A Bluetooth-based automatic encryption authorization system, method and storage medium

Abstract

The present application relates to the technical field of Bluetooth communication, and in particular to a Bluetooth-based automatic encryption authorization system, method and storage medium, which includes: an identity pool for storing Bluetooth identity information of mobile devices; a device pool for storing device information and factory authorization codes of access devices; an online authorization server connected to the identity pool and the device pool, which is used to add a first sequence number and a second sequence number to the factory authorization code based on the generated pre-authorization sequence to obtain a real-time authorization code and send it to the identity pool, and then send the number set to the device pool; an authorization module, which obtains the real-time authorization code responded in the identity pool and matches the number set on the access device; a secondary proxy module, which is used to obtain a proxy access request issued by a mobile terminal and share the real-time authorization code of the mobile terminal; an encryption module, which generates a key based on a preset encryption algorithm combined with the real-time authorization code. The present application can improve the effect of safe automatic authorization of Bluetooth communication.

Description

Technical Field

[0001] The present application relates to the technical field of Bluetooth communication, and in particular to a Bluetooth-based automatic encryption authorization system, method and storage medium. Background Art

[0002] With the continuous development of Internet of Things technology, more and more devices are realizing intelligent connection with users' mobile terminals through different communication methods. The connection between mobile terminals and devices requires obtaining communication connection authorization from the enterprise corresponding to the device for the mobile terminal that needs to be connected.

[0003] Usually, authorization of a mobile terminal requires the business organization of the device to authenticate its identity and send the corresponding authorization key. The mobile terminal is connected and paired with the device based on the authenticated certificate and the obtained authorization key. However, this process is cumbersome and requires manual operation and pairing by the business organization in combination with the mobile terminal holder to be implemented. Automatic authorization and secure encryption of the authorization process are not possible. At the same time, when other secure users are required to connect to the device according to different usage scenarios, the business organization often needs to repeat the authentication, encryption, and authorization process for the newly connected mobile terminal, and intelligent and automated authorization cannot be achieved. Summary of the invention

[0004] In order to improve the security and automatic authorization effect of Bluetooth communication, the present application provides a Bluetooth-based automatic encryption authorization system, method and storage medium.

[0005] In the first aspect, the present application provides an automatic encryption authorization system based on Bluetooth, which adopts the following technical solution:

[0006] An automatic encryption authorization system based on Bluetooth, comprising:

[0007] The identity pool is used to obtain access requests, and based on the access requests, obtain the Bluetooth identity information of the mobile terminal to be accessed and store it regularly;

[0008] A device pool, used to store device information of access devices and obtain factory authorization codes of each access device;

[0009] an online authorization server connected to the identity pool and the device pool via HTTPS, and used to generate a first pre-authorization sequence and a second pre-authorization sequence, and respectively add a first sequence number and a second sequence number to the factory authorization code via the first pre-authorization sequence and the second pre-authorization sequence to obtain a real-time authorization code;

[0010] The online authorization server sends the updated real-time authorization code to the identity pool, and integrates the first sequence number and the second sequence number into a number set and sends the set to the device pool;

[0011] An authorization module is used to obtain the real-time authorization code currently stored in the Bluetooth identity information of the response and the number set currently stored on the access device for matching when the access device obtains the Bluetooth identity information response stored in the identity pool during Bluetooth broadcasting, and completes authorization for the mobile terminal when the match is successful;

[0012] A secondary proxy module, configured to obtain a proxy access request issued by the mobile terminal in the identity pool, and obtain the Bluetooth identity information corresponding to the secondary mobile terminal corresponding to the proxy access request to associate and store with the mobile terminal and share the real-time authorization code received by the mobile terminal;

[0013] The encryption module selects any one or a combination of encryption instructions based on a preset encryption algorithm in combination with the real-time authorization code, and selects a fragment in the real-time authorization code in combination with an encryption extension code through the encryption instruction to generate a key, and encrypts the communication data between the mobile terminal and the access device through the key.

[0014] In some embodiments, the online authorization server is specifically used to:

[0015] Generate an independent mapping relationship between each of the mobile terminals and each of the access devices, wherein the mapping relationship is used to store the factory authorization code that changes in real time;

[0016] The access devices are selected in sequence according to the first pre-authorization sequence, and the first sequence number is generated according to the sequence in which the access devices are selected to be added to the random position of the factory authorization code thereof and randomly updated to the mapping relationship of the plurality of mobile terminals;

[0017] Selecting the mobile terminals in sequence according to the second pre-authorization order, generating the second sequence number according to the order in which the mobile terminals are selected, and randomly adding the second sequence number to a random position of the factory authorization code in a plurality of currently existing mapping relationships to generate the real-time authorization code;

[0018] The first sequence number and the second sequence number together constitute the number set.

[0019] In some of the embodiments, the online authorization server is further configured to:

[0020] When the factory authorization code is repeatedly selected based on the first pre-authorization sequence or the second pre-authorization sequence, if the length of the current real-time authorization code exceeds a preset length, the real-time authorization code is reset, and the reset is characterized by deleting all the first sequence numbers and / or the second sequence numbers currently existing in the real-time authorization code and modifying the value of the factory authorization code;

[0021] When the real-time authorization code is reset, the number set matched by the real-time authorization code is deleted.

