Bluetooth communication method and system for realizing end-to-end voice encryption and Bluetooth equipment

Abstract

The invention discloses a Bluetooth communication scheme for end-to-end voice encryption, which enables a Bluetooth device to perform identity authentication operation in the use period in a one-certificate one-password mode, and can improve the communication security in an efficient and reliable mode. The secret keys used for encryption conversation are generated according to needs, instantaneity is high, use is safer, quantum secret keys with true randomness are adopted as communication voice secret keys and authentication secret keys, and a high-safety end-to-end voice encryption transmission system can be achieved in cooperation with a national secret standard algorithm. And the communication voice data are all ciphertexts in transmission links except the Bluetooth device, so that the security is greatly improved. The encryption communication function can be realized only by configuring an application program in the communication equipment, the mobile phone number of a user and an address book contact do not need to be changed, the switching of an encryption / common call mode is realized through simple operation under the condition that the Bluetooth equipment is allowed to be connected, the use can be effectively simplified, the operation experience is improved, and the user experience is improved. And meanwhile, any hardware change on the communication equipment is not needed.

Description

Technical Field

[0001] The present invention relates to the field of quantum security technology, and more specifically to a wireless Bluetooth communication method and system for implementing end-to-end voice encryption and a corresponding Bluetooth device. Background Art

[0002] Wireless Bluetooth devices can be disconnected from the wired connection between smart devices, which greatly optimizes the user experience of smart devices. However, Bluetooth is an open wireless communication network with great insecurity. For example, data information such as making / receiving calls realized by wireless Bluetooth devices can be easily intercepted and intercepted by illegal third parties. If it involves the leakage of sensitive information such as some commercial secrets, it will inevitably cause immeasurable losses. Therefore, in order to solve the above problems, a wireless Bluetooth device communication method for end-to-end voice encryption is urgently needed.

[0003] In the Chinese invention patent application No. 202210619582.6, in order to ensure the security of voice, the encrypted headset uses the internal key generation module and voice encryption module to encrypt the audio signal after collecting the voice. The key generation module includes a key factor one generation submodule, a key factor two generation submodule and a key generation submodule. The key factor one generation submodule generates a key factor one according to the password entered by the user, and the key factor two generation submodule generates a set of key combinations as key factor two according to the pre-stored massive random keys. The key generation submodule then performs XOR on key factor one and key factor two, and uses the result as the final key for encrypting voice data. However, in this scheme, the generation mechanism of key factor one is a software algorithm generation mechanism, and the massive random keys of key factor two are a fixed static key pool. The entire key generation process has security risks that rely on software algorithms and low key freshness. After receiving the encrypted voice ciphertext from the caller, the voice decryption module uses the same method to generate a decryption key. However, according to the requirements of the symmetric encryption and decryption algorithm, if the key generated by the answering party according to the same key generation mechanism is consistent with the key generated by the sender, the source keys of both parties need to be consistent. This is extremely unreasonable and unsafe. There is a risk of decryption and exposure during key generation and exchange. The user is also required to set a password as a generation parameter of key factor one, which undoubtedly requires the user to remember his or her password. On the one hand, it increases the user's burden on use. On the other hand, the headset body or charging case needs to add a password input module and display screen, which increases the difficulty and cost of production.

[0004] In the Chinese invention patent application No. 201510386918.9, the voice data is also encrypted and decrypted by adding an encryption and decryption unit to the Bluetooth device. Both parties in communication use Bluetooth devices and smart phones, wherein the Bluetooth devices have an encryption and decryption unit for encryption and decryption, and the encryption and decryption unit transmits the encrypted voice data to the smart phone; and decrypts the encrypted voice data from the smart phone, and the decrypted voice data is output through the speaker. Both parties in communication have a dialing application installed on their phones, and its main functions include reading the address book stored in the phone, sending the phone holder's pass code to the Bluetooth device when pinging with the Bluetooth device of the other party, pinging with the other party, choosing whether to encrypt the communication, and sending a warning message to notify the phone holder when the Bluetooth device of any party in communication finds that the check code is abnormal. However, before dialing, the scheme requires users to manually set 8 to 16 digits and English letters in the ASCII code, which increases the burden on users. The mixed parameter encryption method and time slot coding method adopted are based on the user-set passcode, time code, headphone product serial number, pre-synchronization code of the check code, and encryption declaration of the check code. The parameters are just different permutations and combinations, and these parameters will be repeatedly transmitted between the communicating parties during the communication process, which greatly increases the risk of being eavesdropped and cracked. The corresponding decryption method is calculated based on the check code, parameter encryption method / time slot constant declaration, etc., that is, the encryption / decryption keys, parameters, etc. are all calculated based on mathematical formulas. After obtaining enough transmission parameter data, a third party can decipher it by itself. In actual applications, users often set an extremely simple, unchanging combination of numbers and letters as the passcode for ease of use. The time slot unit will also be a fixed integer value after leaving the factory, and the synchronization code is also a fixed combination of 3 bytes. The pseudo-random random number addition has regularity under a certain capacity. The parameter combination results seem to be many, but in fact they are just inferences of mathematical theory and do not achieve actual high security protection.

[0005] In the Chinese invention patent application No. 202211272072.2, a security medium is built into the wireless headset, and both the calling terminal and the answering terminal need to install the application associated with the wireless headset. Before using the headset's confidential communication mode, it is necessary to enter the correct login password in the application, and the login password is associated with the headset's SN code. However, this setting, on the one hand, causes confusion in password settings when using multiple headsets and increases user memory pressure, and on the other hand, increases the operational complexity of using the headset for confidential communication, reduces the user experience, and its confidential communication objects are limited to specific people in its application list, and it is necessary to enter the list of communication personnel in advance in the application, which increases unnecessary operations for users. Summary of the invention

[0006] In view of the above-mentioned defects of the prior art, the present invention proposes a wireless Bluetooth communication method, system and corresponding Bluetooth device for realizing end-to-end voice encryption, wherein the Bluetooth device is allowed to perform identity authentication operation during the use period in a one-certificate-one-key manner, which can improve the security of communication in an efficient and reliable manner; the key used for encrypted calls is generated on demand, with strong immediacy and safer use, and the communication voice key and the authentication key both use quantum keys with true randomness, which can realize a highly secure end-to-end voice encryption transmission system in conjunction with the national secret standard algorithm. The communication voice data is all ciphertext in the transmission link outside the Bluetooth device, which greatly improves security. The encrypted communication function can be realized by only configuring the application in the communication device, without changing the user's mobile phone number and address book contacts, and allowing simple operation to realize the switching of encryption / normal call mode when the Bluetooth device is connected, which can effectively simplify the use and improve the operating experience, without making any hardware changes to the communication device.

[0007] Specifically, a first aspect of the present invention relates to a wireless Bluetooth communication method for implementing end-to-end voice encryption, which comprises:

[0008] The identity authentication step is used to authenticate the Bluetooth device with the help of the quantum key service platform;

[0009] The call mode switching step is used to allow the user to switch between the normal call mode and the encrypted call mode;

[0010] The common communication step is used for generating communication data based on the collected analog voice signal by the calling party's Bluetooth device and transmitting the communication data to the answering party's Bluetooth device by means of the communication device in the common call mode, and recovering the analog voice signal from the communication data by the answering party's Bluetooth device;

[0011] The communication voice key distribution step is used to distribute the communication voice key Km to the Bluetooth device of the caller and the Bluetooth device of the receiver by means of the quantum key service platform in the encrypted call mode after the Bluetooth device passes the identity authentication and a voice channel is established between the communication device of the caller and the communication device of the receiver;

[0012] The encryption communication step is used for, in the encrypted call mode, the calling party's Bluetooth device generates a communication data ciphertext based on the collected analog voice signal by means of encryption processing based on the communication voice key Km and transmits it to the answering party's Bluetooth device by means of the communication device, and the answering party's Bluetooth device recovers the analog voice signal based on the communication data ciphertext by means of decryption processing based on the communication voice key Km;

[0013] Among them, in the identity authentication step:

[0014] The Bluetooth device generates an authentication request message and transmits it to the quantum key service platform through the communication device. The authentication request message includes its security module ID and the locally generated random number R 0 ;

[0015] The quantum key service platform obtains the security module ID and random number R according to the identity authentication request message. 0 ; Determine the authentication key Kr according to the security module ID, wherein the security module of the Bluetooth device is pre-filled with the authentication key Kr by the quantum key service platform; Use the authentication key Kr to encrypt the challenge information to generate challenge data, and the challenge information includes a random number R 0 and a locally generated random number R 1 ; and, returning a challenge response to the Bluetooth device with the help of the communication device, the challenge response including information of the authentication key Kr, the security module ID, the quantum key service platform ID and the challenge data;

[0016] After verifying the security module ID and quantum key service platform ID in the received challenge response, the Bluetooth device obtains the authentication key Kr locally based on the information of the authentication key Kr; the authentication key Kr is used to decrypt the challenge data to obtain the random number R 0 and R 1 ; The decrypted random number R 0 With the local random number R 0 The comparison is performed so that when the comparison is consistent, a response is generated and transmitted to the quantum key service platform through the communication device. The response is generated by encrypting the response information with the authentication key Kr. The response information includes a random number R 0 and R 1 ;

[0017] The quantum key service platform uses the authentication key Kr to decrypt the response to obtain the response information, and then sends the decrypted random number R 1 With the local random number R 1 A comparison is performed to generate and return an authentication success message to the Bluetooth device via the communication device when they are consistent.

