A data encryption method based on WiFi Mesh

Abstract

This invention relates to the field of Internet of Things (IoT) technology, specifically to a data encryption method based on WiFi Mesh. The WiFi Mesh-based data encryption method includes the following steps: S1, a key exchange phase, where an unconnected node sends a network access request to a connected node, and the connected node generates a public key A and a private key a using an asymmetric encryption algorithm; S2, the connected node sends public key A to the unconnected node, which generates a random key B using a random number, and encrypts the random key B using public key A to obtain ciphertext b; the broadcast key E is initially generated by the WiFi root node using a random number, and all WiFi Mesh network endpoints use the same broadcast key E; the unicast key F is randomly generated by the connected node. Compared with existing technologies, this invention has the following advantages: it solves the problem of sensitive information leakage during the initial key exchange in data transmission using an asymmetric encryption algorithm; it improves the starting point of the entire cycle, ensuring the security of subsequent data communication.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and more specifically, to a data encryption method based on WiFi Mesh. Background Technology

[0002] Data encryption technology refers to the process of transforming information (or plaintext) into meaningless ciphertext using an encryption key and encryption function. The receiving end then uses a decryption function and decryption key to restore the plaintext. End-to-end encryption is a method of encryption provided for data transmission from one end to another. Data is encrypted at the sending end and decrypted at the final destination (receiving end), and does not appear in plaintext form at intermediate nodes.

[0003] End-to-end encryption is performed at the application layer, i.e., at a higher level before transmission. Except for the header, the entire message is encrypted throughout the transmission process. Encryption and decryption devices are only present at the sending and receiving ends; messages are not decrypted at any intermediate node. Furthermore, the information consists of a header and a message; the message is the information to be transmitted, and the header contains routing information. Because network transmission involves routing, in end-to-end encryption, although each intermediate node in the channel does not decrypt the message, it must check the routing information to deliver the message to its destination. Therefore, only the message itself can be encrypted, not the header. This makes it vulnerable to detection by certain communication analysis methods, allowing the extraction of sensitive information. Therefore, a more effective data encryption method is needed. Summary of the Invention

[0004] To overcome the shortcomings of the existing technology, this invention proposes a data encryption method based on WiFi Mesh. This method prioritizes key synchronization between the encryption devices at both ends, thus improving the starting point of the entire loop and ensuring the security of subsequent data communication.

[0005] To achieve the above objectives, the present invention employs the following technical solution: a data encryption method based on WiFi Mesh, comprising the following steps:

[0006] S1, Key Exchange Phase: Unconnected nodes send network access requests to connected nodes. Connected nodes generate a public key A and a private key a using an asymmetric encryption algorithm.

[0007] S2, the nodes that have joined the network send public key A to the nodes that have not joined the network. The nodes that have not joined the network generate a random key B using a random number and encrypt the random key B using public key A to obtain ciphertext b.

[0008] S3, the non-network node sends the ciphertext b to the network-connected node, and the network-connected node decrypts the ciphertext b using the private key a to obtain the random key B;

[0009] S4. The nodes that have joined the network generate broadcast key E and unicast key F by random number, and encrypt broadcast key E and unicast key F by random key B to obtain ciphertext e and ciphertext f.

[0010] S5, the nodes that have joined the network send ciphertext e and ciphertext f to the nodes that have not joined the network. The nodes that have not joined the network decrypt ciphertext e and ciphertext f using the random key B to obtain the broadcast key E and the unicast key F.

[0011] S6, nodes not yet connected to the network generate random keys H and J using random numbers, and encrypt random keys H and J using broadcast key E and unicast key F to obtain ciphertext h1 and ciphertext h2;

[0012] S7, the non-network node sends ciphertext h1 and ciphertext h2 to the network-connected node. The network-connected node decrypts ciphertext h1 and ciphertext h2 using the broadcast key E and unicast key F, and should get the same plaintext data H, thereby verifying whether the broadcast key E and unicast key F received by the non-network node are correct.

[0013] S308 After the above exchange steps, the nodes that have joined the network and the nodes that have not joined the network obtain the broadcast key E and the unicast key F through negotiation. During the data exchange phase, the nodes in the WiFi Mesh network end encrypt and decrypt the transmitted content using the broadcast key E and the unicast key F respectively.

[0014] The broadcast key E is initially generated by the WiFi root node using a random number, and all WiFi Mesh network nodes use the same broadcast key E; the unicast key F is randomly generated by the nodes already in the network.

[0015] Preferably, the asymmetric encryption algorithm is RSA, and the symmetric encryption algorithm is AES128.

[0016] Preferably, the unconnected node is a WiFi node or network connection device that has not yet joined the network, and the connected node is a WiFi node that has already connected to the network.

[0017] Compared with the prior art, the present invention has the following advantages:

[0018] During the initial connection phase, an asymmetric encryption algorithm was used to address the issue of sensitive information leakage during the initial key exchange in data transmission. This perfected the starting point of the entire loop and ensured the security of subsequent data communication. Attached Figure Description

[0019] Figure 1 This is a flowchart of the data encryption method based on WiFi Mesh of the present invention. Detailed Implementation

[0020] Example:

[0021] A data encryption method based on WiFi Mesh includes the following steps: In the entire WiFi Mesh network, the initial WiFi node is connected to the network access router, and the WiFi nodes that have accessed the network are collectively referred to as network access nodes.