[0022] In some embodiments, the authorization module is specifically used to:

[0023] Obtaining the Bluetooth identity information of the mobile terminal in response and determining whether it belongs to the identity pool;

[0024] If so, obtaining a unique device code corresponding to the selected target device based on the mobile terminal and pairing it with the broadcast information in the Bluetooth broadcast to achieve pre-connection;

[0025] Searching for the corresponding real-time authorization code in all the corresponding mapping relationships based on the target device selected by the mobile terminal, and determining whether there is a segment match with the factory authorization code of the currently pre-connected access device;

[0026] If so, traversing the real-time authorization code to determine whether there are all fields that match the number set stored in the access device;

[0027] If all fields exist, the match is successful and authorization is completed.

[0028] After the access device authorizes the mobile terminal, all the factory authorization codes issued by the access device in the history are recycled to interrupt the mapping relationship with all other mobile terminals and instruct the access device to remain silent;

[0029] When the current authorization of the mobile terminal is cancelled, the access device is controlled to re-send the factory authorization code to the identity pool to end silence.

[0030] In some of the embodiments, the secondary proxy module is used to generate several identity trees in the identity pool, each of the identity trees has a trunk node and several branch nodes connected by an identity chain, the trunk node is used to store the Bluetooth identity information of each of the mobile terminals, and the branch nodes are used to store the Bluetooth identity information corresponding to the secondary mobile terminals associated with each of the mobile terminals, and all the real-time authorization codes corresponding to the trunk nodes are transmitted to each of the branch nodes through the identity chain.

[0031] In some embodiments, the encryption module is specifically used for:

[0032] Based on the real-time authorization code, a basic segment, a time segment, a location segment and an object segment are respectively generated, wherein the basic segment is represented by a field corresponding to the factory authorization code, the time segment is represented by a generation time field corresponding to the first sequence number and / or the second sequence number, the location segment is represented by a location field of the first sequence number and / or the second sequence number in the real-time authorization code, and the object segment is represented by a data field corresponding to the corresponding field indicating the number of times the issued object is selected;

[0033] randomly selecting an encryption scheme including one or more of the encryption instructions, and combining the selected basis segments, time segments, location segments and / or object segments based on the encryption scheme to obtain a key segment;

[0034] Obtaining the update times of the real-time authorization code, adding a random number to the update times to obtain an encryption extension code, and adding the encryption extension code to the key segment to generate a key, wherein the update times include the addition times of the first sequence number and the second sequence number and the reset times of the real-time authorization code;

[0035] The encryption scheme is updated every time new communication data is acquired.

[0036] In some of the embodiments, a double encryption module is also included in the access device, which is used to determine whether the communication data encrypted by the encryption module and sent by the mobile terminal is sensitive data after the access device obtains the communication data. If so, the communication data is encrypted again and stored or uploaded.

[0037] In a second aspect, the present application provides an automatic encryption authorization method based on Bluetooth, which adopts the following technical solution:

[0038] An automatic encryption authorization method based on Bluetooth is implemented based on the above system.

[0039] In a third aspect, the present application provides a storage medium, which adopts the following technical solution:

[0040] A storage medium stores at least one instruction, at least one program, a code set or an instruction set, wherein the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the above method.

[0041] The technical solution provided by the embodiment of the present application has the following technical effects:

[0042] The Bluetooth identity information of all access devices and accessed mobile terminals is stored in the corresponding data pool in advance, and the factory authorization code of each access device is used as the basis for the association of the two objects. Different mobile terminals and access devices are selected in random order to generate different sequence numbers to adjust the factory authorization code in real time through the sequence number. In this way, there can be a unique and identifiable real-time authorization code between different mobile terminal individuals and different access device individuals. The real-time authorization code is sent to the mobile terminal, and the number set of the change record is sent to the access device, so that the identity and authorization consistency of the two are verified respectively through the real-time authorization code and the number set to complete the authorization verification, so that users can achieve automatic authorization without manual operation;

[0043] The authorization process is secure, and through the secondary agent, the authorized mobile terminal can share the authorization with other mobile terminals recognized by it to complete the authorization.

[0044] At the same time, the encryption key in the communication data transmission is dynamically generated through the real-time authorization code that changes in real time, so that the authorization and encryption processes are associated, the communication process is more secure and the encryption key can be automatically updated and privatized. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a schematic diagram of module connection of a Bluetooth-based automatic encryption authorization system provided in this embodiment. DETAILED DESCRIPTION

[0046] To more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. However, it should be understood by those of ordinary skill in the art that the present application can be implemented without these details. In some cases, in order to avoid unnecessary descriptions that make various aspects of the present application obscure, well-known methods, processes, systems, components and / or circuits that have been described at a higher level will not be described in detail. For those of ordinary skill in the art, it is obvious that various changes can be made to the embodiments disclosed in the present application, and without departing from the principles and scope of the present application, the general principles defined in the present application can be applied to other embodiments and application scenarios. Therefore, the present application is not limited to the embodiments shown, but conforms to the broadest scope consistent with the scope claimed for protection of the present application.

[0047] It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention. In addition, the technical features involved in each embodiment of the present invention described below can be combined with each other as long as there is no conflict between them.

[0048] In the description of this application, "several" means one or more, "more" means more than two, "greater than", "less than", "exceed", etc. are understood to exclude the number itself, and "above", "below", "within", etc. are understood to include the number itself. If there is a description of "first" or "second", it is only used to distinguish the technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0049] In the description of the present application, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples.

[0050] like Figure 1 As shown, the embodiment of the present application discloses an automatic encryption authorization system based on Bluetooth, including:

[0051] The identity pool is used to obtain access requests, and based on the access requests, obtain the Bluetooth identity information of the mobile terminal to be accessed and store it periodically.

[0052] The identity pool is a database built on the management side, which is used to store the Bluetooth identity information corresponding to the connected mobile terminals.

