Method for remotely controlling Android device through MQTT message based on multi-factor identity verification

Abstract

The invention discloses a method for remotely controlling Android equipment through MQTT messages based on multi-factor identity verification. The method comprises the steps that S1, a two-way multi-factor identity verification system is configured in a remote control server; s2, a client application program supporting an MQTT protocol is deployed on the Android device; s3, issuing a starting or closing instruction of the application program and a modification instruction set by the system through an MQTT protocol; s4, the remote control server starts a multi-factor identity verification system to verify the identity of the user; s5, verifying the identity of the remote control server through a multi-factor verification system; s6, preventing unauthorized access and tampering; s7, the control instruction is decrypted through the MQTT client application program; s8, feeding back an operation result to the remote control server in a message form through an MQTT protocol; and S9, recording the feedback operation result in a server log. According to the invention, by introducing multi-factor identity verification and an MQTT protocol, safe and efficient remote control of the Android device is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of MQTT, and in particular to a method for remotely controlling an Android device through an MQTT message based on multi-factor identity authentication. Background Art

[0002] In the prior art, remote control of Android devices mainly relies on the common HTTP and HTTPS communication protocols. Although HTTP and HTTPS communication protocols can provide stable communication in an environment with good network connection, the performance of remote control is often unsatisfactory in an environment with limited bandwidth and high latency. In addition, existing remote control methods usually only rely on a single authentication method to protect system security, which is vulnerable to targeted cracking by attackers. Especially in the field of Internet of Things, many Android devices are deployed in areas with unstable network conditions, such as remote areas or restricted network environments. Traditional remote control solutions face obvious limitations in these scenarios.

[0003] Specifically, traditional remote control methods have the following shortcomings: First, most of the existing technologies use relatively complex communication protocols with low transmission efficiency and cannot adapt well to restricted network environments. Although HTTP and HTTPS protocols have strong versatility and security, the efficiency and reliability of message transmission are poor in low-bandwidth and high-latency networks, resulting in remote control instructions being unable to be transmitted to Android devices in a timely or accurate manner. Second, existing security mechanisms usually use single-factor authentication (static password or device certificate). Although security has been improved to a certain extent, with the diversification of security threats, a single verification method is vulnerable to multiple attack methods such as man-in-the-middle attacks and password brute force cracking, and it is difficult to fully protect devices from unauthorized access. Third, in terms of security verification on the device side, existing technologies mostly rely only on simple certificate verification or IP address filtering. Although these verification methods can prevent some illegal access, there is still a risk of being bypassed by attackers. In a complex network environment, the server's identity authentication methods need to be strengthened. Summary of the invention

[0004] An object of the present invention is to propose a method for remotely controlling an Android device through MQTT messages based on multi-factor identity authentication. The present invention achieves safe and efficient remote control of an Android device by introducing multi-factor identity authentication and the MQTT protocol.

[0005] According to an embodiment of the present invention, a method for remotely controlling an Android device through an MQTT message based on multi-factor identity authentication includes the following steps:

[0006] S1. Configure a two-way multi-factor authentication system in the remote control server, including user multi-factor authentication and Android device multi-factor authentication. User multi-factor authentication includes password authentication, biometric authentication, and dynamic verification code authentication. Android device multi-factor authentication includes server certificate authentication and server IP whitelist authentication.

[0007] S2. Deploy a client application supporting the MQTT protocol on the Android device, where the client application is used to receive and process control instructions sent from the remote control server and perform corresponding operations through the operating system interface of the Android device;

[0008] S3, the remote control server publishes application startup or shutdown instructions, system setting modification instructions, and specific task execution instructions to the target Android device through the MQTT protocol;

[0009] S4. Before the remote control server issues a control instruction, the remote control server starts a multi-factor authentication system to verify the user's identity, and performs authentication operations of each authentication method in turn. Only when all authentication methods are passed, the remote control server allows the control instruction to be issued;

[0010] S5. After the Android device receives the control command, it verifies the identity of the remote control server through a multi-factor authentication system, and checks whether the server's digital certificate and the IP address of the authentication server are in a preset whitelist. Only when all verifications are passed, the Android device will receive and execute the control command;

[0011] S6. When the remote control server issues the control instruction, the control instruction is encrypted by an encryption algorithm to prevent unauthorized access and tampering;

[0012] S7, after the Android device passes the server identity authentication and receives the control instruction, it decrypts the control instruction through the MQTT client application, and calls the interface of the Android operating system to perform corresponding operations according to the content of the control instruction;

[0013] S8. After executing the control command, the Android device feeds back the operation result to the remote control server in the form of a message through the MQTT protocol. The feedback information includes the operation execution status, the current status information of the device, and possible error information;

[0014] S9. After receiving the operation result fed back by the Android device, the remote control server records the fed back operation result in the server log.

