Encryption method, decryption method, device and equipment

Abstract

The embodiments of the present application provide an encryption method, a decryption method, a device and an apparatus. The encryption method includes: obtaining an encryption initialization vector based on a first timestamp; encrypting the data to be encrypted in the original message by using the encryption initialization vector to obtain encrypted data; sending an encrypted message to a second device, or broadcasting an encrypted message, the encrypted message carrying the encrypted data and time data determined based on the first timestamp. The technical solution provided by the embodiments of the present application, since the first timestamp has the characteristics of large variation span and irregularity, the encryption initialization vector generated based on the first timestamp also has the above characteristics. By encrypting the data to be encrypted by the encryption initialization vector having the above characteristics, the probability of the encrypted message being cracked by an illegal device can be reduced, thereby improving the security of the encrypted message.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data encryption technology, and in particular to an encryption method, a decryption method, a device and an apparatus. Background Art

[0002] Data encryption refers to converting plain text into meaningless cipher text through a key and an encryption function. In related technologies, the encryption parameters used by a device to encrypt data include: encryption key, encryption initialization vector, encryption algorithm, etc. The above encryption parameters are negotiated and set by the above device and the device receiving the encrypted message.

[0003] Data encryption can ensure data security to a certain extent, but some current data encryption applications still have some security issues. Summary of the invention

[0004] The embodiments of the present application provide an encryption method, a decryption method, a device and an apparatus. The technical solution is as follows:

[0005] On the one hand, an embodiment of the present application provides an encryption method, applied to a first device, the method comprising:

[0006] Acquire an encryption initialization vector based on a first timestamp, where the first timestamp is determined based on a timestamp when the first device generates an encrypted message;

[0007] The data to be encrypted in the original message is encrypted by using the encryption initialization vector to obtain encrypted data;

[0008] Send an encrypted message to the second device, or broadcast an encrypted message; wherein the encrypted message carries the encrypted data and time data determined based on the first timestamp.

[0009] On the other hand, an embodiment of the present application provides a decryption method, applied to a second device, the method comprising:

[0010] receiving an encrypted message sent or broadcast by the first device, the encrypted message carrying encrypted data and time data determined based on the first timestamp;

[0011] Acquire a decryption initialization vector according to a timestamp when the second device receives the encrypted message and the time data;

[0012] The encrypted data is decrypted using the decryption initialization vector to obtain the data to be encrypted in the original message.

[0013] On the other hand, an embodiment of the present application provides an encryption device, the device comprising:

[0014] A first acquisition module, configured to acquire an encryption initialization vector by the first timestamp, wherein the first timestamp is determined based on a timestamp when the first device generates an encrypted message;

[0015] An encryption module, used to encrypt the data to be encrypted in the original message by using the encryption initialization vector to obtain encrypted data;

[0016] A message sending module is used to send an encrypted message to a second device, or to broadcast an encrypted message; wherein the encrypted message carries the encrypted data and time data determined based on the first timestamp.

[0017] In another aspect, an embodiment of the present application provides a decryption device, the device comprising:

[0018] A message receiving module, configured to receive an encrypted message sent or broadcast by a first device, wherein the encrypted message carries encrypted data and time data determined based on a first timestamp;

[0019] A second acquisition module, configured to acquire a decryption initialization vector according to a timestamp when the second device receives the encrypted message and the time data;

[0020] The decryption module is used to decrypt the encrypted data using the decryption initialization vector to obtain the data to be encrypted in the original message.

[0021] On the other hand, an embodiment of the present application provides a computer device, which includes a Bluetooth chip, and the Bluetooth chip stores computer instructions, and the computer instructions are used to execute the above-mentioned encryption method or decryption method.

[0022] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. The computer program is loaded and executed by a processor to implement the encryption method or decryption method as described above.

[0023] On the other hand, an embodiment of the present application provides a computer program product, which includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above-mentioned encryption method or decryption method.

[0024] The technical solution provided in the embodiments of the present application can bring at least the following beneficial effects:

[0025] By obtaining an encryption initialization vector according to a first timestamp provided by a first device, and then encrypting the data to be encrypted based on the above encryption initialization vector, since the first timestamp has the characteristics of large variation span and irregularity, the encryption initialization vector generated based on the first timestamp also has the above characteristics. By encrypting the data to be encrypted with the encryption initialization vector with the above characteristics, the probability of the encrypted message being cracked by an illegal device can be reduced, thereby improving the security of the encrypted message. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0027] Figure 2 is a schematic diagram of an encryption and decryption process provided by an embodiment of the present application;

[0028] Figure 3 is a flow chart of an encryption method provided by an embodiment of the present application;

[0029] Figure 4 is a flowchart of a decryption method provided by an embodiment of the present application;

[0030] Figure 5 is a flow chart of a time calibration method provided by an embodiment of the present application;

[0031] Figure 6 is a flow chart of a time calibration method provided by an embodiment of the present application;

[0032] Figure 7 is a block diagram of an encryption device provided by an embodiment of the present application;

[0033] Figure 8 is a block diagram of a decryption device provided by an embodiment of the present application;

[0034] Fig. 9 It is a block diagram of a computer device provided by one embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0036] Figure 1 A schematic diagram of an implementation environment provided by an embodiment of the present application is shown. The implementation environment includes: a first device 11 and a second device 12.

[0037] The first device 11 is a sending device of the broadcast message, and the broadcast message is broadcast in the form of a Bluetooth Beacon. The first device 11 can be a smart phone, a tablet computer, a smart home appliance (such as a smart speaker, a smart refrigerator, a smart air conditioner, etc.), a wearable smart device (such as smart glasses, a smart watch, etc.), a smart sensor (such as a temperature sensor, a door and window sensor, etc.), and the embodiment of the present application does not limit the device type of the first device 11.

