Method for secure communication and control between a bluetooth device and a mobile phone and a server

Abstract

A kind of method for secure communication and control between Bluetooth device and mobile phone and server, its specific steps are as follows: S1, mobile phone end is authenticated to server, after identity authentication success, enter step S2;S2, mobile phone end is registered to server, after registration success, save server public key;S3, mobile phone end logs in server, and server is verified to mobile phone end by server private key, whether the mobile phone end is legal operator is confirmed, if legal, enter step S4;S4, mobile phone end is connected with Bluetooth device, and Bluetooth device is authenticated to server by mobile phone end, after authentication success, enter step S5;S5, mobile phone end carries out control command to Bluetooth device, and Bluetooth device verifies the control command of mobile phone end, after verification success, executes control command;S6, after Bluetooth device executes command, server carries out legality verification to Bluetooth device.The present application solves the problem of identity authentication among mobile phone, Bluetooth device and server, to prevent other devices from malicious impersonation.

Description

Technical Field

[0001] This invention belongs to the field of security encryption and data communication technology, and relates to a method for secure communication and control between Bluetooth devices, mobile phones, and servers. Background Technology

[0002] Using smartphones to control smart home devices or other IoT devices via Bluetooth is becoming increasingly popular, but this approach presents several security challenges and drawbacks. Direct smartphone control of Bluetooth devices faces difficulties in mutual authentication, making communication and control information vulnerable to malicious interception and tampering, posing significant security risks. Furthermore, some Bluetooth devices, for cost and performance reasons, do not integrate Wi-Fi or 5G modules, preventing them from transmitting their status information to backend servers.

[0003] Currently, facial recognition unlocking, fingerprint recognition unlocking, finger vein recognition, and iris recognition unlocking all have some drawbacks and limitations.

[0004] 1. Fingerprint recognition modules require direct human contact. In addition to health considerations, exposed devices are also susceptible to malicious screen protector application.

[0005] 2. Face recognition modules require masks to be removed on most devices. Algorithms that do not require mask removal are not ideal in terms of pass rate and false acceptance rate. In addition, the false rejection rate and false acceptance rate of face recognition are higher than those of fingerprint recognition.

[0006] 3. Finger vein recognition and iris recognition technologies are not yet mature enough for large-scale use, especially in places with high traffic.

[0007] Therefore, controlling smart locks via mobile phone is a good supplementary method. One existing method for mobile phone Bluetooth control is as follows: 1. The mobile phone and Bluetooth device establish a connection, and the mobile phone prepares to control the Bluetooth device. 2. The mobile phone sends control commands and information in plaintext to the Bluetooth device. 3. The Bluetooth device responds to the control commands. 4. The device information and its own status are fed back to the mobile phone in plaintext. 5. The mobile phone uploads the device status to the backend server. In step 1, there is no authentication between the mobile phone and the Bluetooth device; anyone within the Bluetooth communication range can become the controller of the Bluetooth device. In step 2, the control commands and communication information between the mobile phone and the Bluetooth device are easily intercepted and tampered with by others. In steps 4 and 5, the process of the Bluetooth device uploading status information to the server is also easily intercepted and tampered with by others. In other words, direct mobile phone control of Bluetooth devices faces difficulties in mutual authentication, and the communication and control between the two present significant security risks. Furthermore, some Bluetooth devices, for cost and performance reasons, do not integrate Wi-Fi or 5G modules, and therefore cannot transmit some of their own status information to the backend server. Summary of the Invention

[0008] This invention provides a method for secure communication and control between Bluetooth devices, mobile phones, and servers, which solves the problem of identity authentication among mobile phones, Bluetooth devices, and servers, and prevents malicious impersonation by other devices; the key is changed during each login, which enhances the security of communication among the three parties.

[0009] The technical solution adopted in this invention is:

[0010] A method for secure communication and control between a Bluetooth device, a mobile phone, and a server, comprising the following steps:

[0011] S1, The mobile device authenticates its identity with the server. After successful authentication, proceed to step S2.

[0012] S2: The mobile app registers with the server and saves the server's public key after successful registration.

[0013] S3, Mobile client logs into server. The server verifies the mobile client using the server's private key to confirm whether the mobile client is a legitimate operator. If legitimate, proceed to step S4.

[0014] S4. The mobile phone establishes a connection with the Bluetooth device. The Bluetooth device authenticates with the server through the mobile phone. After successful authentication, proceed to step S5.

