Establishment of wireless data connections
By introducing controllable optical or acoustic signal devices into the device and using wireless data connections for PIN code exchange process, the problem of implementing secure Bluetooth pairing on devices without display screens and input options is solved, and the security and difficulty of pairing is improved.
Patent Information
- Application Number
- CN202380055236.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2022-07-28
- Filing Date
- 2023-07-14
- Publication Date
- 2025-02-25
AI Technical Summary
Existing Bluetooth device pairing methods make it difficult to achieve secure wireless data connections on devices without display and input options, especially in industrial environments.
By introducing a controllable optical or acoustic signal device into the device, a PIN code exchange process is performed using a wireless data connection, including generating and storing a PIN code, sending a PIN code through a signal device, receiving and verifying a PIN code to determine the acceptance of the data connection.
Improves the security of device pairing, especially on devices without display and input options, making it more difficult for malicious devices to establish connections.
Smart Images
Figure CN119522589A_ABST
Abstract
Description
[0001] The invention relates to a device having an interface for a wireless data connection and a method for establishing a wireless data connection between a first and a second device via such an interface.
[0002] Ideally, the pairing procedure for Bluetooth devices uses a PIN code to ensure that the desired devices are connected to each other. For example, when a smartphone is connected to a vehicle, the display on the vehicle will show a PIN code generated by the vehicle, which must be manually entered into the smartphone. The smartphone then transmits the PIN code to the vehicle, which verifies it. This greatly increases the difficulty for people outside the vehicle to connect Bluetooth devices to the car.
[0003] Some devices do not have a display and no input options. In the end-user space, these devices include headsets, etc. For many devices in industrial environments, installing a display and input options is not possible due to size and / or cost reasons. The previously described pairing method with PIN code cannot be used on such devices.
[0004] Another password-free pairing mechanism works by putting the device to be paired into pairing mode, such as by pressing a button. However, the device then accepts all pairing requests from other devices. The disadvantage of this method is that the security level is low, because any unintended device in the nearby environment may be able to pair.
[0005] Another alternative mechanism is to use a predefined and fixed PIN code. This code can be printed on a label or QR code, or provided in the device manual. This solution also has a low security level.
[0006] Both alternative mechanisms are disadvantageous in industrial environments due to their low security level.
[0007] The technical problem to be solved by the present invention is to provide a method for pairing which provides improved security for devices without sufficient display and input possibilities. A further technical problem to be solved by the present invention is to provide a device which is suitable for carrying out the method.
[0008] With regard to the device, this object is achieved by a device having the features of claims 1 and 2. With regard to the method, this object is achieved by a method having the features of claim 10 .
[0009] The device according to the invention comprises an interface for a wireless data connection, a controllable signaling device for generating an optical or acoustic signal, and a control device for the interface and the controllable signaling device.
[0010] Here, the control device is designed to implement a PIN code exchange process in order to establish a data connection with the second device, and the PIN code exchange process includes the following steps:
[0011] - generate and store a PIN code for receiving a data connection,
[0012] - sending the PIN code by means of said signalling means so as to enable said second device to receive it,
[0013] - receiving the PIN code from the second device via the wireless data connection,
[0014] - The data connection is only accepted if the received PIN code matches the stored PIN code.
[0015] A further device according to the invention has an interface for a wireless data connection, an optical or acoustic detector and a control device for the interface and the detector.
[0016] Here, the control device is designed to implement a PIN code exchange process in order to establish a data connection with the second device, and the PIN code exchange process includes the following steps:
[0017] - receiving, by means of the detector, from the second device a PIN code for establishing a data connection,
[0018] - Sending the PIN code back to the second device via the wireless data connection.
[0019] The first device and the second device respectively serve as both a sender of the PIN code and a receiver of the PIN code.
[0020] In the method for establishing a wireless data connection between a first device and a second device according to the present invention, a PIN code exchange process is implemented.