[0015] Optionally, S1 includes the following sub-steps:

[0016] S11. Configure the user multi-factor authentication system. The user multi-factor authentication system includes the following three authentication methods:

[0017] Password verification: identity authentication is performed through the static password set by the user. The static password is encrypted and stored in the remote control server;

[0018] Biometric verification, which uses the biometric sensor in the user's device to obtain fingerprints and facial features and generate corresponding biometric data for identity confirmation;

[0019] Dynamic verification code verification generates and sends a time- or event-based dynamic verification code through a remote control server. The user completes the verification by entering the dynamic verification code, which is valid within a specified time.

[0020] S12. Configure a multi-factor authentication system for Android devices, which includes the following two authentication methods:

[0021] Verify server certificate: The Android device confirms the legitimacy of the remote control server by verifying the digital certificate sent by the server, including checking whether the server certificate is valid and verifying whether the server certificate signature is correct;

[0022] Check the server IP whitelist verification. When the Android device receives a control instruction from the remote control server, it checks whether the server's IP address exists in the preset IP whitelist. Only when the server IP address is in the whitelist, the Android device is allowed to execute the control instruction.

[0023] Optionally, S2 includes the following sub-steps:

[0024] S21, installing and running a client application supporting the MQTT protocol on the Android device, wherein the client application receives control instructions issued by the remote control server through the MQTT protocol;

[0025] S22, the client application receives control messages from the remote control server by subscribing to the MQTT topic, including instructions for starting or shutting down the application, modifying system settings, and executing specific tasks;

[0026] S23, the client application parses the received control instruction, and calls the relevant interface provided by the Android operating system according to the type of the control instruction to execute the startup application, adjust the system configuration and access the device resources;

[0027] S24, the client application records the execution result of the control operation through a local log, and monitors the battery status, network connection status and currently running applications through the operating system interface of the Android device;

[0028] S25. The client application feeds back the execution result and device status to the remote control server in the form of a message through the MQTT protocol.

[0029] Optionally, the S3 step includes the following sub-steps:

[0030] S31. The remote control server publishes application startup instructions, shutdown instructions, system setting modification instructions, and specific task execution instructions to the target Android device through the MQTT protocol:

[0031]

[0032] Among them, C cmd is the control instruction issued, α i and β i Represents the weight coefficients of different modules in the instruction, depending on the task priority, f(T i ,A i ) indicates the start or close operation of the application in the target device. i is the task type, A i is the application state, g(U i ,S i ) indicates the modification operation of system settings or the execution instruction of specific tasks. i For user input, S i Provide feedback on device status;

[0033] S32. The remote control server publishes the control instruction in the form of a message to the MQTT topic subscribed by the Android device through the publishing mechanism in the MQTT protocol. The MQTT topic is configured according to the unique identifier of the Android device:

[0034]

[0035] Among them, M pub For messages published to an MQTT topic, T ttl Indicates the survival time of the message, C cmd (t) is the control instruction issued at time t, λ is the message delivery attenuation coefficient, indicating that the effective transmission range of the message is related to time, and t0 is the initial time when the message is generated;

[0036] S33. The remote control server generates a unique message identifier for each control instruction. The message identifier is sent together with the control instruction to avoid repeated execution or instruction loss:

[0037]

[0038] Among them, M id is the message identifier, H(C cmd ) is the control instruction Ccmd The hash value of dev (i) is the unique identifier of device i, γ i is the device priority weight coefficient, mod2 64 Ensure that the identifier is unique within the 64-bit length;

[0039] S34. The remote control server selects a QoS level for the message according to the current network status of the device. The QoS level includes:

[0040] QoS 0: Messages are transmitted at most once, and arrival is not guaranteed;

[0041] QoS1: The message is transmitted at least once, ensuring that it arrives but may be repeated;

[0042] QoS2: The message is transmitted only once, ensuring that it arrives and is not repeated;

[0043] S35. The remote control server encrypts the control message by using an encryption algorithm when sending the control command. The remote control server confirms the command execution status according to the feedback information of the Android device and records the execution result of the command.

[0044] Optionally, the S4 step includes the following sub-steps:

[0045] S41. Before issuing a control instruction, the remote control server starts a multi-factor authentication system to verify the identity of the user. The authentication system includes password authentication, biometric authentication, and dynamic verification code authentication. The control instruction can only be issued if all authentication methods are passed.

[0046] S42, password verification step: by verifying the static password P entered by the user user Perform hash processing to generate a hash value H(P user ), and compares it with the reference hash value H stored in the remote control server ref (P user ) is matched, only when H(P user )=H ref (P user ), the password verification is successful;

[0047] S43, biometric verification step: obtaining the user's biometric information feature B through the biometric sensor in the device user and compared with the reference biometric B stored in the server ref (user) to match, if B user =B ref (user), the biometric verification is successful;

[0048] S44, dynamic verification code verification step: the remote control server generates a time-based dynamic verification code TOTP(t), where t is the current timestamp, and the user needs to enter the corresponding dynamic verification code TOTP user (t), if TOTP user (t) = TOTP server (t), the dynamic verification code verification is successful;

[0049] S45. After all verification methods are passed, the remote control server generates a verification pass flag V pass , if V pass =1, then the control command is allowed to be issued. If any verification method fails, V pass =0, control instructions will not be issued;

[0050] S46. The remote control server records the verification result in a log, including the timestamp T of the user's identity verification. log and the execution status of each verification step.