[0038] The first device has a data encryption function. The first device 11 encrypts the data to be encrypted in the original message through the data encryption function to obtain the encrypted data, and then sends an encrypted message carrying the encrypted data to other devices. The encryption algorithms used in the encryption process include but are not limited to the Data Encryption Standard (DES) algorithm, the Triple Data Encryption Algorithm (3DES) algorithm, the Advanced Encryption Standard (AES) algorithm, etc. In the embodiment of the present application, only the encryption algorithm AES algorithm is used as an example for explanation.

[0039] In the embodiment of the present application, the encryption parameters involved in the encryption process include, in addition to the key, an encryption initialization vector generated based on the initialization vector and the first timestamp determined based on the current timestamp of the first device 11. Since the first timestamp has the characteristics of large variation span and irregularity, the encryption initialization vector generated based on the timestamp also has the above characteristics. By encrypting the encrypted data with the encryption initialization vector having the above characteristics, the probability of the encrypted message being cracked by an illegal device can be reduced, thereby improving the security of the encrypted message. In addition, the key and the initialization vector are determined by negotiation between the first device 11 and the second device 12. Optionally, the first device 11 and the second device 12 negotiate and determine the key and the initialization vector during the network configuration process.

[0040] The second device 12 is a receiving device for broadcast messages. The second device 12 may be a smart phone, a tablet computer, a smart home appliance (such as a smart speaker, a smart refrigerator, a smart air conditioner, etc.), a wearable smart device (such as smart glasses, a smart watch, etc.), or a smart sensor (such as a temperature sensor, a door and window sensor, etc.). The embodiment of the present application does not limit the device type of the second device 12.

[0041] The second device 12 has a data decryption function. After receiving the encrypted message, the second device 12 decrypts the encrypted data carried in the encrypted message through the data decryption function to obtain the data to be encrypted in the original message. The decryption process is the reverse process of the encryption process, and the decryption algorithm involved is actually determined according to the algorithm used by the first device 11. For example, the first device 11 uses the AES encryption algorithm to encrypt the data to be encrypted to obtain the encrypted data, and the second device 12 uses the AES decryption algorithm to decrypt the encrypted data to obtain the data to be encrypted.

[0042] In the embodiment of the present application, the decryption parameters involved in the decryption process include, in addition to the key, a decryption initialization vector generated based on the current timestamp of the second device 12 and the first timestamp. The decryption initialization vector is the same as the encryption initialization vector.

[0043] like Figure 1 As shown, the first device 11 is a smart home appliance and the second device 12 is a smart phone for exemplary description.

[0044] In the embodiment of the present application, a cloud 13 may also be included. The cloud 13 is a server that manages Bluetooth devices (including the first device 11 and the second device 12). The user can use the second device 12 to register a family account in the cloud 13, and the first device 11 and the second device 12 are both added to the family account. A family communication network is formed between the first device 11 and the second device 12, and Bluetooth communication can be performed between the devices through the family communication network. It can be understood that the functions provided by the cloud 13 can also be implemented locally, and the embodiment of the present application does not limit this.

[0045] Exemplarily, the cloud 13 assigns a home address to the family account. The broadcast message sent by the first device may carry the home address, so that the broadcast message can be obtained by the second device 12 or other devices in the home communication network.

[0046] In the related art, since the encryption initialization vector is negotiated and set by the encryption party and the decryption party, it is usually fixed, which makes the encrypted message easy to be cracked by illegal devices and has low security.

[0047] Based on this, an embodiment of the present application provides an encryption scheme, which obtains an encryption initialization vector based on a first timestamp provided by a first device, and then encrypts the encrypted data based on the above encryption initialization vector. Since the first timestamp has the characteristics of large variation span and irregularity, the encryption initialization vector generated based on the first timestamp also has the above characteristics. By encrypting the encrypted data with the encryption initialization vector with the above characteristics, the probability of the encrypted message being cracked by an illegal device can be reduced, thereby improving the security of the encrypted message.

[0048] Figure 2 A schematic diagram of the encryption and decryption process provided by an embodiment of the present application is shown. The first device is a smart air conditioner, and the second device is a smart phone. The first device determines an encryption initialization vector and time data carried in the original message according to its own current timestamp, and then encrypts the plaintext in the original message through the encryption initialization vector to obtain an encrypted message. After the encrypted message is sent to the second device, the second device determines a decryption initialization vector according to its own current timestamp and time data, and decrypts the ciphertext in the encrypted message through the decryption initialization vector to obtain the original message.

[0049] Figure 3 A flowchart of an encryption method provided by an embodiment of the present application is shown. The method is applied to Figure 1 The first device 11 in the embodiment. The method comprises:

[0050] Step 301: Obtain an encryption initialization vector based on a first timestamp.

[0051] The first timestamp is determined based on the timestamp when the first device generates the encrypted message. In one example, the first timestamp is also the timestamp when the first device generates the encrypted message. In another example, the second timestamp is determined based on the timestamp when the first device generates the encrypted message and a preset time difference, and the preset time difference is set by the first device by default, and can also be set by user. The encryption initialization vector refers to the initialization vector used in the encryption process.

[0052] In an embodiment of the present application, the first device determines an encryption initialization vector based on the current timestamp of the first device, and then encrypts the data to be encrypted based on the encryption initialization vector. Since the first timestamp has the characteristics of large variation span and irregularity, the encryption initialization vector generated based on the first timestamp also has the above characteristics. By encrypting the data to be encrypted with the encryption initialization vector having the above characteristics, the probability of the encrypted message being cracked by an illegal device can be reduced, thereby improving the security of the encrypted message.

[0053] Optionally, step 301 includes the following sub-steps:

[0054] Step 301a: encode the first timestamp according to a preset format to obtain a first encoded timestamp.

[0055] The preset format refers to a format that is allowed to be recognized and parsed by the first device and the device receiving the encrypted message. Optionally, the preset format is negotiated and set by the first device and the device receiving the encrypted message. Exemplarily, the preset format is a network coding sequence.

[0056] Step 301b: If the number of bits included in the first encoded timestamp is less than the number of bits included in the initialization vector, padding is performed on the first encoded timestamp to obtain a first padded timestamp.

[0057] The initialization vector is pre-agreed upon by the first device and the device receiving the encrypted message.

