WO2023134557A1 - 一种基于工业互联网标识的处理方法及装置 - Google Patents
一种基于工业互联网标识的处理方法及装置 Download PDFInfo
- Publication number
- WO2023134557A1 WO2023134557A1 PCT/CN2023/070847 CN2023070847W WO2023134557A1 WO 2023134557 A1 WO2023134557 A1 WO 2023134557A1 CN 2023070847 W CN2023070847 W CN 2023070847W WO 2023134557 A1 WO2023134557 A1 WO 2023134557A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- message
- industrial internet
- authentication
- identifier
- identification
- Prior art date
Links
- 238000003672 processing method Methods 0.000 title claims abstract description 32
- 238000000034 method Methods 0.000 claims abstract description 152
- 238000012545 processing Methods 0.000 claims description 29
- 238000004590 computer program Methods 0.000 claims description 12
- 238000010586 diagram Methods 0.000 description 18
- 230000003993 interaction Effects 0.000 description 9
- 230000011664 signaling Effects 0.000 description 8
- 238000004891 communication Methods 0.000 description 6
- 238000012795 verification Methods 0.000 description 4
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000013475 authorization Methods 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 238000013459 approach Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000000802 evaporation-induced self-assembly Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000011022 operating instruction Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/30—Managing network names, e.g. use of aliases or nicknames
- H04L61/3015—Name registration, generation or assignment
Definitions
- the present application relates to the communication field, and in particular to a processing method and device based on industrial Internet identification.
- Industrial Internet identifiers refer to identifiers that can uniquely identify physical resources and virtual resources. Physical resources include but are not limited to machines and products, and virtual resources include but not limited to algorithms and processes.
- the data corresponding to the Industrial Internet logo can be managed in an organized manner through the Industrial Internet logo, so as to realize cross-enterprise, cross-industry, cross-regional, and even cross-country data sharing.
- the industrial Internet identity can be carried by an active identity carrier, and the active identity carrier can embed the industrial Internet identity of the device into the device.
- the Industrial Internet logo consists of two parts, namely the logo prefix and the logo suffix. An ID prefix is used to identify a unique business principal, and an ID suffix is used to identify a unique resource.
- the embodiment of this application provides a processing method based on the Industrial Internet ID, which can write the Industrial Internet ID corresponding to the device into the device.
- the embodiment of the present application provides a processing method based on an Industrial Internet ID, which can be executed by a first device, and the first device can correspond to a device that needs to write an Industrial Internet ID.
- the first device may send a first message to the second device, where the first message is used to apply for an Industrial Internet ID for the first device, where the second device is a network manager or a network admission controller.
- the first device may receive a second message sent by the second device, where the second message indicates a result of applying for an Industrial Internet ID for the first device.
- the first device may write the target industrial Internet identifier into the first device based on the second message.
- the second device is a network management or network access controller, so using this solution, there is no need to purchase a private active identification carrier service platform, and there is no risk of being unable to apply for an industrial Internet identification.
- enterprise nodes also The first device can write the target industrial Internet identifier into the device without managing a very large number of secure access accounts.
- the first message sent by the first device to the second device may include the target Industrial Internet identifier.
- the first device may first obtain the target Industrial Internet identifier, then obtain the first message including the target Industrial Internet identifier, and then send the first message to the second device.
- the first message is used to request to register the target industrial internet identifier for the first device.
- the first device may send the first message including the target Industrial Internet identifier to the second device when it has an initial Industrial Internet identifier.
- the first device when it obtains the target industrial Internet identifier, it may first obtain the first prefix during specific implementation, where the first prefix may be, for example, the prefix corresponding to the enterprise that purchased the first device. Then, the first device may obtain the target Industrial Internet identifier based on the first prefix and the initial Industrial Internet identifier of the first device. For example, the prefix in the initial Industrial Internet identifier is replaced with the first prefix, so as to obtain the target Industrial Internet identifier.
- the first device may obtain the first prefix from extended information of a Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol, DHCP) option (option). Specifically, the first device may obtain the extended information of the DHCP option when obtaining an Internet Protocol (Internet Protocol, IP) address through a DHCP server, so as to obtain the first prefix.
- DHCP Dynamic Host Configuration Protocol
- the first message carries the initial Industrial Internet identifier of the first device.
- the second device may determine the target Industrial Internet identity based on the initial Industrial Internet identity, and request to register the target Industrial Internet identity.
- the second device may be pre-configured with a first prefix, and after receiving the first message, the second device may, based on the initial Industrial Internet identifier in the first message and the first prefix , obtain the target Industrial Internet ID, and then request to register the target Industrial Internet ID. After the target Industrial Internet ID is successfully registered, the second device may send a second message carrying the target Industrial Internet ID to the first device.
- the first message is used to request allocation of an industrial Internet identifier for the first device. For example, if the first device does not have an initial Industrial Internet ID, the first device sends to the second device a first message for requesting allocation of an Industrial Internet ID for the first device.
- the second message includes the target Industrial Internet identifier
- the first device may parse the second message to obtain the target Industrial Internet ID, so as to further write the target industrial Internet ID into the first device.
- the first device does not have an initial Industrial Internet ID
- the first device sends a first message to the second device requesting to assign an Industrial Internet ID to the first device, and receives the first message The second message carrying the target Industrial Internet identifier sent by the second device.
- the first device has an initial Industrial Internet ID
- the second device may be pre-configured with a first prefix
- the second device may Based on the initial industrial internet identifier in the first message and the first prefix, a target industrial internet identifier is obtained, and then registration of the target industrial internet identifier is requested.
- the second device may send a second message carrying the target Industrial Internet ID to the first device.
- the second device when the second device is a network admission controller, when the first device does not write the target Industrial Internet identifier into the first device, the second device may be the The first device determines the corresponding network access right. In this case, before sending the first message to the second device, the first device may also send a first authentication message to the second device, so as to obtain permission to access the network.
- the first authentication message includes the initial Industrial Internet identifier.
- the second device determines the network access right of the first device based on the initial industrial Internet identifier.
- the second device when the second device is a network admission controller, after the first device writes the target Industrial Internet identifier into the first device, the first device may The target Industrial Internet ID performs re-authentication, so as to obtain the network access authority corresponding to the target Industrial Internet ID.
- the first device after the first device writes the target industrial Internet identifier into the first device, it can send a second authentication message to the second device, and the second authentication message includes the target industrial Internet Internet identifier, so as to obtain the network access authority corresponding to the target industrial Internet identifier.
- the first device may also obtain indication information, where the indication information is used to indicate to apply for an industrial Internet identifier for the first device. After the first device obtains the indication information, it may trigger the operation of applying for an Industrial Internet ID (that is, send the first message) based on the indication information. In this way, the first device can actively trigger the operation of applying for an Industrial Internet ID based on the indication information without manual configuration.
- the indication information may be carried in DHCP option extension information.
- the first device may obtain the extended information of the DHCP option when obtaining the IP address through the DHCP server. Further, the first device can obtain the indication information by parsing the extension information of the DHCP option.
- the first message is an authentication message.
- the first message may also be used to apply for an Industrial Internet ID for the first device.
- the security authentication of the first device may be divided into two stages, and the authentication message mentioned here may be the authentication message of the first stage.
- the security authentication of the first device is divided into two stages, and after the first stage of security authentication is passed, the first device can apply to the second device (network admission controller) for a second Stage security authentication information, such as the certificate required for the second stage security authentication.
- the second device may include the target Industrial Internet identifier in the security authentication information and send it to the first device.
- the aforementioned second message may be security authentication information carrying the target industrial Internet information.
- the second device may determine the target industrial Internet identifier before carrying the target industrial Internet identifier in the security authentication information and sending it to the first device. There are many ways for the second device to determine the target Industrial Internet ID.
- the second device may request the third device (corresponding to the enterprise node) to assign an Industrial Internet ID to the first device, so as to obtain the target Industrial Internet ID;
- the first message may include an initial Industrial Internet ID, and the second device is configured with a first prefix, then the second device may be based on the initial Industrial Internet ID and the first prefix to obtain the target industrial Internet identifier.
- the second device obtains the target Industrial Internet ID, it also needs to request registration of the target Industrial Internet ID from the third device, and after the target Industrial Internet ID is successfully registered, the target Industrial Internet ID carried in the security authentication information and sent to the first device.
- the embodiment of the present application provides a processing method based on industrial Internet identification, which is applied to a second device, and the second device is a network manager or a network admission controller.
- the second device may receive the first message sent by the first device, the first message is used to apply for an Industrial Internet ID for the first device, and then the second device sends a second message to the third device, the The second message is used to apply for an Industrial Internet identifier for the first device, and the second message includes device information of the first device.
- the second device sends the second message to the third device, it may receive a third message sent by the third device for the second message, and send the third message to the first device.
- the third message indicates a result of applying for an Industrial Internet ID for the first device.
- the second device is a network management or network access controller, there is no need to purchase a private active identification carrier service platform, and there is no risk of being unable to apply for an industrial Internet identification.
- enterprises The node does not need to manage a very large number of secure access accounts, and the first device can write the target industrial Internet identifier into the device.
- the first message includes the target Industrial Internet identifier.
- the third message includes the target Industrial Internet identifier.
- the first device may parse the third message to obtain the target Industrial Internet identifier, so as to further write the target Industrial Internet identifier into the first device.
- the second device may also receive a first authentication message sent by the first device, and determine the first authentication message according to the first authentication message 1st network access for .
- the second device may also receive a second authentication message sent by the first device, and the second authentication message Including the target Industrial Internet identifier, and determining the second network access right of the first device according to the second authentication message.
- the first message carries the initial Industrial Internet identifier of the first device.
- the first message is an authentication message.
- the first device may send a first message to the second device to request the allocation of an Industrial Internet ID for the first device
- the second device may process the first message, for example, add the device information of the first device to the first message to obtain a second message, and the second message is used to request the allocation of an industrial Internet identifier for the first device .
- the first device has an initial Industrial Internet ID
- the second device can obtain a second message including the target Industrial Internet ID based on the first message, and send the second message to Send it to the third device, thereby requesting the third device to register the target industrial Internet identifier for the first device.
- the second device may obtain the second message including the target industrial Internet identifier based on the first message.
- the second message including the target Industrial Internet identifier is obtained based on the first message.
- the second device may obtain the pre-configured first prefix and the device information of the first device, and based on the The first prefix and the initial Industrial Internet ID obtain the target Industrial Internet ID, and then, based on the target Industrial Internet ID and the device information, obtain the second IP address including the device information and the target Industrial Internet ID. information.
- the embodiment of the present application provides a processing device based on industrial Internet identification, which is applied to the first device, and the device includes: a sending unit, configured to send a first message to the second device, and the first message It is used to apply for an industrial Internet identifier for the first device, and the second device is a network manager or a network admission controller; a receiving unit is used to receive a second message sent by the second device, and the second message indicates A result of applying for an Industrial Internet ID for the first device; a processing unit configured to write a target Industrial Internet ID into the first device based on the second message.
- the sending unit is configured to: send a first message carrying the target industrial Internet identifier to the second device, where the first message is used to request registration of the target industrial Internet Internet logo.
- the processing unit is further configured to: obtain the first prefix in the extended information of the DHCP option option of the Dynamic Host Configuration Protocol; Internet identifier, to obtain the target industrial Internet identifier.
- the first message carries the initial Industrial Internet identifier of the first device.
- the first message is used to request allocation of an industrial internet identifier for the first device.
- the second message includes the target Industrial Internet identifier.
- the sending unit is further configured to: before sending the first message, send a first authentication message to the second device, so as to obtain a network access permission.
- the first authentication message includes the initial Industrial Internet identifier.
- the sending unit is further configured to: send a second authentication message to the second device, where the second authentication message includes the target industrial Internet identifier.
- the processing unit is further configured to: acquire indication information, where the indication information is used to instruct to apply for an industrial Internet identifier for the first device.
- the indication information is carried in DHCP option extension information.
- the first message is an authentication message.
- the receiving unit is configured to: receive security authentication information sent by the network admission controller, where the security authentication information includes the target industrial Internet identifier.
- the embodiment of the present application provides a processing device based on industrial Internet identification, which is applied to a second device, the second device is a network manager or a network admission controller, and the device includes: a receiving unit configured to receiving a first message sent by the first device, the first message is used to apply for an Industrial Internet ID for the first device; a sending unit is used to send the second message to a third device, and the second message uses For applying for an Industrial Internet ID for the first device, the second message includes device information of the first device; the receiving unit is further configured to receive a third message, the third message indicates that the first device is A result of a device applying for an Industrial Internet ID; the sending unit is further configured to send the third message to the first device.
- the first message includes the target Industrial Internet identifier.
- the third message includes the target Industrial Internet identifier.
- the receiving unit is further configured to: receive a first authentication message sent by the first device before receiving the first message; the apparatus further includes a processing unit configured to Determine the first network access right of the first device according to the first authentication message.
- the receiving unit is further configured to receive a second authentication message sent by the first device, where the second authentication message includes the target Industrial Internet identifier; the device includes The processing unit is configured to determine the second network access right of the first device according to the second authentication message.
- the first message includes an initial Industrial Internet identifier of the first device.
- the first message is an authentication message.
- the second message is used to request to assign an industrial internet identifier to the first device.
- the second message is used to request to register the target industrial internet identifier for the first device.
- the second message is obtained based on the following methods: obtaining a pre-configured first prefix and the device information of the first device; based on the first prefix and the initial Industrial Internet identifier , to obtain the target Industrial Internet ID; based on the target Industrial Internet ID and the device information, obtain a second message including the device information and the target Industrial Internet ID, and the second message is used to request for the The first device registers the target industrial Internet identifier.
- the embodiment of the present application provides a processing system based on Industrial Internet identification, the system includes a first device and a second device; the first device is used to send a first message to the second device, and the The first message is used to apply for an Industrial Internet ID for the first device, and the second device is a network manager or network admission controller; the second device sends a second message to the first device, and the second The message indicates the result of applying for the Industrial Internet ID for the first device; the first device writes the target Industrial Internet ID into the first device according to the second message.
- the first message includes the target Industrial Internet identifier.
- the first message includes an initial Industrial Internet identifier of the first device.
- the second message includes the target Industrial Internet identifier.
- the first message is an authentication message.
- the second message is security authentication information including the target Internet identifier.
- the embodiment of the present application provides a device.
- the device includes a processor and memory.
- the memory is used to store instructions or computer programs.
- the processor is configured to execute the instructions or computer programs in the memory, execute the method described in any one of the above first aspects, or execute the method described in any one of the above second aspects.
- the embodiment of the present application provides a computer-readable storage medium, including instructions or computer programs, which, when run on a computer, cause the computer to perform the method described in any one of the above first aspects, or to perform the above The method according to any one of the second aspect.
- the embodiments of the present application provide a computer program product including instructions or computer programs, which, when run on a computer, cause the computer to execute the method described in any one of the above first aspects, or to execute the above second aspect. The method described in any one of the aspects.
- Figure 1 is a schematic diagram of an Industrial Internet logo
- FIG. 2 is a schematic diagram of an exemplary application scenario provided by an embodiment of the present application.
- FIG. 3 is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application
- FIG. 4 is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application
- FIG. 5 is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application
- FIG. 6 is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application.
- Fig. 7 is a schematic flowchart of a processing method based on industrial Internet identification provided by the embodiment of the present application.
- FIG. 8 is a schematic flowchart of another processing method based on industrial Internet identification provided by the embodiment of the present application.
