[go: up one dir, main page]

WO2019029471A1 - 一种蓝牙网络及配网方法 - Google Patents

一种蓝牙网络及配网方法 Download PDF

Info

Publication number
WO2019029471A1
WO2019029471A1 PCT/CN2018/098921 CN2018098921W WO2019029471A1 WO 2019029471 A1 WO2019029471 A1 WO 2019029471A1 CN 2018098921 W CN2018098921 W CN 2018098921W WO 2019029471 A1 WO2019029471 A1 WO 2019029471A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication device
bluetooth communication
bluetooth
mobile terminal
data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2018/098921
Other languages
English (en)
French (fr)
Inventor
田皓
张瑞安
徐翔君
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Espressif Systems Shanghai Co Ltd
Original Assignee
Espressif Systems Shanghai Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Espressif Systems Shanghai Co Ltd filed Critical Espressif Systems Shanghai Co Ltd
Priority to US16/462,361 priority Critical patent/US11290875B2/en
Publication of WO2019029471A1 publication Critical patent/WO2019029471A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/047—Key management, e.g. using generic bootstrapping architecture [GBA] without using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/50—Secure pairing of devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/50—Service provisioning or reconfiguring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H04W48/10—Access restriction or access information delivery, e.g. discovery data delivery using broadcasted information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information

