Device authentication method and terminal device

Abstract

The present application relates to the field of communication technology, and in particular to a device authentication method and terminal device, which can effectively ensure the security of communication between electronic devices and Bluetooth devices, improve the complexity and cumbersomeness caused by key negotiation in related technologies, and save computing power, time and other resources. In this method, the Bluetooth device can verify whether the electronic device is trustworthy through a first authentication parameter, and disconnect the Bluetooth connection with the electronic device if it is not trustworthy. It can prevent the electronic device from connecting to the Bluetooth device at will, and ensure the security of communication with the electronic device. At the same time, in the process of generating the first verification information based on the authentication identification information, the Bluetooth device does not need to use a very complex algorithm, which can effectively save the computing power resources and time resources of the electronic device and the Bluetooth device.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a device authentication method and terminal device. Background Art

[0002] With the development of technology and the advancement of science and technology, there are more and more Bluetooth devices around users. Users hope that their Bluetooth devices can establish connections with electronic devices through Bluetooth technology; communicate between electronic devices and Bluetooth devices, so that their electronic devices can control Bluetooth devices, receive data from Bluetooth devices, upgrade Bluetooth devices, etc. through Bluetooth technology.

[0003] In the related art, in order to ensure the security of communication between electronic devices and Bluetooth devices, to prevent other users' electronic devices from connecting to the user's own Bluetooth devices at will, and to prevent the communication between electronic devices and Bluetooth devices from being monitored. Usually, a key negotiation process is carried out between the electronic device and the Bluetooth device, and the two generate a key through negotiation. The electronic device and the Bluetooth device both use the key to carry out the key negotiation process, which requires the use of many security-related libraries, which is cumbersome; and, in each communication, the key needs to be used for encryption and decryption, which is very complicated. It can be seen that in the related art, in order to ensure the security of communication between electronic devices and Bluetooth devices, the means of key negotiation are adopted, which will be too complicated and cumbersome, and the consumption of resources such as computing power and time is large. Some lightweight Bluetooth devices with lower capabilities cannot communicate in this way, and the security of Bluetooth communication is poor. Summary of the invention

[0004] In view of this, the present application provides a device authentication method and terminal device. In this method, the electronic device and the Bluetooth device use parameter verification to perform security authentication, and Bluetooth communication can only be performed after the security authentication is successful, which can effectively ensure the security of communication between the electronic device and the Bluetooth device, improve the complexity and cumbersomeness caused by key negotiation in related technologies, and save computing power, time and other resources. Even lightweight Bluetooth devices can ensure the security of Bluetooth communication.

[0005] In the first aspect, the present application provides a device authentication method, which can be applied to Bluetooth devices; wherein the Bluetooth device can be a terminal device with Bluetooth connection capability, such as a classic Bluetooth device, a BLE Bluetooth device, and a dual-mode Bluetooth device. In this method, after the Bluetooth device establishes a Bluetooth connection with an electronic device, the Bluetooth device generates a second random number and sends the second random number to the electronic device, and the second random number is used to generate a first authentication parameter on the electronic device. Afterwards, the Bluetooth device receives the first authentication parameter and the first random number sent by the electronic device. Next, the Bluetooth device uses a target encryption method to generate first verification information based on the first random number, the second random number, and the authentication identification information of the Bluetooth device; and the Bluetooth device verifies the first authentication parameter based on the first verification information. If the first authentication parameter verification fails, the Bluetooth device disconnects the Bluetooth connection with the electronic device.

[0006] Among them, the Bluetooth device can use a preset random number generation method to generate a second random number. For a Bluetooth device, the authentication identification information can be generated by a preset identification information generation algorithm, or can be searched by the Bluetooth device from its own memory. The above-mentioned target encryption method can be a preset encryption method that is the same as the electronic device or an encryption method that is the same as the electronic device negotiated. Exemplarily, the authentication identification information can be a PIN code; the target encryption method can be an encrypted hash function, such as an MD5 information digest algorithm, a hash algorithm, and the like.

[0007] In the above device authentication method, the Bluetooth device can verify whether the electronic device is credible through the first authentication parameter, and disconnect the Bluetooth connection with the electronic device if it is not credible. This can prevent the electronic device from connecting to the Bluetooth device at will, and ensure the security of communication with the electronic device. At the same time, when the Bluetooth device generates the first verification information based on the authentication identification information, it does not need to use a very complex algorithm; for example, it can be achieved only through an encrypted hash function. This can effectively save the computing power resources and time resources of the electronic device and the Bluetooth device.

[0008] In a possible design of the first aspect, the method provided in the present application may further include: when the verification of the first authentication parameter of the Bluetooth device fails, the Bluetooth device may send a disconnection indication information to the electronic device, where the disconnection indication information is used to indicate the disconnection of the Bluetooth connection.

[0009] In a possible design of the first aspect, the method provided in the present application may also include: when the first authentication parameter is successfully verified, the Bluetooth device uses a target encryption method to generate a second authentication parameter based on the first random number, the second random number and the authentication identification information. Afterwards, the Bluetooth device sends the second authentication parameter to the electronic device, and the second authentication parameter is used to trigger the disconnection of the Bluetooth connection between the electronic device and the Bluetooth device when the electronic device fails to verify the second authentication parameter. It can be understood that in this design, the electronic device can verify whether the Bluetooth device is trustworthy through the second authentication parameter, and disconnect the Bluetooth connection with the electronic device if it is not trustworthy. It can prevent Bluetooth devices from connecting to electronic devices at will, and can further improve the security of communication between Bluetooth devices and electronic devices.

[0010] In a possible design of the first aspect, the method provided in the present application may also include: if the Bluetooth device receives disconnection indication information from the electronic device, the Bluetooth device disconnects the Bluetooth connection with the electronic device.

[0011] In a possible design of the first aspect, the method provided in the present application may further include: if the Bluetooth device receives a notification message from an electronic device, and the notification message is used to indicate that the electronic device has successfully verified the second authentication parameter, the Bluetooth device updates the authentication identification information, and uploads the updated authentication identification information to the server through the electronic device. The above-mentioned updated authentication identification information can be used in the subsequent authentication process for the Bluetooth device. In this design, since the authentication identification information is updated by the Bluetooth device. The update process of the authentication identification information is not perceived at the electronic device or the server; it can prevent other users from stealing the authentication identification information update process and then obtaining the updated authentication identification information to operate the device, which can further improve the security of communication between the Bluetooth device and the electronic device.

[0012] In a possible design of the first aspect, the Bluetooth device updates the authentication identification information, and uploads the updated authentication identification information to the server through the electronic device, which may include: the Bluetooth device updates the authentication identification information after waiting for a preset time interval, and uploads the updated authentication identification information to the server through the electronic device; or, the Bluetooth device monitors the load of the processor in the Bluetooth device; if the load of the processor is less than a preset threshold, the authentication identification information is updated, and the updated authentication identification information is uploaded to the server through the electronic device. In this design, considering that the processor performance of some Bluetooth devices is not very powerful; after the second parameter authentication is successful, the authentication identification information is immediately updated, which may cause the processor to be overloaded. As a result, the process that can work normally on the Bluetooth device becomes stuck, which affects the user experience. Therefore, the embodiment of the present application can avoid the time when the Bluetooth device executes these processes after the electronic device and the Bluetooth device are authenticated. Let the processor of the Bluetooth device only focus on executing the above process, and when the processor of the Bluetooth device is idle, generate new authentication identification information through a preset authentication identification generation algorithm. The workload of the processor of the Bluetooth device can be alleviated, and the occurrence of the overload problem of the processor of the Bluetooth device can be reduced.

[0013] In a possible design of the first aspect, the Bluetooth device adopts a target encryption method to generate the first verification information based on the first random number, the second random number and the authentication identification information, which may include: the Bluetooth device adds a salt value to the authentication identification information, and the salt value may be preset. Afterwards, the Bluetooth device may adopt a target encryption method to generate the first verification information based on the first random number, the second random number and the authentication identification information after the salt value is added.

[0014] In a possible design of the first aspect, the above-mentioned Bluetooth device adopts a target encryption method to generate a second authentication parameter based on a first random number, a second random number and authentication identification information, which may include: the Bluetooth device adds a salt value to the authentication identification information; the salt value may be preset to be the same as the electronic device, or the salt value may be the same as negotiated with the electronic device. Afterwards, the Bluetooth device may adopt a target encryption method to generate a second authentication parameter based on the first random number, the second random number and the authentication identification information after the salt value is added. In this design, it is considered that a rainbow table attack may be launched on the authentication parameter in order to steal the authentication identification information. Therefore, when generating the second authentication parameter, a salt value may be added to the authentication identification information. In this way, even if the second authentication parameter is cracked by the rainbow table, the authentication identification information in this application cannot be obtained. Only an authentication identification information with a salt value added can be obtained, which can further improve the security and reliability of the device authentication method provided by the application embodiment.

[0015] In a possible design of the first aspect, the method provided in the present application may further include: if the Bluetooth device receives notification information from an electronic device, the Bluetooth device uses the encryption method specified by the Bluetooth protocol to perform encrypted transmission with the electronic device.

[0016] In a possible design of the first aspect, the method provided in the present application may also include: when the Bluetooth device successfully verifies the first authentication parameter, the Bluetooth device uses the encryption method specified in the Bluetooth protocol to encrypt the transmission with the electronic device. In this design, the Bluetooth device and the electronic device can encrypt the communication between the two through the encryption method specified in the Bluetooth protocol, and the communication between the two can be monitored in an effective manner. The security of the communication between the two can be effectively guaranteed. For lightweight BLE devices, users usually do not store data with relatively high data security requirements, such as bank accounts, passwords, etc., on these lightweight BLE devices. Therefore, for these lightweight BLE devices, the encryption method in the Bluetooth protocol can also effectively guarantee the security of data transmission.

[0017] In the second aspect, the present application provides a device authentication method, which can be applied to an electronic device, which can be a terminal device with a Bluetooth connection function such as a mobile phone, a tablet computer, a personal computer, etc. In the method, after the electronic device establishes a Bluetooth connection with the Bluetooth device, the electronic device obtains the authentication identification information of the Bluetooth device, wherein, for the electronic device, the authentication identification information can be generated by a preset identification information generation algorithm, or can be obtained from a server. After that, the electronic device generates a first random number and receives a second random number sent by the Bluetooth device; wherein, the electronic device can use a preset random number generation method to generate the first random number. After that, the electronic device uses a target encryption method to generate a first authentication parameter based on the first random number, the second random number and the authentication identification information; wherein, the target encryption method can be a preset encryption method that is the same as the Bluetooth device or the same encryption method negotiated with the Bluetooth device. After that, the electronic device sends a first authentication parameter and a first random number to the Bluetooth device, wherein the first random number is used to verify the first authentication parameter, and the first authentication parameter is used to trigger the disconnection of the Bluetooth connection between the Bluetooth device and the electronic device when the Bluetooth device fails to verify the first authentication parameter. The target encryption method may be a preset encryption method that is the same as that of the Bluetooth device or an encryption method that is negotiated with the Bluetooth device. For example, the authentication identification information may be a PIN code; the target encryption method may be an MD5 information digest algorithm, a hash algorithm, or the like.

[0018] In the above device authentication method, the Bluetooth device can verify whether the electronic device is credible through the first authentication parameter, and disconnect the Bluetooth connection with the electronic device if it is not credible. This can prevent the electronic device from connecting to the Bluetooth device at will, and ensure the security of communication with the electronic device. At the same time, when the Bluetooth device generates the first verification information based on the authentication identification information, it does not need to use a very complex algorithm; for example, it can be achieved only through an encrypted hash function. This can effectively save the computing power resources and time resources of the electronic device and the Bluetooth device.

[0019] In a possible design of the second aspect, the method provided in the present application also includes: if the electronic device receives disconnection indication information from the Bluetooth device, the electronic device disconnects the Bluetooth connection with the Bluetooth device.

