Authentication communication method and system based on applet and Bluetooth device

Abstract

The invention relates to the field of information security, and provides an authentication communication method and system based on an applet and a Bluetooth device, and the method comprises the steps: responding to a connection request of a target applet, and transmitting an identity verification request containing a public key identifier to the target applet; the target applet obtains the public key from the cloud through the public key identifier and generates authentication data; the target Bluetooth device decrypts the authentication data to verify by using a private key, executes a control command of the target applet after the verification is passed, and packages execution result data and a hash value; after receiving the data packet, the target applet recalculates the hash value of the data packet and compares the hash value with the hash value contained in the data packet, and when the hash values are consistent, data transmission is complete; otherwise, the target applet resends the control command and continues to monitor the returned data packet until the hash values are consistent. According to the method, cloud key management and an asymmetric encryption algorithm are introduced, so that a competitive company cannot analyze a protocol, and the problems of data delay and high computing resource consumption in a decryption process are avoided.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to an authentication communication method and system based on a mini-program and a Bluetooth device. Background Art

[0002] In the current implementation of communication between WeChat mini programs and Bluetooth devices, a set of standard Bluetooth communication protocols is used. This protocol allows the mini program to start the Bluetooth adapter, search and connect to nearby Bluetooth devices, and send and receive data through Bluetooth services and features through a series of predefined APIs.

[0003] Although the existing Bluetooth communication protocol provides basic functions for device connection and data exchange, it has significant limitations in terms of security, performance and data integrity. Specifically, data transmission in the current communication process is often not encrypted, making the transmitted data easy to be intercepted or tampered with. Secondly, even if encryption measures are adopted, traditional encryption algorithms may cause significant computing resource consumption and response time delays, affecting user experience, and the key management and storage methods are vulnerable to decompilation attacks, posing security risks.

[0004] In addition, existing technologies also show deficiencies in data integrity verification and device identity authentication. The lack of an effective mechanism to verify the integrity of data packets during data transmission may result in data loss not being discovered and processed in a timely manner. At the same time, the lack of a strong device identity authentication process increases the risk of unauthorized device access. Summary of the invention

[0005] In view of the above problems, the present invention proposes an authentication communication method and system based on applet and Bluetooth device, which is used to solve the problems in the prior art that data is easily intercepted or tampered, the encryption process consumes a lot of resources, and there is a lack of effective identity authentication. The above invention object of the present invention is achieved through the following technical solutions: The present invention provides an authentication communication method based on a small program and a Bluetooth device. The method is deployed in a user terminal. The user terminal is equipped with a target Bluetooth device and a target small program. The method includes: The target Bluetooth device responds to the connection request of the target applet and sends an authentication request including a public key identifier to the target applet after successful connection; The target applet obtains the public key from the cloud through the public key identifier, encrypts the user's identity information and current timestamp through the public key, generates authentication data and sends it to the target Bluetooth device; The target Bluetooth device uses the built-in private key to decrypt the authentication data for verification. After verification, it receives and executes the control command of the target applet, and packages the execution result data and the hash value of the verification result data integrity and transmits it back to the target applet; After receiving the data packet, the target applet recalculates the hash value of the data packet and compares it with the hash value contained in the data packet. When the hash values ​​are consistent, the data transmission is complete and secure; otherwise, the target applet resends the control command and continues to monitor the returned data packet until the hash values ​​are consistent.

[0006] Furthermore, the cloud uses the RSA algorithm to generate several pairs of keys, the keys include a public key and a private key, each pair of keys is stored in the cloud in a server database, and each public key is associated with a unique public key identifier; wherein, The private key and the corresponding public key identifier are embedded in the firmware code generated in the cloud and deployed to the target Bluetooth device for decryption of authentication data; the public key is stored in the cloud and used to encrypt data transmitted from the target Bluetooth device.

[0007] Furthermore, the target applet obtains the public key from the cloud through the public key identifier, encrypts the user's identity information and current timestamp through the public key, and generates authentication data and sends it to the target Bluetooth device, including: The target applet receives the authentication request of the target Bluetooth device; obtains the corresponding public key from the cloud according to the public key identifier in the authentication request; The public key combines the current timestamp with the identity information through the RSA algorithm, encrypts and generates the corresponding encrypted message and encapsulates it. The encrypted message is used as authentication data to respond to the identity authentication request; the identity information includes the identity ID, and can optionally include one or more of the identity name, permission level or role.

[0008] The encapsulated encrypted message is sent to the target Bluetooth device through the Bluetooth communication link between the target applet and the target Bluetooth device.

