Bluetooth communication method, system and computer program product

Abstract

The invention provides a Bluetooth communication method and system and a computer program product, and relates to the technical field of communication. The Bluetooth communication method comprises the following steps: establishing a connection with a second terminal device; a random number is exchanged with the second terminal device, a target material used for Bluetooth communication is negotiated with the second terminal device, and the target material comprises a target authentication mode; performing authentication with the second terminal device based on the random number and a target material determined by negotiation with the second terminal device, and generating a first session key; and when the authentication is passed, performing encrypted communication with the second terminal device based on the first session key.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a Bluetooth communication method, system and computer program product. Background Art

[0002] Nowadays, more and more household devices with integrated Bluetooth functions are appearing in people's lives, such as smart door locks, smart sockets, smart table lamps, etc. These smart devices can be connected and controlled through applications (Apps) in mobile phones or other terminal devices, and can communicate through Bluetooth technology. Although Bluetooth communication can achieve fast connection between devices, the subsequent communication messages are transmitted in plain text, which poses a security risk. In response to this problem, some manufacturers use private encryption methods to encrypt communication data, but usually use a fixed key method, which has the risk of being cracked and is not very secure.

[0003] In view of this, some embodiments of the present specification provide a Bluetooth communication method, system and computer program product, aiming to improve the security of Bluetooth communication. Summary of the invention

[0004] One or more embodiments of the present specification provide a Bluetooth communication method, which is applied to a first terminal device, and the method includes: establishing a connection with a second terminal device; exchanging random numbers with the second terminal device, and negotiating with the second terminal device the target material used for Bluetooth communication, the target material including a target authentication method; authenticating with the second terminal device based on the random number and the target material determined through negotiation with the second terminal device and generating a first session key; when the authentication is successful, performing encrypted communication with the second terminal device based on the first session key.

[0005] According to the method provided by one or more embodiments of the present specification, exchanging random numbers with a second terminal device and negotiating with the second terminal device a target material used for Bluetooth communication includes: generating a first random number, and sending a key negotiation request containing the first random number and candidate materials to the second terminal device, the key negotiation request being used to instruct the second terminal device to exchange random numbers and confirm target materials from the candidate materials; receiving a key negotiation response sent by the second terminal device, the key negotiation response containing a second random number and target material generated by the second terminal device.

[0006] According to the method provided in one or more embodiments of the present specification, authentication is performed with the second terminal device based on a random number and a target material determined by negotiation with the second terminal device and a first session key is generated, including: generating a key authentication request and a first session key based on the first random number, the second random number and the target material, and sending the key authentication request to the second terminal device, the key authentication request being used to instruct the second terminal device to authenticate the key authentication request, and generating a key authentication response when the authentication is successful.

[0007] According to the method provided by one or more embodiments of the present specification, the target material also includes a target verification algorithm confirmed from the candidate material; a key authentication request and a first session key are generated based on the first random number, the second random number and the target material, including: generating a first session key based on the first random number, the second random number and the target verification algorithm; generating a key authentication request based on the first random number, the second random number and the target authentication method.

[0008] According to the method provided by one or more embodiments of the present specification, the target material also includes a target signature algorithm confirmed from the candidate material; a key authentication request is generated based on the first random number, the second random number and the target authentication method, including: signing the first random number and the second random number based on the target signature algorithm and the target authentication method to generate a key authentication request containing a digital signature.

[0009] According to the method provided by one or more embodiments of the present specification, the target material also includes a target encryption algorithm confirmed from the candidate material; when the authentication is successful, encrypted communication is performed with the second terminal device based on the first session key, including: receiving a key authentication response sent by the second terminal device to indicate that the authentication is successful, the key authentication response includes a session identifier generated by the second terminal device; encrypting the session identifier and communication data based on the first session key and the target encryption algorithm, and communicating with the second terminal device based on the encrypted session identifier and the encrypted communication data.

[0010] The method provided according to one or more embodiments of the present specification further includes: periodically updating the first session key based on the validity period corresponding to the first session key, and re-authenticating with the second terminal device.

[0011] According to the method provided by one or more embodiments of the present specification, the first session key is periodically updated based on the validity period corresponding to the first session key, and re-authentication is performed with the second terminal device, including: receiving a quick authentication request sent by the second terminal device, the quick authentication request is generated when the validity period expires, and the quick authentication request includes an updated second random number of the second terminal device and an updated target material; generating a quick authentication response and a new first session key based on the updated second random number and the updated target material, and sending the quick authentication response to the second terminal device, the quick authentication response is used to instruct the second terminal device to authenticate the quick authentication response; when the authentication is successful, communicating with the second terminal device based on the new first session key.

