Device security connection method based on web Bluetooth API, security system and computer readable medium

Abstract

The invention discloses an equipment secure connection method based on a web Bluetooth API, a security system and a computer readable medium, and relates to the technical field of wireless communication, and the method comprises the steps: negotiating and selecting an elliptic curve parameter between user equipment and target equipment, generating a private key, calculating a public key, exchanging the public key, calculating a shared key, and establishing a secure session. A secure connection mechanism is established, so that the user equipment and the target equipment perform secure connection and secure communication through the first shared key and the second shared key respectively, and the connection, the connection keeping state or the communication process can only occur between the first shared key and the second shared key which are equal and authorized. Equipment without a shared key is prevented from acquiring user data or information, so that the security of connection and communication between the equipment is protected; the generated secret key can only be used by legal equipment, so that the security and integrity of subsequent data transmission are ensured, and the security of data interaction between the equipment is improved; communication interference of other devices can be avoided, a third party is prevented from acquiring or interfering data transmission, and the stability of connection between the user equipment and the target device and the data transmission rate are improved.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a device security connection method based on web Bluetooth API, a security system and a computer-readable medium. Background Art

[0002] With the rapid development of the Internet of Things and smart devices, Bluetooth technology has become an important means of achieving wireless communication between devices. Traditional Bluetooth communication usually needs to be operated through local applications, which increases the complexity of development and use. The emergence of Web Bluetooth API enables web applications to interact and communicate directly with Bluetooth devices, simplifying the development process.

[0003] The web Bluetooth API is a web API that allows web pages to communicate directly with Bluetooth devices on the user's device. It allows users to connect to Bluetooth devices in the browser without installing any plug-ins or extensions, thereby achieving a richer interactive experience, for example, implementing application scenarios such as controlling smart home devices and connecting to wearable devices from the web.

[0004] However, the security of the existing Web Bluetooth API can only be used in a secure context, and access rights are controlled by bluetooth instructions in the permission policy. After device pairing, unauthorized devices often connect to user devices, illegally obtain data and send connection communications, which on the one hand leads to insufficient security of the connection, and on the other hand interferes with the connection with the target device, resulting in low efficiency and instability in the connection between the user device and the target device. A more efficient and secure solution is urgently needed. Summary of the invention

[0005] The object of the present invention is to provide a device security connection method based on web Bluetooth API, a security system and a computer-readable medium, so as to solve the problem of insufficient security in web Bluetooth API connection and communication in the prior art.

[0006] The present invention solves the above problems through the following technical solutions:

[0007] A device secure connection method based on web Bluetooth API specifically includes the following steps:

[0008] Negotiate and select elliptic curve parameters: After the user device and at least one target device are successfully paired, the user device and the target device select at least one common elliptic curve parameter according to the Diffie-Hellman key exchange protocol; the elliptic curve parameter includes an equation, a base point, and an order of the elliptic curve;

[0009] Generate private key: the user device and the target device randomly generate a first private key and a second private key respectively; the first private key and the second private key are integer sets respectively;

[0010] Calculating a public key: the user device generates a first public key according to the first private key and the base point of the elliptic curve parameter; the target device generates a second public key according to the second private key and the base point of the elliptic curve parameter; the first public key is the first point on the elliptic curve, obtained by multiplying the first private key and the base point; the second public key is the second point on the elliptic curve, obtained by multiplying the second private key and the base point;

[0011] Exchange public keys: the user device sends the first public key to the target device; the target device sends the second public key to the user device; after the user device receives the second public key and the target device receives the first public key, both call the verifyPublicKey function for verification;

[0012] Calculating a shared key: According to the first private key and the second public key, the user device calls the deriveSharedSecret function to calculate a first shared key; the first shared key is the horizontal coordinate of the first point, which is obtained by multiplying the first private key and the second public key; according to the second private key and the first public key, the target device calls the deriveSharedSecret function to calculate a second shared key; the second shared key is the horizontal coordinate of the second point, which is obtained by multiplying the second private key and the first public key; the value of the first shared key is equal to the value of the second shared key;

[0013] Establishing a secure session: The user device and the target device respectively establish a secure connection and secure communication through the first shared key and the second shared key.

[0014] The device secure connection method based on web Bluetooth API of the present invention provides a common agreed basis for the subsequent generation of shared keys by negotiating and selecting common elliptic curve parameters, and then respectively generates a first private key and a second private key for a user device and a target device, and then calculates and obtains a public key, and finally generates a first shared key and a second shared key with equal values ​​by exchanging the public keys; because the first shared key and the second shared key are shared keys with the same value and negotiated by keys, connection or communication is performed through the first shared key and the second shared key, so that only two devices with equal first shared keys and second shared keys can establish a connection, maintain a connection state or realize communication transmission, avoiding other non-target devices The device is connected to the user device or participates in communication and transmission, thereby preventing devices without shared keys from obtaining user data or information, and protecting the security of the connection and communication between the user device and the target device; the scheme establishes a secure data transmission channel, and the generated key can only be used by legitimate devices, ensuring the security and integrity of subsequent data transmission, and improving the security of data interaction between devices; and, since the present invention avoids the connection of non-target devices, it can avoid communication interference from other devices, prevent a third party from obtaining or interfering with data transmission, and enable the user device and the target device to communicate or transmit data one-to-one under mutual authorization, thereby improving the stability of the connection between the user device and the target device and the data transmission rate.