[0018] Optionally, switching between the normal call mode and the encrypted call mode is performed by operating the Bluetooth device and / or the communication device.

[0019] Further, in the call mode switching step, when one of the calling party and the answering party initiates the switch between the normal call mode and the encrypted call mode and sends a mode switching notification to the other of the calling party and the answering party, and the other of the calling party and the answering party returns a response of successful switching based on the mode switching notification, the switch between the normal call mode and the encrypted call mode is completed.

[0020] Preferably, in the identity authentication step, at least one of the identity authentication request message, challenge information, challenge response and reply information is formed in a data splicing manner; and / or, at least one of the identity authentication request message, challenge information, challenge data, challenge response, reply information and reply response also includes at least one of a content summary, a timestamp and a sequence number.

[0021] Furthermore, the authentication success message includes an identity authentication token Token, which has a preset validity period.

[0022] Furthermore, the wireless Bluetooth communication method of the present invention also includes an identity authentication token updating step, which is used to update the identity authentication token Token by means of the identity authentication step when the identity authentication token Token expires.

[0023] Further, in the communication voice key distribution step:

[0024] The calling party's Bluetooth device sends its security module IDa and local random number Ra to the answering party's Bluetooth device with the help of the communication device, and the answering party's Bluetooth device sends its security module IDb and local random number Rb to the calling party's Bluetooth device with the help of the communication device;

[0025] The calling party's Bluetooth device sends application parameters and its identity authentication token Token_a to the quantum key service platform through the communication device, and the answering party's Bluetooth device sends application parameters and its identity authentication token Token_b to the quantum key service platform through the communication device, where the application parameters include random numbers Ra and Rb, security modules IDa and IDb, and quantum key service platform IDc;

[0026] After verifying the validity of the identity authentication tokens Token_a and Token_b, the quantum key service platform determines the session keys Ka and Kb according to the security modules IDa and IDb, generates a random number Rc and a quantum key Km, encrypts the quantum key Km with the session key Ka to generate a first key ciphertext Kam, encrypts the quantum key Km with the session key Kb to generate a second key ciphertext Kbm, performs summary calculation based on the first and second summary data to generate summary Ha and Hb, and returns the first and second data packets to the Bluetooth devices of the caller and the receiver via the communication device, respectively, wherein: the first summary number is The data includes the first key ciphertext Kam, random numbers Ra and Rc, security module IDb and quantum key service platform IDc, the second summary data includes the second key ciphertext Kbm, random numbers Rb and Rc, security module IDa and quantum key service platform IDc, the first data packet includes the first key ciphertext Kam, information of the session key Ka, summary Ha, random numbers Ra and Rc, security module IDb and quantum key service platform IDc, and the second data packet includes the second key ciphertext Kbm, information of the session key Kb, summary Hb, random numbers Rb and Rc, security module IDa and quantum key service platform IDc;

[0027] The caller's Bluetooth device compares the random number Ra, security module IDb and quantum key service platform IDc in the received first data packet with the local random number Ra, security module IDb and quantum key service platform IDc, and after the digest generated by the digest calculation based on the first digest data in the received first data packet is verified with the received digest Ha, the session key Ka is obtained locally according to the information of the session key Ka in the received first data packet, and the first key ciphertext Kam is decrypted using the session key Ka to obtain the quantum key Km; and,

[0028] The random number Rb, security module IDa and quantum key service platform IDc in the second data packet received by the Bluetooth device of the answering party are compared with the local random number Rb, security module IDa and quantum key service platform IDc, and after the summary calculated based on the second summary data in the received second data packet is verified with the received summary Hb, the session key Kb is obtained locally according to the information of the session key Kb in the received second data packet, and the second key ciphertext Kbm is decrypted using the session key Kb to obtain the quantum key Km.

[0029] Furthermore, the encrypted communication step includes a voice encryption and sending step and a voice decryption and playing step;

[0030] In the voice encryption and transmission step, the Bluetooth device collects analog voice signals, performs analog-to-digital conversion and encoding on the analog voice signals to generate a voice data stream; encrypts the voice data stream using the communication voice key Km to generate a voice ciphertext data stream; modulates the voice ciphertext data stream into a voice-like signal to be sent out as a communication data ciphertext; and / or,

[0031] In the voice decryption and playback step, the Bluetooth device receives a voice-like signal and demodulates the voice-like signal into a voice ciphertext data stream; the voice ciphertext data stream is decrypted using the communication voice key Km to generate a voice data stream; and the analog voice signal is restored based on the voice data stream for playback.

[0032] Furthermore, the voice encryption and sending step also includes the step of calculating and sending the summary of the voice ciphertext data stream, and the voice decryption and playing step also includes the step of verifying the summary of the voice ciphertext data stream.

[0033] Furthermore, in the voice encryption and sending step, the random number Rc is also used to calculate the summary of the voice ciphertext data stream, and in the voice decryption and playback step, the random number Rc obtained in the communication voice key distribution step is also used to verify the summary of the voice ciphertext data stream.

[0034] A second aspect of the present invention relates to a wireless Bluetooth communication system for implementing end-to-end voice encryption, which includes a Bluetooth device, a communication device and a quantum key service platform;

[0035] The quantum key service platform is set up for the authentication of Bluetooth devices and the distribution of communication voice keys Km;

[0036] The communication device and / or the Bluetooth device is configured to switch between a normal call mode and an encrypted call mode;

[0037] The Bluetooth device is further configured to:

[0038] In the normal call mode, communication data is generated based on the collected analog voice signal, and the analog voice signal is recovered from the received communication data; in the encrypted call mode, communication data ciphertext is generated based on the collected analog voice signal by means of encryption processing based on the communication voice key Km, and the analog voice signal is recovered from the received communication data ciphertext by means of decryption processing based on the communication voice key Km; and,

[0039] Generate an identity authentication request message and transmit it to the quantum key service platform through a communication device. The identity authentication request message includes the security module ID and the locally generated random number R 0; Parse the received challenge response to obtain the information of the authentication key Kr, the security module ID, the quantum key service platform ID and the challenge data; verify the security module ID and the quantum key service platform ID obtained by the parsing, and obtain the authentication key Kr from the quantum key pre-filled in the security module according to the information of the authentication key Kr after the verification passes; use the authentication key Kr to decrypt the challenge data to obtain the random number R 0 and R 1 ; and, the decrypted random number R 0 With the local random number R 0 The comparison is performed, and when the comparison is consistent, a response is generated to be transmitted to the quantum key service platform through the communication device. The response is generated by encrypting the response information with the authentication key Kr. The response information includes a random number R 0 and R 1 ;

[0040] Furthermore, the quantum key service platform is further configured to:

[0041] Parse the identity authentication request message to obtain the security module ID and random number R 0 ; Determine the authentication key Kr according to the security module ID; Use the authentication key Kr to encrypt the challenge information to generate challenge data, the challenge information includes a random number R 0 and a locally generated random number R 1 ; Using the communication device to return a challenge response to the Bluetooth device, the challenge response includes the information of the authentication key Kr, the security module ID, the quantum key service platform ID and the challenge data; using the authentication key Kr to decrypt the response to obtain the response information; and decrypting the random number R 1 With the local random number R 1 A comparison is performed, and when the comparison is consistent, an authentication success message is returned to the Bluetooth device with the help of the communication device.

[0042] Further, the communication device includes an application for switching between a normal call mode and an encrypted call mode; and / or, the Bluetooth device includes a button for switching between a normal call mode and an encrypted call mode.

[0043] Furthermore, the authentication success message includes an identity authentication token Token, which has a preset validity period.