[0012] One or more embodiments of the present specification provide a Bluetooth communication method, which is applied to a second terminal device to establish a connection with a first terminal device; exchange random numbers with the first terminal device, and negotiate with the first terminal device the target material used for Bluetooth communication, the target material including a target authentication method; authenticate with the first terminal device based on the random number and the target material determined through negotiation with the first terminal device and generate a second session key; when the authentication is successful, perform encrypted communication with the first terminal device based on the second session key.

[0013] According to the method provided by one or more embodiments of the present specification, exchanging random numbers with a first terminal device and negotiating with the first terminal device a target material used for Bluetooth communication, includes: receiving a key negotiation request sent by the first terminal device, the key negotiation request including a first random number and candidate materials generated by the first terminal device; generating a second random number and confirming the target material from the candidate materials, and sending a key negotiation response including the second random number and the target material to the first terminal device.

[0014] According to the method provided by one or more embodiments of the present specification, authentication is performed with the first terminal device based on a random number and a target material determined through negotiation with the first terminal device and a second session key is generated, including: receiving a key authentication request sent by the first terminal device, wherein the key authentication request is generated based on a first random number, a second random number and the target material; authenticating the key authentication request based on the first random number, the second random number and the target material and generating a second session key; and sending a key authentication response to the first terminal device when the authentication is successful.

[0015] The method provided according to one or more embodiments of the present specification further includes: periodically updating the second session key based on the validity period corresponding to the second session key, and re-authenticating with the first terminal device.

[0016] According to the method provided by one or more embodiments of the present specification, the second session key is periodically updated based on the validity period corresponding to the second session key, and re-authentication is performed with the first terminal device, including: regenerating the second random number and updating the target material when the validity period expires, sending a quick authentication request including the updated second random number and the updated target material to the first terminal device, the quick authentication request being used to instruct the first terminal device to generate a quick authentication response based on the updated second random number and the updated target material; receiving the quick authentication response sent by the first terminal device, and authenticating the quick authentication response based on the updated second random number and the updated target material; and communicating with the first terminal device based on the new second session key when the authentication is successful.

[0017] One or more embodiments of the present specification also provide a Bluetooth communication system, the system comprising: a connection module, used to establish a connection with other terminal devices; a negotiation module, used to exchange random numbers with other terminal devices, and negotiate with other terminal devices on target materials used for Bluetooth communication, the target materials including a target authentication method; an authentication module, used to authenticate with other terminal devices based on random numbers and target materials determined through negotiation with other terminal devices and generate a session key; and a communication module, used to perform encrypted communication with other terminal devices based on the session key when the authentication is successful.

[0018] One or more embodiments of the present specification further provide a computer program product, including a computer program, which, when at least a portion of the computer program is executed by a processor, can implement the Bluetooth communication method described in some embodiments of the present specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] This specification will be further explained by way of exemplary embodiments, which will be described in detail by way of the accompanying drawings. The same numbers in the drawings represent the same structures or steps.

[0020] Figure 1 This is an exemplary flow chart of a Bluetooth communication method according to some embodiments of this specification.

[0021] Figure 2 This is an exemplary flow chart of a re-authentication method according to some embodiments of this specification.

[0022] Figure 3 It is an exemplary flow chart of another Bluetooth communication method shown in some embodiments of this specification.

[0023] Figure 4 This is an exemplary flow chart of another re-authentication method shown in some embodiments of this specification.

[0024] Figure 5 It is an exemplary flow chart of another Bluetooth communication method shown in some embodiments of this specification.

[0025] Figure 6 It is an exemplary block diagram of a Bluetooth communication system according to some embodiments of this specification.

[0026] Figure 7 It is an exemplary block diagram of another Bluetooth communication system shown in some embodiments of this specification. DETAILED DESCRIPTION

[0027] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the embodiments will be described in detail below with reference to the accompanying drawings. Obviously, the contents described below are some examples or embodiments of this specification. For ordinary technicians in this field, without paying creative work, the technical solutions or means disclosed in this specification can also be applied to other scenarios based on these technical contents.

[0028] It should be understood that the "system", "device", "unit" and / or "module" used in this specification is a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, if other words can achieve the same purpose, the words can be replaced by other expressions.