Definitions

  • the invention relates to a networking technology, in particular to a Bluetooth network and a distribution network method.
  • Bluetooth technology was originally created in 1994 by the telecom giant Ericsson as an alternative to the RS232 data line. Bluetooth can connect multiple devices, overcoming the challenges of data synchronization.
  • BLUFI Bluetooth distribution network
  • GATT Server Common Attribute Protocol Service
  • GATT Client common attribute protocol client, such as mobile phone
  • the invention provides a Bluetooth network and a distribution network method, which realizes configuring a wireless network through Bluetooth, and ensures data security in a Bluetooth distribution network and network communication process.
  • the present invention provides a Bluetooth distribution network method, which is characterized in that the method includes:
  • the Bluetooth communication device establishes a connection with the mobile terminal via Bluetooth
  • the Bluetooth communication device negotiates with the mobile terminal to obtain a data encryption method and a shared key for data decryption;
  • the Bluetooth communication device is connected to an external wireless network.
  • the method for establishing a connection between the foregoing Bluetooth communication device and the mobile terminal includes:
  • the Bluetooth communication device enables the universal attribute protocol service function to send a broadcast with preset broadcast data
  • the mobile terminal searches for the broadcast of the Bluetooth communication device, and establishes a connection with the Bluetooth communication device as a preset universal attribute protocol client.
  • the method for the above-mentioned Bluetooth communication device to negotiate encryption and decryption with the mobile terminal includes:
  • the mobile terminal sends a data packet of the “negotiation process” to the Bluetooth communication device;
  • the Bluetooth communication device After receiving the data packet of the “negotiation process”, the Bluetooth communication device parses according to the preset “negotiation process”, and obtains an encryption method for the mobile terminal to send data to the Bluetooth communication device, and generates a corresponding shared secret by using an asymmetric encryption method. key.
  • the above Bluetooth communication device establishes a network connection with an external wireless network, including:
  • the mobile terminal encrypts the connection information used for the connection with the external wireless network, sends the connection information to the Bluetooth communication device, and sends a network connection request to the Bluetooth communication device after the connection information is sent.
  • the Bluetooth communication device When the Bluetooth communication device receives the network connection request, it determines that the information for the network connection is transmitted, and initiates connection with the external wireless network;
  • the wireless network connection status information is sent to the mobile terminal.
  • the encryption method of the above data is generated by a symmetric encryption method.
  • the Bluetooth communication device After receiving the data of the mobile terminal, the Bluetooth communication device performs integrity check, security signature check, and anti-replay attack check on the packet.
  • the information that the Bluetooth communication device negotiates to generate the shared key is processed by the application layer; if the application layer does not process, the DH encryption algorithm provided by the Bluetooth distribution network may be used to negotiate the key.
  • the mobile terminal After the Bluetooth communication device is connected to the external wireless network, the mobile terminal configures the wireless network through the Bluetooth communication device.
  • a Bluetooth network characterized in that the network comprises:
  • a Bluetooth communication device that is connected to an external wireless network
  • the mobile terminal connects to the Bluetooth communication device through Bluetooth communication, and connects to the external wireless network through the Bluetooth communication device; the Bluetooth communication device negotiates with the mobile terminal to generate a data encryption method by using a symmetric encryption method, and generates an asymmetric encryption method for data decryption. Shared key.
  • the above Bluetooth communication device is provided with a dual mode chip of WIFI and Bluetooth.
  • the Bluetooth network and the distribution network method of the present invention have the advantages that the encryption method of the packet data is used in the Bluetooth distribution network process of the present invention, and the asymmetric sharing method is used to generate the corresponding sharing. Key to ensure data security during Bluetooth distribution network and network communication;
  • the Bluetooth communication device after receiving the data of the mobile terminal, performs integrity check, security signature verification, and anti-replay attack verification on the packet to ensure data security, integrity, and identity security.
  • FIG. 1 is a flow chart of a method for a Bluetooth distribution network method according to the present invention.
  • the BLUFI distribution network includes two parts: Softap and Station.
  • the station configuration item in the BLUFI distribution network includes steps such as broadcast, connection, service discovery, negotiation of shared key, transmission of data, and return connection status.
  • the configuration step is described by taking the configuration station as an example.
  • the GATT Client is described by taking the most commonly used mobile phone as an example.
  • the BLUFI distribution network mainly has two functions: one is for receiving data on the mobile terminal, and the other is for transmitting data to the mobile terminal.
  • BLUFI also includes some important functions, such as BLUFI layer fragmentation, BLUFI layer data encryption and verification, BLUFI layer data validation.
  • the user can implement symmetric encryption, asymmetric encryption, and verification algorithm in the process of BLUFI distribution network; in this embodiment, the DH algorithm is used to negotiate the key by default, 128-AES encrypts the data, and CRC16 verifies the data.
  • FIG. 1 it is a specific process of a Bluetooth distribution network method embodiment, which specifically includes the following steps:
  • the Bluetooth communication device activates the GATT Server function to send a broadcast with specific preset broadcast data (adv data). Among them, this broadcast is customized by the user and is not in the BLUFI Profile.