[0015] S5: The mobile phone sends control commands to the Bluetooth device, and the Bluetooth device verifies the control commands from the mobile phone. If the verification is successful, the control commands are executed.

[0016] S6. After the Bluetooth device executes the command, the server verifies the validity of the Bluetooth device.

[0017] Furthermore, step S0 is included before step S1, where the server generates an asymmetric key (K). b+ ,K b- ), and use your own public key K b+ Register your digital certificate with a CA; Bluetooth devices store a Bluetooth device identifier S and a Bluetooth device private key K. c- and the server public key K b+ The server stores the Bluetooth device identifier S and the Bluetooth device public key K. C+ and the server private key K b- The mobile terminal obtained the Bluetooth device identifier S.

[0018] Furthermore, the specific steps for the mobile device to authenticate its identity with the server in step S1 are as follows:

[0019] S11, the mobile device obtains the server's digital certificate from the CA and retrieves the server's public key K from the certificate. b+S12, the mobile device obtains the server's public key K. b+ Then generate a random number N. A and send it to the server;

[0020] S13, The server generates random authentication information M B And send the data to the mobile phone, and then M B and N A splicing together data M B ||N A For data M B ||N A Digital digest is performed to obtain H(M) B ||N A );

[0021] S14, Server Private Key K b- Perform the signature to obtain f(K) b- ,H(M B ||N A Send it to the mobile device;

[0022] S15, the mobile device uses the server's public key K b+ Decryption yields H(M) B ||N A Then, for data M B ||N A Take the digital digest and compare it with H(M) B ||N A The system compares the identities of the mobile devices with those of the server. If the comparison matches, the mobile device has successfully authenticated its identity with the server.

[0023] Furthermore, the specific steps for the mobile device to register with the server in step S2 are as follows:

[0024] S21, the mobile device sends a registration request to the server. After receiving the response, the mobile device generates a login password R, then concatenates the Bluetooth device identifier S, the login password R, and the mobile device identifier D into data S||R||D, and applies the server's public key K to the data S||R||D. b+ Encryption operation yields f(K) b+ ,S||R||D), and encrypt the digital digest H(S||R||D) of the data S||R||D to obtain f(K). b+ H(S||R||D)), then f(K) b+ ,S||R||D) and f(K b+ H(S||R||D)) are sent together to the server;

[0025] S22, After receiving the data, the server uses its private key K. b-The data S||R||D and H(S||R||D) are decrypted. Then, a digital digest operation is performed on the data S||R||D and compared with the received digital digest H(S||R||D). If the data match, the legality of S is verified. If S is legal, the server stores the data R and D and associates them with the data S, thus agreeing to the mobile phone registration as a legitimate operator of the Bluetooth device.

[0026] S23: After receiving the response from the server, the mobile device knows that the registration was successful.

[0027] Furthermore, the specific steps for logging into the server on the mobile device in step S3 are as follows:

[0028] S31, the mobile device sends the login request and the mobile phone number to the server. After receiving the request, the server sends an SMS verification code T.

[0029] S32, after receiving the verification code T, the mobile device generates a symmetric key Ka for this communication. Then, it concatenates the verification code T, login password R, mobile phone identifier D, and symmetric key Ka into the data T||R||D||Ka, and then uses the server's public key K. b+ Encryption yields f(K) b+ The data T||R||D||Ka is encrypted, and the digital digest H(T||R||D||Ka) of T||R||D||Ka is encrypted to obtain f(K). b+ H(T||R||D||Ka)), then f(K) b+ ,T||R||D||Ka),f(K b+ H(T||R||D||Ka)) is sent to the server together;

[0030] S33, the server uses the server's private key K b- After decryption, the data T||R||D||K and H(T||R||D||Ka) are obtained. Then, a digital digest operation is performed on the data T||R||D||Ka and compared with the received digital digest H(T||R||D||Ka). If the data matches, the server will verify the legality of the data T, R, and D. If the verification is successful, the server confirms that the mobile phone is the legitimate operator of the Bluetooth device.

[0031] Furthermore, after the server verifies that the mobile device is a legitimate operator, it uses the symmetric key Ka to encrypt and decrypt communications with the mobile device during the same login connection.