[0029] Unless otherwise specified, technical terms used in this specification to describe components, elements, etc. do not refer to the singular, but may also include the plural. Generally speaking, terms such as "include", "comprise", etc. only indicate that the steps, elements, or components that have been clearly identified are included, and these steps, elements, and components do not constitute an exclusive list, such as the method or device described may also include other steps or components.

[0030] Flowcharts are used in this specification to illustrate the operation steps performed by the device or system of the relevant embodiments, but unless otherwise specified, the order used to describe these steps should not be understood as a limitation on the order in which the steps are performed. A person of ordinary skill in the art can adjust the order in which these steps are performed based on the knowledge and information conveyed by the embodiments of this specification, and the adjustment includes but is not limited to swapping the order, merging multiple steps, and splitting a certain step.

[0031] Bluetooth is a short-range wireless communication technology used to exchange data between devices. Bluetooth technology usually uses the 2.4GHz ISM band for communication and allows devices to communicate with each other without a direct connection. Bluetooth technology can support multiple pairing modes, such as Passkey Entry mode, Numeric Comparison mode, Out of Band (OOB) mode, and Just Works mode. The first three pairing modes usually require user intervention. For example, in Passkey Entry mode, the user needs to enter the pairing code on the device to pair, the Numeric Comparison mode requires the user to confirm whether the numbers displayed on the two devices are consistent, and the OOB mode requires the user to interact through other devices (such as the NFC function of the mobile phone). The Just Works mode does not require user intervention, and devices can be quickly paired without a password, thereby simplifying the pairing process and allowing devices to quickly establish a connection. Bluetooth technology can also include multiple technical modes, such as Classic Bluetooth and Bluetooth Low Energy (BLE). Classic Bluetooth can support continuous, high-bandwidth data streams, such as audio streams or files transmitted by Bluetooth headsets and car audio systems. Compared with Classic Bluetooth, Bluetooth Low Energy has lower power consumption and smaller transmission data packets. It can quickly establish a connection, transmit a small amount of data, and then quickly disconnect to save energy. It can be applied to devices that need to run for a long time and are sensitive to power consumption, such as smart home devices, wearable devices, etc.

[0032] Bluetooth technology can be widely used in scenarios such as wireless audio transmission, smart home control, vehicle-mounted equipment control, and wearable devices. Taking smart home control as an example, more and more household devices with integrated Bluetooth functions are now appearing in people's lives, such as smart door locks, smart sockets, smart desk lamps, etc. These smart devices can be connected and controlled through applications (Apps) in mobile phones or other terminal devices, and can communicate through Bluetooth technology. Although Bluetooth communication can achieve fast connection between devices, subsequent communication messages are transmitted in plain text, which poses a security risk. In response to this problem, some manufacturers use private encryption methods to encrypt communication data, but usually use a fixed key method, which has the risk of being cracked and is not very secure.

[0033] Some embodiments of the present specification propose a Bluetooth communication method, which is applied to a first terminal device, by establishing a connection with a second terminal device, exchanging random numbers with the second terminal device, and negotiating with the second terminal device the target material used for Bluetooth communication, authenticating with the second terminal device based on the random number and the target material determined through negotiation with the second terminal device and generating a first session key, and when the authentication is successful, performing encrypted communication with the second terminal device based on the first session key, thereby customarily negotiating the target material to be used before data communication, and then dynamically performing authentication and generating the first session key, thereby effectively improving the security of Bluetooth communication.

[0034] Figure 1 This is an exemplary flow chart of a Bluetooth communication method according to some embodiments of this specification. Figure 1 The process 100 shown can be executed by the first terminal device, for example, it can be implemented by the Bluetooth communication system 600 deployed on the first terminal device. In some embodiments, the first terminal device can be a control terminal supporting Bluetooth communication, such as a desktop computer, a laptop computer, a mobile phone, and a tablet computer. Figure 1 As shown, process 100 may include the following steps.

[0035] Step 110 , establishing a connection with a second terminal device. In some embodiments, step 110 may be implemented by the first connection module 610 in the Bluetooth communication system 600 .

[0036] In some embodiments, the second terminal device may be a Bluetooth device, such as a smart door lock, smart socket, smart desk lamp, etc. that supports Bluetooth communication. The technology mode used by the second terminal device may be classic Bluetooth or low-power Bluetooth.