[0021] In this case, the first device generates and stores a PIN code, and transmits the PIN code optically or acoustically to the second device. The second device receives the PIN code optically or acoustically, and transmits the PIN code back to the first device via a wireless data connection. The wireless data connection is only established if the stored PIN code matches the PIN code received by the first device via the wireless data connection.
[0022] Thus, in the device and method according to the invention, a data channel is advantageously used for the transmission with the signaling device, which data channel is not a radio channel and which already exists in many devices, thereby making it advantageously simple to use in existing devices.
[0023] The advantage of the first device generating the PIN code is that, by placing the optical or acoustic signaling device in the vicinity of the second device, a data connection to the second device associated with the first device can be established with significantly greater reliability. It is more difficult for a third device to maliciously establish such a connection, since it is more difficult for a third device to receive a PIN code transmitted by optical or acoustic means than by a wireless data connection based on radio.
[0024] In this context, a PIN (Personal Identification Number) is generally understood to be a string of characters, usually a sequence of any number of characters.
[0025] The PIN code sent back to the first device is received via the wireless data connection. This is always possible even if the desired data connection does not yet exist and a prerequisite for this is the receipt of a PIN code. Accepting a data connection means that the devices mutually accept and process data received physically outside the PIN code exchange process. However, if, on the other hand, a data connection is not established, for example because an incorrect PIN code was sent back, both devices physically receive the transmissions from the respective other device, but do not process these further until it is determined that there is no connection to the other device.
[0026] Advantageous embodiments of the invention are obtained from the dependent claims. The embodiments of the independent claims can be combined with the features of one of the dependent claims, or preferably with the features of several dependent claims. Thus, the following additional features can be provided:
[0027] The device can be designed to generate a new PIN code by means of a random number generator for each admission of a data connection. This ensures that no security risks arise from a fixed and stored PIN code. Once such a PIN code is known, it can be used immediately so that a third device can establish a connection as if the third device corresponds to the second device, i.e., to the device that received the PIN code optically or acoustically.
[0028] The signaling device may be a light emitting diode. Light emitting diodes are small, cheap and have low power consumption and are therefore widely used in small and large devices to display simple signals. These signals include, for example, indicator lights that indicate that the device is ready or that the battery is low. In many applications, controllers are already available for this purpose, which can also generate time-variable signals, such as flashing. Light emitting diodes also have the advantage of being very responsive and can therefore also display signals with a high time resolution. Light emitting diodes are therefore particularly suitable for transmitting PIN codes as quickly and covertly as possible. For example, the PIN can be encoded using brightness change values and switching durations.
[0029] In a special design, the signaling device can include a plurality of light-emitting diodes, in particular RGB-LEDs. RGB (three primary colors) LEDs are also often installed in small and large devices to signal operating states. Multi-color LEDs allow for more complex modulation of the signal, making it more difficult to decode. In addition, longer PIN codes, such as encrypted PIN codes, can be transmitted more quickly. In addition to the brightness changes and switching durations of the individual LEDs, the relative values between the LEDs can also be used to encode the PIN.
[0030] Alternatively, the signaling device may be a speaker. The speaker is also present in many small devices and is capable of modulating the sound produced so that data can be transmitted. For example, the speaker may be a piezoelectric speaker.
[0031] The control device can be designed to encrypt the PIN code before transmission, in particular by means of a personal key for a PGP (Pretty Good Privacy) procedure, and to receive the PIN code in an unlocked form. The security of the client device can be further increased by using an encryption method. External devices that maliciously want to establish a data connection with the device must be able to decrypt. For example, if the encryption is performed using the private key of the PGP program, the public key must be known to the third device.
[0032] If the password is not returned in decrypted form, the acceptance of the data connection should be cancelled. For example, if the PIN code is only returned in encrypted form (which is easy to do), the connection will not be established. This ensures that only a second device that can decrypt the PIN code, for example a device that possesses the public key, can accept a data connection with the device.
[0033] The control device can be designed to convert the PIN code into a time-discrete expression by means of inverse fast Fourier transform, and control the signal device according to the result of the conversion. Alternatively, other forms can be used to convert the PIN into control of the signal device. For example, control can be performed in the form of Morse code.