  • the Bluetooth communication device uses a device with an ESP32 chip, and the ESP32 is a dual-mode chip of WiFi+BT.
  • the APP pre-installed on the mobile terminal searches for the broadcast of the Bluetooth communication device, and establishes a connection with the Bluetooth communication device as a preset universal attribute protocol client (GATT Client).
  • GATT Client universal attribute protocol client
  • the mobile APP can be customized by the user.
  • the mobile phone After the connection between the S3, the Bluetooth communication device and the mobile phone is successfully established, the mobile phone sends a data packet of the “negotiation process” to the Bluetooth communication device.
  • the Bluetooth communication device After receiving the data packet of the "negotiation process", the Bluetooth communication device will parse according to the user-defined "negotiation process".
  • the mobile phone negotiates with the Bluetooth communication device, negotiates and determines an encryption manner for the mobile terminal to send data to the Bluetooth communication device, and negotiates and determines a shared key used for data decryption.
  • the encryption method uses a symmetric encryption algorithm such as AES or DES.
  • the shared key is negotiated and generated by an asymmetric encryption algorithm such as DH, or RSA, or ECC.
  • the data length before encryption and decryption and the length of data after encryption and decryption must be consistent, and support in-situ encryption and decryption.
  • the process of security processing such as key agreement is determined and developed by the user.
  • the mobile APP sends Negotiate Data to the ESP32, and the Negotiate Data type packet is transmitted to the application layer for processing. If the application layer is unwilling to process, the DH encryption algorithm provided by BLUFI can be used to negotiate the key.
  • the application layer needs to register the following security-related functions with BLUFI:
  • Function 1 typedef void(*esp_blufi_negotiate_data_handler_t)(uint8_t*data, int len, uint8_t**output_data, int*output_len, bool*need_free);
  • the function 1 is used to receive normal data during the negotiation. After the processing is completed, the data to be sent needs to be transmitted using output_data and output_len. BLUFI will send the output_data from the negotiate_data_handler after calling the negotiate_data_handler.
  • BLUFI will send the output_data from the negotiate_data_handler after calling the negotiate_data_handler.
  • * Two "*" because I don't know the length that I need to send out at the end, so I need the function myself malloc or point to the global variable, through need_free to notify whether free memory is needed.
  • Function 2 indicates that the length of the encrypted and decrypted data must be the same.
  • Function 3 indicates that the length of the encrypted and decrypted data must be the same.
  • This function 4 is used to calculate the checksum, and the return value is the value of the checksum.
  • BLUFI will use the return value of this function to compare with the checksum at the end of the package.
  • the mobile terminal sends a control packet of “setting the security mode” to the Bluetooth communication device.
  • the control packet of the "set security mode” includes an integrity verification method, an identity security signature verification method, and an anti-replay attack verification method performed by the Bluetooth communication device after receiving data of the mobile terminal.
  • the Bluetooth communication device receives the control packet of "Set Security Mode” and encrypts and decrypts the communication data using the negotiated shared key and the configured security policy.
  • the message integrity check method uses a check algorithm such as SHA1, MD5, CRC, or the like.
  • the identity security signature verification method performs signature verification using an algorithm such as RSA or DH.
  • the RSA algorithm can guarantee identity security; while the DH algorithm itself cannot guarantee identity security, other algorithms need to be added to sign.
  • the anti-replay attack verification method adopts: adding a packet sequence, and the sequence participates in data verification.
  • the security mode can be set at any time during the distribution process, and after the ESP32 receives the configuration of the security mode, the security-related operation is performed according to the mode specified by the security mode.
  • the mobile phone encrypts the necessary connection information such as a user name and a password defined by the "BLUFI transmission format" for the WiFi connection, and then transmits the data to the Bluetooth communication device through a symmetric encryption algorithm.
  • the mobile phone After the mobile phone sends all the necessary connection information for connection, the mobile phone sends a “WiFi connection request” to the Bluetooth communication device.
  • the Bluetooth communication device receives data including the connection information and the “WiFi connection request” sent by the mobile terminal, decrypts by using the shared key, and performs integrity check, identity security signature verification, and anti-replay attack verification.
  • the control package of the "WIFI Connection Status Report" is sent to the mobile phone to report the connection status.
  • the distribution network ends.
  • the mobile phone can configure the WIFI network through Bluetooth.
  • the invention also discloses a Bluetooth network suitable for the above-mentioned Bluetooth distribution network method, the Bluetooth communication network comprising: a Bluetooth communication device and a mobile terminal.
  • the Bluetooth communication device employs a communication device having a dual mode chip such as WIFI and Bluetooth such as an ESP32 chip for connecting the mobile terminal via Bluetooth and connecting to the WIFI network via WIFI.
  • the mobile terminal can be a mobile phone, a tablet, etc., and is connected to the Bluetooth communication device through Bluetooth communication, and is connected to the WIfi network through the Bluetooth communication device to configure the WIFI network.
  • the present invention includes, but is not limited to, configuring WIFI STATION, AP, Hotspot, Sniffer, etc. in the configuration of the WIFI mode; Not limited to a variety of embedded software, mobile / tablet APP, Web server and so on.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明公开一种蓝牙配网方法，该方法包含：蓝牙通信设备与移动终端通过蓝牙建立连接；蓝牙通信设备与移动终端协商得出数据加密方式以及用于数据解密的共享密钥；蓝牙通信设备连接外接的无线网络；实现通过蓝牙配置无线网络。本发明蓝牙配网过程中采用对称加密方法对报文数据的加密方式，并采用非对称加密方法生成对应的共享密匙，保障蓝牙配网及网络通讯过程中的数据安全。