[0032] Furthermore, the specific steps for the Bluetooth device to authenticate with the server via the mobile phone in step S4 are as follows:

[0033] S41, the mobile device sends an authentication request. After receiving the request, the Bluetooth device first identifies itself as S, and then uses the server's public key K. b+ Encryption is performed to obtain data f(K) b+ The data is then sent to the mobile device, which receives the data and encrypts it using the symmetric key Ka to obtain f(Ka, f(K)). b+ Then, along with the device authentication request, it is sent to the backend server.

[0034] S42, the server uses the symmetric key Ka to decrypt and obtain the data f(K). b+ Then use the server's private key K. b- Decryption yields data S. The server then verifies the validity of data S. If verification is successful, the server generates a symmetric key Kt for communication between the server and the Bluetooth device during this login session, and a symmetric key Ky for verification. These keys are then concatenated to form data Kt||Ky. Finally, the Bluetooth device's public key K is used... c+ Encrypting the data Kt||Ky yields the data f(K) c+ ,Kt||Ky), and use the server's private key K b- Perform cryptographic signing on the data Kt||Ky to obtain f(K) b- ,Kt||Ky), then the data f(K b- ,Kt||Ky),f(K c+ f(Ka, f(K)) is obtained by encrypting Kt||Ky) with the symmetric key Ka. b- ,Kt||Ky)),f(Ka,f(K c+ ,Kt||Ky)), and send it to the mobile device;

[0035] S43, The mobile device uses the symmetric key Ka to decrypt and obtain the data f(K). b -,Kt||Ky) and f(K c+ ,Kt||Ky), and send the data to the Bluetooth device;

[0036] S44, Bluetooth devices use Bluetooth device private key K c- For data f(K) c+ Decrypting Kt||Ky yields Kt||Ky, which is then used with the server's public key K. b+ For data f(K) b Decrypt -,Kt||Ky to get Kt||Ky, and compare the two decrypted data. If they match, the authentication is successful.

[0037] Furthermore, after the Bluetooth device successfully authenticates with the server, the Bluetooth device saves the symmetric key Kt used for communication and the symmetric key Ky used for verification as the symmetric keys for communication and verification between the Bluetooth device and the server during the same login session.

[0038] Furthermore, the specific steps of step S5 are as follows:

[0039] S51, the mobile phone sends a control command to the Bluetooth device. After receiving the control command, the Bluetooth device generates a random number T, then encrypts T using a symmetric key Kt, and then sends the encrypted data f(Kt,T) to the mobile phone. After receiving the data, the mobile phone encrypts it using a symmetric key Ka to obtain f(Ka,f(Kt,T)), and then sends it to the server along with the control command.

[0040] S52, after receiving the data, the server first decrypts it using the symmetric key Ka to obtain data f(Kt,T), then decrypts the data using the symmetric key Kt to obtain data T. After obtaining the random number T, the server first encrypts the data T using the symmetric key Ky to obtain data f(Ky,T); then it performs a digital digest on the data f(Ky,T) to obtain H(f(Ky,T)), and finally encrypts the digital digest using the symmetric key Ka to obtain f(Ka,H(f(Ky,T))) and sends it to the mobile device.

[0041] S53, the mobile phone uses the symmetric key Ka to decrypt the data H(f(Ky,T)) and sends it to the Bluetooth device. The Bluetooth device also uses the symmetric key Ky to encrypt the data T and takes a digital digest H(f(Ky,T)). The generated data H(f(Ky,T)) is compared with the digital digest received from the mobile phone. If they match, the Bluetooth device executes the control command sent by the mobile phone.

[0042] Furthermore, the specific steps for the server to verify the legitimacy of the Bluetooth device in step S6 are as follows:

[0043] S61, the Bluetooth device encrypts its own state L and the digital digest H(L) of L using the symmetric key Kt to obtain f(Kt,L) and f(Kt,H(L)), and sends the data to the mobile phone.

[0044] S62, after receiving the data, the mobile phone uses the symmetric key Ka to encrypt it to obtain f(Ka,f(Kt,L)) and f(Ka,f(Kt,H(L))), and then sends f(Ka,f(Kt,L)) and f(Ka,f(Kt,H(L))) to the server. The server uses decryption to obtain the Bluetooth device status L and verifies the legitimacy of L.

[0045] The beneficial effects of this invention are: it solves the problem of identity authentication between mobile phones, Bluetooth devices, and servers, preventing malicious impersonation by other devices; and it changes the key each time a login is performed, enhancing the security of communication between the three parties. Attached Figure Description

[0046] Figure 1 This is a schematic diagram of the device status of the present invention.