[0009] Furthermore, the target Bluetooth device uses the built-in private key to decrypt the authentication data to verify that: The target Bluetooth device receives the encapsulated encrypted message and decrypts it using the private key to verify the authentication information; Determine whether the current timestamp in the authentication information is within the valid time range; If the current timestamp is within the valid range, the current timestamp is valid and the identity information is verified. Otherwise, the authentication information is considered invalid and the verification process is interrupted. After the current timestamp is valid and the identity information is verified, the target applet and the target Bluetooth device communicate via the Bluetooth communication link using plain text transmission.

[0010] Further, after the verification is passed, the control command of the target applet is received and executed, and the execution result data and the hash value of the verification result data integrity are packaged and returned to the target applet, including: When the authentication data is verified, the target Bluetooth device receives the control command of the target applet and performs the corresponding operation; The execution result data is packaged, and the data packet content is hashed using the SHA-256 hash algorithm. The calculated original hash value is appended to the end of the data packet for identification and extraction when the target applet receives it.

[0011] Furthermore, after receiving the data packet, the target applet recalculates the hash value of the data packet and compares it with the hash value contained in the data packet. If the hash values ​​are consistent, the data transmission is complete and secure; otherwise, the target applet resends the control command and continues to monitor the returned data packet until the hash values ​​are consistent, including: After receiving the data packet from the target Bluetooth device, the target applet separates the original hash value, and performs the SHA-256 hash algorithm based on the separated data packet to generate a verification hash value; Verify the consistency of the result data by comparing the consistency of the original hash value and the verification hash value; When the original hash value is consistent with the verification hash value, the result data is complete, and the target applet receives the data packet and performs operations; When the original hash value is inconsistent with the verification hash value, the result data is modified, and the target applet ignores the data packet or requests the target Bluetooth device to resend the data packet for verification.

[0012] Based on the same inventive concept, the present invention also provides an authentication communication system based on a mini-program and a Bluetooth device, using the authentication communication method as described above, including: A connection management module, used for the target Bluetooth device to respond to the connection request of the target applet, and send an identity authentication request including a public key identifier to the target applet after successful connection; The encryption communication module is used for the target applet to obtain the public key from the cloud through the public key identifier, and encrypt the user's identity information and current timestamp through the public key to generate authentication data and send it to the target Bluetooth device; The data response module is used for the target Bluetooth device to use the built-in private key to decrypt the authentication data for verification. After the verification is passed, it receives and executes the control command of the target applet, and packages the execution result data and the hash value of the verification result data integrity and transmits it back to the target applet; The data verification module is used to recalculate the hash value of the data packet after the target applet receives the data packet and compare it with the hash value contained in the data packet. When the hash values ​​are consistent, the data transmission is complete and secure; otherwise, the target applet resends the control command and continues to monitor the returned data packet until the hash values ​​are consistent.

[0013] Furthermore, in the encryption communication module, the cloud uses the RSA algorithm to generate several pairs of keys, the keys include public keys and private keys, each pair of keys is stored in the server database of the cloud, and each public key is associated with a unique public key identifier; the private key and the corresponding public key identifier are embedded in the firmware code generated by the cloud and deployed to the target Bluetooth device for decryption of authentication data; the public key is stored in the cloud and is used to encrypt data transmitted from the target Bluetooth device.

[0014] Furthermore, the data response module includes: A decryption unit, used for the target Bluetooth device to receive the encapsulated encrypted message and decrypt it using the private key to verify the authentication information; The communication management unit is used to enable the target applet and the target Bluetooth device to communicate via a Bluetooth communication link in plain text transmission after the authentication information is verified; The execution unit is used for the target Bluetooth device to receive the control commands of the target applet and perform corresponding operations, package the execution result data, hash the data packet content through the SHA-256 hash algorithm, and append the calculated original hash value to the end of the data packet for identification and extraction when the target applet receives it.

[0015] Wherein, the decryption unit includes a timestamp verification subunit and an identity verification subunit; The timestamp verification subunit is used to determine whether the current timestamp in the authentication information is within the valid time range; if the current timestamp is within the valid range, the current timestamp is valid and the identity information is verified; otherwise, the authentication information is determined to be invalid and the verification process is interrupted; The authentication subunit is used to verify the validity of the identity information based on the current timestamp.