[0020] In a possible design of the second aspect, the method provided by the present application also includes: if the electronic device receives a second authentication parameter from a Bluetooth device, the electronic device uses a target encryption method to generate second verification information based on the first random number, the second random number and the authentication identification information of the Bluetooth device. The electronic device verifies the second authentication parameter based on the second verification information, and disconnects the Bluetooth connection with the Bluetooth device if the second authentication parameter verification fails. It can be understood that in this design, the electronic device can verify whether the Bluetooth device is trustworthy through the second authentication parameter, and disconnect the Bluetooth connection with the electronic device if it is not trustworthy. Bluetooth devices can be prevented from arbitrarily connecting to electronic devices, and the security of communication between Bluetooth devices and electronic devices can be further improved.

[0021] In a possible design of the second aspect, the method provided in the present application also includes: when the second authentication parameter verification fails, the electronic device sends a disconnection indication information to the Bluetooth device, and the disconnection indication information is used to indicate the disconnection of the Bluetooth connection.

[0022] In a possible design of the second aspect, the method provided in the present application also includes: when the second authentication parameter is successfully verified, the electronic device sends a notification message to the Bluetooth device, and the notification message is used to indicate that the electronic device has successfully verified the second authentication parameter. After that, the electronic device receives the updated authentication identification information sent by the Bluetooth device, and uploads the updated authentication identification information to the server. In this design, since the Bluetooth device updates the authentication identification information, the updating process of the authentication identification information is not perceived at the electronic device or the server; it can prevent other users from stealing the authentication identification information updating process and then obtaining the updated authentication identification information to operate the device, which can further improve the security of communication between the Bluetooth device and the electronic device.

[0023] In a possible design of the second aspect, the electronic device obtains the authentication identification information of the Bluetooth device, including: when the Bluetooth device is authenticated for the first time, the electronic device generates the authentication identification information based on the device information of the Bluetooth device; wherein the electronic device can use a preset identification information generation algorithm to generate the authentication identification information based on the device information of the Bluetooth device. Alternatively, when the Bluetooth device is not authenticated for the first time, the electronic device obtains the authentication identification information of the Bluetooth device corresponding to the target user account associated with the electronic device from the server based on the device information of the Bluetooth device; the server stores the corresponding relationship between the user account and the authentication identification information of at least one device. wherein the target user account can be the user account logged in on the electronic device.

[0024] In a possible design of the second aspect, the electronic device uploads the updated authentication identification information to the server, including: when the Bluetooth device is authenticated for the first time, the electronic device uploads the updated authentication identification information to the server; so that the server establishes a corresponding relationship between the authentication identification information of the Bluetooth device and the target user account corresponding to the target electronic device. Alternatively, when the authentication scenario of the electronic device is not the first authentication, the electronic device uploads the updated authentication identification information to the server; so that the server updates the corresponding relationship between the authentication identification information of the Bluetooth device and the target user account.

[0025] In a possible design of the second aspect, the method provided in the present application may further include: the electronic device obtains the device information of the Bluetooth device. Afterwards, the electronic device determines the authentication scenario of the Bluetooth device based on the device information, and the authentication scenario includes the first authentication or the non-first authentication. Among them, the device information of the Bluetooth device may include: one or more of: Bluetooth MAC address, device ID, device name, and Bluetooth device type. The Bluetooth MAC address may include: a public device address and a random device address.

[0026] In a possible design of the second aspect, the device information of the Bluetooth device may further include: authentication indication information. The authentication indication information may be in the form of a configuration file, a field, or the like. And, the electronic device determines the authentication scenario of the Bluetooth device based on the device information, which may include: the electronic device determines the authentication scenario of the Bluetooth device based on the authentication indication information.

[0027] In a possible design of the second aspect, the electronic device generates the second verification information based on the first random number, the second random number and the authentication identification information of the Bluetooth device using a target encryption method, which may include: the electronic device adds a salt value to the authentication identification information; the salt value may be preset and the same as the electronic device, or the salt value may be the same as negotiated with the electronic device. The electronic device generates the second verification information based on the first random number, the second random number and the authentication identification information after the salt value is added using a target encryption method.

[0028] In a possible design of the second aspect, the electronic device adopts a target encryption method to generate a first authentication parameter based on a first random number, a second random number and authentication identification information, which may include: the electronic device adds a salt value to the authentication identification information; the salt value may be preset and the same as the electronic device, or the salt value may be the same as negotiated with the electronic device. The electronic device adopts a target encryption method to generate a first authentication parameter based on the first random number, the second random number and the authentication identification information after the salt value is added. In this design, it is considered that a rainbow table attack may be launched on the authentication parameter in order to steal the authentication identification information. Therefore, when generating the second authentication parameter, a salt value can be added to the authentication identification information. In this way, even if the second authentication parameter is cracked by the rainbow table, the authentication identification information in this application cannot be obtained. Only an authentication identification information with a salt value added can be obtained, which can further improve the security and reliability of the device authentication method provided in the application embodiment.

[0029] In a possible design of the second aspect, the method provided by the present application further includes: when the second authentication parameter is successfully verified, the electronic device uses the encryption method included in the Bluetooth protocol to perform encrypted transmission with the Bluetooth device. In this design, the Bluetooth device and the electronic device can encrypt the communication between the two using the encryption method specified in the Bluetooth protocol, and the communication between the two can be monitored in an effective manner. The security of the communication between the two can be effectively guaranteed.

[0030] In a possible design of the second aspect, the method provided in the present application also includes: if the electronic device receives notification information from a Bluetooth device, the electronic device uses the encryption method included in the Bluetooth protocol to perform encrypted transmission with the Bluetooth device.

[0031] In a third aspect, the present application provides a device authentication method, which can be applied to electronic devices, and the electronic devices can be terminal devices with Bluetooth connection functions, such as mobile phones, tablet computers, personal computers, etc. In this method, after the electronic device establishes a Bluetooth connection with the Bluetooth device, the electronic device obtains the authentication identification information of the Bluetooth device. Afterwards, the electronic device generates a first random number and sends the first random number to the Bluetooth device; the first random number is used to generate a second authentication parameter. Afterwards, the electronic device receives the second random number sent by the Bluetooth device, and the second authentication parameter. Afterwards, the electronic device uses a target encryption method to generate second verification information based on the first random number, the second random number and the authentication identification information. Afterwards, the electronic device verifies the second authentication parameter based on the second verification information, and disconnects the Bluetooth connection with the Bluetooth device if the electronic device fails to verify the second authentication parameter.

[0032] In a fourth aspect, the present application provides a terminal device, which may be a mobile phone, a tablet computer, a laptop computer, a car computer, a smart toothbrush, a body fat scale, a smart water cup, and the like, which have Bluetooth connection capabilities. The terminal device includes: a memory, one or more processors, and a Bluetooth module; the memory is coupled to the processor; wherein the memory stores computer program code, and the computer program code includes computer instructions; when the computer instructions are executed by the processor, the terminal device executes the method provided by the first aspect and any possible design of the first aspect. Alternatively, the terminal device executes the method provided by the second aspect and any possible design of the second aspect. Alternatively, the terminal device executes the method provided by the third aspect.

[0033] In a fifth aspect, the present application provides a computer-readable storage medium, in which instructions are stored. When the computer instructions are executed on a terminal device, the terminal device executes the method provided by the first aspect and any possible design of the first aspect. Alternatively, the terminal device executes the method provided by the second aspect and any possible design of the second aspect. Alternatively, the terminal device executes the method provided by the third aspect.

[0034] In a sixth aspect, the present application provides a computer program product comprising instructions, which, when executed on a terminal device, enables the terminal device to execute the method provided by the first aspect and any possible design of the first aspect. Alternatively, enables the terminal device to execute the method provided by the second aspect and any possible design of the second aspect. Alternatively, enables the terminal device to execute the method provided by the third aspect.

[0035] Among them, the technical effects brought about by any design method in the fourth to sixth aspects can refer to the technical effects brought about by different design methods in the first, second and third aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of a use scenario of a device authentication method provided in an embodiment of the present application;

[0037] Figure 2 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0038] Figure 3 A schematic diagram of the software structure of an electronic device provided in an embodiment of the present application;

[0039] Figure 4 A schematic diagram of the structure of a Bluetooth device provided in an embodiment of the present application;

[0040] Figure 5 A schematic diagram of a software architecture provided for an embodiment of the present application;

[0041] Figure 6 A schematic diagram of a process flow of a device authentication method provided in an embodiment of the present application;

[0042] Figure 7 A schematic diagram of a search device interface provided in an embodiment of the present application;

[0043] Figure 8 A schematic diagram of another process of the device authentication method provided in the embodiment of the present application;

[0044] Fig. 9 A schematic diagram of another process of the device authentication method provided in the embodiment of the present application;

[0045] Fig.10 is a schematic diagram of a device authentication interface provided by the example of this application;

[0046] Fig.11 is a schematic diagram of another device authentication interface provided in an embodiment of the present application;

[0047] Fig.12 A schematic diagram of a user login interface provided in an embodiment of the present application;

[0048] Fig.13 A schematic diagram of another process of the device authentication method provided in the embodiment of the present application;

[0049] Fig.14 A schematic diagram of another process of the device authentication method provided in the embodiment of the present application;

[0050] Fig.15 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] Below, before introducing the embodiments of the present application, a brief introduction to Bluetooth technology and Bluetooth devices is first given.

[0052] Bluetooth technology is an open global specification for wireless data and voice communications. It is based on low-cost short-range wireless connections and can establish a communication environment for fixed and mobile devices. It is a short-range wireless communication technology. Bluetooth technology can use a specific frequency band (around 2.4GHz-2.485GHz) to transmit electromagnetic waves. Bluetooth technology can include different versions of Bluetooth protocols, such as Bluetooth 4.0, Bluetooth 4.1, Bluetooth 4.2, Bluetooth 5.0, etc. Among them, in Bluetooth version 4.0 (that is, Bluetooth 4.0) and above, Bluetooth is divided into classic Bluetooth and Bluetooth low energy (BLE or LE for short). Compared with classic Bluetooth, BLE has lower power consumption and is more suitable for some scenarios with relatively low power consumption.

[0053] A Bluetooth device refers to a device with Bluetooth function, including at least: classic Bluetooth device, low-power Bluetooth (BLE) Bluetooth device, and dual-mode Bluetooth device. A dual-mode Bluetooth device refers to a Bluetooth device with both classic Bluetooth function and BLE function.

[0054] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Among them, in the description of the present application, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship, for example, A / B can represent A or B; "and / or" in the present application is only a description of the association relationship of the associated objects, indicating that there can be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. And, in the description of the present application, unless otherwise specified, "multiple" refers to two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple. In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art will understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not necessarily limit the differences. At the same time, in the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design solutions. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for ease of understanding.

[0055] With the development of technology and the advancement of science and technology, there are more and more Bluetooth devices around users. Users hope that their Bluetooth devices can establish connections with electronic devices through Bluetooth technology, so that electronic devices can control Bluetooth devices, receive data from Bluetooth devices, upgrade Bluetooth devices, etc.

[0056] For example, when using Bluetooth devices such as body fat scales, users will want to record their body fat changes, weight changes and other information; and adjust their work and rest, diet, exercise, etc. according to their body fat changes and weight changes. Since the processor of Bluetooth devices such as body fat scales is relatively simple, the memory space is relatively small, and the function is not very powerful. Body fat scales are not competent for data processing and data storage of body fat changes and weight changes. Therefore, users usually establish a Bluetooth connection between body fat scales and mobile phones. The data of the body fat scale is periodically transmitted to the mobile phone, and the changes in body fat and weight are monitored and analyzed through the health application (application, APP) of the mobile phone. This enables users to monitor their own physical health.