[0051] Optionally, the step S5 includes the following sub-steps:

[0052] S51. After the Android device receives the control instruction issued by the remote control server, the identity of the server is verified through a multi-factor verification system, where the verification system includes a digital certificate verification of the server and an IP address whitelist verification;

[0053] S52, digital certificate verification step: The Android device extracts the server's digital certificate Cert from the received control message srv , through the preset root certificate authority public key K CA Verify the certificate. If the verification passes, it means that the server identity is legal. The verification condition is V cert (Cert srv ,K CA )=1, otherwise the control instruction is refused to be executed;

[0054] S53, IP address whitelist verification step: The Android device obtains the server's IP address from the received control message srv and compare it with the preset IP whitelist W in the Android device IP Compare, when IP srv ∈W IP If the verification is successful, the control instruction will be rejected; otherwise,

[0055] S54, if both the digital certificate verification and the IP address whitelist verification are passed, the Android device generates a verification pass flag V pass_srv =1, and continue to execute the control instruction, otherwise the verification failure flag V is generated pass_srv=0, and interrupt the execution of the control instruction;

[0056] S55. After the verification is passed, the Android device records the timestamp T of the verification process. cert and IP address matching status IP match ,The Android device executes the corresponding control instructions according to the ,verified status, and feeds back the execution results to the remote ,control server through the MQTT protocol.

[0057] Optionally, the step S7 includes the following sub-steps:

[0058] S71. After the Android device passes the server identity authentication and receives the encrypted control instruction, the Android device decrypts the control instruction using a symmetric key encryption algorithm through the MQTT client application:

[0059] D cmd =Dec key (C enc );

[0060] Among them, D cmd For the decrypted control instructions, Dec key is the decryption function, C enc is the received encryption control instruction, key is the pre-shared symmetric key;

[0061] S72. After decryption is completed, the Android device parses the content of the control instruction through the MQTT client to identify the operation instruction for starting or shutting down an application, modifying system settings, or executing a specific task;

[0062] S73, calling the API interface of the Android operating system to perform corresponding operations according to the parsed control instruction:

[0063] If the instruction involves starting or shutting down an application, the application management interface of the Android operating system is called;

[0064] If the instruction involves modifying system settings, the settings management interface of the Android system is called;

[0065] If the instruction involves the execution of a specific task, the corresponding task management interface is called to enable the task to be correctly executed on the Android device;

[0066] S74, the Android device monitors the execution status in real time during the execution of the control instruction, and sends feedback information of the execution process back to the remote control server through the MQTT protocol, the feedback information including the execution result, the device status during the execution and any error information;

[0067] S75. After the control instruction is executed, the Android device records all operation logs in a local log file and updates the current status of the device.

[0068] The beneficial effects of the present invention are:

[0069] (1) The present invention improves the communication efficiency in a network environment with limited bandwidth and high latency by adopting the lightweight MQTT protocol for message transmission. Compared with the traditional HTTP and HTTPS protocols, the MQTT protocol can achieve stable message transmission with minimal network resources and lower bandwidth requirements. In the message interaction between the client application and the server, a strategy based on message service quality control is used to ensure the reliability of instruction transmission under different network conditions. By setting an appropriate QoS level, message loss or repeated execution can be effectively avoided even when the network condition is poor, thereby improving the stability and efficiency of remote control.

[0070] (2) The present invention introduces a two-way multi-factor identity authentication mechanism before and after the remote control operation. Multiple authentications are required between the server and the client to ensure the legitimacy of the remote control operation. The user multi-factor authentication and the two-way authentication mechanism on the device side further improve the security of the system before and after each control instruction is transmitted. Compared with the traditional single identity authentication method, the present invention effectively prevents multiple security threats such as man-in-the-middle attacks, replay attacks and malicious tampering, so that the system can operate safely in a complex network environment.

[0071] (3) The control instruction generation and execution process of the present invention uses the MQTT protocol in combination with a multi-level verification mechanism, which can accurately parse and execute control instructions on the Android device side. By introducing the design of symmetric key encryption and unique message identifiers, each instruction is strictly encrypted and authenticated. At the same time, after executing the instruction, the Android device feeds back the execution result and device status to the remote control server in real time, and transmits the execution log information back through the MQTT protocol, further ensuring the reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0073] Figure 1 The present invention provides a flowchart of a method for remotely controlling an Android device through MQTT messages based on multi-factor identity authentication. DETAILED DESCRIPTION

[0074] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0075] refer to Figure 1 , a method for remotely controlling an Android device through MQTT messages based on multi-factor authentication, comprising the following steps:

[0076] S1. Configure a two-way multi-factor authentication system in the remote control server, including user multi-factor authentication and Android device multi-factor authentication. User multi-factor authentication includes password authentication, biometric authentication, and dynamic verification code authentication. Android device multi-factor authentication includes server certificate authentication and server IP whitelist authentication.