[0015] A further improvement of the present invention is that the method for securely connecting devices based on the web Bluetooth API further includes the following steps: after establishing a secure session, the user device and the target device encrypt, transmit and decrypt data using a first shared key and a second shared key respectively; specifically including the following steps:

[0016] Encrypted data: the user device generates a first symmetric encryption key according to the first shared key, and the target device generates a second symmetric encryption key according to the second shared key; the user device or the target device encrypts the data to be transmitted using an AES encryption algorithm, wherein the AES encryption algorithm includes CTR or GCM; encryption parameters are set, an initialization vector is generated, and an encrypted data packet is generated; the encrypted data packet includes: encrypted data and the initialization vector;

[0017] Transmitting data packets: the user device and the target device send the encrypted data packets using the first shared key and the second shared key respectively;

[0018] Decrypting data: After receiving the encrypted data packet, the target device or user device imports the first symmetric encryption key or the second symmetric encryption key into the AES encryption algorithm to generate a first symmetric decryption key or a second decryption key; configure decryption parameters, use the AES mode, and use the first symmetric decryption key or the second decryption key to decrypt the encrypted data.

[0019] As a further improvement scheme of the device security connection method based on web Bluetooth API described in the present invention, a first symmetric encryption key and a second symmetric encryption key are generated respectively according to the first and second shared keys, and the generated first symmetric encryption key and the second symmetric encryption key are only used by the user device and the target device that allow each other, and then the data is encrypted in combination with the AES encryption algorithm, thereby ensuring that the encrypted data will not be obtained by other devices during the transmission process, thereby ensuring the security of data transmission; and the user device and the target device respectively send the encrypted data packet through the first shared key and the second shared key to realize the transmission and exchange of encrypted data between two devices with key connection, which can prevent man-in-the-middle attacks or data tampering to ensure the integrity and correctness of the data, and improve the performance of the device.

[0020] A further improvement of the present invention is that the method for securely connecting devices based on the web Bluetooth API performs integrity verification on the decrypted data through a data integrity verification mechanism after decrypting the data; specifically, the following steps are included:

[0021] Restore the original data and obtain the verification tag generated during the decryption process; the data integrity verification mechanism includes an HMAC authentication mechanism or a GCM authentication mechanism;

[0022] Determine whether the verification tag is consistent with or inconsistent with the expected tag of the data integrity verification mechanism; if the verification tag is inconsistent with the expected tag, determine that the data is tampered with or damaged, disconnect and notify the user device or the target device;

[0023] If the verification tag matches the expected tag, the data verification is determined to be successful and confirmed to be in a safe state; the connection is maintained or disconnected according to the needs of the user device or the target device.

[0024] As a further improvement scheme of the device security connection method based on web Bluetooth API described in the present invention, by configuring a security authentication mechanism and an optimized connection management technology, it is determined whether the verification tag in the data transmission and encryption process meets the expected tag of the data integrity verification mechanism, and then it can be determined whether the data has been tampered with or damaged. If the data has been tampered with or damaged, the connection can be disconnected and the device can be notified, thereby avoiding obtaining virus data or letting the user device know that the data security has been destroyed. This not only ensures the integrity of the data, but also improves the user's management of data security, and further improves the security of the connection between the user device and the target device and the integrity of data transmission.

[0025] A further improvement of the device secure connection method based on web Bluetooth API of the present invention further includes security authentication of the user device and / or the target device during the process of establishing a secure connection and secure communication between the user device and the target device, specifically including the following steps:

[0026] Both the user device and the target device are provided with a device certificate, which is issued by a certificate authority and includes: a public key, a device ID, a signature and a serial number;

[0027] The user device and the target device exchange their respective device certificates with each other; after receiving the other device certificate, the user device or the target device uses the trusted public key to verify the signature, device ID and device serial number of the other device certificate in turn;

[0028] If the device certificate verification fails, the communication between the user device and the target device is terminated.

[0029] As a further improvement scheme of the device secure connection method based on web Bluetooth API described in the present invention, on the premise of establishing a secure connection and communication with a shared key, the user device and the target device are again verified including information such as a public key, device ID, signature and serial number, and the secure connection and communication with the shared key are cooperated to further improve the security and stability of the device connection.

[0030] A further improvement of the device secure connection method based on web Bluetooth API of the present invention requires the user device or the target device to provide identity credentials during the device certificate verification process. The identity credentials include: a password, a PIN code or biometric information.

[0031] As a further improvement scheme of the device secure connection method based on web Bluetooth API described in the present invention, in the process of device certificate verification, in conjunction with the verification of the device certificate, and requiring the user device or the target device to provide identity proof, the connection and communication between the user device and the target device can be double-factor authenticated, and in conjunction with the secure connection of the shared key, the security and stability of the connection between the user device and the target device can be further improved.