[0034] In the second device, the control device may be designed to convert the signal received by the detector into a PIN code by means of a fast Fourier transform.
[0035] The control device can also be designed to transmit the checksum together with the PIN code. Through the checksum, the receiving device can determine whether the PIN code has been transmitted without error.
[0036] In the second device, the control device is expediently designed to receive the checksum together with the PIN code and to determine, based on the checksum, whether the PIN code was transmitted correctly.
[0037] If the transmission of the PIN code is correct, a signal is sent to inform that the PIN code should be retransmitted. Alternatively, the first device may be designed to transmit the PIN code multiple times. In this case, the second device may abandon the PIN code received in error and re-receive the PIN code.
[0038] The wireless data connection can be a connection in accordance with the Bluetooth standard. Bluetooth connections are widely used, including in industrial environments. The establishment of a Bluetooth data connection, also known as pairing, involves the exchange of PIN codes on appropriately equipped devices, wherein the user manually enters the PIN code on one of the devices. Devices that do not support this function, on the other hand, work without a PIN code or have a password set at the factory.
[0039] Alternatively, the wireless data connection can also be a connection that complies with the WiFi standard. If a PIN code is issued by the signaling device, such a data connection is also advantageous in order to allow simple devices to connect more securely.
[0040] The present invention is further described below with reference to the embodiments shown in the accompanying drawings. In the accompanying drawings:
[0041] Figure 1 Shows sensors and control devices that accept Bluetooth connections,
[0042] Figure 2 schematically illustrates a method for reliable Bluetooth pairing,
[0043] Figure 3 Shown is a line protection switch and a tablet computer receiving a WiFi connection.
[0044] The following embodiment describes a method for pairing two Bluetooth devices. However, this is only an example, and the present invention can also be used for other types of wireless data connections, such as WiFi. The present invention is preferably used for wireless standards. The wireless standards mentioned here refer to standards using frequencies in the range of MHz to GHz.
[0045] pass Figure 1 A first embodiment of the present invention is explained. Figure 1 A first device is shown, which in this case is an industrial sensor 11 . Figure 1 Also shown is a second device, which in this case is an industrial control device 12. The control device 12 can be designed for wirelessly addressing, controlling and reading a plurality of sensors 11. The control device 12 can be installed, for example, in a factory building or a production hall.
[0046] In other implementation variants, the second device may also be a device that establishes a connection with other networks, for example, a data network such as the Internet, a cloud service, etc. Here, the device may be a router equipped with a Bluetooth connection under this function.
[0047] The sensor 11 is then connected wirelessly, for example via Bluetooth, to the control device 12. As a relatively small device, the sensor 11 has no keyboard or other input possibilities. The sensor 11 also has no screen for outputting information. The sensor 11 cannot perform a pairing process in which a PIN code is generated and displayed on one device and entered on the other device.
[0048] However, the sensor 11 has an infrared LED 13, which can be controlled and modulated by a microcontroller 14 arranged in the sensor 11. If pairing is to be performed at this time, that is, the sensor 11 is connected to the control device 12 via Bluetooth for data exchange, the infrared LED 13 needs to be used to perform a PIN code exchange process. Figure 2 A schematic diagram showing the PIN code exchange process.
[0049] In the PIN code exchange process, a new PIN code is generated in a first step 21 by the microcontroller 14. In principle, the PIN code can be any string of symbols, such as an alphanumeric string or a simple sequence of numbers. The generation is carried out by a random number generation method. Such methods are known in computer technology, as are methods and ways of storing the generated PIN code in the memory of the microcontroller 14. The PIN code is temporarily stored for a later comparison.
[0050] In a second step 22, the PIN code thus generated is transmitted by the infrared LED 13. For this purpose, for example, an inverse fast Fourier transform (IFFT) method can be used to generate a modulation sequence for the infrared LED 13 from the PIN code. The infrared LED 13 controlled by the microcontroller 14 is controlled so as to run through the modulation sequence once or multiple times. The brightness of the infrared LED 13 is its only degree of freedom, but it can be modulated rapidly so as to emit complex data sequences.