[0058] The padding process refers to increasing the number of bits included in the first encoded timestamp so that the number of bits included in the first encoded timestamp is the same as the number of bits included in the initialization vector.

[0059] Optionally, the first device first calculates the difference between the number of bits included in the first encoded timestamp and the number of bits included in the initialization vector, and then fills a set value at a specified position of the first encoded timestamp, and the filled amount is also the above difference.

[0060] The above-mentioned designated position is set by default by the first device, or is set by negotiation between the first device and the device receiving the encrypted message. For example, before the first bit of the first encoded timestamp, or after the last bit of the first encoded timestamp. The set value is also set by default by the first device, or is set by negotiation between the first device and the device receiving the encrypted message, such as 0 or 1.

[0061] Exemplarily, the first encoded timestamp includes 8 bits, which is 10111011, and the initialization vector includes 13 bits. The first device calculates that the difference between the number of bits included in the first encoded timestamp and the number of bits included in the initialization vector is 5, and then adds 5 zeros after the last bit of the first encoded timestamp to obtain 1011101100000. At this time, the number of bits included in the first encoded timestamp is the same as the number of bits included in the initialization vector.

[0062] If the number of bits included in the first encoded timestamp is equal to the number of bits included in the initialization vector, the first encoded timestamp is directly determined as the first padded timestamp.

[0063] Step 301c, performing a logical operation on the first padded timestamp and the initialization vector to obtain an encrypted initialization vector.

[0064] Optionally, the first device performs an XOR operation on the first padded timestamp and the initialization vector to obtain an encrypted initialization vector. Exemplarily, the first padded timestamp is 1100101011001, and the first padded timestamp is 1011101100000. The two are XORed to obtain an encrypted initialization vector of 0111000111001.

[0065] Step 302: encrypt the data to be encrypted in the original message by using the encryption initialization vector to obtain encrypted data.

[0066] The original message includes data to be encrypted. Table 1 exemplarily shows the data structure of the original message.

[0067] Table-1

[0068]

[0069] As shown in Table 1, the original message carries a header (Head Flag), a device address (Address), time data (Msgtime), plain text (ciphertext), a message integrity code (Message Integrity Code, MIC), etc.

[0070] The packet header is used to indicate the attribute information of the first device and the original message, such as whether the first device has completed the network configuration, whether the original message is encrypted, etc. The device address is the network address of the first device. When the first device is a Bluetooth device, the device address is the home device address assigned when the Bluetooth device is configured with the gateway device. The timestamp is the time data determined based on the first timestamp in step 301. The plaintext is the data to be encrypted, which is empty data or business data. When the original message is a device discovery broadcast, the data to be encrypted is empty data. When the original message is a business message, the data to be encrypted is business data.

[0071] The encryption parameters used in the encryption process include, in addition to the encryption initialization vector, an encryption algorithm and an encryption key. The encryption algorithm includes but is not limited to: a DES algorithm, a 3DES algorithm, and an AES algorithm. In the embodiment of the present application, only the AES algorithm is used as an example for explanation. The encryption key is also negotiated and set by the first device and the device receiving the encrypted message. Exemplarily, the Bluetooth device and the gateway device negotiate and determine the encryption key during the network configuration process.

[0072] Optionally, the first device executes the following code to encrypt the data to be encrypted: AES_CCM_Encrypt(key=beacon_key, iv=xx, aad=data from Head Flags (inclusive) to Address (inclusive), in=plaintext, tag=MIC).

[0073] As shown in the above code, the encryption key is beacon_key, the encryption initialization vector is xx, and the packet header and device address are additional authentication data (ADD), that is, data provided to the device receiving the encrypted message for the device to verify the identity information of the first device, without encryption. The data to be encrypted is plain text. The identifier is the message integrity code.

[0074] Step 303: Send the encrypted message to the second device, or broadcast the encrypted message.

[0075] The encrypted message carries the encrypted data and time data determined based on the first timestamp.

[0076] Optionally, the number of bits included in the time data is determined based on whether the original message carries business data, and the first one or both of the number of bits included in the business data. For example, if the original message carries business data, the number of bits included in the time data is smaller, and if the original message does not carry business data, the number of bits included in the time data is larger. For another example, if the original message carries more business data, the number of bits included in the time data is smaller, and if the original message carries less business data, the number of bits included in the time data is larger.

[0077] Optionally, if the data to be encrypted includes business data, the time data is the lower n bits of the first timestamp, where n is less than the number of bits included in the first timestamp and n is a positive integer.

[0078] The number of bits included in the first timestamp is 64, that is, 8 bytes. n is set by default by the first device, or is set by negotiation between the first device and the device receiving the encrypted message (such as the second device). Exemplarily, n is 8, that is, the time data is one byte. In the above manner, the number of bytes of the time data is reduced, so that the original message can carry more business data, and the data transmission efficiency is improved.

[0079] Optionally, if the data to be encrypted does not carry business data, the time data is a first timestamp.

[0080] Correspondingly, the second device receives the encrypted message sent by the first device, or the second device receives the encrypted message broadcast by the first device.

[0081] Optionally, the first device performs time calibration on its own time before executing step 201. The difference between the time of the first device after the time calibration and the reference time is less than a preset threshold. The preset threshold is set according to actual experience and is not limited in the embodiment of the present application.

[0082] Since the second device needs to calculate the decryption initialization vector based on the time data and decrypt according to the decryption initialization vector, when the time of the first device is inaccurate, the second device fails to decrypt because it cannot accurately restore the encryption initialization vector. To avoid this situation, the time of the first device needs to be corrected. In summary, the technical solution provided by the embodiment of the present application obtains the encryption initialization vector according to the first timestamp provided by the first device, and then encrypts the encrypted data based on the above encryption initialization vector. Since the first timestamp has the characteristics of large variation span and irregularity, the encryption initialization vector generated based on the first timestamp also has the above characteristics. By encrypting the encrypted data with the encryption initialization vector having the above characteristics, the probability of the encrypted message being cracked by an illegal device can be reduced, thereby improving the security of the encrypted message.

