the implementation efficiency is high, and manual errors are avoided, making the data of each device more reliable.
  • Access control part In order to ensure the privacy of data, this application sets access control so that only users with access rights can access the identity file of the device.
  • FIG. 3 it is a schematic structural diagram of a device management system provided in the present application.
  • the device management system may include a first device 31 , a second device 32 , a first access control node 33 , a file system 34 , a database node 35 and a blockchain node 36 .
  • the second device 32 is configured to send an identity file to the first access control node 33, and the identity file includes the identity information of the first device 31 and the public key of the second device 32;
  • the first access control node 33 is used to request the associated information of the first device 31 from the database node 35 based on the identity file.
  • the associated information includes the public key of the device associated with the first device 31, and the associated information is obtained from the blockchain by the database node 35. Obtained from node 36;
  • the first access control node 33 determines that the first device 31 is associated with the second device 32 through the association information, the first access control node 33 is further configured to request the file system 34 to send the identity file;
  • the file system 34 is configured to save the identity file and feed back the first identifier corresponding to the identity file to the first access control node 33, and the first identifier is used to read the identity file from the file system 34.
  • the database node can obtain the association information of the first device from the data stored in the blockchain node, and the association information includes the information of the equipment associated with the first device, which is equivalent to The block chain service provider registers.
  • the first access control node After the first access control node receives the identity file of the first device, it can request the associated information of the first device from the database node and perform verification. After the verification is successful, the first device can be Save the identity file of the file system to the file system, and send the first identifier fed back by the file system to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system.
  • the access control node can be used to control the access of the device or the second device connected to the system, verify the permission of the device accessing the system, and only allow it when it has the permission to access the system
  • the device performs further processing, such as data storage or data reading, thereby improving the privacy and security of data transmission in the system.
  • the second device 32 before sending the identity file to the first access control node 33, the second device 32 is also used to send registration information to the block chain node 36, the registration information includes the public key of the first device 31 and the second the public key of the second device 32;
  • the block chain node 36 is used to write the public key of a device and the public key of the second device 32 into the transaction information of the block chain through the smart contract corresponding to the first device 31 to register the first device;
  • the database node 35 is configured to obtain the transaction information of the blockchain node 36, and save the public key of the first device 31 and the public key of the second device 32 included in the transaction information into the associated information.
  • the first device before the second device saves the identity file of the first device to the file system, the first device is also registered in the blockchain node, so that the blockchain node can choose to match the first device
  • the smart contract of the first device is used to write the information of the first device into the transaction information of the block chain, so that the database node can generate the associated information of the first device after obtaining the transaction information of the block chain node, which can include information related to the first device Information about the device associated with the device. Therefore, in the subsequent process, the access control node can verify the ownership of the first device according to the associated information stored in the database, thereby improving the security of the data of the first device.
  • it can be combined with the smart contract of the blockchain to automatically register the first device, which can be applied to scenarios with a large number of devices, and has strong generalization ability.
  • the second device 32 is also used to send the first identification to the block chain node 36;
  • the block chain node 36 is also used to update the first identification to the locally stored transaction information of the first device 31 through the smart contract corresponding to the first device.
  • the second device after the second device saves the identity file of the first device to the file system, it also saves the first identifier fed back by the file system to the blockchain node, so that the blockchain node can pass the smart contract Save the first identifier in the transaction information of the first device, so that when the database node obtains the transaction information again, it can update the first identifier to the associated information of the first device, so that the associated information of the first device Having more complete information of the first device.
  • the second device 32 is also configured to send an identity request message to the first access control node 33, where the identity request message carries the information of the first device 31 (such as the first device's public key, name, serial number or other identification information) and the public key of the second device 32, the identity request message is used to request the identity file;
  • the first access control node 33 is further configured to send a first request message to the database node 35, where the first request message includes information about the first device 31;
  • the database node 35 is further configured to feed back the first identifier to the first access control node 33;
  • the first access control node 33 is further configured to send the first identification to the file system 34, and receive the identity file fed back by the file system 34;
  • the first access control node 33 is further configured to send the identity file to the second device 32 .
  • the second device may also request the identity file of the first device from the access control node, and the access control node may verify the public key carried in the received identity file and the public key carried in the identity request message, If they match, it means that the device corresponding to the identity file belongs to the second device, and the identity file can be transferred to the second device. Therefore, in the embodiment of the present application, the access control node can verify the ownership of the device, thereby ensuring the security of the identity file of the device.
  • the first device 31 is also used to send the identity credential to the first access control node 33, the identity credential includes the public key of the first device 31, so as to request the identity file from the first access control node 33 ;
  • the first access control node 33 is also used to send a second request message to the database node 35 if the identity certificate is verified and verified successfully, and the second request message includes the identification of the first device 31 (such as the public key of the first device, name, serial number or unique identifier assigned to the first device, etc.);
  • the database node 35 is further configured to feed back the first identifier to the first access control node 33;
  • the first access control node 33 is further configured to send the first identification to the file system 34, and receive the identity file fed back by the file system 34;
  • the first access control node 33 is further configured to send the identity file to the first device 31 .
  • the first device can query the access control node for its own identity file, and the access control node can verify the identity certificate of the first device, and send the identity file to the first device only after the verification is successful, so that Data security of the first device is improved.
  • the first access control node 33 is specifically configured to send a first request message to the database node and receive the first identifier fed back by the database node, where the first request message includes The public key of the first device.
  • the first access control node can obtain the first identification from the database, so that it can request the identity file of the first device from the file system based on the first identification, and obtain the identity file successfully.
  • the first identification can also be sent by the second device to the first access control node, or during the registration process of the first device, the first access control node can save the first identification, and then when querying the identity file, it can The first identifier is extracted from locally stored data.
  • the device management system further includes: a registration server;
  • the first device 31 is specifically configured to send the identity certificate to the registration server through an encrypted channel
  • Registration server for forwarding identity credentials to the access control server through an encrypted channel
  • the first access control node 33 is specifically used to send the identity file to the registration server;
  • the registration server is specifically configured to forward the identity file to the first device 31 .
  • the data transmitted between the first device and the first access control node can be transmitted through an encrypted channel with the registration server, thereby improving the efficiency of data transmission between the first device and the first access control node. security.
  • the device management system further includes: a second access control node;
  • the first device 31 is configured to send a third request message to the second access control node
  • the second access control node is configured to obtain the second identification of the identity file after the third request message is verified and the verification is successful;
  • the second access control node is further configured to feed back the second identifier to the first device 31;
  • the first device 31 is further configured to save the identity file when the first identification matches the second identification.
  • multiple access control nodes can be set in the device management system, and after the identity file is obtained through the first access control node, the second identification can also be obtained through the second access control node. Then verify whether the first identification and the second identification match, and if they match, it is determined that the identity file is a correct file, and the identity file can be saved, thereby ensuring the accuracy of the identity file.
  • the device management system further includes: a third device;
  • the second device 32 is also used to add the information of the third device in the identity file to obtain an updated identity file
  • the information of the third device may include the public key of the third device
  • the updated identity file indicates that the first device Associated with a third device, that is, the device associated with the first device is converted from the second device to the third device;
  • the second device 32 is further configured to send the updated identity file to the first access control node 33;
  • the first access control node 33 is further configured to send the updated identity file to the file system 34, and receive the third identification fed back by the file system 34;
  • the first access control node 33 is further configured to send the third identifier to the second device 32;
  • the second device 32 is further configured to send a third identification to the third device, and the third identification is used to request the file system 34 for an updated identity file;
  • the second device 32 is also configured to send update information to the block chain node 36, the update information includes the public key of the first device 31, the public key of the third device, and the third identification;
  • the block chain node 36 uses the update information to update the transaction information, and obtains the updated transaction information
  • the database node 35 is also used to obtain updated transaction information, and update associated information according to the updated transaction information to obtain updated associated information.
  • the second device can transfer the first device to the third device, and the second device writes the information of the third device into the identity file of the first device and sends it to the access control node to inform the blockchain
  • the node has transferred the first device, so that the database node obtains the transaction information of the blockchain node and updates the associated information of the first device. Therefore, in the embodiment of the present application, the transfer of the device can be completed by the second device by modifying the identity file of the first device, and the ownership transfer of the device can be completed without manual operation.
  • the first identifier is obtained by the file system operating the identity file through a hash algorithm.
  • the device management system provided by this application is exemplarily introduced by taking the file system as IPFS as an example.
  • FIG. 4 it is a schematic structural diagram of another device management system provided by the present application.
  • access control nodes IPFS, databases, and blockchain nodes can form a device management platform to provide services such as authentication and identity management for devices and device owners.
  • Equipment i.e. the first equipment
  • the device mainly needs to perform authentication and information query.
  • Authentication You can use pre-implanted keys such as X.509 certificates or private keys corresponding to IBS public keys to generate signatures, authenticate with external nodes such as access control systems, and also confirm that external nodes are nodes authorized by the device to access, for example
  • the domain name or IP address of the external node is the domain name or IP address embedded in the device during production.
  • the belonging device that is, the second device, or the device owner
  • the belonging device and the device associated with the device may be a server or a terminal, or a service provided to the user through other means, such as a webpage, an APP, and the like.
  • the belonging device usually requires authentication, information query, information storage, device registration or ownership update, etc.
  • a pre-generated private key can be used to generate a signature, authenticate with an external node such as an access control node, and also confirm whether the external device is an authorized access device.
  • Information query It can be responsible for assisting other devices to obtain the identity file of the device from the access control node.
  • the identity file of the device can be sent to the access control node.
  • Smart contracts deployed on blockchain nodes can be invoked to write information such as device ownership, identity files, or hash values of identity files.
  • It can be used to control the access of the devices accessing the aforementioned device control platform, to authenticate the devices connected to the device control platform, or to perform information query, etc., for example:
  • Authentication and access control It can confirm the identity of the device or the belonging device, and at the same time, sign with the private key controlled by itself to prove its identity to the device or the belonging device.
  • the identity file of the device can be obtained from IPFS. After receiving the queryer's identity query request and confirming that the queryer has the right to access the identity file, the identity file can be fed back to the queryer.
  • Information upload It can receive the identity file of the device sent by the device owner, and after determining that the device owner has the authority to update or upload the identity file of the device, write the identity file to IPFS, and feed back the information returned by IPFS to the device owner File verification codes, such as hash values or addresses generated by other means.
  • Device ownership confirmation You can initiate an ownership query request to the database to query the associated information of the device, the hash value of the device and other information, so as to determine the ownership of the device.
  • It can be used to insert or query information about the device.
  • the transaction information related to the identity of the device can be extracted from the blockchain node, and the transaction information can be saved in the database. Usually, if the associated information of the device already exists in the database, the associated information of the device can be updated after the information related to the identity of the device is obtained in the transaction information. If the associated information of the device does not exist in the database, the associated information of the device is generated after the information related to the identity of the device is obtained in the transaction information. When inserting data into the database, it is necessary to confirm whether the initiator of the transaction record is the owner of the device, if so, update the associated information of the device, and if not, not update the associated information of the device.
  • Device information query If the device or the device owner queries the device's identity file, the database node can provide the device's identity file to the access control node.
  • It can be used for device registration and information update. It can be responsible for interacting with the smart contract module deployed on the blockchain node, select the smart contract that matches the device or the manufacturer of the production device, register the device, and upload the device information, the hash value of the identity file and the updated The information of the owner of the device is written into the blockchain.
  • the deployment manner of the device management system provided in this application can refer to FIG. 5 .
  • the device management system includes N nodes, all of which include blockchain nodes, IPFS, database nodes (DB) and access control nodes, and each node is connected through a wired or wireless network.
  • N nodes all of which include blockchain nodes, IPFS, database nodes (DB) and access control nodes, and each node is connected through a wired or wireless network.
  • the present application provides a decentralized device management system, which implements device management functions, such as device registration, information update, identity verification, or information query, through multiple independently operating nodes.
  • device management functions such as device registration, information update, identity verification, or information query
  • the management of equipment is realized through smart contracts, which has strong generalization ability and can be applied to various scenarios.
  • the authority of the inquirer who inquires about the data of the device is verified by accessing the control node, which can improve the data security of the device.
  • FIG. 6 it is a schematic flowchart of a device management method provided by the present application, as described below.
  • the second device sends an identity file to the first access control node.
  • the second device is a user associated with the first device, that is, the owner of the first device, and the user may be carried by a server or a terminal.
  • the device management system provided in this application can provide services to users in the form of a client, and the user can log in to an account on a local PC, and then use the local client as a second device.
  • the device management system provided by this application can provide users with services through the APP installed on the user terminal. The user can register or query the identity of the device owned by the user on the APP, and the terminal can be used as the second equipment.
  • the identity file may include identity information of the first device and/or information of the second device and the like.
  • the identity information of the first device may include, for example, the public key, name, serial number, address or unique identifier assigned to the first device; the information of the second device such as the public key, name, unique ID or address etc.
  • the identity file may indicate that the first device is associated with the second device.
  • the second device may be a device that bears the user's account. Binding the first device, that is, adding the information of the second device to the identity file of the first device and uploading it to the device management platform, so as to associate the first device with the second device on the platform.
  • the second device before the second device sends the identity file to the first access control node, it also sends registration information to the blockchain node, and the registration information may include the information of the first device and the information of the second device.
  • information such as the public key, unique identifier or serial number of the first device, and the public key, unique identifier or serial number of the second device;
  • the blockchain node transfers a device’s Information and the public key of the second device are written into the transaction information of the block chain to register the first device, the smart contract corresponding to the first device can indicate the registration method of the first device, and the smart contract corresponding to each device can It is determined by the preset mapping relationship; the database node obtains the transaction information of the blockchain node, and saves the public key of the first device and the public key of the second device included in the transaction information to the associated information, thereby completing the transaction of the first device registration.
  • a smart contract is a computer protocol designed to disseminate, verify or execute contracts in an informational manner. Smart contracts allow for trusted transactions without third parties, which are traceable and irreversible. A variety of smart contracts can be pre-set in the blockchain node. Each manufacturer or each device may have the same or different smart contracts. The smart contract can indicate the registration method, transaction method or data storage format of the device. In the implementation of this application, the method and system provided by this application can be adapted to more scenarios and compatible with more devices produced by different manufacturers through smart contracts, and has a strong generalization ability.
  • the first device can be registered in the device management system, and the manufacturer (that is, the second device) sends the registration information to the block chain node, and the block chain node determines the device that matches the first device. Smart contract, and write the information of the first device into the block through the smart contract.
  • the database node obtains the transaction information of the blockchain, it will generate the associated information of the first device, including the information of the first device and the first The information of the device associated with the device, etc., so that the access control node can know the ownership of the first device based on the association information of the first device saved in the database, so as to determine the device with the authority to update or query the information of the first device.
  • the first access control node requests association information of the first device from the database node.
  • the first access control node After receiving the identity file sent by the second device, the first access control node can send an attribution request message to the database node to request the database node for the associated information of the first device, which includes the associated information of the first device. Information about the device, the first access control node can obtain the information about the device associated with the first device through the association information.
  • the association information may include the information of the first device and the information of the second device, such as the name, serial number, public key or its hash value of the first device, the certificate of the second device, the public key or its hash value value etc.
  • the first access control node verifies the authority of the second device.
  • the first access control node After the first access control node obtains the associated information of the first device from the database node, it can obtain the information of the device associated with the first device, such as public key, name or other identification information, and judge whether the second device is related to the first device. Device association. If it is determined that the first device is associated with the second device, it means that the second device has the authority to upload the identity file of the first device. If it is determined that the second device is not associated with the first device, it means that the second device does not have the authority to upload the identity file of the first device, and the identity file sent by the second device can be discarded at this time.
  • the public key of the owner included in the association information is the same as the public key of the second device, it can be determined that the first device is associated with the second device; if the public key of the owner included in the association information is the same as that of the second device If the public keys of the devices are different, it is determined that the first device is not associated with the second device, and the received identity file can be discarded at this time.
  • the first access control node sends the identity file to the file system.
  • the access control node can determine that the second device can upload the identity file of the first device, that is, send the identity file to the file system, so that Save the identity file in .
  • the file system saves the identity file.
  • the file system After the file system receives the identity file sent by the first access control node, it saves the identity file.
  • the file system may be a file system deployed on a server, a distributed storage system, or a centralized storage system. After receiving the identity file, it can be saved in the file system.
  • the file system feeds back the first identifier corresponding to the identity file to the first access control node.
  • the file system may generate a first identifier of the identity file and feed it back to the first access control node.
  • the first identifier may be the storage address of the identity file in the file system, or may be an identifier generated according to the storage address of the identity file, or may be an identifier generated according to the content of the identity file.
  • a hash algorithm such as a message-digest algorithm (message-digest algorithm, MD4), MD5, a secure hash algorithm (secure Hash algorithm, SHA), etc.
  • MD4 message-digest algorithm
  • MD5 secure hash algorithm
  • SHA secure Hash algorithm
  • the first identifier is used as an example for illustration, that is, the first identifier, second identifier, or third identifier mentioned below can be obtained through the aforementioned algorithm
  • the obtained identification the following only uses the hash value as an example for illustration.
  • the first access control node feeds back the first identifier to the second device.
  • the first access control node After receiving the first identification, the first access control node can feed back the first identification to the second device, so that the second device can subsequently request the first access control node to query the identity file by virtue of the first identification .
  • the database node can obtain the associated information of the first device from the data stored in the blockchain node, and the associated information includes the information of the device associated with the first device, which is equivalent to
  • the first access control node After registering with the blockchain service provider, after the first access control node receives the identity file of the first device, it can request the associated information of the first device from the database node and verify it. Save the identity file of a device to the file system, and send the first identifier fed back by the file system to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system .
  • the device management method provided by this application can use the access control node to perform access control on devices connected to the system or belonging devices, verify the rights of devices accessing the system, and allow the device only when it has access rights to the system Perform further processing, such as data storage or data reading, so as to improve the privacy and security of data transmission in the system.
  • the second device also sends the first identifier to the blockchain node; the blockchain node records the first identifier into the transaction information of the first device through the smart contract, and the database node can periodically obtain the transaction information information, or obtain the transaction information after detecting that the transaction information is updated, so as to update the information of the first device in the transaction information to the associated information of the first device, that is, to update the first identification to the associated information of the first device, so that The complete associated information of the first device is obtained.
  • the second device may also send an identity request message to the first access control node, where the identity request message carries the information of the first device and the public key of the second device, and the identity request message requests an identity file;
  • the first access control node can also obtain the first identification and send the first identification to the file system to receive the identity file fed back by the file system; if the public key of the owner of the device included in the identity file matches the public key of the second device , which means that the first device is associated with the second device, and the first access control node also sends the identity file to the second device. If the public key included in the identity file does not match the public key of the second device, the identity file may not be sent to the second device or the query failure may be fed back to the second device.
  • the first access control node can verify whether the requester who requests the identity file of the first device has the right to read the identity file of the device, only if the requester has the right to read the identity file Only in this case will the identity document be fed back to the requester, thereby improving the data security of the device and protecting the privacy of the device.
  • the aforementioned device management system may further include a second access control node, and the second device may also send a third request message to the second access control node; the second The access control node obtains the second identification of the identity file based on the verification of the third request message and the verification is successful; the second access control node also feeds back the second identification to the first device; when the verification of the first identification and the second identification match , the second device saves the identity file. Therefore, in the embodiment of the present application, the second device can request the identity file and the corresponding identification of the identity file from multiple access control nodes, and when the identifications fed back by the multiple access control nodes match, it means that the received identity file is accurate. , to save accurate identity documents.
  • the first device may also send an identity credential to the first access control node, where the identity credential includes the identifier of the first device, and the identifier may be the public key, serial number or other unique ID to request the identity file of the first device from the first access control node; if the first access control node verifies the identity credential and the verification succeeds, it sends a second request message to the database node, and the second request message includes the first The public key of the device; the database node also feeds back the first identification to the first access control node; the first access control node also sends the first identification to the file system and receives the identity file fed back by the file system; if the identity file includes If the identifier matches the identifier of the first device, the first access control node also sends the identity file to the first device.
  • the identity credential includes the identifier of the first device
  • the identifier may be the public key, serial number or other unique ID to request the identity file of the first device from the first access control node
  • the access control node when the device itself requests its identity file, the access control node can verify whether the device has the right to access the identity file according to the identity certificate of the requester. After the verification is successful, the identity can be fed back to the requester. file, thereby increasing the security of the device's identity file.
  • the aforementioned device management system may further include a second access control node, and the first device may also send a third request message to the second access control node; the second After the access control node verifies the third request message and the verification is successful, it obtains the second identification of the identity file; the second access control node also feeds back the second identification to the first device; when it is verified that the first identification and the second identification match , the first device saves the identity file, and when the first identifier does not match the second identifier, the first device may re-request the identity file from the first access control node or the second access control node until an accurate identity file is obtained.
  • the first device may request the identity file and the identification corresponding to the identity file from multiple access control nodes, and when the identifications fed back by the multiple access control nodes match, it means that the received identity file is accurate. , to save accurate identity documents.
  • the first access control node may specifically send a first request message to the database node to request the first identification from the database node, where the first request message may include the public key of the first device, and the database node After receiving the first request message, based on the public key carried in the first request message, the association information of the first device can be searched from the locally stored data, and the first identifier included in the information can be fed back to the A first access control node. Therefore, in the implementation of this application, the access control node can obtain accurate device related information from the database, and use this to obtain the device's identity file from the file system, which is equivalent to the process of obtaining files that requires the participation of multiple nodes , can reduce the possibility of data leakage. And the access control node verifies the read permission, thereby increasing the data security of the device.
  • the second device further adds the information of the third device to the identity file to obtain an updated identity file, and the information of the third device includes the public key of the third device; the second device further Send the updated identity file to the first access control node; the first access control node also sends the updated identity file to the file system, and receives the third identification fed back by the file system; the first access control node also sends to the second device The third identification; the second device also sends the third identification to the third device, and the third identification points to the file system to request an updated identity file; the second device also sends update information to the block chain node, and the update information includes the first device The public key of the third device, the public key of the third device, and the third identification; the blockchain node uses the updated information to update the transaction information, and obtains the updated transaction information; the database node also obtains the updated transaction information, and according to the updated transaction information The information updates the associated information to obtain the updated associated information.
  • the ownership of the first device can be converted from the second device to the third device, and the second device adds the information of the third device to the identity file, that is, the owner of the first device is changed to the third device, And upload the updated identity file to the file system, and update the associated information stored in the database to complete the transfer of the device. Therefore, through the method provided in this application, the transfer of equipment can be completed accurately and efficiently, and it can adapt to the scene where equipment transfer is required, and has strong generalization ability.
  • the device management method provided by this application can perform device registration, identity update, identity query, and device transfer. For example, after registering the device, you can Conduct identity inquiries or identity transfers, etc.
  • the processes of registration, identity query, and device transfer are described below as examples.
  • the foregoing file system may be various file systems for storing data, such as a constructed distributed file system, IPFS, etc., and this application exemplarily uses IPFS as an example for illustration.
  • IPFS IP-based distributed file system
  • the device owner may be a manufacturer or a user. The following exemplarily takes the device owner as a manufacturer as an example for illustration.
  • FIG. 7 it is a schematic flowchart of a device management method provided in the present application.
  • the device owner sends device information and device owner information to the blockchain.
  • the device owner (that is, the aforementioned second device, here referred to as the device owner for ease of understanding) can send registration information to the block chain, and the registration information can include the information of the device and the information of the device owner, so as to Register the device with the blockchain.
  • the information of the device may include information such as a public key of the device, or a hash value of the public key, a certificate, a serial number of the device, a device name, or a device identifier.
  • the information of the device owner may include information such as a public key of the device owner, or a hash value of the public key, a certificate of the device owner, or an identification of the device owner.
  • the manufacturer can initiate a registration request to the smart contract deployed on the blockchain through its own blockchain account, and the registration request can carry information such as the identity of the device and the device identification of the manufacturer , such as the public key of the device or the hash value of the public key of the device, or the public key of the manufacturer or the hash value of the public key of the manufacturer.
  • the blockchain (that is, the blockchain node) writes the received information into the block through the smart contract.
  • the blockchain After the blockchain receives the registration information sent by the device owner, it can determine the smart contract that matches the device, and write the received registration information, that is, the information of the device and the information of the device owner, through the smart contract. blocks.
  • the way to determine the smart contract can be through the preset mapping relationship
  • the mapping relationship can be the mapping relationship between the device and the smart contract, or the mapping relationship between the manufacturer of the device and the smart contract, or,
  • the address or interface of the smart contract can be carried in the registration information.
  • the smart contract can indicate the device registration method or device management method, etc.
  • the smart contract can indicate the registration information, encryption method, data format, etc. required for registering the device.
  • different smart contracts can be used to register devices from different manufacturers, so that devices from different manufacturers can be adapted to, and different manufacturers can be introduced only by accessing the corresponding smart contracts, which can realize the control of different manufacturers.
  • Equipment management strong generalization ability.
  • the blockchain feeds back the transaction number or block number to the device owner.
  • the registration information is written into the block through the smart contract, and the transaction number or block number is generated at the same time, and fed back to the device owner, thereby notifying the device owner that the registration information has been written into the block.
  • the database scans the block transaction information.
  • the database is usually carried in the server, and the transaction information in the block can be read by the server.
  • the database can periodically read the transaction information in the block, or read the transaction information after detecting that the transaction information is updated.
  • the database can periodically send read requests to the blockchain and receive transaction information fed back by the blockchain.
  • the database can regularly obtain the information recorded in each block on the blockchain. Whenever the blockchain generates a new data block, the database can extract the identity information from the new block and filter it to filter out the available data. Information. If there is no device association information identified by the device public key in the database, then generate association information for the device and add it to the database. If the device association information identified by the device public key already exists in the database, the blockchain account address of the device owner can be verified. If the address is the same as the blockchain account address when interacting with the device owner last time, Then it is determined to update the device information in the transaction information to the associated information. Wherein, when the device is transferred, the updated new owner address may be different from the original owner address.
  • the database records or updates associated information of the device.
  • the database After the database determines that the transaction information in the block is updated, it can generate or update the associated information of the device according to the transaction information in the block, and the associated information can be used to indicate the information of the user associated with the device.
  • the new information can be updated to the associated information of the equipment. If the associated information of the device does not exist in the database, after detecting that a new block is added in the transaction information, and the block includes the information of the device, the associated information of the device is generated.
  • the association information may include the information of the device itself, such as the public key of the device, the hash value of the public key, serial number, name or other identification, etc., and may also include the information of the owner of the device, such as the owner The public key of the owner, the hash value of the public key, serial number, name or other identification, etc.
  • the device owner generates an identity file.
  • the device owner can generate the device's identity file, which includes the device's identity information, the device owner's identity information, and other information that can identify the identity of the device or the ownership of the device.
  • the identity file may specifically include various identity attributes of the device, and usually the identity file needs to be encrypted. Among them, there are many ways to encrypt, and the public key of the device or the public key of the device owner can be used for encryption.
  • the specific encryption method can be encrypted with a symmetric key K and a general encryption algorithm such as AES.
  • the encryption key itself is encrypted with the device and the device owner's public key and stored in the identity file.
  • the private key of the device owner can be used to sign, so that the received device can use the device public key contained in it for verification, such as through the RSA algorithm or the elliptic curve digital signature algorithm (Elliptic Curve Digital Signature Algorithm, ECDSA) algorithm etc. for verification.
  • ECDSA Elliptic Curve Digital Signature Algorithm
  • the information included in the identity file of the device and the encryption method of each information may be specifically shown in Table 1:
  • the device owner uploads the identity file to the access control node.
  • the device owner After generating the identity file, the device owner uploads the identity file to the access control node to instruct the access control node to save the identity file into IPFS.
  • the access control node can authenticate the identity of the device owner, specifically through the identity certificate and signature provided by the device owner.
  • the identity certificate may include a public key, and the public key and the device owner's public key may generally be the same or two types of public keys generated through a certificate chain.
  • the access control node can use the public key of the device owner and the signature carried in the identity file for verification.
  • a common signature verification step such as RSA, is used to calculate the signature of the file with the public key, and then obtain a value (that is, a hash value) At the same time, perform hash operation on the file data to obtain the hash value of the file, and then compare whether the two hash values are the same, and if they are the same, the signature is passed. Otherwise, signature verification fails.
  • the access control node verifies the signature integrity of the identity file.
  • the identity file carries a signature
  • the identity file can be verified through the signature and the public key of the device owner to confirm whether the identity file has been tampered with. If the identity file is complete, you can proceed to the subsequent steps. If the identity file is incomplete, discard the identity file, or notify the device owner to resend the identity file, or reply to communication failure, etc.
  • the device owner when the device owner generates the identity file, he can use his own private key and encryption algorithm to generate the signature of the identity file.