[0044] Furthermore, the calling party's Bluetooth device sends its security module IDa and local random number Ra to the answering party's Bluetooth device via the communication device, and the answering party's Bluetooth device sends its security module IDb and local random number Rb to the calling party's Bluetooth device via the communication device;

[0045] The calling party's Bluetooth device sends application parameters and its identity authentication token Token_a to the quantum key service platform through the communication device, and the answering party's Bluetooth device sends application parameters and its identity authentication token Token_b to the quantum key service platform through the communication device. The application parameters include random numbers Ra and Rb, security modules IDa and IDb, and quantum key service platform IDc;

[0046] After verifying the validity of the identity authentication tokens Token_a and Token_b, the quantum key service platform determines the session keys Ka and Kb according to the security modules IDa and IDb, generates a random number Rc and a quantum key Km, encrypts the quantum key Km with the session key Ka to generate a first key ciphertext Kam, encrypts the quantum key Km with the session key Kb to generate a second key ciphertext Kbm, performs summary calculation based on the first and second summary data to generate summary Ha and Hb, and returns the first and second data packets to the Bluetooth devices of the caller and the receiver via the communication device, respectively, wherein: the first summary number is The data includes the first key ciphertext Kam, random numbers Ra and Rc, security module IDb and quantum key service platform IDc, the second summary data includes the second key ciphertext Kbm, random numbers Rb and Rc, security module IDa and quantum key service platform IDc, the first data packet includes the first key ciphertext Kam, information of the session key Ka, summary Ha, random numbers Ra and Rc, security module IDb and quantum key service platform IDc, and the second data packet includes the second key ciphertext Kbm, information of the session key Kb, summary Hb, random numbers Rb and Rc, security module IDa and quantum key service platform IDc;

[0047] The caller's Bluetooth device compares the random number Ra, security module IDb and quantum key service platform IDc in the received first data packet with the local random number Ra, security module IDb and quantum key service platform IDc, and after the digest generated by the digest calculation based on the first digest data in the received first data packet is verified with the received digest Ha, the session key Ka is obtained locally according to the information of the session key Ka in the received first data packet, and the first key ciphertext Kam is decrypted using the session key Ka to obtain the quantum key Km;

[0048] The random number Rb, security module IDa and quantum key service platform IDc in the second data packet received by the Bluetooth device of the answering party are compared with the local random number Rb, security module IDa and quantum key service platform IDc, and after the summary calculated based on the second summary data in the received second data packet is verified with the received summary Hb, the session key Kb is obtained locally according to the information of the session key Kb in the received second data packet, and the second key ciphertext Kbm is decrypted using the session key Kb to obtain the quantum key Km.

[0049] Further, the Bluetooth device includes a microphone voice input module, a voice encryption module, a quasi-voice modulation module, a voice data transmission module, a voice data receiving module, a quasi-voice demodulation module, a voice decryption module, a speaker voice output module and a security module;

[0050] The microphone voice input module is configured to collect analog voice signals, perform analog-to-digital conversion and encoding on the analog voice signals to generate a voice data stream;

[0051] The voice encryption module is configured to encrypt the voice data stream to generate a voice ciphertext data stream;

[0052] The voice-like modulation module is configured to modulate the voice ciphertext data stream into a voice-like signal;

[0053] The voice data sending module is configured to send a voice-like signal outwardly based on a data channel or a Bluetooth channel;

[0054] The voice data receiving module is configured to receive a voice-like signal;

[0055] The quasi-speech demodulation module is configured to demodulate the received quasi-speech signal into a voice ciphertext data stream;

[0056] The voice decryption module is configured to decrypt the voice ciphertext data stream to generate a voice data stream;

[0057] The speaker voice output module is configured to generate an analog voice signal for playback based on the voice data stream;

[0058] The security module is configured to provide an interactive interface for external quantum key operations and storage of the quantum key Km.

[0059] Furthermore, the communication device is provided with an application associated with the Bluetooth device for switching between the normal call mode and the encrypted call mode and / or authority management.

[0060] A third aspect of the present invention relates to a wireless Bluetooth device, which includes a security module and is configured to be used in the wireless Bluetooth communication system of the present invention.

[0061] Furthermore, the security module includes a key storage module and an interactive interface module; the key storage module is configured to store the quantum key Km; the interactive interface module is configured to provide an interactive interface for quantum key operations to the outside according to the GM / T 0016 national cryptography industry standard.

[0062] Furthermore, the wireless Bluetooth device of the present invention includes a key for switching between a normal call mode and an encrypted call mode. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 The schematic diagram shows the architecture principle diagram of the Bluetooth device according to the present invention;

[0064] Figure 2 A flowchart schematically shows an identity authentication step in a Bluetooth communication method according to the present invention;

[0065] Figure 3 A flowchart of updating an identity authentication token in a Bluetooth communication method according to the present invention is schematically shown;

[0066] Figure 4 A flowchart schematically shows a communication voice key distribution step and an encryption communication step in a Bluetooth communication method according to the present invention;

[0067] Figure 5 A flowchart of encryption of communication voice data in a Bluetooth communication method according to the present invention is schematically shown;

[0068] Figure 6 Schematically shows a flow chart of communication voice data decryption in the Bluetooth communication method according to the present invention;

[0069] Figure 7 A flowchart schematically shows the steps of switching the call mode in the Bluetooth communication method according to the present invention;

[0070] Figure 8 The flowchart of authorization management of application programs in a communication device according to the Bluetooth communication method and system of the present invention is schematically shown. DETAILED DESCRIPTION

[0071] Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. The following embodiments are provided by way of example so as to fully convey the spirit of the present invention to those skilled in the art to which the present invention belongs. Therefore, the present invention is not limited to the embodiments disclosed herein.

[0072] The present invention proposes a wireless Bluetooth communication system for realizing end-to-end voice encryption, which mainly includes a Bluetooth device, a communication device and a quantum key service platform.

[0073] Figure 1 A wireless Bluetooth device (eg, a Bluetooth headset) according to the present invention is shown, which mainly includes a voice encryption and sending unit, a voice decryption and playback unit, and a security module.

[0074] The security module may include a key storage module and an interactive interface module. Among them, the key storage module is used to store the quantum key Km. In the present invention, the quantum key is pre-filled into the security module in a certain encapsulation format (or encapsulation structure) in the quantum key service platform. Each key in the key ciphertext part of the encapsulation structure has its key serial number (in actual use, the length of the encapsulation structure header will be omitted, and the key serial number is used to indicate the key at a specific position). These pre-filled keys are the same as the keys in the quantum key service platform. Since the quantum keys in the quantum key service platform are all generated by a quantum random number generator or a quantum key distribution (QKD) network QKD device, they are truly random, so the keys filled each time are different, that is, the pre-filled keys stored in the security module of each wireless Bluetooth device can be different, which increases the difficulty of deciphering encrypted communications.

[0075] The interactive interface module can provide an interactive interface for quantum key operations to the outside according to the GM / T 0016 national cryptographic industry standard, for example.

[0076] In the wireless Bluetooth device of the present invention, the voice encryption sending unit is used to generate communication data ciphertext based on the collected analog voice signal by means of encryption processing based on the quantum key Km, so as to send it outward through a wireless or Bluetooth channel.

[0077] Continue to see Figure 1 The voice encryption and sending unit may include a microphone voice input module, a voice encryption module, a quasi-voice modulation module and a voice data sending module.

[0078] In the present invention, the microphone voice input module can collect user voice signals, namely analog voice signals, and generate voice data streams after performing analog-to-digital conversion and encoding on the analog voice signals.

[0079] The voice encryption module can encrypt the voice data stream using the quantum key Km in the encrypted call mode to generate a voice ciphertext data stream. As an example, the voice encryption module can adopt the block encryption method of SM4 CTR mode (counter mode).

[0080] The voice-like modulation module can modulate the voice ciphertext data stream into a voice-like signal so that it can be compressed and correctly encoded by the link vocoder.

[0081] The voice data sending module can send the processed communication data ciphertext, that is, the voice-like signal, to a connected communication device (such as a mobile phone) through a data channel or a Bluetooth channel.

[0082] In the wireless Bluetooth device of the present invention, the voice decryption and playback unit is used to recover the analog voice signal from the received communication data ciphertext (similar voice signal) by means of decryption processing based on the quantum key Km, so as to allow the voice information of the communication to be played.

[0083] Continue to see Figure 1 The voice decryption and playback unit may include a voice data receiving module, a voice-like demodulation module, a voice decryption module and a speaker voice output module.