[0083] The probability of decryption failure of the second device is also reduced by performing time calibration on the first device.

[0084] Figure 4 A flowchart of a decryption method according to an embodiment of the present application is shown. The method is applied to Figure 1 The method comprises:

[0085] Step 401: receiving an encrypted message sent or broadcast by a first device.

[0086] The encrypted message carries the encrypted data and time data determined based on the first timestamp.

[0087] Step 402: Obtain a decryption initialization vector according to the timestamp and time data when the second device receives the encrypted message.

[0088] The decryption initialization vector refers to the initialization vector used in the decryption process, which is the same as the encryption initialization vector. In the embodiment of the present application, the second device obtains the decryption initialization vector according to the timestamp and time data when it receives the encrypted message.

[0089] Optionally, step 402 includes the following sub-steps:

[0090] Step 402a, determining a second timestamp according to the timestamp and time data when the second device receives the encrypted message.

[0091] Optionally, the second device determines at least two candidate timestamps according to the timestamp and time data when the second device receives the encrypted message, and then determines the candidate timestamp closest to the timestamp when the second device receives the encrypted message as the second timestamp. Exemplarily, the timestamp when the second device receives the encrypted message is 14:27:30, and the at least two candidate timestamps are 14:26:14, 14:27:14, and 14:28:14, respectively, and the second device determines 14:27:14 as the second timestamp.

[0092] In a possible implementation, when the time data is the lower n bits of data in the first timestamp, step 402a is implemented as the following steps 402a1-402a3.

[0093] Step 402a1, replacing the lower n bits of the timestamp when the second device receives the encrypted message with the time data to obtain a first candidate timestamp;

[0094] Exemplarily, the timestamp when the second device receives the encrypted message is 14:27:30, and the lower n bits of the timestamp when the first device receives the encrypted message are 14, then the first candidate timestamp is 14:27:14.

[0095] Step 402a2, carry the high m bits of the timestamp when the second device receives the encrypted message, and replace the low n bits of the timestamp when the second device receives the encrypted message with the time data, to obtain a second candidate timestamp;

[0096] The high m bits of data are the data in the timestamp when the second device receives the encrypted message except the low n bits of data, where m is a positive integer. Carrying means increasing the high m bits of the timestamp when the second device receives the encrypted message by a first predetermined value, and the first predetermined value is determined according to the number system adopted by the second device. For example, if the number system adopted by the second device is decimal, the first predetermined value is 1. For another example, if the number system adopted by the second device is binary, the first predetermined value is 246.

[0097] Exemplarily, the timestamp when the second device receives the encrypted message is 14:27:30. The high m bits of the timestamp when the second device receives the encrypted message are carried over to get 14:28:30. The low n bits of the timestamp when the first device receives the encrypted message are 14, so the first candidate timestamp is 14:28:14.

[0098] Step 402a3, abdicate the high m bits of the timestamp when the second device receives the encrypted message, and replace the low n bits of the timestamp when the second device receives the encrypted message with the time data to obtain a third candidate timestamp.

[0099] Delinquency refers to reducing the high m bits of the timestamp when the second device receives the encrypted message by a second predetermined value, and the second predetermined value is determined according to the number system adopted by the second device. For example, the number system adopted by the second device is decimal, and the second predetermined value is 1. For another example, the number system adopted by the second device is binary, and the second predetermined value is 246. Exemplarily, the timestamp when the second device receives the encrypted message is 14:27:30, and the high m bits of the timestamp when the second device receives the encrypted message are carried to obtain 14:26:30. The low n bits of the timestamp when the first device receives the encrypted message are 14, and the first candidate timestamp is 14:26:14.

[0100] In other possible implementations, when the time data is a first timestamp, the time data is directly determined as a second timestamp.

[0101] Step 402b: encode the second timestamp according to a preset format to obtain a second encoded timestamp.

[0102] Step 402c: if the number of bits included in the second encoded timestamp is less than the number of bits included in the initialization vector, padding is performed on the second encoded timestamp to obtain a second padded timestamp.

[0103] The number of bits included in the second padded timestamp is the same as the number of bits included in the initialization vector.

[0104] Step 402d, performing a logical operation on the second padded timestamp and the initialization vector to obtain a decryption initialization vector.

[0105] Optionally, the second device performs an XOR operation on the second padded timestamp and the initialization vector to obtain a decryption initialization vector.

[0106] The explanation of steps 402b-402d refers to steps 301a-301c, which are not repeated here.

[0107] Step 403: decrypt the encrypted data using the decryption initialization vector to obtain the data to be encrypted in the original message.

[0108] The decryption parameters used in the decryption process include, in addition to the decryption initialization vector, a decryption algorithm and a decryption key. The decryption algorithm is determined according to the encryption algorithm. The decryption key is also negotiated and set by the first device and the device receiving the encrypted message.

[0109] Optionally, the second device executes the following code to encrypt the data to be encrypted: AES_CCM_Decrypt(key=beacon_key, iv=xx, aad=data from Head Flags (inclusive) to Address (inclusive), in=ciphertext, tag=MIC).

[0110] As shown in the above code, the decryption key is beacon_key, the decryption initialization vector is xx, and the packet header and device address are additional authentication data (ADD), that is, data for the second device to verify the identity information of the first device, and no decryption is required. The data to be encrypted is ciphertext. The identifier is the message integrity code.

[0111] Optionally, when the time data is the lower n bits of the first timestamp, if the second device fails to decrypt the encrypted data using the decryption initialization vector, the encrypted message is discarded.

[0112] When an illegal device copies an encrypted message and sends the copied encrypted message to a second device at a time after the first timestamp, the decryption initialization vector determined by the second device is different from the encryption initialization vector, which will cause decryption failure. Therefore, the second device directly discards the encrypted message when decryption fails, effectively resisting replay attacks.

