CN114697067A - Internet of things system based on safety guide and group sharing - Google Patents

Abstract

The present invention provides an Internet of Things system, comprising a cloud account server configured to manage a plurality of user accounts corresponding to a plurality of users, wherein the plurality of users includes a first user; a plurality of Internet of Things devices, each The IoT devices are respectively connected in communication with the cloud account server, wherein the plurality of IoT devices include a first IoT device corresponding to the first user, and the first IoT device is configured to store settings set by the first user a predetermined first authorization list; and a plurality of peripheral devices, the plurality of peripheral devices including a first peripheral device directly connected or communicatively connected with the first Internet of Things device. The first Internet of Things device determines whether other users have the first permission to access the first peripheral device based on the first authorization list.

Description

IoT system based on security orientation and group sharing

This application claims that the filing date is December 25, 2020, the application number is 109146142, and the invention-creation title is "Internet of Things system based on security orientation and group sharing".

technical field

The present invention relates to the Internet of Things system. More specifically, the present invention relates to an IoT system based on security orientation and group sharing.

Background technique

In the prior art, the IoT connection technology is a peer-to-peer (P2P) network connection mechanism. When any IoT device is connected to another IoT device, the authorized IoT device must first establish an authorization account and a corresponding password, and this set of accounts and passwords will be used to confirm the identity during connection. Therefore, each IoT device needs to establish a dedicated account and password for each network connection requesting access to the IoT device resources, so that the IoT device administrator needs to spend a lot of time in establishing each connection account.

In addition, when the P2P network connection cannot be established through the wall, a relay server (Relay Server) mechanism will be used for network connection. The relay server will temporarily store the connection exchange data, and then transmit it to the destination IoT device. . Using this mechanism will have the following disadvantages: (1) the information storage relay server has security concerns about information leakage; (2) the data passes through the relay server to increase the network delay time; and (3) the use of the relay server will increase the network bandwidth of the cloud server. and other shortcomings.

In addition, it is known that the account information for accessing storage, monitoring, screen playback and other resources in the Internet of Things is individually established and stored in each Internet of Things device, and account resources are not integrated through a cloud server, and there is no convenient common authorization structure. A consensus protocol can be used to authorize and access the respective resources. Therefore, when each IoT device wants to share resources such as storage, monitoring, screen playback, etc., it is necessary to create a dedicated account and password on each IoT device. In addition to time-consuming management, it is necessary to integrate different resource authorization protocols, resulting in the following disadvantages: ( 1) The connection between IoT devices through different resource authorization protocol interfaces is less efficient than the consistent resource authorization protocol; (2) The development system needs to integrate different resource authorization protocol interfaces, which takes a lot of time.

Therefore, the industry is currently seeking an IoT system based on security orientation and group sharing, which can establish a convenient authorization distribution mechanism and enhance the data security of the IoT system.

SUMMARY OF THE INVENTION

In view of this, the present invention provides an IoT system for improving the aforementioned convenient authorization distribution mechanism and enhancing the data security of the IoT system.

In some embodiments, the IoT system includes a cloud account server configured to manage a plurality of user accounts corresponding to a plurality of users, wherein the plurality of users include a first user; a plurality of IoT devices , each IoT device is respectively connected to the cloud account server in communication, wherein the plurality of IoT devices include a first IoT device corresponding to the first user, and the first IoT device is configured to save the a first authorization list set by a first user; and a plurality of peripheral devices, the plurality of peripheral devices including a first peripheral device directly or communicatively connected to the first Internet of Things device. In some embodiments, the first Internet of Things device determines whether other users have the first permission to access the first peripheral device based on the first authorization list. Each user can apply for a user account to the cloud server.

In some embodiments, the first peripheral device includes at least one of a first storage resource device, a first monitoring resource device, or a first display resource device.

In another embodiment, the plurality of IoT devices further include a second IoT device corresponding to the second user, and the second IoT device is configured to store the first IoT device set by the second user. Two authorization lists; the plurality of peripheral devices further include a second peripheral device directly connected or communicatively connected to the second IoT device, wherein the second IoT device determines whether other users are based on the second authorization list having a second authority to access the second peripheral device, and the second peripheral device includes at least one of a second storage resource device, a second monitoring resource device, or a second display resource device; the plurality of IoT devices also Including a third Internet of Things device corresponding to a third user, and the third Internet of Things device is configured to store a third authorization list set by the third user; and the plurality of peripheral devices also include and the A third peripheral device directly connected or communicatively connected by the third IoT device, wherein the third IoT device determines whether other users have the third permission to access the third peripheral device based on the third authorization list, And the third peripheral device includes at least one of a third storage resource device, a third monitoring resource device, or a third display resource device.