[0032] A further improvement of the device secure connection method based on web Bluetooth API of the present invention, wherein the pairing of the user device and the target device through web Bluetooth API specifically comprises the following steps:

[0033] Enable the scanning function of the user device and set the filtering conditions; optimize the scanning range according to the filtering conditions and scan the target device; detect the broadcast signal of the target device, update the scanning results in real time, and add the discovered device to the list of the user device;

[0034] The user device records the target device selected by the user, sends a pairing request to the target device selected by the user, and stops scanning at the same time;

[0035] Call the connection method in the web Bluetooth API to establish a communication channel. After the target device confirms the pairing request, a two-way communication channel is established.

[0036] If the two-way communication channel is established, the pairing is determined to be successful, and a message indicating the pairing is successful is displayed;

[0037] If the two-way communication channel is not established, the pairing is determined to have failed; the error is handled, and the pairing request is re-initiated or the user is prompted to check the status of the device.

[0038] As a further improved solution of the present invention, on the basis of ensuring a secure connection between the user device and the target device, by optimizing the Bluetooth pairing process and method between the user device and the target device, the efficiency of device pairing and connection is further improved, the security is enhanced, the operation is simplified, and the user experience is enhanced.

[0039] A security system based on web Bluetooth API, comprising: at least one user device and at least one target device; the user device is provided with web Bluetooth API; the user device comprises: a communication module, a scanning module, a pairing module, a connection module, a first key management module, and an encryption transmission module; the target device comprises: a second key management module, an encryption module, a decryption module, and an authentication and authorization module;

[0040] The web Bluetooth API is used to perform Bluetooth communication operations between the user and the target device. The communication module is used to interact and communicate with the target device and the web server respectively. The scanning module is used to scan the information of the target device. The pairing module is used to pair the user device and the target device by Bluetooth. The connection module is used to establish a connection between the user device and the target device. The first key management module is used to generate and manage keys. The encrypted transmission module is used to encrypt and transmit data between the user device and the target device.

[0041] The second key management module is used to generate and manage keys; the encryption module is used to encrypt data; the decryption module is used to decrypt data; and the authentication and authorization module is used to authenticate and verify the connection and communication of the user equipment.

[0042] The web Bluetooth API-based security system of the present invention enables the connection, connection maintenance or communication process between at least one user device and at least one target device to be performed on the premise that a first shared key and a second shared key obtained by mutual negotiation and having equal values ​​are provided, thereby preventing devices without shared keys from obtaining user data or information, protecting the security of the connection and communication between the user device and the target device, and further establishing a secure data transmission channel. The generated key can only be used by legitimate devices, thereby ensuring the security and integrity of subsequent data transmission, and improving the security of data interaction between the user device and the target device. In addition, since the present invention avoids the connection of non-target devices, it can avoid communication interference of other devices, prevent a third party from obtaining or interfering with data transmission, and enable the user device and the target device to connect, communicate or transmit data one-to-one as much as possible, thereby improving the stability of the connection between the user device and the target device and the data transmission rate.

[0043] A non-transitory computer-readable medium containing computer-executable instructions, which, when executed by a processor of a computer, cause the computer to perform steps comprising:

[0044] Negotiate and select elliptic curve parameters: After the user device and at least one target device are successfully paired, the user device and the target device select at least one common elliptic curve parameter according to the Diffie-Hellman key exchange protocol; the elliptic curve parameter includes an equation, a base point, and an order of the elliptic curve;

[0045] Generate private key: the user device and the target device randomly generate a first private key and a second private key respectively; the first private key and the second private key are integer sets respectively;

[0046] Calculating a public key: the user device generates a first public key according to the first private key and the base point of the elliptic curve parameter; the target device generates a second public key according to the second private key and the base point of the elliptic curve parameter; the first public key is the first point on the elliptic curve, obtained by multiplying the first private key and the base point; the second public key is the second point on the elliptic curve, obtained by multiplying the second private key and the base point;

[0047] Exchanging public keys: the user device sends the first public key to the target device; the target device sends the second public key to the user device;

[0048] Calculating a shared key: Based on a first private key and a second public key, the user device calculates a first shared key; the first shared key is obtained by multiplying the first private key and the second public key; the first shared key is the horizontal coordinate of the first point; based on the second private key and the first public key, the target device calculates a second shared key; the second shared key is obtained by multiplying the second private key and the first public key; the second shared key is the horizontal coordinate of the second point; the value of the first shared key is equal to the value of the second shared key;

[0049] Establishing a secure session: The user device and the target device respectively establish a secure connection and secure communication through the first shared key and the second shared key.

[0050] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0051] (1) The present invention first negotiates and selects common elliptic curve parameters to provide a common agreed basis for the subsequent generation of a shared key, then generates a first private key and a second private key for the user device and the target device respectively, then calculates and obtains a public key, and finally generates a first shared key and a second shared key with equal values ​​by exchanging the public keys; so that establishing a connection, maintaining a connection state or a communication process can only be performed between two devices with equal first shared keys and second shared keys, avoiding other devices, such as paired but unconnected devices, from connecting to the user device or participating in communication at the same time, thereby preventing devices without shared keys from obtaining user data or information, thereby protecting the security of the connection and communication between the user device and the target device;

[0052] (2) The present invention can establish a secure data transmission channel by negotiating and generating a shared key between the user device and the target device. The generated key can only be used by legitimate devices, ensuring the security and integrity of subsequent data transmission and improving the security of data interaction between devices.