[0016] Furthermore, the data verification module includes: Hash processing unit: After the target applet receives the data packet from the target Bluetooth device, it separates the original hash value and performs the SHA-256 hash algorithm based on the separated data packet to generate a verification hash value; The integrity verification unit verifies the consistency of the result data by comparing the consistency of the original hash value and the verification hash value; when the original hash value is consistent with the verification hash value, the result data is complete, and the target applet receives the data packet and performs operations; when the original hash value is inconsistent with the verification hash value, the result data is modified, and the target applet ignores the data packet or requests the target Bluetooth device to resend the data packet for verification.

[0017] Compared with the prior art, the present invention has at least one of the following beneficial effects: The present invention introduces cloud-based key management and asymmetric encryption algorithms, which not only ensure that competing companies cannot parse the protocol, but also avoid data delays and high consumption of computing resources during the decryption process. The key security is ensured by generating and securely storing key pairs in the cloud, and the transmission data is encrypted by the RSA asymmetric encryption algorithm to ensure the security of the communication content. In the verification process, identity authentication is performed by combining timestamps with encrypted data, which enhances the system's ability to defend against replay attacks, that is, only requests initiated within a set time are allowed to be processed. In addition, the SHA-256 algorithm is introduced to perform hash calculations on data packets, and the hash value is appended to the end of the data packet to verify the integrity of the data during transmission and ensure that the data has not been tampered with. Once the identity authentication is passed, the system switches to plaintext transmission to reduce the need for decryption operations, thereby greatly reducing the computing burden and communication delays, and optimizing the efficiency and response speed of the communication process. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of the steps of the authentication communication method based on the applet and the Bluetooth device of the present invention; Figure 2 This is a flowchart of key storage management in the authentication communication method based on applet and Bluetooth device of the present invention; Figure 3 It is a flow chart of the target applet operation in the authentication communication method based on the applet and the Bluetooth device of the present invention; Figure 4 This is an interface diagram of successful authentication in the authentication communication method based on the applet and the Bluetooth device of the present invention; Figure 5 This is an interface diagram of authentication failure in the authentication communication method based on the applet and the Bluetooth device of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] Those skilled in the art will appreciate that, unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0021] First embodiment In the current communication practice between WeChat Mini Programs and Bluetooth devices, common methods include using WeChat APIs for device search, connection, and data transmission. Common operation steps are: (1) Call the wx.openBluetoothAdapter method to open the Bluetooth adapter of the mobile device and ensure that the Bluetooth function of the mobile device is activated; (2) Call the wx.startBluetoothDeviceDiscovery method to start the Bluetooth adapter search mode and search for surrounding Bluetooth devices; (3) When a specific Bluetooth device is searched, the applet obtains the deviceId of the Bluetooth device, which is the unique identifier of the device, and calls the wx.createBLEConnection method to establish a connection with the Bluetooth device; (4) When the Bluetooth device is successfully connected, the applet sends a message protocol to communicate with the Bluetooth device by calling the wx.writeBLECharacteristicValue method to send commands or read status.

[0022] When developing WeChat applets for controlling Bluetooth devices, many manufacturers focus mainly on function implementation and ignore data security. Usually, even if developers consider the necessity of encryption protocols, they may eventually give up implementing encryption measures because they are worried that the encryption and decryption processes will significantly consume computing resources and affect device performance. In addition, key security measures such as secure storage of keys, verification of data integrity, and device authentication are often not given enough attention. These omissions not only reduce the security of communications, but also reflect that the lack of security awareness and measures in the field of Bluetooth device communications is a long-standing problem. Therefore, although this set of steps provides a basic operating framework, there are several obvious security and efficiency issues. The specific problems and their impacts are as follows: (1) The communication protocol is not encrypted. During the communication process between the Bluetooth device and the applet, if the communication protocol is not encrypted, the transmitted data can be easily intercepted and tampered with by a third party, resulting in the leakage of sensitive information and increasing security risks.

[0023] (2) Existing encryption algorithms consume computing resources. If encryption measures are used during communication, traditional encryption algorithms may consume a large amount of computing resources and increase the response delay of Bluetooth devices. This not only affects the user experience, but also may limit the application of encryption technology on low-power devices.

[0024] (3) Key leakage. Whether the key is stored in the device firmware or the mini-program, it may be decompiled, resulting in key leakage. Once the key is leaked, the encryption measures will be invalid, affecting the system security.

[0025] (4) Lack of data integrity verification: In the current communication protocol, there is a lack of effective data integrity verification mechanism. There may be data packet loss in Bluetooth communication. When data packet loss occurs, the applet end should notify the device end to resend it.

[0026] (5) There is a lack of device authentication process. Before the formal connection, the mini program should perform an identity authentication process with the device to ensure that the Bluetooth device and the mini program belong to the same system and are controlled by the system, that is, to ensure that it is its own Bluetooth device, and through the Bluetooth device it can also ensure that it is its own mini program.