In another embodiment, the cloud account server further includes a cloud account server private key and a cloud account server public key corresponding to the cloud account server private key; the cloud machine server further includes a cloud machine server private key, and a cloud account server The cloud machine server public key corresponding to the cloud machine server private key; the STUN cloud server also includes the STUN cloud server private key and the STUN cloud server public key corresponding to the STUN cloud server private key; the P2P information exchange cloud server further includes P2P Information exchange cloud server private key, and P2P information exchange cloud server public key corresponding to the P2P information exchange cloud server private key; each of the plurality of users further has corresponding output and input devices, wherein the first user has the first user an output and input device, the first output and input device includes a first output and input device private key, and a first output and input device public key corresponding to the first output and input device private key; the plurality of things The networking device further includes a second IoT device corresponding to the second user, wherein the first IoT device includes a private key of the first IoT device, and the first IoT device corresponding to the private key of the first IoT device a public key, and the second IoT device includes a second IoT device private key and a second IoT device public key corresponding to the second IoT device private key; and the first peripheral device further includes a first peripheral A device private key, and a first peripheral device public key corresponding to the first peripheral device private key.

Other embodiments and advantages of the present invention will become apparent from the following detailed description showing an example of the principles of the invention, taken in conjunction with the accompanying drawings. In addition, well-known components and principles will not be repeated in this specification, so as not to unnecessarily obscure the present invention.

Description of drawings

In the drawings of the present invention, the same reference signs refer to the same or similar components. Furthermore, since the various figures are only examples, they are not drawn to actual scale.

FIG. 1 is a schematic diagram showing an IoT system according to an embodiment of the present invention.

FIG. 2A is a schematic table showing a first authorization list according to an embodiment of the present invention.

FIG. 2B is another way of displaying the first authorization list according to another embodiment of the present invention.

Description of reference numbers:

100: IoT system; 101: Cloud; 102: Cloud machine server; 103: Cloud account server; 104: STUN cloud server; 105: P2P information exchange cloud server; 110: First user; 111: First IoT device ; 112: first storage resource device; 113: first monitoring resource device; 114: first display resource device; 120: second user; 121: second IoT device; 122: second storage resource device; 123: 124: second display resource device; 130: third user; 131: third IoT device; 132: third storage resource device; 133: third monitoring resource device; 134: third display resource device; 200: the first authorization list; 201: another aspect of the first authorization list; 210: the first user account; 211: the first friend authorization list; 212: the first group authorization list; 212a: the first 212b: second group list; 213: first other authorization list; 220: second user account; 230: third user account; 270: arrow.

Detailed ways

The invention will now be described in detail with reference to several preferred embodiments as depicted in the accompanying drawings. In the following description, numerous specific details are set forth in order to provide a general understanding of the present invention. However, one having basic knowledge in the art will understand that the present invention may be practiced in the absence of some or all of these specific details.

FIG. 1 is a schematic diagram showing an IoT system 100 according to an embodiment of the present invention. As shown in FIG. 1 , the cloud 101 includes a cloud machine server 102 for managing IoT devices, a cloud account server 103 for managing user accounts, a STUN cloud server 104 for P2P through-wall connection, and a P2P through-wall connection P2P information exchange cloud server 105 . For example, the first user 110 and the second user 120 can respectively register the corresponding first user account and the second user account with the cloud account server 103 . The cloud account server 103 can manage all users' user accounts, user passwords, whether the accounts are allowed to be disclosed for others to search for options, emails, mobile phone numbers and other user information. It should be understood that although two users are illustrated here, the present invention is not limited thereto. According to actual usage conditions, the IoT system may include more (eg, more than 3) or fewer (eg, less than 1) users.

As shown in the embodiment of FIG. 1 , the first IoT device 111 owned by the first user 110 can exchange information with the cloud 101 (including the cloud machine server 102 , the cloud account server 103 , the STUN cloud server 104 , and the P2P information exchange cloud server). 105) Communication connection, for example, through a communication connection method such as a local area network, the Internet, a wired network, and a wireless network. Similarly, the second IoT device 121 owned by the second user 120 can communicate with the cloud 101 . It should be understood that although two IoT devices are listed here, the present invention is not limited thereto. The present IoT system may include more (eg, more than 3), or fewer (eg, 1) IoT devices, as required. In addition, a user is not limited to owning one IoT device, but may own fewer (eg, 0) or more (eg, more than 2) IoT devices according to needs.

The first IoT device 111 may correspond to (eg, bind) the first user 110 , and the second IoT device 121 may correspond to the second user 120 . More specifically, the first IoT device 111 is bound to the first user 110 by corresponding to the first user account 210 ; the second IoT device 121 is bound by corresponding to the second user account 220 to the second user 120 . The cloud machine server 102 can manage the binding information (for example, the user account corresponding to each IoT device) and machine device identifiers of each IoT device (eg, the first IoT device 111 and the second IoT device 121 ) (ID), and other device information. The machine device ID and other device information of each IoT device can be stored in the information barcode.