[0051] In other embodiments, another form of converting the PIN into a brightness sequence can also be used instead of the IFFT. For example, a discrete brightness sequence can be used. In the simplest case, this corresponds to Morse code, but in more complex variants more than two brightness levels can also be used. On the one hand, this can speed up the data transmission, but on the other hand it can also make the data transmission more complicated. The purpose here is to make it as difficult as possible for a third party to read the PIN code. For this purpose, the process of converting the PIN code into a brightness sequence can be more complicated than is necessary for a simple data transmission.
[0052] In other variants, in addition to the PIN code, a checksum can also be transmitted, based on which correct reception can be verified. Checksums themselves are known in the prior art.
[0053] In a third step 23, the control device 12 receives the infrared signal emitted in this way via the infrared detector 15. For example, the microcontroller 16 of the control device 12 determines the PIN code from the received signal by means of a fast Fourier transformation (FFT). The PIN code is thus transmitted optically from the sensor 11 to the control device 12.
[0054] It is expedient for the sensor 11 to be located near the control device 12 during pairing. It is also expedient for the infrared LED 13 to be designed in such a way that good reception is possible for the infrared detector 15. Unlike radio signals, which can penetrate walls well due to their properties, infrared signals can hardly be received outside the room and due to their strength outside the direct line of sight.
[0055] In a fourth step 24, the control device 12 transmits the PIN code back to the sensor 11 using Bluetooth. Compared to optical transmission, Bluetooth transmission requires significantly less physical proximity or line of sight for this purpose.
[0056] In a fifth step 25, the sensor 11 receives the PIN code and compares the received PIN code with the PIN code originally sent and stored by the sensor 11. If the two match, the sensor 11 accepts the connection. Thus, in a sixth step 26, a Bluetooth connection is established between the sensor 11 and the control device 12. However, if the PIN codes do not match or are not contained in the returned information, the sensor 11 rejects the connection in a seventh step 27.
[0057] Unlike the establishment of a connection using a fixed PIN code (which may be the same for all sensors 11 of the same type) or without a PIN code, the connection acceptance here is ensured by a PIN code that is newly generated for each pairing. The PIN code is transmitted between the devices in a simple manner, in this case via an infrared LED 13 and an infrared detector 15, which is more difficult to intercept than transmission via Bluetooth itself.
[0058] according to Figure 3 A second embodiment of the present invention is described. Figure 1 The same reference numerals are used in the drawings. Figure 3 A first device is shown, which in this case is a line protection switch 31 . Figure 1 A second device is also shown, in this case a tablet 32. Similarly, the second device can also be a smartphone. The line protection switch 31 is arranged in an industrial environment. For example, it can be a DC switch in a factory DC device. Both devices are designed for wireless data connection with respective WiFi interfaces 34, 35.
[0059] A WiFi connection should be established between the line protection switch 31 and the tablet computer 32. In the present embodiment, the line protection switch 31 should not have a display and does not have sufficient PIN code input possibilities.
[0060] However, the circuit breaker 31 comprises an RGB LED light 33 for displaying the status, which can be controlled and modulated by the microcontroller 14 installed in the circuit breaker 31. If a connection is now to be established between the circuit breaker 31 and the tablet computer 32, the following is performed again: Figure 2 . In this case, the PIN code is emitted by an RGB-LED lamp 33. The three independent diodes constituting the RGB-LED lamp 33 can be used to perform more complex modulation than a single LED. Here, the modulation can also be carried out in such a way that it is as difficult as possible for the outside world to identify the type of modulation. The PIN code is received on one side of the tablet computer 32 by a camera 36 arranged in the tablet computer 32. If the camera is an active pixel sensor (also called a CMOS sensor, as opposed to the CCD used in digital cameras and camcorders), as is common in smartphones, relatively fast modulation can be detected. Similar to the first embodiment, the PIN code is transmitted back from the tablet computer 32 to the line protection switch 31 via WiFi interfaces 34, 35.