[0027] In the prior art, in order to solve the problem of plain text transmission during Bluetooth device protocol transmission in the smart home field, the usual industry practice is to encrypt the protocol message and decrypt it on the mini program side. Many practitioners believe that this is effective enough to package data security. However, due to the lack of in-depth testing of the performance impact of encryption and decryption, it is often difficult to detect the potential negative impact of the encryption process on device performance and response speed. At the same time, the secure storage of keys, the integrity verification of data transmission, and the authentication process between devices and mini programs are often overlooked.

[0028] After the WeChat applet was developed and launched, the inventor discovered that some competitors obtained Bluetooth parsing documents provided by customers, developed their own applet and connected it to the Bluetooth device developed by the company, and then stole the device information and user data in the Bluetooth device. Therefore, data security vulnerabilities in the original WeChat applet architecture were discovered, namely improper key management and imperfect data encryption and decryption mechanisms, which provided competitors with opportunities to crack and illegally use the device.

[0029] Based on the analysis of existing encryption schemes, the inventor conducted previous market research and found that the existing various data security encryption schemes all have certain deficiencies and cannot effectively balance security and system performance. Therefore, an innovative solution is proposed for the existing technical problems. This solution not only solves the data security problem in Bluetooth device communication, but also optimizes performance and encryption efficiency, ensuring that the system can operate efficiently and stably while strictly protecting data security. The specific implementation plan is as follows: like Figure 1 As shown, the present invention provides an authentication communication method based on a small program and a Bluetooth device, the method is deployed in a user terminal, the user terminal is equipped with a target Bluetooth device and a target small program, and the method includes: Based on the Bluetooth communication link established between the target Bluetooth device and the target applet, the target Bluetooth device responds to the connection request of the target applet, and sends an identity authentication request including a public key identifier to the target applet after successful connection; The target applet obtains the public key from the cloud through the public key identifier, encrypts the user's identity information and current timestamp through the public key, generates authentication data and sends it to the target Bluetooth device; The target Bluetooth device uses the built-in private key to decrypt the authentication data for verification. After verification, it receives and executes the control command of the target applet, and packages the execution result data and the hash value of the verification result data integrity and transmits it back to the target applet; After receiving the data packet, the target applet recalculates the hash value of the data packet and compares it with the hash value contained in the data packet. If the hash values ​​are consistent, the data transmission is complete and secure; otherwise, the target applet resends the control command and continues to monitor the returned data packet until the hash values ​​are consistent.

[0030] Furthermore, the cloud uses the RSA algorithm to generate several pairs of keys, the keys include a public key and a private key, each pair of keys is stored in the cloud in a server database, and each public key is associated with a unique public key identifier; wherein, The private key and the corresponding public key identifier are embedded in the firmware code generated in the cloud and deployed to the target Bluetooth device for decryption of authentication data; the public key is stored in the cloud and used to encrypt data transmitted from the target Bluetooth device.

[0031] like Figure 2 As shown, regarding the key storage management method in the present invention, first, a public key and a private key are generated according to the RSA algorithm, and the database stores the public key and the private key. Subsequently, the firmware is generated, and the public key ID and the private key are written into the firmware at the same time, and deployed to the device by burning the firmware. When the device communicates with the applet, it passes the public key ID to the applet, and the applet queries the cloud database through the public key ID to obtain the corresponding public key for encrypted communication. It should be noted that the core feature of the RSA asymmetric encryption algorithm is the use of a pair of keys, namely the public key and the private key, to encrypt and decrypt data respectively. Specifically, the public key is responsible for encrypting data, while the private key is responsible for decrypting data. Data encrypted by a public key can only be decrypted by the corresponding private key, and the public key and the private key cannot derive the value of each other through calculation. This design ensures that even if the public key is made public, the data decryption process is still safe, and only the device or system that holds the private key can decrypt the data.

[0032] In the present invention, the key storage management mechanism further enhances the security of the authentication communication method. First, all public and private key pairs are generated and managed in the cloud. The cloud will pre-generate a batch of public and private keys and store them securely in the cloud database. Each pair of public and private keys is associated with a unique identifier, namely the public key ID, to ensure that each key pair can be correctly tracked and managed.

[0033] When the device firmware is generated, the public key ID and the corresponding private key value will be embedded in the firmware code of the Bluetooth device. The private key only exists on the Bluetooth device side and is part of the firmware. Only the Bluetooth device can use its private key to decrypt data encrypted by the public key. The public key is always stored in the cloud. When the mini program needs to communicate with the Bluetooth device, it will obtain the corresponding public key from the cloud through the public key ID and use the public key to encrypt the data.