  • the access control node After receiving the identity file, the access control node uses the device owner's public key and signature to verify the identity file. Signature verification operation to verify the integrity of the identity file.
  • the access control node sends an attribution query request to the database.
  • the attribution query request may carry the public key of the device, or may also carry the hash value of the public key, so as to request the associated information of the device from the database.
  • the database feeds back device association information to the access control node.
  • the database After the database receives the attribution query request sent by the access control node, it can query the locally stored data according to the public key carried in the attribution query request, extract the associated information of the device, and feed back the associated information of the device to the access control node .
  • the associated information may include information about the device and information about the owner associated with the device. Specifically, the associated information may include a public key of the device, or a hash value of the public key of the device, an owner's public key, or a hash value of the owner's public key, and the like.
  • the access control node verifies that the identity of the device owner is consistent with the identity of the uploader of the identity file.
  • the access control node After the access control node receives the associated information of the device, it can verify whether the identity of the owner of the device is consistent with that of the uploader of the identity file. If it can match the owner's public key included in the associated information, whether it is consistent with the device owner's public key, if they are consistent, it means that the device belongs to the identity file uploader, that is, the device is associated with the identity file uploader, and the subsequent steps can be continued step. If not, it means that the device does not belong to the uploader of the identity file. At this time, the identity file can be discarded, or the owner of the device can be notified to resend the identity file, or the communication failure can be replied.
  • the access control node sends the device identity file to the IPFS.
  • the access control node After the access control node verifies that the device is associated with the device owner, that is, the device owner has the authority to upload the identity file of the device, at this time the access control node can send the identity file to IPFS to save the identity file in IPFS.
  • the IPFS feeds back the hash value of the identity file to the access control node.
  • IPFS After IPFS receives and saves the identity file of the device sent by the access control node, it can generate a hash value corresponding to the identity file (that is, the first identification) and feed it back to the access control node.
  • the hash value can be used to read the identity file of the device saved in IPFS. For example, after receiving the hash value, IPFS can calculate the storage address of the file based on the hash value and the corresponding analysis operation, so that based on the The address is read into the device's identity file.
  • the specific manner of generating the hash value can be obtained by a hash (Hash) algorithm, such as MD4, MD5, or SHA.
  • a hash (Hash) algorithm such as MD4, MD5, or SHA.
  • MD4 hash
  • MD5 hash
  • SHA hash
  • the content of the identity file or the storage address can be used as the input of the algorithm, and the corresponding hash value can be output.
  • the method of generating the hash value by using the MD5 algorithm may include: MD5 ("file name+data content").
  • MD5("/sdcard/youku/offlinedata/test.txt&showdemotesttxt) f96b697d7cb7938d525a2f31aaf161d0 (that is, the hash value).
  • the access control node feeds back the hash value of the identity file to the device owner.
  • the access control node After the access control node receives the hash value fed back by IPFS, it can feed back the hash value to the device.
  • the device owner sends the hash value of the identity file to the blockchain.
  • the device owner After receiving the hash value sent by the access control node, the device owner can send the hash value to the blockchain, so that the blockchain can write the hash value into the block through the smart contract.
  • the device owner can also send the information of the device or the device owner to the blockchain to identify itself, so that the blockchain can identify the source of the hash value and determine the ownership of the hash value.
  • the blockchain writes the hash value of the identity file into the block through the smart contract.
  • the hash value can be written into the block through the smart contract, and at the same time, it can also identify the information of the device corresponding to the identity file indicated by the hash value or Device owner information, etc.
  • the blockchain feeds back the transaction number or block number, etc. to the device owner.
  • the blockchain After the blockchain writes the hash value of the device identity file into the block, it can feed back the transaction number or block number to the device owner to notify the device owner that the hash value has been saved in the block.
  • the database scans the block transaction information.
  • step 718 is similar to the aforementioned step 704 and will not be repeated here.
  • the database updates the associated information of the device.
  • the hash value of the identity file is added to the transaction information scanned into the block, and the hash value can be updated to the associated information of the device, so that the associated information of the device is more complete, so that other devices can be retrieved from the database
  • the saved identifier of the identity file is obtained from the saved associated information.
  • the device owner can register the device with the blockchain, so that the blockchain uses the matching smart contract to write the information of the device and its owner into the block.
  • the database can obtain the associated information of the first device from the data stored in the blockchain, the associated information includes the information of the device associated with the first device, which means that the first device has registered with the blockchain service provider, and the first device has registered with the blockchain service provider.
  • an access control node receives the identity file of the first device, it can request the associated information of the first device from the database node and perform verification.
  • the device management method can use the access control node to perform access control on devices connected to the system or belonging devices, verify the rights of devices accessing the system, and allow the device only when it has access rights to the system Perform further processing, such as data storage or data reading, so as to improve the privacy and security of data transmission in the system.
  • the identity query can be divided into multiple situations, the identity file can be queried by the device itself, and the identity file can also be queried by the device owner. For example, when the device owner needs to modify the identity file of the device, he can request the identity file saved on the device management platform from the access control node, or when the device owner has not saved the identity file of the device locally or the local data is lost, he can Request the identity file of the device from the access control node.
  • a device when a device accesses the network for the first time, it may request an identity file from the access control node through the default network, and the identity file may include the identity information of the first device itself and the identity information of the second device associated with it , may also include the information of the operator providing the network, so that the subsequent access to the network provided by the operator can be based on the identity file.
  • the following is an exemplary description of the scenario where the device and the device owner request to query the identity file.
  • the device owner queries the identity document
  • FIG. 8 it is a schematic flowchart of another device management method provided by the present application.
  • the device owner sends an identity query request to the access control node.
  • the identity query request may carry device information or device owner information, etc., to request the access control node to query the device's identity file.
  • step 701 For information about the device and the information about the owner of the device, refer to the related description of step 701 above, which will not be repeated here.
  • the access control node sends the device public key to the database.
  • the access control node After the access control node receives the identity query request from the device owner, it can request the hash value of the identity file from the database. Specifically, a first request message may be sent to the database, and the first request message may carry the public key of the device, so as to request the database for the hash value of the identity file of the device.
  • the first request message can also carry the information of the device owner, such as the public key, serial number or identification of the device owner, so that the database can identify the device owner and read the information of the device owner. Information associated with owned devices. Therefore, in the embodiment of the present application, the access control node may request the first identification from the database node, so that the identity file may be read from the file system based on the first identification.
  • the database feeds back the hash value of the identity file to the access control node.
  • the database After the database receives the first request message, based on the device public key carried in the first request message, the database can query the associated information corresponding to the public key in the stored data, so as to extract the ID of the identity file from the associated information. Hash value, or directly feed back the associated information to the access control node.
  • the access control node sends the hash value of the identity file to the IPFS.
  • the access control node After the access control node receives the hash value of the identity file, it can send the hash value to IPFS to request the identity file corresponding to the hash value from IPFS.
  • the IPFS issues the identity file to the access control node.
  • IPFS After IPFS receives the hash value sent by the access control node, it can determine the address corresponding to the hash value, and read the identity file of the device from the address and send it to the access control node.
  • the specific manner of determining the address corresponding to the hash value may include querying the address corresponding to the hash value using a preset mapping relationship, or calculating the The address saved in the identity file is extracted to the identity file of the device.
  • the access control node verifies the consistency between the owner's public key in the identity file and the requester's public key.
  • the access control node can also verify whether the device owner has the authority to query the device identity file. That is, it is judged whether the information of the user associated with the device included in the identity file matches the information of the requester.
  • the requester can be judged whether the public key of the owner of the device included in the identity file is consistent with the public key of the requester, and if they are consistent, the requester is identified as the owner of the device, and the requester has the authority to query the identity file of the device . If the public key of the owner of the device included in the identity file is inconsistent with the public key of the requester, it means that the requester may not have the authority to query the identity file of the device, and there is no need to feed back the identity file to the requester, or Reply to messages such as no query permission or communication failure.
  • the access control node feeds back the identity file to the device owner.
  • the access control node After the access control node verifies that the device is associated with the device owner, the access control node can issue the identity file to the device owner, so that the device owner can obtain the identity file of the device.
  • the device owner can request to query the identity file of the device through the access control node, and the access control node can verify the authority of the requester. Only when the requester has the authority to query the identity file of the device, the Feedback the identity file of the device to the requester, thereby improving the data security and privacy of the device.
  • the device may communicate with the access control node directly, or communicate with the access control node through the registration server.
  • the access control node may communicate with the access control node directly, or communicate with the access control node through the registration server.
  • FIG. 9 it is a schematic flowchart of another device management method provided by the present application.
  • the device sends the identity credential to the access control node.
  • the identity certificate of the device can include the information of the device itself to request the identity file of the device from the access control node, such as the public key of the device, the hash value of the public key, serial number, unique identifier, time stamp, random value And the signature generated using the private key, etc.
  • the device can obtain the domain name or address of the access control node from the storage, and then initiate a link to the access control node through the domain name or address, and upload the identity certificate of the device, including the certificate of the device, time stamp, random value, and private key
  • the generated signature, etc., the time stamp can be used to prevent replay attacks and increase the security of data transmission within the system.
  • the access control node verifies the identity certificate.
  • the access control node After the access control node receives the identity credentials uploaded by the device, it can verify the identity credentials. Follow the next steps after successful verification. If the verification is unsuccessful, there is no need to perform subsequent steps, or a message such as resending the identity certificate or feedback communication failure can be fed back to the device.
  • the identity certificate includes a timestamp
  • the access control node sends the device public key to the database.
  • the database feeds back the hash value of the identity file to the access control node.
  • the access control node sends the hash value of the identity file to the IPFS.
  • the IPFS issues the identity file to the access control node.
  • step 903-step 906 may refer to the aforementioned steps 802-805, which will not be repeated here.
  • the access control node verifies the consistency between the device public key in the identity file and the requester's public key.
  • the access control node after the access control node obtains the identity file of the device, it can verify whether the device information included in the identity file matches the information of the requester, such as verifying whether the public key of the device in the identity file is consistent with the public key of the requester. , then continue to execute the next steps. If they are not consistent, there is no need to execute the next steps, and you can feed back messages such as communication failure or permissionless to the requester.
  • the access control node feeds back the identity file to the device.
  • the access control node After the access control node confirms that the device public key in the identity file is consistent with the public key of the requester, it means that the requester for the identity file is the device to which the identity file belongs, and has the authority to query the identity file, and can send The device returns an identity document.
  • the device can request to query the identity file of the device through the access control node, and the access control node can verify the authority of the requester, and only when the requester has the authority to query the identity file of the device, the The identity file of the device can be fed back by the user, thereby improving the data security and privacy of the device.
  • the hash value of the device identity file can be obtained from multiple databases through multiple access control nodes, so as to compare the identity files fed back by the multiple access control nodes Whether the hash values are consistent, if they are consistent, the queryer can save the identity file.
  • FIG. 10 it is a schematic flowchart of another device management method provided by the present application.
  • the device sends an identity credential to a first access control node.
  • the first access control node verifies the identity certificate.
  • the first access control node sends the device public key to the first database.
  • the first database feeds back the hash value of the identity file to the first access control node.
  • the first access control node sends the hash value of the identity file to IPFS.
  • the IPFS delivers the identity file to the first access control node.
  • the first access control node verifies the consistency between the device public key in the identity file and the device public key of the requester.
  • the first access control node feeds back the identity file to the device.
  • steps 1001-1008 reference may be made to the description of the aforementioned steps 901-908, which will not be repeated here.
  • the device sends the identity credential to the second access control node.
  • this step 1010 is similar to the aforementioned step 1001, the difference is that in the aforementioned step 1001, the device sends the identity certificate to the first access control node to request the identity file of the device, while in step 1010, the device sends the identity certificate to the second access control node. Control node to request a hash of the device's identity file. Certainly, in step 1010, the device may also request the identity file of the device from the second access control node, which may be adjusted according to actual application scenarios, and this embodiment is only an illustration.
  • the second access control node verifies the message signature.
  • the second access control node sends the device public key to the second database.
  • the second database feeds back the hash value of the identity file to the second access control node.
  • the access control server sends the hash value of the identity file to the device.
  • steps 1010-1013 may refer to the aforementioned steps 902-904, the difference is that the requested databases are different.
  • the device verifies the consistency between the hash value included in the identity file in step 1008 and the hash value received in step 1013.
  • the device After receiving the identity file fed back by the first access control node and the hash value of the identity file fed back by the second access control node, the device verifies the hash value included in the identity file fed back by the first access control node and the second access Whether the hash values fed back by the control node are consistent, if consistent, the identity file can be saved, if not, the identity file can be discarded, and the aforementioned steps 1001-1013 are re-executed until an accurate identity file is obtained.
  • the device saves the identity file, so that the device can Get more accurate identification documents.
  • the device can be connected with the registration server, and communicate with the device management platform through the registration server.
  • the registration server can be a server set up for the device to communicate with the device, thereby reducing the load on the access control server; the registration server can also be a node in the network to which the device is connected, such as a device that can access a WiFi network , the registration server may be one of the network managers in the WiFi network.
  • FIG. 11 it is a schematic flowchart of another device management method provided by the present application.
  • the device sends the identity certificate to the registration server.
  • the device may send the identity certificate to the registration server, so as to request the registration server for the identity file of the device.
  • an encrypted channel can be established between the device and the registration server, such as a Transport Layer Security (TLS) encrypted channel or a channel encrypted by other encryption methods, thereby improving the communication between the device and the registration server.
  • TLS Transport Layer Security
  • the registration server forwards the identity certificate of the device to the access control node.
  • the registration server can forward the identity credentials sent by the device to the access control node through an encrypted channel.
  • an encrypted channel is also established between the registration server and the access control node, and the encryption method of the encrypted channel may be the same as or different from the encryption method of the aforementioned encrypted channel between the device and the registration server, specifically It can be adjusted according to actual application scenarios.
  • steps 1101-1102 and the aforementioned step 901 the difference between steps 1101-1102 and the aforementioned step 901 is that in the aforementioned step 901, the device can directly send the identity credential to the access control node, and the identity credential needs to be forwarded by the registration server in steps 1101-1102. part will not be repeated here.
  • the access control node verifies the identity certificate.
  • the access control node sends the device public key to the database.
  • the database feeds back the hash value of the identity file to the access control node.
  • the access control node sends the hash value of the identity file to the IPFS.
  • the IPFS issues the identity file to the access control node.
  • the access control node verifies the consistency between the device public key in the identity file and the requester's public key.
  • step 1103-step 1108 may refer to the aforementioned steps 902-907, which will not be repeated here.
  • the access control node feeds back the identity file to the registration server.
  • the registration server forwards the identity file to the device.
  • the identity file fed back by the access control node to the registration server may be transmitted through an encrypted channel between the access control node and the registration server, and the identity file forwarded by the registration server to the device may also be transmitted through an encrypted channel between the registration server and the device.
  • the identity file can also be transmitted without using an encrypted channel, which can be adjusted according to the actual application scenario.
  • steps 1108-1109 are similar to the aforementioned step 908 and will not be repeated here. The difference is that in the aforementioned step 908, the access control node directly sends the identity file to the device, while in steps 1108-1109, the registration server forwards the identity file.
  • the data transmitted between the device and the access control node can be forwarded through the registration server, and can be transmitted through an encrypted channel, which can improve the security of the data transmitted between the device and the access control node.
  • the device owner may transfer the device to other users.
  • the manufacturer ie, the first device owner
  • transfers the device to the user ie, the second device owner
  • the steps similar to those in the above-mentioned FIGS. 8-11 are not described in detail, and only the differences are described below as examples.
  • FIG. 12 it is a schematic flowchart of another device management method provided by the present application.
  • the user sends its own user certificate to the vendor.
  • the user certificate can include user information, such as the user's public key, user name, or user ID. identification and other information.
  • the manufacturer obtains the identity file of the device from the access control node.
  • the manufacturer can obtain the identity file of the device from the access control node.
  • the specific process please refer to the steps in Figure 8 above, which will not be repeated here.
  • the manufacturer adds user information to the identity file.
  • the manufacturer can add the user's information to the device's identity file.
  • the identity file of the device can be shown in Table 1 above, and the manufacturer can add the user's certificate, including the user's public key, to the "next owner information" in the identity file to obtain an updated identity file to indicate Transfer the device to the next belonging party, the user.
  • the user's public key can also be used for symmetric encryption, and the updated identity file can be signed, so that subsequent users can use their own public key to decrypt or verify the identity file after obtaining the identity file.
  • the manufacturer sends the updated identity file to the access control node.
  • the access control node obtains the associated information of the device from the database.
  • the access control node uploads the updated identity file to IPFS and receives the updated hash value.
  • the access control node sends the updated hash value to the manufacturer.
  • steps 1204-1207 are similar to the aforementioned steps 707-713, the difference is that the uploaded here is the identity file updated by the manufacturer, while the aforementioned steps 707-713 uploaded the identity file generated by the device owner.
  • the manufacturer sends the user's information to the blockchain.
  • the user's information may include information such as the user's public key, name, or other identifiers.
  • the manufacturer can also send the public key of the device and the updated hash value to the blockchain at the same time to instruct the blockchain to update the transaction information of the device.
  • the blockchain writes the user's information into the block through the smart contract.
  • the blockchain can write the user's information into the block through the smart contract, such as setting the user as the next owner of the device, and identifying it in the transaction information.
  • the database updates the associated information of the device.
  • the database can scan the transaction information of the block chain, thereby updating the information related to the device included in the transaction information to the associated information of the device to obtain the updated associated information.
  • the manufacturer sends the updated hash value to the user.
  • the manufacturer also sends the updated hash value (that is, the third identification) to the user, so that the user can read the identity file of the device based on the third identification.
  • the updated hash value that is, the third identification
  • the user uses the updated hash value to request the identity file from the access control node.
  • the user may send a request message to the control server, which carries the updated hash value, to request the access control node to read the identity file of the device.
  • the request message may also carry user information, such as the user's public key, name, or other identifiers.
  • the access control node reads the identity file from the IPFS.
  • the access control node reads device association information from the database.
  • step 1213-step 1214 can refer to the aforementioned steps 804-805, which will not be repeated here.
  • the access control node verifies the consistency between the owner and the user of the device.
  • the attribution party of the device in the device association information in the database has been changed to the user, so the owner of the device has been replaced by the user.
  • the identity of the owner included in the association information can be verified. Whether the information matches the user's information, such as judging whether the public key of the next owner included in the associated information is consistent with the user's public key, if they are consistent, it means that the device belongs to the user, and you can continue to perform the next steps at this time, if If not, it means that the device does not belong to the user, and no further steps are required.
  • the access control node issues the identity file to the user.
  • the access control node determines that the device belongs to the user, the access control node can deliver the identity file of the device issued by IPFS to the user at this time, so that the user can obtain the identity file of the device it owns.
  • the user updates the attribution party of the device in the identity file.
  • the user After the user obtains the identity file, he can modify the attribution party of the device in the identity file to the user's information.
  • the information included in the device attribution information may be replaced with user information, such as the user's name, identity certificate, and the like.
  • the user uploads a new identity file to the access control node, and receives a new hash value.
  • the user uploads a new hash value to the blockchain.
  • the block chain party writes the new hash value into the block through the smart contract.
  • the database updates the associated information of the device with the new hash value.
  • steps 1218-1221 are similar to the aforementioned steps 1103-1109, the difference is that the identity file uploaded by the manufacturer is replaced by the identity file uploaded by the user, and will not be described in detail below.
  • the transfer of the device can be realized, that is, the transfer of the device from the current owner to the next owner. Therefore, it can adapt to more scenarios, including scenarios such as device registration, transfer, or information query, and has strong generalization ability.
  • FIG. 13 it is a schematic structural diagram of a second device provided by the present application.
  • the second device includes:
  • the transceiver module 1301 is configured to send the identity file to the first access control node, to instruct the first access control node to save the identity file in the file system, and the identity file includes the identity information of the first device and the public key of the second device;
  • the transceiver module 1301 is further configured to receive the first identification sent by the first access control node, the first identification is used to read the identity file from the file system, wherein the first identification is that the first access control node sends the identity file to the file system
  • the identity file is then generated by the file system.
  • the identity file is sent to the file system by the first access control node after verifying the information of the second device and the device associated with the first device in the associated information and the verification is successful.
  • the associated information is the first access control node to the zone.
  • the block chain node requests it, and the associated information is stored in the database node.
  • the transceiver module 1301 is further configured to send registration information to the blockchain node before the second device sends the identity file to the first access control node.
  • the registration information includes the information of the first device and the information of the second device.
  • the public key of the second device the registration information is used to instruct the blockchain node to save the information of the first device and the public key of the second device in the transaction information of the first device through the smart contract corresponding to the first device, and the transaction information is used for
  • the database node generates association information of the first device.
  • the transceiver module 1301 is further configured to send the first identifier to the blockchain node, so as to instruct the blockchain node to update the first identifier into the transaction information of the first device.
  • the transceiver module 1301 is also configured to: send the first identification to the first access control node; receive the identity file sent by the first access control node, the identity file is the The ID is requested from the file system.
  • the device management system further includes: a second access control node; the second device further includes: a saving module 1302;
  • the transceiver module 1301 is further configured to send a third request message to the second access control node;
  • the transceiver module 1301 is further configured to receive the second identification sent by the second access control node;
  • the saving module 1302 is configured to save the identity file if the second identification matches the first identification.
  • the second device may further include: a processing module 1303;
  • the transceiver module 1301 is further configured to receive information of a third device, where the information of the third device includes the public key of the third device;
  • a processing module 1303, configured to add the public key of the third device to the identity file to obtain an updated identity file
  • the transceiver module 1301 is further configured to send the updated identity file to the first access control node, so as to instruct the first access control node to send the updated identity file to the file system and receive the third identification fed back by the file system;
  • the transceiver module 1301 is further configured to receive a third identifier sent by the first access control node, where the third identifier is used to request an updated identity file from the file system.
  • FIG. 14 it is a schematic structural diagram of an access control node provided in this application.
  • a transceiver module 1401, configured to receive the identity file sent by the second device, where the identity file includes the public key of the first device and the public key of the second device;
  • the transceiver module 1401 is further configured to request the database node for associated information of the first device based on the identity file, the associated information includes the public key of the owner of the first device, and the associated information is obtained by the database node from the blockchain node;
  • a processing module 1402 configured to determine that the first device is associated with the second device through association information
  • the transceiver module 1401 is further configured to request the file system to send the identity file, so as to instruct the file system to save the identity file;
  • the transceiver module 1401 is further configured to receive the first identifier fed back by the file system, and send the first identifier to the second device, where the first identifier is used to read the identity file from the file system.
  • the transceiver module 1401 is further configured to request the database node for the identity file based on the identity file if the processing module 1402 determines that the identity file is Association information of the first device.
  • the transceiver module 1401 is also configured to receive an identity request message sent by the second device, the identity request message carries the information of the first device and the public key of the second device, and the identity request message is used to request an identity file;
  • the transceiver module 1401 is further configured to send a first request message to the database node, where the first request message includes the information of the first device;
  • the transceiver module 1401 is also configured to receive the first identifier sent by the database node;
  • the transceiver module 1401 is also configured to send the first identification to the file system, and receive the identity file fed back by the file system;
  • the transceiver module 1401 is further configured to send the identity file to the second device.
  • the transceiver module 1401 is further configured to receive the identity credential sent by the first device, where the identity credential includes the identifier of the first device;
  • the processing module 1402 is also used to verify the identity certificate
  • the transceiver module 1401 is further configured to send a second request message to the database node, where the second request message includes the identifier of the first device;
  • the transceiver module 1401 is also configured to receive the first identifier sent by the database node;
  • the transceiver module 1401 is also configured to send the first identification to the file system, and receive the identity file fed back by the file system;
  • the transceiver module 1401 is further configured to send the identity file to the first device.
  • the device management system further includes: a registration server;
  • the transceiver module 1401 is specifically configured to receive the identity certificate forwarded by the registration server, and the identity certificate is sent to the registration server by the first device through an encrypted channel with the registration server;
  • the transceiver module 1401 is specifically configured to send the identity file to the first device
  • the transceiver module 1401 is specifically configured to send the identity file to the first device through the registration server.
  • the transceiver module 1401 is also configured to: receive the updated identity file sent by the second device; send the updated identity file to the file system, and receive the third identification fed back by the file system; The second device sends the third identification, and the third identification is used to request an updated identity file.
  • FIG. 15 a schematic structural diagram of a blockchain node provided by this application, including:
  • a transceiver module 1501 configured to receive registration information sent by the second device, where the registration information includes the public key of the first device and the public key of the second device;
  • the processing module 1502 is configured to write the public key of the first device and the public key of the second device into the transaction information of the blockchain through the smart contract corresponding to the first device, so that the database node obtains the transaction information of the blockchain node After information, the public key of the first device and the public key of the second device included in the transaction information are stored in the association information of the first device, and the association information includes information of devices associated with the first device.
  • the transceiver module 1501 is further configured to receive a first identifier, the first identifier is used to request the identity file of the first device, and the first identifier is generated by the file system after saving the identity file;
  • the processing module 1502 is further configured to write the first identifier into the transaction information of the first device through the smart contract corresponding to the first device, so that the database node obtains the transaction information of the blockchain node and saves the first identifier in the associated information.
  • FIG. 16 a schematic structural diagram of a database node provided by this application, including:
  • Transceiver module 1601 configured to acquire transaction information in the block chain of the block chain node
  • the processing module 1602 is configured to save the public key of the first device and the public key of the second device included in the transaction information into associated information of the first device, where the associated information includes information about devices associated with the first device.
  • the transceiver module 1601 is further configured to receive a home request message sent by the first access control node, where the home request message carries the public key of the first device;
  • the transceiver module 1601 is further configured to send the associated information of the first device to the first access control node according to the public key of the first device.
  • FIG. 17 is a schematic structural diagram of another second device provided by the present application, as described below.
  • the second device may include a processor 1701 and a memory 1702 .
  • the processor 1701 and the memory 1702 are interconnected by wires. Wherein, program instructions and data are stored in the memory 1702 .
  • the memory 1702 stores program instructions and data corresponding to the aforementioned steps in FIGS. 6-12 .
  • the processor 1701 is configured to execute the method steps performed by the second device shown in any one of the foregoing embodiments in FIG. 6 to FIG. 12 .
  • Transceiver 1703 configured to receive or send data.
  • the aforementioned second device shown in FIG. 17 may be a chip.
  • FIG. 18 is a schematic structural diagram of another access control node provided by the present application, as described below.
  • the access control node may include a processor 1801 and a memory 1802 .
  • the processor 1801 and memory 1802 are interconnected by wires.
  • the memory 1802 stores program instructions and data.
  • the memory 1802 stores program instructions and data corresponding to the aforementioned steps in FIGS. 6-12 .
  • the processor 1801 is configured to execute the method steps performed by the access control node shown in any one of the foregoing embodiments in FIG. 6 to FIG. 12 .
  • Transceiver 1803 configured to receive or send data.
  • the aforementioned access control node shown in FIG. 18 may be a chip.
  • Figure 19 is a schematic structural diagram of another blockchain node provided by this application, as described below.
  • the blockchain node may include a processor 1901 and a memory 1902.
  • the processor 1901 and memory 1902 are interconnected by wires. Wherein, program instructions and data are stored in the memory 1902 .
  • the memory 1902 stores program instructions and data corresponding to the steps in the above-mentioned FIG. 6-FIG. 12 .
  • the processor 1901 is configured to execute the method steps executed by the blockchain node shown in any one of the foregoing embodiments in FIG. 6 to FIG. 12 .
  • Transceiver 1903 configured to receive or send data.
  • the aforementioned blockchain nodes shown in Figure 19 may be chips.
  • FIG. 20 is a schematic structural diagram of another database node provided by the present application, as described below.
  • the database node may include a processor 2001 and a memory 2002 .
  • the processor 2001 and memory 2002 are interconnected by wires. Wherein, program instructions and data are stored in the memory 2002 .
  • the memory 2002 stores program instructions and data corresponding to the steps in the above-mentioned FIG. 6-FIG. 12 .
  • the processor 2001 is configured to execute the method steps performed by the database node shown in any one of the foregoing embodiments in FIG. 6 to FIG. 12 .
  • the transceiver 2003 is used for receiving or sending data.
  • the foregoing database nodes shown in FIG. 20 may be chips.
  • the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a program, and when it runs on the computer, the computer executes the above-mentioned embodiment as described in Figure 6- Figure 12. steps in the method.
  • the embodiment of the present application also provides a device management device.
  • the device management device can also be called a digital processing chip or a chip.
  • the chip includes a processing unit and a communication interface.
  • the processing unit obtains program instructions through the communication interface, and the program instructions are executed by the processing unit.
  • the processing unit is configured to execute the method steps shown in any one of the foregoing embodiments in FIG. 6 to FIG. 12 .
  • the embodiment of the present application also provides a digital processing chip.
  • the digital processing chip integrates a circuit and one or more interfaces for realizing the above-mentioned processor or the functions of the processor.
  • the digital processing chip can complete the method steps in any one or more of the foregoing embodiments.
  • no memory is integrated in the digital processing chip, it can be connected to an external memory through a communication interface.
  • the digital processing chip implements the method steps shown in any one of the above-mentioned embodiments in FIG. 6 to FIG. 12 according to the program code stored in the external memory.
  • the embodiment of the present application also provides a computer program product, which, when running on a computer, causes the computer to execute the steps in the method described in the foregoing embodiments shown in FIGS. 6-12 .
  • the device management apparatus may be a chip.
  • the chip includes: a processing unit and a communication unit.
  • the processing unit may be, for example, a processor, and the communication unit may be, for example, an input/output interface, a pin, or a circuit.
  • the processing unit may execute the computer-executable instructions stored in the storage unit, so that the chips in the server execute the methods described in the embodiments shown in FIGS. 6-12 above.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit located outside the chip in the wireless access device, such as only Read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM), etc.
  • ROM Read-only memory
  • RAM random access memory
  • the aforementioned processing unit or processor may be a central processing unit (central processing unit, CPU), a network processor (neural-network processing unit, NPU), a graphics processing unit (graphics processing unit, GPU), digital signal processing (digital signal processor, DSP), application specific integrated circuit (ASIC) or field programmable logic gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor or any conventional processor or the like.
  • the device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be A physical unit can be located in one place, or it can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • the connection relationship between modules indicates that they have communication connections, which can be implemented as one or more communication buses or signal lines.
  • the essence of the technical solution of this application or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, such as a floppy disk of a computer , U disk, mobile hard disk, read only memory (read only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk, etc., including several instructions to make a computer device (which can be a personal A computer, server, or network device, etc.) executes the methods described in various embodiments of the present application.
  • a computer device which can be a personal A computer, server, or network device, etc.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server, or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • wired eg, coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless eg, infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (solid state disk, SSD)), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请公开了一种设备管理方法、***以及装置，通过实现对设备的自动化管理，对设备的数据隐私和安全进行有效保护。该方法包括：第二设备向第一访问控制节点发送身份文件，以指示第一访问控制节点将身份文件保存至文件***中，身份文件中包括第一设备的身份信息以及第二设备的公钥；第二设备接收第一访问控制节点发送的第一标识，第一标识用于从文件***中读取身份文件，第一标识为第一访问控制节点向文件***发送身份文件后由文件***生成，第一访问控制节点在验证第二设备与关联信息中第一设备关联的设备的信息且验证成功后向文件***发送身份文件，关联信息保存在数据库节点和区块链中。