In one embodiment, the user can log in to the cloud account server 103 through a mobile device for identity verification, and then upload the corresponding user account and the device ID to be bound to the cloud server 102 to complete the IoT device. Binding to the user. In addition, the user can also change the binding state of the IoT device. For example, the user can communicate with the cloud machine server 102 through a mobile device, and input the information of the IoT device to be bound (for example, by scanning the barcode of the information, or directly inputting the machine device ID). Next, the cloud machine server 102 determines whether the IoT device has been bound by other users. If the IoT device has been bound by another user, it is necessary to input the user account and password of the other user to unbind the device, and then the aforementioned IoT device binding operation can be continued. It should be noted that although a mobile device is used for description here, this is only used for auxiliary description. The present invention is not limited to a mobile device, but can be performed by using a personal computer, a notebook computer, a PAD and other devices according to the actual operating conditions. operate.

In one embodiment, each IoT device may be connected, or communicatively connected, to one or more peripheral devices. As shown in FIG. 1, the first IoT device 111 may optionally be directly connected, or communicatively connected, with the first peripheral device. The first peripheral device includes a first storage resource device 112 , a first monitoring resource device 113 , or a first display resource device 114 . Each IoT device can save an authorization list set by its corresponding user. For example, a first authorization list set by the first user 110 may be stored in the first IoT device 111 , and the first authorization list records the first peripheral devices connected to the first IoT device 111 and is used for It is determined whether the user (eg, the second user 120 ) has the first authority to access the first peripheral device. It should be understood that each user may have all the management rights of the corresponding IoT device and peripheral devices connected to each IoT device.

It should be understood that although the above description specifically refers to the first user, the first IoT device, and the first peripheral device, the present invention is not limited thereto, and the above-mentioned content is also applicable to other users (for example, the second user 120 ). ), its corresponding IoT device (eg, the second IoT device 121 ), and related peripheral devices.

In one embodiment, each user can individually select from all user accounts to create their own friend list. For example, the first user may create a first user friend list, and the first user friend list may include, for example, 0 user accounts, which means that he has not yet become friends with any user; or may, for example, Including 10 user accounts means that the first user and the users corresponding to the 10 user accounts are friends with each other.

As mentioned above, the user (eg, the first user) may also create a friend authorization list (eg, the first friend authorization list) in the authorization list (eg, the first authorization list) to select the desired friend from the friend list. An object of authorization (eg, first permission). Taking the above example to illustrate, the first user can select, for example, 5 user accounts from the 10 user accounts, so that the users corresponding to the 5 user accounts have the first permission to access the first peripheral device .

In one embodiment, each user can also select from all user accounts to create their own group list. For example, the first user may create a first user group list, and the first user group list may include one or more groups. Taking a single group as an example, the group may include, for example, 0 A user account means that no user has been added to the group; or it can include, for example, 10 user accounts, which means that there are currently users corresponding to the 10 user accounts in the group. It should be understood that the group list (eg, the first user group list) may not be limited to a single group, but may have an unlimited number of groups according to the actual usage of each user. In addition, if there are more than two groups, each user can add the same user account to two or more groups, that is, the user accounts in these groups can be duplicated with each other.

As mentioned above, the user (eg, the first user) may also create a group authorization list (eg, the first group authorization list) in the authorization list (eg, the first authorization list) to obtain the Select the object you want to authorize. Taking the above example to illustrate, the first user can select at least one group from the first user group list, so that the user corresponding to the user account in the at least one group has the first access to the first peripheral device. a permission.

In one embodiment, the user (eg, the first user) may also create other authorization lists (eg, the first other authorization list) in the authorization list (eg, the first authorization list), so as to be saved by the cloud account server All user accounts that are managed, and permissions (eg, first permissions) are authorized to all users.

For example, please refer to FIG. 2A , which is a schematic table showing the first authorization list 200 according to an embodiment of the present invention. The first authorization list 200 records the first peripheral devices connected to the first IoT device 111 (for example, the first storage resource device 112 , the first monitoring resource device 113 , and the first display resource device 114 in FIG. 2A ) , and a list of user authorizations. The first user 110 can respectively set a user account that can access the first storage resource device 112, the first monitoring resource device 113, or the first display resource device 114, so that the user account (for example, the third user account) The user (eg, the third user 130 ) corresponding to the user account 230 ) can access and/or use the first storage resource device 112 , the first monitoring resource device 113 , or the first display resource device 114 . In addition, since the first IoT device 111 is bound to the first user 110, the first user 110 essentially has the first permission to access the first peripheral device, so it is recorded in the user authorization list The first user account 210 corresponding to the first user 110 has permissions for all peripheral devices (eg, the first storage resource device 112 , the first monitoring resource device 113 , or the first display resource device 114 ).