[0053] The access request is sent by the mobile terminal or the management terminal. It is characterized by a request for a user to connect his mobile terminal to the management platform when purchasing or using a device with Bluetooth communication function so that he can subsequently connect to the device through Bluetooth. Generally, when a user purchases a device, the brand can assist or guide the user to send the access request, so that the user does not need to send a request again when he wants to authorize Bluetooth with the device later.

[0054] The Bluetooth identity information is represented as a mobile terminal-specific and unique authentication data, which is specifically a Bluetooth address, or a combination of a Bluetooth address and a device name.

[0055] The identity pool is used to store the Bluetooth identity information of all connected mobile terminals. At the same time, the storage time of each Bluetooth identity information is timed. When the Bluetooth identity information in the identity pool exceeds the timer and has not been authorized by any access device, the Bluetooth identity information is kicked out of the identity pool and needs to re-enter the identity pool by issuing an access request.

[0056] The device pool is used to store the device information of access devices and obtain the factory authorization code of each access device.

[0057] The device pool is a database built on the management side, which is used to store device information corresponding to the connected devices.

[0058] Access devices are devices that operate through the system and based on Bluetooth communication, such as smart electricity meters, smart water meters, smart homes, etc.

[0059] These devices upload their device information to the device pool for information storage when they leave the factory. The device information is represented by the unique identification information used to represent the identity of the device, including the type, number, name, Bluetooth address, etc. At the same time, in addition to storing the information of each device, the device pool is also used to store the factory authorization code of each access device.

[0060] The Bluetooth authorization code is also called the pairing code or PIN code. It is a string of numbers used to establish a trust relationship and pairing authorization between Bluetooth devices. Each device will be set with a default authorization code before leaving the factory, such as "1234", "0000", "9999". Users can modify the factory authorization code, and the manufacturer can also set a more complex authorization code based on the privacy and security requirements of the produced device.

[0061] The online authorization server is connected to the identity pool and the device pool via HTTPS, and is used to generate a first pre-authorization sequence and a second pre-authorization sequence, and respectively add a first sequence number and a second sequence number to the factory authorization code through the first pre-authorization sequence and the second pre-authorization sequence to obtain a real-time authorization code.

[0062] The online authorization server is built on the server side. It is connected to the identity pool and device pool through a secure HTTPS. It is used to build an authorization link between the identity pool and the device pool. It is independently supervised by the management side and has high security.

[0063] The online authorization server periodically triggers the objects in the connected device pool and identity pool. The triggering order selects the corresponding first pre-authorization order and second pre-authorization order according to the different objects. When each object is triggered, it will correspond to a trigger number to obtain the first sequence number and the second sequence number. The corresponding number value is added to the random position of the corresponding factory authorization code between the device and the mobile terminal through the generated sequence number to update the factory authorization code in real time.

[0064] Because each object is triggered in a different order, the generated sequence numbers are different, and the sequence numbers are added in different positions in the factory authorization code, this allows real-time, non-duplicate real-time authorization codes to be generated between each device and each mobile terminal. On the one hand, this ensures the security of subsequent authorizations, and on the other hand, it also uniquely changes the authorization identifiers between each device and each mobile terminal to avoid connection errors.

[0065] The online authorization server sends the updated real-time authorization code to the identity pool, and combines the first sequence number and the second sequence number into a number set and sends it to the device pool.

[0066] The selected authorization server continuously sends the dynamically changing real-time authorization code to the identity pool. Each mobile terminal in the identity pool can receive the real-time authorization code and receive authorization from the mobile terminal through the real-time authorization code.

[0067] The first serial number and the second serial number adjusted for the factory authorization code are integrated to obtain a number set containing two numbers and number sequences. The number set is sent to the device pool. Each mobile terminal in the device pool can obtain a different number set, and when a mobile terminal wants to access and obtain authorization in the future, the real-time authorization code given by the mobile terminal is verified through the corresponding number set. When the verification is successful, authorization can be provided.

[0068] The authorization module is used to obtain the real-time authorization code currently stored in the response Bluetooth identity information and the number set currently stored on the access device for matching when the access device obtains the Bluetooth identity information response stored in the identity pool during Bluetooth broadcasting, and completes authorization for the mobile terminal when the match is successful.

[0069] The authorization module is used to enable each access device to perform Bluetooth broadcast and determine whether there is a mobile terminal that responds to the Bluetooth broadcast. When there is Bluetooth identity information responding to the Bluetooth broadcast, it is considered that there is a mobile terminal that wants to establish a Bluetooth connection with the access device, and authorization verification is then started.

[0070] During authorization verification, first obtain the real-time authorization code carried by the corresponding Bluetooth identity information, and verify the correctness of the identity of the access device through the real-time authorization code. At the same time, perform field matching on the real-time authorization code according to the number set stored on the access device to determine whether the field information in the real-time authorization code matches the field information in the number set correctly. After the verification is passed, the mobile terminal is authorized. After authorization, the mobile terminal directly completes identity authentication, Bluetooth authorization, and Bluetooth connection with the access device, and communication data can be transmitted between the two.

[0071] The secondary proxy module is used to obtain a proxy access request issued by a mobile terminal in the identity pool, and obtain the Bluetooth identity information corresponding to the secondary mobile terminal corresponding to the proxy access request to associate with the mobile terminal to store and share the real-time authorization code received by the mobile terminal.