[0084] In the present invention, the voice data receiving module can receive a voice-like signal sent by a communication partner from a connected communication device through a data channel or a Bluetooth channel.

[0085] The quasi-speech demodulation module can perform a demodulation operation on the received quasi-speech signal based on the speech parameter model to extract the original speech ciphertext data stream.

[0086] The voice decryption module can decrypt the voice ciphertext data stream to restore the original voice data stream, that is, the voice data plaintext. As an example, the voice decryption module can adopt the packet decryption method of SM4 CTR mode.

[0087] The speaker voice output module can integrate, amplify, and perform digital-to-analog conversion on the recovered voice data stream to generate an analog voice signal for output playback.

[0088] Continue to see Figure 1 In the wireless Bluetooth device of the present invention, a Bluetooth communication protocol library can also be set up, which includes various basic protocols required by the Bluetooth technology system, mainly involving service discovery protocol, phone control protocol, baseband protocol, link management protocol, logical link control and adaptation protocol, etc., to provide support for connections between Bluetooth devices.

[0089] The wireless Bluetooth device may also be provided with a cryptographic algorithm library for providing algorithm interfaces required for Bluetooth device data encryption and decryption, signature verification, etc. As an example, the cryptographic algorithm library may include national secret standard algorithms such as SM2, SM3, and SM4.

[0090] In addition, the wireless Bluetooth device may also include other firmware modules such as a message forwarding module, a call status management module, and a log management module.

[0091] The communication device can be any voice communication device that can be adapted to the Bluetooth device, such as a smart phone, etc., which can access the mobile network, establish a voice channel, and transmit data with other voice communication devices, etc. In the present invention, an application associated with the Bluetooth device can be set in the communication device to provide the user with an interactive interface for operating the Bluetooth device, such as a dialing interface, a call interface, an address book, Bluetooth device status, key information, etc., so as to facilitate the user to intuitively operate and set various functions of the Bluetooth device.

[0092] The quantum key service platform is used to provide key charging, identity authentication and key information query services for Bluetooth devices (security modules), and manage communication voice key distribution and other services between Bluetooth devices. In the present invention, the quantum key service platform can also connect quantum key service components such as quantum key exchange cipher machines, quantum key charging terminals, quantum random number generators and quantum key distribution networks to manage them.

[0093] As a storage device for quantum keys, the quantum key exchange cryptographic machine can provide cryptographic operations such as MAC verification and key encryption storage according to the scheduling control of the quantum key service platform.

[0094] The quantum key charging terminal can charge the quantum key for the Bluetooth device (security module), for example, the quantum key in the quantum key exchange cipher machine can be encapsulated and charged into the Bluetooth device (security module) in a certain format. Thus, the quantum key exchange cipher machine and the Bluetooth device (security module) will share the same quantum key, and the quantum keys in different Bluetooth devices (security modules) are different.

[0095] A quantum random number generator can generate true random numbers based on the principles of quantum physics, which can be used to generate quantum keys, such as providing quantum keys pre-filled in Bluetooth devices (security modules), or voice keys for communication between Bluetooth devices in the same communication domain.

[0096] The quantum key distribution network can provide a steady stream of theoretically unconditionally secure symmetric quantum keys to both parties on demand. For example, in long-distance cross-domain communication, the communication voice key can be provided to nearby Bluetooth devices.

[0097] To better understand the working principle of the wireless Bluetooth communication system for implementing end-to-end voice encryption of the present invention, the following will be combined with Figure 2-8 , the wireless Bluetooth communication method of the present invention is specifically described by way of example.

[0098] The wireless Bluetooth communication method mainly includes an identity authentication step, a call mode switching step, a common communication step, a communication voice key distribution step and an encrypted communication step.

[0099] The authentication step is used to authenticate the Bluetooth device with the help of the quantum key service platform.

[0100] After the Bluetooth device identity authentication is passed, the caller and the receiver can communicate in plain text or encrypted voice in normal call mode or encrypted call mode. In the present invention, any one of the caller and the receiver can conveniently switch between normal call mode and encrypted call mode at any time (for example, before dialing, during a call, etc.) with the help of the call mode switching step. As an example, the user can switch between normal call mode and encrypted call mode by operating the buttons on the Bluetooth device body; or, the user can also use the associated application installed on the communication device to operate on the communication device to switch between normal call mode and encrypted call mode.

[0101] When the user selects the normal call mode, the normal communication steps can be used, with the caller's Bluetooth device generating communication data based on the collected analog voice signal, and the communication data can be transmitted in plain text to the answerer's Bluetooth device with the help of the communication device; when the answerer's Bluetooth device receives the communication data with the help of the communication device, it can recover the analog voice signal from the communication data.

[0102] When the user chooses the encrypted call mode, after a voice channel is established between the caller's communication device and the answerer's communication device (for example, during ringing), the communication voice key distribution step can be executed, and the communication voice key Km can be distributed to the caller's Bluetooth device and the answerer's Bluetooth device with the help of the quantum key service platform, preparing for subsequent encrypted communication.

[0103] After the Bluetooth devices (security modules) of the communicating parties obtain the communication voice key Km (i.e., the shared quantum key) used for the current encrypted communication process, the encrypted communication step can be executed. The caller's Bluetooth device uses the communication voice key Km to generate a communication data ciphertext based on the encryption operation of the collected communication voice data, and transmits it to the answerer's Bluetooth device with the help of the communication device. The answerer's Bluetooth device uses the communication voice key Km to decrypt the received communication data ciphertext to obtain the communication voice data, thereby realizing encrypted voice communication.

[0104] Figure 2 An example of a flowchart of an identity authentication step in a Bluetooth communication method according to the present invention is shown.

[0105] When a Bluetooth device is first activated or restarted, when the Bluetooth device is connected to a communication device and the communication device is connected to the network, the Bluetooth device will usually actively apply for identity authentication. For example, when it is first activated, the user can log in to the application of the communication device and register the account name with the mobile phone number as needed to establish an ACL link connection between the communication device and the Bluetooth device. After the ACL link is established, the Bluetooth device starts to apply for identity authentication.

[0106] Specifically, the Bluetooth device can call the interactive interface of its security module, use the security module ID as authentication data, and generate a local request random number R 0 , for example, with a security module ID and a random number R 0 The identity authentication request message of the Bluetooth device is generated by splicing, transmitted to the communication device through the ACL link, and then sent to the quantum key service platform by the communication device.

[0107] By parsing the identity authentication request message, the quantum key service platform can obtain the security module ID of the Bluetooth device that initiated the request and the request random number R 0 On this basis, the quantum key service platform can query the key information related to the security module ID (i.e. the key information pre-charged into the security module) in the local database, and designate the available key as the authentication key Kr for the subsequent identity authentication operation. At the same time, the quantum key service platform can also generate the platform's challenge random number R 1 , combine the random number R 0 and R 1 The challenge information is formed and encrypted with the authentication key Kr to generate the challenge data. Finally, the information of the authentication key Kr (such as its serial number), the ID of the security module, the ID of the quantum key service platform and the challenge data are combined to generate a challenge response and returned to the communication device, which then forwards the challenge response to the Bluetooth device.

[0108] The Bluetooth device parses the challenge response to obtain the information of the authentication key Kr, the ID of the security module, the ID of the quantum key service platform, and the challenge data, and verifies the received security module ID and quantum key service platform ID. After the verification is passed, the Bluetooth device calls the security module, queries and decrypts the corresponding authentication key Kr pre-charged and stored locally according to the information of the received authentication key Kr (such as the serial number), and uses the authentication key Kr to decrypt the challenge data to obtain the random number R 0 and R 1 . Further, the Bluetooth device can decrypt the random number R 0 The request random number R generated and stored locally 0 A comparison is performed, and if the two are consistent, the identity of the quantum key service platform can be considered legitimate.

[0109] When confirming the legality of the quantum key service platform, the Bluetooth device can send the random number R 0 and R 1 The response information is formed by splicing (for example, reverse splicing), which is encrypted using the authentication key Kr to generate a response, and the response is returned to the communication device through the ACL link, and then sent by the communication device to the quantum key service platform.

[0110] After receiving the response, the quantum key service platform uses the authentication key Kr to decrypt the response and obtain the random number R 0 and R 1 , and the decrypted random number R 1 The random number R generated and stored locally 1 When the two are consistent, the Bluetooth device identity can be considered legitimate. At this time, the quantum key service platform can use the authentication success message as the authentication result and return the authentication success message to the Bluetooth device with the help of the communication device.