Therefore, as shown in the embodiment in FIG. 2A , since only the first user account 210 and the third user account 230 are recorded in the user authorization list of the first storage resource device 112 , only the first user 110 and the third user account are recorded. The third user 130 has the first authority to access the first storage resource device 112 ; the first user account 210 , the second user account 220 and the third user account 230 are recorded in the authorization list of the first monitoring resource device 113 , so the first user 110 , the second user 120 and the third user 130 all have the first authority to access the first monitoring resource device 113 .

In addition, as shown by the arrow 270 in FIG. 2A , the first user 110 can also set the field in the user authorization list to "*", indicating that the first authorization of the first peripheral device is open to the cloud account server All the user accounts in 103, so that the users corresponding to all the user accounts can access the first peripheral device. When the user communicates with the cloud machine server 102 via input and output devices (eg, mobile devices, personal computers, laptops, PADs, etc.), the cloud machine server 102 can display all IoT devices set as "*" and their Corresponding to the peripheral device to indicate to all users that the peripheral device currently has open permissions. Therefore, in the embodiment of FIG. 2A, the first user 110 and the third user 130 can access the first storage resource device 112; the first user 110, the second user 120 and the third user 130 can store The first monitoring resource device 113 is taken; and all users who have registered user accounts in the cloud account server 103 can access the first display resource device 114 .

Next, please refer to FIG. 2B , which is another manner 201 for displaying the first authorization list according to another embodiment of the present invention. Another aspect 201 of the first authorization list records a first friend authorization list 211, a first group authorization list 212, a first other authorization list 213, and their respective resource authorization lists, wherein the first group authorization list 212 includes a first group list 212a and a second group list 212b, and the resource authorization list records the resource devices authorized by each list.

As shown in the embodiment in FIG. 2B , the resource authorization list of the first friend authorization list 211 records the first storage resource device 112 , so the user corresponding to the user account in the first friend authorization list 211 has access to the first storage resource device 112 . A first authority of the storage resource device 112; the first storage resource device 112 is recorded in the resource authorization list of the first group list 212a, so the user corresponding to the user account in the first group list 212a has access to the first storage resource device 112. A first authority of the storage resource device 112; the resource authorization list of the second group list 212b records the first storage resource device 112, the first monitoring resource device 113, and the first display resource device 114, so it is different from the second group The user corresponding to the user account in the list 212b has the first authority to access the first storage resource device 112, the first monitoring resource device 113, and the first display resource device 114; the resource authorization list of the first other authorization list 213 The first display resource device 114 is described in , so all users who have registered user accounts in the cloud account server 103 can access the first display resource device 114 .

For the first storage resource device 112, such as a conventional hard disk (HDD), a solid-state disk (SSD) and other storage devices, the first permission opened by the first user 110 may include but not limited to folder setting permission, file reading permissions, file write permissions, or a combination thereof. In some embodiments, the folder setting permission may further include setting a read-only (Read) permission, setting a read-write (Write) permission, or a combination thereof.

For the first monitoring resource device 113, such as a network camera, a monitoring video recorder, etc., the first permission opened by the first user 110 may include, but is not limited to, the Liveview permission, the recording permission, and the Playback permission. , system parameter settings, or a combination thereof.

For the first display resource device 114, such as a screen display device, etc., the first permission opened by the first user 110 may include, but is not limited to, permission to receive push multimedia, permission to be synchronously played by remote IoT devices, permission to play content, or a combination thereof.

It should be understood that although the above description specifically refers to the first user, the first IoT device, and the first peripheral device, the present invention is not limited thereto, and the above-mentioned content is also applicable to other users (for example, the second user 120 ). ), its corresponding IoT device (eg, the second IoT device 121 ), and related peripheral devices.

In addition, when the IoT device is communicatively connected to the cloud 101, the cloud 101 can download and store the corresponding user accounts of authorized users listed in each authorization list (eg, friend authorization list, group authorization list, or other authorization list) information. When the IoT device is disconnected from the cloud 101 (ie, not connected in communication), the IoT device can use the previously downloaded and stored authorized user account information, so that the authorized user of the current version of the authorized user account information can obtain peripheral devices access rights.

As mentioned above, during the disconnection between the IoT device and the cloud 101 (ie, no communication connection), if the user account information of each authorization list is changed, the IoT device and the cloud 101 will be reconnected to communicate with each other. Synchronizing (eg, re-downloading) the updated user account information enables authorized users who update the version of the authorized user account information to gain access rights to peripheral devices.