[0057] In the related art, in order to ensure the security of communication between an electronic device and a Bluetooth device, a key negotiation process is usually performed between the electronic device and the Bluetooth device, and a key is generated by the negotiation. Both the electronic device and the Bluetooth device perform encrypted transmission through the key. The key negotiation process requires multiple rounds of information exchange between the electronic device and the Bluetooth device, and the process is very cumbersome. And it is necessary to use many security-related libraries (for example, Mbed-TLS library, PolarSSL library, etc.); and the use of these libraries takes up a lot of storage space. And, after the key negotiation is passed, each communication between the two requires the use of some encryption / decryption algorithms, such as RSA algorithm, Elliptic curve cryptography (ECC) algorithm and Elliptic Curve Diffie-Hellman key Exchange (ECDH) algorithm, etc.; Among them, the RSA algorithm was proposed by Ronald Rivest, Adi Shamir and Leonard Adleman, and was named after the first letters of the three surnames. The encryption / decryption process using these algorithms is very complicated and consumes a lot of computing resources and time.

[0058] It can be seen that in the related technology, in order to ensure the security of communication between electronic devices and Bluetooth devices, the means of key negotiation are too complicated and cumbersome, and consume a lot of resources such as computing power, storage space and time. For some lightweight Bluetooth devices, these lightweight Bluetooth devices have relatively small memory space and the processor performance of Bluetooth devices is not strong, and they cannot communicate in this way, and the security of Bluetooth communication will be relatively poor.

[0059] Based on this, the present application provides a device authentication method and terminal device. In this method, the electronic device and the Bluetooth device use parameter verification to perform security authentication, and Bluetooth communication can only be performed after the security authentication is successful, which can effectively ensure the security of communication between the electronic device and the Bluetooth device, improve the complexity and cumbersomeness caused by key negotiation in related technologies, and save computing power, time, storage space and other resources. Even lightweight Bluetooth devices can ensure the security of Bluetooth communication.

[0060] In some schemes, in order to ensure the security of communication between electronic devices and Bluetooth devices, prevent other users' electronic devices from connecting to the user's own Bluetooth devices at will, and prevent the communication between electronic devices and Bluetooth devices from being monitored. After the Bluetooth connection is established, the electronic device and the Bluetooth device will carry out a key negotiation process. A key is generated by negotiation between the two. If the key negotiation between the electronic device and the Bluetooth device fails, and the key is not obtained through negotiation, it can be considered that one of the electronic device or the Bluetooth device is unreliable, not a trustworthy device, and a randomly connected device. And after the key negotiation between the two is passed, the communication between the two will be based on the key, which can be used to prevent the communication between the electronic device and the Bluetooth device from being monitored. In the above-mentioned key negotiation process, the two will exchange information for multiple rounds, and many security-related libraries need to be used. It can be seen that in these schemes, in order to ensure the security of communication between the electronic device and the Bluetooth device, the means of key negotiation will be too complicated and cumbersome. In view of this, a device authentication method and terminal device provided by the application are provided. In this method, the electronic device and the Bluetooth device do not perform a key negotiation process, but use parameter verification to authenticate each other's identities to prevent arbitrary connection between devices; and the electronic device and the Bluetooth device do not use negotiation to generate a key to encrypt the communication between the electronic device and the Bluetooth device, but use the encryption method in the Bluetooth protocol to encrypt the communication to prevent the communication between the devices from being monitored. Thereby ensuring the security of communication between the electronic device and the Bluetooth device. It can improve the complexity and cumbersome situation caused by the use of key negotiation to ensure the security of communication between the electronic device and the Bluetooth device. For lightweight BLE devices, users usually do not store data with high data security requirements, such as bank accounts, passwords, etc. on these lightweight BLE devices. Therefore, for these lightweight BLE devices, the encryption method in the Bluetooth protocol can also ensure the security of data transmission.

[0061] The device authentication method provided in this application can be applied in a near field communication communication scenario, that is, terminal device A and terminal device B establish a near field communication connection through near field communication technology. Among them, the near field communication technology can be Bluetooth technology, ZigBee technology, 433 megahertz (MHz) communication technology, 2.4 gigahertz (GHz) communication technology, etc.

[0062] The following will take the Bluetooth technology as an example to illustrate the application scenarios of this application. Figure 1 , Figure 1 A schematic diagram of a use scenario of the device authentication method provided in an embodiment of the present application. After the electronic device 100 establishes a Bluetooth connection with the Bluetooth device 400, in order to ensure the security of the communication between the electronic device 100 and the Bluetooth device 400, the Bluetooth device 400 will perform a device authentication process with the electronic device 100; the process can be completed by the electronic device 100 and the Bluetooth device 400 with the help of the server 500.

[0063] Exemplarily, the electronic device in the embodiments of the present application can be a portable computer (such as a mobile phone), a tablet computer, a laptop computer, a personal computer (PC), a wearable electronic device (such as a smart watch), an augmented reality (AR) / virtual reality (VR) device, a car computer, and other devices that can connect to the Internet and have Bluetooth connection capability.

[0064] The Bluetooth device in the embodiment of the present application may be a classic Bluetooth device, a BLE device, a dual-mode Bluetooth device, etc. For example: smart home devices, smart toothbrushes, body fat scales, smart water cups, smart blood pressure monitors, and other electronic devices with Bluetooth connection capabilities. Also, the server in the embodiment of the present application may be a cloud server, a heterogeneous server, a virtual server, etc. The following embodiments do not impose any special restrictions on the specific forms of the electronic device, the Bluetooth device, and the server.

[0065] For example, the electronic device is a mobile phone. Figure 2, which shows a schematic diagram of the structure of an electronic device 100 provided in an embodiment of the present application. The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. Among them, the sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0066] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or separate some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0067] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0068] The controller may be the nerve center and command center of the electronic device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0069] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0070] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0071] The I2S interface can be used for audio communication. In some embodiments, the processor 110 can include multiple I2S buses. The processor 110 can be coupled to the audio module 170 via the I2S bus to achieve communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 via the I2S interface to achieve the function of answering a call through a Bluetooth headset.

[0072] The PCM interface can also be used for audio communication, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 can be coupled via a PCM bus interface. In some embodiments, the audio module 170 can also transmit audio signals to the wireless communication module 160 via the PCM interface to realize the function of answering calls via a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.

[0073] The UART interface is a universal serial data bus for asynchronous communication. The bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, the UART interface is generally used to connect the processor 110 and the wireless communication module 160. For example, the processor 110 communicates with the Bluetooth module in the wireless communication module 160 through the UART interface to implement the Bluetooth function. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 through the UART interface to implement the function of playing music through a Bluetooth headset.

[0074] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0075] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0076] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0077] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), global navigation satellite systems (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and filters it, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0078] The wireless communication module 160 may further include a classic Bluetooth module and / or a Bluetooth Low Energy (BLE) module.

[0079] The electronic device 100 can realize functions such as communication and data transmission through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, etc.

[0080] Exemplarily, in the embodiment of the present application, the electronic device 100 can establish a Bluetooth connection with the Bluetooth device through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, etc., and receive device information, random numbers, authentication parameters, etc. from the Bluetooth device.

[0081] For example, in the embodiment of the present application, the electronic device 100 can also establish communication with the server through the antenna 1, the antenna 2, the mobile communication module 150, and the wireless communication module 160 to receive authentication identification information and authentication history records from the server.

[0082] The internal memory 121 can be used to store computer executable program codes, which include instructions. The processor 110 executes various functional applications and data processing of the electronic device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0083] Exemplarily, in an embodiment of the present application, after the electronic device 100 establishes a Bluetooth connection with the Bluetooth device. The electronic device can obtain the device information of the Bluetooth device through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, etc. The processor 110 can generate authentication identification information based on the device information of the Bluetooth device through the computer executable program code stored in the internal memory 121. Alternatively, the authentication identification information is obtained from the server through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, mobile communication module 150, etc. The processor 100 of the electronic device 100 will generate authentication parameters based on the authentication identification information and perform device authentication with the Bluetooth device.

[0084] The software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. In the embodiment of the present invention, the Android system of the layered architecture is taken as an example to exemplify the software structure of the electronic device 100.

[0085] Figure 3 It is a schematic diagram of the software structure of the electronic device 100 provided in an embodiment of the present application.

[0086] The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into five layers, from top to bottom: application layer, application framework layer, Android runtime and system library, kernel layer and underlying protocol layer.

[0087] The application layer can include a series of application packages. Figure 3As shown, the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, APP with Bluetooth management function (for example, smart space APP), etc. The application framework layer provides application programming interface (API) and programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0088] Android runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0089] The core library consists of two parts: one part is the function that needs to be called by the Java language, and the other part is the Android core library.

[0090] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0091] The system library can include multiple functional modules. For example: surface manager, media library, 3D graphics processing library (for example: OpenGL ES), 2D graphics engine (for example: SGL), etc. The surface manager is used to manage the display subsystem and provide fusion of 2D and 3D layers for multiple applications. The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc. The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, synthesis, and layer processing, etc. The 2D graphics engine is a drawing engine for 2D drawing.

[0092] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0093] The bottom protocol layer is used to provide the protocols required for the electronic device to work, which may include: Bluetooth protocol, Wi-Fi protocol, message queuing telemetry transport protocol (MQTT) and hypertext transport protocol over secure socket layer (HTTPS), etc. Among them, the Bluetooth protocol may include classic Bluetooth protocol and / or BLE Bluetooth protocol.

[0094] like Figure 3 As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, etc. The window manager is used to manage window programs. The window manager can obtain the size of the display screen, determine whether there is a status bar, lock the screen, capture the screen, etc. The content provider is used to store and obtain data and make the data accessible to the application. The data may include video, images, audio, calls made and received, browsing history and bookmarks, phone books, etc. The view system includes visual controls, such as controls for displaying text, controls for displaying pictures, etc. The view system can be used to build applications. The display interface can be composed of one or more views. The phone manager is used to provide communication functions for the electronic device 100. For example, the management of call status (including connected, hung up, etc.). The resource manager provides various resources for the application, such as localized strings, icons, pictures, layout files, video files, etc.

[0095] Among them, the application framework layer can also include a device management layer and a device connection layer. Both the device management layer and the device connection layer are used to provide services related to device connection and management for the electronic device 100. For example, data and functional support are provided for Bluetooth management apps. For example, the device management layer may include: a device registration module, a device query module, a device control module, etc. The device connection layer may include: a device discovery module, a device connection module, a device authentication module, etc.

[0096] For example, see Figure 4 , Figure 4 This is a schematic diagram of the structure of a Bluetooth device provided in an embodiment of the present application. It should be understood that Figure 4 The Bluetooth device 400 shown is only an example. In other embodiments, the Bluetooth device 400 may have more Figure 4 The more or less components shown in the figure may be combined with two or more components, or may have different component configurations. The various components shown in the figure may be implemented in hardware, software, or a combination of hardware and software including one or more signal processing and / or application specific integrated circuits.

[0097] like Figure 4 As shown, the Bluetooth device 400 may include a processor 401, a memory 402, a Bluetooth communication module 403, an antenna 404, a power switch 405, a USB communication processing module 406, and an audio processing module 407. Among them: the processor 401 can be used to read and execute computer-readable instructions. In a specific implementation, the processor 401 may mainly include a controller, an arithmetic unit, and a register. Among them, the controller is mainly responsible for decoding instructions and sending control signals for operations corresponding to the instructions. The arithmetic unit is mainly responsible for saving register operands and intermediate operation results temporarily stored during the execution of instructions. In a specific implementation, the hardware architecture of the processor 401 may be an application-specific integrated circuit (ASIC) architecture, a MIPS architecture, an ARM architecture, or an NP architecture, etc.

[0098] In some embodiments, the processor 401 may be used to parse signals received by the Bluetooth communication module 403, such as query requests and paging requests sent by electronic devices. The processor 401 may be used to perform corresponding processing operations according to the parsing results, such as performing Bluetooth scanning or Bluetooth pairing.