[0053] (3) The present invention can establish a secure data transmission channel by negotiating and generating a shared key between the user device and the target device. Since the connection of non-target devices is avoided, communication interference from other devices can be avoided, and third parties can be prevented from obtaining or interfering with data transmission. The user device and the target device can be connected to communicate or transmit data one-to-one as much as possible, thereby improving the stability of the connection between the user device and the target device and the data transmission rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flow chart of a method for securely connecting devices based on web Bluetooth API of the present invention;

[0055] Figure 2 A schematic diagram of the process of establishing a secure session in the device secure connection method of the present invention;

[0056] Figure 3 A schematic diagram of the data encryption transmission process of the device secure connection method of the present invention;

[0057] Figure 4 A schematic diagram of a pairing process between a user device and a target device according to the present invention;

[0058] Figure 5 This is a schematic diagram of the module structure of the security system based on web Bluetooth API of the present invention. DETAILED DESCRIPTION

[0059] The present invention is further described in detail below in conjunction with examples, but the embodiments of the present invention are not limited thereto.

[0060] Example 1

[0061] Combined with Figure 1 and Figure 2 As shown, a method for securely connecting devices based on web Bluetooth API specifically includes the following steps:

[0062] A device secure connection method based on web Bluetooth API specifically includes the following steps:

[0063] S1: Negotiate and select elliptic curve parameters: After the user device and at least one target device are successfully paired, the user device and the target device select at least one common elliptic curve parameter according to the Diffie-Hellman key exchange protocol; the elliptic curve parameter includes the equation, base point and order of the elliptic curve;

[0064] Generate private key: The user device and the target device randomly generate a first private key and a second private key respectively; the first private key and the second private key are integer sets respectively;

[0065] Calculate the public key: the user device generates the first public key according to the first private key and the base point of the elliptic curve parameter; the target device generates the second public key according to the second private key and the base point of the elliptic curve parameter; the first public key is the first point on the elliptic curve, which is obtained by multiplying the first private key and the base point; the second public key is the second point on the elliptic curve, which is obtained by multiplying the second private key and the base point;

[0066] S2: Exchange public keys: The user device sends the first public key to the target device; the target device sends the second public key to the user device; after the user device receives the second public key and the target device receives the first public key, both call the verifyPublicKey function for verification;

[0067] Calculate the shared key: According to the first private key and the second public key, the user device calls the deriveSharedSecret function to calculate the first shared key; the first shared key is obtained by multiplying the first private key and the second public key; the first shared key is the horizontal coordinate of the first point; according to the second private key and the first public key, the target device calls the deriveSharedSecret function to calculate the second shared key; the second shared key is obtained by multiplying the second private key and the first public key; the second shared key is the horizontal coordinate of the second point; the value of the first shared key is equal to the value of the second shared key;

[0068] S3: Establishing a secure session: The user device and the target device respectively establish a secure connection and secure communication through the first shared key and the second shared key.

[0069] Specifically, the shared key security connection mechanism in this embodiment is understood as follows: for example, the first private key generated by the user device is a, and the second private key generated by the target device is b. The first public key is calculated by using the first private key and the base point of the elliptic curve, so that the public key is the first point on the elliptic curve obtained by multiplying the first private key and the base point; the user device calculates its first public key A=a*G, where G is the base point of the elliptic curve; the target device calculates the second public key B=b*G;

[0070] Exchange public keys: The user device sends the first public key A to the target device; the target device sends the second public key B to the user device;

[0071] Calculate the shared key: The shared key is the horizontal coordinate of a point on the elliptic curve obtained by multiplying the first private key and the second public key; for example, the user device uses the first private key a and the second public key B of the target device to calculate, and obtains the first shared key S=B*a; the target device uses the second private key b and the first public key A of the user device to calculate, and obtains the second shared key S=A*b; according to the mathematical properties of the elliptic curve, the value of B*a is equal to the value of A*b, so the values ​​of the first shared key and the second shared key are equal, so the shared key S calculated by both parties is the same, that is, the user device and the target device can recognize each other during the connection and generate the shared key, and then in the connection process after the device is paired, the shared key is mutually recognized to ensure the secure connection and secure communication between the user device and the secure target device with the second shared key; wherein, the first private key, the second private key, the first public key, and the second public key are all understood as the keys in the method, and the first and second are only for the convenience of clear description without substantive explanation.

[0072] It should be noted that the secure connection is understood as a connection method based on the web Bluetooth API that includes the secure connection method of the present invention. After pairing, the application of the user device calls the relevant API method to initialize the secure connection configured by the device secure connection method of the present invention, ensuring that only authorized devices can establish a secure session, that is, the user device and the target device can establish a secure connection and secure communication.