Description

一种蓝牙网络及配网方法 技术领域
本发明涉及一种组网技术，具体涉及一种蓝牙网络及配网方法。
背景技术
蓝牙
Figure PCTCN2018098921-appb-000001
是一种无线技术标准，可实现固定设备、移动设备和楼宇个人域网之间的短距离数据交换(使用2.4-2.485GHz的ISM波段的UHF无线电波)。蓝牙技术最初由电信巨头爱立信公司于1994年创制，当时是作为RS232数据线的替代方案。蓝牙可连接多个设备，克服了数据同步的难题。
蓝牙配网，简称为BLUFI。该功能主要定义了使用GATT Server(通用属性协议服务)来实现被GATT Client(通用属性协议客户端，例如手机)传入WIFI的必连接信息，从而实现WIFI能够连上AP或配置使用SoftAP的profile。
发明内容
本发明提供一种蓝牙网络及配网方法，实现通过蓝牙配置无线网络，并保证保障蓝牙配网及网络通讯过程中的数据安全。
为实现上述面对目的，本发明提供一种蓝牙配网方法，其特点是，该方法包含：
蓝牙通信设备与移动终端通过蓝牙建立连接；
蓝牙通信设备与移动终端协商得出数据加密方式以及用于数据解密的共享密钥；
蓝牙通信设备连接外接的无线网络。
上述蓝牙通信设备与移动终端建立连接的方法包含：
蓝牙通信设备开启通用属性协议服务功能，发送带有预设广播数据的广播；
移动终端搜索到蓝牙通信设备的广播，作为预设的通用属性协议客户端与蓝牙通信设备建立连接。
上述蓝牙通信设备与移动终端协商加解密的方法包含：
移动终端向蓝牙通信设备发送“协商过程”的数据包；
蓝牙通信设备收到“协商过程”的数据包后，按照预设的“协商过程” 进行解析，得出移动终端向蓝牙通信设备发送数据的加密方式，并通过非对称加密方法生成对应的共享密钥。
上述蓝牙通信设备与外接的无线网络建立网络连接包含：
移动终端将用于与外接的无线网络连接的连接信息进行加密后发送至蓝牙通信设备，并在连接信息发送完成后向蓝牙通信设备发送网络连接请求；
蓝牙通信设备接收移动终端的数据通过共享密钥进行解密；
当蓝牙通信设备接收到网络连接请求，则判定用于网络连接的信息传输完毕，启动与外接的无线网络连接；
蓝牙通信设备与外接的无线网络建立连接后，送无线网络连接状态信息至移动终端。
上述数据的加密方式采用对称加密方法生成。
上述蓝牙通信设备接收移动终端的数据后对报文进行完整性校验、安全签名校验和防重放攻击校验。
上述蓝牙通信设备协商生成共享密钥的信息由应用层处理；若应用层不处理，可使用蓝牙配网提供的DH加密算法来磋商密钥。
上述蓝牙通信设备连接外接的无线网络后，移动终端通过蓝牙通信设备对无线网络进行配置。
一种蓝牙网络，其特点是，该网络包含：
蓝牙通信设备，其连接外接的无线网络；
移动终端，其通过蓝牙通信连接蓝牙通信设备，通过蓝牙通信设备连接外接的无线网络；蓝牙通信设备与移动终端协商采用对称加密方法生成数据加密方式，以及采用非对称加密方法生成用于数据解密的共享密钥。
上述蓝牙通信设备设有WIFI和蓝牙的双模芯片。
本发明一种蓝牙网络及配网方法和现有技术相比，其优点在于，本发明蓝牙配网过程中采用对称加密方法对报文数据的加密方式，并采用非对称加密方法生成对应的共享密匙，保障蓝牙配网及网络通讯过程中的数据安全；
本发明中蓝牙通信设备接收移动终端的数据后，对报文进行完整性校验、安全签名校验和防重放攻击校验，保证数据安全、完整性、身份安全。
附图说明
图1为本发明一种蓝牙配网方法的方法流程图。
具体实施方式
以下结合附图，进一步说明本发明的具体实施例。
以下具体公开一种蓝牙配网方法的实施例，BLUFI配网包含了配置Softap和Station两部分。BLUFI配网中的station配置项目包含了广播、连接、服务发现、协商共享密钥、传输数据、回传连接状态等步骤。本实施例中以配置station为例说明配置步骤。
本实施例中GATT Client以最常用的手机为例展开阐述；BLUFI配网主要有两个功能：一是用于接收手机端的数据，二是用于发送数据给手机端。当然，BLUFI还包含了一些重要功能，如BLUFI层分片、BLUFI层数据加密和校验、BLUFI层数据确认等。基于本实施例用户可以实现BLUFI配网的过程中的对称加密、非对称加密以及校验算法；本实施例中默认使用DH算法协商密钥，128-AES加密数据，CRC16对数据进行校验。
如图1所示，为一种蓝牙配网方法实施例的具体流程，具体包含以下步骤：
S1、蓝牙通信设备开启通用属性协议服务(GATT Server)功能，发送带有特定预设广播数据(adv data)的广播。其中，此广播由用户自定义，不在BLUFI Profile内。
本实施例中，蓝牙通信设备采用设有ESP32芯片的设备，ESP32是一款WiFi+BT的双模芯片。
S2、移动终端(本实施例中为手机)上预装的APP搜索到蓝牙通信设备的广播，作为预设的通用属性协议客户端(GATT Client)与蓝牙通信设备建立连接。其中，手机APP可以由用户自定义。
S3、蓝牙通信设备与手机连接建立成功后，手机向蓝牙通信设备发送“协商过程”的数据包。
S4、蓝牙通信设备收到“协商过程”的数据包后，会按照用户自定义的“协商过程”来解析。