[0072] The secondary proxy module is used to enable the mobile terminal to remotely or closely proxy authorization for other mobile terminals, so that after a mobile terminal successfully authorizes with an access device, the mobile terminal can temporarily or permanently share the authorization with other mobile terminals, so that other authorized mobile terminals do not need to make access requests, Bluetooth broadcast responses, etc., but directly enjoy the current authorization as secondary mobile terminals of the accessed mobile terminal. Therefore, the secondary mobile terminal can directly share the real-time authorization code received by its corresponding mobile terminal.

[0073] In this way, after a main mobile terminal or a management mobile terminal is authorized and connected to the access device, family members or enterprise members can obtain authorization through a secondary agent and directly connect to the access device.

[0074] It should be noted that the secondary agent only has mobile terminals in the identity pool and is issued by authorized mobile terminals.

[0075] The encryption module selects any one or a combination of encryption instructions based on a preset encryption algorithm combined with a real-time authorization code, and selects a fragment in the real-time authorization code through the encryption instruction in combination with an encryption expansion code to generate a key, and encrypts the communication data between the mobile terminal and the access device through the key.

[0076] The encryption module is used to encrypt Bluetooth communication data to achieve secure transmission after the mobile terminal obtains authorization and establishes a Bluetooth connection with the access device. In the embodiment of the present application, the corresponding encryption instruction or a combination of multiple encryption instructions is selected through an encryption algorithm, and an encryption key is generated in combination with the real-time authorization code. The content of the encryption key is closely related to the real-time authorization code between the mobile terminal and the access device. Some fragments of the real-time authorization code are selected through the selected encryption instruction, and the encrypted fragments are combined in a sequential or random manner, and certain encryption extension codes are added to form a key. The communication data is encrypted by the key, thereby realizing a multiple encryption method of real-time authorization code + key generation, making the encryption process more secure.

[0077] Through the above steps, the Bluetooth identity information of all access devices and the accessed mobile terminals are stored in the corresponding data pool in advance, and the factory authorization code of each access device is used as the basis for the association object between the two. Different mobile terminals and access devices are selected in random order to generate different sequence numbers to adjust the factory authorization code in real time through the sequence number. In this way, there can be a unique and identifiable real-time authorization code between different mobile terminal individuals and different access device individuals. The real-time authorization code is sent to the mobile terminal, and the number set of the change record is sent to the access device, so that the identity and authorization consistency of the two are verified respectively through the real-time authorization code and the number set to complete the authorization verification, so that the user can achieve automatic authorization without manual operation;

[0078] The authorization process is secure, and through the secondary agent, the authorized mobile terminal can share the authorization with other mobile terminals recognized by it to complete the authorization.

[0079] At the same time, the encryption key in the communication data transmission is dynamically generated through the real-time authorization code that changes in real time, so that the authorization and encryption processes are associated, the communication process is more secure and the encryption key can be automatically updated and privatized.

[0080] In some other embodiments, the online authorization server is specifically used for:

[0081] Generate independent mapping relationships between each mobile terminal and each access device.

[0082] There is a mapping relationship between each mobile terminal and each access device, and the mapping relationship is used to store the factory authorization code that changes in real time. When the subsequent mobile terminal and access device are selected in the corresponding order, the sequence number generated according to the corresponding order will be added to the corresponding mapping relationship.

[0083] Selecting access devices in sequence through a first pre-authorization order, and generating a first sequence number according to the order in which the access devices are selected to add to a random position of its own factory authorization code and randomly update the mapping relationship to a plurality of mobile terminals;

[0084] First, access devices are selected through the first pre-authorization order, where the order in which each device is selected is random, and the number of access devices selected each time is also random. For example, there are four access devices a1, a2, a3, and a4. After selecting according to the randomly generated first pre-authorization order, the selected objects are as follows: a2, a1a3, a2a3, a4, and a1a2a4. Then the first sequence number corresponds to the order in which each access device is selected, and the first sequence numbers corresponding to a1 are 2 and 5, respectively, the first sequence numbers of a2 are 1, 3, and 5, respectively, the first sequence numbers of a3 are 2 and 3, respectively, and the first sequence numbers of a4 are 4 and 5, respectively.

[0085] Then each access device will randomly add the first sequence number to the random position of the factory authorization code. It should be noted that no matter how many first sequence numbers an access device corresponds to, only one is added each time and sent to a random number of mapping relationships.

[0086] If there are four mobile terminals, b1, b2, b3, and b4, then taking a1 as an example, the factory authorization code of a1 is 1234, then the first first sequence number is added to obtain 12234, and sent to the mapping relationship corresponding to the two mobile terminals b1b4, then the mapping relationship between b1b4 and a1 is changed from 1234 to 12234. At the same time, the second first sequence number is added again to obtain 122354, and updated to the mapping relationship corresponding to the two mobile terminals b3b4, then the mapping relationship between b3 and a1 is updated from 1234 to 122354, and the mapping relationship between b4 and a1 is updated from 12234 to 122354.

[0087] In this way, after frequent updates, the authorization codes stored in the mapping relationship between different mobile terminals and different access devices will be updated to different degrees, and their numerical values ​​and numerical lengths may be different.

[0088] The mobile terminals are selected in sequence through the second pre-authorization order, and a second sequence number is generated according to the order in which the mobile terminals are selected, and the second sequence number is randomly added to a random position in a number of factory authorization codes in the current mapping relationship to generate a real-time authorization code.