Description

一种设备管理方法、***以及装置
本申请要求于2021年07月22日提交中国专利局、申请号为“202110832257.3”、申请名称为“一种设备管理方法、***以及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及人工智能领域，尤其涉及一种设备管理方法、***以及装置。
背景技术
随着通信网络的发展，接入网络的设备也越来越多。例如，物联网(internet of things，IoT)设备是数字世界的基石，是数字世界与物理世界的接口。负责从物理世界感知信息并发送到数字世界，同时也负责从数字世界接受反馈并执行动作。
常用的基于人工的方式对设备进行身份管理，包括身份的发放，回收，身份的转让等，难以应对海量设备身份管理带来的挑战。因此，如何实现更高效的身份管理是当前面临的重大挑战。
发明内容
本申请提供一种设备管理方法、***以及装置，通过实现对设备的自动化管理，对设备的数据隐私和安全进行有效保护。
有鉴于此，本申请第一方面提供一种设备管理***，包括：第一设备、第二设备、第一访问控制节点、文件***、数据库节点和区块链节点，数据库节点中部署了用于存储数据的数据库；
第二设备，用于向第一访问控制节点发送身份文件，身份文件包括第一设备的身份信息以及第二设备的公钥；
第一访问控制节点，用于基于身份文件向数据库节点请求第一设备的关联信息，关联信息中包括第一设备关联的设备的公钥，关联信息是数据库节点从区块链节点中获取到；
若第一访问控制节点通过关联信息确定第一设备与第二设备关联，则第一访问控制节点，还用于向文件***发送身份文件；
文件***，用于保存身份文件并向第一访问控制节点反馈身份文件对应的第一标识，第一标识用于从文件***中读取身份文件。
本申请实施方式中，数据库节点可以从区块链节点中保存的数据中获取到第一设备的关联信息，该关联信息包括了第一设备关联的设备的信息，相当于第一设备已在区块链服务商进行注册，第一访问控制节点在接收到第一设备的身份文件之后，即可从数据库节点请求第一设备的关联信息并进行验证，在验证成功之后，即可将第一设备的身份文件保存至文件***中，并将文件***反馈的第一标识发送给第二设备，从而使第二设备或者其他设备可以使用该第一标识来从文件***中读取到身份文件。因此，本申请提供的设备管理***中，可以使用访问控制节点来对接入***的设备或者第二设备进行访问控制，验证访问该***的设备的权限，仅当具有访问***的权限时才允许该设备进行进一步处理，如数据存储或者数据读取，从而提高***中的数据传输的隐私安全。
在一种可能的实施方式中，第二设备在向第一访问控制节点发送身份文件之前，还用于向区块链节点发送注册信息，注册信息包括第一设备的公钥以及第二设备的公钥；
区块链节点，用于在对第二设备的公钥验证且验证成功之后，通过与第一设备对应的智能合约将一设备的公钥以及第二设备的公钥写入区块链的交易信息中已对第一设备进行注册；
数据库节点，用于获取区块链节点的交易信息，并将交易信息中包括的第一设备的公钥和第二设备的公钥保存至关联信息。
因此，本申请实施方式中，在第二设备将第一设备的身份文件保存至文件***之前，还在区块链节点中注册该第一设备，使区块链节点可以选择与第一设备匹配的智能合约来将第一设备的信息写入区块链的交易信息中，从而使数据库节点在获取区块链节点的交易信息来生成第一设备的关联信息，该关联信息可以用于指示第一设备关联的设备。从而在后续的流程中，访问控制节点可以根据数据库中保存的关联信息来验证第一设备的归属，提高第一设备的数据的安全性。并且，可以结合区块链的智能合约来自动化地注册第一设备，可以应用于具有海量设备的场景，泛化能力强。
在一种可能的场景中，第二设备，还用于向区块链节点发送第一标识；
区块链节点，还用于通过与第一设备对应的智能合约将第一标识更新至本地保存的第一设备的交易信息中。
因此，本申请实施方式中，第二设备在将第一设备的身份文件保存至文件***之后，还将文件***反馈的第一标识保存至区块链节点，从而使区块链节点通过智能合约将该第一标识保存至第一设备的交易信息从，使数据库节点在再次获取交易信息时，可以将该第一标识更新至第一设备的关联信息中，从而使第一设备的关联信息中具有第一设备的更完整的信息。
在一种可能的场景中，第二设备，还用于向第一访问控制节点发送身份请求消息，身份请求消息中携带第一设备的信息以及第二设备的公钥，身份请求消息用于请求身份文件，该第一设备的信息中可以包括第一设备的公钥、名称或者其他标识等；
第一访问控制节点，还用于获取第一标识；
第一访问控制节点，还用于向文件***发送第一标识，并接收文件***反馈的身份文件；
若身份文件中包括的公钥与第二设备的公钥匹配，则第一访问控制节点，还用于向第二设备发送身份文件。
本申请实施方式中，第二设备还可以向访问控制节点请求第一设备的身份文件，访问控制节点可以对接收到的身份文件中携带的公钥与身份请求消息中携带的公钥进行验证，若匹配，则表示该身份文件对应的设备的归属为第二设备，即可将身份文件传输至第二设备。因此，本申请实施方式中，访问控制节点可以对设备的归属进行验证，从而保证了设备的身份文件的安全性。
在一种可能的场景中，第一设备，还用于向第一访问控制节点发送身份凭证，身份凭证中包括第一设备的标识，以向第一访问控制节点请求身份文件，该第一设备的标识可以 包括第一设备的名称、公钥或者为第一设备分配的唯一标识等；
第一访问控制节点，还用于若对身份凭证验证且验证成功，则向数据库节点发送第二请求消息，第二请求消息包括第一设备的标识；
数据库节点，还用于向第一访问控制节点反馈第一标识；
第一访问控制节点，还用于向文件***发送第一标识，并接收文件***反馈的身份文件；
若身份文件中包括的标识与身份凭证中的标识匹配，则第一访问控制节点，还用于向第一设备发送身份文件。
本申请实施方式中，第一设备可以向访问控制节点查询自身的身份文件，访问控制节点可以对第一设备的身份凭证进行验证，进在验证成功之后才将身份文件发送给第一设备，从而提高第一设备的数据安全性。
在一种可能的实施方式中，设备管理***还包括：注册服务器；
第一设备，具体用于通过加密管道向注册服务器发送身份凭证；
注册服务器，用于通过加密管道向访问控制服务器转发身份凭证；
第一访问控制节点，具体用于在向注册服务器发送身份文件；
注册服务器，具体用于向第一设备转发身份文件。
因此，本申请实施方式中，第一设备和第一访问控制节点之间传输的数据，可以通过与注册服务器之间的加密通道传输，从而提高第一设备和第一访问控制节点之间传输数据的安全性。
在一种可能的实施方式中，设备管理***还包括：第二访问控制节点；
第一设备，用于向第二访问控制节点发送第三请求消息；
第二访问控制节点，用于在对第三请求消息进行验证且验证成功之后，获取身份文件的第二标识；
第二访问控制节点，还用于向第一设备反馈第二标识；
第一设备，还用于当验证第一标识和第二标识匹配时，保存身份文件。
本申请实施方式中，可以在设备管理***中设置多个访问控制节点，在通过第一访问控制节点得到身份文件之后，还可以通过第二访问控制节点获取第二标识。随后验证第一标识和第二标识是否匹配，若匹配则确定该身份文件为正确文件，即可保存该身份文件，从而可以保证得到身份文件的准确性。
在一种可能的实施方式中第一访问控制节点，具体用于向数据库节点发送第一请求消息并接收数据库节点反馈的第一标识，第一请求消息包括第一设备的公钥。
因此，本申请实施方式中，第一访问控制节点可以从数据库中得到第一标识，从而可以基于该第一标识向文件***请求第一设备的身份文件，从而成功获取到身份文件。
在一种可能的实施方式中，该第一标识也可以是由第二设备发送至第一访问控制节点，或者在第一设备的注册过程中，第一访问控制节点可以保存该第一标识，进而在查询身份文件时，可以从本地保存的数据中提取到该第一标识。
在一种可能的实施方式中，设备管理***还包括：第三设备；
第二设备，还用于在身份文件中增加第三设备的信息，得到更新后的身份文件，第三设备的信息中包括第三设备的公钥；
第二设备，还用于向第一访问控制节点发送更新后的身份文件；
第一访问控制节点，还用于向文件***发送更新后的身份文件，并接收文件***反馈的第三标识；
第一访问控制节点，还用于向第二设备发送第三标识；
第二设备，还用于向第三设备发送第三标识，第三标识用于向文件***请求更新后的身份文件；
第二设备，还用于向区块链节点发送更新信息，更新信息中包括第一设备的公钥、第三设备的公钥、以及第三标识；
区块链节点使用更新信息更新交易信息，得到更新后的交易信息；
数据库节点，还用于获取更新后的交易信息，并根据更新后的交易信息更新关联信息，得到更新后的关联信息。
本实施方式中，第二设备可以将第一设备转让给第三设备，第二设备将第三设备的信息写入第一设备的身份文件中，并发送给访问控制节点，以告知区块链节点该第一设备已转让，从而使数据库节点获取区块链节点的交易信息并更新第一设备的关联信息。因此，本申请实施方式中，可以由第二设备通过修改第一设备的身份文件完成设备的转让，无需人工操作，即可完成设备的归属转让。
在一种可能的实施方式中，第一标识为文件***对通过哈希算法对身份文件进行运算得到。
第二方面，本申请提供一种设备管理方法，应用于设备管理***，设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，数据库节点中部署了用于存储数据的数据库，第一设备与第二设备关联，方法包括：
第二设备向第一访问控制节点发送身份文件，以指示第一访问控制节点将身份文件保存至文件***中，身份文件中包括第一设备的公钥以及第二设备的公钥；第二设备接收第一访问控制节点发送的第一标识，第一标识用于从文件***中读取身份文件，其中，第一标识为第一访问控制节点向文件***发送身份文件后由文件***生成，身份文件由第一访问控制节点在验证第二设备与关联信息中第一设备关联的设备的信息且验证成功后向文件***发送，关联信息为第一访问控制节点向区块链节点请求得到，关联信息保存在数据库节点中。
因此，本申请实施方式中，数据库节点可以从区块链节点中保存的数据中获取到第一设备的关联信息，该关联信息包括了第一设备关联的设备的信息，相当于第一设备已在区块链服务商进行注册，第一访问控制节点在接收到第一设备的身份文件之后，即可从数据库节点请求第一设备的关联信息并进行验证，在验证成功之后，即可将第一设备的身份文件保存至文件***中，并将文件***反馈的第一标识发送给第二设备，从而使第二设备或者其他设备可以使用该第一标识来从文件***中读取到身份文件。因此，本申请提供的设备管理方法，可以使用访问控制节点来对接入***的设备或者第二设备进行访问控制，验 证访问该***的设备的权限，仅当具有访问***的权限时才允许该设备进行进一步处理，如数据存储或者数据读取，从而提高***中的数据传输的隐私安全。
在一种可能的实施方式中，在第二设备向第一访问控制节点发送身份文件之前，上述方法还可以包括：第二设备向区块链节点发送注册信息，注册信息包括第一设备的信息(如第一设备的公钥、名称或者其他标识等)以及第二设备的公钥，注册信息用于指示区块链节点通过与第一设备对应的智能合约在第一设备的交易信息中保存第一设备的信息以及第二设备的公钥，交易信息用于数据库节点生成第一设备的关联信息。
因此，本申请实施方式中，在第二设备上传设备的身份文件之前，还可以向区块链节点注册设备，从而使数据库节点具有设备的关联信息，访问控制服务器可以基于设备的关联信息验证第二设备是否具有上传身份文件的权限，从而可以避免无权限设备修改设备的身份文件，提高设备的数据安全性。
在一种可能的实施方式中，上述方法还可以包括：第二设备向区块链节点发送第一标识，以指示区块链节点讲第一标识更新至第一设备的交易信息中。
本申请实施方式中，还可以将指示身份文件的第一通过区块链更新至设备的关联信息中，从而使设备的关联信息包括更完整的信息。
在一种可能的实施方式中，上述方法还可以包括：第二设备向第一访问控制节点发送第一标识；第二设备接收第一访问控制节点发送的身份文件，身份文件为第一访问控制节点通过第一标识向文件***请求得到。
本申请实施方式中，第二设备可以通过第一标识来查询身份文件，使第二设备可以查询到设备的身份文件。
在一种可能的实施方式中，设备管理***还包括：第二访问控制节点；上述方法还可以包括：第二设备向第二访问控制节点发送第三请求消息；第二设备接收第二访问控制节点发送的第二标识；若第二标识和第一标识匹配，则第二设备保存身份文件。
因此，本申请实施方式中，第二设备可以向多个访问控制节点分别请求身份文件以及身份文件对应的标识，当该多个访问控制节点反馈的标识匹配时，即表示接收到的身份文件准确，即可保存准确的身份文件。
在一种可能的实施方式中，上述方法还可以包括：第二设备接收第三设备的信息，第三设备的信息包括第三设备的公钥；第二设备在身份文件中添加第三设备的公钥，得到更新后的身份文件，更新后的身份文件指示第一设备与第三设备关联；第二设备向第一访问控制节点发送更新后的身份文件，以指示第一访问控制节点向文件***发送更新后的身份文件并接收文件***反馈的第三标识；第二设备接收第一访问控制节点发送的第三标识，第三标识用于向文件***请求更新后的身份文件。
因此，本申请实施方式中，当设备自身请求其身份文件时，访问控制节点可以根据请求者的身份凭证来验证设备是否具有访问身份文件的权限，从验证成功之后，即可向请求者反馈身份文件，从而提高设备的身份文件的安全性。
第三方面，本申请提供一种设备管理方法，应用于设备管理***，设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，数据库 节点中部署了用于存储数据的数据库，第一设备与第二设备关联，该方法包括：第一访问控制节点接收第二设备发送的身份文件，身份文件包括第一设备的身份信息以及第二设备的公钥，该身份文件可以指示第一设备与第二设备关联；第一访问控制节点基于身份文件向数据库节点请求第一设备的关联信息，关联信息中包括与第一设备关联的设备的公钥，关联信息是数据库节点从区块链节点中获取到；若第一访问控制节点通过关联信息确定第一设备与第二设备关联，则第一访问控制节点向文件***请求发送身份文件，以指示文件***保存身份文件；第一访问控制节点接收文件***反馈的第一标识，并向第二设备发送第一标识，第一标识用于从文件***中读取身份文件。
因此，本申请实施方式中，数据库节点可以从区块链节点中保存的数据中获取到第一设备的关联信息，该关联信息包括了第一设备关联的设备的信息，相当于第一设备已在区块链服务商进行注册，第一访问控制节点在接收到第一设备的身份文件之后，即可从数据库节点请求第一设备的关联信息并进行验证，在验证成功之后，即可将第一设备的身份文件保存至文件***中，并将文件***反馈的第一标识发送给第二设备，从而使第二设备或者其他设备可以使用该第一标识来从文件***中读取到身份文件。因此，本申请提供的设备管理方法，可以使用访问控制节点来对接入***的设备或者第二设备进行访问控制，验证访问该***的设备的权限，仅当具有访问***的权限时才允许该设备进行进一步处理，如数据存储或者数据读取，从而提高***中的数据传输的隐私安全。
在一种可能的实施方式中，第一访问控制节点基于身份文件向数据库节点请求第一设备的关联信息，可以包括：若第一访问控制节点根据身份文件中携带的签名确定身份文件完整，则基于身份文件向数据库节点请求第一设备的关联信息。
因此，本申请实施方式中，访问控制节点在确定身份文件完整之后，向数据库节点请求设备的关联信息，相当于在确保身份文件完整的情况下，才请求设备的关联信息。
在一种可能的实施方式中，上述方法还可以包括：第一访问控制节点接收第二设备发送身份请求消息，身份请求消息中携带第一设备的公钥以及第二设备的公钥，身份请求消息用于请求身份文件；第一访问控制节点向数据库节点发送第一请求消息，第一请求消息包括第一设备的信息，如第一设备的公钥、名称或者其他标识等；第一访问控制节点接收数据库节点发送的第一标识；第一访问控制节点向文件***发送第一标识，并接收文件***反馈的身份文件；若身份文件中包括的公钥与第二设备的公钥匹配，则第一访问控制节点向第二设备发送身份文件。
因此，本申请实施方式中，访问控制节点可以向数据库节点请求第一标识，从而可以基于该第一标识来从文件***中读取到身份文件。
在一种可能的实施方式中，上述方法还可以包括：第一访问控制节点接收第一设备发送的身份凭证，身份凭证中包括第一设备的标识；第一访问控制节点对身份凭证验证；若身份凭证验证成功，则第一访问控制节点向数据库节点发送第二请求消息，第二请求消息包括第一设备的标识；第一访问控制节点接收数据库节点发送的第一标识；第一访问控制节点向文件***发送第一标识，并接收文件***反馈的身份文件；若身份文件中包括的标识与第一设备的公钥标识，则第一访问控制节点向第一设备发送身份文件。
因此，本申请实施方式中，访问控制节点可以对设备查询自身的身份文件进行访问控制，在对身份凭证验证成功之后才将身份文件传输给设备，提高设备的数据安全性。
在一种可能的实施方式中，设备管理***还包括：注册服务器；
第一访问控制节点接收第一设备发送的身份凭证，包括：第一访问控制节点接收注册服务器转发的身份凭证，身份凭证由第一设备通过与注册服务器之间的加密管道发送至注册服务器；
第一访问控制节点向第一设备发送身份文件，可以包括：第一访问控制节点通过注册服务器向第一设备发送身份文件。
因此，本申请实施方式中，第一设备和第一访问控制节点之间传输的数据，可以通过与注册服务器之间的加密通道传输，从而提高第一设备和第一访问控制节点之间传输数据的安全性。
在一种可能的实施方式中，上述方法还可以包括：第一访问控制节点接收第二设备发送的更新后的身份文件；第一访问控制节点向文件***发送更新后的身份文件，并接收文件***反馈的第三标识；第一访问控制节点向第二设备发送第三标识，第三标识用于请求更新后的身份文件。
本实施方式中，第二设备可以将第一设备转让给第三设备，第二设备将第三设备的信息写入第一设备的身份文件中，并发送给访问控制节点，以告知区块链节点该第一设备已转让，从而使数据库节点获取区块链节点的交易信息并更新第一设备的关联信息。因此，本申请实施方式中，可以由第二设备通过修改第一设备的身份文件完成设备的转让，无需人工操作，即可完成设备的归属转让。
第四方面，本申请提供一种设备管理方法，应用于设备管理***，设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，数据库节点中部署了用于存储数据的数据库，第一设备与第二设备关联，方法包括：区块链节点接收第二设备发送的注册信息，注册信息包括第一设备的公钥以及第二设备的公钥；区块链节点通过与第一设备对应的智能合约将第一设备的公钥以及第二设备的公钥写入区块链的交易信息中，以使数据库节点获取区块链节点的交易信息后，将交易信息中包括的第一设备的公钥和第二设备的公钥保存至第一设备的关联信息中，关联信息包括与第一设备关联的设备的信息。
本申请实施方式中，数据库节点可以从区块链节点中保存的数据中获取到第一设备的关联信息，该关联信息包括了第一设备关联的设备的信息，相当于第一设备已在区块链服务商进行注册，第一访问控制节点在接收到第一设备的身份文件之后，即可从数据库节点请求第一设备的关联信息并进行验证，在验证成功之后，即可将第一设备的身份文件保存至文件***中，并将文件***反馈的第一标识发送给第二设备，从而使第二设备或者其他设备可以使用该第一标识来从文件***中读取到身份文件。因此，本申请提供的设备管理***中，可以使用访问控制节点来对接入***的设备或者第二设备进行访问控制，验证访问该***的设备的权限，仅当具有访问***的权限时才允许该设备进行进一步处理，如数据存储或者数据读取，从而提高***中的数据传输的隐私安全。
在一种可能的实施方式中，上述方法还可以包括：区块链节点接收第一标识，第一标识用于请求第一设备的身份文件，第一标识为文件***在保存身份文件后生成；区块链节点通过与第一设备对应的智能合约将第一标识写入第一设备的交易信息中，以使数据库节点获取区块链节点的交易信息后将第一标识保存至关联信息中。
因此，本申请实施方式中，在第二设备将第一设备的身份文件保存至文件***之前，还在区块链节点中注册该第一设备，使区块链节点可以选择与第一设备匹配的智能合约来将第一设备的信息写入区块链的交易信息中，从而使数据库节点在获取区块链节点的交易信息来生成第一设备的关联信息，该关联信息可以用于指示第一设备关联的设备。从而在后续的流程中，访问控制节点可以根据数据库中保存的关联信息来验证第一设备的归属，提高第一设备的数据的安全性。并且，可以结合区块链的智能合约来自动化地注册第一设备，可以应用于具有海量设备的场景，泛化能力强。
第五方面，本申请提供一种设备管理方法，应用于设备管理***，设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，数据库节点中部署了用于存储数据的数据库，第一设备与第二设备关联，方法包括：数据库节点获取区块链节点的区块链中的交易信息；数据库节点将交易信息中包括的第一设备的公钥和第二设备的公钥保存至第一设备的关联信息中，关联信息用于指示第一设备关联的设备的信息。
本申请实施方式中，数据库节点可以从区块链节点中保存的数据中获取到第一设备的关联信息，该关联信息包括了第一设备关联的设备的信息，相当于第一设备已在区块链服务商进行注册，第一访问控制节点在接收到第一设备的身份文件之后，即可从数据库节点请求第一设备的关联信息并进行验证，在验证成功之后，即可将第一设备的身份文件保存至文件***中，并将文件***反馈的第一标识发送给第二设备，从而使第二设备或者其他设备可以使用该第一标识来从文件***中读取到身份文件。因此，本申请提供的设备管理***中，可以使用访问控制节点来对接入***的设备或者第二设备进行访问控制，验证访问该***的设备的权限，仅当具有访问***的权限时才允许该设备进行进一步处理，如数据存储或者数据读取，从而提高***中的数据传输的隐私安全。
在一种可能的实施方式中，上述方法还可以包括：数据库节点接收第一访问控制节点发送的归属请求消息，归属请求消息中携带第一设备的标识；数据库节点根据第一设备的标识向第一访问控制节点发送第一设备的关联信息。
因此，本申请实施方式中，数据库节点接收到归属请求消息之后，根据该消息中携带的设备的公钥查找对应的关联信息，并反馈给访问控制节点。
第六方面，本申请实施例提供一种第二设备，该第二设备具有实现上述第二方面设备管理方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第七方面，本申请实施例提供一种访问控制节点，该访问控制节点具有实现上述第三方面设备管理方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第八方面，本申请实施例提供一种区块链节点，该区块链节点具有实现上述第四方面设备管理方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第九方面，本申请实施例提供一种数据库节点，该数据库节点具有实现上述第五方面设备管理方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第十方面，本申请实施例提供一种第二设备，包括：处理器和存储器，其中，处理器和存储器通过线路互联，处理器调用存储器中的程序代码用于执行上述第二方面任一项所示的设备管理方法中与处理相关的功能。可选地，该第二设备可以是芯片。
第十一方面，本申请实施例提供一种访问控制节点，包括：处理器和存储器，其中，处理器和存储器通过线路互联，处理器调用存储器中的程序代码用于执行上述第三方面任一项所示的设备管理方法中与处理相关的功能。可选地，该访问控制节点可以是芯片。
第十二方面，本申请实施例提供一种区块链节点，包括：处理器和存储器，其中，处理器和存储器通过线路互联，处理器调用存储器中的程序代码用于执行上述第四方面任一项所示的设备管理方法中与处理相关的功能。可选地，该区块链节点可以是芯片。