[0113] To sum up, the technical solution provided in the embodiment of the present application obtains an encryption initialization vector according to the first timestamp provided by the first device, and then encrypts the encrypted data based on the above encryption initialization vector. Since the first timestamp has the characteristics of large variation span and irregularity, the encryption initialization vector generated based on the first timestamp also has the above characteristics. By encrypting the encrypted data with the encryption initialization vector with the above characteristics, the probability of the encrypted message being cracked by an illegal device can be reduced, thereby improving the security of the encrypted message.

[0114] In summary, when the time data is the lower n bits of the first timestamp, if the decryption fails, the corresponding encrypted message is discarded, thereby effectively resisting replay attacks.

[0115] Since the encryption initialization vector used in the encryption process is determined based on the first timestamp, when the first device initiates the time calibration process after establishing a binding relationship or when it is powered on again after power failure, the second device can determine whether the time of the first device is accurate based on the first timestamp and its own current timestamp when decrypting the encrypted time calibration request message. Figure 5 Explain the process.

[0116] Step 501: A first device obtains an encryption initialization vector based on a first timestamp.

[0117] Step 502: The first device encrypts the timing request message by using an encryption initialization vector to obtain an encrypted timing request message.

[0118] The time correction request broadcast is used to request correction of the time of the first device. The time correction request broadcast carries a packet header, a device address, a first timestamp, plain text, and a message integrity code.

[0119] Step 503: The first device broadcasts an encrypted time synchronization request message.

[0120] In one possible implementation, the first device broadcasts the encrypted time synchronization request message after establishing a binding relationship with other devices (eg, a gateway device). In another possible implementation, the first device broadcasts the encrypted time synchronization request message when it is powered on again after power failure.

[0121] Optionally, the timing parameters are determined according to the power consumption of the first device. The above-mentioned timing window includes a first time interval, a timing window, a second time interval, etc. The first time interval is the time interval between two adjacent initiations of the timing process of the first device. The timing window is a time window for broadcasting an encrypted timing request message. The second time interval is the time interval between two adjacent broadcasts of an encrypted timing request message.

[0122] Optionally, the first time interval is positively correlated with the power consumption of the first device, that is, the greater the power consumption of the first device, the longer the first time interval; and the smaller the power consumption of the first device, the smaller the first time interval.

[0123] Optionally, the timing window is negatively correlated with the power consumption of the first device, that is, the smaller the power consumption of the first device, the larger the timing window; and the larger the power consumption of the first device, the smaller the timing window.

[0124] Optionally, the second time interval is positively correlated with the power consumption of the first device, that is, the smaller the power consumption of the first device, the smaller the second time interval; and the larger the power consumption of the first device, the larger the second time interval.

[0125] In one example, the first time interval is 30 minutes, the time window is 15 seconds, and the second time interval is 200 milliseconds. In another example, the first time interval is flexibly set according to the number of time interval initiations, such as the first time interval is 30 seconds, the second time interval is 1 minute, the third time interval is 2 minutes, and the latter time interval is twice the previous time interval, until the first time interval is 30 minutes.

[0126] Step 504: When the second device scans the encrypted time synchronization request message broadcast by the first device, the second device decrypts the encrypted time synchronization request message according to the first timestamp carried in the encrypted time synchronization request message.

[0127] Step 505: If the decryption is successful, but the difference between the first timestamp and the timestamp when the second device scans the encrypted timing request message is greater than a preset threshold, a timing process for the first device is initiated according to the encrypted timing request message.

[0128] The preset threshold is set according to the time accuracy requirement, and the embodiment of the present application does not limit this. If the difference between the first timestamp and the timestamp when the second device receives the encrypted message is greater than the preset threshold, it means that the time of the second device is significantly different from that of the first device, so it is necessary to initiate a time calibration process for the first device.

[0129] Optionally, if the difference between the first timestamp and the timestamp when the second device receives the encrypted message is less than a preset threshold, the second timestamp is used to decrypt the encrypted timing request message. If the decryption fails, the timing process for the first device is initiated according to the encrypted timing request message.

[0130] Optionally, before sending the time synchronization response message, the second device first determines whether to establish a communication connection with the first device. If the two have not established a communication connection, the second device sends a connection establishment request to the first device, and the first device establishes a communication connection with the second device according to the connection establishment request. After the communication connection is established, the second device returns a time synchronization response message to the first device through the communication connection; or, after the communication connection is established, the first device sends a time synchronization request to the second device through the communication connection, and the second device returns a time synchronization response message through the communication connection according to the time synchronization request.

[0131] The timing process is as follows: the second device establishes a communication connection with the first device, the second device sends a timing command to the first device, the timing command carries the timing time, and after the first device receives the timing command, it performs time calibration according to the timing time carried in the timing command.

[0132] Figure 6 A flowchart of calibrating the time of a first device according to an embodiment of the present application is shown. The method comprises the following steps:

[0133] Step 601, after the first device completes binding, or after the first device is powered off and then powered on, it broadcasts an encrypted time synchronization request message.

[0134] Step 602: After the second device scans the encrypted time synchronization request broadcast, it decrypts the encrypted time synchronization request message according to the first timestamp carried in the encrypted time synchronization request message.

[0135] Step 603: If the decryption is successful and the difference between the second timestamp and the timestamp when the second device scans the encrypted timing request message is greater than a preset threshold, a connection timing is initiated.

[0136] Step 604: The first device establishes a communication connection with the second device.

[0137] Step 605: The first device sends a time synchronization request to the second device.

[0138] Step 606: The second device sends a time calibration response to the first device, where the time calibration response carries the time calibration time.

[0139] Step 607: The first device completes time calibration according to the calibration time.

[0140] Step 608: The first device disconnects the communication connection with the second device.

[0141] Optionally, the encryption scheme provided in the embodiment of the present application is applied to the field of Internet of Things (IOT), in which case the first device is a Bluetooth device and the second device is a mobile terminal. The encryption method comprises the following steps:

[0142] Step 61: Obtain an encryption initialization vector based on the first timestamp.

[0143] The first timestamp is the timestamp when the Bluetooth device generates the encrypted message.