- FIG. 9 is a schematic structural diagram of a processing device based on industrial Internet identification provided by an embodiment of the present application.
- Fig. 10 is a schematic structural diagram of another processing device based on industrial Internet identification provided by the embodiment of the present application.
- FIG. 11 is a schematic structural diagram of a device provided by an embodiment of the present application.
- the embodiment of the present application provides a processing method based on the Industrial Internet ID, which can write the Industrial Internet ID corresponding to the enterprise into the device after the enterprise purchases the device.
- the Industrial Internet logo includes a logo prefix and a logo suffix, and the logo prefix can reflect a unique corporate entity.
- An identification suffix is used to identify a unique resource (such as a device).
- the identification prefix can include multiple levels, as shown in Figure 1, the A in the identification prefix is used to identify the country, the A.B in the identification prefix is used to identify the B region of the country A, and the entire identification prefix A.B.C is used to identify a specific An enterprise (that is, an enterprise located in region B in country A).
- the identification suffix block_data is used to identify unique resources.
- the device does not have an Industrial Internet logo.
- the company that purchased the device needs to assign its own Industrial Internet logo to it.
- the device has an initial Industrial Internet ID
- the initial Industrial Internet ID may be the Industrial Internet ID corresponding to the enterprise that produced the device.
- the company that purchased the device needs to replace the logo prefix in the initial Industrial Internet logo with the company's logo prefix to form the device corresponding to the company's Industrial Internet logo.
- the identification prefix corresponding to equipment manufacturer A is: 88.103.1
- the industrial Internet identification is written for the equipment when it leaves the factory; then the equipment is purchased by enterprise B, and the identification prefix corresponding to enterprise B is: 88.103.2.
- the identification prefix in its Industrial Internet identification needs to be changed to 88.103.2.
- the enterprise node can also store the device information of the device and the device's Industrial Internet ID in the company.
- the enterprise nodes mentioned here refer to the nodes used by enterprises to deal with matters related to the Industrial Internet.
- an enterprise that manufactures equipment can develop its own private active identification carrier service platform. After purchasing the equipment, the enterprise that purchases the equipment can also purchase the active identification carrier service platform developed by the equipment manufacturing enterprise, so as to use the active identification
- the carrier service platform writes the industrial Internet logo corresponding to the enterprise into the device.
- the active identification carrier may directly apply for an industrial Internet identification from the enterprise node that purchased the device.
- this approach also has certain drawbacks:
- the enterprise node that purchases the device will assign an accessible account password or access token to each connected device (such as a terminal, corresponding to an active identification carrier).
- each connected device such as a terminal, corresponding to an active identification carrier.
- enterprise nodes are usually deployed in the cloud (public cloud or private cloud).
- cloud public cloud or private cloud.
- industrial network devices may be restricted from directly accessing external services. Therefore, the active identification carrier may not be able to directly access the aforementioned enterprise nodes, resulting in the inability to apply for an industrial Internet identification.
- the active identification carrier cannot automatically know when to apply for an industrial Internet identification from the enterprise node that purchased the device, and manual configuration is required.
- the embodiment of this application provides a processing method based on industrial Internet identification, which does not need to purchase a private active identification carrier service platform, and there is no risk of being unable to apply for an industrial Internet identification.
- enterprise nodes do not need to be managed A very large account for secure access.
- FIG. 2 is a schematic diagram of an exemplary application scenario provided by the embodiment of the present application.
- the identification agent 200 may run in a necessary network administrator or network admission controller of the enterprise network to which the enterprise node 300 belongs.
- the identification agent 200 since the identification agent 200 runs in the necessary network management or network admission controller of the enterprise network, the network investment can be reduced. In addition, it can also avoid network security problems that may be caused by direct external interaction of enterprise nodes, and can also greatly simplify the management scale of enterprise nodes 300 for devices that need to apply for industrial Internet identification.
- this figure is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application. in:
- the active identification device is a device that needs to write the industrial Internet identification into itself, and the active identification device may be, for example, the device 100 shown in FIG. 2 .
- the identification proxy server is a device that runs the identification proxy.
- the identification proxy may be the identification proxy 200 described in FIG. 2 , and the identification proxy server may be a network manager or a network admission controller.
- the identifier resolution node is an identifier resolution node of an enterprise, and the identifier resolution node may be, for example, the enterprise node 300 shown in FIG. 2 .
- a DHCP server can assign an IP address to an actively identified device.
- the method 100 shown in FIG. 3 can be applied to a scenario where the active identification device has an initial industrial Internet identification.
- the method 100 may include, for example, the following S101-S109.
- the active identification device obtains a DHCP option through a DHCP server, the DHCP option includes an IP address, and the extended information of the DHCP option includes a prefix 1 and an address of an identification proxy server.
- the prefix 1 is a prefix corresponding to the enterprise to which the identification resolution node belongs.
- the extended information of the DHCP option further includes indication information, and the indication information is used to instruct the active identification device to apply for an industrial Internet identification. Since the extended information includes indication information, the active identification device can apply for an industrial Internet identification based on the indication information without manual configuration.
- the information included in the extended information of the DHCP option may be pre-configured on the DHCP server.
- the active identification device obtains the target Industrial Internet identification based on the initial Industrial Internet identification and the prefix 1.
- the active identification device may replace the prefix in the initial industrial Internet identification with the prefix 1, so as to obtain the target industrial Internet identification.
- the active identification device sends a message 1 to the identification proxy server, where the message 1 includes the target Industrial Internet ID, and the message 1 is used to request registration of the target Industrial Internet ID.
- the active identification device After the active identification device obtains the target industrial Internet identification, it can obtain message 1 based on the target industrial Internet identification, and then send the message 1 to the address of the identification proxy server included in the extension information of the DHCP option. The above identifies the proxy server.
- the identification proxy server obtains message 2 according to message 1, wherein message 2 includes the target industrial Internet identification and device information of the active identification device.
- the device information of the active identification device may be configured on the identification proxy server in advance by an administrator.
- the identification proxy server is a network administrator, the network administrator already has the device information of the active identification device.
- the device information of the active identification device may include, for example, a media access control (media access control, MAC) address of the active identification device, a name of the active identification device, an initial industrial Internet identification of the active identification device, etc. , not listed here.
- a media access control media access control, MAC
- the ID proxy server sends message 2 to the ID resolution node, so as to apply for registration of the target industrial Internet ID with the ID resolution node.
- S106 The identity resolution node verifies the target industrial Internet identity.
- the identifier parsing node After the identifier parsing node receives the message 2, it can parse the message 2 to obtain the target industrial Internet identifier included in the message 2. Then, verify the target Industrial Internet ID. In an example, the identity resolution node may determine that the target Industrial Internet identity has passed the verification when the target Industrial Internet identity has not been registered.
- the identity resolution node sends a message 3 to the identity proxy server when the target industrial Internet identity passes the verification, and the message 3 is used to indicate that the registration of the target industrial Internet identity is successful.
- the identity resolution node may also save the correspondence between the target industrial Internet identity and the device information of the actively-identified device when the target industrial Internet identity passes the verification.
- the identification proxy server sends message 3 to the active identification device.
- the active identification device Based on the message 3, the active identification device writes the target industrial Internet identification into the active identification device.
- the active identification device After the active identification device receives the message 3, it may determine that the registration of the target industrial Internet identification is successful. Therefore, the active identification device can write the target industrial Internet identification into the active identification device.
- an active identification device with an initial Industrial Internet identification, it can determine the prefix 1 and the address of the identification proxy server applying for the Industrial Internet identification while obtaining the IP address, so as to use the prefix 1 to obtain the target Industrial Internet ID, and apply for registration of the target Industrial Internet ID through the ID proxy server.
- the active identification device obtains the target Industrial Internet ID based on the prefix 1 and the initial Industrial Internet ID, and sends message 1 including the target Industrial Internet ID to the ID proxy server.
- the message 1 may include an initial industrial Internet identifier.
- the identification proxy server can be configured with a prefix 1, and the identification proxy server can obtain the target industrial Internet identification based on the initial industrial Internet identification and prefix 1 included in the message 1, and then, the identification proxy server can be based on the target The Industrial Internet ID and the device information of the actively identified device obtain the aforementioned message 2, and further execute S105 and subsequent steps.
- method 100 may also be combined with a network access control (network access control, NAC) solution.
- NAC network access control
- a prefix-based authentication and authorization policy may be pre-configured on the network admission controller. For example, configure network authority 1 for prefixes not intended for the enterprise, and configure network authority 2 for prefixes aimed at the enterprise, where network resources accessible by network authority 1 are less than network resources accessible by network authority 2.
- the active identification device may send an authentication message 1 to the network admission controller, where the authentication message 1 includes an initial industrial Internet identification.
- the active identification device may send the authentication message 1 to a network authentication device, and the network authentication device forwards the authentication message 1 to a network admission controller.
- the network admission controller determines the network authority 1 based on the initial industrial Internet identification in the authentication message 1, and sends the network authority 1 to the network authentication device, so that the active identification device obtains the network authority 1. in:
- the authentication message 1 may be a message based on MAC authentication, or a message based on 802.1X authentication.
- the authentication message 1 can be obtained by extending an existing protocol message, for example, by extending an existing protocol message, the extended type length value (type length value, TLV) field is used to carry the initial Industrial Internet logo.
- the existing protocol packets include but are not limited to Link Layer Discovery Protocol (LLDP) packets, Extensible Authentication Protocol (EAP) packets, 802.11 association protocol packets, etc. etc., not listed here.
- the identification proxy server may send a re-authentication message to the network authentication device.
- the active identification device may send an authentication message 2 carrying the target Industrial Internet identifier to the network authentication device, and the network authentication device sends the authentication message 2 to the network based on the re-authentication message Admission controller.
- the network admission controller determines the network authority 2 based on the target industrial Internet identifier in the authentication message 2, and sends the network authority 2 to the network authentication device, so that the active identification device obtains the network authority 2. in:
- the authentication message 2 may be a message based on MAC authentication, or a message based on 802.1X authentication.
- the authentication message 2 can be obtained by extending an existing protocol packet, for example, extending an existing protocol packet, and the extended TLV field is used to carry the target industrial Internet identifier.
- the existing protocol packets include but not limited to LLDP packets, EAP packets, 802.11 associated protocol packets, etc., which are not listed here for description.
- FIG. 4 this figure is a signaling interaction diagram of another industrial Internet identification-based processing method provided by the embodiment of the present application. in:
- the active identification device is a device that needs to write the industrial Internet identification into itself, and the active identification device may be, for example, the device 100 shown in FIG. 2 .
- the network admission controller is a device that runs an identification agent, and the identification agent may be the identification agent 200 described in FIG. 2 .
- the identifier resolution node is an identifier resolution node of an enterprise, and the identifier resolution node may be, for example, the enterprise node 300 shown in FIG. 2 .
- the method 200 shown in FIG. 4 may also be applied to a scenario where the active identification device has an initial industrial Internet identification.
- the method 200 may include, for example, the following S201-S211.
- the active identification device sends an authentication message 3 to the network admission controller, where the authentication message 3 includes the initial industrial Internet identification of the active identification device.
- accessing the network by an active identification device may include two-stage authentication, and the authentication message 3 is used to perform the first-stage authentication, and the authentication message 3 may include device information of the active identification device.
- the authentication at the first stage may be authentication with weak security such as MAC authentication.
- the authentication message 3 it is similar to the authentication message 1.
- the authentication at the first stage may be handled by a network admission controller.
- the network admission controller may authenticate the active identification device based on the authentication message 3 .
- the first stage of certification may be manually approved. In this case, the administrator may approve the active identification device.
- the network admission controller can obtain a corresponding authentication result after authenticating the active identification device based on the authentication message 3 . If the authentication in the first stage is manually approved, the network admission controller may obtain the authentication result input by the user.
- the prefix 1 may be pre-configured on the network admission controller. After the network admission controller receives the authentication message 3 including the initial Industrial Internet ID, it can obtain the target Industrial Internet ID based on the initial Industrial Internet ID and prefix 1.
- the network admission controller generates a message 4, the message 4 includes the target industrial Internet identity and the device information of the active identification device, and the message 4 is used to request registration of the target industrial Internet identity.
- the network admission controller sends message 4 to the identity resolution node, so as to apply to the identity resolution node for registration of the target industrial Internet identity.
- S205 The identity resolution node verifies the target industrial Internet identity.
- the identity resolution node sends a message 5 to the network admission controller when the target industrial Internet identity passes the verification, and the message 5 is used to indicate that the registration of the target industrial Internet identity is successful.
- S204-S206 its specific implementation is the same as that of S105-S107, and the identification proxy server in S105-S107 is equivalent to the network admission controller in S204-S206.
- S204-S206 reference may be made to the description of S105-S107, which will not be repeated here.
- the network admission controller sends a message 6 to the network authentication device, where the message 6 is used to indicate that the authentication of the active identification device is successful.
- the network admission controller when it determines that the active identification device has passed the authentication, it can execute the "obtain the target industrial Internet identification based on the initial industrial Internet identification and prefix 1" in S202 and the subsequent S203- S207.
- S207 may be performed before the "obtain the target Industrial Internet ID based on the initial Industrial Internet ID and prefix 1" in S202 is executed, it may also be performed between S202-S206, and it may also be performed with the step in S202 "Get the target industrial internet identifier based on the initial industrial internet identifier and prefix 1" is executed at the same time, which is not specifically limited in this embodiment of the present application.
- the active identification device After the active identification device obtains the IP address, it sends a message 7 to the network admission controller, where the message 7 is used to request security authentication information.
- the actively identified device can obtain an IP address through the DHCP server.
- the security authentication information is information required for the active identification device to perform the second-stage security authentication.
- the security authentication information may include an 802.1X authentication certificate.
- the security authentication information may also include other information, which will not be listed here.
- the network admission controller sends the security authentication information including the target Industrial Internet ID to the active ID device.
- the network admission controller After the network admission controller receives the message 5, it can determine that the registration of the target industrial Internet identifier is successful. Therefore, after receiving the message 7, the network admission controller may obtain the target industrial Internet identifier, and send the security authentication information including the target industrial Internet identifier to the active identification device.
- the active identification device writes the target industrial Internet identification into the active identification device.
- the active identification device After the active identification device receives the security authentication information, it can analyze the security authentication information to obtain the target industrial Internet identifier, and then write the target industrial Internet identifier into the active identification device.
- the active identification device sends an authentication message 4 to the network admission controller, where the authentication message 4 includes the security authentication information.
- the authentication message 4 may be an authentication message corresponding to 802.1X authentication.
- the network admission controller may perform security authentication on the active identification device based on the security authentication information in the authentication message 4.
- the security authentication of the active identification terminal can be divided into two stages of authentication.
- the active identification device with the initial industrial Internet identification it can be successfully authenticated in the first stage and obtain the second authentication.
- the target Industrial Internet logo is obtained.
- this figure is a signaling interaction diagram of a processing method based on industrial Internet identification provided by an embodiment of the present application. in:
- the identification proxy server and the identification resolution node, reference may be made to relevant descriptions in the method 100, and repeated descriptions are not repeated here.
- the method 300 shown in FIG. 5 can be applied to a scenario where the active identification device does not have an initial industrial Internet identification.
- the method 300 may include, for example, the following S301-S308.
- the active identification device obtains a DHCP option through a DHCP server, the DHCP option includes an IP address, and the extended information of the DHCP option includes an address of an identification proxy server.
- the extended information of the DHCP option further includes indication information, and the indication information is used to instruct the active identification device to apply for an industrial Internet identification.