[0061] Reference numerals list
[0062] 11 Sensors
[0063] 12 Control Equipment
[0064] 13 infrared LED lights
[0065] 14, 16 Microcontroller
[0066] 15 Infrared detector
[0067] 17, 18 Bluetooth interface
[0068] 21…27 First Arrangement to the Seventh Step
[0069] 31 Line protection switch
[0070] 32 tablets
[0071] 33RGB-LED lights
[0072] 34, 35 WiFi interface
[0073] 36 cameras
Claims
1. A device (11, 31) having: - interfaces for wireless data connections (17, 34), - a controllable signaling device (13, 33) for generating an optical or acoustic signal, - a control device (14) for the interface (17, 34) and the controllable signaling device (13, 33), in, The control device (14) is designed to implement a PIN code exchange process in order to accept a data connection with a second device (12, 32), and the PIN code exchange process includes the following steps: - generating (21) and storing a PIN code for receiving a data connection, - sending (22) a PIN code via the signaling means (13, 33) so as to enable the second device (12, 32) to receive it, - receiving (33) the PIN code from the second device (12, 32) via the wireless data connection, - The data connection is only accepted if the received PIN code matches the stored PIN code.
2. The device (11, 31) according to claim 1, wherein The device is designed to generate a new PIN code by means of a random number generator for each admission of a data connection.
3. The device (11, 31) according to claim 1 or 2, wherein: The signaling device (13, 33) is a light emitting diode (13).
4. The device (11, 31) according to claim 3, wherein: The signaling device (13) comprises a plurality of light emitting diodes, in particular RGB-LED lamps (33).
5. The device (11, 31) according to claim 1, wherein The signaling device (13, 33) is a loudspeaker.
6. The device (11, 31) according to one of the preceding claims, wherein: The control device (17, 34) is designed to encrypt the PIN code before transmission, in particular by means of a personal key for a PGP process, and to receive the PIN code in an unlocked form.
7. The device (11, 31) according to one of the preceding claims, wherein: The control device (17, 34) is designed to transform the PIN code into a time-discrete expression by means of inverse fast Fourier transform, and control the signaling device (13, 33) according to the result of the transformation.
8. The device (11, 31) according to one of the preceding claims, wherein The control device (34) is designed to transmit the checksum together with the PIN code.
9. A device (12, 32) having an interface (18, 35) for a wireless data connection, having - optical or acoustic detectors (15, 36), - a control device (16) for the interface (18, 35) and the detector (15, 36), in, The control device (16) is designed to implement a PIN code exchange process in order to accept a data connection with a second device (11, 31), and the PIN code exchange process includes the following steps: - receiving a PIN code for accepting a data connection from the second device by means of the detector (15, 36), - Sending the PIN code back to the second device (11, 31) via the wireless data connection.
10. The device (12, 32) according to claim 9, wherein The control device (16) is designed to convert the signal received by the detector (15, 36) into a PIN code by means of a fast Fourier transform.
11. The device (12, 32) according to claim 9 or 10, wherein: The control device (16) is designed to receive the checksum together with the PIN code and to determine, based on the checksum, whether the PIN code was transmitted correctly.
12. The device (11, 12, 31, 32) according to one of the preceding claims, wherein The wireless data connection is a connection compliant with the Bluetooth standard.
13. The device (11, 12, 31, 32) according to one of the preceding claims, wherein The wireless data connection is a connection that complies with the WiFi standard.
14. A method for establishing a wireless data connection between a first device and a second device (11, 12, 31, 32), wherein: Implement a PIN exchange process, where: - the first device (11, 31) generates and stores a PIN code, - the first device (11, 31) transmits the PIN code optically or acoustically to the second device (12, 32), - the second device (12, 32) optically or acoustically receives the PIN code, - the second device (12, 32) transmits the PIN code to the first device (11, 31) via a wireless data connection, - The connection is accepted only if the stored PIN code matches the PIN code received by the first device (11, 31) by means of the wireless data connection.