[0077] S2. Deploy a client application supporting the MQTT protocol on the Android device, where the client application is used to receive and process control instructions sent from the remote control server and perform corresponding operations through the operating system interface of the Android device;

[0078] S3, the remote control server publishes application startup or shutdown instructions, system setting modification instructions, and specific task execution instructions to the target Android device through the MQTT protocol;

[0079] S4. Before the remote control server issues a control instruction, the remote control server starts a multi-factor authentication system to verify the user's identity, and performs authentication operations of each authentication method in turn. Only when all authentication methods are passed, the remote control server allows the control instruction to be issued;

[0080] S5. After the Android device receives the control command, it verifies the identity of the remote control server through a multi-factor authentication system, and checks whether the server's digital certificate and the IP address of the authentication server are in a preset whitelist. Only when all verifications are passed, the Android device will receive and execute the control command;

[0081] S6. When the remote control server issues the control instruction, the control instruction is encrypted by an encryption algorithm to prevent unauthorized access and tampering;

[0082] S7, after the Android device passes the server identity authentication and receives the control instruction, it decrypts the control instruction through the MQTT client application, and calls the interface of the Android operating system to perform corresponding operations according to the content of the control instruction;

[0083] S8. After executing the control command, the Android device feeds back the operation result to the remote control server in the form of a message through the MQTT protocol. The feedback information includes the operation execution status, the current status information of the device, and possible error information;

[0084] S9. After receiving the operation result fed back by the Android device, the remote control server records the fed back operation result in the server log.

[0085] In this implementation, S1 includes the following sub-steps:

[0086] S11. Configure the user multi-factor authentication system. The user multi-factor authentication system includes the following three authentication methods:

[0087] Password verification: identity authentication is performed through the static password set by the user. The static password is encrypted and stored in the remote control server;

[0088] Biometric verification, which uses the biometric sensor in the user's device to obtain fingerprints and facial features and generate corresponding biometric data for identity confirmation;

[0089] Dynamic verification code verification generates and sends a time- or event-based dynamic verification code through a remote control server. The user completes the verification by entering the dynamic verification code, which is valid within a specified time.

[0090] S12. Configure the multi-factor authentication system of the Android device. The system includes the following two authentication methods:

[0091] Verify server certificate: The Android device confirms the legitimacy of the remote control server by verifying the digital certificate sent by the server, including checking whether the server certificate is valid and verifying whether the server certificate signature is correct;

[0092] Check the server IP whitelist verification. When the Android device receives a control instruction from the remote control server, it checks whether the server's IP address exists in the preset IP whitelist. Only when the server IP address is in the whitelist, the Android device is allowed to execute the control instruction.

[0093] In this implementation, S2 includes the following sub-steps:

[0094] S21. Install and run a client application supporting the MQTT protocol on the Android device, where the client application receives control instructions issued by the remote control server through the MQTT protocol;

[0095] S22, the client application receives control messages from the remote control server by subscribing to the MQTT topic, including instructions for starting or shutting down the application, modifying system settings, and executing specific tasks;

[0096] S23, the client application parses the received control instruction, and calls the relevant interface provided by the Android operating system according to the type of the control instruction to execute the startup application, adjust the system configuration and access the device resources;

[0097] S24, the client application records the execution result of the control operation through a local log, and monitors the battery status, network connection status and currently running applications through the operating system interface of the Android device;

[0098] S25. The client application feeds back the execution result and device status to the remote control server in the form of a message through the MQTT protocol.

[0099] In this implementation, step S3 includes the following sub-steps:

[0100] S31. The remote control server publishes application startup instructions, shutdown instructions, system setting modification instructions, and specific task execution instructions to the target Android device through the MQTT protocol:

[0101]

[0102] Among them, C cmd is the control instruction issued, α i and β i Represents the weight coefficients of different modules in the instruction, depending on the task priority, f(T i ,A i ) indicates the start or close operation of the application in the target device. i is the task type, A i is the application state, g(U i ,S i ) indicates the modification operation of system settings or the execution instruction of specific tasks. i For user input, S i Provide feedback on device status;

[0103] S32. The remote control server publishes the control instruction in the form of a message to the MQTT topic subscribed by the Android device through the publishing mechanism in the MQTT protocol. The MQTT topic is configured according to the unique identifier of the Android device:

[0104]

[0105] Among them, M pub For messages published to an MQTT topic, T ttl Indicates the survival time of the message, C cmd (t) is the control instruction issued at time t, λ is the message delivery attenuation coefficient, indicating that the effective transmission range of the message is related to time, and t0 is the initial time when the message is generated;

[0106] S33. The remote control server generates a unique message identifier for each control instruction. The message identifier is sent together with the control instruction to avoid repeated execution or instruction loss:

[0107]

[0108] Among them, M id is the message identifier, H(C cmd ) is the control instruction C cmd The hash value of dev (i) is the unique identifier of device i, γ i is the device priority weight coefficient, mod2 64 Ensure that the identifier is unique within the 64-bit length;

[0109] S34. The remote control server selects a QoS level for the message according to the current network status of the device. The QoS level includes:

[0110] QoS 0: Messages are transmitted at most once, and arrival is not guaranteed;

[0111] QoS1: The message is transmitted at least once, ensuring that it arrives but may be repeated;

[0112] QoS2: The message is transmitted only once, ensuring that it arrives and is not repeated;

[0113] S35. The remote control server encrypts the control message by using an encryption algorithm when sending the control command. The remote control server confirms the command execution status according to the feedback information of the Android device and records the execution result of the command.