As shown in FIG. 1 , since the first user 110 has all the operation rights (ie, the first rights) of the first IoT device and its connected resource devices, the first user 110 can perform the following actions: access The content in the first storage resource device 112 or the first display resource device 114 is used to play the content in the first storage resource device 112 to input and output devices (eg, mobile devices, personal computers, notebook computers, PADs, etc. ) or the first display resource device 114 plays the real-time video content of the first monitoring resource device 113 in real time, stores the content recorded by the first monitoring resource device 113 in the first storage resource device 112, and replays the content stored in the first monitoring resource device 112. The content recorded by the first monitoring resource device 113 in the first storage resource device 112 is stored.

In one embodiment, the first user 110 may, for example, use the above-mentioned first authorization list, friend authorization list, group authorization list, or other authorization list to authorize the first permission to the second user 120 . In this embodiment, since the second user 120 has the first authority, the following actions can be performed: the input and output device or the first display resource device 114 is used to play the real-time image content of the first monitoring resource device 113 in real time; The input and output device or the first display resource device 114 plays back the content recorded by the first monitoring resource device 113 stored in the first storage resource device 112 , or accesses the content in the first storage resource device 112 .

In another embodiment, as shown in the embodiment of FIG. 1 , the IoT system may further include a third user 130 , a third IoT device 131 , a third storage resource device 132 , a third monitoring resource device 133 , Or the third display resource device 134, the relative relationship of which is as described above, so it will not be repeated here. In this embodiment, when the second user 120 obtains the first permission, the following actions can be performed: using the first display resource device 114 to play the content in the first storage resource device 112 , and using the second display resource device 124 to play the content in the first storage resource device 112 . A content in the resource device 112 is stored, and the real-time video content of the first monitoring resource device 113 is played by using the second display resource device 124 .

In a further embodiment, the first user 110 and the third user 130 respectively authorize the peripheral device authority to the second user 120 . In other words, when the second user 120 obtains the first permission and the third permission, the second user 120 can perform the following actions: use the first display resource device 114, the second display resource device 124, and/or the third display resource The device 134 plays the same content of the first display resource device 114 and/or the third display resource device 134 synchronously; Play to the first display resource device 114 and/or the third display resource device 134 .

In other further embodiments, when the second user 120 obtains the first permission and the third permission, the second user 120 can perform the following actions: accessing the first storage resource device 112 and/or the third storage resource device 132; store the video content recorded by the first monitoring resource device 113, the second monitoring resource device 123, and/or the third monitoring resource device 133 to the first storage resource device 112 and/or the third storage resource device 132. With this embodiment, since the video content recorded by each monitoring resource device can be stored in the storage resource device of other users, for example, when the second monitoring resource device 123 of the second user 120 is damaged by a thief, the second monitoring resource device 123 of the second user 120 can be The content recorded by the monitoring resource device 123 can be stored in the first storage resource device 112 and/or the third storage resource device 132 so as to preserve criminal evidence without being damaged by thieves.

The term "communication connection" mentioned in this article can improve data security through encryption function to ensure that the transmitted information cannot be cracked by hackers. The following paragraphs will further describe the encryption method applied to the IoT structure of this paper.

In one embodiment, the cloud account server 103 of the cloud 101 or other servers (for example, the cloud machine server 102, the STUN cloud server 104, or the P2P information exchange cloud server 105) can each have a private key and a private key corresponding to the private key. 's public key. For example, the cloud account server 103 may have a cloud account server private key and a cloud account server public key corresponding to the private key.

Each user may have an output and input device (eg, mobile phone, personal computer, laptop, PAD, etc.), wherein the output and input device has its own private key, and a public key corresponding to this private key. For example, the first user 110 may have a first output and input device (eg, a mobile phone) that has its own first output and input device private key and corresponds to this private key The first output and input device public key. In addition, each user can have not only a single output and input device, but an unlimited number of output and input devices, and each output and input device has its own private key and a public key corresponding to the private key. key.

Similarly, the IoT device corresponding to each user may also have its own private key and a public key corresponding to the private key. For example, the first IoT device 111 may have a first IoT device private key and a first IoT device public key corresponding to the private key.

Similarly, peripheral devices communicatively connected to each IoT device may also have their own private keys and public keys corresponding to the private keys. For example, the first monitoring resource device 113 may have a first monitoring resource device private key and a first monitoring resource device public key corresponding to the private key.

In this embodiment, when the first user 110 uses the first output and input device to communicate with the first Internet of Things device 111, the first output and input device and the first Internet of Things device 111 will use the private data owned by each other. key and public key (i.e., the first output and input device private key, the first output and input device public key, the first IoT device private key, and the first IoT device public key), using the commonly used in the field of information security The cryptographic algorithm establishes an encrypted communication channel between the two parties to transmit data. All plaintext data are encrypted and then transmitted before transmission, so as to ensure that other servers that transmit the data in the middle cannot know the content of the transmitted data, and only the two communicating parties can decrypt the plaintext. It should be understood that although the above description takes the first output and input device and the first IoT device 111 as an example, the present invention is not limited to this, and the first output and input device can also be connected with the second IoT device 121, or For other IoT devices to communicate with each other, the above encryption steps still apply.