第十三方面，本申请实施例提供一种数据库节点，包括：处理器和存储器，其中，处理器和存储器通过线路互联，处理器调用存储器中的程序代码用于执行上述第五方面任一项所示的设备管理方法中与处理相关的功能。可选地，该数据库节点可以是芯片。
第十四方面，本申请实施例提供了一种装置，该装置也可以称为数字处理芯片或者芯片，芯片包括处理单元和通信接口，处理单元通过通信接口获取程序指令，程序指令被处理单元执行，处理单元用于执行如上述第二方面至第五方面任一可选实施方式中与处理相关的功能。
第十五方面，本申请实施例提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行上述第一方面至第五方面任一可选实施方式中的方法。
第十六方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面至第五方面任一可选实施方式中的方法。
附图说明
图1为本申请提供的一种设备管理***的结构示意图；
图2为本申请提供的另一种设备管理***的结构示意图；
图3为本申请提供的另一种设备管理***的结构示意图；
图4为本申请提供的另一种设备管理***的结构示意图；
图5为本申请提供的另一种设备管理***的结构示意图；
图6为本申请提供的一种设备管理方法的流程示意图；
图7为本申请提供的另一种设备管理方法的流程示意图；
图8为本申请提供的另一种设备管理方法的流程示意图；
图9为本申请提供的另一种设备管理方法的流程示意图；
图10为本申请提供的另一种设备管理方法的流程示意图；
图11为本申请提供的另一种设备管理方法的流程示意图；
图12为本申请提供的另一种设备管理方法的流程示意图；
图13为本申请提供的一种第二设备的结构示意图；
图14为本申请提供的一种访问控制节点的结构示意图；
图15为本申请提供的一种区块链节点的结构示意图；
图16为本申请提供的一种数据库节点的结构示意图；
图17为本申请提供的另一种第二设备的结构示意图；
图18为本申请提供的另一种访问控制节点的结构示意图；
图19为本申请提供的另一种区块链节点的结构示意图；
图20为本申请提供的另一种数据库节点的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请提供的***和方法可以适应各种通信网络，接入通信网络的设备将大量增加，因此实现接入网络的设备的管理成为重要课题。
例如，一些常用的方式中，基于人工的方式对设备进行身份管理，包括身份的发放，回收，身份的转让等，难以应对海量设备身份管理带来的挑战。可以通过一些平台来支持设备自动获取启动身份，但这些平台都是私有平台，协议和平台都是私有的，开放性不足，小规模的设备生产厂商难以复制，同时对使用者的也要求比较高，因此难以大规模推广。
又例如，为了克服专有平台的不足，需要制定物联网设备零接触入网标准，如启动密钥安全获取框架(Bootstrapping Remote Secure Key Infrastructures，BRSKI)，厂商生产设备时只要遵循了该标准，当使用者也遵循标准部署了设备后，则设备在第一次接入网络时可自动获取设备身份，购买者对设备进行提前配置。但是该标准也有缺陷，每个厂商都需要部署一套身份管理平台，同时要与多个厂商对接。因此，在费用和生态构建方面都面临挑战，泛化能力弱。
在本申请提供的场景中，多个厂商，运营商，云服务厂商可以使用区块链技术，共同构建一个公共的身份管理平台，通过身份管理平台实现设备初始化身份的发放，归属转移等功能。
区块链由一系列不断增长的记录组成，这些记录成为区块(Block)。这些区块通过密码学技术链接再一起，每一个区块包含前一个区块的哈希值，时间戳，和交易数据等。区块链本质上是一个分布式多备份的数据库，但是与数据库最大的不同之处是数据的存储是通过多方共识形成，并使用哈希链对历史数据进行保护，从而使得数据不可篡改。与传统的数据库技术相比，区块链数据不可以篡改的特征更容易获得用户的信任，因而能够更 好地支持多方合作。区块链技术的另一个特征是支持智能合约，智能合约是一段在区块链上自动执行的计算机程序。使用智能合约可以减少交易的中间环节，实现交易自动化。
星际文件***(inter planet file System，IPFS)协议是一种文件存储和内容分发网络协议，整合了多种分布式***，为用户提供统一的可寻址数据存储。IPFS本质是一个P2P的分布式存储***，通过基于文件内容生成的唯一编码去访问网络中的文件资源。IPFS可以与去中心化的区块链技术相结合，解决中心化互联网架构下数据存储的安全性、用户协作的时效性和存储与带宽成本的问题。IPFS***采用了的冗余备份技术是Erasure coding(EC，纠删码)。n份原始数据，增加m份校验数据，可以通过n+m份数据中的任意n份数据来恢复原始数据，也就是可容忍的最大失效的数据数量为m。
在一些数据存储的场景中，可以使用区块链和IPFS进行文件存储，区块链***主要用来存储文件哈希和文件共享的group ID，IPFS***则负责存储文件。同时，***引入了一个关键节点，IPFS_Proxy，然而，IPFS_Proxy可以获取用户存储的文件信息，同时，文件记录上链的能力也依赖于IPFS_Proxy。IPFS_Proxy的权力过大容易造成***安全风险，如数据内容泄露等威胁。
因此，本申请提供一种设备管理***以及设备管理方法，用于结合区块链的智能合约自动化完成设备的接入，可以适用于海量接入设备的场景，且更有利于数据隐私保护。
首先，本申请提供的设备管理***以及设备管理方法可以应用于各种具有多个接入设备的通信网络，如分布式网络、物联网等。本申请示例性地，以物联网为例进行示例性说明。
通常，当前的物联网设备在生产并销售给客户后，需要客户通过手工配置向设备颁发身份，比如从运营商购买SIM卡并***设备上SIM卡槽，然后设备才能以上述身份接入网络。本申请通过为设备制造商，用户，运营商，设备等提供可信的身份信息共享平台，实现设备自动获取入网和业务身份，归属确认等，实现设备的零接触入网。
示例性地，本申请提供的设备管理***如图1所示，厂商在制造设备之后，可以在设备中植入设备的身份，厂商可以向设备管理平台注册或者转让设备的归属。设备的拥有者和设备本身都可以从设备管理平台获取设备的身份文件。
设备可以由厂商转让给用户，用户可以向设备管理管理平台提供用户自身的身份信息，设备管理平台即可在设备的关联信息中将设备的拥有者更新为用户。可以由设备的拥有者，如用户向运营商或者IoT服务器购买服务，如设备可以通过运营商提来接入网络，可以通过IoT服务商上传数据等。
其中，各个设备之间可以通过有限或者无线网络进行通信，如第五代移动通信技术(5th-Generation，5G)***，长期演进(long term evolution，LTE)***、全球移动通信***(global system for mobile communication，GSM)或码分多址(code division multiple access，CDMA)网络、宽带码分多址(wideband code division multiple access，WCDMA)网络、无线保真(wireless fidelity，WiFi)、蓝牙(bluetooth)、紫蜂协议(Zigbee)、射频识别技术(radio frequency identification，RFID)、远程(Long Range，Lora)无线通信、近距离无线通信(near field communication，NFC)中的任意一种或多种的组合 等。
示例性地，该设备管理平台的功能可以如图2所示。
其中，该设备管理平台可以分为多个部分，如可以分为区块链部分、IPFS存储部分(图2中未示出)、数据库部分以及访问控制部分。
区块链部分：通常，设备管理平台上保存的身份文件是设备管理的核心，因此，必须保证信息是可信的。因此，本申请通过采用区块链的不可篡改特性保证共享平台上记录的设备信息的可信属性，使用智能合约确保关键数据记录到区块链上。
IPFS部分：为了克服区块链的存储能力的限制，本申请可以使用IPFS去中心化文件***来存储色板的身份文件，而使用区块链保存设备的身份标识，归属以及身份文件的哈希值等占用存储较少的数据，从而实现数据的合理分布，最大化利用各个部分的资源。
数据库部分：为了确保身份信息的正确性，本申请使用了去中心化的数据库***过滤设备信息的正确性。多个节点运行独立的数据库，用于保存从数据库上获取的设备身份信息。数据库信息来源于区块链上的存储的设备身份管理信息。数据的***不依赖于人工修改，实现效率高，且避免了人工误差，使各个设备的数据更可靠。
访问控制部分：为了确保数据的隐私性，本申请通过设置访问控制，使仅具有访问权限的用户才能访问设备的身份文件。
参阅图3，本申请提供的一种设备管理***的结构示意图。
该设备管理***可以包括第一设备31、第二设备32、第一访问控制节点33、文件***34、数据库节点35和区块链节点36。
其中，第二设备32，用于向第一访问控制节点33发送身份文件，身份文件包括第一设备31的身份信息以及第二设备32的公钥；
第一访问控制节点33，用于基于身份文件向数据库节点35请求第一设备31的关联信息，关联信息中包括第一设备31关联的设备的公钥，关联信息是数据库节点35从区块链节点36中获取到；
若第一访问控制节点33通过关联信息确定第一设备31与第二设备32关联，则第一访问控制节点33，还用于向文件***34请求发送身份文件；
文件***34，用于保存身份文件并向第一访问控制节点33反馈身份文件对应的第一标识，第一标识用于从文件***34中读取身份文件。
本申请实施方式中，数据库节点可以从区块链节点中保存的数据中获取到第一设备的关联信息，该关联信息包括了第一设备关联的设备的信息，相当于第一设备已在区块链服务商进行注册，第一访问控制节点在接收到第一设备的身份文件之后，即可从数据库节点请求第一设备的关联信息并进行验证，在验证成功之后，即可将第一设备的身份文件保存至文件***中，并将文件***反馈的第一标识发送给第二设备，从而使第二设备或者其他设备可以使用该第一标识来从文件***中读取到身份文件。因此，本申请提供的设备管理***中，可以使用访问控制节点来对接入***的设备或者第二设备进行访问控制，验证访问该***的设备的权限，仅当具有访问***的权限时才允许该设备进行进一步处理，如数据存储或者数据读取，从而提高***中的数据传输的隐私安全。
在一种可能的场景中，第二设备32在向第一访问控制节点33发送身份文件之前，还用于向区块链节点36发送注册信息，注册信息包括第一设备31的公钥以及第二设备32的公钥；
区块链节点36，用于通过与第一设备31对应的智能合约将一设备的公钥以及第二设备32的公钥写入区块链的交易信息中以对第一设备进行注册；
数据库节点35，用于获取区块链节点36的交易信息，并将交易信息中包括的第一设备31的公钥和第二设备32的公钥保存至关联信息。
因此，本申请实施方式中，在第二设备将第一设备的身份文件保存至文件***之前，还在区块链节点中注册该第一设备，使区块链节点可以选择与第一设备匹配的智能合约来将第一设备的信息写入区块链的交易信息中，从而使数据库节点在获取区块链节点的交易信息来生成第一设备的关联信息，该关联信息可以包括与第一设备关联的设备的信息。从而在后续的流程中，访问控制节点可以根据数据库中保存的关联信息来验证第一设备的归属，提高第一设备的数据的安全性。并且，可以结合区块链的智能合约来自动化地注册第一设备，可以应用于具有海量设备的场景，泛化能力强。
在一种可能的场景中，第二设备32还用于向区块链节点36发送第一标识；
区块链节点36还用于通过与第一设备对应的智能合约将第一标识更新至本地保存的第一设备31的交易信息中。
因此，本申请实施方式中，第二设备在将第一设备的身份文件保存至文件***之后，还将文件***反馈的第一标识保存至区块链节点，从而使区块链节点通过智能合约将该第一标识保存至第一设备的交易信息中，使数据库节点在再次获取交易信息时，可以将该第一标识更新至第一设备的关联信息中，从而使第一设备的关联信息中具有第一设备的更完整的信息。
在一种可能的场景中，第二设备32，还用于向第一访问控制节点33发送身份请求消息，身份请求消息中携带第一设备31的信息(如第一设备的公钥、名称、序列号或者其他标识等信息)以及第二设备32的公钥，身份请求消息用于请求身份文件；
第一访问控制节点33，还用于向数据库节点35发送第一请求消息，第一请求消息包括第一设备31的信息；
数据库节点35，还用于向第一访问控制节点33反馈第一标识；
第一访问控制节点33，还用于向文件***34发送第一标识，并接收文件***34反馈的身份文件；
若身份文件中包括的公钥与第二设备32的公钥匹配，则第一访问控制节点33，还用于向第二设备32发送身份文件。
本申请实施方式中，第二设备还可以向访问控制节点请求第一设备的身份文件，访问控制节点可以对接收到的身份文件中携带的公钥与身份请求消息中携带的公钥进行验证，若匹配，则表示该身份文件对应的设备的归属为第二设备，即可将身份文件传输至第二设备。因此，本申请实施方式中，访问控制节点可以对设备的归属进行验证，从而保证了设备的身份文件的安全性。
在一种可能的场景中，第一设备31，还用于向第一访问控制节点33发送身份凭证，身份凭证中包括第一设备31的公钥，以向第一访问控制节点33请求身份文件；
第一访问控制节点33，还用于若对身份凭证验证且验证成功，则向数据库节点35发送第二请求消息，第二请求消息包括第一设备31的标识(如第一设备的公钥、名称、序列号或者为第一设备分配的唯一标识等)；
数据库节点35，还用于向第一访问控制节点33反馈第一标识；
第一访问控制节点33，还用于向文件***34发送第一标识，并接收文件***34反馈的身份文件；
若身份文件中包括的标识与身份凭证中包括的标识匹配，则第一访问控制节点33，还用于向第一设备31发送身份文件。
本申请实施方式中，第一设备可以向访问控制节点查询自身的身份文件，访问控制节点可以对第一设备的身份凭证进行验证，进在验证成功之后才将身份文件发送给第一设备，从而提高第一设备的数据安全性。
在一种可能的实施方式中，第一访问控制节点33，具体用于向所述数据库节点发送第一请求消息并接收所述数据库节点反馈的所述第一标识，所述第一请求消息包括所述第一设备的公钥。
因此，本申请实施方式中，第一访问控制节点可以从数据库中得到第一标识，从而可以基于该第一标识向文件***请求第一设备的身份文件，从而成功获取到身份文件。
当然该第一标识也可以是由第二设备发送至第一访问控制节点，或者在第一设备的注册过程中，第一访问控制节点可以保存该第一标识，进而在查询身份文件时，可以从本地保存的数据中提取到该第一标识。
在一种可能的实施方式中，设备管理***还包括：注册服务器；
第一设备31，具体用于通过加密管道向注册服务器发送身份凭证；
注册服务器，用于通过加密管道向访问控制服务器转发身份凭证；
第一访问控制节点33，具体用于在向注册服务器发送身份文件；
注册服务器，具体用于向第一设备31转发身份文件。
因此，本申请实施方式中，第一设备和第一访问控制节点之间传输的数据，可以通过与注册服务器之间的加密通道传输，从而提高第一设备和第一访问控制节点之间传输数据的安全性。
在一种可能的场景中，设备管理***还包括：第二访问控制节点；
第一设备31，用于向第二访问控制节点发送第三请求消息；
第二访问控制节点，用于基于在对第三请求消息进行验证且验证成功之后，获取身份文件的第二标识；
第二访问控制节点，还用于向第一设备31反馈第二标识；
第一设备31，还用于当验证身第一标识和第二标识匹配时，保存身份文件。
本申请实施方式中，可以在设备管理***中设置多个访问控制节点，在通过第一访问控制节点得到身份文件之后，还可以通过第二访问控制节点获取第二标识。随后验证第一 标识和第二标识是否匹配，若匹配则确定该身份文件为正确文件，即可保存该身份文件，从而可以保证得到身份文件的准确性。
在一种可能的场景中，设备管理***还包括：第三设备；
第二设备32，还用于在身份文件中增加第三设备的信息，得到更新后的身份文件，第三设备的信息中可以包括第三设备的公钥，更新后的身份文件指示第一设备与第三设备关联，即第一设备所关联的设备由第二设备转换为第三设备；
第二设备32，还用于向第一访问控制节点33发送更新后的身份文件；
第一访问控制节点33，还用于向文件***34发送更新后的身份文件，并接收文件***34反馈的第三标识；
第一访问控制节点33，还用于向第二设备32发送第三标识；
第二设备32，还用于向第三设备发送第三标识，第三标识用于向文件***34请求更新后的身份文件；
第二设备32，还用于向区块链节点36发送更新信息，更新信息中包括第一设备31的公钥、第三设备的公钥、以及第三标识；
区块链节点36使用更新信息更新交易信息，得到更新后的交易信息；
数据库节点35，还用于获取更新后的交易信息，并根据更新后的交易信息更新关联信息，得到更新后的关联信息。
本实施方式中，第二设备可以将第一设备转让给第三设备，第二设备将第三设备的信息写入第一设备的身份文件中，并发送给访问控制节点，以告知区块链节点该第一设备已转让，从而使数据库节点获取区块链节点的交易信息并更新第一设备的关联信息。因此，本申请实施方式中，可以由第二设备通过修改第一设备的身份文件完成设备的转让，无需人工操作，即可完成设备的归属转让。
在一种可能的实施方式中，第一标识为文件***对通过哈希算法对身份文件进行运算得到。
为便于理解，以文件***为IPFS为例，对本申请提供的设备管理***进行示例性介绍。参阅图4，本申请提供的另一种设备管理***的结构示意图。
其中，访问控制节点、IPFS、数据库以及区块链节点等可以组成设备管理平台，为设备以及设备归属者提供认证、身份管理等服务。
下面分别对各个设备的功能或者所提供的服务进行介绍。
1、设备(即第一设备)
设备主要需要进行认证以及信息查询。
认证：可以使用预先植入的密钥如X.509证书或者IBS公钥对应的私钥，产生签名，与外部节点如访问控制***进行认证，同时也确认外部节点是设备授权访问的节点，例如外部节点的域名或者IP地址是设备生产时植入的域名或者IP地址。
信息查询：从访问控制节点获取设备的身份信息。
2、归属设备(即第二设备，或者称为设备拥有者)
归属设备与设备关联的设备，可以是服务器或者终端，或者通过其他方式，如网页、 APP等为用户提供的服务等。
归属设备通常需要进行认证、信息查询、信息存储、设备注册或者归属更新等。
认证：可以使用预先生成的私钥产生签名，与外部节点如访问控制节点进行认证，同时也确认外部设备是否为授权访问的设备。
信息查询：可以负责协助其他设备从访问控制节点获取到设备的身份文件。
信息存储：可以向访问控制节点发送设备的身份文件。
设备注册和归属更新：可以调用部署于区块链节点的智能合约，写入设备的归属、身份文件或者身份文件的哈希值等信息。
3、访问控制节点
可以用于对访问前述的设备控制平台的设备进行访问控制，对接入设备控制平台的设备进行认证，或者进行信息查询等，例如：
认证与访问控制：可以确认设备或者归属设备的身份，同时也通过使用自身控制的私钥进行签名，向设备或者归属设备证明自身的身份。
信息查询：可以从IPFS获取设备的身份文件，在接收到查询者的身份查询请求，并确认查询者的具有访问该身份文件的权限之后，即可将身份文件反馈给查询者。
信息上传：可以接收设备拥有者发送的设备的身份文件，并在确定设备拥有者具有更新或者上传设备的身份文件的权限后，向IPFS写入该身份文件，并向设备拥有者反馈IPFS返回的文件验证码，如哈希值或者其他方式生成的地址等。
设备归属确认：可以向数据库发起归属查询请求，查询设备的关联信息，设备的哈希值等信息，从而确定设备的归属。
4、数据库节点
可以用于对设备的信息进行***或者信息查询等。
设备信息过滤与***：可以从区块链节点中提取与设备的身份相关的交易信息，并将该交易信息保存至数据库中。通常，若数据库中已存在该设备的关联信息，则在获取到交易信息中包括设备的身份相关的信息之后，即可更新设备的关联信息。若数据库中不存在设备的关联信息，则在获取到交易信息中包括设备的身份相关的信息之后生成设备的关联信息。在将数据***至数据库中时，需要确认交易记录的发起方是否为设备的拥有者，若是，则更新设备的关联信息，若否，则不更新设备的关联信息。
设备信息查询：若设备或者设备拥有者等查询设备的身份文件时，数据库节点可以向访问控制节点提供设备的身份文件。
5、区块链节点
可以用于进行设备的注册与信息更新等。可以负责与区块链节点上部署的智能合约模块进行交互，选择与设备匹配或者与生产设备的厂商匹配的智能合约，进行设备的注册，将设备的信息、身份文件的哈希值以及更新的设备的归属者的信息等写入区块链中。
示例性地，本申请提供的设备管理***的部署方式可以参阅图5。
其中，该设备管理***中包括了N个节点，都包括了区块链节点、IPFS、数据库节点(DB)和访问控制节点，各个节点通过有线或者无线网络连接。
因此，本申请提供了一种去中心化的设备管理***，通过多个独立运行的节点实现了设备管理的功能，如设备注册、信息更新、身份验证或者信息查询等。通过智能合约来实现设备的管理，泛化能力强，可以适用于多种场景。且通过访问控制节点来对查询设备的数据的查询者的权限进行验证，可以提高设备的数据安全性。
前述对本申请提供的设备管理***的架构进行了介绍，下面结合本申请提供的设备管理***以及设备管理方法的流程进行更详细地介绍。
参阅图6，本申请提供的一种设备管理方法的流程示意图，如下所述。
601、第二设备向第一访问控制节点发送身份文件。
其中，该第二设备为第一设备关联的用户，即第一设备的拥有者，该用户可以承载于服务器或者终端。例如，本申请提供的设备管理***可以通过客户端的形式为用户提供服务，用户可以在本地PC端登录账户，即可将本地的客户端作为第二设备。又例如，本申请提供的设备管理***可以通过安装在用户终端上的APP为用户提供服务，用户可以在APP上对用户所拥有的设备进行注册或者身份查询等，即可将该终端作为第二设备。
该身份文件中可以包括第一设备的身份信息和/或第二设备的信息等。第一设备的身份信息可以包括如第一设备的公钥、名称、序列号、地址或者为第一设备分配的唯一标识等；该第二设备的信息如第二设备的公钥、名称、唯一标识或者地址等。
且该身份文件可以指示第一设备与第二设备关联，例如，第二设备可以是承载了用户的账户的设备，用户在购买第一设备之后，即第二设备归属于用户，用户可以在账户中绑定第一设备，即通过在第一设备的身份文件中添加第二设备的信息并上传至设备管理平台，以在平台上将第一设备与第二设备关联起来。
在一种可能的实施方式中，第二设备在向第一访问控制节点发送身份文件之前，还向区块链节点发送注册信息，该注册信息中可以包括第一设备的信息和第二设备的信息，如第一设备的公钥、唯一标识或者序列号等，以及第二设备的公钥、唯一标识或者序列号等；区块链节点在通过与第一设备对应的智能合约将一设备的信息以及第二设备的公钥写入区块链的交易信息中以对第一设备进行注册，与第一设备对应的智能合约可以指示第一设备的注册方式，每个设备对应的智能合约可以通过预先设置的映射关系来确定；数据库节点获取区块链节点的交易信息，并将交易信息中包括的第一设备的公钥和第二设备的公钥保存至关联信息，从而完成第一设备的注册。
其中，智能合约是一种旨在以信息化方式传播、验证或执行合同的计算机协议。智能合约允许在没有第三方的情况下进行可信交易，这些交易可追踪且不可逆转。区块链节点中可以预先设置多种智能合约，每个厂商或者每个设备可能对象相同或者不同的智能合约，该智能合约可以指示设备的注册方式、交易方式或者数据保存格式等。本申请实施方式中，可以通过智能合约的方式，使本申请提供的方法以及***可以适应更多的场景，兼容更多不同厂商生产的设备，具有很强的泛化能力。
例如，在厂商生产设备之后，即可在设备管理***中注册该第一设备，由厂商(即第二设备)向区块链节点发送注册信息，区块链节点确定与该第一设备匹配的智能合约，并通过智能合约将第一设备的信息写入区块中，数据库节点在获取区块链的交易信息时，将 生成第一设备的关联信息，其中包括第一设备的信息以及第一设备所关联的设备的信息等，从而使访问控制节点可以基于数据库中保存的第一设备的关联信息来获知第一设备的归属，从而确定具有更新或者查询第一设备的信息的权限的设备。