[0099] The memory 402 is coupled to the processor 401 and is used to store various software programs and / or multiple sets of instructions. In a specific implementation, the memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more disk storage devices, flash memory devices, or other non-volatile solid-state storage devices. The memory 402 may store an operating system, such as uCOS, VxWorks, RTLink, and other embedded operating systems. The memory 402 may also store a communication program, which may be used to communicate with the electronic device 100.

[0100] The Bluetooth communication module 403 may include a classic Bluetooth module and / or a Bluetooth Low Energy (BLE) module.

[0101] The wireless communication function of the Bluetooth device 400 can be implemented through the antenna 404, the Bluetooth communication module 403, the modem processor, etc.

[0102] Antenna 404 can be used to transmit and receive electromagnetic wave signals. Each antenna in Bluetooth device 400 can be used to cover a single or multiple communication frequency bands. In some embodiments, the Bluetooth communication module 403 can have one or more antennas. Power switch 405 can be used to control the power supply to Bluetooth device 400. USB communication processing module 406 can be used to connect to the Bluetooth device 400 through a USB interface ( Figure 4In some embodiments, the Bluetooth device 400 may also include a serial interface such as an RS-232 interface. The serial interface may be connected to other devices, such as an audio external speaker device such as a speaker, so that the Bluetooth device 400 and the audio external speaker device can collaborate to play audio and video.

[0103] Exemplarily, the Bluetooth device 400 can establish a Bluetooth connection with the electronic device 100 through the antenna 404, the Bluetooth communication module 403, the modem processor, etc. After the Bluetooth device 400 establishes a Bluetooth connection with the electronic device 100, the processor 401 can run the computer-readable instructions stored in the memory 402 to generate authentication identification information. And in the process of authenticating with the electronic device 100, the authentication parameters are generated by the authentication identification information to perform device authentication with the electronic device.

[0104] It should be understood that Figure 4 The structure shown is only an example and does not constitute a specific limitation on the Bluetooth device 400. In the following embodiments of the present application, the Bluetooth device 400 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of hardware and software.

[0105] See also Figure 5 , Figure 5A software architecture diagram provided for an embodiment of the present application. The device management layer of the electronic device in the figure includes: a device registration module 502, a device query module 503, a device control module 504 and an information forwarding module 514. The device connection layer may include: a device discovery module 505, a device connection module 506, and a device authentication module 507. Among them, the device registration module 502 is mainly used to register the Bluetooth device after the electronic device and the Bluetooth device are authenticated for the first time, and register the device information of the Bluetooth device to the server. The device query module 503 is used to query the device information of the Bluetooth device 400 from the server 500. The device control module 504 is mainly responsible for device control based on various protocols. For example, a control instruction is sent to a Bluetooth device through a protocol provided by the underlying protocol layer, and a control instruction is sent to a service through a protocol provided by the underlying protocol layer, etc. The protocols adopted include but are not limited to Bluetooth protocol, Wi-Fi protocol, message queuing telemetry transport (MQTT) protocol and hypertext transfer security (HTTPS) protocol. And through the above protocol, control the switch of Bluetooth devices, query Bluetooth device data, perform Over-the-Air Technology (OTA) upgrades on Bluetooth devices, restore factory settings on Bluetooth devices, and other operations. For example, the device control module 504 can obtain information about Bluetooth devices from the Bluetooth device 400 through the Bluetooth protocol, and control the switch of the Bluetooth device, parameter adjustment, etc. For another example, the device control module 504 can also obtain an OTA upgrade package from a server based on one or more of the Wi-Fi protocol, MQTT, and HTTPS protocols, and use the OTA upgrade package to perform OTA upgrades on the Bluetooth device through the Bluetooth protocol.

[0106] The device discovery module 505 mainly performs complex scanning to discover the Bluetooth device 400, and after discovering the Bluetooth device 400, the device connection module 506 establishes a Bluetooth connection with the Bluetooth device 400. The device authentication module 507 is mainly responsible for authenticating whether the Bluetooth device 400 is credible.

[0107] To cooperate with the electronic device 100, the server 500 and the Bluetooth device 400 should include the following architecture:

[0108] The server 500 may include: a device registration module 508, a device information storage module 509. The Bluetooth device 400 may include: a device authentication module 510, a device registration module 512 and a processing module 513. Among them, the device registration module 508 of the server 500, the device registration module 512 of the Bluetooth device 400 and the device registration module 502 of the electronic device 100 cooperate with each other to register the Bluetooth device after the Bluetooth device is authenticated for the first time. After the registration is successful, the device authentication module of the Bluetooth device generates the authentication identification information of the Bluetooth device, and forwards the generated authentication identification information to the server 500 through the information forwarding module 514 of the electronic device 100. And the device information storage module 509 of the server 500 stores it.

[0109] In summary, Figure 5 In the software architecture diagram shown, the electronic device 100 can establish a Bluetooth connection with the Bluetooth device 400 through the device discovery module 505 and the device connection module 506. After the Bluetooth connection is established, the electronic device 100 will obtain the authentication identification information of the Bluetooth device 400; the device authentication module 507 of the electronic device 100 will generate authentication parameters based on the authentication identification information. Similarly, the device authentication module 512 of the Bluetooth device 400 will also generate authentication parameters based on the authentication identification information. The Bluetooth device 400 and the electronic device 100 respectively compare whether the authentication parameters generated by the other party are the same as the authentication parameters generated by themselves to verify the reliability and security of the other party.

[0110] Below, the device authentication method provided by the embodiment of the present application will be specifically described in conjunction with the accompanying drawings and application scenarios. For Bluetooth devices, the authentication scenarios when performing device authentication can be divided into first-time authentication scenarios and non-first-time authentication scenarios. In these two scenarios, the device authentication method provided by the present application will be slightly different. Among them, the first authentication can be understood as no successful authentication with the electronic device after the Bluetooth device leaves the factory or restores the factory settings. In other words, the registration information of the Bluetooth device does not exist on the server, and the Bluetooth device has not been successfully registered on the server.

[0111] First, take the first authentication scenario as an example to introduce the device authentication method provided by this application. Figure 6 ; Figure 6 A schematic diagram of a flow chart of a device authentication method provided in an embodiment of the present application. The device authentication method may include steps S101-S104.

[0112] S101. The electronic device searches for a Bluetooth device and establishes a Bluetooth connection with the Bluetooth device.

[0113] Electronic devices can use the methods provided in the Bluetooth protocol to search for Bluetooth devices and establish Bluetooth connections with Bluetooth devices.

[0114] As a possible implementation, the process may be as follows:

[0115] When the electronic device is not connected to the Bluetooth device, after the electronic device turns on the Bluetooth function, the electronic device can send an inquiry request to the surrounding. When the Bluetooth device is in the inquiry scan state, the Bluetooth device can scan the inquiry request sent by the electronic device. In response to the scanned inquiry request, the Bluetooth device can send an inquiry response to the electronic device, so that the electronic device obtains the Bluetooth device as a pairable Bluetooth device option. After the user selects the device option of the Bluetooth device, the electronic device can send a paging request to the Bluetooth device. The Bluetooth device can monitor the paging request of the electronic device at a certain frequency modulation frequency within a fixed time window at a fixed interval. After monitoring the paging request of the electronic device, the Bluetooth device can send a slave paging response to the electronic device in the next time slot (time window). After receiving the slave paging response of the Bluetooth device, the electronic device can send a master paging response to the Bluetooth device in the next time slot. Based on this, a Bluetooth connection is established between the electronic device and the Bluetooth device.

[0116] For example, the Bluetooth device is a BLE device and the Bluetooth protocol is a BLE protocol. Figure 5 The software architecture shown describes the Bluetooth connection process between the electronic device 100 and the Bluetooth device 400.

[0117] When the electronic device 100 is not connected to the Bluetooth device 400, after the Bluetooth function of the electronic device 100 is turned on, the device discovery module 505 of the electronic device will broadcast (advertising) and send a broadcast event (advertising event). The broadcast event will include the above-mentioned query request. The electronic device obtains the Bluetooth device as a pairable Bluetooth device option. Among them, the broadcast event (advertising event) is to send one or more broadcast packets (for example, ADV_IND broadcast packets) at a preset broadcast interval. Among them, the broadcast packet can be sent simultaneously on one or more radio frequency channels. In one possible implementation, a Bluetooth management application is provided on the electronic device. After the electronic device starts the Bluetooth management application, it establishes a Bluetooth connection with the Bluetooth device in response to the user's operation. Exemplarily, the Bluetooth management application can be a smart space APP; see Figure 7 , Figure 7A schematic diagram of a search device interface provided in an embodiment of the present application. Figure 7 Part (a) in the figure is the display interface of the Smart Space APP in the electronic device. There is an "Add Device" control on the display interface. When the user clicks the control, the Bluetooth function of the electronic device is turned on for the user. The device discovery module of the electronic device will broadcast and send broadcast events. The display interface can jump to Figure 7 The interface shown in part (b) indicates that the electronic device starts scanning and discovering Bluetooth devices.

[0118] If the Bluetooth device 400 turns on its own Bluetooth function at this time, the Bluetooth device 400 will scan on the above one or more radio frequency channels. After the Bluetooth device 400 scans the broadcast packet sent by the electronic device 100, the Bluetooth device 400 will send a query response to the electronic device 100. In response to the device discovery module 505 of the electronic device 100 receiving the query response, the electronic device 100 can obtain the Bluetooth device as a pairable Bluetooth device option. For example, see again Figure 7 , Figure 7 In part (c) of FIG. 1 , the electronic device displays the scanned Bluetooth device (shown as an electronic scale), but the electronic device and the Bluetooth device are not connected at this time. Figure 7 As shown in part (d) of FIG. 1 , if the user selects the Bluetooth device, the electronic device will send a paging request to the Bluetooth device to request to establish a Bluetooth connection with the Bluetooth device. Specifically, in Figure 5 In the software architecture shown. In response to the user selecting the device option of the Bluetooth device, the device connection module 506 of the electronic device 100 can send a paging request to the Bluetooth device 400. The Bluetooth device 400 can monitor the paging request of the electronic device 100 at a certain frequency modulation frequency within a fixed time window at fixed intervals. After monitoring the paging request of the electronic device 100, the Bluetooth device 400 can send a slave device paging response to the electronic device in the next time slot. After receiving the slave device paging response of the Bluetooth device 100, the device connection module 506 of the electronic device 100 can send a master device paging response to the Bluetooth device in the next time slot. Based on this, a Bluetooth connection is established between the electronic device and the Bluetooth device.

[0119] As a possible implementation, when the Bluetooth device is a BLE device, the electronic device can establish a Bluetooth connection with the BLE device in just work mode. When the Bluetooth device is a classic Bluetooth device, the electronic device can establish a Bluetooth connection with the classic Bluetooth device in just work mode.

[0120] As a possible implementation method, after the electronic device and the Bluetooth device establish a Bluetooth connection, the communication between the electronic device and the Bluetooth device can be protected by the encryption method in the Bluetooth protocol, which can effectively prevent the communication between the electronic device and the Bluetooth device from being monitored. For lightweight BLE devices, users usually do not store data with high data security requirements, such as bank accounts, passwords, etc. on these lightweight BLE devices. Therefore, for these lightweight BLE devices, the encryption method in the Bluetooth protocol can also ensure the security of data transmission.

[0121] S102. The electronic device obtains device information of the Bluetooth device, and determines that it is a first authentication scenario based on the device information.

[0122] Among them, the device information of the Bluetooth device may include: Bluetooth Media Access Control (MAC) address, device ID, device name, Bluetooth device type or one or more. Among them, the Bluetooth device may include: classic Bluetooth device or BLE device, dual-mode device, etc. The authentication indication information can be used to indicate whether the Bluetooth device is authenticated for the first time. For BLE devices, the Bluetooth MAC address may include: public device address (Public Device Address) and random device address (Random Device Address). The public device address is unique and will not change. Since BLE devices mostly perform broadcast communication when communicating, after obtaining the Bluetooth MAC address, theoretically any device can perform broadcast communication with the Bluetooth device. Therefore, in order to improve the security of BLE device communication, the Bluetooth MAC address of the BLE device can use the form of public device address + random device address to improve the security of BLE device communication.