[0111] In a preferred example, in order to prevent data from being tampered with during transmission, a summary of the data content can also be added to the transmitted data (such as an authentication request message, challenge information, challenge data, challenge response, response information and response response, etc.), for example, by placing the content summary at the end of the data for security verification.

[0112] In a preferred example, information such as a timestamp or serial number may also be added to the transmitted data (such as an authentication request message, challenge information, challenge data, challenge response, response information, and response response, etc.) to ensure the uniqueness and transmission timeliness of the data, thereby obtaining a higher level of data transmission security.

[0113] In a preferred example, the identity authentication token of the Bluetooth device can also be set in the authentication success message provided by the quantum key service platform, so that the quantum key service platform can manage the login status of the Bluetooth device and reduce the time consumption of multiple identity authentications in a short period of time. For example, a validity period can be set in the provided identity authentication token, and during the validity period, the Bluetooth device can carry the identity authentication token to make other service requests.

[0114] Figure 3 The flowchart of updating the identity authentication token in the wireless Bluetooth communication method of the present invention is schematically shown.

[0115] As mentioned above, when the Bluetooth device is first enabled or restarted, interconnected with the communication device, and the communication device is connected to the network, the Bluetooth device can actively apply for identity authentication and obtain an identity authentication token Token with the help of the above identity authentication steps.

[0116] After using the Bluetooth device for a period of time, the user, as the caller, can use the application associated with the Bluetooth device to choose to make an encrypted call to apply for a communication voice key, as the receiver, answer an encrypted call to apply for a communication voice key, query the local key information, and other operations that require communication application operations with the quantum key service platform. The user can carry the locally existing identity authentication token to initiate the application request.

[0117] After receiving the application message sent by the Bluetooth device via the communication device, the quantum key service platform can first check whether the identity authentication token carried in the application message has expired. If it is within the validity period, it can directly enter the relevant operations (such as returning the corresponding communication voice key, key information, etc.); otherwise, it is necessary to re-authenticate, such as updating the identity authentication token with the help of the above-mentioned identity authentication steps.

[0118] Figure 4 The flowchart of the communication voice key distribution step and the encryption communication step in the wireless Bluetooth communication method of the present invention is schematically shown, wherein a timing diagram for the encryption communication process is also provided.

[0119] After identity authentication, the caller's communication device can select a contact as the communication object in the application, and select encrypted call dialing to initiate an invitation. At this time, the caller's communication device and the receiver's communication device enter the ringing stage, establish a voice channel, and the caller and the receiver can obtain each other's voice modulation information, such as Figure 4 As shown.

[0120] In this state, the communication voice key distribution step can be used to distribute the quantum key Km between the caller's Bluetooth device and the answerer's Bluetooth device as the communication voice key.

[0121] To this end, the caller's Bluetooth device can generate a random number Ra, which is combined with the IDa information of its security module, and the combined result is sent to the receiver's communication device through the caller's communication device, and then to the receiver's Bluetooth device; similarly, the receiver's Bluetooth device can generate a random number Rb, which is combined with the IDb information of its security module, and the combined result is sent to the caller's communication device through the receiver's communication device, and then to the caller's Bluetooth device. Both parties can also create an application session IDsession to identify the call.

[0122] Subsequently, the caller's Bluetooth device can send the security module IDa, security module IDb, random number Ra, random number Rb, IDsession and IDc of the quantum key service platform as application parameters, together with the identity authentication token Token_a of the caller's Bluetooth device, to the quantum key service platform through the caller's communication device, requesting the quantum key service platform to create a communication voice key for this call based on IDsession.

[0123] Similarly, the Bluetooth device of the answering party can send the security module IDa, security module IDb, random number Ra, random number Rb, IDsession and IDc of the quantum key service platform as application parameters, together with the identity authentication token Token_b of the Bluetooth device of the answering party, to the quantum key service platform through the communication device of the answering party, requesting the quantum key service platform to create the communication voice key for this call based on IDsession.

[0124] After verifying that the identity authentication token Token_a of the caller's Bluetooth device is within the validity period, the quantum key service platform will search the database for the corresponding key information based on the security module IDa, and designate the available key Ka as the session key between the quantum key service platform and the caller's Bluetooth device in response to this service request. Similarly, after verifying that the identity authentication token Token_b of the receiver's Bluetooth device is within the validity period, the quantum key service platform will search the database for the corresponding key information based on the security module IDb, and designate the available key Kb as the session key between the quantum key service platform and the receiver's Bluetooth device in response to this service request.

[0125] The quantum key service platform will also generate a verification random number Rc and a communication voice key Km bound to the application parameters. Therefore, the session key Ka can be used to encrypt the quantum key Km to generate a first key ciphertext Kam, calculate the verification summary of the first summary data including Kam, Ra, Rc, IDb and IDc to generate a summary Ha, and package Kam, Ha, the information of the key Ka (such as its serial number SNa), Ra, Rc, IDb, IDc and IDsession together, and return it to the Bluetooth device of the caller through the communication device of the caller as a first data packet. Similarly, the session key Kb is also used to encrypt the quantum key Km to generate a second key ciphertext Kbm, calculate the verification summary of the second summary data including Kbm, Rb, Rc, IDa and IDc to generate a summary Hb, and package Kbm, Hb, the information of the key Kb (such as its serial number SNb), Rb, Rc, IDa, IDc and IDsession together as a second data packet and return it to the Bluetooth device of the receiver through the communication device of the receiver.

[0126] After the calling party's Bluetooth device parses the first data packet to obtain the data therein, it can compare the parsed Ra, IDb and IDc with the corresponding information stored locally. If the comparison is consistent, the summary Ha is further verified, and the summary generated by the summary calculation based on the first summary data in the received first data packet is compared with the received summary Ha. If the summary Ha passes the verification, the interactive interface of its security module can be called to find the internally stored session key Ka corresponding to the information of the key Ka (such as the serial number SNa), and the session key Ka is used to decrypt the first key ciphertext Kam to obtain the communication voice key Km.

[0127] Similarly, after the Bluetooth device of the receiving party parses the second data packet to obtain the data therein, it can compare the parsed Rb, IDa and IDc with the corresponding information stored locally. If the comparison is consistent, the summary Hb is further verified, and the summary generated by the summary calculation based on the second summary data in the received second data packet is compared with the received summary Hb. If the summary Hb passes the verification, the interactive interface of its security module can be called to find the internally stored session key Kb corresponding to the information of the key Kb (such as the serial number SNb), and the session key Kb is used to decrypt the second key ciphertext Kbm to obtain the communication voice key Km.

[0128] At this point, both parties have obtained the communication voice key Km for this session, and both parties can use their respective Bluetooth devices to encrypt and decrypt the collected or received voice data streams. After the voice data streams are processed and sent out by the Bluetooth device, they are all ciphertext, which effectively avoids the risk of being intercepted in the communication link.

[0129] Figure 5 The flowchart schematically shows the communication voice data encryption process in the Bluetooth communication method of the present invention.

[0130] like Figure 5 As shown, the microphone voice input module of the caller's Bluetooth device collects the user's analog voice signal, and generates a voice data stream after analog-to-digital conversion and encoding.

[0131] The voice encryption module calls the interactive interface of the cryptographic algorithm library and the security module, and uses the communication voice key, for example, based on the national secret SM4CTR algorithm, to encrypt the voice data stream to obtain a voice ciphertext data stream (i.e., communication data ciphertext). Preferably, a checksum can also be calculated for the voice ciphertext data stream and attached to the end of the voice ciphertext data stream (i.e., attached to the end of the data frame).

[0132] The voice-like modulation module modulates the voice ciphertext data stream into a voice-like signal that can be correctly encoded by the vocoder, and transmits the voice-like signal to the voice data sending module, which transmits it to the communication device through the Bluetooth channel.

[0133] The communication device sends the final ciphertext data (i.e., a voice-like signal) to the communication device of the receiving party through a voice channel.

[0134] Figure 6 The flowchart of communication voice data decryption in the Bluetooth communication method according to the present invention is schematically shown.

[0135] like Figure 6 As shown, the communication device of the receiving party forwards the ciphertext data (ie, the voice-like signal) received through the voice channel to the voice data receiving module of the Bluetooth device.

[0136] The quasi-speech demodulation module of the Bluetooth device demodulates the quasi-speech signal, extracts the ciphertext data stream and the verification summary therein, and transmits them to the speech decryption module.

[0137] The voice decryption module calls the interactive interface of the cryptographic algorithm library and the security module to verify the verification summary. If the verification passes, the communication voice key is used to decrypt the voice ciphertext data stream based on the national secret SM4 CTR algorithm.