In this embodiment, the above encryption step can also be applied to the communication connection between various IoT devices, between the cloud 101 (including each cloud server) and each IoT device, between each server in the cloud 101, and each IoT device Communication connection between peripheral devices connected thereto, and communication connection between the first output and input device and each cloud server. In addition, one of a timestamp, a random number or a pseudo-random number (nonce) can be added to the cryptographic algorithm of the above encryption step to avoid retransmission attacks when data is transmitted between the two parties.

In addition, when the peripheral device connected to the IoT device is abnormal, the IoT device can automatically push the abnormal information of the peripheral device to the abnormal information receiver through the list of abnormal information receivers set in advance by the system, so that the abnormal information Receiving personnel can carry out abnormal removal processing or replace abnormal devices.

It should be understood that the terms "corresponding," "owning," and "binding" as used herein have similar meanings and may be used interchangeably herein.

The IoT system disclosed in the present invention uses the user account in the cloud account server as the basis for judging authorization, so when performing the authorization behavior, the IoT device owner does not need to establish an authorized person account, thus saving a lot of time. In addition, the user can use a single corresponding user account, that is, can manage or access authorized multiple IoT devices and multiple connected peripheral devices, which can save steps and save account management. The present invention also proposes a group authorization structure, which is convenient for IoT device administrators to create different groups according to the same authorization authority. Authorize actions to save management time. In addition, in the Internet of Things system disclosed in the present invention. The cloud account server is only used to manage the user accounts used for authentication and authorization. The data and data in the peripheral devices connected to each IoT device will not pass through the cloud, but will only be transmitted between authorized IoT devices , and use the above encryption steps to increase the security of the communication connection, so a security-oriented and group sharing IoT system can be established.

Although the present invention has been described in detail with reference to the preferred embodiments and drawings, they are only illustrative and not intended to limit the present invention. Those with basic common sense in the technical field to which the present invention pertains can make various modifications, changes and equivalent substitutions without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention should be defined by the appended patent application scope.

Claims (35)