[0089] Secondly, the mobile terminals are selected in sequence through a randomly generated second pre-authorization order, wherein the order in which each mobile terminal is selected is random, and the number of mobile terminals selected each time is also random. For example, the four mobile terminals b1, b2, b3, and b4 in the above example are selected according to the randomly generated second pre-authorization order, and the selected objects are b1b2, b1, b2b4, b2b3b4 in order. Then the second sequence number corresponds to the order in which the mobile terminals are selected. The second sequence number corresponding to b1 is 1 and 2, the second sequence number corresponding to b2 is 1, 3, and 4, the second sequence number corresponding to b3 is 4, and the second sequence number corresponding to b4 is 3 and 4.

[0090] Then each mobile terminal randomly adds the second sequence number to the random position of the factory authorization code. It should be noted that no matter how many second sequence numbers a mobile terminal corresponds to, only one is added each time and sent to the mapping relationship of the random number.

[0091] As in the above example, b4 first obtains its current authorization code, which is 122354, and randomly adds the first second sequence number to a certain position to obtain 1232354, and updates it to the mapping relationship between a1 and a3, and then randomly adds the second second sequence number to a certain position to obtain 14232354 to update it to the mapping relationship of a2.

[0092] In this way, through frequent updates, the authorization codes in the mapping relationship between different mobile terminals and different access devices can be updated again, and the new authorization code obtained after each update serves as a unique real-time authorization code for each access device and each mobile terminal.

[0093] The first sequence number and the second sequence number together constitute a number set.

[0094] At the same time, all the sequence numbers that change in the mapping relationship between each mobile terminal corresponding to each access device are integrated to obtain a number set. The integration order is obtained in the form of the first sequence number + the second sequence number. For example, the number set corresponding to the mapping relationship between a1 and b4 mentioned above is: {2, 5, 3, 4}.

[0095] In some other embodiments, the online authorization server is further configured to:

[0096] When the factory authorization code is repeatedly selected based on the first pre-authorization sequence or the second pre-authorization sequence, if the length of the current real-time authorization code exceeds the preset length, the real-time authorization code is reset. The reset is characterized by deleting all the first sequence numbers and / or second sequence numbers currently existing in the real-time authorization code and modifying the value of the factory authorization code.

[0097] The authorization code in a mapping relationship can continuously add the first sequence number and / or the second sequence number based on the repeated selection of its corresponding mobile terminal and / or access device. Then, as the number of selections increases, the length of the real-time authorization code will also increase.

[0098] The real-time authorization code is the basis for authorization verification. The longer the authorization code is, the more time and processing it will take for subsequent verification. Therefore, in order to reduce the verification workload and time on the one hand, and to save storage space on the other hand, when the length of the real-time authorization code exceeds the preset length, the real-time authorization code needs to be reset to reselect and update the authorization order.

[0099] When being reset, all first sequence numbers and / or second sequence numbers existing in the current real-time authorization code need to be deleted, and the value of the factory authorization code needs to be modified, so that after a complete authorization code change, the next round of adjustments can be made based on the new factory authorization code.

[0100] Simply, you can also directly delete the current real-time authorization code and randomly generate a new factory authorization code.

[0101] When the real-time authorization code is reset, the set of numbers that the real-time authorization code matches is deleted.

[0102] At the same time, when the real-time authorization code is reset, all the currently existing sequence numbers are deleted, so the number set corresponding to the real-time authorization code will also be deleted, and a new number set will be generated in real time as the new authorization code is updated.

[0103] In some other embodiments, the authorization module is specifically used to:

[0104] Get the Bluetooth identity information of the responding mobile terminal and determine whether it belongs to the identity pool.

[0105] The access device uses Bluetooth broadcasting to determine whether there is a responding mobile terminal. The response is characterized by the presence of a Bluetooth device with Bluetooth turned on and capable of handshaking within the Bluetooth broadcast range. When there is a response, it is determined whether the Bluetooth identity information in the responding mobile terminal belongs to the identity pool. If so, the subsequent steps are performed. If not, the device is ignored.

[0106] This step can be used to preliminarily screen out irrelevant mobile devices that are not in the identity pool and can be authorized with Bluetooth. The basis for subsequent Bluetooth authorization is the mobile devices connected to the system.

[0107] If so, the mobile terminal obtains a unique device code corresponding to the selected target device and pairs it with the broadcast information in the Bluetooth broadcast to achieve pre-connection.

[0108] If it belongs to the identity pool, the mobile terminal pairs the broadcast information with the unique device code of the selected target device to be connected. The unique device code can be generated by the user entering it on the mobile terminal or by scanning the QR code, barcode, etc. on the access device. The unique device code is the information that each access device has specifically for representing its own identity, which is different from the authorization code.

[0109] Based on the target device selected by the mobile terminal, the corresponding real-time authorization code is searched in all corresponding mapping relationships, and it is determined whether there is a fragment match with the factory authorization code of the currently pre-connected access device;

[0110] After pre-connection, the mobile terminal first obtains the corresponding real-time authorization code from the mapping relationship corresponding to the selected target device, and obtains whether the factory authorization code of the pre-connected access device matches the real-time authorization code.

[0111] If they match, it means that the identity authentication of the current pre-connected device and the selected target device is passed. If they do not match, it means that the current pre-connected device is not the selected target device, and the pre-connection is disconnected.

[0112] The fragment matching method is to split the factory authorization code and map it to the real-time authorization code in the order of the fields to determine whether all the fields are matched.

[0113] If so, traverse the real-time authorization code to determine whether there are all fields that match the number set stored in the access device;

[0114] Secondly, first ignore the fields on the real-time authorization code that have been successfully matched with the factory authorization code, and traverse the remaining fields to see if all the fields stored in the number set exist. If all exist, it means that the authorization verification is successful. If not, it is determined to be a non-authorized mobile terminal. At this time, the pre-connection is disconnected and the Bluetooth identity information of the mobile terminal is marked to prohibit the mobile terminal from making authorization attempts again in the future. At the same time, an alarm message is generated and sent to the management end.