[0123] In some embodiments, the device information of the Bluetooth device may also include authentication indication information. The authentication indication information may be in the form of a configuration file, a field, or the like. Exemplarily, the authentication indication information may be in the form of a configuration file, which records the number of times the Bluetooth device has been successfully authenticated. When the number of successful authentications of a Bluetooth device is 0, the Bluetooth device is considered to be authenticated for the first time. Alternatively, the authentication indication information may also be in the form of a field. For example, the first_certification field may be used to record whether the Bluetooth device is authenticated for the first time. When the value of the first_certification field is 1, the Bluetooth device is considered to be authenticated for the first time. When the value of the first_certification field is 0, the Bluetooth device is considered not to be authenticated for the first time.

[0124] As a possible implementation, when the Bluetooth device is a BLE device, the electronic device can use the method of scanning Bluetooth broadcasts, BluetoothDevice.connectGatt command, and sending and receiving BLE data to obtain the Bluetooth MAC address, device ID, device name, Bluetooth device type, authentication indication information, etc. of the BLE device. When the Bluetooth device is a classic Bluetooth device, the electronic device can use the method of scanning Bluetooth broadcasts, BluetoothDevice.createRfcommSocketToServiceRecord command, and sending and receiving Bluetooth data to obtain the device ID, device name, Bluetooth device type, authentication indication information, etc. of the classic Bluetooth device.

[0125] As a possible implementation, the electronic device may determine that the authentication scenario of the Bluetooth device is the first authentication scenario based on the authentication indication information in the device information. For example, when the authentication indication information is in the form of a configuration file, the electronic device may determine that the Bluetooth device is in the first authentication scenario based on the number of authentications recorded in the file being 0. Alternatively, when the authentication indication information is in the form of a field, the electronic device may determine that the Bluetooth device is in the first authentication scenario based on the value of the field.

[0126] As a possible implementation, the electronic device can also determine whether the Bluetooth device is in the first authentication scenario based on the Bluetooth MAC address in the device information. For example, the electronic device will locally record the MAC address of the Bluetooth device that has been authenticated with itself, and form an authentication history record. After the electronic device obtains the MAC address of the Bluetooth device, the electronic device can query the MAC address of the Bluetooth device in the authentication history record. If it is found that the MAC address of the Bluetooth device does not exist in the authentication history record, it can be considered that the Bluetooth device is in the first authentication scenario.

[0127] Considering that in some scenarios, the user may have multiple electronic devices and connect to the electronic devices through multiple electronic devices respectively. For example, the user may use a mobile phone to connect to a body fat scale through Bluetooth in the morning of a certain day, and use a tablet computer to connect to a body fat scale through Bluetooth in the afternoon. In some embodiments, the electronic device uploads the authentication history record to the server. The server binds the authentication history record to the user account logged in on the electronic device. After the electronic device obtains the MAC address of the Bluetooth device, the electronic device can obtain the authentication history records of all electronic devices under the user account logged in on the electronic device from the server, and use the authentication history record to determine whether the Bluetooth device is the first authentication scenario.

[0128] S103. The electronic device and the Bluetooth device each generate authentication identification information of the Bluetooth device based on the device information of the Bluetooth device.

[0129] Wherein, the authentication identification information may be a personal identification number (PIN) code. The authentication identification information may be generated by a preset identification information generation algorithm. Wherein, the preset identification information generation algorithm may generate the authentication identification information of the Bluetooth device through the device information of the Bluetooth device. In some embodiments, the identification information generation algorithm may generate the authentication identification information of the Bluetooth device through the MAC address of the Bluetooth device. In some embodiments, the identification information generation algorithm may also generate the authentication identification information of the Bluetooth device through the device ID of the Bluetooth device and the MAC address of the Bluetooth device.

[0130] Exemplarily, the device information includes a Bluetooth MAC address, the Bluetooth MAC address includes a public device address and a random device address, and the authentication identification information is a PIN code, and step S103 is introduced in detail. Step S103 may include steps S103a1-S103a4.

[0131] S103a1. The electronic device extracts the public device address from the Bluetooth MAC address.

[0132] For example, since there are certain rules for Bluetooth MAC addresses, for example, for a 48-bit Bluetooth MAC address, the first 24 bits are the public device address and the last 24 bits are the random device address, this embodiment can extract the first 24 bits of the Bluetooth MAC address to obtain the public device address.

[0133] S103a2. The electronic device generates a PIN code based on the public device address using a preset identification information generation algorithm.

[0134] S103a3 Bluetooth device extracts the public device address in the Bluetooth MAC address;

[0135] S103a4. The Bluetooth device generates a PIN code based on the public device address using a preset identification information generation algorithm, wherein the preset identification information generation algorithm is the same as the identification information generation algorithm in the electronic device.

[0136] When the Bluetooth device is a BLE device, the Bluetooth MAC address will appear in the form of a combination of a public device address + a random device address. Since the random device address is generated by the BLE device when the Bluetooth is connected, it will change every time it is connected. Therefore, the embodiment of the present application is to ensure the uniqueness of the PIN code generated during the first authentication. The embodiment of the present application can use the unique and unchanged public device address in the MAC address to generate the PIN code; it can ensure the uniqueness of the generated PIN code in the first authentication scenario, thereby improving the stability of the device authentication method provided in the embodiment of the present application.

[0137] In some embodiments, the preset identification information generation algorithm can reassemble the public device address to generate a PIN code. For example, the first 12 bits and the last 12 bits of the public device address can be swapped and used as the PIN code.

[0138] In some embodiments, the preset identification information generation algorithm may also generate a PIN code based on the random device address, for example, by performing a hash operation on the random device address and using the result of the hash operation as the PIN code.

[0139] It can be understood that in actual applications, the PIN code can be generated by the electronic device first, or by the Bluetooth device first, or by the electronic device and the Bluetooth device at the same time; reasonable adjustments can be made according to actual application conditions, and this application does not limit this.

[0140] S104. The electronic device and the Bluetooth device respectively generate authentication parameters based on the authentication identification information, exchange authentication parameters with each other, and verify each other's authentication parameters.

[0141] In step S104, if the authentication parameter verification is successful, it indicates that the electronic device and the Bluetooth device can trust each other, and the electronic device will maintain a Bluetooth connection with the Bluetooth device; and data transmission, OTA upgrade and other operations can be performed subsequently.

[0142] In addition, in step S104, if the authentication parameter verification fails, it indicates that one of the electronic device and the Bluetooth device is an untrusted device, and the Bluetooth connection between the Bluetooth device and the electronic device is disconnected, thereby preventing user data from being leaked and stolen.

[0143] As a possible implementation, the electronic device and the Bluetooth device may also directly perform the parameter verification process only once. For example, the Bluetooth device may generate authentication parameters for the electronic device to verify. If the electronic device fails to verify the authentication parameters, it may be considered that the Bluetooth device is untrustworthy, and the communication connection with the Bluetooth device will be disconnected. For another example, the electronic device may also generate authentication parameters for the Bluetooth device to verify. If the Bluetooth device fails to verify the authentication parameters, it may be considered that the Bluetooth device is untrustworthy, and the communication connection with the Bluetooth device will be disconnected.

[0144] As a possible implementation, the above authentication parameters may include: a first authentication parameter and a second authentication parameter. The Bluetooth device may generate a random number R1 using a preset random number generation method; similarly, the electronic device may also generate a random number R2 using a preset random number generation method. The electronic device and the Bluetooth device exchange R1 and R2 with each other. Afterwards, the electronic device may generate a first authentication parameter based on R1, R2 and authentication identification information using a preset encryption method; similarly, the Bluetooth device may also generate a second authentication parameter based on R1, R2 and authentication identification information using a preset encryption method. Among them, the first authentication parameter is different from the second authentication parameter. To ensure that the first authentication parameter is different from the second authentication parameter, the electronic device may calculate the value of R1+R2, and concatenate the value of R1+R2 with the authentication identification information, and after concatenation, use a preset encryption method to generate the first authentication parameter; the Bluetooth device may also calculate the value of R1*R2, and concatenate the value of R1*R2 with the authentication identification information, and after concatenation, use a preset encryption method to generate the second authentication parameter.

[0145] After the electronic device generates the first authentication parameter, the electronic device will send the first authentication parameter to the Bluetooth device, and the Bluetooth device can verify the first authentication parameter to verify whether the electronic device is credible. The process of the Bluetooth device verifying the first authentication parameter can be as follows:

[0146] The Bluetooth device uses the same encryption method as the electronic device or the same encryption method negotiated by both parties to generate a verification message based on R1, R2 and the authentication identification information, and compares the verification information with the first authentication parameter to see if they are the same. If the verification information is the same as the first authentication parameter, the first authentication parameter verification is successful, and the electronic device can be considered trustworthy. If they are not the same, the first authentication parameter verification fails, and the electronic device can be considered untrustworthy. The Bluetooth connection with the electronic device will be disconnected to avoid data leakage of users on the Bluetooth device, thereby threatening the user's information security.

[0147] Similarly, after the Bluetooth device verifies that the electronic device is credible, the electronic device also needs to verify whether the Bluetooth device is credible. Based on this, the Bluetooth device can generate a second authentication parameter based on R1, R2 and the authentication identification information, and send the second authentication parameter to the electronic device. The electronic device can verify whether the Bluetooth device is credible by verifying the second authentication parameter. This process is similar to the process of the Bluetooth device verifying the first authentication parameter, and will not be repeated here.

[0148] As a possible implementation, when parameter verification fails, disconnection indication information may be transmitted between the electronic device and the Bluetooth device, and the disconnection indication information may be used to indicate disconnection of the Bluetooth connection between the two.

[0149] As a possible implementation, after both the electronic device and the Bluetooth device are successfully authenticated, the electronic device (Bluetooth device) may send a notification message to the other party, and the notification message may be used to indicate that the electronic device (Bluetooth device) has successfully authenticated the authentication parameters.

[0150] It should be noted that in the embodiment of the present application, the Bluetooth device can first verify whether the electronic device is trustworthy, or the electronic device can first verify whether the Bluetooth device is trustworthy. The present application does not limit the order in which the Bluetooth device and the electronic device verify whether they are trustworthy with each other.

[0151] Among them, the preset random number generation method can be implemented in the form of a table lookup. For example, one or more built-in random number tables can be pre-configured. Whenever a random number needs to be generated, a random number can be selected from the random number table in order or in reverse order. And, the preset random number generation method can also be implemented in the form of a function. For example, using the random function, whenever a random number needs to be generated, a random number can be obtained by calling the random function.

[0152] The preset encryption method may be a cryptographic hash function, also known as an encrypted hash function, such as the MD5 message-digest algorithm (MD5), a hash algorithm such as SHA-1, SHA-256, and the like.

[0153] It can be seen that if the parameter verification is passed, it indicates that the electronic device and the Bluetooth device are devices that can trust each other, and the Bluetooth device and the electronic device can communicate securely. In some embodiments, during the communication process between the electronic device and the Bluetooth device, both perform encrypted transmission in the encryption method specified in the Bluetooth protocol. For example, after the Bluetooth device successfully verifies the first authentication parameter, the electronic device and the Bluetooth device can perform encrypted transmission in the encryption method specified in the Bluetooth protocol. For another example, after the electronic device successfully verifies the second authentication parameter, the electronic device and the Bluetooth device can perform encrypted transmission in the encryption method specified in the Bluetooth protocol.