1. an internet of things system, is characterized in that, comprises: a cloud account server configured to manage multiple user accounts corresponding to multiple users, wherein each user can apply for the respective user account from the cloud account server, and the multiple users include the first user; A plurality of IoT devices, each IoT device is respectively connected to the cloud account server in communication, wherein the plurality of IoT devices includes a first IoT device corresponding to the first user, and the first IoT device a networked device configured to maintain a first authorization list set by the first user; and a plurality of peripheral devices, the plurality of peripheral devices including a first peripheral device directly connected or communicatively connected to the first Internet of Things device, The first Internet of Things device determines whether other users have the first permission to access the first peripheral device based on the first authorization list. 2 . The IoT system according to claim 1 , wherein the first peripheral device comprises at least one of a first storage resource device, a first monitoring resource device, or a first display resource device. 3 . 3 . The Internet of Things system according to claim 2 , wherein when the first peripheral device includes the first storage resource device, the first permission includes a file in the first storage resource device. 4 . Folder setting permissions, file read permissions, file write permissions, or a combination thereof. 4 . The Internet of Things system according to claim 3 , wherein the folder setting authority includes setting a read-only authority, setting a read-write authority, or a combination thereof. 5 . 5 . The Internet of Things system according to claim 2 , wherein when the first peripheral device includes the first monitoring resource device, the first authority includes real-time monitoring authority, recording authority, playback authority, and playback authority. 6 . permissions, system parameter settings, or a combination thereof. 6 . The Internet of Things system according to claim 2 , wherein when the first peripheral device includes the first display resource device, the first permission includes permission to receive push multimedia, permission to be synchronized Play content rights, or a combination thereof, from the remote IoT device. 7 . The Internet of Things system of claim 1 , wherein the first user selects from the plurality of user accounts to create a first user friend list. 8 . 8. The Internet of Things system according to claim 7, wherein the first authorization list further comprises: a first friend authorization list configured to hold at least one user account further selected by the first user from the first user friend list to authorize the first authorization to the at least one user User corresponding to the account. 9 . The IoT system of claim 1 , wherein the first user selects from the plurality of user accounts to create a first user group list. 10 . 10. The Internet of Things system according to claim 9, wherein the first authorization list further comprises: a first group authorization list configured to store at least one group further selected by the first user from the first user group list to authorize the first authorization to the at least one group The user corresponding to the user account in the group. 11. The Internet of Things system according to claim 1, wherein the first authorization list further comprises: The first other authorization list is configured to store the plurality of user accounts managed by the cloud account server, so as to authorize the first authority to all of the plurality of users. 12. The Internet of Things system according to claim 1, further comprising: A cloud machine server configured to register a plurality of identifiers respectively corresponding to the plurality of IoT devices and information of a plurality of user accounts corresponding to the plurality of identifiers respectively. 13. The Internet of Things system according to claim 2, wherein when the first peripheral device includes the first storage resource device, the first user can access the first storage resource device content in . 14. The Internet of Things system according to claim 2, wherein when the first peripheral device includes the first storage resource device and the first display resource device, the first user can use the The first display resource device plays the content in the first storage resource device. 15. The IoT system according to claim 2, wherein when the first peripheral device includes the first monitoring resource device and the first storage resource device, at least one of the following is executed: The first user can play the real-time image content of the first monitoring resource device in real time; The first user can store the content recorded by the first monitoring resource device to the first storage resource device; The first user can play back the content recorded by the first monitoring resource device stored in the first storage resource device; When the second user has the first permission, the second user can play the real-time video content of the first monitoring resource device in real time; or When the second user has the first permission, the second user can play back the content recorded by the first monitoring resource device stored in the first storage resource device. 16 . The Internet of Things system according to claim 2 , wherein when the first peripheral device includes the first storage resource device and the second user has the first authority, the second user Content in the first storage resource device can be accessed. 17. The Internet of Things system according to claim 2, characterized in that, The plurality of IoT devices further include a second IoT device corresponding to a second user, and the second IoT device is configured to store a second authorization list set by the second user; The plurality of peripheral devices further include a second peripheral device directly or communicatively connected to the second IoT device, Wherein, the second IoT device determines whether other users have the second permission to access the second peripheral device based on the second authorization list, and the second peripheral device includes a second storage resource device , at least one of a second monitoring resource device, or a second display resource device; The plurality of IoT devices further include a third IoT device corresponding to a third user, and the third IoT device is configured to store a third authorization list set by the third user; and The plurality of peripheral devices further include a third peripheral device directly or communicatively connected to the third IoT device, Wherein, the third IoT device determines whether other users have a third authority to access the third peripheral device based on the third authorization list, and the third peripheral device includes a third storage resource device , at least one of a third monitoring resource device, or a third display resource device. 18. The IoT system according to claim 17, wherein when the first peripheral device comprises the first storage resource device, the first display resource device, and the first monitoring resource device, When the second peripheral device includes the second display resource device, and the second user has the first permission, at least one of the following will be executed: The second user can use the first display resource device to play the content in the first storage resource device; The second user can use the second display resource device to play the content in the first storage resource device; The second user can use the second display resource device to play the real-time image content of the first monitoring resource device; The second user can use the second display resource device to play back the content recorded by the first monitoring resource device stored in the first storage resource device. 19 . The Internet of Things system according to claim 17 , wherein when the first peripheral device includes the first display resource device, and the second peripheral device includes the second display resource device, the When the third peripheral device includes the third display resource device, and the second user has the first permission and the third permission, at least one of the following will be executed: The second user can use the second display resource device to synchronously play the same content of the first display resource device; The second user can use the second display resource device to synchronously play the same content of the third display resource device; The second user can use the third display resource device to synchronously play the same content of the first display resource device; The second user can use the first display resource device to synchronously play the same content of the third display resource device. 20 . The Internet of Things system according to claim 17 , wherein when the first peripheral device includes the first display resource device and the first storage resource device, the second peripheral device includes the The second display resource device and the second storage resource device, the third peripheral device includes the third display resource device and the third storage resource device, and the second user has the first authority and all When the third authority is specified, at least one of the following will be executed: The second user can play the content in the second storage resource device to the first display resource device; The second user can play the content in the second storage resource device to the third display resource device; The second user can play the content in the first storage resource device to the third display resource device; The second user can play the content in the third storage resource device to the first display resource device. 