[0047] Figure 2 This is a flowchart of the mobile terminal verification server identity of the present invention.

[0048] Figure 3 This is a flowchart of the mobile client registering with the server according to the present invention.

[0049] Figure 4 This is a flowchart of the mobile login server of the present invention.

[0050] Figure 5 This is a flowchart of the authentication process between the Bluetooth device and the server according to the present invention.

[0051] Figure 6 This is a flowchart of the mobile phone terminal controlling Bluetooth devices according to the present invention. Detailed Implementation

[0052] The present invention will be further described below with reference to specific embodiments, but the invention is not limited to these specific embodiments. Those skilled in the art should recognize that the present invention covers all alternatives, improvements, and equivalents that may be included within the scope of the claims.

[0053] Terminology Explanation

[0054] Symmetric encryption: An encryption method that uses a single-key cryptosystem, where the same key can be used for both encryption and decryption of information.

[0055] Asymmetric encryption: Unlike symmetric encryption algorithms, asymmetric encryption algorithms require two keys: a public key and a private key. The public and private keys are a pair; if data is encrypted using the public key, it can only be decrypted using the corresponding private key; conversely, if data is encrypted using the private key, it can only be decrypted using the corresponding public key.

[0056] Digital digest: Digital digest technology uses a one-way hash function to map plaintext input of arbitrary length to ciphertext output of fixed length (such as 128 bits), ensuring the integrity of information and preventing information from being tampered with or partially deleted during network transmission.

[0057] Digital signature: A digital signature (also known as a public-key digital signature) is a unique string of numbers that only the sender of the information can generate and that cannot be forged by others. This string also serves as valid proof of the authenticity of the information sent by the sender. It is similar to a physical signature written on paper, but implemented using public-key cryptography techniques, and is used to authenticate digital information. A digital signature typically defines two complementary operations: one for signing and the other for verification. Digital signatures are an application of asymmetric key encryption and digital digest techniques.

[0058] CA Digital Certificates: A Certificate Authority (CA) is a nationally recognized, authoritative, trustworthy, and impartial third-party organization responsible for issuing and managing digital certificates required by all entities participating in online business. Digital certificates are like identity cards in the online world. They enable the establishment of secure and reliable trust relationships between users who do not meet face-to-face. This trust relationship originates from a PKI / CA certification center, making the construction of secure PKI / CA certification centers crucial. A CA possesses a certificate (containing a public key) and a private key. Public users online trust a CA by verifying its signature. Anyone can obtain a CA's certificate (containing a public key) to verify the certificates it issues.

[0059] Bluetooth: Bluetooth technology is an open global standard for wireless data and voice communication. It is a special short-range wireless technology connection based on low-cost short-range wireless connectivity, which establishes a communication environment for fixed and mobile devices.

[0060] Function notation: f(U,V) encrypts data V using key U; H(W) performs a digital digest operation on data W; X||Y concatenates data X and data Y into a new data.

[0061] Reference Figure 1-6 This embodiment provides a method for secure communication and control between Bluetooth devices, mobile phones, and servers, the specific steps of which are as follows:

[0062] S0, The server generates an asymmetric key (K) b+ ,K b- ), and use your own public key K b+ Register your digital certificate with a CA; Bluetooth devices store a Bluetooth device identifier S and a Bluetooth device private key K. c- and the server public key K b+ The server stores the Bluetooth device identifier S and the Bluetooth device public key K. C+ and the server private key K b- The mobile terminal obtained the Bluetooth device identifier S.

[0063] Bluetooth devices and servers are typically provided by the same manufacturer, so both devices and servers store their respective identifiers and keys at the factory. The mobile terminal, as the owner of the Bluetooth device, has already obtained the Bluetooth device identifier S from the manufacturer. The Bluetooth device identifier S is unique.

[0064] S1, The mobile device authenticates its identity with the server. After successful authentication, proceed to step S2.