[0034] Therefore, the present invention has higher security in key storage. By generating and managing keys in the cloud, it effectively prevents third parties from cracking the firmware or applets on the device side through reverse engineering, thereby ensuring that the keys are not leaked. The system uses the RSA asymmetric encryption algorithm to encrypt identity information to ensure that the data is highly secure during transmission, and only authorized devices can decrypt and access relevant information. After identity authentication is passed, the system uses a plaintext transmission mode for data communication. This method avoids further encryption and decryption processes, reduces complex computing operations, and significantly reduces the computing resource consumption of the device side and the client side. At the same time, it effectively reduces communication delays and optimizes the performance of the overall system.

[0035] Furthermore, the target applet obtains the public key from the cloud through the public key identifier, encrypts the user's identity information and current timestamp through the public key, and generates authentication data and sends it to the target Bluetooth device, including: The target applet receives the authentication request of the target Bluetooth device; obtains the corresponding public key from the cloud according to the public key identifier in the authentication request; The public key combines the current timestamp with the identity information through the RSA algorithm, encrypts and generates the corresponding encrypted message and encapsulates it. The encrypted message is used as authentication data to respond to the identity authentication request; the identity information includes the identity ID, and can optionally include one or more of the identity name, permission level or role, etc.

[0036] It should be noted that the core part of identity information is the identity ID, which is a unique identifier for each device or user in the system and is used to distinguish different communication entities. On this basis, identity information can also selectively include other additional information, such as identity name, permission level or role, to further enhance the access control and security of the system.

[0037] The encapsulated encrypted message is sent to the target Bluetooth device through the Bluetooth communication link between the target applet and the target Bluetooth device.

[0038] Furthermore, the target Bluetooth device uses the built-in private key to decrypt the authentication data to verify that: The target Bluetooth device receives the encapsulated encrypted message and decrypts it using the private key to verify the authentication information; Determine whether the current timestamp in the authentication information is within the valid time range; If the current timestamp is within the valid range, the current timestamp is valid and the identity information is verified. Otherwise, the authentication information is considered invalid and the verification process is interrupted. After the current timestamp is valid and the identity information is verified, the target applet and the target Bluetooth device communicate via the Bluetooth communication link using plain text transmission.

[0039] Specifically, in the identity authentication process, when the target applet tries to connect to the target Bluetooth device, the target Bluetooth device will send the public key ID and the identity authentication protocol to the target applet. After receiving the information, the target applet obtains the corresponding public key from the cloud through the public key ID, and then uses the public key to encrypt the current timestamp and identity information, and returns the generated encrypted data to the device. After receiving the encrypted data, the device decrypts it with its private key and verifies the legitimacy of the identity information. At the same time, the device will also check whether the difference between the timestamp and the current time is within the preset range, such as whether it is within a valid range of five minutes. If the identity authentication is passed and the timestamp is valid, communication is allowed to continue; otherwise, the target Bluetooth device will terminate the Bluetooth connection with the target applet to ensure communication security.

[0040] Further, after the verification is passed, the control command of the target applet is received and executed, and the execution result data and the hash value of the verification result data integrity are packaged and returned to the target applet, including: When the authentication data is verified, the target Bluetooth device receives the control command of the target applet and performs the corresponding operation; The execution result data is packaged, and the data packet content is hashed using the SHA-256 hash algorithm. The calculated original hash value is appended to the end of the data packet for identification and extraction when the target applet receives it.

[0041] Furthermore, after receiving the data packet, the target applet recalculates the hash value of the data packet and compares it with the hash value contained in the data packet. If the hash values ​​are consistent, the data transmission is complete and secure; otherwise, the target applet resends the control command and continues to monitor the returned data packet until the hash values ​​are consistent, including: After receiving the data packet from the target Bluetooth device, the target applet separates the original hash value, and performs the SHA-256 hash algorithm based on the separated data packet to generate a verification hash value; Verify the consistency of the result data by comparing the consistency of the original hash value and the verification hash value; When the original hash value is consistent with the verification hash value, the result data is complete, and the target applet receives the data packet and performs operations; When the original hash value is inconsistent with the verification hash value, the result data is modified, and the target applet ignores the data packet or requests the target Bluetooth device to resend the data packet for verification.