- the information included in the extended information of the DHCP option may be pre-configured on the DHCP server.
- the active identification device sends a message 1' to the identification proxy server, and the message 1' is used to request allocation of an industrial Internet identification.
- the identification proxy server obtains message 2' according to message 1', wherein message 2' includes the device information of the active identification device.
- the device information of the active identification device may be configured on the identification proxy server in advance by an administrator.
- the identification proxy server is a network administrator, the network administrator already has the device information of the active identification device.
- the identification proxy server can obtain the message 2' based on the message 1' and the device information of the active identification device. For example, the identification proxy server may add the device information to the message 1' to obtain the message 2'.
- the identification proxy server sends the message 2' to the identification resolution node, so as to request the identification resolution node to allocate an industrial Internet identification for the active identification device.
- the identity resolution node determines the target industrial Internet identity as the industrial Internet identity allocated to the active identity device.
- the identification resolution node can obtain the target industrial Internet identification according to certain rules, for example, randomly generate an identification suffix, and if the randomly generated identification suffix is not used, based on the identification suffix and the corresponding identification prefix of the enterprise , to obtain the target Industrial Internet ID.
- S306 The identity resolution node sends the message 3' carrying the target industrial Internet identity to the identity proxy server.
- the identification proxy server sends the message 3' to the active identification device.
- the active identification device writes the target industrial Internet identification into the active identification device based on the message 3'.
- the active identification device After the active identification device receives the message 3', it can analyze the message 3' to obtain the target industrial Internet identification included in the message 3', so as to write the target industrial Internet identification into the active identification device.
- an active identification device that does not have an initial Industrial Internet identification, it can determine the address of the identification proxy server that previously applied for an Industrial Internet identification based on the extended information of the DHCP option while obtaining an IP address , so as to request to assign an Industrial Internet ID to itself through the ID proxy server.
- method 300 may also be combined with a NAC solution. Specifically: when the active identification device does not have an industrial Internet identification, determine the corresponding network access authority for the active identification device. After the active identification device obtains the target Industrial Internet ID, re-authentication is performed based on the target Industrial Internet ID, so as to obtain the network access authority corresponding to the target Industrial Internet ID.
- a prefix-based authentication and authorization policy may be pre-configured on the network admission controller. For example, configure network authority 1 for no prefix, and configure network authority 2 for the enterprise-specific prefix.
- the network resources accessible by network authority 1 are less than those accessible by network authority 2.
- the active identification device may send an authentication message 1' to the network admission controller, and the authentication message 1' does not include the industrial Internet identification.
- the active identification device may send the authentication message 1' to the network authentication device, and the network authentication device sends the authentication message 1' to the network admission controller.
- the network admission controller determines the network authority 1 based on the authentication message 1', and sends the network authority 1 to the network authentication device, so that the active identification device obtains the network authority 1. in:
- the authentication message 1' can also be a message based on MAC authentication, or a message based on 802.1X authentication.
- the authentication message 1' may be an existing protocol message.
- the existing protocol packets include but are not limited to Link Layer Discovery Protocol (LLDP) packets, Extensible Authentication Protocol (EAP) packets, 802.11 association protocol packets, etc. Etc., not enumerating and explaining one by one here.
- the identification proxy server may send a re-authentication message to the network authentication device.
- the active identification device may send an authentication message 2' carrying the target Industrial Internet identifier to the network authentication device, and the network authentication device sends the authentication message 2' to the network authentication device based on the re-authentication message.
- the network admission controller described above. The network admission controller determines the network authority 2 based on the target industrial Internet identifier in the authentication message 2', and sends the network authority 2 to the network authentication device, so that the active identification device obtains the network authority 2 . in:
- the authentication message 2' may be a message based on MAC authentication, or a message based on 802.1X authentication. , which will not be repeated here.
- FIG. 6 this figure is a signaling interaction diagram of another industrial Internet identification-based processing method provided by the embodiment of the present application. in:
- the network admission controller and the identification resolution node reference may be made to the description of the method 200 above, and the description will not be repeated here.
- the method 400 shown in FIG. 6 may also be applied to a scenario where the active identification device does not have an initial industrial Internet identification.
- the method 400 may include, for example, the following S401-S410.
- S401 The active identification device sends an authentication message 3' to the network admission controller.
- actively identifying the device to access the network may include two stages of authentication, the authentication message 3' is used to perform the first stage of authentication, and the authentication message 3' may include the device of the actively identifying device information.
- the authentication at the first stage may be authentication with weak security such as MAC authentication.
- the authentication message 3' it is similar to the authentication message 1'.
- the authentication at the first stage may be handled by a network admission controller, and in this case, the network admission controller may authenticate the active identification device based on the authentication message 3'.
- the first stage of certification may be manually approved. In this case, the administrator may approve the active identification device.
- the network admission controller can obtain a corresponding authentication result after authenticating the active identification device based on the authentication message 3'. If the authentication at the first stage is manually approved, the network admission controller can obtain the authentication result input by the user.
- the network admission controller sends a message 4' to the identity resolution node, so as to request the identity resolution node to allocate an industrial Internet identity for the active identity device.
- the identity resolution node determines the target industrial Internet identity as the industrial Internet identity assigned to the active identity device based on the message 4'.
- identification resolution node determining the target Industrial Internet ID as the Industrial Internet ID assigned to the active identification device, reference may be made to relevant descriptions in S305, and repeated descriptions are not repeated here.
- the identifier resolution node may also store the correspondence between the target industrial Internet identifier and the device information of the active identifier device.
- the identifier resolution node sends a message 5' to the network admission controller, and the message 5' carries the target industrial Internet identifier.
- the network admission controller After the network admission controller receives the message 5', it can save the target industrial Internet identifier. As an example, the network admission controller may save the correspondence between the target industrial Internet identifier and the identifier of the active identifier device. Wherein, the identifier of the active identification device may be, for example, the MAC address of the active identification device.
- S406 The network admission controller sends a message 6' to the network authentication device, where the message 6' is used to indicate that the authentication of the active identification device is successful.
- the active identification device After the active identification device obtains the IP address, it sends a message 7' to the network admission controller, where the message 7' is used to request security authentication information.
- the actively identified device can obtain an IP address through the DHCP server.
- Said message 7' includes the identification of said active identification device.
- the security authentication information is information required for the active identification device to perform the second-stage security authentication.
- the security authentication information may include an 802.1X authentication certificate.
- the security authentication information may also include other information, which will not be listed here.
- the network admission controller sends security authentication information including the target Industrial Internet ID to the active ID device.
- the network admission controller may search for the correspondence between the aforementioned target industrial Internet identifier and the identifier of the active identifier device based on the identifier of the active identifier device in the message 7' relationship, so as to obtain the target industrial Internet identity, and then send the security authentication information including the target industrial Internet identity to the active identification device.
- the active identification device writes the target industrial Internet identification into the active identification device.
- the active identification device After the active identification device receives the security authentication information, it can analyze the security authentication information to obtain the target industrial Internet identifier, and then write the target industrial Internet identifier into the active identification device.
- the active identification device sends an authentication message 4' to the network admission controller, where the authentication message 4' includes the security authentication information.
- the authentication message 4' may be an authentication message corresponding to 802.1X authentication.
- the network admission controller may perform security authentication on the active identification device based on the security authentication information in the authentication message 4'.
- the security authentication of the active identification terminal can be divided into two stages of authentication.
- the target industrial Internet logo is obtained.
- this figure is a schematic flowchart of a processing method based on industrial Internet identification provided by an embodiment of the present application.
- the first device is a device that needs to write the industrial Internet identifier into itself, and the first device may be, for example, the device 100 shown in FIG. 2 .
- the second device is a device running an identification agent.
- the identification agent may be the identification agent 200 described in FIG. 2
- the second device may be a network manager or a network admission controller.
- the method shown in FIG. 7 can be applied to the method 100 , method 200 , method 300 and method 400 provided in the above embodiments.
- the method 500 shown in FIG. 7 may include, for example, the following S501-S503.
- the first device sends a first message to a second device, where the first message is used to apply for an Industrial Internet ID for the first device, and the second device is a network manager or a network admission controller.
- the first device receives a second message sent by the second device, where the second message indicates a result of applying for an Industrial Internet ID for the first device.
- the first device writes the target Industrial Internet identifier into the first device based on the second message.
- the first device corresponds to the active identification device in the method 100; the second device corresponds to the identification proxy server in the method 100.
- the first message corresponds to message 1 in method 100 ; the second message corresponds to message 3 in method 100 .
- the first device corresponds to the active identification device in the method 200; the second device corresponds to the network admission server in the method 200.
- the first message corresponds to the authentication message 3 in the method 200; the second message corresponds to the security authentication information in the method 200.
- the first device corresponds to the active identification device in the method 300; the second device corresponds to the identification proxy server in the method 300.
- the first message corresponds to message 1' in method 100; the second message corresponds to message 3' in method 100.
- the first device corresponds to the active identification device in the method 400; the second device corresponds to the network admission server in the method 400.
- the first message corresponds to the authentication message 3' in the method 400; the second message corresponds to the security authentication information in the method 400.
- the sending the first message to the second device includes:
- the method further includes:
- the first message carries the initial Industrial Internet identifier of the first device.
- the first message is used to request allocation of an industrial Internet identifier for the first device.
- the second message includes the target Industrial Internet identifier.
- the method before sending the first message, the method further includes:
- the first authentication message in method 500 may correspond to authentication message 1 in the above embodiment, or may correspond to authentication message 1' in the above embodiment.
- the first authentication message includes the initial Industrial Internet identifier.
- the method further includes:
- the second authentication message in method 500 may correspond to authentication message 2 in the above embodiment, or may correspond to authentication message 2' in the above embodiment.
- the method further includes:
- the indication information in method 500 may be the indication information mentioned in method 100 or the indication information mentioned in method 300 .
- the indication information is carried in DHCP option extension information.
- the first message is an authentication message.
- the authentication message mentioned here may correspond to the authentication message 3 in the method 200, and may also correspond to the authentication message 3' in the method 400.
- the receiving the second message sent by the second device includes:
- the security authentication information mentioned here may correspond to the security authentication information in method 200 , and may also correspond to the security authentication information in method 400 .
- FIG. 8 this figure is a schematic flow chart of another industrial Internet identification-based processing method provided by the embodiment of the present application.
- the first device is a device that needs to write the industrial Internet identifier into itself, and the first device may be, for example, the device 100 shown in FIG. 2 .
- the second device is a device running an identification agent.
- the identification agent may be the identification agent 200 described in FIG. 2
- the second device may be a network manager or a network admission controller.
- the method shown in FIG. 8 may be applied to the method 100 and the method 300 provided in the above embodiments.
- the method 600 shown in FIG. 8 may include, for example, the following S601-S604.
- the second device receives a first message sent by the first device, where the first message is used to apply for an Industrial Internet ID for the first device.
- the first message corresponds to message 1 in method 100 .
- the first message corresponds to message 1' in method 300.
- the second device sends the second message to the third device, where the second message is used to apply for an Industrial Internet identifier for the first device, and the second message includes device information of the first device.
- the second message corresponds to message 2 in method 100 .
- the second message corresponds to message 2' in method 300.
- the second device receives a third message sent by the third device, where the third message indicates a result of applying for an Industrial Internet ID for the first device.
- the third message corresponds to message 3 in method 100 .
- the third message corresponds to message 3' in method 300.
- S604 The second device sends the third message to the first device.
- the first message includes the target Industrial Internet identifier.
- the third message includes the target Industrial Internet identifier.
- the method before receiving the first message, further includes: receiving a first authentication message sent by the first device; determining the first authentication message of the first device according to the first authentication message 1st network access for .
- the first authentication message in method 600 may correspond to authentication message 1 in the above embodiment, or may correspond to authentication message 1' in the above embodiment.
- the method further includes: receiving a second authentication message sent by the first device, where the second authentication message includes the target Industrial Internet identifier; A second network access right of the first device is determined.
- the second authentication message in method 600 may correspond to authentication message 2 in the above embodiment, or may correspond to authentication message 2' in the above embodiment.
- the first message includes an initial Industrial Internet identifier of the first device.
- the first message is an authentication message.
- the second message is used to request to assign an industrial Internet identifier to the first device.
- the second message is used to request to register the target industrial internet identifier for the first device.
- the second message is obtained based on the following manner: obtaining a pre-configured first prefix and device information of the first device; based on the first prefix and the initial industrial Internet identifier, Obtain the target Industrial Internet ID; based on the target Industrial Internet ID and the device information, obtain a second message including the device information and the target Industrial Internet ID, and the second message is used to request for the The first device registers the target Industrial Internet identifier. in:
- the embodiment of the present application also provides an Industrial Internet ID-based processing device, see FIG. 9 , which is a schematic structural diagram of an Industrial Internet ID-based processing device provided in the embodiment of the present application.
- the apparatus 900 shown in FIG. 9 may be applied to the first device, for executing the above method 500 performed by the first device.
- the apparatus 900 includes: a sending unit 901 , a receiving unit 902 and a processing unit 903 .
- the sending unit 901 is configured to send a first message to a second device, the first message is used to apply for an Industrial Internet ID for the first device, and the second device is a network manager or a network admission controller; a receiving unit 902 , configured to receive a second message sent by the second device, the second message indicating the result of applying for an Industrial Internet ID for the first device; the processing unit 903 is configured to, based on the second message, assign the target industrial The Internet identifier is written into the first device.
- the sending unit 901 is configured to: send a first message carrying the target Industrial Internet identifier to the second device, where the first message is used to request registration of the target Industrial internet logo.
- the processing unit 903 is further configured to: obtain the first prefix in the extended information of the DHCP option option of the Dynamic Host Configuration Protocol; according to the first prefix and the initial Industrial Internet ID, to obtain the target Industrial Internet ID.
- the first message carries the initial Industrial Internet identifier of the first device.
- the first message is used to request allocation of an industrial internet identifier for the first device.
- the second message includes the target Industrial Internet identifier.
- the sending unit 901 is further configured to: before sending the first message, send a first authentication message to the second device, so as to obtain a network access permission.
- the first authentication message includes the initial Industrial Internet identifier.
- the sending unit 901 is further configured to: send a second authentication message to the second device, where the second authentication message includes the target industrial Internet identifier.
- the processing unit 903 is further configured to: acquire indication information, where the indication information is used to instruct to apply for an industrial Internet identifier for the first device.
- the indication information is carried in DHCP option extension information.
- the first message is an authentication message.
- the receiving unit 903 is configured to: receive security authentication information sent by the network admission controller, where the security authentication information includes the target industrial Internet identifier.
- the embodiment of the present application also provides an Industrial Internet ID-based processing device, see FIG. 10 , which is a schematic structural diagram of another Industrial Internet ID-based processing device provided in the embodiment of the present application.
- the apparatus 1000 shown in FIG. 10 may be applied to a second device, for executing the above method 600 performed by the second device.
- the apparatus 1000 includes: a receiving unit 1001 and a sending unit 1002 .
- the receiving unit 1001 is configured to receive a first message sent by the first device, and the first message is used to apply for an Industrial Internet ID for the first device; the sending unit 1002 is configured to send the second message to a third device , the second message is used to apply for an Industrial Internet ID for the first device, the second message includes device information of the first device; the receiving unit 1001 is also used to receive a third message, the The third message indicates a result of applying for an Industrial Internet ID for the first device; the sending unit 1002 is further configured to send the third message to the first device.
- the first message includes the target Industrial Internet identifier.
- the third message includes the target Industrial Internet identifier.