[0073] It should be noted that the process of exchanging public keys, calculating shared keys, and sending shared keys is understood as key negotiation. Specifically, in this embodiment, the specific implementation of ECDH key exchange using JavaScript's Web Crypto API is as follows:

[0074] ```javascriptasync function generateKeyPair(){

[0075] / / Generate a key pair

[0076] const keyPair=await crypto.subtle.generateKey({

[0077] name:"ECDH",

[0078] namedCurve: "P-256"

[0079] },true,["deriveKey","deriveBits"]);

[0080] return keyPair;

[0081] }

[0082] async function deriveSharedSecret(privateKey,publicKey){

[0083] / / Calculate the shared key

[0084] const sharedSecret=await crypto.subtle.deriveBits({

[0085] name:"ECDH",

[0086] public:publicKey

[0087] },privateKey,256);

[0088] return sharedSecret;

[0089] }

[0090] async function main(){

[0091] / / Generate a key pair on the user device

[0092] const userKeyPair=await generateKeyPair();

[0093] const userPublicKey=userKeyPair.publicKey;

[0094] const userPrivateKey=userKeyPair.privateKey;

[0095] / / Generate a key pair on the target device

[0096] const targetKeyPair=await generateKeyPair();

[0097] const targetPublicKey=targetKeyPair.publicKey;

[0098] const targetPrivateKey=targetKeyPair.privateKey;

[0099] / / The user device calculates the shared key

[0100] const userSharedSecret=await deriveSharedSecret(userPrivateKey,targetPublicKey);

[0101] / / The target device calculates the shared key

[0102] const targetSharedSecret=await deriveSharedSecret(targetPrivateKey,userPublicKey);

[0103] / / Output the shared key

[0104] console.log(new Uint8Array(userSharedSecret));

[0105] console.log(new Uint8Array(targetSharedSecret));

[0106] }

[0107] main().

[0108] In the above logic program: the generateKeyPair function generates an ECDH key pair, which includes a public key and a private key; the deriveSharedSecret function uses the private key and the other party's public key to calculate the shared key; the main function simulates the key pair generation and shared key calculation process of the user device and the target device.

[0109] Specifically, in this embodiment, reference Figure 1 As shown, in the process of establishing a secure connection and secure communication between the user device and the target device, it also includes S11: security authentication of the user device and / or the target device, which specifically includes the following steps:

[0110] Both the user device and the target device have device certificates, which are issued by a certificate authority and include: public key, device ID, signature, and serial number;

[0111] The user device and the target device exchange their respective device certificates with each other; after receiving the other device certificate, the user device or the target device uses the trusted public key to verify the signature, device ID and device serial number of the other device certificate in turn;

[0112] If the device certificate verification fails, the communication between the user device and the target device is terminated.

[0113] Specifically, in this embodiment, Figure 1 As shown, the pairing request and the connection establishment process of the user device and the target device cooperate to achieve the establishment of a secure connection and secure communication between the user device and the target device; it should be noted that in the process of establishing a secure connection and secure communication between the user device and the target device, the security authentication of the user device and / or the target device is understood to be any step before the user device and the target device complete the secure connection and secure communication. In this embodiment, for the convenience of representation, Figure 1 The device security authentication configuration performs security authentication after the shared key is generated, but is not limited to after the shared key is generated.

[0114] Specifically, in this embodiment, during the device certificate verification process, the user device or the target device may be required to provide identity credentials, and the identity credentials include: a password, a PIN code, or biometric information.

[0115] On the basis of realizing secure connection and secure communication between user equipment and target equipment, reference Figure 3 As shown, in this embodiment, after establishing a secure session, the user device and the target device encrypt, transmit and decrypt data using the first shared key and the second shared key respectively; specifically, the following steps are included:

[0116] Encrypted data: The user device generates a first symmetric encryption key according to the first shared key, and the target device generates a second symmetric encryption key according to the second shared key; the user device or the target device encrypts the data to be transmitted using the AES encryption algorithm, and the AES encryption algorithm includes CTR or GCM; encryption parameters are set, an initialization vector is generated, and an encrypted data packet is generated; the encrypted data packet includes: encrypted data and an initialization vector;

[0117] Transmitting data packets: the user device and the target device send encrypted data packets using the first shared key and the second shared key respectively;

[0118] Decrypting data: After receiving the encrypted data packet, the target device or user device imports the first symmetric encryption key or the second symmetric encryption key into the AES encryption algorithm to generate the first symmetric decryption key or the second decryption key; configure the decryption parameters, use the AES mode, and use the first symmetric decryption key or the second decryption key to decrypt the encrypted data.

[0119] It should be noted that if Figure 3 The two devices shown specifically refer to the user device and the target device; more specifically, the following logic is used to encrypt, transmit and decrypt data:

[0120] Select the encryption mode:

[0121]

[0122] Sending encrypted data:

[0123]

[0124] Receive and decrypt data:

[0125]

[0126] In this embodiment, more specifically, the logic of decrypting data is as follows: receiving encrypted data:

[0127]

[0128]

[0129] Import the shared secret:

[0130]

[0131] Set decryption parameters:

[0132]

[0133] Decrypted data:

[0134]

[0135]

[0136] In this embodiment, specifically, Figure 3 As shown, after decrypting the data, the integrity of the decrypted data is verified through a data integrity verification mechanism; specifically, the following steps are included:

[0137] Restore the original data and obtain the verification tag generated during the decryption process; the data integrity verification mechanism includes the HMAC authentication mechanism or the GCM authentication mechanism;

[0138] Determine whether the verification tag is consistent with or inconsistent with the expected tag of the data integrity verification mechanism; if the verification tag is inconsistent with the expected tag, determine that the data is tampered with or damaged, disconnect and notify the user device or the target device;

[0139] If the verification tag matches the expected tag, the data verification is determined to be successful and confirmed to be in a safe state; the connection is maintained or disconnected according to the needs of the user device or the target device.