[0154] It can be seen that the solution provided by the embodiment of the present application mainly uses the authentication parameters generated by the authentication identification information, and uses the parameter verification method between the electronic device and the Bluetooth device to authenticate each other's identity, to verify whether the other party is credible, thereby preventing the random connection between devices. Because before the authentication is passed, there is no trust between the two parties (Bluetooth device or electronic device) performing the authentication. The authentication identification information will not be transmitted between the Bluetooth device and the electronic device, and only the random numbers R1 and R2 used to assist in generating the authentication parameters will be transmitted. In this way, even if one of the two parties performing the authentication is unsafe, the unsafe device can only obtain the random number and authentication parameters, and cannot directly obtain the authentication identification information. The device authentication process between the electronic device and the Bluetooth device cannot be cracked by the random number and authentication parameters, thereby preventing the random connection between devices, thereby ensuring the security of communication between devices.

[0155] At the same time, in the present application, in the process of generating authentication parameters based on authentication identification information, there is no need to use a very complex algorithm, for example, it can be achieved only by using an encrypted hash function, which can effectively save computing power resources and time resources of electronic devices and Bluetooth devices.

[0156] The following will take the preset encryption method as a hash algorithm and the authentication identification information as a PIN code as an example to describe step S104 in detail. Figure 8 , Figure 8 This is another flow chart of the device authentication method provided in the embodiment of the present application. Step S104 may include: S104a1-S104a10.

[0157] S104a1. The electronic device generates a random number R2.

[0158] For example, the electronic device may use a random function to generate a random number R2.

[0159] S104a2. The electronic device sends a random number request to the Bluetooth device.

[0160] S104a3. The Bluetooth device generates a random number R1 in response to the random number request.

[0161] For example, the Bluetooth device may use a preset random number table to generate the random number R1.

[0162] S104a4. The Bluetooth device sends the random number R1 to the electronic device.

[0163] S104a5. The electronic device generates a first authentication parameter based on R1, R2 and the PIN code.

[0164] As a possible implementation, the electronic device may first calculate the value of R1+R2, and concatenate the value of R1+R2 and the PIN code, and after concatenation, use the SHA256 method to generate the first authentication parameter. The value of R1+R2 and the PIN code may be concatenated in the order of the value of R1+R2 first and the PIN code later. The value of R1+R2 may also be inserted into the PIN code to achieve concatenation, which is not limited in this application.

[0165] As a possible implementation, the electronic device may also use a key-related hash operation message authentication code (Hash-based Message Authentication Code, HMAC) function to generate a first authentication parameter based on R1, R2 and a PIN code. Among them, the HMAC function is a method of constructing a message authentication code using a one-way hash function, which takes a key and a message as input and generates a message digest as output. For example, R1+R2 can be used as the message input, and the PIN code can be used as the key input; the first authentication parameter C1 as the message digest output is obtained, that is, C1=HmacSHA256(R1+R2, PIN). Among them, HmacSHA256 indicates that the one-way hash function used by the HMAC function is a hash 256 function.

[0166] S104a6. The electronic device sends the first authentication parameter and R1 to the Bluetooth device.

[0167] S104a7. In response to receiving the first authentication parameter and R1 sent by the electronic device, the Bluetooth device verifies whether the first authentication parameter is the same based on R1, R2 and the PIN code.

[0168] It is understandable that after the Bluetooth device receives the first authentication parameter sent by the electronic device, it will also use a hash algorithm to verify whether the first authentication parameter is the same through R1, R2 and the first authentication representation information. For example, it can be done by:

[0169] C1`=HmacSHA256(R1+R2, PIN) is used to obtain C1` and compare C1` with C1 sent by the electronic device. If they are consistent, then for the Bluetooth device, the electronic device can be trusted, and it is safe to continue communicating with the electronic device, and no information security issues will arise, and Bluetooth communication can continue. If they are inconsistent, then for the Bluetooth device, the electronic device cannot be trusted, and it is dangerous to continue Bluetooth communication, and information security issues will arise, and Bluetooth communication cannot continue. Therefore, if the Bluetooth device verifies that C1` is inconsistent with C1, the Bluetooth device will actively disconnect the Bluetooth connection with the electronic device.

[0170] S104a8. The Bluetooth device generates a second authentication parameter based on R1, R2 and the PIN code.

[0171] As a possible implementation, the Bluetooth device may use an HMAC function to generate a second authentication parameter C2 based on R1, R2 and a PIN code, ie, C2 = HmacSHA256 (R1*R2, PIN).

[0172] S104a9. The Bluetooth device sends the second authentication parameter to the electronic device.

[0173] S104a10. In response to receiving the second authentication parameter sent by the Bluetooth device, the electronic device verifies whether the second authentication parameter is the same based on R1, R2 and the PIN code.

[0174] Similarly, the electronic device can also obtain C2` by calculating C2`=HmacSHA256(R1*R2, PIN) and compare whether C2` is consistent with C2.

[0175] Based on this, the device authentication method provided in the embodiment of the present application can complete parameter verification between the electronic device and the Bluetooth device with only a few information exchanges, and can complete the authentication of each other's identity. The process is relatively simple. At the same time, there is no need to use a particularly complex algorithm in the process of performing authentication parameter verification, and it can be completed only through an encrypted hash function. It does not occupy too much memory and processor resources of the Bluetooth device, and can reduce the pressure on the Bluetooth device hardware. Using the device authentication method provided by the present application can effectively improve the complex and cumbersome situation caused by using key negotiation to ensure the security of communication between devices.

[0176] As a possible implementation, in some scenarios, rainbow-tables attacks may be launched on authentication parameters in order to steal authentication identification information. For example, a rainbow table is used to reversely infer the PIN code through the first authentication parameter and / or the second authentication parameter. Therefore, when generating the first authentication parameter and the second authentication parameter, a salt value may be added to the PIN code to prevent rainbow table attacks.

[0177] Exemplarily, when the electronic device generates the first authentication parameter based on R1, R2 and the PIN code, a salt value FactorA can be added to the PIN code. After the salt value FactorA is added, even if the first authentication parameter is obtained, the PIN code cannot be obtained by using a rainbow table to crack the first authentication parameter, but a cracked value of the PIN code with the salt value added is obtained. Since the attacker cannot know the position of the salt value on the PIN code and the size of the salt value, the attacker cannot obtain the PIN code, which can improve the security and reliability of the device authentication method provided in the embodiment of the present application, and provide the method with the ability to defend against rainbow table attacks.

[0178] For example, in step S104a5, after adding the salt value FactorA, C1 can be calculated in the following way:

[0179] C1=HmacSHA256(R1+R2, PIN+FactorA).

[0180] Correspondingly, for step S104a7, after adding the salt value FactorA, C1' can be calculated in the following way:

[0181] C1`=HmacSHA256(R1+R2, PIN+FactorA).

[0182] It can be understood that the salt value FactorA can be the same as the preset one, or can be the same as negotiated between the electronic device and the Bluetooth device.

[0183] In order to further improve the security of this embodiment and the ability to defend against rainbow table attacks, a salt value Factor B different from salt value Factor A can be used to generate the second authentication parameter. Similarly, Factor B can be the same as the preset one, or can be the same as negotiated by the electronic device and the Bluetooth device.

[0184] For example, in step S104a8, after adding the salt value FactorB, C2 can be calculated in the following manner:

[0185] C2=HmacSHA256(R1+R2, PIN+FactorB).

[0186] Correspondingly, for step S104a10, after adding the salt value FactorB, C2' can be calculated in the following manner:

[0187] C2`=HmacSHA256(R1+R2, PIN+FactorB).

[0188] It is understandable that the rainbow table is an auxiliary tool for cracking hash algorithms. The rainbow table is based on the theory of time-space tradeoff, but it is not simply "trading space for time", but a "two-way transaction" to achieve a balance between the two. The rainbow table is a pre-calculated table for the inverse operation of the cryptographic hash function, prepared for cracking the hash value (also known as hash value, micro-image, summary, fingerprint, hash ciphertext) of the password. Such a table is often used to recover a fixed-length plain text password consisting of a finite set of characters.

[0189] Combined with the above Figure 5 The software architecture shown in FIG. 104 can also be implemented according to the following process. Fig. 9 , Fig. 9This is another flow chart of the device authentication method provided in the embodiment of the present application. Step S104 may include steps S104b1-S104b10.

[0190] S104b1. The device registration module 502 of the electronic device 100 generates a random number R2.

[0191] S104b2. The device control module 504 of the electronic device 100 sends a random number request to the device registration module 512 of the Bluetooth device 400.

[0192] Exemplarily, the device control module 504 may use a control instruction in the Bluetooth protocol of the electronic device 100 to send a random number request to the device registration module 512 of the Bluetooth device 400 .

[0193] S104b3. The device registration module 512 of the Bluetooth device 400 generates a random number R1 in response to the random number request.

[0194] S104b4. The Bluetooth device 400 sends the random number R1 to the device control module 504 of the electronic device 100.

[0195] S104b5. The device registration module 504 of the electronic device 100 generates a first authentication parameter based on R1, R2 and the authentication identification information.

[0196] S104b6. The device registration module 502 of the electronic device 100 sends the first authentication parameter and R1 to the device registration module 512 of the Bluetooth device 400.

[0197] S104b7. The device registration module 512 of the Bluetooth device 400 responds to receiving the first authentication parameter and R1 sent by the electronic device; verifies whether the first authentication parameter is the same based on R1, R2 and the authentication identification information.

[0198] Optionally, after step S104b7, you can choose to execute S104b71.

[0199] S104b71. The smart space APP 501 of the electronic device 100 responds to the device registration module 512 of the Bluetooth device 400 to verify that the first authentication parameter is different, and prompts the user that the authentication fails.

[0200] S104b8. The device registration module 512 of the Bluetooth device 400 generates a second authentication parameter based on R1, R2 and the authentication identification information.

[0201] S104b9. The device registration module 512 of the Bluetooth device 400 sends the second authentication parameter to the device registration module 502 of the electronic device 100.

[0202] S104b10. In response to receiving the second authentication parameter sent by the Bluetooth device 400, the device registration module 502 of the electronic device 100 verifies whether the second authentication parameter is the same based on R1, R2 and the authentication identification information.

[0203] Optionally, after step S104b10, you may choose to execute S104b101.

[0204] S104b101. The smart space APP 501 of the electronic device 100 responds to the device registration module 502 of the electronic device 100 verifying that the second authentication parameter is different, and prompts the user that the authentication fails.

[0205] As a possible implementation, when prompting the user that the authentication failed, the electronic device can briefly display the reason why the user authentication failed and display the failure code. After obtaining the failure code, the user can query the detailed reason for the authentication failure based on the failure code, which can improve the user's experience. For example, see Fig.10 , Fig.10 is a schematic diagram of a device authentication interface provided by the example of this application. For step S104b71, the smart space APP501 of the electronic device 100 can be Fig.10 The interface shown in part (a) of the figure prompts the user that the authentication fails. For step S104b101, the smart space APP of the electronic device 100 can be Fig.10 The interface shown in part (b) prompts the user that the authentication fails.

[0206] Since the electronic device and the Bluetooth device communicate based on the Bluetooth protocol, the encryption method in the Bluetooth protocol will be used for encryption during the communication process between the electronic device and the Bluetooth device (such as the above steps S104a2, S104a4, S104a6 and S104a9, and other subsequent steps), which can ensure the security of the communication between the electronic device and the Bluetooth device. At the same time, since the encryption methods in the Bluetooth protocol are mostly solidified inside the Bluetooth chip, the encryption methods in the Bluetooth protocol are used to encrypt the communication between the electronic device and the Bluetooth device, which can save the processor resources of the Bluetooth device. Compared with using an additional encryption algorithm to additionally encrypt the communication between the electronic device and the Bluetooth device, this method can save the processor resources of the Bluetooth device and the ROM resources of the Bluetooth device.

[0207] As a possible implementation, after step S104b10, the electronic device may also prompt the user that the electronic device and the Bluetooth device have been authenticated. For example, the speaker of the electronic device may emit a preset prompt sound effect to prompt the user; or the motor of the electronic device may also make a preset vibration prompt to prompt the user.