[0138] Finally, the speaker voice output module integrates, amplifies, and performs digital-to-analog conversion on the voice data stream, outputs and plays the analog voice signal.

[0139] Preferably, a random number Rc can be added to the generation parameters of the verification summary and sent to the receiving party as an enhanced verification code. At this time, the receiving party can compare the Rc parsed when applying for the communication voice key from the quantum key service platform with the random number Rc in the ciphertext data sent from the caller. If they are consistent, it means that the transmitted ciphertext data is credible; if they are inconsistent, it means that the transmitted ciphertext data may be tampered with or the caller is not credible.

[0140] Figure 7 The flowchart of the call mode switching steps in the Bluetooth communication method according to the present invention is schematically shown, wherein operating the associated application in the communication device to realize the switching function is taken as an example.

[0141] like Figure 7As shown, when a user requests to switch from ordinary call mode to encrypted call mode, for example by clicking a button for switching to encrypted call on the graphical user interface of an application, the (wireless) Bluetooth device on this end calls the security module to prepare the parameter information required to apply for the communication voice key, and after obtaining the communication voice key Km required for this encrypted call with the help of the communication voice key distribution step, the master and slave devices synchronize operations and switch to encrypted call mode, synchronize the status of the call mode switching to the application on the associated communication device and display it in the interface, and finally use the voice channel established between the communication devices of the caller and the answerer to notify the other end to switch to encrypted call mode.

[0142] After receiving the notification message, the wireless Bluetooth device of the caller calls the security module to generate application information, obtains the communication voice key Km required for this encrypted call from the quantum key service platform through the communication voice key distribution step, and then starts to synchronize the status of the call mode of the master and slave devices, enters the encrypted call mode, and synchronizes the status of the call mode switching with the application on the associated communication device and displays it in the interface. Finally, respond to the caller.

[0143] After both the caller and the receiver have successfully obtained the communication voice key, the call mode switch is considered to have successfully entered the encrypted call. Otherwise, the wireless Bluetooth device of the party that triggered the switch operation will be notified of the switch failure and fall back to the normal call mode, and the result will be displayed in the application interface. In the encrypted call process, only the master headset is used to encrypt the voice data to be sent, and the master and slave headsets will synchronously decrypt the received voice ciphertext data.

[0144] When the user requests to switch to normal call mode by clicking the button to switch to normal call on the graphical user interface of the application, for example during an encrypted call, the wireless Bluetooth device at the local end stops encrypting the voice data, and the master and slave devices operate synchronously and switch to normal call mode.

[0145] The wireless Bluetooth device has switched to normal call mode, and synchronized the call mode switching status to the application on the associated communication device and displayed it in the interface. Finally, the voice channel established between the caller and the answerer's communication devices is used to notify the other party to switch to normal call mode.

[0146] After receiving the notification message, the wireless Bluetooth device of the caller synchronizes the status of the call mode of the master and slave devices, enters the normal call mode, and synchronizes the status of the call mode switching with the application on the associated communication device and displays it in the interface. Finally, a response is made to the caller.

[0147] The call mode switch is considered successful to normal call only after the caller receives a successful response from the answering party. Otherwise, the wireless Bluetooth device of the party that triggered the switching operation will be informed of the switch failure and fall back to the encrypted call mode, and the result will be displayed in the application interface.

[0148] As mentioned above, in the present invention, the triggering of switching the call mode can be realized by means of an application on the associated communication device or by means of a button on the wireless Bluetooth device body.

[0149] The user initiator who triggers the switching mode can be the caller or the receiver. When one party triggers the switching operation, the other party can passively receive the notification and switch the call mode, or refuse to switch the call mode.

[0150] In order to realize functions such as synchronizing call records, adding and deleting contacts, automatically calling up applications for incoming calls, and keeping applications alive, authorization management can be performed on applications associated with wireless Bluetooth devices when using them, so that they obtain certain access rights, thereby significantly improving the user experience.

[0151] Figure 8 The flowchart of authorization management of application programs in a communication device according to the Bluetooth communication method and system of the present invention is schematically shown.

[0152] like Figure 8 As shown, the user turns on the wireless Bluetooth device, establishes an ACL link connection with the communication device, and completes the pairing of the Bluetooth devices. Then, you can install and open the application associated with the wireless Bluetooth device on the communication device, and grant relevant permissions according to the interface prompts: grant access to contacts so that you can add, delete, modify, import, and export contact information simultaneously; grant access to phone and call records so that you can quickly display incoming call reminder information, call record query and dial functions; set the application as the default phone application to automatically pop up the answering interface for incoming calls, reducing the user's operations of opening and switching applications.

[0153] Based on the above, it can be seen that in the Bluetooth communication scheme for realizing end-to-end voice encryption of the present invention, with the help of a unique identity authentication design, the Bluetooth device performs identity authentication operation during the use period in a one-certificate-one-key manner, which can improve the security of communication in an efficient and reliable manner; each encrypted call applies for a new communication voice key required for this call from the quantum key service platform to encrypt the voice data, the key is generated on demand, has strong immediacy, high update frequency, and is safer to use, and the communication voice key and the authentication key both use quantum keys with true randomness, and can realize a highly secure end-to-end voice encryption transmission system in conjunction with the national secret standard algorithm. In addition, the communication voice data is encrypted and decrypted in the Bluetooth device, and is ciphertext in the transmission link outside the Bluetooth device, which can greatly improve the security of communication. It is only necessary to configure the corresponding application in the communication device to realize the encrypted communication function, so that there is no need to change the user's mobile phone number and address book contacts during use, and it is allowed to simply click / switch the encrypted call mode button to realize the switch between encryption / ordinary call mode when the Bluetooth device is connected, which can effectively simplify the use and improve the operating experience, without making any hardware changes to the communication device.

[0154] Compared with the prior art, in the Bluetooth communication scheme proposed by the present invention, it is not necessary to force users to set passwords for wireless Bluetooth devices, which reduces the difficulty of use and the pain of remembering passwords. When the wireless Bluetooth device uses the encryption mode, it will update the encryption key in real time from the quantum key service platform instead of using its own preset key to encrypt voice data. The receiving party will also obtain the corresponding decryption key from the quantum key service platform. The quantum key service platform not only provides highly secure quantum keys, but also adds a layer of identity authentication to both parties in communication, which greatly increases the key distribution security of each call, thereby ensuring the confidentiality of encrypted calls.

[0155] The quantum key generation mechanism adopted by the present invention is also completely independent of parameters such as wireless Bluetooth devices and user's personal settings. It has true randomness, is generated on demand during communication, has strong immediacy, requires no additional settings, and is more flexible and easy to use. The SM4 algorithm adopted is a symmetric cryptographic system, which has good adaptability to end-to-end voice communication scenarios, and the key is obtained from a trusted third party. Therefore, the two-way encrypted communication based on this can prove the trustworthiness of the identities of both parties in the communication. Neither untrusted eavesdropping third parties nor trusted eavesdropping third parties can obtain the call key, so that the wireless Bluetooth device can achieve truly high-security end-to-end encrypted communication. In addition, the present invention only needs to perform identity authentication once when the identity validity period expires, which greatly reduces the energy consumption of wireless Bluetooth devices.

[0156] In addition, after the user provides the necessary authorization, the present invention can synchronize the original device address book to the application, so that the user can open it and use it, and the application interface is similar to the native dialing and contact interface of the communication device, which greatly reduces the difficulty of user use. On the other hand, regardless of whether the two parties in the communication are people in the address book, as long as both parties use the wireless Bluetooth device and its associated application, ordinary calls or encrypted calls can be realized, which has broad application and promotion prospects.

[0157] It can be seen that the Bluetooth communication solution of the present invention has at least the following advantages:

[0158] 1. One password for each conversation, quantum protection, strong security

[0159] (a) Bluetooth headsets need to be authenticated during use, and a different key is used each time, which greatly enhances the security of identity authentication;

[0160] (b) Each time a call is encrypted, a new communication voice key required for this call is applied for from the quantum key service platform to encrypt the voice data. The key is generated on demand, has strong immediacy, is updated frequently, and is safer to use;

[0161] (c) The newly acquired communication voice key and the key pre-filled into the security module during the encrypted call are both from the quantum random number generator or the quantum key generated by the QKD device, which has true randomness and cooperates with the national secret standard algorithm to realize a highly secure end-to-end voice encryption transmission system;

[0162] (d) The user's voice data is encrypted in the Bluetooth headset on the user's end and decrypted in the Bluetooth headset on the other end. It is ciphertext in the communication device and the intermediate transmission link. The entire data transmission is end-to-end encrypted. No sensitive information such as keys is involved in the intermediate link. Even if criminals eavesdrop or intercept information in the middle, they can only get ciphertext, which greatly improves the security of communication.