[0140] It should be noted that maintaining connection or disconnecting is understood as completing the transmission of encrypted data. The connection can be maintained or disconnected according to the actual needs of the user device or the target device, excluding disconnections caused by unstable connection or data transmission errors or security risks.

[0141] The present invention can realize the pairing of the user device and the target device by using the conventional Bluetooth pairing method based on the device connection method of the web Bluetooth API. In this embodiment, specifically, Figure 2 and Figure 4 As shown, the user device and the target device are paired through the web Bluetooth API, which includes the following steps:

[0142] Enable the scanning function of the user device and set the filtering conditions; optimize the scanning range according to the filtering conditions and scan the target device; detect the broadcast signal of the target device, update the scanning results in real time, and add the discovered device to the list of the user device;

[0143] The user device records the target device selected by the user, sends a pairing request to the target device selected by the user, and stops scanning at the same time;

[0144] Call the connection method in the web Bluetooth API to establish a communication channel. After the target device confirms the pairing request, a two-way communication channel is established.

[0145] If the two-way communication channel is established, the pairing is determined to be successful, and a message indicating the pairing is successful is displayed;

[0146] If the two-way communication channel is not established, the pairing is determined to have failed; the error is handled, and the pairing request is re-initiated or the user is prompted to check the status of the device.

[0147] Specifically, refer to Figure 4 As shown, before starting the Bluetooth scanning function, the user device supports Bluetooth connection. If not, the pairing is terminated; if supported, the Bluetooth scanning function is started again to search for devices.

[0148] Specifically, a pairing request is initiated by the user device, so that the application of the user device calls the device.gatt.connect() method of the selected device to initiate a pairing request to the target device. This method is implemented through the Web Bluetooth API interface to ensure the reliability and timeliness of the request. When initiating a pairing request, the application can set relevant parameters, such as device name, service UUID, etc., in order to connect to the target device more accurately. In order to improve the success rate of the request, preprocessing can be performed before the request is initiated, such as checking the device status, signal strength, etc., to ensure that the device is in a state where it can maintain connection.

[0149] The target device then responds. After receiving the pairing request, the target device confirms the request and sends a response signal to the initiating device. The response signal contains the device's confirmation information and pairing parameters. After receiving the response signal, the application parses and verifies the signal to ensure the validity and authenticity of the response. To prevent man-in-the-middle attacks and other security threats, the application can perform security checks when parsing the response signal, such as verifying the device identity and detecting abnormal signals.

[0150] Specifically, the user device and the target device are paired successfully. When the two devices successfully establish a pairing connection, the system will display a pairing success message to inform the user that the pairing is complete. After the pairing is successful, the devices can establish a subsequent secure connection and transmit data. The application can call relevant API methods to initialize the secure connection to ensure the security and stability of data transmission. After the pairing is successful, the application can also perform some subsequent processing, such as recording pairing information, updating device status, and starting secure data transmission.

[0151] In this embodiment, the pairing failure processing mechanism is as follows: if the pairing request is not responded to or fails, the application will take corresponding error handling measures according to the specific situation, including re-initiating the pairing request, prompting the user to check the device status, recording the reason for the failure, etc.; specifically, the application of the user device can set a retry mechanism to attempt pairing multiple times within a certain period of time to increase the probability of success; at the same time, user-friendly error prompts can be provided to help users troubleshoot problems; to improve system stability, the application can also perform operations such as resource release and status recovery when the processing fails to ensure the normal operation of the system; the present invention adopts an optimized device scanning strategy and an intelligent error handling mechanism to reduce the waiting time during the pairing process, ensure the security and stability of the connection, and provide real-time monitoring and adaptive optimization strategies to ensure that the device pairing process is always kept in the best state.

[0152] Example 2

[0153] Combination Figure 5 As shown, this embodiment discloses a security system based on web Bluetooth API according to the present invention, comprising: at least one user device and at least one target device; the user device is provided with web Bluetooth API; the user device comprises: a communication module, a scanning module, a pairing module, a connection module, a first key management module, and an encryption transmission module; the target device comprises: a second key management module, an encryption module, a decryption module, and an authentication and authorization module;

[0154] The web Bluetooth API is used to perform Bluetooth communication operations between the user and the target device. The communication module is used to interact and communicate with the target device and the web server respectively; the scanning module is used to scan the information of the target device; the pairing module is used to pair the user device and the target device by Bluetooth; the connection module is used to establish a connection between the user device and the target device; the first key management module is used to generate and manage keys; the encrypted transmission module is used to encrypt and transmit data between the user device and the target device;

[0155] The second key management module is used to generate and manage keys; the encryption module is used to encrypt data; the decryption module is used to decrypt data; and the authentication and authorization module is used to authenticate and verify the connection and communication of the user equipment.

[0156] It should be noted that the web Bluetooth API-based security system of the present invention can be configured in the user device and the target device through a computer application program, thereby implementing the steps described in Embodiment 1 of the present invention, that is, realizing the functions of the system of the present invention.