[0115] In this way, when the factory authorization code of each access device is stolen or leaked, it can be verified through the sequence number that is updated in real time and stored on an independent server. The thief cannot obtain the real-time changing and randomly generated sequence number and cannot carry out authorization attacks.

[0116] If all fields exist, the match is successful and authorization is completed.

[0117] In some other embodiments, the authorization module is specifically used to:

[0118] After the access device authorizes the mobile terminal, all factory authorization codes issued by the access device in the history are recovered to interrupt the mapping relationship with all other mobile terminals and instruct the access device to remain silent.

[0119] When an access device authorizes a mobile terminal, the access device enters a silent state. In the silent state, the access device stops Bluetooth broadcasting and does not accept connection requests from other mobile terminals.

[0120] At the same time, the access device will recycle all factory authorization codes issued to other mobile terminals in the past except the currently authorized mobile terminal and terminate the mapping relationship with other mobile terminals, so that other mobile terminals can no longer try to authorize or connect to the access device through any authorization code.

[0121] When the authorization of the current mobile terminal is canceled, the control access device re-sends the factory authorization code to the identity pool to end the silence.

[0122] When the authorization between the access device and the currently connected mobile terminal is cancelled, the access device can restore the mapping relationship with all mobile terminals in the identity pool and start Bluetooth broadcasting at the same time.

[0123] In this way, each access device is only allowed to make an authorized connection based on one primary mobile terminal at a time. However, it should be noted that when the mobile terminal shares the authorization to other secondary mobile terminals, because the secondary mobile terminal is subordinate to the corresponding primary mobile terminal and the real-time authorization code it obtains is shared by the primary mobile terminal, the secondary mobile terminal corresponding to the mobile terminal currently obtaining the authorization can obtain the authorization of the access device together with the primary mobile terminal.

[0124] In other embodiments, the secondary proxy module is used to generate several identity trees in the identity pool, each identity tree has a trunk node and several branch nodes connected by an identity chain, the trunk node is used to store the Bluetooth identity information of each mobile terminal, and the branch node is used to store the Bluetooth identity information corresponding to the secondary mobile terminal associated with each mobile terminal, and all real-time authorization codes corresponding to the trunk node are transmitted to each branch node through the identity chain.

[0125] The secondary proxy module generates several identity trees in the identity pool. The identity trees include a trunk and several branches, and the trunk and the branches are connected by identity chains.

[0126] The trunk part corresponds to the Bluetooth identity information corresponding to each mobile terminal that initially accesses the identity pool. When a mobile terminal in the identity pool acts as a secondary agent and needs to share the real-time authorization code with other mobile terminals, the shared mobile terminal is defined as a secondary mobile terminal and added to the branch corresponding to the mobile terminal, and the real-time authorization code that needs to be shared will be transmitted in the identity chain.

[0127] It should be noted that in order to ensure security and privacy, a trunk node is only allowed to generate three branch nodes at most. At the same time, different trunk nodes are not allowed to contain branch nodes with the same storage content, and the next level of branch nodes are not allowed to be generated on the branch nodes.

[0128] In some other embodiments, the encryption module is specifically used to:

[0129] A basic segment, a time segment, a location segment, and an object segment are generated respectively based on the real-time authorization code.

[0130] The basic segment is represented by the field corresponding to the factory authorization code, such as "0000", "1234", etc.

[0131] The time segment is characterized by a generation time field corresponding to the first sequence number and / or the second sequence number. For example, if the first generation first sequence number is 3, then 3 corresponds to a time field.

[0132] The position fragment is characterized by the position field of the first sequence number and / or the second sequence number in the real-time authorization code. For example, if the position of the first sequence number in the current real-time authorization code is the 4th position, then 4 corresponds to the position fragment.

[0133] The object fragment is represented by a data field corresponding to the corresponding field indicating the number of times the issued object is selected. For example, when the number of times the access device is selected to generate the first sequence number is 3, a "3" field is generated.

[0134] An encryption scheme containing one or more encryption instructions is randomly selected, and based on the encryption scheme, the selected basic fragment, time fragment, location fragment and / or object fragment are combined to obtain a key fragment, wherein the fragments selected by the multiple encryption instructions are arranged in sequence according to the response order of the encryption instructions.

[0135] Each time Bluetooth data is transmitted, one or more encryption instructions are randomly selected to obtain an encryption scheme, and the corresponding field combination is selected as a key segment. For example, in the access device a1 and the mobile terminal b1, the factory authorization code is 0000, and the first sequence numbers generated are 3 and 8, and the second sequence numbers generated are 1 and 5, respectively. The final generated real-time authorization code is 10035080. If the selected encryption scheme includes position fragments and object fragments, the corresponding key segment is the position number of the first sequence number - the position number of the second sequence number - the number of times the access device is selected - the number of times the mobile terminal is selected, and the specific key segment is 471522.

[0136] The update times of the real-time authorization code are obtained, and a random number is added to the update times to obtain an encryption extension code, and the encryption extension code is added to the key segment to generate a key, wherein the update times include the times the first sequence number and the second sequence number are added and the times the real-time authorization code is reset.

[0137] First, obtain the number of times the real-time authorization code is updated. For example, a real-time authorization code is obtained by updating the factory authorization code 8 times, and a reset is performed in the middle, so the number of updates is 9. The randomly generated random number can be any number from 0 to 9, such as 6, then the encryption extension code is 96. Finally, add the encryption extension code to the key segment given in the above example to obtain the key 47152296.