- the receiving unit 1001 is further configured to: before receiving the first message, receive a first authentication message sent by the first device; the apparatus further includes a processing unit configured to: Determine the first network access right of the first device according to the first authentication message.
- the receiving unit 1001 is further configured to receive a second authentication message sent by the first device, where the second authentication message includes the target Industrial Internet identifier; the apparatus includes The processing unit is configured to determine the second network access right of the first device according to the second authentication message.
- the first message includes an initial Industrial Internet identifier of the first device.
- the first message is an authentication message.
- the second message is used to request to assign an industrial internet identifier to the first device.
- the second message is used to request to register the target industrial internet identifier for the first device.
- the second message is obtained based on the following methods: obtaining a pre-configured first prefix and the device information of the first device; based on the first prefix and the initial Industrial Internet identifier , to obtain the target Industrial Internet ID; based on the target Industrial Internet ID and the device information, obtain a second message including the device information and the target Industrial Internet ID, and the second message is used to request for the The first device registers the target industrial Internet identifier.
- obtaining a pre-configured first prefix and the device information of the first device based on the first prefix and the initial Industrial Internet identifier , to obtain the target Industrial Internet ID; based on the target Industrial Internet ID and the device information, obtain a second message including the device information and the target Industrial Internet ID, and the second message is used to request for the
- the first device registers the target industrial Internet identifier.
- a device 1100 includes: a processor 1110 , a communication interface 1120 and a memory 1130 .
- the number of processors 1110 in the device 1100 may be one or more, and one processor is taken as an example in FIG. 11 .
- the processor 1110, the communication interface 1120, and the memory 1130 may be connected through a bus system or other methods, wherein the connection through the bus system 1140 is taken as an example in FIG. 11 .
- the processor 1110 may be a central processing unit (central processing unit, CPU), a network processor (network processor, NP) or a combination of CPU and NP.
- the processor 1110 may further include a hardware chip.
- the aforementioned hardware chip may be an application-specific integrated circuit (application-specific integrated circuit, ASIC), a programmable logic device (programmable logic device, PLD) or a combination thereof.
- the aforementioned PLD may be a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof.
- the memory 1130 may include a volatile memory (English: volatile memory), such as a random-access memory (random-access memory, RAM); the memory 1130 may also include a non-volatile memory (English: non-volatile memory), such as a fast Flash memory (English: flash memory), hard disk (hard disk drive, HDD) or solid-state drive (solid-state drive, SSD); the memory 1130 may also include a combination of the above types of memory.
- the memory 1130 may, for example, store extended information of DHCP options including the first prefix; when the device 1100 corresponds to the processing device 1000 based on the Industrial Internet ID shown in FIG. 10 , The storage 1130 may, for example, store device information of the first device.
- the memory 1130 stores an operating system and programs, executable modules or data structures, or their subsets, or their extended sets, where the programs may include various operating instructions for implementing various operations.
- the operating system may include various system programs for implementing various basic services and processing hardware-based tasks.
- the processor 1110 can read the program in the memory 1130 to implement the processing method based on the Industrial Internet ID provided by the embodiment of the present application (such as the processing method based on the Industrial Internet ID executed by the first device, or the industrial Internet ID-based processing method executed by the second device). treatment of Internet identifiers).
- the bus system 1140 may be a peripheral component interconnect standard (peripheral component interconnect, PCI) bus or an extended industry standard architecture (extended industry standard architecture, EISA) bus or the like.
- PCI peripheral component interconnect
- EISA extended industry standard architecture
- the bus system 1140 can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 11 , but it does not mean that there is only one bus or one type of bus.
- the embodiment of the present application also provides a computer-readable storage medium, including an instruction or a computer program, which, when run on a computer, causes the computer to execute the industrial Internet identification-based processing method provided in the above embodiments.
- the embodiment of the present application also provides a computer program product including an instruction or a computer program, which, when run on a computer, causes the computer to execute the industrial Internet identification-based processing method provided in the above embodiments.
- the disclosed system, device and method can be implemented in other ways.
- the device embodiments described above are only illustrative.
- the division of units is only a logical business division. In actual implementation, there may be other division methods.
- multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented.
- the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
- a unit described as a separate component may or may not be physically separated, and a component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
- each business unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
- the above-mentioned integrated units can be implemented in the form of hardware or in the form of software business units.
- the integrated unit is realized in the form of a software business unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
- the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods in various embodiments of the present application.
- the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .
- the services described in the present invention may be implemented by hardware, software, firmware or any combination thereof.
- the services may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
- Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
- a storage media may be any available media that can be accessed by a general purpose or special purpose computer.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本申请实施例提供了一种基于工业互联网标识的处理方法,第一设备可以向第二设备发送第一消息,该第一消息用于为第一设备申请工业互联网标识,其中,第二设备为网管或者网络准入控制器。而后,第一设备可以接收第二设备发送的第二消息,第二消息指示为第一设备申请工业互联网标识的结果。第一设备接收第二消息之后,可以并基于第二消息,将目标工业互联网标识写入到第一设备中。正是由于第二设备为网管或者网络准入控制器,因此,利用本方案,既无需购买私有的主动标识载体服务平台,也不会存在无法申请到工业互联网标识的风险,另外,企业节点也无需管理十分庞大的安全访问的账号,第一设备就可以将目标工业互联网标识写入到设备内部。
Description
本申请要求于2022年1月13日提交中国国家知识产权局、申请号为202210038368.1、申请名称为“一种基于工业互联网标识的处理方法及装置”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
本申请涉及通信领域,尤其涉及一种基于工业互联网标识的处理方法及装置。
工业互联网标识是指能够唯一识别物理资源以及虚拟资源的身份标识,其中,物理资源包括但不限于机器以及产品,虚拟资源包括但不限于算法以及工序。通过工业互联网标识可以将工业互联网标识所对应的数据进行有组织的管理,从而实现跨企业、跨行业、跨地区、甚至跨国家的数据共享。
在一个示例中,工业互联网标识可以通过主动标识载体承载,主动标识载体可以将设备的工业互联网标识嵌入到设备内部。工业互联网标识包括两部分,分别为标识前缀和标识后缀。标识前缀用于标识唯一的企业主体,标识后缀用于标识唯一的资源。
企业在购买设备后,需要将该设备对应本企业的工业互联网标识写入到设备内部。如何将该设备对应本企业的工业互联网标识写入到设备内部,是目前尚待解决的问题。
发明内容
本申请实施例提供了一种基于工业互联网标识的处理方法,可以将设备对应的工业互联网标识写入到设备内部。
第一方面,本申请实施例提供了一种基于工业互联网标识的处理方法,可以由第一设备执行,第一设备可以对应需要写入工业互联网标识的设备。第一设备可以向第二设备发送第一消息,该第一消息用于为所述第一设备申请工业互联网标识,其中,所述第二设备为网管或者网络准入控制器。而后,所述第一设备可以接收所述第二设备发送的第二消息,所述第二消息指示为所述第一设备申请工业互联网标识的结果。第一设备接收第二消息之后,可以基于所述第二消息,将目标工业互联网标识写入到第一设备中。正是由于第二设备为网管或者网络准入控制器,因此,利用本方案,既无需购买私有的主动标识载体服务平台,也不会存在无法申请到工业互联网标识的风险,另外,企业节点也无需管理十分庞大的安全访问的账号,第一设备就可以将目标工业互联网标识写入到设备内部。