[0144] Step 62: encrypt the data to be encrypted in the original message by using the encryption initialization vector to obtain encrypted data.

[0145] Step 63: Send the encrypted message to the mobile terminal, or broadcast the encrypted message.

[0146] The encrypted message carries the encrypted data and the time data determined based on the first timestamp. Accordingly, the decryption method further includes the following steps:

[0147] Step 64: Receive the encrypted message sent or broadcast by the Bluetooth device.

[0148] The encrypted message carries the encrypted data and time data determined based on the first timestamp.

[0149] Step 65, obtaining a decryption initialization vector according to the timestamp and time data when the mobile terminal receives the encrypted message.

[0150] Step 66, decrypt the encrypted data using the decryption initialization vector to obtain the data to be encrypted in the original message.

[0151] The following is an embodiment of the device of the present application. For parts not described in detail in the embodiment of the device, reference may be made to the technical details disclosed in the above method embodiment.

[0152] Figure 7 A block diagram of an encryption device provided by an exemplary embodiment of the present application is shown. The encryption device can be implemented as all or part of a terminal through software, hardware, or a combination of both. The encryption device includes:

[0153] The first acquisition module 701 is configured to acquire an encryption initialization vector based on the first timestamp. The first timestamp is determined based on a timestamp when the first device generates an encrypted message.

[0154] The encryption module 702 is used to encrypt the data to be encrypted in the original message by using the encryption initialization vector to obtain encrypted data.

[0155] The message sending module 703 is used to send the encrypted message to the second device, or broadcast the encrypted message; wherein the encrypted message carries the encrypted data and time data determined based on the first timestamp.

[0156] To sum up, the technical solution provided in the embodiment of the present application obtains an encryption initialization vector according to the first timestamp provided by the first device, and then encrypts the encrypted data based on the above encryption initialization vector. Since the first timestamp has the characteristics of large variation span and irregularity, the encryption initialization vector generated based on the first timestamp also has the above characteristics. By encrypting the encrypted data with the encryption initialization vector with the above characteristics, the probability of the encrypted message being cracked by an illegal device can be reduced, thereby improving the security of the encrypted message.

[0157] Based on Figure 7 In an optional embodiment provided by the illustrated embodiment, the first acquisition module 702 is used to:

[0158] Encode the first timestamp according to a preset format to obtain a first encoded timestamp;

[0159] If the number of bits included in the first encoded timestamp is less than the number of bits included in the initialization vector, padding the first encoded timestamp to obtain a first padded timestamp, where the number of bits included in the first padded timestamp is the same as the number of bits included in the initialization vector;

[0160] A logical operation is performed on the first padded timestamp and the initialization vector to obtain the encryption initialization vector.

[0161] Optionally, the first acquisition module 702 is configured to perform an XOR operation on the first padded timestamp and the initialization vector to obtain the encrypted initialization vector.

[0162] Based on Figure 7 In an optional embodiment provided by the illustrated embodiment, when the data to be encrypted includes business data, the time data is the lower n bits of the first timestamp, and n is less than the number of bits included in the first timestamp;

[0163] When the data to be encrypted does not include business data, the time data is the first timestamp.

[0164] Based on Figure 7 In an optional embodiment provided by the illustrated embodiment, the device further comprises: a first time calibration module ( Figure 7 not shown).

[0165] The first time calibration module is used to: perform time calibration processing on the time of the first device, so that the error between the time of the first device after the time calibration processing and the reference time is less than a preset threshold.

[0166] Based on Figure 7 In an optional embodiment provided by the illustrated embodiment, the first device is a Bluetooth device, and the second device is a mobile terminal;

[0167] The first acquisition module 701 is used to acquire an encryption initialization vector based on a first timestamp, where the first timestamp is a timestamp when the Bluetooth device generates an encrypted message.

[0168] The encryption module 702 is used to encrypt the data to be encrypted in the original message by using the encryption initialization vector to obtain encrypted data.

[0169] The message sending module 703 is used to send an encrypted message to the mobile terminal, or broadcast an encrypted message; wherein the encrypted message carries the encrypted data and time data determined based on the first timestamp.

[0170] Figure 8 A block diagram of a decryption device provided by an exemplary embodiment of the present application is shown. The decryption device can be implemented as all or part of a terminal through software, hardware, or a combination of both. The decryption device includes:

[0171] The message receiving module 801 is used to receive an encrypted message sent by a first device, where the encrypted message carries encrypted data and time data determined based on a first timestamp.

[0172] The second acquisition module 802 is configured to acquire a decryption initialization vector according to a timestamp when the second device receives the encrypted message and the first timestamp.

[0173] The decryption module 803 is used to decrypt the encrypted data using the decryption initialization vector to obtain the data to be encrypted in the original message.

[0174] Based on Figure 8 In the optional embodiment provided by the illustrated embodiment, the second acquisition module 802 is used to:

[0175] determining a second timestamp according to a timestamp when the second device receives the encrypted message and the time data;

[0176] Encode the second timestamp according to a preset format to obtain a second encoded timestamp;

[0177] If the number of bits included in the second encoded timestamp is less than the number of bits included in the initialization vector, padding the second encoded timestamp to obtain a second padded timestamp, where the number of bits included in the second padded timestamp is the same as the number of bits included in the initialization vector;

[0178] A logical operation is performed on the second padded timestamp and the initialization vector to obtain the decryption initialization vector.

[0179] Optionally, the second acquisition module 802 is used to:

[0180] Determine at least two candidate timestamps according to the timestamp when the second device receives the encrypted message and the time data;

[0181] The candidate timestamp closest to the timestamp when the second device receives the encrypted message is determined as the second timestamp.

[0182] Optionally, when the time data is lower n bits of data in the first timestamp, the second acquisition module 802 is configured to:

[0183] Replacing the lower n bits of the timestamp when the second device receives the encrypted message with the time data to obtain a first candidate timestamp;

[0184] Carrying the upper m bits of the timestamp when the second device receives the encrypted message, and replacing the lower n bits of the timestamp when the second device receives the encrypted message with the time data, to obtain a second candidate timestamp, wherein the upper m bits of the timestamp are the data of the timestamp when the second device receives the encrypted message except the lower n bits, and m is a positive integer;

[0185] The high m bits of data in the timestamp when the second device receives the encrypted message are abdicated, and the low n bits of data in the timestamp when the second device receives the encrypted message are replaced with the time data to obtain a third candidate timestamp.