[0208] As a possible implementation, after step S104b10, step S104 may further include:

[0209] S104b11. The smart space APP 501 of the electronic device 100 responds to the device registration module 502 of the electronic device 100 verifying that the second parameter is the same, and prompts the user that the authentication is successful.

[0210] For example, see Fig.11 , Fig.11 is a schematic diagram of another device authentication interface provided in an embodiment of the present application. The smart space APP of the electronic device can display the following Fig.11 The interface shown in part (a) will prompt the user to pass the authentication and will display Fig.11 The interface shown in part (b) of the figure prompts the user that the body fat scale is connected. When the user clicks the body fat scale control, the smart space APP of the electronic device 100 will display the following information: Fig.11 The list of controls shown in part (b) of the figure. The user can click on the controls in the control group to set the body fat scale. For example, see again Fig.11 Users can click the "Rename" control to rename the body fat scale; they can also click the "Device Settings" control to set the standby time and measurement units of the body fat scale, such as kilograms, pounds, etc.; they can also click the "Device Upgrade" control to perform OTA upgrades on the body fat scale; they can also click Disconnect to actively disconnect the Bluetooth connection with the body fat scale.

[0211] In some embodiments, if the authentication parameter verification is successful, the Bluetooth device updates the authentication identification information, and uploads the updated authentication identification information to the server through the electronic device, and binds the updated authentication identification information to the user account, so that the Bluetooth device is registered on the server through the electronic device. That is to say, after step S104, in order to facilitate the electronic device and the Bluetooth device to perform the next device authentication process, and to facilitate the user to use different electronic devices, the same Bluetooth device is connected to Bluetooth. That is, after step S104, the device authentication method provided by the present application may also include the steps of registering and binding the Bluetooth device.

[0212] Before registering and binding a Bluetooth device, the electronic device needs to log in to a user account and establish a communication connection with a server. Therefore, the process of logging in to a user account on an electronic device is briefly introduced first.

[0213] The electronic device can verify the identity of the user by prompting the user to log in to the account. The user account can be a unique character information such as the user's mobile phone number, user email address, user name, etc.

[0214] As a possible implementation, a user can enter the user's identity authentication information in an electronic device. The identity authentication information is a user account and a password corresponding to the user account. The electronic device can submit the identity authentication information to the server to authenticate the user. After the server verifies the identity authentication information, it will send a user identification information to the electronic device, and the electronic device will store the user identification information in the read-only memory (ROM) of the electronic device. When the electronic device receives the user identification information, it can be considered that the user has successfully logged into the user account. In some possible implementations, the user identification information received by the electronic device can be time-sensitive. That is, within a certain period, the user identification information is valid; if it expires, it is necessary to re-enter the identity authentication information in the electronic device to log in to the account.

[0215] In some scenarios, because the user has not logged in to the account, or the last time-sensitive user identification information has expired, the electronic device will display the user account login interface, prompting the user to enter the user account and the password corresponding to the user account in the user account login interface to log in to the user account. In one possible implementation, a Bluetooth management application is provided in the electronic device. After the electronic device starts the Bluetooth management application, it logs in to the user account corresponding to the Bluetooth management application. Then, the electronic device executes subsequent device authentication methods based on the Bluetooth management application. Exemplarily, the Bluetooth management application can be a Smart Space APP, and the user can log in to the user account through the Smart Space APP. The login interface of the Smart Space APP can be as follows: Fig.12 As shown, Fig.12 A user login interface diagram provided in an embodiment of the present application. A user can log in using a user account (which can be a user's mobile phone number, email address, or other account name) and a password. Fig.12 As shown in part (a) of , you can also log in using your mobile phone number and verification code, such as Fig.12 As shown in part (b) of the figure, after registering an account, the user can log in using various information under the account.

[0216] Assuming that the user's mobile phone number is a unique identifier, the mobile phone number is the credential for subsequent registration with the cloud server. When the user logs in using the user's mobile phone number and verification code, the electronic device can directly send the mobile phone number to the server for login or registration; when the user logs in using the account name and password, the electronic device can find the mobile phone number corresponding to the user account through the user account, and send the mobile phone number to the cloud server for login or registration.

[0217] In some scenarios, users will experience Bluetooth devices and their various functions. For example, before purchasing a body fat scale, users will experience the body fat scale's weight detection and body fat detection functions, and will check their own body fat weight, exercise plans, etc. on their mobile phones. Electronic devices do not log in to an account, and experience Bluetooth devices and the Smart Space APP in account-free mode. For example, see again Fig.12 Users can also select the option corresponding to no-account login in the Smart Space APP and enter the no-account login mode. In the no-account login mode, users can experience the body fat scale device and related functions of the Smart Space APP without logging in with an account.

[0218] It can be understood that the device authentication method provided by the present application can perform account login before device authentication (e.g., before step S101), or can perform account login after the Bluetooth device and the electronic device are authenticated (e.g., after step S104) and before registration and binding. The embodiments of the present application do not limit the specific timing of logging into the user account.

[0219] Below, the device authentication method provided by this application will be supplemented by taking the example of the Bluetooth device and the electronic device successfully authenticated (i.e., the authentication parameters are successfully verified), the electronic device logs in to the user account; and then the Bluetooth device is registered and bound. Figure 6 The device authentication method provided in the present application may further include steps S105-S107 after the parameter authentication is passed in step S104.

[0220] S105. The electronic device logs in to the user account and establishes a communication connection with the server.

[0221] This process can be referred to the above-mentioned introduction to the process of logging into a user account on an electronic device, and will not be repeated here.

[0222] S106. The Bluetooth device is registered on the server through the electronic device.

[0223] Before registering a Bluetooth device, the electronic device may be in a registered state. Therefore, before introducing the registration process of a Bluetooth device, the registration process of an electronic device is first introduced. Figure 5As shown in the software architecture diagram, for an electronic device 100 that has the ability to log in to a user account (it can also be understood as having the ability to communicate directly with the server 500 over the Internet), it can register with the server 500 by relying on its own login capability. The process can be: when the user account is logged in for the first time on the electronic device 100, the device registration module 401 can send the user account to the server 500, and the device registration module of the server 500 assigns a device registration information, such as a device registration ID, to the electronic device 100. The device registration information is returned to the electronic device 100, and the electronic device 100 applies for registration to the server 500 according to the device registration information. After successful registration, the server 500 can use the user account and / or registration ID to identify the electronic device 100.

[0224] For example, for Bluetooth devices, especially lightweight BLE devices, they may not have the ability to log in to a user account (which can also be understood as not having the ability to communicate directly with the server), and need to establish a Bluetooth connection with the electronic device and pass mutual authentication before registering with the electronic device. Figure 5 Under the software architecture shown, after the electronic device 100 and the Bluetooth device 400 are authenticated. The device registration module 512 of the Bluetooth device 400 will send the device information of the Bluetooth device 400 (such as Bluetooth MAC address, device name, device ID, Bluetooth device type, etc.) and the user account logged in by the electronic device 100 to the server 500 through the information forwarding module 514 of the electronic device 100. The device registration module 508 of the server 500 will generate a device registration information for the Bluetooth device 400, such as a device registration ID. And the device registration information is returned to the Bluetooth device 400, and the Bluetooth device 400 applies for registration to the server 500 with the help of the information forwarding module 514 according to the device registration information. After successful registration, the server 500 can use the user account and / or device information to identify the Bluetooth device 400. And after successful registration, the server 500 will bind the Bluetooth device 400 to the user account.

[0225] S107. The Bluetooth device updates the authentication identification information, and uploads the updated authentication identification information to the server through the electronic device.

[0226] After receiving the updated authentication identification information, the server can store the authentication identification information in the device information storage module of the server and bind it to the user account logged in on the electronic device. It is understandable that the updated authentication identification information can be used in the subsequent authentication process for the Bluetooth device; that is, the authentication identification information updated last time can be used for authentication in the subsequent authentication process for the Bluetooth device. Based on this, different terminal devices under the user account can obtain the authentication identification information of this Bluetooth device from the server, while terminal devices with different user accounts of the Bluetooth device cannot obtain the authentication identification information of this Bluetooth device. Subsequently, when the user uses other terminal devices under the user account to connect to this Bluetooth device, the authentication process of this Bluetooth device can be completed without perception, which is very convenient. At the same time, the security of Bluetooth communication with this Bluetooth device can also be guaranteed.

[0227] After the Bluetooth device is authenticated with the electronic device, it can use a preset authentication identification generation algorithm to generate new authentication identification information. And store the authentication identification information in its own memory for the next authentication process with the electronic device. And because the Bluetooth device in this application does not communicate directly with the server, the Bluetooth device can use the electronic device as an intermediary. The new authentication identification information is uploaded to the server through the information forwarding module of the electronic device. In this way, the electronic device can obtain the new authentication identification information from the server during the next authentication, and the electronic device can authenticate with the Bluetooth device based on the new authentication identification information during the next authentication.

[0228] It is understandable that the authentication identification information in this application is updated by the Bluetooth device, and the server and the electronic device will not perform the authentication identification information update process. Therefore, it can effectively prevent other users from stealing the authentication identification information update process and obtaining the updated authentication identification information to operate the device, which can further improve the security of communication between the Bluetooth device and the electronic device.

[0229] As a possible implementation, after updating the authentication identification information, the Bluetooth device can also modify the authentication indication information so that at the next authentication, the electronic device can know based on the authentication indication information that the authentication scenario is not the first authentication. For example, the Bluetooth device can increase the number of authentications in the authentication indication information in the form of a configuration file by one. For another example, the Bluetooth device can change the value of the field from 0 to 1.

[0230] Next, the device authentication method provided by this application is introduced in the non-first authentication scenario, see Fig.13 , Fig.13It is a flow chart of the device authentication method provided by the embodiment of the present application. The device authentication method may include steps S201-S206. Among them, non-first authentication can be understood as having been authenticated before the current authentication of the Bluetooth device. That is to say, the registration information of the Bluetooth device and the authentication identification information of the Bluetooth device updated during the last authentication process exist on the server. For example, after the first authentication of electronic device A and the Bluetooth device, the Bluetooth connection of electronic device A and the Bluetooth device is disconnected due to some reasons (such as the distance between electronic device A and the Bluetooth device exceeds the effective distance of Bluetooth communication, or the user actively disconnects the Bluetooth connection, etc.). Afterwards, when electronic device A performs device authentication with the Bluetooth device again, it will use the updated authentication identification information and perform steps S201-S206 to authenticate with the Bluetooth device. And after the authentication is successful, the Bluetooth device will update a new authentication identification information again for the next device authentication. For another example, a user uses electronic device A to authenticate with a Bluetooth device, and after the authentication is passed, the user wants to use electronic device B to connect with the Bluetooth device. At this time, since electronic device A and electronic device B belong to the same user, the user will log in to the same account on electronic device A and electronic device B, that is, the user account of electronic device A and electronic device B is the same. Therefore, electronic device B can obtain the authentication identification information of the Bluetooth device from the server and authenticate with the Bluetooth device based on this identification information.

[0231] S201. The electronic device logs in to the user account and establishes a communication connection with the server. This process is similar to the process of the electronic device logging in to the user account, and will not be repeated here.

[0232] S202. The electronic device searches for a Bluetooth device and establishes a Bluetooth connection with the Bluetooth device.

[0233] S203. The electronic device obtains device information of the Bluetooth device, and determines a non-first authentication scenario based on the device information.

[0234] As for steps S202 - S203 , this process is similar to the above steps S101 - S102 , and the specific description of the above embodiment may be referred to, and will not be described in detail.

[0235] S204. The electronic device obtains the authentication identification information of the Bluetooth device from the server based on the user account.