[0138] After obtaining the key, the transmitted data can be encrypted using an encryption algorithm such as AES to obtain ciphertext. At the same time, the key is sent to the other side and the ciphertext is decrypted using the same symmetric key to obtain plaintext.

[0139] Whenever new communication data is acquired, the encryption scheme is updated.

[0140] In other embodiments, a double encryption module is also included in the access device, which is used to determine whether the communication data encrypted by the encryption module sent by the mobile terminal is sensitive data after the access device obtains the communication data. If so, the communication data is encrypted again and stored or uploaded.

[0141] There is also a double encryption module inside the access device, which is used to store or upload the data encrypted once on the mobile terminal after it corresponds to sensitive data. The encryption method at this time can use the above encryption method or the traditional hash encryption method, so that more important data such as recharge data and refund data can be encrypted twice with the authorization code, increasing the security of communication data.

[0142] The embodiment of the present application also discloses a Bluetooth-based automatic encryption authorization method, which is implemented based on the above-mentioned system.

[0143] A storage medium is also disclosed in an embodiment of the present application, which stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the above method.

[0144] The implementation principle is:

[0145] The Bluetooth identity information of all access devices and accessed mobile terminals is stored in the corresponding data pool in advance, and the factory authorization code of each access device is used as the basis for the association of the two objects. Different mobile terminals and access devices are selected in random order to generate different sequence numbers to adjust the factory authorization code in real time through the sequence number. In this way, there can be a unique and identifiable real-time authorization code between different mobile terminal individuals and different access device individuals. The real-time authorization code is sent to the mobile terminal, and the number set of the change record is sent to the access device, so that the identity and authorization consistency of the two are verified respectively through the real-time authorization code and the number set to complete the authorization verification, so that users can achieve automatic authorization without manual operation;

[0146] The authorization process is secure, and through the secondary agent, the authorized mobile terminal can share the authorization with other mobile terminals recognized by it to complete the authorization.

[0147] At the same time, the encryption key in the communication data transmission is dynamically generated through the real-time authorization code that changes in real time, so that the authorization and encryption processes are associated, the communication process is more secure and the encryption key can be automatically updated and privatized.

[0148] It should be understood that although the steps in the flowchart of the accompanying drawings are shown in sequence according to the instructions of the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise clearly stated in this document, the execution of these steps is not strictly limited in order and can be performed in other orders.

[0149] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. An automatic encryption authorization system based on Bluetooth, characterized in that: include: The identity pool is used to obtain access requests, and based on the access requests, obtain the Bluetooth identity information of the mobile terminal to be accessed and store it regularly; A device pool, used to store device information of access devices and obtain factory authorization codes of each access device; The online authorization server is connected to the identity pool and the device pool via HTTPS, and is used to generate a first pre-authorization sequence and a second pre-authorization sequence, and respectively add a first sequence number and a second sequence number to the factory authorization code through the first pre-authorization sequence and the second pre-authorization sequence to obtain a real-time authorization code. Specifically, Generate an independent mapping relationship between each of the mobile terminals and each of the access devices, wherein the mapping relationship is used to store the factory authorization code that changes in real time; The access devices are selected in sequence according to the first pre-authorization sequence, and the first sequence number is generated according to the sequence in which the access devices are selected to be added to the random position of the factory authorization code thereof and randomly updated to the mapping relationship of the plurality of mobile terminals; Selecting the mobile terminals in sequence according to the second pre-authorization order, generating the second sequence number according to the order in which the mobile terminals are selected, and randomly adding the second sequence number to a random position of the factory authorization code in a plurality of currently existing mapping relationships to generate the real-time authorization code; The first serial number and the second serial number together form a serial number set; The online authorization server sends the updated real-time authorization code to the identity pool, and integrates the first sequence number and the second sequence number into a number set and sends the set to the device pool; The authorization module is used to obtain the real-time authorization code currently stored in the Bluetooth identity information of the response and the number set currently stored on the access device for matching when the access device obtains the Bluetooth identity information response stored in the identity pool during Bluetooth broadcasting, and completes authorization for the mobile terminal when the match is successful. Specifically, Obtaining the Bluetooth identity information of the mobile terminal in response and determining whether it belongs to the identity pool; If so, obtaining a unique device code corresponding to the selected target device based on the mobile terminal and pairing it with the broadcast information in the Bluetooth broadcast to achieve pre-connection; Searching for the corresponding real-time authorization code in all the corresponding mapping relationships based on the target device selected by the mobile terminal, and determining whether there is a segment match with the factory authorization code of the currently pre-connected access device; If so, traversing the real-time authorization code to determine whether there are all fields that match the number set stored in the access device; If all fields exist, the match is successful and authorization is completed; A secondary proxy module, configured to obtain a proxy access request issued by the mobile terminal in the identity pool, and obtain the Bluetooth identity information corresponding to the secondary mobile terminal corresponding to the proxy access request to associate and store with the mobile terminal and share the real-time authorization code received by the mobile terminal; The encryption module selects any one or a combination of encryption instructions based on a preset encryption algorithm in combination with the real-time authorization code, and selects a fragment in the real-time authorization code in combination with an encryption extension code through the encryption instruction to generate a key, and encrypts the communication data between the mobile terminal and the access device through the key.