21 . The Internet of Things system according to claim 17 , wherein when the first peripheral device includes the first monitoring resource device and the first storage resource device, the second peripheral device includes the The second monitoring resource device and the second storage resource device, the third peripheral device includes the third monitoring resource device and the third storage resource device, and when the second user has the first permission and When the third authority is used, at least one of the following will be executed: the second user can access the content in the first storage resource device; the second user can access the content in the third storage resource device; The second user can store the video content recorded by the first monitoring resource device in the first storage resource device; The second user can store the video content recorded by the second monitoring resource device in the first storage resource device; The second user can store the video content recorded by the third monitoring resource device in the first storage resource device; The second user can store the video content recorded by the first monitoring resource device in the third storage resource device; The second user can store the video content recorded by the second monitoring resource device in the third storage resource device; The second user can store the video content recorded by the third monitoring resource device in the third storage resource device. 22. The Internet of Things system according to claim 1, further comprising: a cloud machine server; a STUN cloud server; and A P2P information exchange cloud server, in which The cloud account server further includes the cloud account server private key and the cloud account server public key corresponding to the cloud account server private key; the cloud machine server further includes the cloud machine server private key, and the cloud machine server the cloud server public key corresponding to the private key; the STUN cloud server further includes the STUN cloud server private key and the STUN cloud server public key corresponding to the STUN cloud server private key; the P2P information exchange cloud server also includes The P2P information exchange cloud server private key, and the P2P information exchange cloud server public key corresponding to the P2P information exchange cloud server private key; Each of the plurality of users also has a corresponding output and input device, wherein the first user has a first output and input device, the first output and input device includes a first output and input device private key, and a first output and input device public key corresponding to the first output and input device private key; The plurality of IoT devices further include a second IoT device corresponding to a second user, wherein the first IoT device includes a private key of the first IoT device and a private key associated with the first IoT device a corresponding first IoT device public key, and the second IoT device includes a second IoT device private key and a second IoT device public key corresponding to the second IoT device private key; and The first peripheral device further includes a first peripheral device private key and a first peripheral device public key corresponding to the first peripheral device private key. 23. The Internet of Things system according to claim 22, wherein when the first output and input device is communicatively connected to the first Internet of Things device, the first output and input device private key, The first output and input device public key, the first Internet of Things device private key, and the first Internet of Things device public key, using a cryptographic algorithm to establish an encrypted communication channel; and with the first output And the input device or the first IoT device can decrypt the encrypted information. 24. The IoT system according to claim 22, wherein when the first output and input device is communicatively connected to the second IoT device, the first output and input device private key, The first output and input device public key, the second IoT device private key, and the second IoT device public key, using a cryptographic algorithm to establish an encrypted communication channel; and with the first output And the input device or the second IoT device can decrypt the encrypted information. 25. The Internet of Things system according to claim 22, wherein when the first Internet of Things device is communicatively connected to the second Internet of Things device, the private key of the first Internet of Things device, the The first IoT device public key, the second IoT device private key, and the second IoT device public key use a cryptographic algorithm to establish an encrypted communication channel; and communicate with the first IoT device or The second IoT device is capable of decrypting encrypted information. 26. The Internet of Things system according to claim 22, wherein when the cloud account server is communicatively connected to the first Internet of Things device, the cloud account server private key and the cloud account server public key are used. key, the private key of the first Internet of Things device, and the public key of the first Internet of Things device, and use a cryptographic algorithm to establish an encrypted communication channel; and communicate with the cloud account server or the first Internet of Things device. Decrypt encrypted information. 27. The Internet of Things system according to claim 22, wherein when the first output and input device is communicatively connected to the cloud account server, the private key of the first output and input device, the private key of the first output and input device, the The public key of the first output and input device, the private key of the cloud account server, and the public key of the cloud account server, using a cryptographic algorithm to establish an encrypted communication channel; The cloud account server can decrypt encrypted information. 28. The Internet of Things system according to claim 22, wherein when the first Internet of Things device is communicatively connected to the first peripheral device, the first Internet of Things device private key, the first An IoT device public key, the first peripheral device private key, and the first peripheral device public key, using a cryptographic algorithm to establish an encrypted communication channel; and communicating with the first IoT device or the first peripheral The device can decrypt encrypted information. 29. The Internet of Things system according to claim 26, wherein when the cloud account server is replaced with one of a cloud machine server, a STUN cloud server, or a P2P information exchange cloud server, the same logic is used as the When the first Internet of Things device is communicatively connected, an encrypted communication channel is established by using the respective private key and public key, and a cryptographic algorithm is used; and the encrypted information can be decrypted with both ends of the respective encrypted communication channel. 30. The Internet of Things system according to claim 27, wherein when the cloud account server is replaced with one of a cloud machine server, a STUN cloud server, or a P2P information exchange cloud server, the same logic is also used with all of them. When the first output and input devices are communicatively connected, the respective private keys and public keys are used to establish encrypted communication channels using cryptographic algorithms; and the encrypted information can be decrypted with both ends of the respective encrypted communication channels. 31. The Internet of Things system according to any one of claims 23 to 30, wherein one of timestamp, random number or pseudo-random number is further added to the encrypted communication channel. 32. The IoT system according to claim 8, wherein the first IoT device downloads and stores the at least one user saved in the first friend authorization list from the cloud account server account information. 33. The Internet of Things system according to claim 10, wherein the first Internet of Things device downloads and stores all the data in at least one group in the first group authorization list from the cloud account server. information about the user account. 34. The Internet of Things system according to claim 32 or 33, wherein when the first Internet of Things device and the cloud account server disconnect the communication connection and reconnect the communication connection, the first Internet of Things device Download and save the updated user account information again. 35. The Internet of Things system according to claim 1, wherein when an abnormality occurs in the first peripheral device, the abnormal information of the first peripheral device is automatically pushed and broadcasted to the abnormal information according to the abnormal information receiving personnel list. receiving personnel.

Images