[0236] It is understandable that the authentication identification information can be obtained by the electronic device from the server based on the device information of the Bluetooth device and the user account logged in on the electronic device. If the authentication identification information is not obtained, it means that the Bluetooth device does not belong to the user, and the electronic device will disconnect the Bluetooth connection with the Bluetooth device; then, the electronic device can also prompt the user that the authentication with the Bluetooth device has failed.

[0237] In some other embodiments, the electronic device may also log in to the user account after step 202, after step S203 or at other times, thereby obtaining the authentication identification information of the Bluetooth device from the server based on the user account. The embodiments of the present application do not limit the specific time of logging in to the user account.

[0238] In some embodiments, the electronic device can obtain the authentication identification information of the Bluetooth device from the server through the registration ID of the Bluetooth device and the user account logged in on the electronic device. In some embodiments, the electronic device can also query the server through the MAC address of the Bluetooth device and the user account. For example, taking the device information as the device ID and the authentication identification information as the PIN code as an example, step S204 is described in detail. Fig.14 In this scenario, step S204 may include: S204a1-S204a7.

[0239] S204a1. The electronic device generates a query request based on the device ID and user account of the Bluetooth device, wherein the user account is the user account logged in on the electronic device.

[0240] It is understandable that the query request can be in the form of a message, which is mainly used to request the server to query the authentication identification information corresponding to the device information of the Bluetooth device bound to the user account, such as the PIN code corresponding to the device ID of the Bluetooth device. The PIN code is generated by the Bluetooth device and the electronic device after the last authentication is passed, and uploaded to the server with the help of the electronic device.

[0241] S204a2. The electronic device sends the query request to the server.

[0242] S204a3. The server responds to the query request and queries the PIN code of the device ID under the user identification information.

[0243] S204a4. In response to the server querying the PIN code of the Bluetooth device, the server sends the PIN code to the electronic device.

[0244] S204a5. The electronic device receives the PIN code.

[0245] S204a6. In response to the server failing to find the PIN code of the Bluetooth device, the server sends a query indication message to the electronic device.

[0246] S204a7. The electronic device responds to the query instruction message and prompts the user that the authentication fails.

[0247] S205. The electronic device and the Bluetooth device respectively generate authentication parameters based on the authentication identification information, exchange authentication parameters with each other, and respectively verify each other's authentication parameters.

[0248] The electronic device may obtain the authentication identification information from the server, and the Bluetooth device may search for the authentication identification information in its own memory.

[0249] As for step S205, this process is similar to the above step S104, and the specific description of the above embodiment may be referred to, which will not be repeated here.

[0250] S206. The Bluetooth device updates the authentication identification information, and uploads the updated authentication identification information to the server through the electronic device.

[0251] As for step S206, this process is similar to the above step S107, and the specific description of the above embodiment may be referred to, which will not be repeated here.

[0252] It is understandable that in some scenarios, after the electronic device and the Bluetooth device are authenticated. The Bluetooth device will execute some processes (such as transmitting data to the Bluetooth device, performing OTA upgrades, etc.). After the Bluetooth device is authenticated (for example, after the above step S106, after the above step S205), since the processor performance of some Bluetooth devices is not very powerful, updating the authentication identification information immediately may cause the processor to overload. As a result, the process that could have been working normally on the Bluetooth device will become stuck. Therefore, the embodiment of the present application can avoid the time when the Bluetooth device executes these processes after the electronic device and the Bluetooth device are authenticated. Let the processor of the Bluetooth device only focus on executing the above process, and when the processor of the Bluetooth device is idle, generate new authentication identification information through a preset authentication identification generation algorithm. The workload of the processor of the Bluetooth device can be alleviated, and the occurrence of overload problems of the processor of the Bluetooth device can be reduced.

[0253] As a possible implementation, after the electronic device passes the authentication (for example, after step S106, after step S205), the Bluetooth device will not immediately update the authentication identification information. For example, the Bluetooth device can update the authentication identification information after a preset time interval (for example, 60s). For another example, the Bluetooth device can also monitor its own processor load, and when the processor load is less than a preset threshold (for example, 70%), the authentication identification information is updated.

[0254] It is understandable that in order to implement the above functions, the electronic device includes hardware and / or software modules corresponding to the execution of each function. In combination with the algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in combination with the embodiments, but such implementation should not be considered to be beyond the scope of the present application.

[0255] In this embodiment, the electronic device can be divided into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0256] The embodiment of the present application also provides a terminal device, which can be the above-mentioned electronic device or Bluetooth device, such as Fig.15 As shown, the terminal device may include one or more processors 1001 , a memory 1002 and a communication interface 1003 .

[0257] The memory 1002 and the communication interface 1003 are coupled to the processor 1001. For example, the memory 1002, the communication interface 1003 and the processor 1001 may be coupled together via a bus 1004.

[0258] The communication interface 1003 is used for data transmission with other devices. The memory 1002 stores computer program code. The computer program code includes computer instructions. When the computer instructions are executed by the processor 1001, the electronic device performs the device authentication in the embodiment of the present application.

[0259] Among them, the processor 1001 can be a processor or a controller, for example, a central processing unit (CPU), a general processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the present disclosure. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0260] The bus 1004 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus 1004 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.15 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0261] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program code is stored. When the processor executes the computer program code, the electronic device executes the relevant method steps in the method embodiment.

[0262] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, it enables the computer to execute the relevant method steps in the above method embodiment.

[0263] Among them, the electronic device, computer-readable storage medium or computer program product provided in this application is used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here.

[0264] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0265] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0266] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0267] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0268] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0269] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A device authentication method, characterized in that: Applied to a Bluetooth device, the method comprises: After successful authentication with the second electronic device, updating the authentication identification information; Uploading the updated authentication identification information to the server through the second electronic device; disconnecting the Bluetooth connection from the second electronic device; Establishing a Bluetooth connection with the first electronic device; After establishing a Bluetooth connection with the first electronic device, generating a second random number and sending the second random number to the first electronic device; wherein the first electronic device logs in to the same user account as the second electronic device, and the first electronic device obtains authentication identification information from the server through the user account; receiving the first authentication parameter and the first random number sent by the first electronic device; the first authentication parameter is generated by the first electronic device according to the second random number and the authentication identification information; Using a target encryption method, generating first verification information based on the sum of the first random number and the second random number and the authentication identification information of the Bluetooth device; verifying the first authentication parameter based on the first verification information, and disconnecting the Bluetooth connection with the first electronic device when the verification of the first authentication parameter fails; If the first authentication parameter is successfully verified, using a target encryption method to generate a second authentication parameter based on the product of the first random number and the second random number and the authentication identification information; The second authentication parameter is sent to the first electronic device, where the second authentication parameter is used to trigger disconnection of the Bluetooth connection between the first electronic device and the Bluetooth device when verification fails.

2. The method according to claim 1, characterized in that The method further comprises: In the case where the first authentication parameter verification fails, disconnection indication information is sent to the first electronic device, where the disconnection indication information is used to instruct to disconnect the Bluetooth connection.

3. The method according to claim 1, characterized in that The method further comprises: If disconnection indication information is received from the first electronic device, the Bluetooth connection with the first electronic device is disconnected.

4. The method according to claim 1, characterized in that: The method further comprises: If notification information is received from the first electronic device, the notification information is used to indicate that the second authentication parameter verification is successful, the authentication identification information is updated, and the updated authentication identification information is uploaded to the server through the first electronic device.

5. The method according to claim 1, characterized in that The step of adopting a target encryption method to generate first verification information based on the sum of the first random number and the second random number and the authentication identification information of the Bluetooth device includes: A salt value is added to the authentication identification information, where the salt value is preset; and a target encryption method is used to generate first verification information based on the sum of the first random number and the second random number, and the authentication identification information of the Bluetooth device after the salt value is added.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: When the first authentication parameter is successfully verified, encryption is performed with the first electronic device using an encryption method specified in the Bluetooth protocol.

7. A device authentication method, characterized in that: Applied to a first electronic device, the method includes: The first electronic device logs in to the same user account as the second electronic device, and the first electronic device obtains authentication identification information from the server through the user account, wherein the authentication identification information is updated by the Bluetooth device after the Bluetooth device successfully authenticates the second electronic device; After establishing a Bluetooth connection with the Bluetooth device, obtaining authentication identification information of the Bluetooth device from the server; Generate a first random number, and receive a second random number sent by the Bluetooth device; Using a target encryption method, generating a first authentication parameter based on the sum of the first random number and the second random number, and the authentication identification information; Sending the first authentication parameter and the first random number to the Bluetooth device, where the first random number is used to verify the first authentication parameter, and the first authentication parameter is used to trigger disconnection of the Bluetooth connection between the Bluetooth device and the first electronic device when the verification fails; If a second authentication parameter is received from the Bluetooth device, generating second verification information based on the product of the first random number and the second random number and the authentication identification information of the Bluetooth device by using a target encryption method; The second authentication parameter is verified based on the second verification information, and if the verification of the second authentication parameter fails, the Bluetooth connection with the Bluetooth device is disconnected.

8. The method according to claim 7, characterized in that The method further comprises: If disconnection indication information is received from the Bluetooth device, the Bluetooth connection with the Bluetooth device is disconnected.

9. The method according to claim 7, characterized in that: The method further comprises: In the case where the second authentication parameter verification fails, disconnection indication information is sent to the Bluetooth device, where the disconnection indication information is used to indicate disconnection of the Bluetooth connection.

10. The method according to claim 7, characterized in that The method further comprises: If the second authentication parameter verification succeeds, sending notification information to the Bluetooth device, where the notification information is used to indicate that the second authentication parameter verification succeeds; Receive the updated authentication identification information sent by the Bluetooth device, and upload the updated authentication identification information to the server.

11. The method according to any one of claims 7 to 10, characterized in that: The obtaining of the authentication identification information of the Bluetooth device includes: In the case where the Bluetooth device is authenticated for the first time, generating the authentication identification information based on the device information of the Bluetooth device; or When the Bluetooth device is not being authenticated for the first time, the authentication identification information of the Bluetooth device corresponding to the target user account associated with the electronic device is obtained from the server based on the device information of the Bluetooth device; the server stores the correspondence between the user account and the authentication identification information of at least one device.

12. The method according to claim 11, characterized in that The step of uploading the updated authentication identification information to the server includes: In the case where the Bluetooth device is authenticated for the first time, the updated authentication identification information is uploaded to the server; so that a corresponding relationship between the authentication identification information of the Bluetooth device and the target user account corresponding to the target electronic device is established on the server; or, In the case where the Bluetooth device is not being authenticated for the first time, the updated authentication identification information is uploaded to a server, so that the corresponding relationship between the authentication identification information of the Bluetooth device and the target user account is updated on the server.

13. The method according to claim 11, characterized in that The method further comprises: Obtain device information of the Bluetooth device; Based on the device information, an authentication scenario of the Bluetooth device is determined, where the authentication scenario includes first authentication or non-first authentication.

14. The method according to claim 7, characterized in that The adopting the target encryption method to generate the first authentication parameter based on the sum of the first random number and the second random number and the authentication identification information includes: A salt value is added to the authentication identification information, where the salt value is preset; and a first authentication parameter is generated based on the sum of the first random number and the second random number and the authentication identification information after the salt value is added, using a target encryption method.

15. The method according to claim 7, characterized in that The method further comprises: When the second authentication parameter is successfully verified, encryption is performed with the Bluetooth device using an encryption method specified in the Bluetooth protocol.

16. A terminal device, characterized in that: include: A memory, one or more processors, and a Bluetooth module; the memory is coupled to the processor; wherein the memory stores a computer program code, the computer program code includes a computer instruction; when the computer instruction is executed by the processor, the terminal device executes the method according to any one of claims 1 to 6; or, Enable the terminal device to execute the method as described in any one of claims 7-15.

17. A computer-readable storage medium, characterized in that: comprising computer instructions, which, when executed on a terminal device, cause the terminal device to execute the method according to any one of claims 1 to 6; or The terminal device executes the method as described in any one of claims 7 to 15.

Images