[0114] In this implementation, step S4 includes the following sub-steps:

[0115] S41. Before issuing a control instruction, the remote control server starts a multi-factor authentication system to verify the identity of the user. The authentication system includes password authentication, biometric authentication, and dynamic verification code authentication. The control instruction can only be issued if all authentication methods are passed.

[0116] S42, password verification step: by verifying the static password P entered by the user user Perform hash processing to generate a hash value H(P user ), and compares it with the reference hash value H stored in the remote control server ref (P user ) is matched, only when H(P user )=H ref (P user ), the password verification is successful;

[0117] S43, biometric verification step: obtaining the user's biometric information feature B through the biometric sensor in the device user and compared with the reference biometric B stored in the server ref(user) to match, if B user =B ref (user), the biometric verification is successful;

[0118] S44, dynamic verification code verification step: the remote control server generates a time-based dynamic verification code TOTP(t), where t is the current timestamp, and the user needs to enter the corresponding dynamic verification code TOTP user (t), if TOTP user (t) = TOTP server (t), the dynamic verification code verification is successful;

[0119] S45. After all verification methods are passed, the remote control server generates a verification pass flag V pass , if V pass =1, then the control command is allowed to be issued. If any verification method fails, V pass =0, control instructions will not be issued;

[0120] S46. The remote control server records the verification result in a log, including the timestamp T of the user's identity verification. log and the execution status of each verification step.

[0121] In this implementation, step S5 includes the following sub-steps:

[0122] S51. After the Android device receives the control instruction issued by the remote control server, the identity of the server is verified through a multi-factor verification system, where the verification system includes a digital certificate verification of the server and an IP address whitelist verification;

[0123] S52, digital certificate verification step: The Android device extracts the server's digital certificate Cert from the received control message srv , through the preset root certificate authority public key K CA Verify the certificate. If the verification passes, it means that the server identity is legal. The verification condition is V cert (Cert srv ,K CA )=1, otherwise the control instruction is refused to be executed;

[0124] S53, IP address whitelist verification step: The Android device obtains the server's IP address from the received control message srv and compare it with the preset IP whitelist W in the Android device IP Compare, when IP srv ∈W IP If the verification is successful, the control instruction will be rejected; otherwise,

[0125] S54, if both the digital certificate verification and the IP address whitelist verification are passed, the Android device generates a verification pass flag V pass_srv =1, and continue to execute the control instruction, otherwise the verification failure flag V is generated pass_srv =0, and interrupt the execution of the control instruction;

[0126] S55. After the verification is passed, the Android device records the timestamp T of the verification process. cert and IP address matching status IP match ,The Android device executes the corresponding control instructions according to the ,verified status, and feeds back the execution results to the remote ,control server through the MQTT protocol.

[0127] In this implementation, step S7 includes the following sub-steps:

[0128] S71. After the Android device passes the server identity authentication and receives the encrypted control instruction, the Android device decrypts the control instruction using a symmetric key encryption algorithm through the MQTT client application:

[0129] D cmd =Dec key (C enc );

[0130] Among them, D cmd For the decrypted control instructions, Dec key is the decryption function, C enc is the received encryption control instruction, key is the pre-shared symmetric key;

[0131] S72. After decryption is completed, the Android device parses the content of the control instruction through the MQTT client to identify the operation instruction for starting or shutting down an application, modifying system settings, or executing a specific task;

[0132] S73, calling the API interface of the Android operating system to perform corresponding operations according to the parsed control instruction:

[0133] If the instruction involves starting or shutting down an application, the application management interface of the Android operating system is called;

[0134] If the instruction involves modifying system settings, the settings management interface of the Android system is called;

[0135] If the instruction involves the execution of a specific task, the corresponding task management interface is called to enable the task to be correctly executed on the Android device;

[0136] S74, the Android device monitors the execution status in real time during the execution of the control instruction, and sends feedback information of the execution process back to the remote control server through the MQTT protocol, the feedback information including the execution result, the device status during the execution and any error information;

[0137] S75. After the control instruction is executed, the Android device records all operation logs in a local log file and updates the current status of the device.

[0138] Embodiment 1:

[0139] A shopping mall in a certain city has set up multiple electronic advertising machines for playing advertisements and promotional videos. At the same time, users have also installed electronic photo album devices in their homes to display family photos and videos. Users hope to remotely select and push photos to these devices through mobile phone APP to achieve automatic playback and carousel of photos. At the same time, users also hope to control the playback order, pause, delete or withdraw the pushed photos after pushing. In this context, the method based on multi-factor identity authentication and MQTT message control of the present invention is used to remotely manage and operate these devices to ensure security and efficiency.