602、第一访问控制节点向数据库节点请求第一设备的关联信息。
第一访问控制节点在接收到第二设备发送的身份文件之后，即可向数据库节点发送归属请求消息，以向数据库节点请求第一设备的关联信息，该关联信息中包括了第一设备关联的设备的信息，第一访问控制节点可以通过该关联信息来获知第一设备关联的设备的信息。
例如，该关联信息中可以包括第一设备的信息以及第二设备的信息，如第一设备的名称、序列号、公钥或者其哈希值、第二设备的证书、公钥或者其哈希值等。
603、第一访问控制节点验证第二设备的权限。
第一访问控制节点在从数据库节点得到第一设备的关联信息之后，即可获知第一设备关联的设备的信息，如公钥、名称或者其他标识等信息，并判断第二设备是否与第一设备关联。若确定第一设备与第二设备关联，则表示第二设备具有上传第一设备的身份文件的权限。若确定第二设备与第一设备不关联，则表示第二设备不具有上传第一设备的身份文件的权限，此时可以丢弃第二设备发送的身份文件。
例如，若关联信息中所包括的拥有者的公钥与第二设备的公钥相同，即可确定第一设备与第二设备关联，若关联信息中所包括的拥有者的公钥与第二设备的公钥不相同，则确定第一设备的与第二设备不关联，此时可以丢弃接收到的身份文件。
604、若验证成功，则第一访问控制节点向文件***发送身份文件。
其中，若第一访问控制节点确定第一设备与第二设备关联，则可以访问控制节点确定该第二设备可以上传第一设备的身份文件，即可向文件***发送身份文件，以在文件***中保存该身份文件。
605、文件***保存身份文件。
文件***在接收到第一访问控制节点发送的身份文件之后，即保存该身份文件。
具体地，该文件***可以是部署于服务器上的文件***，可以是分布式存储***，也可以是集中式存储***。在接收到身份文件之后，即可在文件***中保存该身份文件。
606、文件***向第一访问控制节点反馈身份文件对应的第一标识。
文件***在保存了第一设备的身份文件之后，可以生成该身份文件的第一标识并反馈给第一访问控制节点。
该第一标识可以是身份文件在文件***中的保存地址，也可以是根据该身份文件的保存地址生成的标识，还可以是根据身份文件的内容所生成的标识等。示例性地，生成该第一标识的方式有多种，具体可以根据哈希算法，如信息摘要算法(message-digest algorithm，MD4)、MD5、安全散列算法(secure Hash algorithm，SHA)等，如将身份文件的保存地址作为上述算法的输入，即可输出第一标识，或者，将身份文件的内容作为上述算法的输入，输出第一标识。
为便于理理解，本申请以下实施方式中，以该第一标识为哈希值进行示例性说明，即 以下所提及的第一标识、第二标识或者第三标识等可以是通过前述的算法得到的标识，以下仅以哈希值为例进行示例性说明。
607、第一访问控制节点向第二设备反馈第一标识。
第一访问控制节点在接收到第一标识之后，即可将该第一标识反馈至第二设备，以使该第二设备后续可以凭借该第一标识向第一访问控制节点请求查询该身份文件。
因此，本申请实施方式中，数据库节点可以从区块链节点中保存的数据中获取到第一设备的关联信息，该关联信息包括了第一设备关联的设备的信息，相当于第一设备已在区块链服务商进行注册，第一访问控制节点在接收到第一设备的身份文件之后，即可从数据库节点请求第一设备的关联信息并进行验证，在验证成功之后，即可将第一设备的身份文件保存至文件***中，并将文件***反馈的第一标识发送给第二设备，从而使第二设备或者其他设备可以使用该第一标识来从文件***中读取到身份文件。因此，本申请提供的设备管理方法，可以使用访问控制节点来对接入***的设备或者归属设备进行访问控制，验证访问该***的设备的权限，仅当具有访问***的权限时才允许该设备进行进一步处理，如数据存储或者数据读取，从而提高***中的数据传输的隐私安全。
在一种可能的实施方式中，第二设备还向区块链节点发送第一标识；区块链节点通过智能合约将第一标识记录到第一设备的交易信息中，数据库节点可以定期获取交易信息，或者在检测到交易信息更新后获取交易信息，从而将交易信息中第一设备的信息更新至第一设备的关联信息中，即将该第一标识更新至第一设备的关联信息中，从而得到完整的第一设备的关联信息。
在一种可能的实施方式中，第二设备还可以向第一访问控制节点发送身份请求消息，身份请求消息中携带第一设备的信息以及第二设备的公钥，身份请求消息请求身份文件；第一访问控制节点还可以获取第一标识并向文件***发送第一标识，以接收文件***反馈的身份文件；若身份文件中包括的设备的拥有者的公钥与第二设备的公钥匹配，即表示第一设备与第二设备关联，则第一访问控制节点还向第二设备发送身份文件。若身份文件中所包括的公钥与第二设备的公钥不匹配，则可以不向第二设备发送该身份文件或者向第二设备反馈查询失败等。因此，本申请实施方式中，第一访问控制节点可以验证请求第一设备的身份文件的请求者是否具有读取设备的身份文件的权限，仅当在请求者具有读取该身份文件的权限的情况下才将身份文件反馈给请求者，从而提高了设备的数据安全性，可以保护设备的隐私。
在一种可能的实施方式中，为了进一步增加数据的安全性，前述的设备管理***还可以包括第二访问控制节点，第二设备还可以向第二访问控制节点发送第三请求消息；第二访问控制节点基于在对第三请求消息进行验证且验证成功之后，获取身份文件的第二标识；第二访问控制节点还向第一设备反馈第二标识；当验证第一标识和第二标识匹配时，第二设备保存身份文件。因此，本申请实施方式中，第二设备可以向多个访问控制节点分别请求身份文件以及身份文件对应的标识，当该多个访问控制节点反馈的标识匹配时，即表示接收到的身份文件准确，即可保存准确的身份文件。
在一种可能的实施方式中，第一设备还可以向第一访问控制节点发送身份凭证，该身 份凭证中包括第一设备的标识，该标识可以第一设备的公钥、序列号或者其他唯一标识，以向第一访问控制节点请求第一设备的身份文件；第一访问控制节点，还若对身份凭证验证且验证成功，则向数据库节点发送第二请求消息，第二请求消息包括第一设备的公钥；数据库节点，还向第一访问控制节点反馈第一标识；第一访问控制节点，还向文件***发送第一标识，并接收文件***反馈的身份文件；若身份文件中包括的标识与第一设备的标识匹配，则第一访问控制节点，还向第一设备发送身份文件。因此，本申请实施方式中，当设备自身请求其身份文件时，访问控制节点可以根据请求者的身份凭证来验证设备是否具有访问身份文件的权限，从验证成功之后，即可向请求者反馈身份文件，从而提高设备的身份文件的安全性。
在一种可能的实施方式中，为了进一步增加数据的安全性，前述的设备管理***还可以包括第二访问控制节点，第一设备还可以向第二访问控制节点发送第三请求消息；第二访问控制节点在对第三请求消息进行验证且验证成功之后，获取身份文件的第二标识；第二访问控制节点，还向第一设备反馈第二标识；当验证第一标识和第二标识匹配时，第一设备保存身份文件，当第一标识和第二标识不匹配时，第一设备可以重新向第一访问控制节点或者第二访问控制节点请求身份文件，直到得到准确的身份文件。因此，本申请实施方式中，第一设备可以向多个访问控制节点分别请求身份文件以及身份文件对应的标识，当该多个访问控制节点反馈的标识匹配时，即表示接收到的身份文件准确，即可保存准确的身份文件。
在一种可能的实施方式中，第一访问控制节点具体可以向数据库节点发送第一请求消息，以向数据库节点请求第一标识，该第一请求消息可以包括第一设备的公钥，数据库节点在接收到该第一请求消息之后，即可基于该第一请求消息中携带的公钥，从本地保存的数据找查询第一设备的关联信息，并将该信息中包括的第一标识反馈给第一访问控制节点。因此，本申请实施方式中，访问控制节点可以从数据库中获取到准确的设备的关联信息，并以此来从文件***中获取到设备的身份文件，相当于获取文件的过程需要多个节点参与，可以减少数据泄露的可能性。且由访问控制节点来对读取权限进行验证，从而增加了设备的数据安全性。
在一种可能的实施方式中，第二设备，还在身份文件中增加第三设备的信息，得到更新后的身份文件，第三设备的信息中包括第三设备的公钥；第二设备还向第一访问控制节点发送更新后的身份文件；第一访问控制节点还向文件***发送更新后的身份文件，并接收文件***反馈的第三标识；第一访问控制节点还向第二设备发送第三标识；第二设备还向第三设备发送第三标识，第三标识指向文件***请求更新后的身份文件；第二设备还向区块链节点发送更新信息，更新信息中包括第一设备的公钥、第三设备的公钥、以及第三标识；区块链节点使用更新信息更新交易信息，得到更新后的交易信息；数据库节点还获取更新后的交易信息，并根据更新后的交易信息更新关联信息，得到更新后的关联信息。
本申请实施方式中，第一设备的归属可以由第二设备转换为第三设备，第二设备在将身份文件中增加第三设备的信息，即将第一设备的归属者修改为第三设备，并将更新后的身份文件上传至文件***中，并更新数据库中保存的关联信息，完成设备的转让。因此， 通过本申请提供的方法，可以准确高效地完成设备的转让，可以适应需要进行设备转让的场景，泛化能力强。
前述对本申请提供的设备管理方法的流程进行了介绍，其中，本申请提供的设备管理方法，可以对设备进行注册、身份更新、身份查询以及设备转让等，如在对设备进行注册之后，即可进行身份查询或者身份转让等。
为便于理解，下面分别对注册、身份查询以及设备转让等流程分别进行示例性介绍。示例性地，前述的文件***可以是各种用于存储数据的文件***，如构建的分布式文件***、IPFS等，本申请示例性地，以IPFS为例进行示例性说明。设备拥有者可以是厂商也可以是用户，下面示例性地，以设备拥有者为厂商为例进行示例性说明。
需要说明的是，以下实施例所提及的设备注册、身份查询以及设备转让等流程可以结合起来实施，也可以分别独立实施，具体可以根据实际应用场景进行调整，本申请以下实施例中并不作限定。
一、设备注册
参阅图7，本申请提供的一种设备管理方法的流程示意图。
701、设备拥有者向区块链发送设备的信息以及设备拥有者信息。
其中，设备拥有者(即前述的第二设备，此处为便于理解称为设备拥有者)可以向区块链发送注册信息，该注册信息中可以包括设备的信息以及设备拥有者的信息，以向区块链注册该设备。
该设备的信息可以包括设备的公钥、或者该公钥的哈希值、证书、设备的序列号、设备名称或者设备标识等信息。
设备拥有者的信息可以包括设备拥有者的公钥、或者该公钥的哈希值、设备拥有者的证书、或者设备拥有者的标识等信息。
例如，若设备拥有者为厂商，厂商可以通过自身的区块链账号，向部署于区块链上的智能合约发起注册请求，该注册请求中可以携带设备的身份标识以及厂商的设备标识等信息，如设备的公钥或者设备公钥的哈希值，或者厂商的公钥或该厂商公钥的哈希值等。
702、区块链(即区块链节点)通过智能合约将接收到的信息写入区块。
区块链在接收到设备拥有者发送的注册信息之后，即可确定与该设备匹配的智能合约，并通过该智能合约将接收到的注册信息，即设备的信息和设备拥有者的信息写入区块。
其中，确定智能合约的方式可以是通过预先设置的映射关系，该映射关系可以是设备与智能合约之间的映射关系，也可以使制造设备的厂商与智能合约之间的映射关系，或者，还可以在注册信息中携带智能合约的地址或者接口等。该智能合约可以指示设备的注册方式或者设备管理方式等，如该智能合约可以指示注册设备所需的注册信息、加密方式、数据格式等。
因此，本申请实施方式中，可以使用不同的智能合约来注册不同厂商的设备，从而可以适应不同厂商的设备，仅需接入对应的智能合约即可引入不同的厂商，可以实现对不同厂商的设备的管理，泛化能力强。
703、区块链向设备拥有者反馈交易编号或者区块编号。
在区块链通过智能合约将注册信息写入区块中，同时生成交易编号或者区块编号，并反馈给设备拥有者，从而通知设备拥有者已将注册信息写入区块中。
704、数据库扫描区块交易信息。
其中，数据库通常承载于服务器中，可以由该服务器读取区块中的交易信息。
具体地，数据库可以周期性地读取区块中的交易信息，或者在检测到交易信息更新之后读取交易信息。例如，数据库可以周期性地向区块链发送读取请求，并接收区块链反馈的交易信息。
具体例如，数据库可以定期获取区块链上每一个区块记录的信息，每当区块链产生一个新的数据块，数据库即可从新的区块中提取到身份信息并进行过滤，筛选出可用的信息。如若数据库中不存在以设备公钥为标识的设备关联信息，则为该设备生成关联信息并添加至数据库中。若数据库中已存在以设备公钥为标识的设备关联信息，则可以验证设备拥有者的区块链账户地址，若该地址与上一次与设备拥有者进行交互时的区块链账户地址相同，则确定将交易信息中设备的信息更新至关联信息中。其中，在进行设备转让时，更新后新的拥有者地址可以与原来的拥有者地址不同。
705、数据库记录或者更新设备的关联信息。
数据库在确定区块中的交易信息更新之后，即可根据区块中的交易信息生成或者更新设备的关联信息，该关联信息可以用于指示设备关联的用户的信息。
其中，若数据库中已存在设备的关联信息，在校测到交易信息中包括设备的新的信息之后，即可将新的信息更新至设备的关联信息中。若数据库中不存在设备的关联信息，则在检测到交易信息中新增了区块，该区块中包括设备的信息之后，生成设备的关联信息。
具体地，该关联信息中可以包括设备自身的信息，如设备的公钥、该公钥的哈希值、序列号、名称或者其他标识等，还可以包括该设备的拥有者的信息，如拥有者的公钥、该公钥的哈希值、序列号、名称或者其他标识等。
706、设备拥有者生成身份文件。
设备拥有者可以生成设备的身份文件，其中包括设备的身份信息、设备拥有者的身份信息等可以标识设备身份或者设备归属的信息。
身份文件中具体可以包括设备的多种身份属性，通常身份文件需要被加密。其中加密的方式可以由多种，可以使用设备公钥或者设备拥有者公钥来进行加密，如具体加密的方法可用对称密钥K和通用的加密算法如AES对其进行加密。加密密钥本身使用设备和设备拥有者的公钥进行加密，并保存在身份文件中。
此外，为了保证身份文件的完整性，可以使用设备拥有者的私钥进行签名，从而使接收到的设备可以使用其中包含的设备公钥进行验证，如通过RSA算法或者椭圆曲线数字签名算法(Elliptic Curve Digital Signature Algorithm，ECDSA)算法等进行验证。且通常设备的身份文件可以使用Jason格式进行保存。
例如，设备的身份文件所包括的信息以及各项信息的加密方式具体可以如表1所示：
Figure PCTCN2022103564-appb-000001
表1
707、设备拥有者向访问控制节点上传身份文件。
设备拥有者在生成身份文件之后，向访问控制节点上传该身份文件，以指示访问控制节点将该身份文件保存至IPFS中。
其中，访问控制节点可以对设备拥有者的身份进行认证，具体可以通过设备拥有者提供的身份证书和签名来完成。该身份证书中可以包括公钥，该公钥与设备拥有者公钥通常可以是相同的或者是通过证书链生成的两种公钥等。访问控制节点可以使用设备拥有者的公钥以及身份文件中携带的签名进行验证。例如，假设设备拥有者的公钥与身份文件中存储的公钥相同，则采用通用的签名验证步骤，如RSA，使用公钥与文件的签名进行运算，然后获取到一个数值(即hash值)，同时对文件数据进行hash运算，获取文件的哈希值，然后对比两个hash值是否相同，相同则签名通过。否则，签名验证失败。
708、访问控制节点验证身份文件的签名完整性。
其中，该身份文件中携带签名，可以通过对该签名以及设备拥有者的公钥来对身份文件进行验证，确认身份文件是否被篡改。若身份文件完整，则可以继续进行后续步骤，若身份文件不完整，则以丢弃该身份文件，或者通知设备拥有者重新发送身份文件，或者回复通信失败等。
例如，设备拥有者在生成身份文件时，可以使用自身的私钥以及加密算法来生成身份文件的签名，访问控制节点在接收到身份文件之后，使用设备拥有者的公钥以及签名对身份文件进行签名验证运算，验证身份文件是否完整。
709、访问控制节点向数据库发送归属查询请求。
该归属查询请求中可以携带设备的公钥，或者还可以携带该公钥的哈希值，从而向数据库请求设备的关联信息。
710、数据库向访问控制节点反馈设备关联信息。
在数据库接收到访问控制节点发送的归属查询请求之后，即可根据该归属查询请求中携带的公钥，查询本地保存的数据，提取出设备的关联信息，并向访问控制节点反馈设备的关联信息。
该关联信息中够可以包括设备的信息以及设备关联的拥有者的信息。该关联信息具体可以包括设备的公钥，或者该设备公钥的哈希值、拥有者的公钥或者该拥有者公钥的哈希值等。
711、访问控制节点验证设备拥有者身份与身份文件上传者的身份一致性。
访问控制节点在接收到设备的关联信息之后，即可验证设备的拥有者与身份文件的上传者的身份是否一致。如可以匹配关联信息中包括的拥有者公钥，与设备拥有者的公钥是否一致，若一致，则表示设备归属于身份文件上传者，即设备与身份文件上传者关联，可以继续执行后续的步骤。若不一致，则表示设备并不归属于身份文件上传者，此时可以丢弃该身份文件，或者通知设备拥有者重新发送身份文件，或者回复通信失败等。
712、访问控制节点向IPFS发送设备身份文件。
在访问控制节点验证设备与设备拥有者关联之后，即设备拥有者具有上传设备的身份文件的权限，此时访问控制节点可以向IPFS发送该身份文件，以将该身份文件保存于IPFS中。
713、IPFS向访问控制节点反馈身份文件的哈希值。
IPFS在接收并保存访问控制节点发送的设备的身份文件之后，即可生成与该身份文件对应的哈希值(即第一标识)并反馈给访问控制节点。该哈希值可以用于读取IPFS中保存的设备的身份文件，如IPFS在接收到哈希值之后，即可基于该哈希值以及相应的解析运算计算出文件的保存地址，从而基于该地址读取到设备的身份文件。
具体地，生成该哈希值的具体方式可以哈希(Hash)算法，如MD4、MD5或SHA等算法得到的。如可以将身份文件的内容或者保存地址作为算法的输入，输出对应的哈希值。
例如，采用MD5算法生成哈希值的方式可以包括：MD5(“文件名称+数据内容”)。如MD5("/sdcard/youku/offlinedata/test.txt&showdemotesttxt")＝f96b697d7cb7938d525a2f31aaf161d0(即哈希值)。
714、访问控制节点向设备拥有者反馈身份文件的哈希值。
访问控制节点接收到IPFS反馈的哈希值之后，即可向设备反馈该哈希值。
715、设备拥有者向区块链发送身份文件哈希值。
设备拥有者接收到访问控制节点发送的哈希值之后，可以将该哈希值发送至区块链，以使区块链通过智能合约将该哈希值写入区块中。
此外，设备拥有者还可以向区块链发送设备的信息或者设备拥有者的信息，以表明自身的身份，从而使区块链可以识别出哈希值的来源并确定该哈希值的归属。
716、区块链通过智能合约将身份文件的哈希值写入区块。
区块链接收到设备拥有者发送的哈希值之后，即可通过智能合约将该哈希值写入区块中，同时还可以标识出该哈希值指示的身份文件对应的设备的信息或者设备拥有者的信息等。
717、区块链向设备拥有者反馈交易编号或者区块编号等。
区块链在将设备身份文件的哈希值写入区块后，即可向设备拥有者反馈交易编号或者区块编号等，以通知设备拥有者该哈希值已保存至区块中。
718、数据库扫描区块交易信息。
其中，步骤718与前述步骤704类似，此处不再赘述。
719、数据库更新设备的关联信息。
在扫描到区块的交易信息中新增了身份文件的哈希值，即可将该哈希值更新至设备的关联信息中，从而使设备的关联信息更完整，使其他设备可以从数据库中保存的关联信息中获取到身份文件的保存标识。
因此，本色申请实施方式中，设备拥有者可以向区块链注册设备，使区块链使用匹配的智能合约将设备及其拥有者的信息写入区块中。数据库可以从区块链中保存的数据中获取到第一设备的关联信息，该关联信息包括了第一设备关联的设备的信息，相当于第一设备已在区块链服务商进行注册，第一访问控制节点在接收到第一设备的身份文件之后，即可从数据库节点请求第一设备的关联信息并进行验证，在验证成功之后，即可将第一设备的身份文件保存至文件***中，并将文件***反馈的第一标识发送给第二设备，从而使第二设备或者其他设备可以使用该第一标识来从文件***中读取到身份文件。因此，本申请提供的设备管理方法，可以使用访问控制节点来对接入***的设备或者归属设备进行访问控制，验证访问该***的设备的权限，仅当具有访问***的权限时才允许该设备进行进一步处理，如数据存储或者数据读取，从而提高***中的数据传输的隐私安全。
二、身份查询
其中，身份查询可以分为多种情况，可以由设备本身来查询身份文件，也可以由设备拥有者来查询身份文件。例如，在设备拥有者在需要修改设备的身份文件时，可以向访问控制节点请求设备管理平台上保存的身份文件，或者，当设备拥有者本地未保存设备的身份文件或者本地数据丢失时，可以向访问控制节点请求设备的身份文件。又例如，在设备第一次接入网络时，可以通过缺省网络向访问控制节点请求查询身份文件，该身份文件中可以包括第一设备自身的身份信息以及与其关联的第二设备的身份信息，还可以包括提供 网络的运营商的信息，以便于后续可以基于身份文件接入运营商提供的网络中。
下面分别对设备和设备拥有者请求查询身份文件的场景进行示例性说明。
1、设备拥有者查询身份文件
参阅图8，本申请提供的另一种设备管理方法的流程示意图。
801、设备拥有者向访问控制节点发送身份查询请求。
其中，该身份查询请求中可以携带设备的信息或者设备拥有者的信息等，以向访问控制节点请求查询设备的身份文件。
该设备的信息以及设备拥有者的信息可以参阅前述步骤701的相关描述，此处不再赘述。
802、访问控制节点向数据库发送设备公钥。
访问控制节点在接收到来自设备拥有者的身份查询请求之后，可以向数据库请求身份文件的哈希值。具体可以是向数据库发送第一请求消息，该第一请求消息中可以携带设备的公钥，以向数据库请求设备的身份文件的哈希值。
当然，该第一请求消息中还可以携带设备拥有者的信息，如该设备拥有者的公钥、序列号或者标识等，使数据库识别出该设备拥有者，并读取到该设备拥有者所拥有的设备的关联信息。因此，本申请实施方式中，访问控制节点可以向数据库节点请求第一标识，从而可以基于该第一标识来从文件***中读取到身份文件。
803、数据库向访问控制节点反馈身份文件的哈希值。
数据库在接收到第一请求消息之后，可以基于该第一请求消息中携带的设备公钥，在保存的数据中查询与该公钥对应的关联信息，从而从该关联信息中提取到身份文件的哈希值，或者直接将该关联信息反馈至访问控制节点。
804、访问控制节点向IPFS发送身份文件的哈希值。
访问控制节点在接收到身份文件的哈希值之后，即可将该哈希值发送至IPFS，以向IPFS请求与该哈希值对应的身份文件。
805、IPFS向访问控制节点下发身份文件。
IPFS在接收到访问控制节点发送的哈希值之后，可以确定与该哈希值对应的地址，并从该地址中读取设备的身份文件并下发至访问控制节点。
具体地，确定与该哈希值对应的地址的具体方式可以包括，使用预先设置的映射关系查询与该哈希值对应的地址，或者使用与前述生成该哈希值的逆运算，计算出该身份文件所保存的地址，从而提取到设备的身份文件。
806、访问控制节点验证身份文件中的拥有者的公钥与请求者的公钥的一致性。
访问控制节点还可以验证设备拥有者是否具有查询设备身份文件的权限。即判断身份文件中所包括的设备关联的用户的信息，与请求者的信息是否匹配。
例如，可以判断身份文件中所包括的设备的拥有者的公钥与请求者的公钥是否一致，若一致，则标识请求者即设备的拥有者，该请求者具有查询设备的身份文件的权限。若身份文件中所包括的设备的拥有者的公钥与请求者的公钥不一致，则表示请求者可能不具有查询设备的身份文件的权限，此时可以无需将身份文件反馈给请求者，或者回复无查询权 限或者通信失败等消息。
807、访问控制节点向设备拥有者反馈身份文件。
在访问控制节点验证设备与设备拥有者关联之后，访问控制节点即可将身份文件下发给设备拥有者，从而使设备拥有者可以获取到设备的身份文件。
因此，本申请实施方式中，设备拥有者可以通过访问控制节点来请求查询设备的身份文件，访问控制节点可以对请求者的权限进行验证，仅当请求者具有查询设备身份文件的权限时，才向请求者反馈设备的身份文件，从而提高设备的数据安全性以及隐私性。