[0065] The specific steps for mobile devices to authenticate their identity with the server are as follows:

[0066] S11, the mobile device obtains the server's digital certificate from the CA and retrieves the server's public key K from the certificate. b+ S12, the mobile device obtains the server's public key K. b+ Then generate a random number N. A and send it to the server;

[0067] S13, The server generates random authentication information M B And send the data to the mobile phone, and then M B and N A splicing together data M B ||N A For data M B ||N A Digital digest is performed to obtain H(M) B ||N A );

[0068] S14, Server Private Key K b- Perform the signature to obtain f(K) b- ,H(M B ||N A Send it to the mobile device;

[0069] S15, the mobile device uses the server's public key K b+ Decryption yields H(M) B ||N A Then, for data M B ||N A Take the digital digest and compare it with H(M) B ||N A The system compares the identities of the mobile devices with those of the server. If the comparison matches, the mobile device has successfully authenticated its identity with the server.

[0070] S2, the mobile app registers with the server; after successful registration, it saves the server's public key K. b+ ;

[0071] The specific steps for registering with the server on a mobile device are as follows:

[0072] S21, the mobile device sends a registration request to the server. After receiving the response, the mobile device generates a login password R, then concatenates the Bluetooth device identifier S, the login password R, and the mobile device identifier D into data S||R||D, and applies the server's public key K to the data S||R||D. b+ Encryption operation yields f(K) b+ ,S||R||D), and encrypt the digital digest H(S||R||D) of the data S||R||D to obtain f(K). b+ H(S||R||D)), then f(K) b+ ,S||R||D) and f(K b+ H(S||R||D)) are sent together to the server;

[0073] S22, After receiving the data, the server uses its private key K. b- The data S||R||D and H(S||R||D) are decrypted. Then, a digital digest operation is performed on the data S||R||D and compared with the received digital digest H(S||R||D) (to prevent data tampering). If the data match, the legality of S is verified. If S is legal, the server stores the data R and D and associates them with the data S, thus agreeing to the mobile phone registration as a legitimate operator of the Bluetooth device.

[0074] S23: After receiving the response from the server, the mobile device knows that the registration was successful.

[0075] S3, mobile app login to the server, the server uses the server's private key K b- Verify the mobile device to confirm whether it is operated by a legitimate user. If it is legitimate, proceed to step S4.

[0076] The specific steps for logging into the server on a mobile device are as follows:

[0077] S31, the mobile device sends the login request and the mobile phone number to the server. After receiving the request, the server sends an SMS verification code T.

[0078] S32, after receiving the verification code T, the mobile device generates a symmetric key Ka for this communication. Then, it concatenates the verification code T, login password R, mobile phone identifier D, and symmetric key Ka into the data T||R||D||Ka, and then uses the server's public key K. b+ Encryption yields f(K) b+ The data T||R||D||Ka is encrypted, and the digital digest H(T||R||D||Ka) of T||R||D||Ka is encrypted to obtain f(K). b+ H(T||R||D||Ka)), then f(K) b+ ,T||R||D||Ka),f(Kb+ H(T||R||D||Ka)) is sent to the server together; the mobile phone identifier D is unique.

[0079] S33, the server uses the server's private key K b- After decryption, the data T||R||D||K and H(T||R||D||Ka) are obtained. Then, a digital digest operation is performed on the data T||R||D||Ka, and it is compared with the received digital digest H(T||R||D||Ka) (to prevent data tampering). If the data matches, the server will verify the legality of the data T, R, and D. If the verification is successful, the server confirms that the mobile phone is the legitimate operator of the Bluetooth device.

[0080] After the server verifies that the mobile device is a legitimate user, it uses the symmetric key Ka to encrypt and decrypt communications with the mobile device during the same login connection.

[0081] S4. The mobile phone establishes a connection with the Bluetooth device. The Bluetooth device authenticates with the server through the mobile phone. After successful authentication, proceed to step S5.

[0082] The specific steps for Bluetooth devices to authenticate with the server via the mobile device are as follows:

[0083] S41, the mobile device sends an authentication request. After receiving the request, the Bluetooth device first identifies itself as S, and then uses the server's public key K. b+ Encryption is performed to obtain data f(K) b+ The data is then sent to the mobile device, which receives the data and encrypts it using the symmetric key Ka to obtain f(Ka, f(K)). b+ Then, along with the device authentication request, it is sent to the backend server.