[0140] In Example 1, the advertising machine and the electronic photo album device are operated by the Android system. The client application allows the user to select photos and push them to the device via the MQTT protocol. After receiving the instructions, the device stores, plays and controls the photos. The whole process includes the following main steps:

[0141] Photo selection and push: Users select local photos through the mobile phone APP and push the photos and their metadata to the designated electronic photo album or advertising machine device through the MQTT protocol.

[0142] Command control: Users can send play, pause, switch, and withdraw control commands in the APP to remotely manage the photo display on the device.

[0143] Multi-factor authentication: To ensure the security of the control process, users need to pass multi-factor authentication before operation, including passwords, biometrics and dynamic verification codes, to ensure that only authorized users can perform operations.

[0144] Device-side operation: After receiving the control command, the electronic photo album or advertising machine device obtains Android system permissions to manage photos, including storage, playback and deletion operations.

[0145] Photo push scenarios:

[0146] On a weekend in July 2024, a user pushed several family photos to the electronic photo album device at home (device ID: Frame_001) via a mobile phone APP, requesting that the photos be played automatically in sequence. The APP client first requires the user to perform multi-factor authentication. The user entered the password, scanned the fingerprint, and completed the dynamic verification code verification. After the verification was passed, the APP generated a push instruction containing the photo file, playback order, and display duration metadata.

[0147] The remote control server sends this command to the electronic photo album device through the MQTT protocol. After the device receives the push command through the MQTT client, it first verifies the identity of the server to ensure that the command comes from the authorized control end. The verification includes checking whether the server's IP is in the whitelist and whether the certificate is valid. The following is the data record of the push operation process:

[0148] Table 1: Photo push operation record

[0149]

[0150] After the photo is successfully pushed, the user wants to adjust the order of the photos and pause a specific photo. On the APP client, the user sends the control instructions of "pause" and "adjust order". The remote server publishes these instructions to the album device through the MQTT protocol. After receiving the instructions, the device immediately decrypts and authenticates them to ensure the legitimacy of the instructions. The following is the data record of the control operation:

[0151] Table 2: Photo control command operation record

[0152]

[0153] After a period of time, the user finds that a photo that does not need to be displayed has been pushed and decides to withdraw it. The user selects the withdraw function in the APP. The system requires the user to re-authenticate to ensure the security of the operation. After completing the verification, the APP client generates a withdrawal instruction and sends the withdrawal instruction to the electronic photo album device through the MQTT protocol. After receiving the withdrawal instruction, the device successfully withdraws the specified photo after verification and decryption, and returns the feedback information to the server and user.

[0154] In this case, multi-factor authentication and MQTT protocol were used for remote control of the device and photo push. This method has higher security and efficiency than traditional HTTP or HTTPS methods, especially in environments with limited network or high latency. The lightweight characteristics of the MQTT protocol ensure the efficient transmission of instructions. In addition, the multi-factor authentication system ensures the legitimacy of each operation step and prevents unauthorized users from performing operations. Through IP whitelist and digital certificate verification, the device can effectively identify the legitimacy of the control server and prevent the execution of malicious instructions.

[0155] Through the implementation method of the present invention, electronic photo albums or advertising machine devices can safely and stably receive photo push and control instructions from remote users. Users can conveniently manage these devices through mobile phone APP and ensure the safety and timeliness of all operations. This system is not only suitable for family electronic photo albums, but also widely applicable to scenarios where outdoor advertising machines require remote control and security management.

[0156] The present invention improves the communication efficiency in a network environment with limited bandwidth and high latency by adopting the lightweight MQTT protocol for message transmission. Compared with traditional HTTP and HTTPS protocols, the MQTT protocol can achieve stable message transmission with minimal network resources and lower bandwidth requirements. In the message interaction between client applications and servers, a strategy based on message service quality control is used to ensure the reliability of instruction transmission under different network conditions. By setting an appropriate QoS level, message loss or repeated execution can be effectively avoided even when the network conditions are poor, thereby improving the stability and efficiency of remote control.

[0157] The present invention introduces a two-way multi-factor identity authentication mechanism before and after the remote control operation, and requires multiple authentications between the server and the client to ensure the legitimacy of the remote control operation. The user multi-factor authentication (password, biometrics, dynamic verification code) and the two-way authentication mechanism on the device side (digital certificate and IP whitelist authentication) further improve the security of the system before and after each control instruction is transmitted. Compared with the traditional single identity authentication method, the present invention effectively prevents multiple security threats such as man-in-the-middle attacks, replay attacks and malicious tampering, so that the system can operate safely in a complex network environment.

[0158] The control instruction generation and execution process of the present invention uses the MQTT protocol in combination with a multi-level verification mechanism, and can accurately parse and execute control instructions on the Android device side. By introducing the design of symmetric key encryption and unique message identifiers, each instruction is strictly encrypted and authenticated. At the same time, after executing the instruction, the Android device feeds back the execution result and device status to the remote control server in real time, and transmits the execution log information back through the MQTT protocol, further ensuring the reliability of the system.