在一种可能的实现方式中,第一设备发送给第二设备的第一消息中可以包括目标工业互联网标识。例如,所述第一设备可以首先获取目标工业互联网标识,而后,得到包括所述目标工业互联网标识的所述第一消息,再将所述第一消息发送给第二设备。对于这种情况,所述第一消息用于请求为第一设备注册所述目标工业互联网标识。在一个示例中,所述第一设备可以在自身具备初始工业互联网标识的情况下,向所述第二设备发送包括所述目标工业互联网标识的第一消息。
在一种可能的实现方式中,第一设备获取目标工业互联网标识在具体实现时,可以首先获取第一前缀,其中,第一前缀例如可以是购买所述第一设备的企业对应的前缀。而后,所述第一设备可以基于所述第一前缀和所述第一设备的初始工业互联网标识,得到所述目标工业互联网标识。例如,将所述初始工业互联网标识中的前缀替换为所述第一前缀,从 而得到所述目标工业互联网标识。在一个示例中,所述第一设备可以从动态主机配置协议(Dynamic Host Configuration Protocol,DHCP)选项(option)的扩展信息中获得所述第一前缀。具体地,所述第一设备可以在通过DHCP服务器获取因特网协议(Internet Protocol,IP)地址时,获得所述DHCP选项的扩展信息,从而得到所述第一前缀。
在一种实现可能的实现方式中,所述第一消息携带所述第一设备的初始工业互联网标识。对于这种情况,第二设备可以基于所述初始工业互联网标识确定所述目标工业互联网标识,并请求注册所述目标工业互联网标识。在一个示例中,所述第二设备上可以预先配置有第一前缀,第二设备接收到所述第一消息之后,可以基于所述第一消息中的初始工业互联网标识和所述第一前缀,得到目标工业互联网标识,而后,请求注册所述目标工业互联网标识。在所述目标工业互联网标识注册成功之后,所述第二设备可以将携带所述目标工业互联网标识的第二消息发送给第一设备。
在一种可能的实现方式中,所述第一消息用于请求为所述第一设备分配工业互联网标识。例如,所述第一设备不具备初始工业互联网标识,则所述第一设备向第二设备发送用于请求为所述第一设备分配工业互联网标识的第一消息。
在一种可能的实现方式中,所述第二消息包括所述目标工业互联网标识,第一设备接收到所述第二消息之后,可以对所述第二消息进行解析,得到所述目标工业互联网标识,从而进一步将目标工业互联网标识写入到第一设备内部。在一个示例中,所述第一设备不具备初始工业互联网标识,所述第一设备向第二设备发送用于请求为所述第一设备分配工业互联网标识的第一消息,并接收所述第二设备发送的携带所述目标工业互联网标识的所述第二消息。在又一个示例中,所述第一设备具备初始工业互联网标识,所述第二设备上可以预先配置有第一前缀,第二设备接收到包括所述初始工业互联网标识的第一消息之后,可以基于所述第一消息中的初始工业互联网标识和所述第一前缀,得到目标工业互联网标识,而后,请求注册所述目标工业互联网标识。在所述目标工业互联网标识注册成功之后,所述第二设备可以将携带所述目标工业互联网标识的第二消息发送给第一设备。
在一种可能的实现方式中,当所述第二设备为网络准入控制器时,在所述第一设备未将目标工业互联网标识写入到第一设备中时,第二设备可以为所述第一设备确定对应的网络访问权限。对于这种情况,所述第一设备在向第二设备发送第一消息之前,还可以向所述第二设备发送第一认证消息,以获得接入网络的权限。
在一种可能的实现方式中,所述第一认证消息中包括所述初始工业互联网标识。相应的,第二设备基于所述初始工业互联网标识确定所述第一设备的网络访问权限。
在一种可能的实现方式中,当所述第二设备为网络准入控制器时,在所述第一设备将目标工业互联网标识写入到第一设备中之后,所述第一设备可以基于所述目标工业互联网标识进行重认证,从而获得与所述目标工业互联网标识对应的网络访问权限。对于这种情况,所述第一设备在将目标工业互联网标识写入到第一设备中之后,可以向所述第二设备发送第二认证消息,所述第二认证消息中包括所述目标工业互联网标识,从而获取与所述目标工业互联网标识对应的网络访问权限。
在一种可能的实现方式中,第一设备在向第二设备发送第一消息之前,还可以获取指示信息,所述指示信息用于指示为所述第一设备申请工业互联网标识。第一设备获取所述 指示信息之后,可以基于所述指示信息触发申请工业互联网标识的操作(即发送第一消息)。这样一来,第一设备即可基于所述指示信息主动触发申请工业互联网标识的操作,而无需人为手工配置。
在一种可能的实现方式中,所述指示信息可以携带在DHCP option扩展信息中。具体地,所述第一设备可以在通过DHCP服务器获取IP地址时,获得所述DHCP选项的扩展信息。进一步地,所述第一设备对所述DHCP选项的扩展信息进行解析即可获得所述指示信息。
在一种可能的实现方式中,所述第一消息为认证消息。换言之,所述第一消息除了可以用于请求进行安全认证之外,还可以用于为所述第一设备申请工业互联网标识。在一个示例中,可以将第一设备的安全认证划分成两个阶段,此处提及的认证消息,可以是第一阶段的认证消息。
在一种可能的实现方式中,将第一设备的安全认证划分成两个阶段,则在第一阶段安全认证通过之后,第一设备可以向第二设备(网络准入控制器)申请第二阶段的安全认证信息,例如第二阶段安全认证所需的证书。对于这种情况,所述第二设备可以将所述目标工业互联网标识携带在所述安全认证信息中发送给所述第一设备。换言之,对于这种情况,前述第二消息可以是携带所述目标工业互联网信息的安全认证信息。其中,第二设备在将所述目标工业互联网标识携带在所述安全认证信息中发送给所述第一设备之前,可以确定所述目标工业互联网标识。第二设备确定目标工业互联网标识可以有多种实现方式,在一个示例中,所述第二设备可以向第三设备(对应企业节点)请求为第一设备分配工业互联网标识,从而得到所述目标工业互联网标识;在又一个示例中,所述第一消息中可以包括初始工业互联网标识,而所述第二设备上配置有第一前缀,则所述第二设备可以基于所述初始工业互联网标识和所述第一前缀得到所述目标工业互联网标识。当然,所述第二设备得到所述目标工业互联网标识之后,还需要向第三设备请求注册所述目标工业互联网标识,并在所述目标工业互联网标识注册成功之后,将所述目标工业互联网标识携带在所述安全认证信息中发送给所述第一设备。
第二方面,本申请实施例提供了一种基于工业互联网标识的处理方法,应用于第二设备,所述第二设备为网管或者网络准入控制器。第二设备可以接收第一设备发送的第一消息,所述第一消息用于为所述第一设备申请工业互联网标识,而后,所述第二设备向第三设备发送第二消息,所述第二消息用于为所述第一设备申请工业互联网标识,所述第二消息包括所述第一设备的设备信息。第二设备向所述第三设备发送第二消息之后,可以接收所述第三设备针对所述第二消息发送的第三消息,并将所述第三消息发送给所述第一设备。所述第三消息指示为所述第一设备申请工业互联网标识的结果。由此可见,利用本方案,由于第二设备为网管或者网络准入控制器,因此,既无需购买私有的主动标识载体服务平台,也不会存在无法申请到工业互联网标识的风险,另外,企业节点也无需管理十分庞大的安全访问的账号,第一设备就可以将目标工业互联网标识写入到设备内部。
在一种可能的实现方式中,所述第一消息包括所述目标工业互联网标识。
在一种可能的实现方式中,所述第三消息包括所述目标工业互联网标识。第一设备接收到所述第三消息之后,可以对所述第三消息进行解析,得到所述目标工业互联网标识, 从而进一步将目标工业互联网标识写入到第一设备内部。
在一种可能的实现方式中,第二设备在接收所述第一消息之前,还可以接收所述第一设备发送的第一认证消息,并根据所述第一认证消息确定所述第一设备的第一网络访问权限。
在一种可能的实现方式中,所述第二设备在将第三消息发送给第一设备之后,第二设备还可以接收所述第一设备发送的第二认证消息,所述第二认证消息中包括所述目标工业互联网标识,并根据所述第二认证消息确定所述第一设备的第二网络访问权限。
在一种实现可能的实现方式中,所述第一消息携带所述第一设备的初始工业互联网标识。
在一种实现可能的实现方式中,所述第一消息为认证消息。
在一种实现可能的实现方式中,所述第一设备不具备初始工业互联网标识,则所述第一设备可以向第二设备发送用于请求为第一设备分配工业互联网标识的第一消息,所述第二设备可以对第一消息进行处理,例如将第一设备的设备信息添加到第一消息中,从而得到第二消息,所述第二消息用于请求为第一设备分配工业互联网标识。
在一种实现可能的实现方式中,所述第一设备具备初始工业互联网标识,则所述第二设备可以基于所述第一消息得到包括目标工业互联网标识的第二消息,并将第二消息发送给第三设备,从而请求第三设备为第一设备注册目标工业互联网标识。
在一种实现可能的实现方式中,所述第二设备在将第二消息发送给第三设备之前,可以基于第一消息得到包括目标工业互联网标识的第二消息。其中,基于所述第一消息得到包括目标工业互联网标识的第二消息在具体实现时,所述第二设备可以获取预先配置的第一前缀和所述第一设备的设备信息,并基于所述第一前缀和所述初始工业互联网标识,得到所述目标工业互联网标识,而后,基于所述目标工业互联网标识和所述设备信息,得到包括所述设备信息和所述目标工业互联网标识的第二消息。
第三方面,本申请实施例提供了一种基于工业互联网标识的处理装置,应用于第一设备,所述装置包括:发送单元,用于向第二设备发送第一消息,所述第一消息用于为所述第一设备申请工业互联网标识,所述第二设备为网管或者网络准入控制器;接收单元,用于接收所述第二设备发送的第二消息,所述第二消息指示为所述第一设备申请工业互联网标识的结果;处理单元,用于基于所述第二消息,将目标工业互联网标识写入到所述第一设备中。
在一种实现可能的实现方式中,所述发送单元,用于:向所述第二设备发送携带所述目标工业互联网标识的第一消息,所述第一消息用于请求注册所述目标工业互联网标识。
在一种实现可能的实现方式中,所述处理单元还用于:获取动态主机配置协议DHCP选项option的扩展信息中的第一前缀;根据所述第一前缀和所述第一设备的初始工业互联网标识,得到所述目标工业互联网标识。
在一种实现可能的实现方式中,所述第一消息携带所述第一设备的初始工业互联网标识。
在一种实现可能的实现方式中,所述第一消息用于请求为所述第一设备分配工业互联网标识。
在一种实现可能的实现方式中,所述第二消息包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述发送单元还用于:在发送所述第一消息之前,向所述第二设备发送第一认证消息,以获得接入网络的权限。
在一种实现可能的实现方式中,所述第一认证消息包括所述初始工业互联网标识。
在一种实现可能的实现方式中,所述发送单元还用于:向所述第二设备发送第二认证消息,所述第二认证消息中包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述处理单元还用于:获取指示信息,所述指示信息用于指示为所述第一设备申请工业互联网标识。
在一种实现可能的实现方式中,所述指示信息携带在DHCP option扩展信息中。
在一种实现可能的实现方式中,所述第一消息为认证消息。
在一种实现可能的实现方式中,所述接收单元,用于:接收所述网络准入控制器发送的安全认证信息,所述安全认证信息包括所述目标工业互联网标识。
第四方面,本申请实施例提供了一种基于工业互联网标识的处理装置,应用于第二设备,所述第二设备为网管或者网络准入控制器,所述装置包括:接收单元,用于接收第一设备发送的第一消息,所述第一消息用于为所述第一设备申请工业互联网标识;发送单元,用于向第三设备发送所述第二消息,所述第二消息用于为所述第一设备申请工业互联网标识,所述第二消息包括所述第一设备的设备信息;所述接收单元,还用于接收第三消息,所述第三消息指示为所述第一设备申请工业互联网标识的结果;所述发送单元,还用于将所述第三消息发送给所述第一设备。
在一种实现可能的实现方式中,所述第一消息包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述第三消息包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述接收单元还用于:在接收所述第一消息之前,接收所述第一设备发送的第一认证消息;所述装置还包括处理单元,用于根据所述第一认证消息确定所述第一设备的第一网络访问权限。
在一种实现可能的实现方式中,所述接收单元还用于接收所述第一设备发送的第二认证消息,所述第二认证消息中包括所述目标工业互联网标识;所述装置包括的处理单元用于根据所述第二认证消息确定所述第一设备的第二网络访问权限。
在一种实现可能的实现方式中,所述第一消息包括所述第一设备的初始工业互联网标识。
在一种实现可能的实现方式中,所述第一消息为认证消息。
在一种实现可能的实现方式中,所述第二消息用于请求为第一设备分配工业互联网标识。
在一种实现可能的实现方式中,所述第二消息用于请求为第一设备注册目标工业互联网标识。
在一种实现可能的实现方式中,所述第二消息基于如下方式获得:获取预先配置的第一前缀和所述第一设备的设备信息;基于所述第一前缀和所述初始工业互联网标识,得到所述目标工业互联网标识;基于所述目标工业互联网标识和所述设备信息,得到包括所述设备信息和所述目标工业互联网标识的第二消息,所述第二消息用于请求为所述第一设备 注册所述目标工业互联网标识。
第五方面,本申请实施例提供了一种基于工业互联网标识的处理***,所述***包括第一设备和第二设备;所述第一设备用于向第二设备发送第一消息,所述第一消息用于为所述第一设备申请工业互联网标识,所述第二设备为网管或者网络准入控制器;所述第二设备向所述第一设备发送第二消息,所述第二消息指示为所述第一设备申请工业互联网标识的结果;所述第一设备根据所述第二消息,将目标工业互联网标识写入到所述第一设备中。
在一种实现可能的实现方式中,所述第一消息包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述第一消息包括所述第一设备的初始工业互联网标识。
在一种实现可能的实现方式中,所述第二消息包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述第一消息为认证消息。
在一种实现可能的实现方式中,所述第二消息为包括所述目标互联网标识的安全认证信息。
第六方面,本申请实施例提供了一种设备。所述设备包括处理器和存储器。所述存储器用于存储指令或计算机程序。所述处理器用于执行所述存储器中的所述指令或计算机程序,执行以上第一方面任意一项所述的方法,或者执行以上第二方面任意一项所述的方法。
第七方面,本申请实施例提供了一种计算机可读存储介质,包括指令或计算机程序,当其在计算机上运行时,使得计算机执行以上第一方面任意一项所述的方法,或者执行以上第二方面任意一项所述的方法。
第八方面,本申请实施例提供了一种包含指令或计算机程序的计算机程序产品,当其在计算机上运行时,使得计算机执行以上第一方面任意一项所述的方法,或者执行以上第二方面任意一项所述的方法。
为了更清楚地说明本申请实施例或现有技术中的技术方案,下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍,显而易见地,下面描述中的附图仅仅是本申请中记载的一些实施例,对于本领域普通技术人员来讲,在不付出创造性劳动的前提下,还可以根据这些附图获得其他的附图。
图1为一个工业互联网标识的示意图;
图2为本申请实施例提供的一个示例性应用场景示意图;
图3为本申请实施例提供的一种基于工业互联网标识的处理方法的信令交互图;
图4为本申请实施例提供的一种基于工业互联网标识的处理方法的信令交互图;
图5为本申请实施例提供的一种基于工业互联网标识的处理方法的信令交互图;
图6为本申请实施例提供的一种基于工业互联网标识的处理方法的信令交互图;
图7为本申请实施例提供的一种基于工业互联网标识的处理方法的流程示意图;
图8为本申请实施例提供的又一种基于工业互联网标识的处理方法的流程示意图;
图9为本申请实施例提供的一种基于工业互联网标识的处理装置的结构示意图;
图10为本申请实施例提供的又一种基于工业互联网标识的处理装置的结构示意图;
图11为本申请实施例提供的一种设备的结构示意图。
本申请实施例提供了一种基于工业互联网标识的处理方法,能够在企业购买设备之后,将对应该企业的工业互联网标识写入到设备内部。
为方便理解,首先对工业互联网标识的相关内容进行介绍。
参见图1,该图为一个工业互联网标识的示意图。如图1所示,工业互联网标识包括标识前缀和标识后缀,标识前缀能够体现唯一的企业主体。标识后缀用于标识唯一的资源(例如设备)。其中:标识前缀可以包括多个层级,如图1所示,标识前缀中的A用于标识国家,标识前缀中的A.B用于标识A国家的B地区,整个标识前缀A.B.C用于标识某一具体的企业(即位于A国家B地区的某一企业)。标识后缀block_data用于标识唯一的资源。
企业在购买设备后,需要将该设备对应本企业的工业互联网标识写入到设备内部。
在一个场景中,该设备没有工业互联网标识,此时,购买该设备的企业需要为其分配本企业的工业互联网标识。
在另一个场景中,该设备具备一个初始工业互联网标识,该初始工业互联网标识可以是生产该设备的企业对应的工业互联网标识。对于这种情况,购买该设备的企业需要将初始工业互联网标识中的标识前缀更换为本企业的标识前缀,形成该设备对应本企业的工业互联网标识。例如,设备制造商A对应的标识前缀为:88.103.1,在出厂时为设备写入工业互联网标识;而后该设备被企业B购买,企业B对应的标识前缀为:88.103.2。该设备被企业B购买之后,需要将其工业互联网标识中的标识前缀修改为88.103.2。
企业节点除了将该设备对应本企业的工业互联网标识写入到设备内部之外,还可以存储该设备的设备信息和该设备在本企业的工业互联网标识。此处提及的企业节点,指的是企业用于处理与工业互联网相关的事项的节点。
在一个示例中,制造设备的企业可以开发其私有的主动标识载体服务平台,购买设备的企业在购买设备之后,可以一并购买制造设备的企业开发的主动标识载体服务平台,从而利用该主动标识载体服务平台将对应本企业的工业互联网标识写入到设备内部。
但是,对于某一企业而言,其可以购买多个企业制造的设备,若采用上述方案,则需要购买前述多个企业开发的主动标识载体服务平台,成本高昂。因此,该方案的可行性不是很高。
在又一个示例中,可以由主动标识载体直接向购买该设备的企业节点申请工业互联网标识。但是,这种方式也有一定的缺陷:
第一、通常情况下,购买该设备的企业节点会为每个对接的设备(例如终端,对应主动标识载体)分配一个可访问的账号密码或者访问令牌,当大批量的终端需要与所述企业节点对接时,则安全访问的账号管理将变得十分庞大,难以维护。
第二、企业节点通常部署在云端(公有云或者私有云),出于工业数据安全方面的考虑,可能会限制工业网络设备直接访问外部服务。因此,主动标识载体可能无法直接访问前述企业节点,从而导致无法申请到工业互联网标识。
第三、主动标识载体不能自动获知向购买该设备的企业节点申请工业互联网标识的时机,需要人为手工配置。
因此,该方案的可行性也不是很高。
鉴于此,本申请实施例提供了一种基于工业互联网标识的处理方法,既无需购买私有的主动标识载体服务平台,也不会存在无法申请到工业互联网标识的风险,另外,企业节点也无需管理十分庞大的安全访问的账号。