2. The Bluetooth-based automatic encryption authorization system according to claim 1, characterized in that: The online authorization server is further specifically used for: When the factory authorization code is repeatedly selected based on the first pre-authorization sequence or the second pre-authorization sequence, if the length of the current real-time authorization code exceeds a preset length, the real-time authorization code is reset, and the reset is characterized by deleting all the first sequence numbers and / or the second sequence numbers currently existing in the real-time authorization code and modifying the value of the factory authorization code; When the real-time authorization code is reset, the number set matched by the real-time authorization code is deleted.

3. The automatic encryption authorization system based on Bluetooth according to claim 1, characterized in that: The authorization module is specifically used for: After the access device authorizes the mobile terminal, all the factory authorization codes issued by the access device in the history are recycled to interrupt the mapping relationship with all other mobile terminals, and the access device is ordered to remain silent; When the current authorization of the mobile terminal is cancelled, the access device is controlled to re-send the factory authorization code to the identity pool to end silence.

4. The Bluetooth-based automatic encryption authorization system according to claim 1, characterized in that: The secondary proxy module is used to generate several identity trees in the identity pool, each of the identity trees has a trunk node and several branch nodes connected by an identity chain, the trunk node is used to store the Bluetooth identity information of each mobile terminal, and the branch node is used to store the Bluetooth identity information corresponding to the secondary mobile terminal associated with each mobile terminal, and all the real-time authorization codes corresponding to the trunk node are transmitted to each branch node through the identity chain.

5. The Bluetooth-based automatic encryption authorization system according to claim 1, characterized in that: The encryption module is specifically used for: Based on the real-time authorization code, a basic segment, a time segment, a location segment and an object segment are respectively generated, wherein the basic segment is represented by a field corresponding to the factory authorization code, the time segment is represented by a generation time field corresponding to the first sequence number and / or the second sequence number, the location segment is represented by a location field of the first sequence number and / or the second sequence number in the real-time authorization code, and the object segment is represented by a data field corresponding to the corresponding field indicating the number of times the issued object is selected; randomly selecting an encryption scheme including one or more of the encryption instructions, and combining the selected basis segments, time segments, location segments and / or object segments based on the encryption scheme to obtain a key segment; Obtaining the update times of the real-time authorization code, adding a random number to the update times to obtain an encryption extension code, and adding the encryption extension code to the key segment to generate a key, wherein the update times include the addition times of the first sequence number and the second sequence number and the reset times of the real-time authorization code; The encryption scheme is updated every time new communication data is acquired.

6. The Bluetooth-based automatic encryption authorization system according to claim 1, characterized in that: It also includes a double encryption module stored in the access device, which is used to determine whether the communication data encrypted by the encryption module sent by the mobile terminal is sensitive data after the access device obtains the communication data. If so, the communication data is encrypted again and stored or uploaded.

7. A Bluetooth-based automatic encryption authorization method, characterized in that: Based on the system as described in any one of claims 1 to 6, the following steps are implemented: Obtaining an access request, and based on the access request, obtaining Bluetooth identity information of a mobile terminal to be accessed and storing it periodically to construct an identity pool; Storing device information of access devices and obtaining factory authorization codes of each access device to build a device pool; Connecting with the identity pool and the device pool through HTTPS, generating a first pre-authorization sequence and a second pre-authorization sequence, and respectively adding a first sequence number and a second sequence number to the factory authorization code through the first pre-authorization sequence and the second pre-authorization sequence to obtain a real-time authorization code, specifically, Generate an independent mapping relationship between each of the mobile terminals and each of the access devices, wherein the mapping relationship is used to store the factory authorization code that changes in real time; The access devices are selected in sequence according to the first pre-authorization sequence, and the first sequence number is generated according to the sequence in which the access devices are selected to be added to the random position of the factory authorization code thereof and randomly updated to the mapping relationship of the plurality of mobile terminals; Selecting the mobile terminals in sequence according to the second pre-authorization order, generating the second sequence number according to the order in which the mobile terminals are selected, and randomly adding the second sequence number to a random position of the factory authorization code in a plurality of currently existing mapping relationships to generate the real-time authorization code; The first sequence number and the second sequence number together constitute the number set; The online authorization server sends the updated real-time authorization code to the identity pool, and integrates the first sequence number and the second sequence number into a number set and sends the number set to the device pool; When the access device obtains the Bluetooth identity information response stored in the identity pool during Bluetooth broadcasting, the real-time authorization code currently stored in the Bluetooth identity information of the response and the number set currently stored on the access device are obtained for matching, and authorization is completed for the mobile terminal when the matching is successful. Specifically, Obtaining the Bluetooth identity information of the mobile terminal in response and determining whether it belongs to the identity pool; If so, obtaining a unique device code corresponding to the selected target device based on the mobile terminal and pairing it with the broadcast information in the Bluetooth broadcast to achieve pre-connection; Searching for the corresponding real-time authorization code in all the corresponding mapping relationships based on the target device selected by the mobile terminal, and determining whether there is a segment match with the factory authorization code of the currently pre-connected access device; If so, traversing the real-time authorization code to determine whether there are all fields that match the number set stored in the access device; If all fields exist, the match is successful and authorization is completed; Used to obtain a proxy access request issued by the mobile terminal in the identity pool, and obtain the Bluetooth identity information corresponding to the secondary mobile terminal corresponding to the proxy access request to associate with the mobile terminal to store and share the real-time authorization code received by the mobile terminal; Based on a preset encryption algorithm, any one or a combination of encryption instructions is selected in combination with the real-time authorization code, and a fragment in the real-time authorization code is selected through the encryption instruction in combination with an encryption extension code to generate a key, and the communication data between the mobile terminal and the access device is encrypted through the key.

8. A storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method according to claim 7.

Images