[0084] S42, the server uses the symmetric key Ka to decrypt and obtain the data f(K). b+ Then use the server's private key K. b- Decryption yields data S. The server then verifies the validity of data S. If verification is successful, the server generates a symmetric key Kt for communication between the server and the Bluetooth device during this login session, and a symmetric key Ky for verification. These keys are then concatenated to form data Kt||Ky. Finally, the Bluetooth device's public key K is used... c+ Encrypting the data Kt||Ky yields the data f(K) c+ ,Kt||Ky), and use the server's private key K b- Perform cryptographic signing on the data Kt||Ky to obtain f(K) b- ,Kt||Ky), then the data f(K b- ,Kt||Ky),f(K c+f(Ka, f(K)) is obtained by encrypting Kt||Ky) with the symmetric key Ka. b- ,Kt||Ky)),f(Ka,f(K c+ ,Kt||Ky)), and send it to the mobile device;

[0085] S43, The mobile device uses the symmetric key Ka to decrypt and obtain the data f(K). b -,Kt||Ky) and f(K c+ ,Kt||Ky), and send the data to the Bluetooth device;

[0086] S44, Bluetooth devices use Bluetooth device private key K c- For data f(K) c+ Decrypting Kt||Ky yields Kt||Ky, which is then used with the server's public key K. b+ For data f(K) b Decrypt -,Kt||Ky to get Kt||Ky, and compare the two decrypted data. If they match, the authentication is successful.

[0087] After successful authentication between the Bluetooth device and the server, the Bluetooth device saves the symmetric key Kt used for communication and the symmetric key Ky used for verification as the symmetric keys for communication and verification between the Bluetooth device and the server during the same login session.

[0088] S5: The mobile phone sends control commands to the Bluetooth device, and the Bluetooth device verifies the control commands from the mobile phone. If the verification is successful, the control commands are executed.

[0089] The specific steps are as follows:

[0090] S51, the mobile phone sends a control command to the Bluetooth device. After receiving the control command, the Bluetooth device generates a random number T, then encrypts T using a symmetric key Kt, and then sends the encrypted data f(Kt,T) to the mobile phone. After receiving the data, the mobile phone encrypts it using a symmetric key Ka to obtain f(Ka,f(Kt,T)), and then sends it to the server along with the control command.

[0091] S52, after receiving the data, the server first decrypts it using the symmetric key Ka to obtain data f(Kt,T), then decrypts the data using the symmetric key Kt to obtain data T. After obtaining the random number T, the server first encrypts the data T using the symmetric key Ky to obtain data f(Ky,T); then it performs a digital digest on the data f(Ky,T) to obtain H(f(Ky,T)), and finally encrypts the digital digest using the symmetric key Ka to obtain f(Ka,H(f(Ky,T))) and sends it to the mobile device.

[0092] S53, the mobile phone uses the symmetric key Ka to decrypt the data H(f(Ky,T)) and sends it to the Bluetooth device. The Bluetooth device also uses the symmetric key Ky to encrypt the data T and takes a digital digest H(f(Ky,T)). The generated data H(f(Ky,T)) is compared with the digital digest received from the mobile phone. If they match, the Bluetooth device executes the control command sent by the mobile phone.

[0093] S6. After the Bluetooth device executes the command, the server verifies the validity of the Bluetooth device.

[0094] The specific steps the server takes to verify the legitimacy of Bluetooth devices are as follows:

[0095] S61, the Bluetooth device encrypts its own state L and the digital digest H(L) of L using the symmetric key Kt to obtain f(Kt,L) and f(Kt,H(L)), and sends the data to the mobile phone.

[0096] S62, after receiving the data, the mobile phone uses the symmetric key Ka to encrypt it to obtain f(Ka,f(Kt,L)) and f(Ka,f(Kt,H(L))), and then sends f(Ka,f(Kt,L)) and f(Ka,f(Kt,H(L))) to the server. The server uses decryption to obtain the Bluetooth device status L and verifies the legality of L (whether it has been tampered with).

[0097] This invention solves the problem of identity authentication between mobile phones, Bluetooth devices, and servers, preventing malicious impersonation by other devices; the key is changed each time a login is performed, enhancing the security of communication between the three parties.