2、设备自身查询身份文件
其中，设备自身查询身份文件的场景中，设备可以直接与访问控制节点进行通信，也可以是通过注册服务器与访问控制节点进行通信，下面分别对不同的场景进行示例性说明。
(1)设备直接与访问控制节点进行通信
参阅图9，本申请提供的另一种设备管理方法的流程示意图。
901、设备向访问控制节点发送身份凭证。
其中，设备的身份凭证中可以包括设备自身的信息，以向访问控制节点请求设备的身份文件，如设备的公钥、该公钥的哈希值、序列号、唯一标识、时间戳、随机数值以及使用私钥生成的签名等。
例如，设备可以从存储器中获取访问控制节点的域名或者地址，然后通过该域名或者地址向访问控制节点发起链接，上传设备的身份凭证，其中包括设备的证书、时间戳、随机数值以及使用私钥生成的签名等，该时间戳可以用于防重放攻击，增加***内的数据传输安全性。
902、访问控制节点验证身份凭证。
访问控制节点在接收到设备上传的身份凭证之后，即可对该身份凭证进行验证。在验证成功之后执行后续步骤。若验证不成功，则无需执行后续步骤，或者可以向设备反馈重新发送身份凭证或者反馈通信失败等消息。
具体可以，若身份凭证中包括时间戳，则可以验证是否已接收过包含该时间戳的消息，若是，则可以丢弃该身份凭证，若否，则可以继续使用设备的公钥对签名进行验证，若验证成功，则可以继续执行后续步骤。
903、访问控制节点向数据库发送设备公钥。
904、数据库向访问控制节点反馈身份文件的哈希值。
905、访问控制节点向IPFS发送身份文件的哈希值。
906、IPFS向访问控制节点下发身份文件。
其中，步骤903-步骤906可以参阅前述步骤802-805，此处不再赘述。
907、访问控制节点验证身份文件中的设备公钥与请求者的公钥的一致性。
其中，访问控制节点在获取到设备的身份文件之后，可以验证身份文件包括的设备信息与请求者的信息是否匹配，如验证身份文件中的设备公钥与请求者的公钥是否一致，若一致，则继续执行后续步骤，若不一致，则无需执行后续步骤，可以向请求者反馈通信失败或者无权限等消息。
908、访问控制节点向设备反馈身份文件。
其中，在访问控制节点在确定身份文件中的设备公钥与请求者的公钥一致之后，即表示请求该身份文件的是该身份文件所属的设备，具有查询该身份文件的权限，即可向该设备反馈身份文件。
因此，本申请实施方式中，设备可以通过访问控制节点来请求查询设备的身份文件，访问控制节点可以对请求者的权限进行验证，仅当请求者具有查询设备身份文件的权限时，才向请求者反馈设备的身份文件，从而提高设备的数据安全性以及隐私性。
此外，为了进一步提高得到的身份文件的可靠性，还可以通过多个访问控制节点从多个多个数据库中分别获取设备身份文件的哈希值，从而对比该多个访问控制节点反馈的身份文件的哈希值是否一致，若一致则查询者可以保存身份文件。参阅图10，本申请提供的另一种设备管理方法的流程示意图。
1001、设备向第一访问控制节点发送身份凭证。
1002、第一访问控制节点验证身份凭证。
1003、第一访问控制节点向第一数据库发送设备公钥。
1004、第一数据库向第一访问控制节点反馈身份文件的哈希值。
1005、第一访问控制节点向IPFS发送身份文件的哈希值。
1006、IPFS向第一访问控制节点下发身份文件。
1007、第一访问控制节点验证身份文件中的设备公钥与请求者的设备公钥的一致性。
1008、第一访问控制节点向设备反馈身份文件。
其中，步骤1001-1008可以参阅前述步骤901-908的描述，此处不再赘述。
1009、设备向第二访问控制节点发送身份凭证。
其中，该步骤1010与前述步骤1001类似，区别在于前述步骤1001中设备将身份凭证发送至第一访问控制节点，以请求设备的身份文件，而步骤1010中，设备将身份凭证发送至第二访问控制节点，以请求设备的身份文件的哈希值。当然，在步骤1010中，设备也可以向第二访问控制节点请求设备的身份文件，具体可以根据实际应用场景调整，本实施例仅仅是示例性说明。
1010、第二访问控制节点验证消息签名。
1011、第二访问控制节点向第二数据库发送设备公钥。
1012、第二数据库向第二访问控制节点反馈身份文件的哈希值。
1013、访问控制服务器向设备发送身份文件的哈希值。
其中，步骤1010-步骤1013可以参阅前述步骤902-904，区别在于所请求的数据库不相同。
1014、设备验证步骤1008中身份文件包括的哈希值与步骤1013接收到的哈希值的一致性。
设备在接收到第一访问控制节点反馈的身份文件以及第二访问控制节点反馈的身份文件的哈希值之后，验证第一访问控制节点反馈的身份文件中所包括的哈希值与第二访问控制节点反馈的哈希值是否一致，若一致，则可以保存身份文件，若不一致，则可以丢弃身 份文件，并重新执行前述步骤1001-1013，直到得到准确的身份文件。
因此，本申请实施方式中，可以对比多个访问控制节点反馈的身份文件的标识是否一致，仅当多个访问控制节点反馈的身份文件的标识一致时，设备才保存身份文件，从而可以使设备得到更准确的身份文件。
(2)设备通过注册服务器与访问控制节点进行通信
其中，设备可以与注册服务器连接，并通过注册服务器与设备管理平台通信。该注册服务器可以是为设备设置的服务器，用于与设备进行通信，从而降低访问控制服务器的负荷；该注册服务器也可以是设备所接入的网络中的节点，如设备可以接入WiFi网络中，该注册服务器可以是WiFi网络中的其中一个网管。
参阅图11，本申请提供的另一种设备管理方法的流程示意图。
1101、设备向注册服务器发送身份凭证。
其中，设备可以向注册服务器发送身份凭证，以向注册服务器请求设备的身份文件。
具体地，在步骤1101之前，设备与注册服务器之间可以建立加密通道，如安全传输层协议(Transport Layer Security，TLS)加密管道或者通过其他加密方式加密的通道，从而提高设备与注册服务器之间传输的数据的安全性。
1102、注册服务器向访问控制节点转发设备的身份凭证。
注册服务器可以通过加密通道将设备发送的身份凭证转发至访问控制节点。
其中，在步骤1102之前，注册服务器和访问控制节点之间也以建立加密通道，该加密通道的加密方式与前述设备与注册服务器之间的加密通道的加密方式可以相同，也可以不相同，具体可以根据实际应用场景调整。
需要说明的是，步骤1101-1102与前述步骤901的区别在于，前述步骤901中，设备可以直接向访问控制节点发送身份凭证，步骤1101-1102中该身份凭证需由注册服务器来转发，对于类似的部分此处不再赘述。
1103、访问控制节点验证身份凭证。
1104、访问控制节点向数据库发送设备公钥。
1105、数据库向访问控制节点反馈身份文件的哈希值。
1106、访问控制节点向IPFS发送身份文件的哈希值。
1107、IPFS向访问控制节点下发身份文件。
1108、访问控制节点验证身份文件中的设备公钥与请求者的公钥的一致性。
其中，步骤1103-步骤1108可以参阅前述步骤902-907，此处不再赘述。
1108、访问控制节点向注册服务器反馈身份文件。
1109、注册服务器向设备转发身份文件。
其中，访问控制节点向注册服务器反馈身份文件可以是通过访问控制节点与注册服务器之间的加密通道传输，以及注册服务器向设备转发身份文件也可以是通过注册服务器与设备之间的加密通道传输，当然也可以不采用加密通道传输身份文件，具体可以根据实际应用场景进行调整。
需要说明的是，步骤1108-1109与前述步骤908类似，此处不再赘述。区别在于，前 述步骤908中访问控制节点直接向设备发送身份文件，而步骤1108-1109则由注册服务器来转发该身份文件。
因此，本申请实施方式中，可以通过注册服务器来转发设备与访问控制节点之间传输的数据，且可以通过加密通道传输，可以提高设备与访问控制节点之间传输的数据安全性。
三、设备转让
其中，设备拥有者可以将设备转让给其他用户，本申请示例性地，以厂商(即第一设备拥有者)将设备转让给用户(即第二设备拥有者)为例进行示例性说明。其中，对于与前述图8-图11中类似的步骤不作赘述，以下仅对区别进行示例性说明。
参阅图12，本申请提供的另一种设备管理方法的流程示意图。
1201、用户向厂商发送自身的用户证书。
其中，在用户和厂商同意进行设备转让后，用户可以向厂商提供自身的身份证书，为便于区分称为用户证书，该用户证书中可以包括用户的信息，如用户的公钥、用户名称或者用户标识等信息。
1202、厂商从访问控制节点获取设备的身份文件。
厂商可以从访问控制节点获取设备的身份文件，具体过程可以参阅前述图8中的步骤，此处不再赘述。
1203、厂商在身份文件中增加用户信息。
厂商在获取到身份文件之后，即可在设备的身份文件中增加用户的信息。
例如，设备的身份文件可以前述表1所示，厂商可以在身份文件中的“下一归属方信息”中，增加用户的证书，其中包括用户的公钥，得到更新后的身份文件，以表示将设备转让给下一归属方，即用户。
此外，还可以使用用户公钥来进行对称加密，并对更新后的身份文件进行签名，以便于后续用户在得到该身份文件后可以使用自身的公钥来进行解密或者验证。
1204、厂商向访问控制节点发送更新后的身份文件。
1205、访问控制节点从数据库中获取设备的关联信息。
1206、访问控制节点向IPFS上传更新后的身份文件并接收更新后的哈希值。
1207、访问控制节点向厂商下发更新后的哈希值。
其中，步骤1204-步骤1207与前述步骤707-步骤713类似，区别在于此处上传的是厂商更新后的身份文件，而前述步骤707-步骤713上传的是设备拥有者生成的身份文件。
1208、厂商向区块链发送用户的信息。
其中，用户的信息可以包括用户的公钥、名称或者其他标识等信息。此外，厂商还可以同时向区块链发送设备公钥以及更新后的哈希值等，以指示区块链更新设备的交易信息。
1209、区块链通过智能合约将用户的信息写入区块。
其中，区块链可以通过智能合约将用户的信息写入区块中，如将用户作为设备的下一任拥有者，且在交易信息中标识出来。
1210、数据库更新设备的关联信息。
其中，参阅前述步骤704，数据库可以扫描区块链的交易信息，从而将交易信息中所包 括的与设备相关的信息更新至设备的关联信息中，得到更新后的关联信息。
1212、厂商向用户发送更新后的哈希值。
此外，厂商还向用户发送更新后的哈希值(即第三标识)，从而使用户可以基于该第三标识来读取到设备的身份文件。
1212、用户使用更新后的哈希值向访问控制节点请求身份文件。
其中，用户可以向控制服务器发送请求消息，其中携带更新后哈希值，以向访问控制节点请求读取设备的身份文件。该请求消息中还可以携带用户的信息，如用户的公钥、名称或者其他标识等。
1213、访问控制节点从IPFS读取身份文件。
1214、访问控制节点从数据库中读取设备关联信息。
其中，步骤1213-步骤1214可以参阅前述步骤804-805，此处不再赘述。
1215、访问控制节点验证设备的拥有者和用户的一致性。
其中，在前述步骤1203-步骤1209中，已将数据库中设备关联信息中设备的归属方修改为用户，因此设备的拥有者已替换为用户，此时可以验证关联信息中所包括的拥有者的信息与用户的信息是否匹配，如判断关联信息中包括的下一归属方的公钥与用户的公钥是否一致，若一致，则表示设备的归属为用户，此时可以继续执行后续步骤，若不一致，则表示设备不归属于用户，无需执行后续步骤。
1216、访问控制节点向用户下发身份文件。
其中，若访问控制节点确定设备归属于用户，此时访问控制节点可以将IPFS下发的设备的身份文件下发给用户，以使用户获取到其拥有的设备的身份文件。
1217、用户更新身份文件中设备的归属方。
用户在得到身份文件之后，可以将身份文件中设备的归属方修改为用户的信息。
例如，参阅前述表1，可以将设备归属方信息中所包括的信息替换为用户的信息，如替换为用户的名称、身份证书等。
1218、用户向访问控制节点上传新的身份文件，并接收新的哈希值。
1219、用户向区块链上传新的哈希值。
1220、区块链方通过智能合约将新的哈希值写入区块。
1221、数据库将新的哈希值更新至设备的关联信息中。
其中，步骤1218-步骤1221与前述步骤1103-步骤1109类似，区别在于由厂商上传身份文件替换为由用户上传身份文件，以下不再赘述。
因此，在本申请实施方式中，可以实现设备的转让，即将设备由当前拥有者转让给下一拥有者。因此可以适应更多的场景，包括设备注册、转让或者信息查询等场景，泛化能力强。
前述对本申请提供的***以及方法进行了详细介绍，下面对本申请提供的装置进行介绍。
参阅图13，本申请提供的一种第二设备的结构示意图。
该第二设备包括：
收发模块1301，用于向第一访问控制节点发送身份文件，以指示第一访问控制节点将身份文件保存至文件***中，身份文件中包括第一设备的身份信息以及第二设备的公钥；
收发模块1301，还用于接收第一访问控制节点发送的第一标识，第一标识用于从文件***中读取身份文件，其中，第一标识为第一访问控制节点向文件***发送身份文件后由文件***生成，身份文件由第一访问控制节点在验证第二设备与关联信息中第一设备关联的设备的信息且验证成功后向文件***发送，关联信息为第一访问控制节点向区块链节点请求得到，关联信息保存在数据库节点中。
在一种可能的实施方式中，收发模块1301，还用于在第二设备向第一访问控制节点发送身份文件之前，向区块链节点发送注册信息，注册信息包括第一设备的信息以及第二设备的公钥，注册信息用于指示区块链节点通过与第一设备对应的智能合约在第一设备的交易信息中保存第一设备的信息以及第二设备的公钥，交易信息用于数据库节点生成第一设备的关联信息。
在一种可能的实施方式中，收发模块1301，还用于向区块链节点发送第一标识，以指示区块链节点讲第一标识更新至第一设备的交易信息中。
在一种可能的实施方式中，收发模块1301，还用于：向第一访问控制节点发送第一标识；接收第一访问控制节点发送的身份文件，身份文件为第一访问控制节点通过第一标识向文件***请求得到。
在一种可能的实施方式中，设备管理***还包括：第二访问控制节点；第二设备还包括：保存模块1302；
收发模块1301，还用于向第二访问控制节点发送第三请求消息；
收发模块1301，还用于接收第二访问控制节点发送的第二标识；
保存模块1302，用于若第二标识和第一标识匹配，则保存身份文件。
在一种可能的实施方式中，第二设备还可以包括：处理模块1303；
收发模块1301，还用于接收第三设备的信息，第三设备的信息包括第三设备的公钥；
处理模块1303，用于在身份文件中添加第三设备的公钥，得到更新后的身份文件；
收发模块1301，还用于向第一访问控制节点发送更新后的身份文件，以指示第一访问控制节点向文件***发送更新后的身份文件并接收文件***反馈的第三标识；
收发模块1301，还用于接收第一访问控制节点发送的第三标识，第三标识用于向文件***请求更新后的身份文件。
参阅图14，本申请提供的一种访问控制节点的结构示意图。
收发模块1401，用于接收第二设备发送的身份文件，该身份文件包括第一设备的公钥以及第二设备的公钥；
收发模块1401，还用于基于身份文件向数据库节点请求第一设备的关联信息，关联信息中包括第一设备的拥有者的公钥，关联信息是数据库节点从区块链节点中获取到；
处理模块1402，用于通过关联信息确定第一设备与第二设备关联；
若处理模块1402通过关联信息确定第一设备归属于第二设备，则收发模块1401，还用于向文件***请求发送身份文件，以指示文件***保存身份文件；
收发模块1401，还用于接收文件***反馈的第一标识，并向第二设备发送第一标识，第一标识用于从文件***中读取身份文件。
在一种可能的实施方式中，收发模块1401，还用于若处理模块1402根据所述身份文件中携带的签名确定所述身份文件完整，则基于所述身份文件向所述数据库节点请求所述第一设备的关联信息。
在一种可能的实施方式中，
收发模块1401，还用于接收第二设备发送身份请求消息，身份请求消息中携带第一设备的信息以及第二设备的公钥，身份请求消息用于请求身份文件；
收发模块1401，还用于向数据库节点发送第一请求消息，第一请求消息包括第一设备的信息；
收发模块1401，还用于接收数据库节点发送的第一标识；
收发模块1401，还用于向文件***发送第一标识，并接收文件***反馈的身份文件；
若身份文件中包括的公钥与第二设备的公钥匹配，则收发模块1401，还用于向第二设备发送身份文件。
在一种可能的实施方式中，收发模块1401，还用于接收第一设备发送的身份凭证，身份凭证中包括第一设备的标识；
处理模块1402，还用于对身份凭证验证；
若身份凭证验证成功，则收发模块1401，还用于向数据库节点发送第二请求消息，第二请求消息包括第一设备的标识；
收发模块1401，还用于接收数据库节点发送的第一标识；
收发模块1401，还用于向文件***发送第一标识，并接收文件***反馈的身份文件；
若身份文件中包括的公钥与第一设备的公钥匹配，则收发模块1401，还用于向第一设备发送身份文件。
在一种可能的实施方式中，设备管理***还包括：注册服务器；
收发模块1401，具体用于接收注册服务器转发的身份凭证，身份凭证由第一设备通过与注册服务器之间的加密管道发送至注册服务器；
收发模块1401，具体用于向第一设备发送身份文件；
收发模块1401，具体用于通过注册服务器向第一设备发送身份文件。
在一种可能的实施方式中，收发模块1401，还用于：接收第二设备发送的更新后的身份文件；向文件***发送更新后的身份文件，并接收文件***反馈的第三标识；向第二设备发送第三标识，第三标识用于请求更新后的身份文件。
参阅图15，本申请提供的一种区块链节点的结构示意图，包括：
收发模块1501，用于接收第二设备发送的注册信息，注册信息包括第一设备的公钥以及第二设备的公钥；
处理模块1502，用于通过与第一设备对应的智能合约将第一设备的公钥以及第二设备的公钥写入区块链的交易信息中，以使数据库节点获取区块链节点的交易信息后，将交易信息中包括的第一设备的公钥和第二设备的公钥保存至第一设备的关联信息中，关联信息 包括与第一设备关联的设备的信息。
在一种可能的实施方式中，收发模块1501，还用于收第一标识，第一标识用于请求第一设备的身份文件，第一标识为文件***在保存身份文件后生成；
处理模块1502，还用于通过与第一设备对应的智能合约将第一标识写入第一设备的交易信息中，以使数据库节点获取区块链节点的交易信息后将第一标识保存至关联信息中。
参阅图16，本申请提供的一种数据库节点的结构示意图，包括：
收发模块1601，用于获取区块链节点的区块链中的交易信息；
处理模块1602，用于将交易信息中包括的第一设备的公钥和第二设备的公钥保存至第一设备的关联信息中，关联信息包括与第一设备关联的设备的信息。
在一种可能的实施方式中，收发模块1601，还用于接收第一访问控制节点发送的归属请求消息，归属请求消息中携带第一设备的公钥；
收发模块1601，还用于根据第一设备的公钥向第一访问控制节点发送第一设备的关联信息。
请参阅图17，本申请提供的另一种第二设备的结构示意图，如下所述。
该第二设备可以包括处理器1701和存储器1702。该处理器1701和存储器1702通过线路互联。其中，存储器1702中存储有程序指令和数据。
存储器1702中存储了前述图6-图12中的步骤对应的程序指令以及数据。
处理器1701用于执行前述图6-图12中任一实施例所示的第二设备执行的方法步骤。
收发器1703，用于接收或者发送数据。
可选地，前述的图17中所示的第二设备可以为芯片。
请参阅图18，本申请提供的另一种访问控制节点的结构示意图，如下所述。
该访问控制节点可以包括处理器1801和存储器1802。该处理器1801和存储器1802通过线路互联。其中，存储器1802中存储有程序指令和数据。
存储器1802中存储了前述图6-图12中的步骤对应的程序指令以及数据。
处理器1801用于执行前述图6-图12中任一实施例所示的访问控制节点执行的方法步骤。
收发器1803，用于接收或者发送数据。
可选地，前述的图18中所示的访问控制节点可以为芯片。
请参阅图19，本申请提供的另一种区块链节点的结构示意图，如下所述。
该区块链节点可以包括处理器1901和存储器1902。该处理器1901和存储器1902通过线路互联。其中，存储器1902中存储有程序指令和数据。
存储器1902中存储了前述图6-图12中的步骤对应的程序指令以及数据。
处理器1901用于执行前述图6-图12中任一实施例所示的区块链节点执行的方法步骤。
收发器1903，用于接收或者发送数据。
可选地，前述的图19中所示的区块链节点可以为芯片。
请参阅图20，本申请提供的另一种数据库节点的结构示意图，如下所述。
该数据库节点可以包括处理器2001和存储器2002。该处理器2001和存储器2002通过 线路互联。其中，存储器2002中存储有程序指令和数据。
存储器2002中存储了前述图6-图12中的步骤对应的程序指令以及数据。
处理器2001用于执行前述图6-图12中任一实施例所示的数据库节点执行的方法步骤。
收发器2003，用于接收或者发送数据。
可选地，前述的图20中所示的数据库节点可以为芯片。
本申请实施例中还提供一种计算机可读存储介质，该计算机可读存储介质中存储有程序，当其在计算机上运行时，使得计算机执行如前述图6-图12所示实施例描述的方法中的步骤。
本申请实施例还提供了一种设备管理装置，该设备管理装置也可以称为数字处理芯片或者芯片，芯片包括处理单元和通信接口，处理单元通过通信接口获取程序指令，程序指令被处理单元执行，处理单元用于执行前述图6-图12中任一实施例所示的方法步骤。
本申请实施例还提供一种数字处理芯片。该数字处理芯片中集成了用于实现上述处理器，或者处理器的功能的电路和一个或者多个接口。当该数字处理芯片中集成了存储器时，该数字处理芯片可以完成前述实施例中的任一个或多个实施例的方法步骤。当该数字处理芯片中未集成存储器时，可以通过通信接口与外置的存储器连接。该数字处理芯片根据外置的存储器中存储的程序代码来实现上述图6-图12中任一实施例所示的方法步骤。
本申请实施例中还提供一种包括计算机程序产品，当其在计算机上行驶时，使得计算机执行如前述图6-图12所示实施例描述的方法中的步骤。
本申请实施例提供的设备管理装置可以为芯片，芯片包括：处理单元和通信单元，所述处理单元例如可以是处理器，所述通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使服务器内的芯片执行上述图6-图12所示实施例描述的方法。可选地，所述存储单元为所述芯片内的存储单元，如寄存器、缓存等，所述存储单元还可以是所述无线接入设备端内的位于所述芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。
具体地，前述的处理单元或者处理器可以是中央处理器(central processing unit，CPU)、网络处理器(neural-network processing unit，NPU)、图形处理器(graphics processing unit，GPU)、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit,ASIC)或现场可编程逻辑门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者也可以是任何常规的处理器等。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条 或多条通信总线或信号线。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本申请而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、只读存储器(read only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、***、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
最后应说明的是：以上，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。