S5、手机与蓝牙通信设备进行协商，协商确定移动终端向蓝牙通信设备发送数据的加密方式，并且协商确定用于数据解密的共享密钥。
其中加密方式采用例如AES、或DES等的对称加密算法。
共享密钥采用DH、或RSA、或ECC等非对称加密算法协商生成。
具体的，对称加解密时，加解密前的数据长度和加解密后的数据长度必须一致，且支持原地加解密。
在ESP32端的代码中，密钥协商等安全处理的流程，由用户来决定和开发。手机APP向ESP32发送协商数据(Negotiate Data)，Negotiate Data类型的包将传送给应用层处理。如果应用层不愿意处理，可使用BLUFI提供的DH加密算法来磋商密钥。应用层需向BLUFI注册如下几个与安全相关的函数：
1)函数1：typedef void(*esp_blufi_negotiate_data_handler_t)(uint8_t*data，int len，uint8_t**output_data，int*output_len，bool*need_free)；
该函数1用来接收协商期间的normal data，处理完成后，需要将待发送的数据使用output_data和output_len传出。BLUFI会在调用完negotiate_data_handler后，发送negotiate_data_handler传出的output_data。这里是两个“*”，因为不知道最后需要发出去的长度，所以需要函数自己malloc或者指向全局变量，通过need_free通知是否需要free内存。
2)函数2：typedef int(*esp_blufi_encrypt_func_t)(uint8_t iv8，uint8_t*crypt_data，int cyprt_len)；
函数2表明加密和解密的数据长度必须一致。
3)函数3：typedef int(*esp_blufi_decrypt_func_t)(uint8_t iv8，uint8_t*crypt_data，int crypt_len)；
函数3表示加密和解密的数据长度必须一致。
4)函数4：typedef uint16_t(*esp_blufi_checksum_func_t)(uint8_t iv8，uint8_t*data，int len)；
该函数4用来计算checksum，返回值为checksum的值。BLUFI会使用该函数返回值与包末尾的checksum做比较。
S6、协商结束后，手机端向蓝牙通信设备发送“设置安全模式”的控制包。“设置安全模式”的控制包中包含蓝牙通信设备接收移动终端的数据后对报文进行的完整性校验方法、身份安全签名校验方法和防重放攻击校验方法。蓝牙通信设备收到“设置安全模式”的控制包，将使用协商出来的共享密钥以及配置的安全策略对通信数据进行加解密。
报文完整性校验方法采用例如SHA1、MD5、CRC等的校验算法。
身份安全签名校验方法采用例如RSA、或DH等算法进行签名校验。其中RSA算法可以保证身份安全；而DH算法本身不能保证身份安全，需要添加其他算法来签名。
防重放攻击校验方法采用：加入发包Sequence，并且Sequence参与数据校验。
进一步的，安全模式可以在配网过程中的任何时候进行设置，ESP32收到安全模式的配置后，就会根据安全模式指定的模式进行安全相关的操作。
S7、手机将用于WiFi连接的“BLUFI传输格式”定义的用户名、密码等必要的连接信息，通过对称加密算法进行加密后，发送至蓝牙通信设备。
S8、当手机将所有用于连接的必要的连接信息发送完成后，手机向蓝牙通信设备发送“WiFi连接请求”。
S9、蓝牙通信设备接收移动终端发出的包含连接信息和“WiFi连接请求”等数据，通过共享密钥进行解密，并进行完整性校验、身份安全签名校验和防重放攻击校验。
S10、当蓝牙通信设备确认接收到“WiFi连接请求”，则判定手机已经将用于WiFi连接的必要的连接信息传输完毕，启动连接WIFI网络。
S11、蓝牙通信设备连接WIFI后，将发送『WIFI连接状态报告』的控制包给手机，以报告连接状态。配网结束。
进一步的，手机可以通过蓝牙对WIFI网络实现配置。
本发明还公开了一种适用于上述蓝牙配网方法的蓝牙网络，该蓝牙通信网络包含：蓝牙通信设备和移动终端。
蓝牙通信设备采用设有例如ESP32芯片等WIFI和蓝牙的双模芯片的通信设备，用于通过蓝牙连接移动终端，并通过WIFI连接WIFI网络。
移动终端可以为手机、平板等，通过蓝牙通信连接蓝牙通信设备，通过蓝牙通信设备连接WIfi网络，对WIFI网络进行配置。
除上述所示用于配置WIFI STATION的优选实施例之外，本发明在配置WIFI模式上，还包括但不限于配置WIFI STATION、AP、Hotspot、Sniffer等；此发明在软硬件形态上，包括但不限于各种嵌入式软件，手机/平板APP，Web server等。
尽管本发明的内容已经通过上述优选实施例作了详细介绍，但应当认识 到上述的描述不应被认为是对本发明的限制。在本领域技术人员阅读了上述内容后，对于本发明的多种修改和替代都将是显而易见的。因此，本发明的保护范围应由所附的权利要求来限定。