[0042] It should be specifically noted that in the process of data integrity check, the SHA-256 hash algorithm is used to ensure the integrity of the communication data. During each Bluetooth communication process, the target Bluetooth device will generate a hash value for the current data packet through the SHA-256 algorithm, and append the hash value to the end of the data packet, usually the last six digits. When the target applet receives the data packet, it will re-hash the portion of the original data packet that does not contain the hash value to generate a new hash value. Subsequently, the target applet compares the calculated hash value with the hash value attached by the target Bluetooth device. If the two hash values ​​are consistent, it means that the data has not been tampered with during transmission, and the data integrity verification is passed; if the hash values ​​are inconsistent, the applet will send a request to the device to resend the data packet, and the device will resend the data after receiving the request to ensure the accuracy and integrity of the data transmission.

[0043] Second embodiment Based on the same inventive concept, the present invention also provides an authentication communication system based on a mini-program and a Bluetooth device, using the authentication communication method as described above, including: A connection management module, used for the target Bluetooth device to respond to the connection request of the target applet, and send an identity authentication request including a public key identifier to the target applet after successful connection; The encryption communication module is used for the target applet to obtain the public key from the cloud through the public key identifier, and encrypt the user's identity information and current timestamp through the public key to generate authentication data and send it to the target Bluetooth device; The data response module is used for the target Bluetooth device to use the built-in private key to decrypt the authentication data for verification. After the verification is passed, it receives and executes the control command of the target applet, and packages the execution result data and the hash value of the verification result data integrity and transmits it back to the target applet; The data verification module is used to recalculate the hash value of the data packet after the target applet receives the data packet and compare it with the hash value contained in the data packet. When the hash values ​​are consistent, the data transmission is complete and secure; otherwise, the target applet resends the control command and continues to monitor the returned data packet until the hash values ​​are consistent.

[0044] Furthermore, in the encryption communication module, the cloud uses the RSA algorithm to generate several pairs of keys, the keys include public keys and private keys, each pair of keys is stored in the server database of the cloud, and each public key is associated with a unique public key identifier; the private key and the corresponding public key identifier are embedded in the firmware code generated by the cloud and deployed to the target Bluetooth device for decryption of authentication data; the public key is stored in the cloud and is used to encrypt data transmitted from the target Bluetooth device.

[0045] Furthermore, the data response module includes: A decryption unit, used for the target Bluetooth device to receive the encapsulated encrypted message and decrypt it using the private key to verify the authentication information; The communication management unit is used to enable the target applet and the target Bluetooth device to communicate via a Bluetooth communication link in plain text transmission after the authentication information is verified; The execution unit is used for the target Bluetooth device to receive the control commands of the target applet and perform corresponding operations, package the execution result data, hash the data packet content through the SHA-256 hash algorithm, and append the calculated original hash value to the end of the data packet for identification and extraction when the target applet receives it.

[0046] Wherein, the decryption unit includes a timestamp verification subunit and an identity verification subunit; The timestamp verification subunit is used to determine whether the current timestamp in the authentication information is within the valid time range; if the current timestamp is within the valid range, the current timestamp is valid and the identity information is verified; otherwise, the authentication information is determined to be invalid and the verification process is interrupted; The authentication subunit is used to verify the validity of the identity information based on the current timestamp.

[0047] Furthermore, the data verification module includes: Hash processing unit: After the target applet receives the data packet from the target Bluetooth device, it separates the original hash value and performs the SHA-256 hash algorithm based on the separated data packet to generate a verification hash value; The integrity verification unit verifies the consistency of the result data by comparing the consistency of the original hash value and the verification hash value; when the original hash value is consistent with the verification hash value, the result data is complete, and the target applet receives the data packet and performs operations; when the original hash value is inconsistent with the verification hash value, the result data is modified, and the target applet ignores the data packet or requests the target Bluetooth device to resend the data packet for verification.

[0048] The principles, contents and implementation methods of the above-mentioned connection management module, encryption communication module, data response module and data verification module are all as described in the first embodiment and will not be repeated here.

[0049] Third embodiment In order to enable those skilled in the art to more clearly understand the technical solution of the present invention, Figure 3 , 4 , 5, describes in detail the operation process of the target applet. This embodiment focuses on the interaction steps between the applet and the Bluetooth device and its related security mechanisms, including device search, connection, identity authentication, data encryption and decryption, and data integrity verification.

[0050] like Figure 3 As shown, the target applet operation process is: (1) Start the target applet and enter the target Bluetooth device search process.

[0051] (2) The mini program searches for devices. Through the WeChat Bluetooth API, the target mini program starts scanning for available Bluetooth devices in the surrounding area.