Claims (48)

  1. 一种设备管理***，其特征在于，包括：第一设备、第二设备、第一访问控制节点、文件***、数据库节点和区块链节点，所述数据库节点中部署了用于存储数据的数据库；
    所述第二设备，用于向所述第一访问控制节点发送身份文件，所述身份文件包括所述第一设备的身份信息以及所述第二设备的公钥；
    所述第一访问控制节点，用于基于所述身份文件向所述数据库节点请求所述第一设备的关联信息，所述关联信息中包括所述第一设备所关联的设备的公钥，所述关联信息是所述数据库节点从所述区块链节点中获取到；
    若所述第一访问控制节点通过所述关联信息确定所述第一设备与所述第二设备关联，则所述第一访问控制节点，还用于向所述文件***发送所述身份文件；
    所述文件***，用于保存所述身份文件并向所述第一访问控制节点反馈所述身份文件对应的第一标识，所述第一标识用于从所述文件***中读取所述身份文件。
  2. 根据权利要求1所述的***，其特征在于，
    所述第二设备在向所述第一访问控制节点发送身份文件之前，还用于向所述区块链节点发送注册信息，所述注册信息包括所述第一设备的信息以及所述第二设备的公钥；
    所述区块链节点，用于第二设备通过与所述第一设备对应的智能合约将所述第一设备的信息以及所述第二设备的公钥写入区块链的交易信息中以进行注册；
    所述数据库节点，用于获取所述区块链节点的交易信息，并将所述交易信息中包括的所述第一设备的公钥和所述第二设备的公钥保存至所述关联信息。
  3. 根据权利要求1或2所述的***，其特征在于，
    所述第二设备，还用于向所述区块链节点发送所述第一标识；
    所述区块链节点，还用于通过与所述第一设备对应的智能合约将所述第一标识更新至本地保存的所述第一设备的交易信息中。
  4. 根据权利要求1-3中任一项所述的***，其特征在于，
    所述第二设备，还用于向所述第一访问控制节点发送身份请求消息，所述身份请求消息中携带所述第一设备的信息以及所述第二设备的公钥，所述身份请求消息用于请求所述身份文件；
    所述第一访问控制节点，还用于获取所述第一标识；
    所述第一访问控制节点，还用于向所述文件***发送所述第一标识，并接收所述文件***反馈的所述身份文件；
    若所述身份文件中包括的公钥与所述第二设备的公钥匹配，则所述第一访问控制节点，还用于向所述第二设备发送所述身份文件。
  5. 根据权利要求1-4中任一项所述的***，其特征在于，
    所述第一设备，还用于向所述第一访问控制节点发送身份凭证，所述身份凭证中包括所述第一设备的标识，以向所述第一访问控制节点请求所述身份文件；
    所述第一访问控制节点，还用于若对所述身份凭证验证且验证成功，则向所述数据库节点发送第二请求消息，所述第二请求消息包括所述第一设备的标识；
    所述数据库节点，还用于向所述第一访问控制节点反馈所述第一标识；
    所述第一访问控制节点，还用于向所述文件***发送所述第一标识，并接收所述文件***反馈的所述身份文件；
    若所述身份文件中包括的标识与所述身份凭证中的标识匹配，则所述第一访问控制节点，还用于向所述第一设备发送所述身份文件。
  6. 根据权利要求5所述的***，其特征在于，所述设备管理***还包括：注册服务器；
    所述第一设备，具体用于通过加密管道向所述注册服务器发送所述身份凭证；
    所述注册服务器，用于通过加密管道向所述访问控制服务器转发所述身份凭证；
    所述第一访问控制节点，具体用于在向所述注册服务器发送所述身份文件；
    所述注册服务器，具体用于向所述第一设备转发所述身份文件。
  7. 根据权利要求5或6所述的***，其特征在于，所述设备管理***还包括：第二访问控制节点；
    所述第一设备，用于向所述第二访问控制节点发送第三请求消息；
    所述第二访问控制节点，用于在对所述第三请求消息进行验证且验证成功之后，获取所述身份文件的第二标识；
    所述第二访问控制节点，还用于向所述第一设备反馈所述第二标识；
    所述第一设备，还用于当验证所述第一标识和所述第二标识匹配时，保存所述身份文件。
  8. 根据权利要求4-7中任一项所述的***，其特征在于，
    所述第一访问控制节点，具体用于向所述数据库节点发送第一请求消息并接收所述数据库节点反馈的所述第一标识，所述第一请求消息包括所述第一设备的公钥。
  9. 根据权利要求1-8中任一项所述的***，其特征在于，所述设备管理***还包括：第三设备；
    所述第二设备，还用于在所述身份文件中增加所述第三设备的信息，得到更新后的身份文件，所述第三设备的信息中包括所述第三设备的公钥，所述更新后的身份文件指示所述第一设备与所述第三设备关联；
    所述第二设备，还用于向所述第一访问控制节点发送所述更新后的身份文件；
    所述第一访问控制节点，还用于向所述文件***发送所述更新后的身份文件，并接收所述文件***反馈的第三标识；
    所述第一访问控制节点，还用于向所述第二设备发送所述第三标识；
    所述第二设备，还用于向所述第三设备发送所述第三标识，所述第三标识用于向所述文件***请求所述更新后的身份文件；
    所述第二设备，还用于向所述区块链节点发送更新信息，所述更新信息中包括所述第一设备的公钥、所述第三设备的公钥、以及所述第三标识；
    所述区块链节点使用所述更新信息更新所述交易信息，得到更新后的交易信息；
    所述数据库节点，还用于获取所述更新后的交易信息，并根据所述更新后的交易信息更新所述关联信息，得到更新后的关联信息。
  10. 一种设备管理方法，其特征在于，应用于设备管理***，所述设备管理***包括：第一设备、第一访问控制节点、文件***、第二设备、数据库节点和区块链节点，所述数据库节点中部署了用于存储数据的数据库，所述第一设备与所述第二设备关联，所述方法包括：
    所述第二设备向所述第一访问控制节点发送身份文件，以指示所述第一访问控制节点将所述身份文件保存至所述文件***中，所述身份文件中包括所述第一设备的身份信息以及所述第二设备的公钥；
    所述第二设备接收所述第一访问控制节点发送的第一标识，所述第一标识用于从所述文件***中读取所述身份文件，其中，所述第一标识为所述第一访问控制节点向所述文件***发送所述身份文件后由所述文件***生成，所述身份文件由所述第一访问控制节点在验证所述第二设备与关联信息中所述第一设备关联的设备的信息且验证成功后向所述文件***发送，所述关联信息为所述第一访问控制节点向所述区块链节点请求得到，所述关联信息保存在所述数据库节点中。
  11. 根据权利于要求10所述的方法，其特征在于，在所述第二设备向所述第一访问控制节点发送身份文件之前，所述方法还包括：
    所述第二设备向所述区块链节点发送注册信息，所述注册信息包括所述第一设备的信息以及所述第二设备的公钥，所述注册信息用于指示所述区块链节点通过与所述第一设备对应的智能合约在交易信息中保存所述第一设备的信息以及所述第二设备的公钥，所述交易信息用于所述数据库节点生成所述第一设备的关联信息。
  12. 根据权利于要求10或11所述的方法，其特征在于，所述方法还包括：
    所述第二设备向所述区块链节点发送所述第一标识，以指示所述区块链节点讲所述第一标识更新至所述第一设备的交易信息中。
  13. 根据权利于要求10-12中任一项所述的方法，其特征在于，所述方法还包括：
    所述第二设备向所述第一访问控制节点发送所述第一标识；
    所述第二设备接收所述第一访问控制节点发送的所述身份文件，所述身份文件为所述第一访问控制节点通过所述第一标识向所述文件***请求得到。
  14. 根据权利于要求13所述的方法，其特征在于，所述设备管理***还包括：第二访问控制节点；所述方法还包括：
    所述第二设备向所述第二访问控制节点发送第三请求消息；
    所述第二设备接收所述第二访问控制节点发送的第二标识；
    若所述第二标识和所述第一标识匹配，则所述第二设备保存所述身份文件。
  15. 根据权利要求10-14中任一项所述的方法，其特征在于，所述方法还包括：
    所述第二设备接收第三设备的信息，所述第三设备的信息包括所述第三设备的公钥；
    所述第二设备在所述身份文件中添加所述第三设备的公钥，得到更新后的身份文件，所述更新后的身份文件指示所述第一设备与所述第三设备关联；
    所述第二设备向所述第一访问控制节点发送所述更新后的身份文件，以指示所述第一访问控制节点向所述文件***发送所述更新后的身份文件并接收所述文件***反馈的第三 标识；
    所述第二设备接收所述第一访问控制节点发送的所述第三标识，所述第三标识用于向所述文件***请求所述更新后的身份文件。
  16. 一种设备管理方法，其特征在于，应用于设备管理***，所述设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，所述数据库节点中部署了用于存储数据的数据库，所述第一设备与所述第二设备关联，所述方法包括：
    所述第一访问控制节点接收所述第二设备发送的身份文件，所述身份文件包括所述第一设备的身份信息以及所述第二设备的公钥；
    所述第一访问控制节点基于所述身份文件向所述数据库节点请求所述第一设备的关联信息，所述关联信息中包括与所述第一设备的关联的设备的公钥，所述关联信息是所述数据库节点从所述区块链节点中获取到；
    若所述第一访问控制节点通过所述归属信息确定所述第一设备与所述第二设备关联，则所述第一访问控制节点向所述文件***发送所述身份文件，以指示所述文件***保存所述身份文件；
    所述第一访问控制节点接收所述文件***反馈的第一标识，并向所述第二设备发送所述第一标识，所述第一标识用于从所述文件***中读取所述身份文件。
  17. 根据权利要求16所述的方法，其特征在于，所述第一访问控制节点基于所述身份文件向所述数据库节点请求所述第一设备的关联信息，包括：
    若所述第一访问控制节点根据所述身份文件中携带的签名确定所述身份文件完整，则基于所述身份文件向所述数据库节点请求所述第一设备的关联信息。
  18. 根据权利要求16或17所述的方法，其特征在于，所述方法还包括：
    所述第一访问控制节点接收所述第二设备发送身份请求消息，所述身份请求消息中携带所述第一设备的信息以及所述第二设备的公钥，所述身份请求消息用于请求所述身份文件；
    所述第一访问控制节点向所述数据库节点发送第一请求消息，所述第一请求消息包括所述第一设备的信息；
    所述第一访问控制节点接收所述数据库节点发送的所述第一标识；
    所述第一访问控制节点向所述文件***发送所述第一标识，并接收所述文件***反馈的所述身份文件；
    若所述身份文件中包括的公钥与所述第二设备的公钥匹配，则所述第一访问控制节点向所述第二设备发送所述身份文件。
  19. 根据权利要求16-18中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一访问控制节点接收所述第一设备发送的身份凭证，所述身份凭证中包括所述第一设备的标识；
    所述第一访问控制节点对所述身份凭证验证；
    若所述身份凭证验证成功，则所述第一访问控制节点向所述数据库节点发送第二请求 消息，所述第二请求消息包括所述第一设备的标识；
    所述第一访问控制节点接收所述数据库节点发送的所述第一标识；
    所述第一访问控制节点向所述文件***发送所述第一标识，并接收所述文件***反馈的所述身份文件；
    若所述身份文件中包括的标识与所述第一设备的标识匹配，则所述第一访问控制节点向所述第一设备发送所述身份文件。
  20. 根据权利要求19所述的方法，其特征在于，所述设备管理***还包括：注册服务器；
    所述第一访问控制节点接收所述第一设备发送的身份凭证，包括：
    所述第一访问控制节点接收所述注册服务器转发的所述身份凭证，所述身份凭证由所述第一设备通过与所述注册服务器之间的加密管道发送至所述注册服务器；
    所述第一访问控制节点向所述第一设备发送所述身份文件，包括；
    所述第一访问控制节点通过所述注册服务器向所述第一设备发送所述身份文件。
  21. 根据权利要求16-20中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一访问控制节点接收所述第二设备发送的更新后的身份文件；
    所述第一访问控制节点向所述文件***发送所述更新后的身份文件，并接收所述文件***反馈的第三标识；
    所述第一访问控制节点向所述第二设备发送所述第三标识，所述第三标识用于请求所述更新后的身份文件。
  22. 一种设备管理方法，其特征在于，应用于设备管理***，所述设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，所述数据库节点中部署了用于存储数据的数据库，所述第一设备与所述第二设备关联，所述方法包括：
    所述区块链节点接收所述第二设备发送的注册信息，所述注册信息包括所述第一设备的信息以及所述第二设备的公钥；
    所述区块链节点通过与所述第一设备对应的智能合约将所述第一设备的公钥以及所述第二设备的公钥写入区块链的交易信息中，以使所述数据库节点获取所述区块链节点的交易信息后，将所述交易信息中包括的所述第一设备的公钥和所述第二设备的公钥保存至所述第一设备的关联信息中，所述关联信息包括与所述第一设备关联的设备的信息。
  23. 根据权利要求22所述的方法，其特征在于，所述方法还包括：
    所述区块链节点接收第一标识，所述第一标识用于请求所述第一设备的身份文件，所述第一标识为所述文件***在保存所述身份文件后生成；
    所述区块链节点通过与所述第一设备对应的智能合约将所述第一标识写入所述交易信息中，以使所述数据库节点获取所述区块链节点的交易信息后将所述第一标识保存至所述关联信息中。
  24. 一种设备管理方法，其特征在于，应用于设备管理***，所述设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，所述数 据库节点中部署了用于存储数据的数据库，所述第一设备与所述第二设备关联，所述方法包括：
    所述数据库节点获取所述区块链节点的区块链中的交易信息；
    所述数据库节点将所述交易信息中包括的所述第一设备的公钥和所述第二设备的公钥保存至所述第一设备的关联信息中，所述关联信息包括与所述第一设备关联的设备的信息。
  25. 根据权利于要求24所述的方法，其特征在于，所述方法还包括：
    所述数据库节点接收所述第一访问控制节点发送的归属请求消息，所述归属请求消息中携带所述第一设备的标识；
    所述数据库节点根据所述第一设备的标识向所述第一访问控制节点发送所述第一设备的所述关联信息。
  26. 一种第二设备，其特征在于，应用于设备管理***，所述设备管理***包括：所述第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，所述数据库节点中部署了用于存储数据的数据库，所述第一设备与所述第二设备关联，所述设备包括：
    收发模块，用于向所述第一访问控制节点发送身份文件，以指示所述第一访问控制节点将所述身份文件保存至所述文件***中，所述身份文件中包括所述第一设备的身份信息以及所述第二设备的公钥；
    所述收发模块，还用于接收所述第一访问控制节点发送的第一标识，所述第一标识用于从所述文件***中读取所述身份文件，其中，所述第一标识为所述第一访问控制节点向所述文件***发送所述身份文件后由所述文件***生成，所述身份文件由所述第一访问控制节点在验证所述第二设备与关联信息中所述第一设备关联的设备的信息且验证成功后向所述文件***发送，所述关联信息为所述第一访问控制节点向所述区块链节点请求得到，所述关联信息保存在所述数据库节点中。
  27. 根据权利于要求26所述的设备，其特征在于，
    所述收发模块，还用于在向所述第一访问控制节点发送身份文件之前，向所述区块链节点发送注册信息，所述注册信息包括所述第一设备的信息以及所述第二设备的公钥，所述注册信息用于指示所述区块链节点通过与所述第一设备对应的智能合约在所述第一设备的交易信息中保存所述第一设备的信息以及所述第二设备的公钥，所述交易信息用于所述数据库节点生成所述第一设备的关联信息。
  28. 根据权利于要求26或27所述的设备，其特征在于，
    所述收发模块，还用于向所述区块链节点发送所述第一标识，以指示所述区块链节点讲所述第一标识更新至所述第一设备的交易信息中。
  29. 根据权利于要求26-28中任一项所述的设备，其特征在于，所述收发模块，还用于：
    向所述第一访问控制节点发送所述第一标识；
    接收所述第一访问控制节点发送的所述身份文件，所述身份文件为所述第一访问控制节点通过所述第一标识向所述文件***请求得到。
  30. 根据权利于要求29所述的设备，其特征在于，所述设备管理***还包括：第二访问控制节点；所述第二设备还包括：保存模块；
    所述收发模块，还用于向所述第二访问控制节点发送第三请求消息；
    所述收发模块，还用于接收所述第二访问控制节点发送的第二标识；
    所述保存模块，用于若所述第二标识和所述第一标识匹配，则保存所述身份文件。
  31. 根据权利要求26-30中任一项所述的设备，其特征在于，所述装置还包括：处理模块；
    所述收发模块，还用于接收第三设备的信息，所述第三设备的信息包括所述第三设备的公钥；
    所述处理模块，用于在所述身份文件中添加所述第三设备的公钥，得到更新后的身份文件；
    所述收发模块，还用于向所述第一访问控制节点发送所述更新后的身份文件，以指示所述第一访问控制节点向所述文件***发送所述更新后的身份文件并接收所述文件***反馈的第三标识；
    所述收发模块，还用于接收所述第一访问控制节点发送的所述第三标识，所述第三标识用于向所述文件***请求所述更新后的身份文件。
  32. 一种访问控制节点，其特征在于，应用于设备管理***，所述设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，所述数据库节点中部署了用于存储数据的数据库，所述第一设备与所述第二设备关联，所述方法包括：
    收发模块，用于接收所述第二设备发送的身份文件，所述身份文件包括所述第一设备的公钥以及所述第二设备的公钥；
    所述收发模块，还用于基于所述身份文件向所述数据库节点请求所述第一设备的关联信息，所述关联信息中包括所述第一设备的拥有者的公钥，所述关联信息是所述数据库节点从所述区块链节点中获取到；
    处理模块，用于通过所述关联信息确定所述第一设备与所述第二设备关联；
    若所述处理模块通过所述关联信息确定所述第一设备与所述第二设备关联，则所述收发模块，还用于向所述文件***请求发送所述身份文件，以指示所述文件***保存所述身份文件；
    所述收发模块，还用于接收所述文件***反馈的第一标识，并向所述第二设备发送所述第一标识，所述第一标识用于从所述文件***中读取所述身份文件。
  33. 根据权利要求32所述的节点，其特征在于，
    所述收发模块，还用于若所述处理模块根据所述身份文件中携带的签名确定所述身份文件完整，则基于所述身份文件向所述数据库节点请求所述第一设备的关联信息。
  34. 根据权利要求32或33所述的节点，其特征在于，
    所述收发模块，还用于接收所述第二设备发送身份请求消息，所述身份请求消息中携 带所述第一设备的信息以及所述第二设备的公钥，所述身份请求消息用于请求所述身份文件；
    所述收发模块，还用于向所述数据库节点发送第一请求消息，所述第一请求消息包括所述第一设备的信息；
    所述收发模块，还用于接收所述数据库节点发送的所述第一标识；
    所述收发模块，还用于向所述文件***发送所述第一标识，并接收所述文件***反馈的所述身份文件；
    若所述身份文件中包括的公钥与所述第二设备的公钥匹配，则所述收发模块，还用于向所述第二设备发送所述身份文件。
  35. 根据权利要求32-34中任一项所述的节点，其特征在于，
    所述收发模块，还用于接收所述第一设备发送的身份凭证，所述身份凭证中包括所述第一设备的标识；
    所述处理模块，还用于对所述身份凭证验证；
    若所述身份凭证验证成功，则所述收发模块，还用于向所述数据库节点发送第二请求消息，所述第二请求消息包括所述第一设备的标识；
    所述收发模块，还用于接收所述数据库节点发送的所述第一标识；
    所述收发模块，还用于向所述文件***发送所述第一标识，并接收所述文件***反馈的所述身份文件；
    若所述身份文件中包括的公钥与所述第一设备的公钥匹配，则所述收发模块，还用于向所述第一设备发送所述身份文件。
  36. 根据权利要求35所述的节点，其特征在于，所述设备管理***还包括：注册服务器；
    所述收发模块，具体用于接收所述注册服务器转发的所述身份凭证，所述身份凭证由所述第一设备通过与所述注册服务器之间的加密管道发送至所述注册服务器；
    所述收发模块，具体用于向所述第一设备发送所述身份文件；
    所述收发模块，具体用于通过所述注册服务器向所述第一设备发送所述身份文件。
  37. 根据权利要求32-36中任一项所述的节点，其特征在于，
    所述收发模块，还用于接收所述第二设备发送的更新后的身份文件；
    所述收发模块，还用于向所述文件***发送所述更新后的身份文件，并接收所述文件***反馈的第三标识；
    所述收发模块，还用于向所述第二设备发送所述第三标识，所述第三标识用于请求所述更新后的身份文件。
  38. 一种区块链节点，其特征在于，应用于设备管理***，所述设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，所述数据库节点中部署了用于存储数据的数据库，所述第一设备与所述第二设备关联，所述方法包括：
    收发模块，用于接收所述第二设备发送的注册信息，所述注册信息包括所述第一设备 的公钥以及所述第二设备的公钥；
    处理模块，用于通过与所述第一设备对应的智能合约将所述第一设备的公钥以及所述第二设备的公钥写入区块链的交易信息中，以使所述数据库节点获取所述区块链节点的交易信息后，将所述交易信息中包括的所述第一设备的公钥和所述第二设备的公钥保存至所述第一设备的关联信息中，所述关联信息包括与所述第一设备关联的设备的信息。
  39. 根据权利要求38所述的区块链节点，其特征在于，
    所述收发模块，还用于收第一标识，所述第一标识用于请求所述第一设备的身份文件，所述第一标识为所述文件***在保存所述身份文件后生成；
    所述处理模块，还用于通过与所述第一设备对应的智能合约将所述第一标识写入所述第一设备的所述交易信息中，以使所述数据库节点获取所述区块链节点的交易信息后将所述第一标识保存至所述关联信息中。
  40. 一种数据库节点，其特征在于，应用于设备管理***，所述设备管理***包括：第二设备、第一访问控制节点、文件***、第一设备、数据库节点和区块链节点，所述数据库节点中部署了用于存储数据的数据库，所述第一设备与所述第二设备关联，所述方法包括：
    收发模块，用于获取所述区块链节点的区块链中的交易信息；
    处理模块，用于将所述交易信息中包括的所述第一设备的公钥和所述第二设备的公钥保存至所述第一设备的关联信息中，所述关联信息包括与所述第一设备关联的设备的信息。
  41. 根据权利于要求40所述的数据库节点，其特征在于，
    所述收发模块，还用于接收所述第一访问控制节点发送的归属请求消息，所述归属请求消息中携带所述第一设备的公钥；
    所述收发模块，还用于根据所述第一设备的公钥向所述第一访问控制节点发送所述第一设备的所述关联信息。
  42. 一种第二设备，其特征在于，包括处理器，所述处理器和存储器耦合，所述存储器存储有程序，当所述存储器存储的程序指令被所述处理器执行时实现权利要求10至15中任一项所述的方法。
  43. 一种访问控制节点，其特征在于，包括处理器，所述处理器和存储器耦合，所述存储器存储有程序，当所述存储器存储的程序指令被所述处理器执行时实现权利要求16至21中任一项所述的方法。
  44. 一种区块链节点，其特征在于，包括处理器，所述处理器和存储器耦合，所述存储器存储有程序，当所述存储器存储的程序指令被所述处理器执行时实现权利要求22至23中任一项所述的方法。
  45. 一种数据库节点，其特征在于，包括处理器，所述处理器和存储器耦合，所述存储器存储有程序，当所述存储器存储的程序指令被所述处理器执行时实现权利要求24至25中任一项所述的方法。
  46. 一种计算机可读存储介质，包括程序，当其被处理单元所执行时，执行如权利要 求10至25中任一项所述的方法。
  47. 一种设备管理装置，其特征在于，包括处理单元和通信接口，所述处理单元通过所述通信接口获取程序指令，当所述程序指令被所述处理单元执行时实现权利要求10至25中任一项所述的方法。
  48. 一种计算机程序产品，包括计算机程序/指令，其特征在于，所述计算机程序/指令被处理器执行时实现如权利要求10至25中任一项所述的方法。
PCT/CN2022/103564 2021-07-22 2022-07-04 一种设备管理方法、***以及装置 WO2023000967A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22845132.4A EP4357950A1 (en) 2021-07-22 2022-07-04 Device management method, system and apparatus
US18/416,938 US20240163119A1 (en) 2021-07-22 2024-01-19 Device management method, system, and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110832257.3A CN115694847A (zh) 2021-07-22 2021-07-22 一种设备管理方法、***以及装置
CN202110832257.3 2021-07-22