Claims (10)

  1. 一种蓝牙配网方法，其特征在于，该方法包含：
    蓝牙通信设备与移动终端通过蓝牙建立连接；
    蓝牙通信设备与移动终端协商得出数据加密方式以及用于数据解密的共享密钥；
    蓝牙通信设备连接外接的无线网络。
  2. 如权利要求1所述的蓝牙配网方法，其特征在于，所述蓝牙通信设备与移动终端建立连接的方法包含：
    蓝牙通信设备开启通用属性协议服务功能，发送带有预设广播数据的广播；
    移动终端搜索到蓝牙通信设备的广播，作为预设的通用属性协议客户端与蓝牙通信设备建立连接。
  3. 如权利要求1所述的蓝牙配网方法，其特征在于，所述蓝牙通信设备与移动终端协商加解密的方法包含：
    移动终端向蓝牙通信设备发送“协商过程”的数据包；
    蓝牙通信设备收到“协商过程”的数据包后，按照预设的“协商过程”进行解析，得出移动终端向蓝牙通信设备发送数据的加密方式，并通过非对称加密方法生成对应的共享密钥。
  4. 如权利要求1所述的蓝牙配网方法，其特征在于，所述蓝牙通信设备与外接的无线网络建立网络连接包含：
    移动终端将用于与外接的无线网络连接的连接信息进行加密后发送至蓝牙通信设备，并在连接信息发送完成后向蓝牙通信设备发送网络连接请求；
    蓝牙通信设备接收移动终端的数据通过共享密钥进行解密；
    当蓝牙通信设备接收到网络连接请求，则判定用于网络连接的信息传输完毕，启动与外接的无线网络连接；
    蓝牙通信设备连接外接的无线网络后，发送无线网络的连接状态信息至移动终端。
  5. 如权利要求3所述的蓝牙配网方法，其特征在于，所述数据的加密方式采 用对称加密方法生成。
  6. 如权利要求3所述的蓝牙配网方法，其特征在于，所述蓝牙通信设备接收移动终端的数据后对报文进行完整性校验、安全签名校验和防重放攻击校验。
  7. 如权利要求3所述的蓝牙配网方法，其特征在于，所述蓝牙通信设备协商生成共享密钥的信息由应用层处理；若应用层不处理，可使用蓝牙配网提供的DH加密算法来磋商密钥。
  8. 如权利要求1所述的蓝牙配网方法，其特征在于，所述蓝牙通信设备连接外接的无线网络后，移动终端通过蓝牙通信设备对无线网络进行配置。
  9. 一种蓝牙网络，其特征在于，该网络包含：
    蓝牙通信设备，其连接外接的无线网络；
    移动终端，其通过蓝牙通信连接蓝牙通信设备，通过蓝牙通信设备连接外接的无线网络；蓝牙通信设备与移动终端协商采用对称加密方法生成数据加密方式，以及采用非对称加密方法生成用于数据解密的共享密钥。
  10. 如权利要求9所述的蓝牙配网网络，其特征在于，所述蓝牙通信设备设有WIFI和蓝牙的双模芯片。
PCT/CN2018/098921 2017-08-10 2018-08-06 一种蓝牙网络及配网方法 Ceased WO2019029471A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/462,361 US11290875B2 (en) 2017-08-10 2018-08-06 Bluetooth network and network configuration method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710681659.1 2017-08-10
CN201710681659.1A CN107231627B (zh) 2017-08-10 2017-08-10 一种蓝牙网络及配网方法

Publications (1)

Publication Number Publication Date
WO2019029471A1 true WO2019029471A1 (zh) 2019-02-14

Family

ID=59958011

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/098921 Ceased WO2019029471A1 (zh) 2017-08-10 2018-08-06 一种蓝牙网络及配网方法

Country Status (3)

Country Link
US (1) US11290875B2 (zh)
CN (1) CN107231627B (zh)
WO (1) WO2019029471A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113810887A (zh) * 2020-05-29 2021-12-17 Oppo广东移动通信有限公司 蓝牙协议连接方法、装置、存储介质及相关设备
CN114040366A (zh) * 2021-09-22 2022-02-11 惠州城市职业学院(惠州商贸旅游高级职业技术学校) 一种网络通信安全性高的蓝牙连接加密方法