[0159] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for remotely controlling an Android device using MQTT messages based on multi-factor authentication, characterized in that: The steps include: S1. Configure a two-way multi-factor authentication system in the remote control server, including user multi-factor authentication and Android device multi-factor authentication. User multi-factor authentication includes password authentication, biometric authentication, and dynamic verification code authentication. Android device multi-factor authentication includes server certificate authentication and server IP whitelist authentication. S2. Deploy a client application supporting the MQTT protocol on the Android device, where the client application is used to receive and process control instructions sent from the remote control server and perform corresponding operations through the operating system interface of the Android device; S3, the remote control server publishes application startup or shutdown instructions, system setting modification instructions, and specific task execution instructions to the target Android device through the MQTT protocol; S4. Before the remote control server issues a control instruction, the remote control server starts a multi-factor authentication system to verify the user's identity, and performs authentication operations of each authentication method in turn. Only when all authentication methods are passed, the remote control server allows the control instruction to be issued; S5. After the Android device receives the control command, it verifies the identity of the remote control server through a multi-factor authentication system, and checks whether the server's digital certificate and the IP address of the authentication server are in a preset whitelist. Only when all verifications are passed, the Android device will receive and execute the control command; S6. When the remote control server issues the control instruction, the control instruction is encrypted by an encryption algorithm to prevent unauthorized access and tampering; S7, after the Android device passes the server identity authentication and receives the control instruction, it decrypts the control instruction through the MQTT client application, and calls the interface of the Android operating system to perform corresponding operations according to the content of the control instruction; S8. After executing the control command, the Android device feeds back the operation result to the remote control server in the form of a message through the MQTT protocol. The feedback information includes the operation execution status, the current status information of the device, and possible error information; S9. After receiving the operation result fed back by the Android device, the remote control server records the fed back operation result in the server log.

2. According to claim 1, a method for remotely controlling an Android device using MQTT messages based on multi-factor identity authentication, characterized in that: The S1 comprises the following sub-steps: S11. Configure the user multi-factor authentication system. The user multi-factor authentication system includes the following three authentication methods: Password verification: identity authentication is performed through the static password set by the user. The static password is encrypted and stored in the remote control server; Biometric verification, which uses the biometric sensor in the user's device to obtain fingerprints and facial features and generate corresponding biometric data for identity confirmation; Dynamic verification code verification generates and sends a time- or event-based dynamic verification code through a remote control server. The user completes the verification by entering the dynamic verification code, which is valid within a specified time. S12. Configure a multi-factor authentication system for Android devices, which includes the following two authentication methods: Verify server certificate: The Android device confirms the legitimacy of the remote control server by verifying the digital certificate sent by the server, including checking whether the server certificate is valid and verifying whether the server certificate signature is correct; Check the server IP whitelist verification. When the Android device receives a control instruction from the remote control server, it checks whether the server's IP address exists in the preset IP whitelist. Only when the server IP address is in the whitelist, the Android device is allowed to execute the control instruction.

3. According to claim 1, a method for remotely controlling an Android device using MQTT messages based on multi-factor identity authentication, characterized in that: The S2 comprises the following sub-steps: S21, installing and running a client application supporting the MQTT protocol on the Android device, wherein the client application receives control instructions issued by the remote control server through the MQTT protocol; S22, the client application receives control messages from the remote control server by subscribing to the MQTT topic, including instructions for starting or shutting down the application, modifying system settings, and executing specific tasks; S23, the client application parses the received control instruction, and calls the relevant interface provided by the Android operating system according to the type of the control instruction to execute the startup application, adjust the system configuration and access the device resources; S24, the client application records the execution result of the control operation through a local log, and monitors the battery status, network connection status and currently running applications through the operating system interface of the Android device; S25. The client application feeds back the execution result and device status to the remote control server in the form of a message through the MQTT protocol.

4. The method of remotely controlling an Android device via MQTT messages based on multi-factor identity authentication according to claim 1, characterized in that: The S3 step includes the following sub-steps: S31. The remote control server publishes application startup instructions, shutdown instructions, system setting modification instructions, and specific task execution instructions to the target Android device through the MQTT protocol: Among them, C cmd is the control instruction issued, α i and β i Represents the weight coefficients of different modules in the instruction, depending on the task priority, f(T i ,A i ) indicates the start or close operation of the application in the target device. i is the task type, A i is the application state, g(U i ,S i ) indicates the modification operation of system settings or the execution instruction of specific tasks. i For user input, S i Provide feedback on device status; S32. The remote control server publishes the control instruction in the form of a message to the MQTT topic subscribed by the Android device through the publishing mechanism in the MQTT protocol. The MQTT topic is configured according to the unique identifier of the Android device: Among them, M pub For messages published to an MQTT topic, T ttl Indicates the survival time of the message, C cmd (t) is the control instruction issued at time t, λ is the message delivery attenuation coefficient, indicating that the effective transmission range of the message is related to time, and t0 is the initial time when the message is generated; S33. The remote control server generates a unique message identifier for each control instruction. The message identifier is sent together with the control instruction to avoid repeated execution or instruction loss: Among them, M id is the message identifier, H(C cmd ) is the control instruction C cmd The hash value of dev (i) is the unique identifier of device i, γ i is the device priority weight coefficient, mod2 64 Ensure that the identifier is unique within the 64-bit length; S34. The remote control server selects a QoS level for the message according to the current network status of the device. The QoS level includes: QoS 0: Messages are transmitted at most once, and arrival is not guaranteed; QoS1: The message is transmitted at least once, ensuring that it arrives but may be repeated; QoS2: The message is transmitted only once, ensuring that it arrives and is not repeated; S35. The remote control server encrypts the control message by using an encryption algorithm when sending the control command. The remote control server confirms the command execution status according to the feedback information of the Android device and records the execution result of the command.