[0037] In some embodiments, the first terminal device can establish a connection with the second terminal device based on the Just Works mode. For example, the second terminal device can turn on the Bluetooth function to broadcast, so as to allow the surrounding terminal devices supporting Bluetooth communication to discover the second terminal device, the first terminal device turns on the Bluetooth function and searches for nearby Bluetooth devices, the first terminal device selects the second terminal device in the search results and establishes a connection with the second terminal device, so that the connection between the first terminal device and the second terminal device can be quickly established without the user entering a password.

[0038] Step 120 , exchanging random numbers with the second terminal device, and negotiating with the second terminal device the target material used for Bluetooth communication. In some embodiments, step 120 may be implemented by the first negotiation module 620 in the Bluetooth communication system 600 .

[0039] In some embodiments, the first terminal device may generate a first random number and send a key agreement request including the first random number and the candidate material to the second terminal device.

[0040] In some embodiments, the first terminal device may generate a first random number of preset bytes through a random number generator. The length of the first random number may affect the security of Bluetooth communication. Generally speaking, the longer the length of the first random number, the higher the security of Bluetooth communication.

[0041] In some embodiments, the candidate materials may include more than one candidate authentication method, and the authentication method is used to authenticate the terminal device performing Bluetooth communication, and Bluetooth communication is allowed when the authentication is passed. The authentication method may include, for example, password authentication, digital certificate authentication, device hardware code authentication, etc. Exemplarily, password authentication may be based on a preset password, and the preset password may be a shared password pre-set in the first terminal device and the second terminal device. Digital certificate authentication may be based on a preset digital certificate, and the preset digital certificate may be a shared digital certificate pre-set in the first terminal device and the second terminal device. The device hardware code may be a code or serial number used to identify the first terminal device or the second terminal device.

[0042] In some embodiments, the candidate material may also include one or more candidate encryption algorithms for encrypting data to improve the security of transmitted data. Exemplarily, the encryption algorithm may be a symmetric encryption algorithm, such as AES, DES, SM4, etc.

[0043] In some embodiments, the candidate material may also include one or more candidate signature algorithms for generating a digital signature to verify the identity of the sender. In some embodiments, the signature algorithm may be a hash algorithm, which is a mathematical function that maps input data of any length to output data of a fixed length (called a hash value or message digest), such as MD5, SHA, SM3, etc. Exemplarily, a hash value may be calculated using a hash algorithm and used as a digital signature; for example, a hash value may be calculated using a hash algorithm and the hash value may be encrypted using a first session key to generate a digital signature. In other embodiments, the signature algorithm may also be other symmetric key signature algorithms or asymmetric key signature algorithms, such as HMAC, RSA, DSA, ECDSA, etc. Exemplarily, a hash value may be calculated using a hash algorithm and the hash value may be encrypted based on a symmetric key signature algorithm or an asymmetric key signature algorithm to generate a digital signature.

[0044] In some embodiments, the candidate material may also include more than one candidate verification algorithm for calculating the first session key. In some embodiments, the verification algorithm may be a hash algorithm. Exemplarily, the verification algorithm may be MD5, SHA, SM3, etc.

[0045] In some embodiments, the key negotiation request may be sent in the form of a message. Exemplarily, the structure of the message may include a fixed header, a payload, and a check value. Among them, the payload may include specific message content, such as a first random number and a candidate material. The check value is used to verify whether the message has been tampered with or an error has occurred during the transmission process. The fixed header may include basic data of the message for identifying and managing the message. Exemplarily, the fixed header may include the ID of the receiver and the sender, a sequence number, a message type, a payload length, etc. The ID of the receiver and the sender may be, for example, a device identifier of the first terminal device and the second terminal device. The sequence number may be, for example, a unique sequence number for identifying the message. The message type may be, for example, a key negotiation request, a key negotiation response, etc. For example, the number 1 indicates that the message type is a key negotiation request. The payload length is used to determine the size of the payload. In some embodiments, the first terminal device may pre-configure the candidate material and the identifier corresponding to the candidate material. When sending a message of a key negotiation request to the second terminal device, the candidate material in the message may be the identifier of the candidate material.