Families Citing this family (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107231627B (zh) * 2017-08-10 2020-11-10 乐鑫信息科技（上海）股份有限公司 一种蓝牙网络及配网方法
CN108391238A (zh) * 2018-02-01 2018-08-10 乐鑫信息科技（上海）有限公司 无线mesh网络的配网方法
CN108366362B (zh) * 2018-02-01 2021-02-12 乐鑫信息科技（上海）股份有限公司 Mesh网络及其mesh设备安全配网方法
JP7129172B2 (ja) * 2018-02-08 2022-09-01 キヤノン株式会社 通信端末、その制御方法、およびプログラム
CN108540502A (zh) * 2018-07-18 2018-09-14 重庆信络威科技有限公司 一种基于蓝牙通信的组网协议
CN111510919B (zh) * 2019-01-31 2023-02-03 阿里巴巴集团控股有限公司 网络配置方法、装置、设备和系统
CN111246473A (zh) * 2019-08-01 2020-06-05 深圳市点嘀互联网络有限公司 通过蓝牙协议承载Carplay自动获取WIFI证书连接车机的方法
CN110958266A (zh) * 2019-12-16 2020-04-03 中国南方电网有限责任公司 数据处理方法、系统、计算机设备和存储介质
CN113411194A (zh) 2020-03-16 2021-09-17 瑞昱半导体股份有限公司 物联网网络系统及其组网方法
CN113497812B (zh) 2020-03-18 2024-08-09 瑞昱半导体股份有限公司 物联网网络组网认证系统及其方法
CN113453376A (zh) * 2020-03-24 2021-09-28 珠海格力电器股份有限公司 网络配置方法、相关装置、设备及存储介质
CN113452660B (zh) 2020-03-27 2023-07-25 瑞昱半导体股份有限公司 网状网络与云端服务器的通信方法、网状网络系统及其节点装置
CN113518405B (zh) 2020-04-09 2023-03-07 瑞昱半导体股份有限公司 网状网络系统
CN111556555A (zh) * 2020-04-29 2020-08-18 杭州涂鸦信息技术有限公司 一种网络摄像机与网关低功耗保活方法及其系统
CN111818492B (zh) * 2020-05-20 2024-05-24 上海橙群微电子有限公司 蓝牙信标及其数据的传输方法、可读存储介质
CN111866998A (zh) * 2020-07-24 2020-10-30 深圳创维数字技术有限公司 蓝牙配网方法、设备及存储介质
CN113038444B (zh) * 2021-03-25 2022-07-19 支付宝(杭州)信息技术有限公司 生成应用层密钥的方法和装置
CN114302383A (zh) * 2021-12-30 2022-04-08 上海富瀚微电子股份有限公司 一种网络摄像机蓝牙广播配网的方法及系统
CN114501460A (zh) * 2022-03-10 2022-05-13 深圳市天贝物联科技有限公司 基于蓝牙的nas设备配网方法、系统及设备
CN115988468A (zh) * 2022-12-20 2023-04-18 四川阵风科技有限公司 基于软件、终端设备、服务器联动的蓝牙传输方法及系统
US20250047413A1 (en) * 2023-08-04 2025-02-06 Nxp Usa, Inc. System and method for control frame protection
CN117676580B (zh) * 2023-12-14 2024-05-17 上海博汽智能科技有限公司 一种基于车载网关的安全认证方法
CN117858085B (zh) * 2023-12-19 2025-04-11 慧之安可(北京)科技有限公司 用于多设备场景的蓝牙配网对接方法和系统

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101707767A (zh) * 2009-10-26 2010-05-12 中兴通讯股份有限公司 一种数据传输方法及设备
CN105357666A (zh) * 2014-08-20 2016-02-24 中兴通讯股份有限公司 一种wifi密码共享方法和终端
CN105516896A (zh) * 2015-12-02 2016-04-20 惠州Tcl移动通信有限公司 一种可穿戴设备与移动终端的蓝牙互连方法及系统
CN105592409A (zh) * 2016-03-23 2016-05-18 北京清川科技有限公司 基于蓝牙的wi-fi连接通信方法及系统
US9516579B1 (en) * 2014-06-30 2016-12-06 Wildfire.Exchange, Inc. Social bandwidth and connectivity sharing
CN106961665A (zh) * 2017-05-19 2017-07-18 深圳市芯中芯科技有限公司 一种基于蓝牙通信的智能硬件配网方法
CN107231627A (zh) * 2017-08-10 2017-10-03 乐鑫信息科技（上海）有限公司 一种蓝牙网络及配网方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9155026B2 (en) * 2012-01-10 2015-10-06 Htc Corporation Systems for facilitating wireless communication and related methods
US20150318874A1 (en) * 2014-04-30 2015-11-05 Aliphcom Pairing devices using acoustic signals
US9736699B1 (en) * 2015-07-28 2017-08-15 Sanjay K. Rao Wireless Communication Streams for Devices, Vehicles and Drones
US10091242B2 (en) * 2015-12-14 2018-10-02 Afero, Inc. System and method for establishing a secondary communication channel to control an internet of things (IOT) device
WO2018120553A1 (zh) * 2016-12-30 2018-07-05 华为技术有限公司 一种网络共享方法及终端