[0022] As WiFi Mesh networks are built, more WiFi nodes need to be set up to enable data transmission. At the same time, there are also some network connection devices waiting to be connected. These WiFi nodes or network connection devices are collectively referred to as nodes not yet connected to the network.

[0023] For nodes that are not yet connected to the network, a key exchange is required when they first connect to the network. The specific steps are as follows:

[0024] S1, Key Exchange Phase: Unconnected nodes send network access requests to connected nodes. Connected nodes generate a public key A and a private key a using an asymmetric encryption algorithm.

[0025] S2, the nodes that have joined the network send public key A to the nodes that have not joined the network. The nodes that have not joined the network generate a random key B using a random number and encrypt the random key B using public key A to obtain ciphertext b. Since public key A is sent in plaintext, there is a risk of leakage of public key A information.

[0026] S3, the non-network node sends ciphertext b to the network-connected node. The network-connected node decrypts ciphertext b using private key a to obtain random key B. Since ciphertext b is encrypted using the public key A of an asymmetric encryption algorithm, it can only be decrypted using the corresponding private key a. Therefore, the security of ciphertext b is guaranteed, and subsequent messages are transmitted in ciphertext form, which solves the problem of sensitive information leakage during key exchange in the early stage of data transmission.

[0027] S4. The nodes that have joined the network generate broadcast key E and unicast key F by random number, and encrypt broadcast key E and unicast key F by random key B to obtain ciphertext e and ciphertext f.

[0028] S5, the nodes that have joined the network send ciphertext e and ciphertext f to the nodes that have not joined the network. The nodes that have not joined the network decrypt ciphertext e and ciphertext f using the random key B to obtain the broadcast key E and the unicast key F.

[0029] S6, nodes not yet connected to the network generate random keys H and J using random numbers, and encrypt random keys H and J using broadcast key E and unicast key F to obtain ciphertext h1 and ciphertext h2;

[0030] S7, the non-network node sends ciphertext h1 and ciphertext h2 to the network-connected node. The network-connected node decrypts ciphertext h1 and ciphertext h2 using the broadcast key E and unicast key F, and should get the same plaintext data H, thereby verifying whether the broadcast key E and unicast key F received by the non-network node are correct.

[0031] S308 After the above exchange steps, the nodes that have joined the network and the nodes that have not joined the network obtain the broadcast key E and the unicast key F through negotiation. During the data exchange phase, the nodes in the WiFi Mesh network end encrypt and decrypt the transmitted content using the broadcast key E and the unicast key F respectively.

[0032] The broadcast key E is initially generated by the WiFi root node using a random number, and all WiFi Mesh network nodes use the same broadcast key E; the unicast key F is randomly generated by the nodes already in the network.

[0033] Preferably, the asymmetric encryption algorithm is RSA, and the symmetric encryption algorithm is AES128.

[0034] The above method addresses the issue of being able to encrypt only the message header, but not the header, which could easily lead to the leakage of sensitive information. In the initial connection phase, an asymmetric encryption algorithm is used to solve the problem of sensitive information leakage during the initial key exchange in data transmission. This perfects the starting point of the entire loop and ensures the security of subsequent data communication.

Claims

1. A data encryption method based on WiFi Mesh, characterized in that, Includes the following steps: S1, Key Exchange Phase: Unconnected nodes send network access requests to connected nodes. Connected nodes generate a public key A and a private key a using an asymmetric encryption algorithm. S2, the nodes that have joined the network send public key A to the nodes that have not joined the network. The nodes that have not joined the network generate a random key B using a random number and encrypt the random key B using public key A to obtain ciphertext b. S3, the non-network node sends the ciphertext b to the network-connected node, and the network-connected node decrypts the ciphertext b using the private key a to obtain the random key B; S4. The nodes that have joined the network generate a broadcast key E and a unicast key F using a random number. They then use a symmetric encryption algorithm with a random key B to encrypt the broadcast key E and the unicast key F, resulting in the calculated ciphertext e after concatenating E+F. S5, the nodes that have joined the network send the ciphertext e to the nodes that have not joined the network. The nodes that have not joined the network decrypt the ciphertext e using the random key B and reconstruct it according to the set splicing method to obtain the broadcast key E and the unicast key F. S6. Unconnected nodes generate random number H using a random number generator, and encrypt random number H using a symmetric encryption algorithm with broadcast key E and unicast key F to obtain ciphertext h1 and ciphertext h2. S7, the non-network node sends ciphertext h1 and ciphertext h2 to the network-connected node. The network-connected node decrypts ciphertext h1 and ciphertext h2 using the broadcast key E and unicast key F, and should get the same plaintext data H, thereby verifying whether the broadcast key E and unicast key F received by the non-network node are correct. S8. After the above exchange steps, the network-connected nodes and non-network-connected nodes negotiate to obtain the broadcast key E and the unicast key F. During the data exchange phase, several network-connected nodes encrypt and decrypt the transmitted content using the broadcast key E and the unicast key F respectively, and conduct bidirectional data communication. The broadcast key E is initially generated by the WiFi root node using a random number, and all WiFi Mesh network nodes use the same broadcast key E; the unicast key F is randomly generated by the nodes already in the network. The asymmetric encryption algorithm is RSA, and the symmetric encryption algorithm is AES128; The unconnected nodes are WiFi nodes or network connection devices that have not yet joined the network, while the connected nodes are WiFi nodes that have already connected to the network.

Images