[0052] (3) Connect to the target Bluetooth device. Once the target Bluetooth device is found, the target applet attempts to establish a Bluetooth connection with the target Bluetooth device.

[0053] (4) The target Bluetooth device sends an authentication message. After the target Bluetooth device is successfully connected, it will send an authentication message containing the public key ID, i.e., authentication information, to the target applet.

[0054] (5) The target applet receives the message. The target applet receives the authentication message sent by the target Bluetooth device and obtains the corresponding public key from the cloud database through the public key ID. (6) The target applet uses the obtained public key to encrypt the timestamp and identity information through the RSA algorithm, and sends the encrypted message to the target Bluetooth device.

[0055] (8) The target Bluetooth device receives the encrypted message and decrypts it using the private key to check whether the timestamp is valid and whether the identity information is legal.

[0056] (9) Figure 5 As shown in , when the authentication fails, the target Bluetooth device immediately disconnects the Bluetooth connection. Figure 4 As shown, communication continues, and the target applet sends a control protocol to control the device.

[0057] (10) Determine whether the user exits the control page. If the user exits the control interface, the process ends. Otherwise, the target Bluetooth device receives the control instruction, performs the corresponding operation, and returns a data packet of the response message.

[0058] (11) After executing the control command, the device returns a data message and calculates the hash value of the message using the SHA-256 algorithm, appends it to the end of the message, and sends it back to the applet.

[0059] (12) The applet parses the message and verifies the hash value. If the hash values ​​are consistent, the data integrity verification is successful and communication continues. If the hash values ​​are inconsistent, the target applet sends a request to the device to retransmit the data, and the device resends the data packet until the data integrity is verified.

[0060] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

[0061] It should be noted that the above embodiments can be freely combined as needed. The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered as the protection scope of the present invention.

Claims

1. An authentication communication method based on a mini-program and a Bluetooth device, characterized in that: The authentication communication method is deployed in a user terminal, and the user terminal is equipped with a target Bluetooth device and a target applet. The method includes: The target Bluetooth device responds to the connection request of the target applet, and sends an identity authentication request including a public key identifier to the target applet after successful connection; The target applet obtains the public key from the cloud through the public key identifier, encrypts the user's identity information and current timestamp through the public key, generates authentication data and sends it to the target Bluetooth device; The target Bluetooth device uses the built-in private key to decrypt the authentication data for verification. After verification, it receives and executes the control command of the target applet, and packages the execution result data and the hash value verifying the integrity of the result data and transmits them back to the target applet; After receiving the data packet, the target applet recalculates the hash value of the data packet and compares it with the hash value contained in the data packet. When the hash values ​​are consistent, the data transmission is complete and secure; otherwise, the target applet resends the control command and continues to monitor the returned data packet until the hash values ​​are consistent.

2. The authentication communication method according to claim 1, characterized in that: The cloud uses the RSA algorithm to generate several pairs of keys, the keys include a public key and a private key, each pair of keys is stored in the cloud in a server database, and each public key is associated with a unique public key identifier; wherein, The private key and the corresponding public key identifier are embedded in the firmware code generated in the cloud and deployed in the target Bluetooth device for decryption of the authentication data; the public key is stored in the cloud and used to encrypt data transmitted from the target Bluetooth device.

3. The authentication communication method according to claim 1, characterized in that: The target applet obtains the public key from the cloud through the public key identifier, encrypts the user's identity information and the current timestamp through the public key, and generates authentication data to send to the target Bluetooth device, including: The target applet receives the identity authentication request of the target Bluetooth device; and obtains the corresponding public key from the cloud according to the public key identifier in the identity authentication request; The public key combines the current timestamp with the identity information through the RSA algorithm, encrypts and generates a corresponding encrypted message and encapsulates it, and the encrypted message is used as the authentication data to respond to the identity authentication request; the identity information includes an identity ID, and may optionally include one or more of an identity name, an authority level or a role; The encapsulated encrypted message is sent to the target Bluetooth device through the Bluetooth communication link between the target applet and the target Bluetooth device.

4. The authentication communication method according to claim 3, characterized in that: The target Bluetooth device uses the built-in private key to decrypt the authentication data verification including: The target Bluetooth device receives the encapsulated encrypted message and decrypts it using the private key to verify the authentication information; Determining whether the current timestamp in the authentication information is within a valid time range; When the current timestamp is within the valid range, the current timestamp is valid and the identity information is verified; otherwise, the authentication information is determined to be invalid and the verification process is interrupted; Based on the fact that the current timestamp is valid and the identity information is verified, the target applet and the target Bluetooth device communicate with each other via the Bluetooth communication link in a plain text transmission manner.