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101707767A (zh) * 2009-10-26 2010-05-12 中兴通讯股份有限公司 一种数据传输方法及设备
US9516579B1 (en) * 2014-06-30 2016-12-06 Wildfire.Exchange, Inc. Social bandwidth and connectivity sharing
CN105357666A (zh) * 2014-08-20 2016-02-24 中兴通讯股份有限公司 一种wifi密码共享方法和终端
CN105516896A (zh) * 2015-12-02 2016-04-20 惠州Tcl移动通信有限公司 一种可穿戴设备与移动终端的蓝牙互连方法及系统
CN105592409A (zh) * 2016-03-23 2016-05-18 北京清川科技有限公司 基于蓝牙的wi-fi连接通信方法及系统
CN106961665A (zh) * 2017-05-19 2017-07-18 深圳市芯中芯科技有限公司 一种基于蓝牙通信的智能硬件配网方法
CN107231627A (zh) * 2017-08-10 2017-10-03 乐鑫信息科技（上海）有限公司 一种蓝牙网络及配网方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113810887A (zh) * 2020-05-29 2021-12-17 Oppo广东移动通信有限公司 蓝牙协议连接方法、装置、存储介质及相关设备
CN113810887B (zh) * 2020-05-29 2023-07-14 Oppo广东移动通信有限公司 蓝牙协议连接方法、装置、存储介质及相关设备
CN114040366A (zh) * 2021-09-22 2022-02-11 惠州城市职业学院(惠州商贸旅游高级职业技术学校) 一种网络通信安全性高的蓝牙连接加密方法
CN114040366B (zh) * 2021-09-22 2024-04-09 惠州城市职业学院(惠州商贸旅游高级职业技术学校) 一种网络通信安全性高的蓝牙连接加密方法

Also Published As

Publication number Publication date
US20210058770A1 (en) 2021-02-25
CN107231627A (zh) 2017-10-03
US11290875B2 (en) 2022-03-29
CN107231627B (zh) 2020-11-10

Similar Documents

Publication Publication Date Title
WO2019029471A1 (zh) 一种蓝牙网络及配网方法
US10979412B2 (en) Methods and apparatus for secure device authentication
CN107659406B (zh) 一种资源操作方法及装置
EP3051744B1 (en) Key configuration method and apparatus
US20190123909A1 (en) End-to-End Service Layer Authentication
US10250578B2 (en) Internet key exchange (IKE) for secure association between devices
CN113438071A (zh) 安全通信的方法及设备
CN105850168B (zh) 一种网络设备安全连接方法、相关装置及系统
CN110891269B (zh) 一种数据保护方法、设备及系统
EP3794852B1 (en) Secure methods and systems for identifying bluetooth connected devices with installed application
CN110601825B (zh) 密文的处理方法及装置、存储介质、电子装置
CN112449323B (zh) 一种通信方法、装置和系统
WO2015164999A1 (zh) 虚拟卡下载方法、终端及中间设备
WO2018120836A1 (zh) 一种终端配对方法、装置及系统、终端及计算机可读存储介质
WO2010023506A1 (en) Methods, apparatuses, computer program products, and systems for providing secure pairing and association for wireless devices
WO2018024048A1 (zh) 一种认证方法，服务器，终端以及网关
WO2017201753A1 (zh) 一种移动网络的认证方法和装置
WO2021212516A1 (zh) 应用于短距离通信系统的配对方法和无线设备
CN115037504B (zh) 通信方法及装置
WO2022188033A1 (zh) 数据上传方法、数据下载方法及相关设备
WO2021022406A1 (zh) 一种身份验证方法及装置
CN106341815B (zh) 一种无线连接方法、终端及ap
CN110495153A (zh) 在预关联的状态中加密数据
CN117279119B (zh) 用于设备间无线通信的方法和通信装置
CN109960935A (zh) 确定tpm可信状态的方法、装置及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18844186

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18844186

Country of ref document: EP

Kind code of ref document: A1