本申请实施例提供的基于工业互联网标识的处理方法,可以应用于图2所示的场景。图2为本申请实施例提供的一个示例性应用场景示意图。
在图2所示的场景中,对于需要将工业互联网标识写入到自身内部的设备100而言,其可以通过标识代理200向企业节点300申请工业互联网标识。其中,标识代理200可以运行在企业节点300所属的企业网络所必须的网管或者网络准入控制器中。一方面,由于标识代理200运行在企业网络所必须的网管或者网络准入控制器中,因此,可以减少网络的投资。另外,也可以避免企业节点直接对外交互可能带来的网络安全问题,还可以大幅简化企业节点300对对需要申请工业互联网标识的设备的管理规模。
接下来,结合附图介绍本申请实施例提供的基于工业互联网标识的处理方法。
首先介绍主动标识设备具备初始工业互联网标识时,本申请实施例提供的基于工业互联网标识的处理方法。
参见图3,该图为本申请实施例提供的一种基于工业互联网标识的处理方法的信令交互图。其中:
主动标识设备为需要将工业互联网标识写入到自身内部的设备,主动标识设备例如可以是图2所示的设备100。标识代理服务器为运行标识代理的设备,所述标识代理可以是图2所述的标识代理200,标识代理服务器可以是网管或者网络准入控制器。标识解析节点为企业的标识解析节点,标识解析节点例如可以是图2所示的企业节点300。DHCP服务器可以为主动标识设备分配IP地址。
图3所示的方法100,可以应用于所述主动标识设备具备初始工业互联网标识的场景。
所述方法100例如可以包括如下S101-S109。
S101:主动标识设备通过DHCP服务器获取DHCP选项,所述DHCP选项中包括IP地址,所述DHCP选项的扩展信息中包括前缀1和标识代理服务器的地址。
其中,所述前缀1为对应所述标识解析节点所属的企业的前缀。
在一个示例中,所述DHCP选项的扩展信息中还包括指示信息,该指示信息用于指示所述主动标识设备申请工业互联网标识。由于所述扩展信息中包括指示信息,因此,所述主动标识设备可以基于所述指示信息申请工业互联网标识,而无需人为手工配置。
在一个示例中,所述DHCP选项的扩展信息中包括的信息,可以是预先配置在所述DHCP服务器上的。
S102:主动标识设备基于初始工业互联网标识和所述前缀1,得到目标工业互联网标识。
主动标识设备可以将所述初始工业互联网标识中的前缀替换成所述前缀1,从而得到目标工业互联网标识。
S103:主动标识设备向标识代理服务器发送消息1,所述消息1中包括所述目标工业互联网标识,所述消息1用于请求注册所述目标工业互联网标识。
主动标识设备得到目标工业互联网标识之后,可以基于所述目标工业互联网标识,得到消息1,而后,基于所述DHCP选项的扩展信息中包括的标识代理服务器的地址,将所述消息1发送给所述标识代理服务器。
S104:标识代理服务器根据消息1得到消息2,其中,消息2中包括所述目标工业互联网标识和所述主动标识设备的设备信息。
在一个示例中,所述主动标识设备的设备信息可以是管理员提前配置到所述标识代理服务器上的。在又一个示例中,当所述标识代理服务器是网管时,所述网管中原本就具备所述主动标识设备的设备信息。
所述主动标识设备的设备信息,例如可以包括主动标识设备的媒体接入控制(media access control,MAC)地址、所述主动标识设备的名称、所述主动标识设备的初始工业互联网标识,等等,此处不一一列举说明。
S105:标识代理服务器将消息2发送给标识解析节点,以向所述标识解析节点申请注册所述目标工业互联网标识。
S106:标识解析节点对所述目标工业互联网标识进行验证。
标识解析节点接收到消息2之后,可以对消息2进行解析,得到消息2中包括的目标工业互联网标识。而后,对所述目标工业互联网标识进行验证。在一个示例中,标识解析节点可以在所述目标工业互联网标识尚未被注册的情况下,确定所述目标工业互联网标识通过验证。
S107:标识解析节点在所述目标工业互联网标识通过验证的情况下,向所述标识代理服务器发送消息3,消息3用于指示目标工业互联网标识注册成功。
另外,所述标识解析节点在所述目标工业互联网标识通过验证的情况下,还可以保存所述目标工业互联网标识和所述主动标识设备的设备信息之间的对应关系。
S108:标识代理服务器将消息3发送给所述主动标识设备。
S109:主动标识设备基于所述消息3,将目标工业互联网标识写入到主动标识设备中。
主动标识设备接收到消息3之后,可以确定所述目标工业互联网标识注册成功。因此,所述主动标识设备可以将目标工业互联网标识写入到所述主动标识设备中。
通过以上描述可知,对于原本具有初始工业互联网标识的主动标识设备而言,其可以在获取IP地址的同时,确定前缀1以及确定申请工业互联网标识的标识代理服务器的地址,从而利用前缀1得到目标工业互联网标识,并通过所述标识代理服务器申请注册所述目标工业互联网标识。
在以上方法100中,由主动标识设备基于前缀1和初始工业互联网标识得到目标工业互联网标识,并将包括目标工业互联网标识的消息1发送给标识代理服务器。但是在另一个示例中,所述消息1中可以包括初始工业互联网标识。相应的,所述标识代理服务器上可以配置有前缀1,标识代理服务器可以基于包括消息1中的初始工业互联网标识和前缀1得到目标工业互联网标识,而后,所述标识代理服务器可以基于所述目标工业互联网标识和所述主动标识设备的设备信息,得到前述消息2,并进一步执行S105及后续步骤。
在一个示例中,当方法100中的标识代理服务器为网络准入控制器时,方法100还可以与网络接入控制(network access control,NAC)方案相结合。具体地:在所述主动标识 设备未将初始工业互联网标识更新为目标工业互联网标识时,基于所述初始工业互联网标识确定所述主动标识设备的网络访问权限。当所述主动标识设备将初始工业互联网标识更新为目标工业互联网标识之后,基于所述目标工业互联网标识进行重认证,从而获得与所述目标工业互联网标识对应的网络访问权限。
在一个示例中,可以预先在所述网络准入控制器上配置基于前缀的认证授权策略。例如,对于针对非本企业的前缀,配置网络权限1,对于针对本企业的前缀,配置网络权限2,其中,网络权限1可访问的网络资源,少于网络权限2可访问的网络资源。
对于这种情况,在S101之前,所述主动标识设备可以向所述网络准入控制器发送认证消息1,该认证消息1中包括初始工业互联网标识。作为一个示例,所述主动标识设备可以向网络认证设备发送所述认证消息1,由所述网络认证设备将所述认证消息1转发给网络准入控制器。所述网络准入控制器基于所述认证消息1中的初始工业互联网标识,确定网络权限1,并将网络权限1发送给网络认证设备,从而使得所述主动标识设备获得所述网络权限1。其中:
所述认证消息1可以是基于MAC认证的消息,也可以是基于802.1X认证的消息。所述认证消息1可以对已有的协议报文进行扩展得到的,例如,对已有的协议报文进行扩展,扩展类型长度值(type length value,TLV)字段用于携带所述初始工业互联网标识。其中,已有的协议报文包括但不限于链路层发现协议(Link Layer Discovery Protocol,LLDP)报文、可扩展身份验证协议(Extensible Authentication Protocol,EAP)报文、802.11关联协议报文,等等,此处不一一列举说明。
在S107之后,标识代理服务器可以向网络认证设备发送重认证消息。相应的,在S109之后,所述主动标识设备可以向网络认证设备发送携带目标工业互联网标识的认证消息2,所述网络认证设备基于所述重认证消息将所述认证消息2发送给所述网络准入控制器。所述网络准入控制器基于所述认证消息2中的目标工业互联网标识,确定网络权限2,并将网络权限2发送给网络认证设备,从而使得所述主动标识设备获得所述网络权限2。其中:
与认证消息1类似,所述认证消息2可以是基于MAC认证的消息,也可以是基于802.1X认证的消息。所述认证消息2可以对已有的协议报文进行扩展得到的,例如,对已有的协议报文进行扩展,扩展类TLV字段用于携带所述目标工业互联网标识。其中,已有的协议报文包括但不限于LLDP报文、EAP报文、802.11关联协议报文,等等,此处不一一列举说明。
参见图4,该图为本申请实施例提供的又一种基于工业互联网标识的处理方法的信令交互图。其中:
主动标识设备为需要将工业互联网标识写入到自身内部的设备,主动标识设备例如可以是图2所示的设备100。网络准入控制器为运行标识代理的设备,所述标识代理可以是图2所述的标识代理200。标识解析节点为企业的标识解析节点,标识解析节点例如可以是图2所示的企业节点300。
图4所示的方法200,也可以应用于所述主动标识设备具备初始工业互联网标识的场景。
所述方法200例如可以包括如下S201-S211。
S201:主动标识设备向网络准入控制器发送认证消息3,所述认证消息3中包括所述主动标识设备的初始工业互联网标识。
在一个示例中,主动标识设备接入网络可以包括两个阶段的认证,所述认证消息3用于进行第一阶段的认证,所述认证消息3中可以包括所述主动标识设备的设备信息。在一个示例中,所述第一阶段的认证可以是安全性偏弱的认证例如MAC认证。关于所述认证消息3,其与认证消息1类似,关于认证消息3可以参考前文对于认证消息1的描述部分,此处不做详述。
关于所述主动标识设备的设备信息,可以参考上文的描述部分,此处不再重复描述。
在一个示例中,所述第一阶段的认证可以由网络准入控制器处理,对于这种情况,所述网络准入控制器可以基于所述认证消息3对所述主动标识设备进行认证。在又一个示例中,所述第一阶段的认证可以由人工审批。对于这种情况,可以由管理员对所述主动标识设备进行审批。
S202:网络准入控制器在确定所述主动标识设备通过认证的情况下,基于所述初始工业互联网标识和前缀1,得到目标工业互联网标识。
若所述第一阶段的认证可以由网络准入控制器处理,则所述网络准入控制器基于所述认证消息3对所述主动标识设备进行认证之后,可以得到对应的认证结果。若所述第一阶段的认证由人工审批,则所述网络准入控制器可以获取用户输入的认证结果。
在一个示例中,所述前缀1可以预先配置在所述网络准入控制器上。当所述网络准入控制器接收到包括初始工业互联网标识的认证消息3之后,可以基于所述初始工业互联网标识和前缀1,得到目标工业互联网标识。
S203:网络准入控制器生成消息4,消息4中包括所述目标工业互联网标识和所述主动标识设备的设备信息,消息4用于请求注册所述目标工业互联网标识。
S204:网络准入控制器将消息4发送给标识解析节点,以向所述标识解析节点申请注册所述目标工业互联网标识。
S205:标识解析节点对所述目标工业互联网标识进行验证。
S206:标识解析节点在所述目标工业互联网标识通过验证的情况下,向所述网络准入控制器发送消息5,消息5用于指示目标工业互联网标识注册成功。
关于S204-S206,其具体实现与S105-S107的具体实现相同,S105-S107中的标识代理服务器相当于S204-S206中的网络准入控制器。关于S204-S206的具体实现,可以参考S105-S107的描述部分,此处不做重复描述。
S207:网络准入控制器向网络认证设备发送消息6,消息6用于指示主动标识设备认证成功。
需要说明的是,网络准入控制器在确定所述主动标识设备通过认证的情况下,可以执行S202中的“基于所述初始工业互联网标识和前缀1,得到目标工业互联网标识”以及后续S203-S207。在一个示例中,S207可以在S202中的“基于所述初始工业互联网标识和前缀1,得到目标工业互联网标识”被执行之前执行,也可在S202-S206之间执行,还可以与S202中的“基于所述初始工业互联网标识和前缀1,得到目标工业互联网标识”同时执行,本申请实施例不做具体限定。
S208:主动标识设备获取IP地址之后,向网络准入控制器发送消息7,消息7用于请求安全认证信息。
其中:
主动标识设备可以通过DHCP服务器获取IP地址。
所述安全认证信息为所述主动标识设备进行第二阶段安全认证所需的信息。当所述第二阶段安全认证为802.1X认证时,所述安全认证信息可以包括802.1X认证证书。当然,所述安全认证信息还可以包括其它信息,此处不一一列举说明。
S209:网络准入控制器将包括所述目标工业互联网标识的安全认证信息发送给所述主动标识设备。
网络准入控制器接收到消息5之后,则可以确定目标工业互联网标识注册成功。因此,网络准入控制器接收到消息7之后,可以获取所述目标工业互联网标识,并将包括所述目标工业互联网标识的安全认证信息发送给所述主动标识设备。
S210:主动标识设备将所述目标工业互联网标识写入到所述主动标识设备内部。
主动标识设备接收到所述安全认证信息之后,可以对所述安全认证信息进行解析,得到目标工业互联网标识,而后,将所述目标工业互联网标识写入到所述主动标识设备内部。
S211:主动标识设备向网络准入控制器发送认证消息4,所述认证消息4包括所述安全认证信息。
在一个示例中,所述认证消息4可以是802.1X认证对应的认证消息。网络准入控制器接收到认证消息4之后,可以基于认证消息4中的安全认证信息,对所述主动标识设备进行安全认证。
通过以上描述可知,利用方法200,可以将主动标识终端的安全认证分成两个阶段的认证,对于原本具有初始工业互联网标识的主动标识设备而言,其可以在第一阶段认证成功、获取第二阶段认证所需要的安全认证信息时,申请得到目标工业互联网标识。
接下来介绍主动标识设备不具备初始工业互联网标识时,本申请实施例提供的基于工业互联网标识的处理方法。
参见图5,该图为本申请实施例提供的一种基于工业互联网标识的处理方法的信令交互图。其中:
关于主动标识设备、标识代理服务器以及标识解析节点,可以参考方法100中的相关描述部分,此处不做重复描述。
图5所示的方法300,可以应用于所述主动标识设备不具备初始工业互联网标识的场景。
所述方法300例如可以包括如下S301-S308。
S301:主动标识设备通过DHCP服务器获取DHCP选项,所述DHCP选项中包括IP地址,所述DHCP选项的扩展信息中包括标识代理服务器的地址。
在一个示例中,所述DHCP选项的扩展信息中还包括指示信息,该指示信息用于指示所述主动标识设备申请工业互联网标识。
在一个示例中,所述DHCP选项的扩展信息中包括的信息,可以是预先配置在所述 DHCP服务器上的。
S302:主动标识设备向标识代理服务器发送消息1’,所述消息1’用于请求分配工业互联网标识。
S303:标识代理服务器根据消息1’得到消息2’,其中,消息2’中包括所述主动标识设备的设备信息。
在一个示例中,所述主动标识设备的设备信息可以是管理员提前配置到所述标识代理服务器上的。在又一个示例中,当所述标识代理服务器是网管时,所述网管中原本就具备所述主动标识设备的设备信息。
标识代理服务器接收到消息1’之后,可以基于所述消息1’和主动标识设备的设备信息,得到消息2’。例如,所述标识代理服务器可以将所述设备信息添加到所述消息1’中,得到所述消息2’。
S304:标识代理服务器将消息2’发送给标识解析节点,以请求所述标识解析节点为所述主动标识设备分配工业互联网标识。
S305:标识解析节点将目标工业互联网标识确定为分配给所述主动标识设备的工业互联网标识。
标识解析节点可以按照一定的规则获得所述目标工业互联网标识,例如,随机生成一个标识后缀,并在该随机生成的标识后缀未被使用的情况下,基于所述标识后缀和企业对应的标识前缀,得到所述目标工业互联网标识。
S306:标识解析节点将携带目标工业互联网标识的消息3’发送给标识代理服务器。
S307:标识代理服务器将消息3’发送给所述主动标识设备。
S308:主动标识设备基于所述消息3’,将目标工业互联网标识写入到主动标识设备中。
主动标识设备接收到消息3’之后,可以对所述消息3’进行解析,得到消息3’中包括的目标工业互联网标识,从而将所述目标工业互联网标识写入到主动标识设备中。
通过以上描述可知,对于原本不具有初始工业互联网标识的主动标识设备而言,其可以在获取IP地址的同时,基于所述DHCP选项的扩展信息,确定前申请工业互联网标识的标识代理服务器的地址,从而并通过所述标识代理服务器请求为自身分配工业互联网标识。
在一个示例中,当方法300中的标识代理服务器为网络准入控制器时,方法300还可以与NAC方案相结合。具体地:在所述主动标识设备不具备工业互联网标识时,为所述主动标识设备确定对应的网络访问权限。当所述主动标识设备获得目标工业互联网标识之后,基于所述目标工业互联网标识进行重认证,从而获得与所述目标工业互联网标识对应的网络访问权限。
在一个示例中,可以预先在所述网络准入控制器上配置基于前缀的认证授权策略。例如,对于无前缀,配置网络权限1,对于针对本企业的前缀,配置网络权限2,其中,网络权限1可访问的网络资源,少于网络权限2可访问的网络资源。
对于这种情况,在S301之前,所述主动标识设备可以向所述网络准入控制器发送认证消息1’,该认证消息1’不包括工业互联网标识。作为一个示例,所述主动标识设备可 以向网络认证设备发送所述认证消息1’,由所述网络认证设备将所述认证消息1’发送给网络准入控制器。所述网络准入控制器基于所述认证消息1’,确定网络权限1,并将网络权限1发送给网络认证设备,从而使得所述主动标识设备获得所述网络权限1。其中:
与认证消息1类似,所述认证消息1’也可以是基于MAC认证的消息,也可以是基于802.1X认证的消息。所述认证消息1’可以是已有的协议报文。其中,已有的协议报文包括但不限于链路层发现协议(Link Layer Discovery Protocol,LLDP)报文、可扩展身份验证协议(Extensible Authentication Protocol,EAP)报文、802.11关联协议报文,等等,此处不一一列举说明。
在S306之后,标识代理服务器可以向网络认证设备发送重认证消息。相应的,在S308之后,所述主动标识设备可以向网络认证设备发送携带目标工业互联网标识的认证消息2’,所述网络认证设备基于所述重认证消息将所述认证消息2’发送给所述网络准入控制器。所述网络准入控制器基于所述认证消息2’中的目标工业互联网标识,确定网络权限2,并将网络权限2发送给网络认证设备,从而使得所述主动标识设备获得所述网络权限2。其中:
与认证消息1’类似,所述认证消息2’可以是基于MAC认证的消息,也可以是基于802.1X认证的消息。,此处不再重复说明。
参见图6,该图为本申请实施例提供的又一种基于工业互联网标识的处理方法的信令交互图。其中:
关于主动标识设备、网络准入控制器和标识解析节点,可以参考上文对于方法200的描述部分,此处不再重复描述。
图6所示的方法400,也可以应用于所述主动标识设备不具备初始工业互联网标识的场景。
所述方法400例如可以包括如下S401-S410。
S401:主动标识设备向网络准入控制器发送认证消息3’。
在一个示例中,主动标识设备接入网络可以包括两个阶段的认证,所述认证消息3’用于进行第一阶段的认证,所述认证消息3’中可以包括所述主动标识设备的设备信息。在一个示例中,所述第一阶段的认证可以是安全性偏弱的认证例如MAC认证。关于所述认证消息3’,其与认证消息1’类似,关于认证消息3’可以参考前文对于认证消息1’的描述部分,此处不做详述。
关于所述主动标识设备的设备信息,可以参考上文的描述部分,此处不再重复描述。
在一个示例中,所述第一阶段的认证可以由网络准入控制器处理,对于这种情况,所述网络准入控制器可以基于所述认证消息3’对所述主动标识设备进行认证。在又一个示例中,所述第一阶段的认证可以由人工审批。对于这种情况,可以由管理员对所述主动标识设备进行审批。