5. The authentication communication method according to claim 4, characterized in that: After verification, receiving and executing the control command of the target applet, and packaging the result data of the execution and the hash value for verifying the integrity of the result data and transmitting them back to the target applet include: When the authentication data is verified, the target Bluetooth device receives the control command of the target applet and performs a corresponding operation; The result data of the execution is packaged, and the content of the data packet is hashed using the SHA-256 hash algorithm, and the calculated original hash value is appended to the end of the data packet for identification and extraction when the target applet receives it.

6. The authentication communication method according to claim 5, characterized in that: After receiving the data packet, the target applet recalculates the hash value of the data packet and compares it with the hash value contained in the data packet. When the hash values ​​are consistent, the data transmission is complete and secure. Otherwise, the target applet resends the control command and continues to monitor the returned data packets until the hash values ​​are consistent, including: After receiving the data packet from the target Bluetooth device, the target applet separates the original hash value, and performs the SHA-256 hash algorithm based on the separated data packet to generate a verification hash value; Verifying the consistency of the result data by comparing the consistency of the original hash value and the verification hash value; When the original hash value is consistent with the verification hash value, the result data is complete, and the target applet receives the data packet and performs an operation; When the original hash value is inconsistent with the verification hash value, the result data is modified, and the target applet ignores the data packet or requests the target Bluetooth device to resend the data packet for verification.

7. An authentication communication system based on a mini-program and a Bluetooth device, using the authentication communication method according to any one of claims 1 to 6, characterized in that: include, A connection management module, used for the target Bluetooth device to respond to the connection request of the target applet, and send an identity authentication request including a public key identifier to the target applet after successful connection; An encryption communication module, used for the target applet to obtain the public key from the cloud through the public key identifier, and encrypt the user's identity information and current timestamp through the public key, generate authentication data and send it to the target Bluetooth device; A data response module is used for the target Bluetooth device to decrypt the authentication data using a built-in private key for verification, receive and execute the control command of the target applet after verification, and package the execution result data and the hash value for verifying the integrity of the result data and transmit them back to the target applet; The data verification module is used to recalculate the hash value of the data packet and compare it with the hash value contained in the data packet after the target applet receives the data packet. When the hash values ​​are consistent, the data transmission is complete and secure; otherwise, the target applet resends the control command and continues to monitor the returned data packet until the hash values ​​are consistent.

8. The authentication communication system according to claim 7, characterized in that: In the encryption communication module, the cloud uses the RSA algorithm to generate several pairs of keys, the keys include a public key and a private key, each pair of keys is stored in the cloud in a server database, and each public key is associated with a unique public key identifier; the private key and the corresponding public key identifier are embedded in the firmware code generated by the cloud and deployed to the target Bluetooth device for decryption of the authentication data; the public key is stored in the cloud and is used to encrypt data transmitted from the target Bluetooth device.

9. The authentication communication system according to claim 8, characterized in that: The data response module includes: A decryption unit, used for the target Bluetooth device to receive the encapsulated encrypted message and decrypt it using the private key to verify the authentication information; A communication management unit, configured to enable the target applet and the target Bluetooth device to communicate with each other via the Bluetooth communication link in a plain text transmission mode after the authentication information is verified; An execution unit, used for the target Bluetooth device to receive the control command of the target applet and perform corresponding operations, package the result data of the execution, hash the data packet content through the SHA-256 hash algorithm, and append the calculated original hash value to the end of the data packet for identification and extraction when the target applet receives it; Wherein, the decryption unit includes a timestamp verification subunit and the identity verification subunit; The timestamp verification subunit is used to determine whether the current timestamp in the authentication information is within a valid time range; if the current timestamp is within the valid range, the current timestamp is valid and the identity information is verified; otherwise, the authentication information is determined to be invalid and the verification process is interrupted; The identity authentication subunit is used for authentication based on the validity of the current timestamp and the identity information.

10. The authentication communication system according to claim 9, characterized in that: The data verification module comprises: Hash processing unit: after receiving the data packet from the target Bluetooth device, the target applet separates the original hash value, and performs the SHA-256 hash algorithm based on the separated data packet to generate a verification hash value; The integrity verification unit verifies the consistency of the result data by comparing the consistency of the original hash value and the verification hash value; when the original hash value is consistent with the verification hash value, the result data is complete, and the target applet receives the data packet and performs operations; when the original hash value is inconsistent with the verification hash value, the result data is modified, and the target applet ignores the data packet or requests the target Bluetooth device to resend the data packet for verification.

Images