5. The method of remotely controlling an Android device via MQTT messages based on multi-factor identity authentication according to claim 1, characterized in that: The S4 step includes the following sub-steps: S41. Before issuing a control instruction, the remote control server starts a multi-factor authentication system to verify the identity of the user. The authentication system includes password authentication, biometric authentication, and dynamic verification code authentication. The control instruction can only be issued if all authentication methods are passed. S42, password verification step: by verifying the static password P entered by the user user Perform hash processing to generate a hash value H(P user ), and compares it with the reference hash value H stored in the remote control server ref (P user ) is matched, only when H(P user )=H ref (P user ), the password verification is successful; S43, biometric verification step: obtaining the user's biometric information feature B through the biometric sensor in the device user and compared with the reference biometric B stored in the server ref (user) to match, if B user =B ref (user), the biometric verification is successful; S44, dynamic verification code verification step: the remote control server generates a time-based dynamic verification code TOTP(t), where t is the current timestamp, and the user needs to enter the corresponding dynamic verification code TOTP user (t), if TOTP user (t) = TOTP server (t), the dynamic verification code verification is successful; S45. After all verification methods are passed, the remote control server generates a verification pass flag V pass , if V pass =1, then the control command is allowed to be issued. If any verification method fails, V pass =0, control instructions will not be issued; S46. The remote control server records the verification result in a log, including the timestamp T of the user's identity verification. log and the execution status of each verification step.

6. The method of remotely controlling an Android device via MQTT messages based on multi-factor identity authentication according to claim 1, characterized in that: The S5 step includes the following sub-steps: S51. After the Android device receives the control instruction issued by the remote control server, the identity of the server is verified through a multi-factor verification system, where the verification system includes a digital certificate verification of the server and an IP address whitelist verification; S52, digital certificate verification step: The Android device extracts the server's digital certificate Cert from the received control message srv , through the preset root certificate authority public key K CA Verify the certificate. If the verification passes, it means that the server identity is legal. The verification condition is V cert (Cert srv ,K CA )=1, otherwise the control instruction is refused to be executed; S53, IP address whitelist verification step: The Android device obtains the server's IP address from the received control message srv and compare it with the preset IP whitelist W in the Android device IP Compare, when IP srv ∈W IP If the verification is successful, the control instruction will be rejected; otherwise, S54, if both the digital certificate verification and the IP address whitelist verification are passed, the Android device generates a verification pass flag V pass_srv =1, and continue to execute the control instruction, otherwise the verification failure flag V is generated pass_srv =0, and interrupt the execution of the control instruction; S55. After the verification is passed, the Android device records the timestamp T of the verification process. cert and IP address matching status IP match ,The Android device executes the corresponding control instructions according to the ,verified status, and feeds back the execution results to the remote ,control server through the MQTT protocol.

7. The method for remotely controlling an Android device via MQTT messages based on multi-factor identity authentication according to claim 1, characterized in that: The S7 step includes the following sub-steps: S71. After the Android device passes the server identity authentication and receives the encrypted control instruction, the Android device decrypts the control instruction using a symmetric key encryption algorithm through the MQTT client application: D cmd =Dec key (C enc ); Among them, D cmd For the decrypted control instructions, Dec key is the decryption function, C enc is the received encryption control instruction, key is the pre-shared symmetric key; S72. After decryption is completed, the Android device parses the content of the control instruction through the MQTT client to identify the operation instruction for starting or shutting down an application, modifying system settings, or executing a specific task; S73, calling the API interface of the Android operating system to perform corresponding operations according to the parsed control instruction: If the instruction involves starting or shutting down an application, the application management interface of the Android operating system is called; If the instruction involves modifying system settings, the settings management interface of the Android system is called; If the instruction involves the execution of a specific task, the corresponding task management interface is called to enable the task to be correctly executed on the Android device; S74, the Android device monitors the execution status in real time during the execution of the control instruction, and sends feedback information of the execution process back to the remote control server through the MQTT protocol, the feedback information including the execution result, the device status during the execution and any error information; S75. After the control instruction is executed, the Android device records all operation logs in a local log file and updates the current status of the device.

Images