[0157] Specific references Figure 5 As shown, the user device of the present invention is understood as, for example, a client, which can access a web application through a browser, start Bluetooth scanning, select a target device, perform device pairing, establish a secure connection, and perform data encryption transmission. The communication module is responsible for device scanning and discovery, device pairing and connection, and data transmission and reception. It should be noted that the user device can process the calculation, storage, and data transmission functions of the present invention by conventionally using a computer processor, so that it can call related functions and calculate public keys, private keys, and shared keys, and can achieve interactive authentication with Bluetooth devices. Figure 5 Including the modules shown, but not limited to this list, and also including various common modules that can be implemented; the Web server can provide web page applications, process user requests, and provide API interfaces.

[0158] Specifically, the target device can be a Bluetooth device, which can respond to pairing requests, perform key exchange, establish a secure connection, receive and decrypt data, and send encrypted data. Among them, a security module is configured to generate and manage keys, encrypt and decrypt algorithms, and process authentication and authorization mechanisms. It should be noted that pairing connection and communication are basic functions that can be realized by the general module. The present invention includes Figure 5 The specific modules shown are but not limited to the modules shown.

[0159] Example 3

[0160] Based on Embodiment 1, this embodiment discloses a non-transitory computer-readable medium containing computer-executable instructions. When executed by a processor of a computer, the computer-executable instructions cause the computer to perform steps, the steps comprising:

[0161] Negotiate and select elliptic curve parameters: After the user device and at least one target device are successfully paired, the user device and the target device select at least one common elliptic curve parameter according to the Diffie-Hellman key exchange protocol; the elliptic curve parameter includes the equation, base point and order of the elliptic curve;

[0162] Generate private key: The user device and the target device randomly generate a first private key and a second private key respectively; the first private key and the second private key are integer sets respectively;

[0163] Calculate the public key: the user device generates the first public key according to the first private key and the base point of the elliptic curve parameter; the target device generates the second public key according to the second private key and the base point of the elliptic curve parameter; the first public key is the first point on the elliptic curve, which is obtained by multiplying the first private key and the base point; the second public key is the second point on the elliptic curve, which is obtained by multiplying the second private key and the base point;

[0164] Exchange public keys: The user device sends the first public key to the target device; the target device sends the second public key to the user device; after the user device receives the second public key and the target device receives the first public key, both call the verifyPublicKey function for verification;

[0165] Calculate the shared key: According to the first private key and the second public key, the user device calls the deriveSharedSecret function to calculate the first shared key; the first shared key is obtained by multiplying the first private key and the second public key; the first shared key is the horizontal coordinate of the first point; according to the second private key and the first public key, the target device calls the deriveSharedSecret function to calculate the second shared key; the second shared key is obtained by multiplying the second private key and the first public key; the second shared key is the horizontal coordinate of the second point; the value of the first shared key is equal to the value of the second shared key;

[0166] Establishing a secure session: The user device and the target device respectively establish a secure connection and secure communication through the first shared key and the second shared key.

[0167] Specifically, in this embodiment, after being able to perform the above specific steps, the non-transitory computer-readable medium containing computer-executable instructions in this embodiment can also perform the following steps:

[0168] After the secure session is established, the user device and the target device encrypt, transmit and decrypt data using the first shared key and the second shared key respectively; specifically, the following steps are included:

[0169] Encrypted data: The user device generates a first symmetric encryption key according to the first shared key, and the target device generates a second symmetric encryption key according to the second shared key; the user device or the target device encrypts the data to be transmitted using the AES encryption algorithm, and the AES encryption algorithm includes CTR or GCM; encryption parameters are set, an initialization vector is generated, and an encrypted data packet is generated; the encrypted data packet includes: encrypted data and an initialization vector;

[0170] Transmitting data packets: the user device and the target device send encrypted data packets using the first shared key and the second shared key respectively;

[0171] Decrypting data: After receiving the encrypted data packet, the target device or user device imports the first symmetric encryption key or the second symmetric encryption key into the AES encryption algorithm to generate the first symmetric decryption key or the second decryption key; configure the decryption parameters, use the AES mode, and use the first symmetric decryption key or the second decryption key to decrypt the encrypted data.

[0172] Although the present invention is described herein with reference to the illustrative embodiments of the present invention, the above embodiments are only preferred embodiments of the present invention, and the embodiments of the present invention are not limited to the above embodiments. It should be understood that those skilled in the art can design many other modifications and embodiments, which will fall within the scope and spirit of the principles disclosed in this application.

Claims

1. A device secure connection method based on web Bluetooth API, characterized in that: The following steps are involved: Negotiate and select elliptic curve parameters: After the user device and at least one target device are successfully paired, the user device and the target device select at least one common elliptic curve parameter according to the Diffie-Hellman key exchange protocol; the elliptic curve parameter includes an equation, a base point, and an order of the elliptic curve; Generate private key: the user device and the target device randomly generate a first private key and a second private key respectively; the first private key and the second private key are integer sets respectively; Calculating a public key: The user device generates a first public key according to the first private key and a base point of the elliptic curve parameter; The target device generates a second public key according to the second private key and the base point of the elliptic curve parameter; The first public key is a first point on the elliptic curve, obtained by multiplying the first private key and the base point; the second public key is a second point on the elliptic curve, obtained by multiplying the second private key and the base point; Exchanging public keys: the user device sends the first public key to the target device; the target device sends the second public key to the user device; After the user device receives the second public key and the target device receives the first public key, both call the verifyPublicKey function for verification; Calculating a shared key: According to the first private key and the second public key, the user device calls the deriveSharedSecret function to calculate a first shared key; the first shared key is the horizontal coordinate of the first point, which is obtained by multiplying the first private key and the second public key; according to the second private key and the first public key, the target device calls the deriveSharedSecret function to calculate a second shared key; the second shared key is the horizontal coordinate of the second point, which is obtained by multiplying the second private key and the first public key; the value of the first shared key is equal to the value of the second shared key; Establishing a secure session: The user device and the target device respectively establish a secure connection and secure communication through the first shared key and the second shared key.