[0186] Optionally, the second acquisition module 802 is used to perform an XOR operation on the second padded timestamp and the initialization vector to obtain the decryption initialization vector.

[0187] Based on Figure 8 In an optional embodiment provided by the illustrated embodiment, when the time data is the lower n bits of the first timestamp, the device further includes: a discarding module ( Figure 8 not shown).

[0188] A discarding module is used to discard the encrypted message if decryption of the encrypted data fails using the decryption initialization vector.

[0189] Based on Figure 8 In an optional embodiment provided by the illustrated embodiment, the device further comprises: a second time calibration module ( Figure 8 not shown).

[0190] The second time calibration module is used for:

[0191] When the encrypted message is an encrypted timing request message, if the difference between the second timestamp corresponding to the timing request message and the timestamp when the second device receives the encrypted message is greater than a preset threshold, the timing process for the first device is initiated according to the timing request message.

[0192] It should be noted that the device provided in the above embodiment only uses the division of the above functional modules as an example to implement its functions. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and their specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0193] Fig. 9 The block diagram of the structure of a computer device provided by an exemplary embodiment of the present application is shown. The computer device in the present application may include one or more of the following components: a processor 910 and a memory 920 .

[0194] The processor 910 may include one or more processing cores. The processor 910 uses various interfaces and lines to connect various parts of the entire computer device, and executes various functions of the computer device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 920, and calling data stored in the memory 920. Optionally, the processor 910 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 910 can integrate one or a combination of a central processing unit (CPU) and a modem. Among them, the CPU mainly processes operating systems and applications, etc.; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 910, but may be implemented separately through a chip.

[0195] Optionally, when the processor 910 executes the program instructions in the memory 920, the encryption method or the decryption method provided by the above-mentioned various method embodiments is implemented.

[0196] The memory 920 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 920 includes a non-transitory computer-readable storage medium. The memory 920 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 920 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data created according to the use of the computer device, etc.

[0197] The structure of the above-mentioned computer device is only illustrative. In actual implementation, the computer device may include more or fewer components, which is not limited in this embodiment.

[0198] Those skilled in the art will understand that Fig. 9 The structure shown in the figure does not constitute a limitation on the computer device 900, and the computer device 900 may include more or less components than those shown in the figure, or combine some components, or adopt a different arrangement of components.

[0199] In an exemplary embodiment, an embodiment of the present application provides a computer device, which includes a Bluetooth chip. The Bluetooth chip stores computer instructions, and the computer instructions are used to execute the above encryption method or decryption method.

[0200] In an exemplary embodiment, a computer-readable storage medium is further provided, in which a computer program is stored. The computer program is loaded and executed by a processor of a terminal to implement the encryption method or the decryption method in the above method embodiment.

[0201] Optionally, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic tape, a floppy disk, an optical data storage device, or the like.

[0202] In an exemplary embodiment, a computer program product is also provided, which includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the encryption method or decryption method provided in the above-mentioned one aspect or various optional implementations of one aspect.

[0203] It should be understood that the "plurality" mentioned in this article refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. The words "first", "second" and similar terms used in this article do not indicate any order, quantity or importance, but are only used to distinguish different components.

[0204] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0205] The above description is only an exemplary embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An encryption method, characterized in that: Applied to a first device, the method includes: Acquire an encryption initialization vector based on a first timestamp, where the first timestamp is determined based on a timestamp when the first device generates an encrypted message; The time synchronization request message is encrypted by using the encryption initialization vector to obtain an encrypted time synchronization request message; Broadcasting the encrypted time synchronization request message; establishing a communication connection with a second device; Sending a time calibration request to the second device; receiving a time calibration response sent by the second device, wherein the time calibration response carries the time calibration time; Complete time synchronization according to the time synchronization time, so that the difference between the first timestamp and the timestamp when the second device scans the encrypted time synchronization request message is less than a preset threshold; The data to be encrypted in the original message is encrypted by using the encryption initialization vector to obtain encrypted data; Sending the encrypted message to the second device, or broadcasting the encrypted message; The encrypted message carries the encrypted data and time data determined based on the first timestamp.

2. The method according to claim 1, characterized in that The obtaining an encryption initialization vector based on the first timestamp includes: Encode the first timestamp according to a preset format to obtain a first encoded timestamp; If the number of bits included in the first encoded timestamp is less than the number of bits included in the initialization vector, padding the first encoded timestamp to obtain a first padded timestamp, where the number of bits included in the first padded timestamp is the same as the number of bits included in the initialization vector; A logical operation is performed on the first padded timestamp and the initialization vector to obtain the encryption initialization vector.

3. The method according to claim 2, characterized in that The performing a logical operation on the first padded timestamp and the initialization vector to obtain the encryption initialization vector includes: An XOR operation is performed on the first padded timestamp and the initialization vector to obtain the encryption initialization vector.

4. The method according to any one of claims 1 to 3, characterized in that: When the data to be encrypted includes business data, the time data is the lower n bits of the first timestamp, where n is less than the number of bits included in the first timestamp; When the data to be encrypted does not include business data, the time data is the first timestamp.

5. The method according to any one of claims 1 to 3, characterized in that: Before obtaining the encryption initialization vector based on the first timestamp, the method further includes: The time of the first device is calibrated, and the error between the time of the first device after the calibration and the reference time is less than a preset threshold.

6. The method according to any one of claims 1 to 3, characterized in that: The first device is a Bluetooth device, the second device is a mobile terminal, and the method includes: Acquire an encryption initialization vector based on a first timestamp, where the first timestamp is determined based on a timestamp when the Bluetooth device generates an encrypted message; The data to be encrypted in the original message is encrypted by using the encryption initialization vector to obtain encrypted data; Sending an encrypted message to a mobile terminal, or broadcasting an encrypted message; wherein the encrypted message carries the encrypted data and time data determined based on the first timestamp.