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/416,938 Continuation US20240163119A1 (en) 2021-07-22 2024-01-19 Device management method, system, and apparatus

Publications (1)

Publication Number Publication Date
WO2023000967A1 true WO2023000967A1 (zh) 2023-01-26

Family

ID=84978935

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/103564 WO2023000967A1 (zh) 2021-07-22 2022-07-04 一种设备管理方法、***以及装置

Country Status (4)

Country Link
US (1) US20240163119A1 (zh)
EP (1) EP4357950A1 (zh)
CN (1) CN115694847A (zh)
WO (1) WO2023000967A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117097443A (zh) * 2023-10-20 2023-11-21 中国电子科技集团公司第二十八研究所 一种具有关键数据发送反馈功能的信息***及其发送方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116624361B (zh) * 2023-04-11 2024-03-22 北京通嘉宏瑞科技有限公司 真空泵工作方法、装置、计算机设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107257340A (zh) * 2017-06-19 2017-10-17 阿里巴巴集团控股有限公司 一种认证方法、基于区块链的认证数据处理方法及设备
US20190289454A1 (en) * 2016-10-04 2019-09-19 Nec Corporation Embedded sim management system, node device, embedded sim management method, program, and information registrant device
CN110958111A (zh) * 2019-12-09 2020-04-03 广东电网有限责任公司 一种基于区块链的电力移动终端身份认证机制
CN111209558A (zh) * 2019-12-26 2020-05-29 曙光网络科技有限公司 基于区块链的物联网设备身份认证方法以及***
CN111726343A (zh) * 2020-06-11 2020-09-29 桂林电子科技大学 一种基于ipfs和区块链的电子公文安全传输方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190289454A1 (en) * 2016-10-04 2019-09-19 Nec Corporation Embedded sim management system, node device, embedded sim management method, program, and information registrant device
CN107257340A (zh) * 2017-06-19 2017-10-17 阿里巴巴集团控股有限公司 一种认证方法、基于区块链的认证数据处理方法及设备
CN110958111A (zh) * 2019-12-09 2020-04-03 广东电网有限责任公司 一种基于区块链的电力移动终端身份认证机制
CN111209558A (zh) * 2019-12-26 2020-05-29 曙光网络科技有限公司 基于区块链的物联网设备身份认证方法以及***
CN111726343A (zh) * 2020-06-11 2020-09-29 桂林电子科技大学 一种基于ipfs和区块链的电子公文安全传输方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117097443A (zh) * 2023-10-20 2023-11-21 中国电子科技集团公司第二十八研究所 一种具有关键数据发送反馈功能的信息***及其发送方法
CN117097443B (zh) * 2023-10-20 2024-01-19 中国电子科技集团公司第二十八研究所 一种具有关键数据发送反馈功能的信息***及其发送方法

Also Published As

Publication number Publication date
US20240163119A1 (en) 2024-05-16
EP4357950A1 (en) 2024-04-24
CN115694847A (zh) 2023-02-03

Similar Documents

Publication Publication Date Title
US11223677B2 (en) Peer-to-peer syncable storage system
US11601426B2 (en) Device authentication method, service access control method, device, and non-transitory computer-readable recording medium
WO2023000967A1 (zh) 一种设备管理方法、***以及装置
US8549326B2 (en) Method and system for extending encrypting file system
JP6652767B2 (ja) 接続デバイスのステータスを管理するための方法
CN111526159B (zh) 建立数据连接的方法、装置、终端设备及存储介质
US20050266798A1 (en) Linking security association to entries in a contact directory of a wireless device
WO2022193984A1 (zh) 跨链进行数据传输的方法、装置、计算机设备、存储介质和计算机程序产品
CN113966625A (zh) 用于核心网络域中的证书处理的技术
CN113255014B (zh) 一种基于区块链的数据处理方法以及相关设备
TW202226802A (zh) 分布式帳本系統
CN113676332B (zh) 二维码认证方法、通信设备及存储介质
CN114172730A (zh) 面向链上链下结合文件区块链的跨链方法及中间***
CN117336022A (zh) 在可信wlan中认证电力终端的方法、***、终端及存储介质
CN112235331A (zh) 一种数据传输处理方法及设备
WO2022206247A1 (zh) 一种证书查询方法及装置
CN114666155B (zh) 设备接入方法、***、装置、物联网设备和网关设备
WO2021136511A1 (zh) 一种通信方法及装置
KR102658615B1 (ko) SSP 단말의 번들 다운로드 과정과 eSIM 프로파일 다운로드 과정 호환 연동 방법
US20220256349A1 (en) Provision of Application Level Identity
WO2024007855A1 (zh) 一种基于区块链的数据处理方法、设备以及可读存储介质
WO2023040554A1 (zh) 一种区块链***
US11943211B2 (en) Device monitoring in accessing network
WO2023221502A1 (zh) 数据传输方法和***及信令安全管理网关
CN116633553A (zh) 一种基于区块链的物联网wpki证书管理方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22845132

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022845132

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022845132

Country of ref document: EP

Effective date: 20240117

NENP Non-entry into the national phase

Ref country code: DE