Claims

1. A method for secure communication and control between a Bluetooth device, a mobile phone and a server, comprising the following steps: S1, the mobile phone authenticates the server, and enters step S2 after successful authentication; S2, the mobile phone registers with the server, and saves the server public key after successful registration; S3, the mobile phone logs in the server, and the server verifies whether the mobile phone is a legal operator by using the server private key, and enters step S4 if the mobile phone is a legal operator; S4, the mobile phone establishes a connection with the Bluetooth device, and the Bluetooth device is authenticated by the server through the mobile phone, and enters step S5 after successful authentication; The specific steps of authenticating the Bluetooth device by the server through the mobile phone are as follows: S41, the mobile phone sends an authentication request, the Bluetooth device receives the request, and first encrypts the Bluetooth device identifier S using the server public key K b+ to obtain data f(K b+ , S) and sends it to the mobile phone, the mobile phone receives the data and uses the symmetric key Ka to obtain f(Ka, f(K b+ , S)), and then sends it to the back-end server together with the device authentication request; S42, the server uses the symmetric key Ka to decrypt the data f(K b+ ,S) to obtain data S, then uses the server private key K b- to decrypt the data S to obtain data S, and finally the server verifies the legitimacy of the data S, and if the verification is passed, the server generates the symmetric key Kt for communication between the server and the Bluetooth device during this login period, and the symmetric key Ky for verification, and splices them to form data Kt||Ky, then uses the Bluetooth device public key K c+ to encrypt the data Kt||Ky to obtain data f(K c+ ,Kt||Ky), and uses the server private key K b- to encrypt and sign the data Kt||Ky to obtain f(K b- ,Kt||Ky), then sends the data f(K b- ,Kt||Ky), f(K c+ ,Kt||Ky) to the mobile phone end through the symmetric key Ka to obtain f(Ka,f(K b- , Kt||Ky)), f(Ka, f(K c+ ,Kt||Ky)). S43, the mobile phone decrypts the data f(K b , Kt||Ky) and f(K c+ , Kt||Ky) using the symmetric key Ka, and sends the data to the Bluetooth device. S44, the Bluetooth device uses the Bluetooth device private key K c- decrypts the data f(K c+ , Kt||Ky) to obtain Kt||Ky, uses the server public key K b+ decrypts the data f(K b , Kt||Ky) to obtain Kt||Ky, and compares the two decrypted data. If the comparison is consistent, the authentication is successful. S5, the mobile phone sends a control command to the Bluetooth device, and the Bluetooth device verifies the control command from the mobile phone, and executes the control command after successful verification; S6, the server verifies the legality of the Bluetooth device after the Bluetooth device executes the command.

2. The method for secure communication and control between a Bluetooth device and a mobile phone and a server according to claim 1, characterized in that: Step S1 further comprises step S0, the server generates an asymmetric key (K b+ , K b- ), and registers its digital certificate with the CA using its public key K b+ ; the Bluetooth device stores the Bluetooth device identifier S, the Bluetooth device private key K c- , and the server public key K b+ ; the server stores the Bluetooth device identifier S, the Bluetooth device public key K C+ , and the server private key K b- ; the mobile terminal has acquired the Bluetooth device identifier S.

3. The method for secure communication and control between a Bluetooth device and a handset and a server according to claim 2, wherein: The specific steps of authenticating the server by the mobile phone are as follows: S11, the mobile phone end obtains the digital certificate of the server from the CA, and obtains the server public key K from the certificate b+ ; S12, the mobile phone gets the server public key K b+ A random number N is generated A and sent to the server; S13, the server generates random authentication information M B , and sends the random authentication information M B to the mobile phone, and then splices M B and N A to form data M B ||N A , and performs digital digest on the data M B ||N A to obtain H(M B ||N A ) S14, server private key K b- Sign, get f(K b- , H(M B ||N A )), and send to mobile phone end; S15, the mobile phone uses the server public key K b+ Decryption to get H(M B ||N A ), then the data M B ||N A Take the digital digest, and compare H(M B ||N A ), if consistent, the mobile phone to the server identity authentication success.

4. The method for secure communication and control between a Bluetooth device and a handset and a server according to claim 3, wherein: The specific steps of registering the server by the mobile phone in step S2 are as follows: S21, the mobile phone end sends a registration request to the server, after receiving the response, the mobile phone end generates a login password R, then splices the Bluetooth device identification S, the login password R and the mobile phone identification D into data S||R||D, and uses the server public key K b+ to perform encryption operation to obtain f(K b+ , S||R||D), and encrypts the digital digest H(S||R||D) of the data S||R||D to obtain f(K b+ , H(S||R||D)), then sends f(K b+ , S||R||D) and f(K b+ , H(S||R||D)) to the server together; S22, the server uses the server private key K b- The data S||R||D and H(S||R||D) are decrypted, and a digital digest operation is performed on the data S||R||D. The digital digest H(S||R||D) received is compared. If the data is consistent, the legality of S is verified. If S is legal, the server stores the data R and D, and associates the data S, and agrees that the mobile phone is registered as a legal operator of the Bluetooth device. S23, the mobile phone knows that the registration is successful after receiving the response from the server.