[0163] 2. Humanized design, simple operation and good convenience

[0164] (a) The key positions of the wireless Bluetooth device can be set to be similar to those of conventional wireless Bluetooth devices, without any complicated operations such as additional password unlocking, and user acceptance is high.

[0165] (b) The application interface associated with the wireless Bluetooth device can be set to be similar to the dial-up and contact interfaces and operations of communication devices on the market. The user learning threshold is low, the interface design is reasonable, and the operation is simple.

[0166] (c) In the wireless Bluetooth device of the present invention, the user's mobile phone number and address book contacts can remain unchanged. When encrypted communication is required, the user only needs to connect the wireless Bluetooth device and click / switch the encrypted call mode button to enter the encrypted call mode. Clicking / switch the encrypted call mode button again can return to the normal call mode. There is no need to set too many identity verification codes, login passwords, etc., which effectively simplifies the use and improves the operating experience.

[0167] (d) Users can independently select the call mode before dialing and during a call. When a call comes in, the call answering interface can be automatically called up to quickly enter an encrypted call. Users do not need to repeatedly switch application interfaces to avoid misoperation that affects the user's communication process.

[0168] 3. No need to change the hardware configuration of the communication equipment, the communication mode is widely applicable

[0169] (a) To implement the encrypted communication scheme of the present invention, it is only necessary to optimize the design on the Bluetooth headset without making any hardware changes to the communication device;

[0170] (b) The solution can be extended to other communication devices that can be connected to the Bluetooth headset, or to other scenarios that rely on Bluetooth technology for communication, and has strong versatility and extensibility.

[0171] Those skilled in the art will appreciate that the present invention also proposes a Bluetooth device and a quantum key service platform suitable for use in the above-mentioned system and method.

[0172] Although the present invention has been described above through specific embodiments in conjunction with the accompanying drawings, those skilled in the art will readily recognize that the above embodiments are merely exemplary and are used to illustrate the principles of the present invention, and do not limit the scope of the present invention. Those skilled in the art may make various combinations, modifications and equivalent substitutions to the above embodiments without departing from the spirit and scope of the present invention.

Claims

1. A wireless Bluetooth communication method for implementing end-to-end voice encryption, wherein include: The identity authentication step is used to authenticate the Bluetooth device with the help of the quantum key service platform; The call mode switching step is used to allow the user to switch between the normal call mode and the encrypted call mode; The common communication step is used for generating communication data based on the collected analog voice signal by the calling party's Bluetooth device and transmitting the communication data to the answering party's Bluetooth device by means of the communication device in the common call mode, and recovering the analog voice signal from the communication data by the answering party's Bluetooth device; The communication voice key distribution step is used to distribute the communication voice key Km to the Bluetooth device of the caller and the Bluetooth device of the receiver by means of the quantum key service platform in the encrypted call mode after the Bluetooth device passes the identity authentication and a voice channel is established between the communication device of the caller and the communication device of the receiver; The encryption communication step is used for, in the encrypted call mode, the calling party's Bluetooth device generates a communication data ciphertext based on the collected analog voice signal by means of encryption processing based on the communication voice key Km and transmits it to the answering party's Bluetooth device by means of the communication device, and the answering party's Bluetooth device recovers the analog voice signal based on the communication data ciphertext by means of decryption processing based on the communication voice key Km; Among them, in the identity authentication step: The Bluetooth device generates an authentication request message and transmits it to the quantum key service platform through the communication device. The authentication request message includes its security module ID and the locally generated random number R 0 ; The quantum key service platform obtains the security module ID and random number R according to the identity authentication request message. 0 ; Determine the authentication key Kr according to the security module ID, wherein the security module of the Bluetooth device is pre-filled with the authentication key Kr by the quantum key service platform; Use the authentication key Kr to encrypt the challenge information to generate challenge data, and the challenge information includes a random number R 0 and a locally generated random number R 1 ; and, returning a challenge response to the Bluetooth device with the help of the communication device, the challenge response including information of the authentication key Kr, the security module ID, the quantum key service platform ID and the challenge data; After verifying the security module ID and quantum key service platform ID in the received challenge response, the Bluetooth device obtains the authentication key Kr locally based on the information of the authentication key Kr; the authentication key Kr is used to decrypt the challenge data to obtain the random number R 0 and R 1 ; The decrypted random number R 0 With the local random number R 0 The comparison is performed so that when the comparison is consistent, a response is generated and transmitted to the quantum key service platform through the communication device. The response is generated by encrypting the response information with the authentication key Kr. The response information includes a random number R 0 and R 1 ; The quantum key service platform uses the authentication key Kr to decrypt the response to obtain the response information, and then sends the decrypted random number R 1 With the local random number R 1 A comparison is performed to generate and return an authentication success message to the Bluetooth device via the communication device when they are consistent.

2. The wireless Bluetooth communication method according to claim 1, in, Switch between normal call mode and encrypted call mode by operating the Bluetooth device and / or the communication device.

3. The wireless Bluetooth communication method according to claim 1, in, In the call mode switching step, when one of the calling party and the answering party initiates the switch between the normal call mode and the encrypted call mode and sends a mode switching notification to the other of the calling party and the answering party, and the other of the calling party and the answering party returns a response of successful switching based on the mode switching notification, the switch between the normal call mode and the encrypted call mode is completed.

4. The wireless Bluetooth communication method according to claim 1, in, In the identity authentication step, at least one of the identity authentication request message, challenge information, challenge response and reply information is formed in a data splicing manner; and / or, at least one of the identity authentication request message, challenge information, challenge data, challenge response, reply information and reply response also includes at least one of a content summary, a timestamp and a sequence number.

5. The wireless Bluetooth communication method according to claim 1, in, The authentication success message includes an authentication token Token, which has a preset validity period.

6. The wireless Bluetooth communication method as described in claim 5 further comprises an identity authentication token updating step, which is used to update the identity authentication token Token by means of the identity authentication step when the identity authentication token Token expires.

7. The wireless Bluetooth communication method according to claim 5, in, In the communication voice key distribution step: The calling party's Bluetooth device sends its security module IDa and local random number Ra to the answering party's Bluetooth device with the help of the communication device, and the answering party's Bluetooth device sends its security module IDb and local random number Rb to the calling party's Bluetooth device with the help of the communication device; The calling party's Bluetooth device sends application parameters and its identity authentication token Token_a to the quantum key service platform through the communication device, and the answering party's Bluetooth device sends application parameters and its identity authentication token Token_b to the quantum key service platform through the communication device, where the application parameters include random numbers Ra and Rb, security modules IDa and IDb, and quantum key service platform IDc; After verifying the validity of the identity authentication tokens Token_a and Token_b, the quantum key service platform determines the session keys Ka and Kb according to the security modules IDa and IDb, generates a random number Rc and a quantum key Km, encrypts the quantum key Km with the session key Ka to generate a first key ciphertext Kam, encrypts the quantum key Km with the session key Kb to generate a second key ciphertext Kbm, performs summary calculation based on the first and second summary data to generate summary Ha and Hb, and returns the first and second data packets to the Bluetooth devices of the caller and the receiver via the communication device, respectively, wherein: the first summary number is The data includes the first key ciphertext Kam, random numbers Ra and Rc, security module IDb and quantum key service platform IDc, the second summary data includes the second key ciphertext Kbm, random numbers Rb and Rc, security module IDa and quantum key service platform IDc, the first data packet includes the first key ciphertext Kam, information of the session key Ka, summary Ha, random numbers Ra and Rc, security module IDb and quantum key service platform IDc, and the second data packet includes the second key ciphertext Kbm, information of the session key Kb, summary Hb, random numbers Rb and Rc, security module IDa and quantum key service platform IDc; The caller's Bluetooth device compares the random number Ra, security module IDb and quantum key service platform IDc in the received first data packet with the local random number Ra, security module IDb and quantum key service platform IDc, and after the digest generated by the digest calculation based on the first digest data in the received first data packet is verified with the received digest Ha, the session key Ka is obtained locally according to the information of the session key Ka in the received first data packet, and the first key ciphertext Kam is decrypted using the session key Ka to obtain the quantum key Km; and, The random number Rb, security module IDa and quantum key service platform IDc in the second data packet received by the Bluetooth device of the answering party are compared with the local random number Rb, security module IDa and quantum key service platform IDc, and after the summary calculated based on the second summary data in the received second data packet is verified with the received summary Hb, the session key Kb is obtained locally according to the information of the session key Kb in the received second data packet, and the second key ciphertext Kbm is decrypted using the session key Kb to obtain the quantum key Km.