S402:网络准入控制器在确定所述主动标识设备通过认证的情况下,生成消息4’,消息4’中包括所述主动标识设备的设备信息,消息4’用于请求为所述主动标识设备分配工业互联网标识。
若所述第一阶段的认证可以由网络准入控制器处理,则所述网络准入控制器基于所述认证消息3’对所述主动标识设备进行认证之后,可以得到对应的认证结果。若所述第一阶 段的认证由人工审批,则所述网络准入控制器可以获取用户输入的认证结果。
S403:网络准入控制器将消息4’发送给标识解析节点,以请求所述标识解析节点为所述主动标识设备分配工业互联网标识。
S404:标识解析节点基于消息4’将目标工业互联网标识确定为分配给所述主动标识设备的工业互联网标识。
关于标识解析节点将目标工业互联网标识确定为分配给所述主动标识设备的工业互联网标识的具体实现,可以参考S305中的相关描述部分,此处不做重复描述。
标识解析节点还可以保存所述目标工业互联网标识和所述主动标识设备的设备信息之间的对应关系。
S405:标识解析节点向所述网络准入控制器发送消息5’,消息5’中携带所述目标工业互联网标识。
网络准入控制器接收到所述消息5’之后,可以保存所述目标工业互联网标识。作为一个示例,所述网络准入控制器可以保存所述目标工业互联网标识和所述主动标识设备的标识之间的对应关系。其中,所述主动标识设备的标识,例如可以是所述主动标识设备的MAC地址。S406:网络准入控制器向网络认证设备发送消息6’,消息6’用于指示主动标识设备认证成功。
S407:主动标识设备获取IP地址之后,向网络准入控制器发送消息7’,消息7’用于请求安全认证信息。
其中:
主动标识设备可以通过DHCP服务器获取IP地址。
所述消息7’包括所述主动标识设备的标识。
所述安全认证信息为所述主动标识设备进行第二阶段安全认证所需的信息。当所述第二阶段安全认证为802.1X认证时,所述安全认证信息可以包括802.1X认证证书。当然,所述安全认证信息还可以包括其它信息,此处不一一列举说明。
S408:网络准入控制器将包括所述目标工业互联网标识的安全认证信息发送给所述主动标识设备。网络准入控制器接收到所述消息7’之后,可以基于所述消息7’中的主动标识设备的标识,查找得到前述所述目标工业互联网标识和所述主动标识设备的标识之间的对应关系,从而得到所述目标工业互联网标识,从而将包括所述目标工业互联网标识的安全认证信息发送给所述主动标识设备。
S409:主动标识设备将所述目标工业互联网标识写入到所述主动标识设备内部。
主动标识设备接收到所述安全认证信息之后,可以对所述安全认证信息进行解析,得到目标工业互联网标识,而后,将所述目标工业互联网标识写入到所述主动标识设备内部。
S410:主动标识设备向网络准入控制器发送认证消息4’,所述认证消息4’包括所述安全认证信息。
在一个示例中,所述认证消息4’可以是802.1X认证对应的认证消息。网络准入控制器接收到认证消息4’之后,可以基于认证消息4’中的安全认证信息,对所述主动标识设备进行安全认证。
通过以上描述可知,利用方法400,可以将主动标识终端的安全认证分成两个阶段的认 证,对于原本不具有初始工业互联网标识的主动标识设备而言,其可以在第一阶段认证成功、获取第二阶段认证所需要的安全认证信息时,申请得到目标工业互联网标识。
参见图7,该图为本申请实施例提供的一种基于工业互联网标识的处理方法的流程示意图。
第一设备为需要将工业互联网标识写入到自身内部的设备,第一设备例如可以是图2所示的设备100。第二设备为运行标识代理的设备,所述标识代理可以是图2所述的标识代理200,第二设备可以是网管或者网络准入控制器。
图7所示的方法,可以应用于以上实施例提供的方法100、方法200、方法300以及方法400。图7所示的方法500,例如可以包括如下S501-S503。
S501:第一设备向第二设备发送第一消息,所述第一消息用于为所述第一设备申请工业互联网标识,所述第二设备为网管或者网络准入控制器。
S502:第一设备接收所述第二设备发送的第二消息,所述第二消息指示为所述第一设备申请工业互联网标识的结果。
S503:第一设备基于所述第二消息,将目标工业互联网标识写入到所述第一设备中。
当所述方法500应用于以上方法100时,第一设备对应方法100中的主动标识设备;第二设备对应方法100中的标识代理服务器。所述第一消息对应于方法100中的消息1;所述第二消息对应方法100中的消息3。
当所述方法500应用于以上方法200时,第一设备对应方法200中的主动标识设备;第二设备对应方法200中的网络准入服务器。所述第一消息对应于方法200中的认证消息3;所述第二消息对应方法200中的安全认证信息。
当所述方法500应用于以上方法300时,第一设备对应方法300中的主动标识设备;第二设备对应方法300中的标识代理服务器。所述第一消息对应于方法100中的消息1’;所述第二消息对应方法100中的消息3’。
当所述方法500应用于以上方法400时,第一设备对应方法400中的主动标识设备;第二设备对应方法400中的网络准入服务器。所述第一消息对应于方法400中的认证消息3’;所述第二消息对应方法400中的安全认证信息。
在一种可能的实现方式中,所述向第二设备发送第一消息,包括:
向所述第二设备发送携带所述目标工业互联网标识的第一消息,所述第一消息用于请求注册所述目标工业互联网标识。
在一种可能的实现方式中,所述方法还包括:
获取动态主机配置协议DHCP选项option的扩展信息中的第一前缀;
根据所述第一前缀和所述第一设备的初始工业互联网标识,得到所述目标工业互联网标识。
在一种可能的实现方式中,所述第一消息携带所述第一设备的初始工业互联网标识。
在一种可能的实现方式中,所述第一消息用于请求为所述第一设备分配工业互联网标识。
在一种可能的实现方式中,所述第二消息包括所述目标工业互联网标识。
在一种可能的实现方式中,在发送所述第一消息之前,所述方法还包括:
向所述第二设备发送第一认证消息,以获得接入网络的权限。
方法500中的第一认证消息,可以对应以上实施例中的认证消息1,也可以对应以上实施例中的认证消息1’。
在一种可能的实现方式中,所述第一认证消息包括所述初始工业互联网标识。
在一种可能的实现方式中,所述方法还包括:
向所述第二设备发送第二认证消息,所述第二认证消息中包括所述目标工业互联网标识。
方法500中的第二认证消息,可以对应以上实施例中的认证消息2,也可以对应以上实施例中的认证消息2’。
在一种可能的实现方式中,所述方法还包括:
获取指示信息,所述指示信息用于指示为所述第一设备申请工业互联网标识。
方法500中的指示信息,可以是方法100中的提及的指示信息,也可以是方法300中提及的指示信息。
在一种可能的实现方式中,所述指示信息携带在DHCP option扩展信息中。
在一种可能的实现方式中,所述第一消息为认证消息。此处提及的所述认证消息可以对应方法200中的认证消息3,也可以对应方法400中的认证消息3’。
在一种可能的实现方式中,所述接收所述第二设备发送的第二消息,包括:
接收所述网络准入控制器发送的安全认证信息,所述安全认证信息包括所述目标工业互联网标识。此处提及的安全认证信息,可以对应方法200中的安全认证信息,也可以对应方法400中的安全认证信息。
关于所述方法500的具体实现,可以参考前文对于方法100、方法200、方法300以及方法400的相关描述部分,此处不做详述。
参见图8,该图为本申请实施例提供的又一种基于工业互联网标识的处理方法的流程示意图。
第一设备为需要将工业互联网标识写入到自身内部的设备,第一设备例如可以是图2所示的设备100。第二设备为运行标识代理的设备,所述标识代理可以是图2所述的标识代理200,第二设备可以是网管或者网络准入控制器。
图8所示的方法,可以应用于以上实施例提供的方法100以及方法300。图8所示的方法600,例如可以包括如下S601-S604。
S601:第二设备接收第一设备发送的第一消息,所述第一消息用于为所述第一设备申请工业互联网标识。
当方法600应用于方法100时,所述第一消息对应方法100中的消息1。
当方法600应用于方法300时,所述第一消息对应方法300中的消息1’。
S602:第二设备向第三设备发送所述第二消息,所述第二消息用于为所述第一设备申请工业互联网标识,所述第二消息包括所述第一设备的设备信息。
当方法600应用于方法100时,所述第二消息对应方法100中的消息2。
当方法600应用于方法300时,所述第二消息对应方法300中的消息2’。
S603:第二设备接收所述第三设备发送的第三消息,所述第三消息指示为所述第一设备申请工业互联网标识的结果。
当方法600应用于方法100时,所述第三消息对应方法100中的消息3。
当方法600应用于方法300时,所述第三消息对应方法300中的消息3’。
S604:第二设备将所述第三消息发送给所述第一设备。
在一种可能的实现方式中,所述第一消息包括所述目标工业互联网标识。
在一种可能的实现方式中,所述第三消息包括所述目标工业互联网标识。
在一种可能的实现方式中,在接收所述第一消息之前,所述方法还包括:接收所述第一设备发送的第一认证消息;根据所述第一认证消息确定所述第一设备的第一网络访问权限。
方法600中的第一认证消息,可以对应以上实施例中的认证消息1,也可以对应以上实施例中的认证消息1’。
在一种可能的实现方式中,所述方法还包括:接收所述第一设备发送的第二认证消息,所述第二认证消息中包括所述目标工业互联网标识;根据所述第二认证消息确定所述第一设备的第二网络访问权限。
方法600中的第二认证消息,可以对应以上实施例中的认证消息2,也可以对应以上实施例中的认证消息2’。
在一种可能的实现方式中,所述第一消息包括所述第一设备的初始工业互联网标识。
在一种可能的实现方式中,所述第一消息为认证消息。
在一种可能的实现方式中,所述第二消息用于请求为第一设备分配工业互联网标识。
在一种可能的实现方式中,所述第二消息用于请求为第一设备注册目标工业互联网标识。
在一种可能的实现方式中,所述第二消息基于如下方式获得:获取预先配置的第一前缀和所述第一设备的设备信息;基于所述第一前缀和所述初始工业互联网标识,得到所述目标工业互联网标识;基于所述目标工业互联网标识和所述设备信息,得到包括所述设备信息和所述目标工业互联网标识的第二消息,所述第二消息用于请求为所述第一设备注册所述目标工业互联网标识。其中:
关于所述方法600的具体实现,可以参考前文对于方法100以及方法300的相关描述部分,此处不做详述。
本申请实施例还提供了一种基于工业互联网标识的处理装置,参见图9,该图为本申请实施例提供的一种基于工业互联网标识的处理装置的结构示意图。图9所示的装置900可以应用于第一设备,用于执行以上由第一设备执行的方法500。所述装置900包括:发送单元901、接收单元902和处理单元903。
发送单元901,用于向第二设备发送第一消息,所述第一消息用于为所述第一设备申请工业互联网标识,所述第二设备为网管或者网络准入控制器;接收单元902,用于接收所述第二设备发送的第二消息,所述第二消息指示为所述第一设备申请工业互联网标识的结果;处理单元903,用于基于所述第二消息,将目标工业互联网标识写入到所述第一设备中。
在一种实现可能的实现方式中,所述发送单元901,用于:向所述第二设备发送携带所 述目标工业互联网标识的第一消息,所述第一消息用于请求注册所述目标工业互联网标识。
在一种实现可能的实现方式中,所述处理单元903还用于:获取动态主机配置协议DHCP选项option的扩展信息中的第一前缀;根据所述第一前缀和所述第一设备的初始工业互联网标识,得到所述目标工业互联网标识。
在一种实现可能的实现方式中,所述第一消息携带所述第一设备的初始工业互联网标识。
在一种实现可能的实现方式中,所述第一消息用于请求为所述第一设备分配工业互联网标识。
在一种实现可能的实现方式中,所述第二消息包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述发送单元901还用于:在发送所述第一消息之前,向所述第二设备发送第一认证消息,以获得接入网络的权限。
在一种实现可能的实现方式中,所述第一认证消息包括所述初始工业互联网标识。
在一种实现可能的实现方式中,所述发送单元901还用于:向所述第二设备发送第二认证消息,所述第二认证消息中包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述处理单元903还用于:获取指示信息,所述指示信息用于指示为所述第一设备申请工业互联网标识。
在一种实现可能的实现方式中,所述指示信息携带在DHCP option扩展信息中。
在一种实现可能的实现方式中,所述第一消息为认证消息。
在一种实现可能的实现方式中,所述接收单元903,用于:接收所述网络准入控制器发送的安全认证信息,所述安全认证信息包括所述目标工业互联网标识。
关于所述装置900的具体实现,可以参考以上对于方法500的相关描述部分,此处不再重复描述。
本申请实施例还提供了一种基于工业互联网标识的处理装置,参见图10,该图为本申请实施例提供的又一种基于工业互联网标识的处理装置的结构示意图。图10所示的装置1000可以应用于第二设备,用于执行以上由第二设备执行的方法600。所述装置1000包括:接收单元1001和发送单元1002。
接收单元1001,用于接收第一设备发送的第一消息,所述第一消息用于为所述第一设备申请工业互联网标识;发送单元1002,用于向第三设备发送所述第二消息,所述第二消息用于为所述第一设备申请工业互联网标识,所述第二消息包括所述第一设备的设备信息;所述接收单元1001,还用于接收第三消息,所述第三消息指示为所述第一设备申请工业互联网标识的结果;所述发送单元1002,还用于将所述第三消息发送给所述第一设备。
在一种实现可能的实现方式中,所述第一消息包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述第三消息包括所述目标工业互联网标识。
在一种实现可能的实现方式中,所述接收单元1001还用于:在接收所述第一消息之前,接收所述第一设备发送的第一认证消息;所述装置还包括处理单元,用于根据所述第一认证消息确定所述第一设备的第一网络访问权限。
在一种实现可能的实现方式中,所述接收单元1001还用于接收所述第一设备发送的第二认证消息,所述第二认证消息中包括所述目标工业互联网标识;所述装置包括的处理单 元用于根据所述第二认证消息确定所述第一设备的第二网络访问权限。
在一种实现可能的实现方式中,所述第一消息包括所述第一设备的初始工业互联网标识。
在一种实现可能的实现方式中,所述第一消息为认证消息。
在一种实现可能的实现方式中,所述第二消息用于请求为第一设备分配工业互联网标识。
在一种实现可能的实现方式中,所述第二消息用于请求为第一设备注册目标工业互联网标识。
在一种实现可能的实现方式中,所述第二消息基于如下方式获得:获取预先配置的第一前缀和所述第一设备的设备信息;基于所述第一前缀和所述初始工业互联网标识,得到所述目标工业互联网标识;基于所述目标工业互联网标识和所述设备信息,得到包括所述设备信息和所述目标工业互联网标识的第二消息,所述第二消息用于请求为所述第一设备注册所述目标工业互联网标识。关于所述装置1000的具体实现,可以参考以上对于方法600的相关描述部分,此处不再重复描述。
需要说明的是,前述提及的基于工业互联网标识的处理装置900和基于工业互联网标识的处理装置1000,其硬件结构可以为如图11所示的结构,图11为本申请实施例提供的一种设备的结构示意图。
请参阅图11所示,设备1100包括:处理器1110、通信接口1120和和存储器1130。其中设备1100中的处理器1110的数量可以一个或多个,图11中以一个处理器为例。本申请实施例中,处理器1110、通信接口1120和存储器1130可通过总线***或其它方式连接,其中,图11中以通过总线***1140连接为例。
处理器1110可以是中央处理器(central processing unit,CPU),网络处理器(network processor,NP)或者CPU和NP的组合。处理器1110还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit,ASIC),可编程逻辑器件(programmable logic device,PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device,CPLD),现场可编程逻辑门阵列(field-programmable gate array,FPGA),通用阵列逻辑(generic array logic,GAL)或其任意组合。
存储器1130可以包括易失性存储器(英文:volatile memory),例如随机存取存储器(random-access memory,RAM);存储器1130也可以包括非易失性存储器(英文:non-volatile memory),例如快闪存储器(英文:flash memory),硬盘(hard disk drive,HDD)或固态硬盘(solid-state drive,SSD);存储器1130还可以包括上述种类的存储器的组合。当设备1100对应前述基于工业互联网标识的处理装置900时,存储器1130例如可以存储包括第一前缀的DHCP选项的扩展信息;当设备1100对应图10所示的基于工业互联网标识的处理装置1000时,存储器1130例如可以存储第一设备的设备信息。
可选地,存储器1130存储有操作***和程序、可执行模块或者数据结构,或者它们的子集,或者它们的扩展集,其中,程序可包括各种操作指令,用于实现各种操作。操作***可包括各种***程序,用于实现各种基础业务以及处理基于硬件的任务。处理器1110可以读取存储器1130中的程序,实现本申请实施例提供的基于工业互联网标识的处理方法(例 如第一设备执行的基于工业互联网标识的处理方法,又如第二设备执行的基于工业互联网标识的处理方法)。
总线***1140可以是外设部件互连标准(peripheral component interconnect,PCI)总线或扩展工业标准结构(extended industry standard architecture,EISA)总线等。总线***1140可以分为地址总线、数据总线、控制总线等。为便于表示,图11中仅用一条粗线表示,但并不表示仅有一根总线或一种类型的总线。
本申请实施例还提供了一种计算机可读存储介质,包括指令或计算机程序,当其在计算机上运行时,使得计算机执行以上实施例提供的基于工业互联网标识的处理方法。
本申请实施例还提供了一种包含指令或计算机程序的计算机程序产品,当其在计算机上运行时,使得计算机执行以上实施例提供的基于工业互联网标识的处理方法。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象,而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换,以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外,术语“包括”和“具有”以及他们的任何变形,意图在于覆盖不排他的包含,例如,包含了一系列步骤或单元的过程、方法、***、产品或设备不必限于清楚地列出的那些步骤或单元,而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