5. The method for secure communication and control between a Bluetooth device and a handset and a server according to claim 4, wherein: The specific steps of logging in the server by the mobile phone in step S3 are as follows: S31, the mobile phone sends a login request and the mobile phone number to the server, and the server sends a short message verification code T after receiving the login request; S32, the mobile phone end receives the verification code T, generates a symmetric key Ka used for communication this time, then splices the verification code T, the login password R, the mobile phone identifier D, and the symmetric key Ka into data T||R||D||Ka, and then uses the server public key K b+ to encrypt to obtain f(K b+ ,T||R||D||Ka), and encrypts the digital digest H(T||R||D||Ka) of the data T||R||D||Ka to obtain f(K b+ ,H(T||R||D||Ka)), then sends f(K b+ ,T||R||D||Ka) and f(K b+ , H(T||R||D||Ka)) to the server together; S33, the server uses the server private key K b- After decryption, the data T||R||D||K and H(T||R||D||Ka) are obtained, and then the digital digest operation is performed on the data T||R||D||Ka, and compared with the received digital digest H(T||R||D||Ka). If the data is consistent, the server will verify the legality of the data T, R, D, and if the verification is passed, the server confirms that the mobile terminal is a legal operator of the Bluetooth device.

6. The method for secure communication and control between a Bluetooth device and a handset and a server according to claim 5, wherein: After the server verifies that the mobile phone is a legal operator, the server uses the symmetric key Ka to communicate with the mobile phone during the same login connection.

7. The method for secure communication and control between a Bluetooth device and a handset and a server according to claim 6, wherein: After the Bluetooth device is authenticated by the server, the Bluetooth device saves the symmetric key Kt for communication and the symmetric key Ky for verification as the symmetric keys for communication and verification between the Bluetooth device and the server during the same login connection.

8. The method for secure communication and control between a Bluetooth device and a handset and a server according to claim 7, wherein: The specific steps of step S5 are as follows: S51, the mobile phone sends a control command to the Bluetooth device, the Bluetooth device generates a random number T after receiving the control command, then encrypts T by using the symmetric key Kt, and then sends the encrypted data f(Kt, T) to the mobile phone, the mobile phone receives the data, encrypts the data by using the symmetric key Ka to obtain f(Ka, f(Kt, T)), and then sends the data to the server together with the control command; S52, the server receives the data, first decrypts the data by using the symmetric key Ka to obtain f(Kt, T), then decrypts the data by using the symmetric key Kt to obtain T, and then encrypts the data T by using the symmetric key Ky to obtain f(Ky, T) after obtaining the random number T, then takes a digital digest of the data f(Ky, T) to obtain H(f(Ky, T)), and finally encrypts the digital digest by using the symmetric key Ka to obtain f(Ka, H(f(Ky, T))) and sends it to the mobile phone; S53, the mobile phone end sends the data H(f(Ky, T)) to the Bluetooth device after decryption using the symmetric key Ka, the Bluetooth device also encrypts the data T using the symmetric key Ky and takes the digital digest H(f(Ky, T)), compares the generated data H(f(Ky, T)) with the digital digest received from the mobile phone end, if the comparison is consistent, the Bluetooth device executes the control command issued by the mobile phone end.

9. The method for secure communication and control between a Bluetooth device and a handset and a server according to claim 8, wherein: The specific steps of the server verifying the legality of the Bluetooth device in step S6 are as follows: S61, the Bluetooth device encrypts the state L of itself and the digital digest H(L) of L using the symmetric key Kt to obtain f(Kt, L) and f(Kt, H(L)), and sends the data to the mobile phone end; S62, the mobile phone end receives the data and encrypts it using the symmetric key Ka to obtain f(Ka, f(Kt, L)) and f(Ka, f(Kt, H(L))), and then sends f(Ka, f(Kt, L)) and f(Ka, f(Kt, H(L))) to the server, the server decrypts to obtain the state L of the Bluetooth device and verifies the legality of L.

Images