8. The wireless Bluetooth communication method according to claim 7, in, The encrypted communication step includes a voice encryption and sending step and a voice decryption and playing step; In the voice encryption and transmission step, the Bluetooth device collects analog voice signals, performs analog-to-digital conversion and encoding on the analog voice signals to generate a voice data stream; The voice data stream is encrypted using the communication voice key Km to generate a voice ciphertext data stream; Modulating the voice ciphertext data stream into a voice-like signal to be sent out as communication data ciphertext; and / or, In the voice decryption and playback step, the Bluetooth device receives the voice-like signal and demodulates the voice-like signal into a voice ciphertext data stream; the voice ciphertext data stream is decrypted using the communication voice key Km to generate a voice data stream; Restore the analog voice signal based on the voice data stream for playback.

9. The wireless Bluetooth communication method according to claim 8, in, The voice encryption and sending step also includes the step of calculating and sending the summary of the voice ciphertext data stream, and the voice decryption and playing step also includes the step of verifying the summary of the voice ciphertext data stream.

10. The wireless Bluetooth communication method according to claim 9, in, In the voice encryption and sending step, the random number Rc is also used to calculate the summary of the voice ciphertext data stream. In the voice decryption and playback step, the random number Rc obtained in the communication voice key distribution step is also used to verify the summary of the voice ciphertext data stream.

11. A wireless Bluetooth communication system for implementing end-to-end voice encryption, comprising a Bluetooth device, a communication device and a quantum key service platform; The quantum key service platform is set up for the authentication of Bluetooth devices and the distribution of communication voice keys Km; The communication device and / or the Bluetooth device is configured to switch between a normal call mode and an encrypted call mode; in, The Bluetooth device is further configured to: In the normal call mode, communication data is generated based on the collected analog voice signal, and the analog voice signal is recovered from the received communication data; in the encrypted call mode, communication data ciphertext is generated based on the collected analog voice signal by means of encryption processing based on the communication voice key Km, and the analog voice signal is recovered from the received communication data ciphertext by means of decryption processing based on the communication voice key Km; as well as, Generate an identity authentication request message and transmit it to the quantum key service platform through a communication device. The identity authentication request message includes the security module ID and the locally generated random number R 0 ; Parse the received challenge response to obtain the information of the authentication key Kr, the security module ID, the quantum key service platform ID and the challenge data; verify the security module ID and the quantum key service platform ID obtained by the parsing, and obtain the authentication key Kr from the quantum key pre-filled in the security module according to the information of the authentication key Kr after the verification passes; use the authentication key Kr to decrypt the challenge data to obtain the random number R 0 and R 1 ;as well as , the decrypted random number R 0 With the local random number R 0 The comparison is performed, and when the comparison is consistent, a response is generated to be transmitted to the quantum key service platform through the communication device. The response is generated by encrypting the response information with the authentication key Kr. The response information includes a random number R 0 and R 1 ; and , the quantum key service platform is further configured to: Parse the identity authentication request message to obtain the security module ID and random number R 0 ; Determine the authentication key Kr according to the security module ID; Use the authentication key Kr to encrypt the challenge information to generate challenge data. The challenge information includes the random number R 0 and a locally generated random number R 1 ; Using the communication device, a challenge response is returned to the Bluetooth device, and the challenge response includes information of the authentication key Kr, the security module ID, the quantum key service platform ID and the challenge data; using the authentication key Kr to decrypt the response to obtain the response information; And, the decrypted random number R 1 With the local random number R 1 A comparison is performed, and when the comparison is consistent, an authentication success message is returned to the Bluetooth device with the help of the communication device.

12. The wireless Bluetooth communication system according to claim 11, in, The communication device includes an application for switching between a normal call mode and an encrypted call mode; and / or the Bluetooth device includes a button for switching between a normal call mode and an encrypted call mode.

13. The wireless Bluetooth communication system according to claim 11, in, The authentication success message includes an authentication token Token, which has a preset validity period.

14. The wireless Bluetooth communication system according to claim 13, in: The calling party's Bluetooth device sends its security module IDa and local random number Ra to the answering party's Bluetooth device with the help of the communication device, and the answering party's Bluetooth device sends its security module IDb and local random number Rb to the calling party's Bluetooth device with the help of the communication device; The calling party's Bluetooth device sends application parameters and its identity authentication token Token_a to the quantum key service platform through the communication device, and the answering party's Bluetooth device sends application parameters and its identity authentication token Token_b to the quantum key service platform through the communication device. The application parameters include random numbers Ra and Rb, security modules IDa and IDb, and quantum key service platform IDc; After verifying the validity of the identity authentication tokens Token_a and Token_b, the quantum key service platform determines the session keys Ka and Kb according to the security modules IDa and IDb, generates a random number Rc and a quantum key Km, encrypts the quantum key Km with the session key Ka to generate a first key ciphertext Kam, encrypts the quantum key Km with the session key Kb to generate a second key ciphertext Kbm, performs summary calculation based on the first and second summary data to generate summary Ha and Hb, and returns the first and second data packets to the Bluetooth devices of the caller and the receiver via the communication device, respectively, wherein: the first summary number is The data includes the first key ciphertext Kam, random numbers Ra and Rc, security module IDb and quantum key service platform IDc, the second summary data includes the second key ciphertext Kbm, random numbers Rb and Rc, security module IDa and quantum key service platform IDc, the first data packet includes the first key ciphertext Kam, information of the session key Ka, summary Ha, random numbers Ra and Rc, security module IDb and quantum key service platform IDc, and the second data packet includes the second key ciphertext Kbm, information of the session key Kb, summary Hb, random numbers Rb and Rc, security module IDa and quantum key service platform IDc; The caller's Bluetooth device compares the random number Ra, security module IDb and quantum key service platform IDc in the received first data packet with the local random number Ra, security module IDb and quantum key service platform IDc, and after the digest generated by the digest calculation based on the first digest data in the received first data packet is verified with the received digest Ha, the session key Ka is obtained locally according to the information of the session key Ka in the received first data packet, and the first key ciphertext Kam is decrypted using the session key Ka to obtain the quantum key Km; The random number Rb, security module IDa and quantum key service platform IDc in the second data packet received by the Bluetooth device of the answering party are compared with the local random number Rb, security module IDa and quantum key service platform IDc, and after the summary calculated based on the second summary data in the received second data packet is verified with the received summary Hb, the session key Kb is obtained locally according to the information of the session key Kb in the received second data packet, and the second key ciphertext Kbm is decrypted using the session key Kb to obtain the quantum key Km.

15. The wireless Bluetooth communication system according to claim 11, in, The Bluetooth device includes a microphone voice input module, a voice encryption module, a quasi-voice modulation module, a voice data transmission module, a voice data receiving module, a quasi-voice demodulation module, a voice decryption module, a speaker voice output module and a security module; The microphone voice input module is configured to collect analog voice signals, perform analog-to-digital conversion and encoding on the analog voice signals to generate a voice data stream; The voice encryption module is configured to encrypt the voice data stream to generate a voice ciphertext data stream; The voice-like modulation module is configured to modulate the voice ciphertext data stream into a voice-like signal; The voice data sending module is configured to send a voice-like signal outwardly based on a data channel or a Bluetooth channel; The voice data receiving module is configured to receive a voice-like signal; The quasi-speech demodulation module is configured to demodulate the received quasi-speech signal into a voice ciphertext data stream; The voice decryption module is configured to decrypt the voice ciphertext data stream to generate a voice data stream; The speaker voice output module is configured to generate an analog voice signal for playback based on the voice data stream; The security module is configured to provide an interactive interface for external quantum key operations and storage of the quantum key Km.

16. The wireless Bluetooth communication system according to claim 11, in, The communication device is provided with an application associated with the Bluetooth device, which is used for switching between the normal call mode and the encrypted call mode and / or authority management.

17. A wireless Bluetooth device, comprising a security module, and configured to be used in the wireless Bluetooth communication system according to any one of claims 11 to 16.

18. The wireless Bluetooth device according to claim 17, in, The security module includes a key storage module and an interactive interface module; The key storage module is configured to store the quantum key Km; The interactive interface module is configured to provide an interactive interface for quantum key operations to the outside according to the GM / T 0016 national cryptographic industry standard.

19. The wireless Bluetooth device as claimed in claim 17, comprising a key for switching between a normal call mode and an encrypted call mode.

Images