7. A decryption method, characterized in that: Applied to the second device, the method includes: When the encrypted time synchronization request message broadcast by the first device is scanned, the encrypted time synchronization request message is decrypted according to the first timestamp carried by the encrypted time synchronization request message; If the decryption is successful and the difference between the first timestamp and the timestamp when the second device scans the encrypted time synchronization request message is greater than a preset threshold, a time synchronization process for the first device is initiated according to the encrypted time synchronization request message, and the time synchronization process includes: Establishing a communication connection with the first device; Receiving a time synchronization request sent by the first device; Sending a time synchronization response to the first device, where the time synchronization response carries the time synchronization time, and the time synchronization response is used to instruct the first device to complete the time synchronization according to the time synchronization time; receiving an encrypted message sent or broadcast by the first device, the encrypted message carrying encrypted data and time data determined based on the first timestamp; Acquire a decryption initialization vector according to a timestamp when the second device receives the encrypted message and the time data; The encrypted data is decrypted using the decryption initialization vector to obtain the data to be encrypted in the original message.

8. The method according to claim 7, characterized in that The acquiring a decryption initialization vector according to the timestamp when the second device receives the encrypted message and the time data includes: determining a second timestamp according to a timestamp when the second device receives the encrypted message and the time data; Encode the second timestamp according to a preset format to obtain a second encoded timestamp; If the number of bits included in the second encoded timestamp is less than the number of bits included in the initialization vector, padding the second encoded timestamp to obtain a second padded timestamp, where the number of bits included in the second padded timestamp is the same as the number of bits included in the initialization vector; A logical operation is performed on the second padded timestamp and the initialization vector to obtain the decryption initialization vector.

9. The method according to claim 8, characterized in that The determining the second timestamp according to the timestamp when the second device receives the encrypted message and the time data includes: Determine at least two candidate timestamps according to the timestamp when the second device receives the encrypted message and the time data; The candidate timestamp closest to the timestamp when the second device receives the encrypted message is determined as the second timestamp.

10. The method according to claim 9, characterized in that When the time data is the lower n bits of the first timestamp, determining at least two candidate timestamps according to the timestamp when the second device receives the encrypted message and the time data includes: Replacing the lower n bits of the timestamp when the second device receives the encrypted message with the time data to obtain a first candidate timestamp; Carrying the upper m bits of the timestamp when the second device receives the encrypted message, and replacing the lower n bits of the timestamp when the second device receives the encrypted message with the time data, to obtain a second candidate timestamp, wherein the upper m bits of the timestamp are the data of the timestamp when the second device receives the encrypted message except the lower n bits, and m is a positive integer; The high m bits of data in the timestamp when the second device receives the encrypted message are abdicated, and the low n bits of data in the timestamp when the second device receives the encrypted message are replaced with the time data to obtain a third candidate timestamp.

11. The method according to claim 8, characterized in that The performing a logical operation on the second padded timestamp and the initialization vector to obtain the decryption initialization vector includes: An XOR operation is performed on the second padded timestamp and the initialization vector to obtain the decryption initialization vector.

12. The method according to any one of claims 7 to 11, characterized in that: When the time data is the lower n bits of the first timestamp, the method further includes: If the encrypted data fails to be decrypted using the decryption initialization vector, the encrypted message is discarded.

13. An encryption device, characterized in that: The device comprises: A first acquisition module, configured to acquire an encryption initialization vector based on a first timestamp, wherein the first timestamp is determined based on a timestamp when the encryption device generates an encrypted message; The device also includes a module for performing the following steps: encrypting the time synchronization request message through the encrypted initialization vector to obtain an encrypted time synchronization request message; broadcasting the encrypted time synchronization request message; establishing a communication connection with a decryption device; sending a time synchronization request to the decryption device; receiving a time synchronization response sent by the decryption device, the time synchronization response carrying a time synchronization time; completing time synchronization according to the time synchronization time, so that the difference between the first timestamp and the timestamp when the decryption device scans the encrypted time synchronization request message is less than a preset threshold; An encryption module, used to encrypt the data to be encrypted in the original message by using the encryption initialization vector to obtain encrypted data; A message sending module, used to send the encrypted message to the decryption device, or broadcast the encrypted message; The encrypted message carries the encrypted data and time data determined based on the first timestamp.

14. A decryption device, characterized in that: The device comprises: The device includes a module for performing the following steps: when an encrypted time synchronization request message broadcast by an encryption device is scanned, the encrypted time synchronization request message is decrypted according to a first timestamp carried by the encrypted time synchronization request message; when the decryption is successful and the difference between the first timestamp and the timestamp when the decryption device scans the encrypted time synchronization request message is greater than a preset threshold, a time synchronization process for the encryption device is initiated according to the encrypted time synchronization request message, the time synchronization process including: Establishing a communication connection with the encryption device; receiving a time calibration request sent by the encryption device; sending a time calibration response to the encryption device, the time calibration response carrying a time calibration time, the time calibration response being used to instruct the encryption device to complete the time calibration according to the time calibration time; A message receiving module, used to receive an encrypted message sent or broadcast by the encryption device, wherein the encrypted message carries encrypted data and time data determined based on the first timestamp; A second acquisition module, used to acquire a decryption initialization vector according to the timestamp when the decryption device receives the encrypted message and the time data; The decryption module is used to decrypt the encrypted data using the decryption initialization vector to obtain the data to be encrypted in the original message.

15. A computer device, characterized in that: The computer device comprises a Bluetooth chip, wherein the Bluetooth chip stores computer instructions, wherein the computer instructions are used to execute the encryption method as described in any one of claims 1 to 6, or the decryption method as described in any one of claims 7 to 12.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which is loaded and executed by a processor to implement the encryption method as described in any one of claims 1 to 6, or the decryption method as described in any one of claims 7 to 12.

Images