2. The device secure connection method based on web Bluetooth API according to claim 1, characterized in that: After the secure session is established, the user device and the target device encrypt, transmit and decrypt data using the first shared key and the second shared key respectively; specifically, the following steps are included: Encrypted data: the user device generates a first symmetric encryption key according to the first shared key, and the target device generates a second symmetric encryption key according to the second shared key; the user device or the target device encrypts the data to be transmitted using an AES encryption algorithm, wherein the AES encryption algorithm includes CTR or GCM; encryption parameters are set, an initialization vector is generated, and an encrypted data packet is generated; the encrypted data packet includes: encrypted data and the initialization vector; Transmitting data packets: the user device and the target device send the encrypted data packets using the first shared key and the second shared key respectively; Decrypting data: After receiving the encrypted data packet, the target device or user device imports the first symmetric encryption key or the second symmetric encryption key into the AES encryption algorithm to generate a first symmetric decryption key or a second decryption key; configure decryption parameters, use the AES mode, and use the first symmetric decryption key or the second decryption key to decrypt the encrypted data.

3. The device secure connection method based on web Bluetooth API according to claim 2, characterized in that: After decrypting the data, the integrity of the decrypted data is verified through the data integrity verification mechanism; specifically, the following steps are included: Restore the original data and obtain the verification tag generated during the decryption process; the data integrity verification mechanism includes an HMAC authentication mechanism or a GCM authentication mechanism; Determine whether the verification tag is consistent with or inconsistent with the expected tag of the data integrity verification mechanism; if the verification tag is inconsistent with the expected tag, determine that the data is tampered with or damaged, disconnect and notify the user device or the target device; If the verification tag matches the expected tag, the data verification is determined to be successful and confirmed to be in a safe state; the connection is maintained or disconnected according to the needs of the user device or the target device.

4. The device secure connection method based on web Bluetooth API according to claim 1, characterized in that: In the process of establishing a secure connection and secure communication between the user device and the target device, the security authentication of the user device and / or the target device specifically includes the following steps: Both the user device and the target device are provided with a device certificate, which is issued by a certificate authority and includes: a public key, a device ID, a signature and a serial number; The user device and the target device exchange their respective device certificates with each other; after receiving the other device certificate, the user device or the target device uses the trusted public key to verify the signature, device ID and device serial number of the other device certificate in turn; If the device certificate verification fails, the communication between the user device and the target device is terminated.

5. The device secure connection method based on web Bluetooth API according to claim 4, characterized in that: During the device certificate verification process, the user device or the target device is required to provide identity credentials, and the identity credentials include: a password, a PIN code or biometric information.

6. The device secure connection method based on web Bluetooth API according to claim 1, characterized in that: The user device and the target device are paired via a web Bluetooth API, specifically including the following steps: Enable the scanning function of the user device and set the filtering conditions; optimize the scanning range according to the filtering conditions and scan the target device; detect the broadcast signal of the target device, update the scanning results in real time, and add the discovered device to the list of the user device; The user device records the target device selected by the user, sends a pairing request to the target device selected by the user, and stops scanning at the same time; Call the connection method in the web Bluetooth API to establish a communication channel. After the target device confirms the pairing request, a two-way communication channel is established. If the two-way communication channel is established, the pairing is determined to be successful, and a message indicating the pairing is successful is displayed; If the two-way communication channel is not established, the pairing is determined to have failed; the error is handled, and the pairing request is re-initiated or the user is prompted to check the status of the device.

7. A security system based on web Bluetooth API, characterized in that: include: at least one user device and at least one target device; The user equipment is provided with a web Bluetooth API; The user device includes: a communication module, a scanning module, a pairing module, a connection module, a first key management module, and an encryption transmission module; the target device includes: a second key management module, an encryption module, a decryption module, and an authentication and authorization module; The web Bluetooth API is used to perform Bluetooth communication operations between the user and the target device. The communication module is used to interact and communicate with the target device and the web server respectively. The scanning module is used to scan the information of the target device. The pairing module is used to pair the user device and the target device by Bluetooth. The connection module is used to establish a connection between the user device and the target device. The first key management module is used to generate and manage keys. The encrypted transmission module is used to encrypt and transmit data between the user device and the target device. The second key management module is used to generate and manage keys; the encryption module is used to encrypt data; the decryption module is used to decrypt data; and the authentication and authorization module is used to authenticate and verify the connection and communication of the user equipment.

8. A non-transitory computer-readable medium containing computer-executable instructions, characterized in that: When executed by a processor of a computer, the computer executable instructions cause the computer to perform the steps of claim 1 or 2.

Images