所属领域的技术人员可以清楚地了解到,为描述的方便和简洁,上述描述的***,装置和单元的具体工作过程,可以参考前述方法实施例中的对应过程,在此不再赘述。
在本申请所提供的几个实施例中,应该理解到,所揭露的***,装置和方法,可以通过其它的方式实现。例如,以上所描述的装置实施例仅仅是示意性的,例如,单元的划分,仅仅为一种逻辑业务划分,实际实现时可以有另外的划分方式,例如多个单元或组件可以结合或者可以集成到另一个***,或一些特征可以忽略,或不执行。另一点,所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口,装置或单元的间接耦合或通信连接,可以是电性,机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的,作为单元显示的部件可以是或者也可以不是物理单元,即可以位于一个地方,或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外,在本申请各个实施例中的各业务单元可以集成在一个处理单元中,也可以是各个单元单独物理存在,也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现,也可以采用软件业务单元的形式实现。
集成的单元如果以软件业务单元的形式实现并作为独立的产品销售或使用时,可以存储在一个计算机可读取存储介质中。基于这样的理解,本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来,该计算机软件产品存储在一个存储介质中,包括若干指令用以使得一台计算机设备(可以是个人计算机,服务器,或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。 而前述的存储介质包括:U盘、移动硬盘、只读存储器(ROM,Read-Only Memory)、随机存取存储器(RAM,Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员应该可以意识到,在上述一个或多个示例中,本发明所描述的业务可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时,可以将这些业务存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质,其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上的具体实施方式,对本发明的目的、技术方案和有益效果进行了进一步详细说明,所应理解的是,以上仅为本发明的具体实施方式而已。
以上,以上实施例仅用以说明本申请的技术方案,而非对其限制;尽管参照前述实施例对本申请进行了详细的说明,本领域的普通技术人员应当理解:其依然可以对前述各实施例所记载的技术方案进行修改,或者对其中部分技术特征进行等同替换;而这些修改或者替换,并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。
Claims (32)
- 一种基于工业互联网标识的处理方法,其特征在于,应用于第一设备,所述方法包括:向第二设备发送第一消息,所述第一消息用于为所述第一设备申请工业互联网标识,所述第二设备为网管或者网络准入控制器;接收所述第二设备发送的第二消息,所述第二消息指示为所述第一设备申请工业互联网标识的结果;基于所述第二消息,将目标工业互联网标识写入到所述第一设备中。
- 根据权利要求1所述的方法,其特征在于,所述向第二设备发送第一消息,包括:向所述第二设备发送携带所述目标工业互联网标识的第一消息,所述第一消息用于请求注册所述目标工业互联网标识。
- 根据权利要求2所述的方法,其特征在于,所述方法还包括:获取动态主机配置协议DHCP选项option的扩展信息中的第一前缀;根据所述第一前缀和所述第一设备的初始工业互联网标识,得到所述目标工业互联网标识。
- 根据权利要求1所述的方法,其特征在于,所述第一消息携带所述第一设备的初始工业互联网标识。
- 根据权利要求1所述的方法,其特征在于,所述第一消息用于请求为所述第一设备分配工业互联网标识。
- 根据权利要求1或4或5所述的方法,其特征在于,所述第二消息包括所述目标工业互联网标识。
- 根据权利要求1-6任意一项所述的方法,其特征在于,在发送所述第一消息之前,所述方法还包括:向所述第二设备发送第一认证消息,以获得接入网络的权限。
- 根据权利要求7所述的方法,其特征在于,所述第一认证消息包括所述初始工业互联网标识。
- 根据权利要求1-8任意一项所述的方法,其特征在于,所述方法还包括:向所述第二设备发送第二认证消息,所述第二认证消息中包括所述目标工业互联网标识。
- 根据权利要求1-9任意一项所述的方法,其特征在于,所述方法还包括:获取指示信息,所述指示信息用于指示为所述第一设备申请工业互联网标识。
- 根据权利要求10所述的方法,其特征在于,所述指示信息携带在DHCP option扩展信息中。
- 根据权利要求1或4所述的方法,其特征在于,所述第一消息为认证消息。
- 根据权利要求1或4或12所述的方法,其特征在于,所述接收所述第二设备发送的第二消息,包括:接收所述网络准入控制器发送的安全认证信息,所述安全认证信息包括所述目标工业互联网标识。
- 一种基于工业互联网标识的处理方法,其特征在于,应用于第二设备,所述第二设 备为网管或者网络准入控制器,所述方法包括:接收第一设备发送的第一消息,所述第一消息用于为所述第一设备申请工业互联网标识;向第三设备发送所述第二消息,所述第二消息用于为所述第一设备申请工业互联网标识,所述第二消息包括所述第一设备的设备信息;接收第三消息,所述第三消息指示为所述第一设备申请工业互联网标识的结果;将所述第三消息发送给所述第一设备。
- 根据权利要求14所述的方法,其特征在于,所述第一消息包括所述目标工业互联网标识。
- 根据权利要求14所述的方法,其特征在于,所述第三消息包括所述目标工业互联网标识。
- 根据权利要求14-16任意一项所述的方法,其特征在于,在接收所述第一消息之前,所述方法还包括:接收所述第一设备发送的第一认证消息;根据所述第一认证消息确定所述第一设备的第一网络访问权限。
- 根据权利要求14-17任意一项所述的方法,其特征在于,所述方法还包括:接收所述第一设备发送的第二认证消息,所述第二认证消息中包括所述目标工业互联网标识;根据所述第二认证消息确定所述第一设备的第二网络访问权限。
- 根据权利要求14或16所述的方法,其特征在于,所述第一消息包括所述第一设备的初始工业互联网标识。
- 根据权利要求14或19所述的方法,其特征在于,所述第一消息为认证消息。
- 根据权利要求14或16所述的方法,其特征在于,所述第二消息用于请求为第一设备分配工业互联网标识。
- 根据权利要求14或15所述的方法,其特征在于,所述第二消息用于请求为第一设备注册目标工业互联网标识。
- 根据权利要求19所述的方法,其特征在于,所述第二消息基于如下方式获得:获取预先配置的第一前缀和所述第一设备的设备信息;基于所述第一前缀和所述初始工业互联网标识,得到所述目标工业互联网标识;基于所述目标工业互联网标识和所述设备信息,得到包括所述设备信息和所述目标工业互联网标识的第二消息,所述第二消息用于请求为所述第一设备注册所述目标工业互联网标识。
- 一种基于工业互联网标识的处理***,其特征在于,所述***包括第一设备和第二设备;所述第一设备用于向第二设备发送第一消息,所述第一消息用于为所述第一设备申请工业互联网标识,所述第二设备为网管或者网络准入控制器;所述第二设备向所述第一设备发送第二消息,所述第二消息指示为所述第一设备申请工业互联网标识的结果;所述第一设备根据所述第二消息,将目标工业互联网标识写入到所述第一设备中。
- 根据权利要求24所述的***,其特征在于,所述第一消息包括所述目标工业互联网标识。
- 根据权利要求24所述的***,其特征在于,所述第一消息包括所述第一设备的初始工业互联网标识。
- 根据权利要求24或26所述的***,其特征在于,所述第二消息包括所述目标工业互联网标识。
- 根据权利要求24或26或27所述的***,其特征在于,所述第一消息为认证消息。
- 根据权利要求24或26-28任意一项所述的***,其特征在于,所述第二消息为包括所述目标互联网标识的安全认证信息。
- 一种设备,其特征在于,包括:处理器和存储器;所述存储器,用于存储指令或计算机程序;所述处理器,用于执行所述指令或计算机程序,执行权利要求1-23任意一项所述的方法。
- 一种计算机存储介质,其特征在于,所述计算机可读存储介质中存储有指令,当其在处理器上运行时,实现权利要求1-23任意一项所述的方法。
- 一种计算机程序产品,其特征在于,包括程序,当所述程序在处理器上运行时,实现权利要求1-23任意一项所述的方法。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210038368.1A CN116489123A (zh) | 2022-01-13 | 2022-01-13 | 一种基于工业互联网标识的处理方法及装置 |
CN202210038368.1 | 2022-01-13 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2023134557A1 true WO2023134557A1 (zh) | 2023-07-20 |
Family
ID=87210571
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2023/070847 WO2023134557A1 (zh) | 2022-01-13 | 2023-01-06 | 一种基于工业互联网标识的处理方法及装置 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN116489123A (zh) |
WO (1) | WO2023134557A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN117749761A (zh) * | 2024-02-19 | 2024-03-22 | 中国信息通信研究院 | 基于工业互联网标识的标识解析方法和装置、设备和介质 |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20190334860A1 (en) * | 2018-04-30 | 2019-10-31 | Siemens Aktiengesellschaft | Control Component and Method for Registering Device Names Assigned to Industrial Automation Devices or Communication Devices in a Name Service System |
CN111767484A (zh) * | 2020-08-31 | 2020-10-13 | 中国信息通信研究院 | 工业互联网标识解析方法及相关装置 |
CN113037773A (zh) * | 2021-03-30 | 2021-06-25 | 中国联合网络通信集团有限公司 | 主动标识载体及其管理方法、服务平台 |
CN113779605A (zh) * | 2021-09-14 | 2021-12-10 | 码客工场工业科技(北京)有限公司 | 一种基于联盟链的工业互联网Handle标识体系解析认证方法 |
-
2022
- 2022-01-13 CN CN202210038368.1A patent/CN116489123A/zh active Pending
-
2023
- 2023-01-06 WO PCT/CN2023/070847 patent/WO2023134557A1/zh unknown
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20190334860A1 (en) * | 2018-04-30 | 2019-10-31 | Siemens Aktiengesellschaft | Control Component and Method for Registering Device Names Assigned to Industrial Automation Devices or Communication Devices in a Name Service System |
CN111767484A (zh) * | 2020-08-31 | 2020-10-13 | 中国信息通信研究院 | 工业互联网标识解析方法及相关装置 |
CN113037773A (zh) * | 2021-03-30 | 2021-06-25 | 中国联合网络通信集团有限公司 | 主动标识载体及其管理方法、服务平台 |
CN113779605A (zh) * | 2021-09-14 | 2021-12-10 | 码客工场工业科技(北京)有限公司 | 一种基于联盟链的工业互联网Handle标识体系解析认证方法 |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN117749761A (zh) * | 2024-02-19 | 2024-03-22 | 中国信息通信研究院 | 基于工业互联网标识的标识解析方法和装置、设备和介质 |
CN117749761B (zh) * | 2024-02-19 | 2024-05-14 | 中国信息通信研究院 | 基于工业互联网标识的标识解析方法和装置、设备和介质 |
Also Published As
Publication number | Publication date |
---|---|
CN116489123A (zh) | 2023-07-25 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8239549B2 (en) | Dynamic host configuration protocol | |
US10776489B2 (en) | Methods and systems for providing and controlling cryptographic secure communications terminal operable to provide a plurality of desktop environments | |
CN110650076B (zh) | Vxlan的实现方法,网络设备和通信*** | |
US8806565B2 (en) | Secure network location awareness | |
US8605582B2 (en) | IP network system and its access control method, IP address distributing device, and IP address distributing method | |
US10595320B2 (en) | Delegating policy through manufacturer usage descriptions | |
JP4879643B2 (ja) | ネットワークアクセス制御システム、端末、アドレス付与装置、端末システム認証装置、ネットワークアクセス制御方法、及び、コンピュータプログラム | |
US10038591B1 (en) | Apparatus, system, and method for secure remote configuration of network devices | |
US8887237B2 (en) | Multimode authentication | |
US20090025079A1 (en) | Communication system for authenticating or relaying network access, relaying apparatus, authentication apparatus, and communication method | |
US11019032B2 (en) | Virtual private networks without software requirements | |
WO2013013481A1 (zh) | 接入认证方法、设备、服务器及*** | |
WO2023134557A1 (zh) | 一种基于工业互联网标识的处理方法及装置 | |
US8087066B2 (en) | Method and system for securing a commercial grid network | |
WO2023220344A1 (en) | Authentication and enforcement of differentiated policies for a bridge mode virtual machine in a mac-based authentication network | |
US20220417039A1 (en) | Manufacturer usage description mud file obtaining method and device | |
US20220394009A1 (en) | Network security from host and network impersonation | |
US20220210192A1 (en) | Network configuration security using encrypted transport | |
JP2009272693A (ja) | 接続制御システム、接続制御方法および接続制御プログラム | |
CN113890864B (zh) | 数据包处理方法、装置、电子设备和存储介质 | |
WO2022222524A1 (zh) | 一种访问控制方法和相关设备 | |
US20240187858A1 (en) | Enhanced authentication procedure for o-ran network elements | |
JP7338070B2 (ja) | 情報処理方法及び関連するネットワーク機器 | |
WO2021103986A1 (zh) | 一种网络设备管理方法、装置、网络管理设备及介质 | |
WO2023227057A1 (zh) | 业务授权方法、装置、网络功能及存储介质 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 23739900 Country of ref document: EP Kind code of ref document: A1 |