[0046] In some embodiments, the key negotiation request is used to instruct the second terminal device to exchange random numbers and confirm the target material from the candidate materials. According to a certain example, the target material may include a target authentication method. According to another example, the target material may also include at least one of a target encryption algorithm, a target signature algorithm, and a target verification algorithm. Taking the confirmation of the target authentication method as an example, the key negotiation request may instruct the second terminal device to randomly determine one of the more than one candidate authentication methods sent by the first terminal device according to the authentication methods supported by itself as the target authentication method. The method for confirming the target encryption algorithm, the target signature algorithm, and the target verification algorithm is similar to the method for confirming the target authentication method, and will not be repeated here.

[0047] In some embodiments, after receiving the key negotiation request, the second terminal device may generate a second random number, confirm the target material from the candidate materials, and send a key negotiation response to the first terminal device. Further, the first terminal device may receive the key negotiation response sent by the second terminal device, and the key negotiation response includes the second random number generated by the second terminal device and the target material.

[0048] By negotiating with the second terminal device to determine the target material to be used before data communication with the second terminal device, the material to be used in this communication is dynamically negotiated, and authentication and data encryption are performed based on the dynamically negotiated material in the subsequent stage, effectively improving the security of Bluetooth communication. Since the material negotiation is performed at the application layer, the second terminal device can customize the protocol according to the algorithm or authentication method it supports, so that the first terminal device and the second terminal device can interact in a private scenario, enhancing the security of Bluetooth communication.

[0049] Step 130 , based on the random number and the target material determined by negotiation with the second terminal device, authentication is performed with the second terminal device and a first session key is generated. In some embodiments, step 130 may be implemented by the first authentication module 630 in the Bluetooth communication system 600 .

[0050] In some embodiments, after receiving the key negotiation response sent by the second terminal device, the first terminal device can generate a key authentication request and a first session key based on the first random number, the second random number and the target material, and send the key authentication request to the second terminal device. The specific method of generating the key authentication request and the first session key is described below.

[0051] Regarding the generation of the first session key, in some embodiments, when the target material includes a target authentication method confirmed from the candidate material, the first session key can be generated based on the first random number, the second random number and the target authentication method. Exemplarily, when the target authentication method is password authentication, the first random number, the second random number and the preset password corresponding to the password authentication method can be concatenated, and the concatenated values ​​can be hashed based on a preset authentication algorithm to obtain a hash value, which is used as the first session key. The preset authentication algorithm can be a shared authentication algorithm pre-configured in the first terminal device and the second terminal device, such as a hash algorithm (such as MD5, SHA, SM3, etc.) pre-configured in the first terminal device and the second terminal device.

[0052] In some embodiments, when the target material further includes a target verification algorithm confirmed from the candidate material, the first session key can also be generated based on the first random number, the second random number and the target verification algorithm. Exemplarily, the first random number can be concatenated with the second random number, and the concatenated random number can be hashed based on the target verification algorithm to obtain a hash value, which is used as the first session key. In other embodiments, the first session key can also be generated based on the first random number, the second random number, the target authentication method and the target verification algorithm. Exemplarily, when the target authentication method is password authentication, the first random number, the second random number and the preset password corresponding to the password authentication method can be concatenated, and the concatenated value can be hashed based on the target verification algorithm to obtain a hash value, which is used as the first session key.

[0053] In some embodiments, there are multiple ways to splice random numbers or splice random numbers with other values. For example, the values ​​of the preset positions in the first random number and the second random number can be spliced, or a preset password can be added between the first random number and the second random number, or the preset password can be inserted into the preset positions in the first random number and the second random number.

[0054] For generating a key authentication request, in some embodiments, a key authentication request can be generated based on a first random number, a second random number, and a target authentication method. Exemplarily, when the target authentication method is password authentication, the first random number, the second random number, and a preset password corresponding to the password authentication method can be concatenated to obtain a concatenated value, and the concatenated value is signed based on a preset signature algorithm to obtain a digital signature, and a key authentication request is generated based on the digital signature. The preset signature algorithm can be a shared signature algorithm pre-configured in the first terminal device and the second terminal device, such as a hash algorithm (such as MD5, SHA, SM3, etc.) pre-configured in the first terminal device and the second terminal device.

[0055] In some embodiments, when the target material further includes a target signature algorithm confirmed from the candidate material, the first random number and the second random number may be signed based on the target signature algorithm and the target authentication method to generate a key authentication request including a digital signature. Exemplarily, when the target authentication method is password authentication, the first random number, the second random number, and a preset password corresponding to the password authentication method may be concatenated to obtain a concatenated value, and the concatenated value may be signed based on the target signature algorithm to obtain a digital signature, and a key authentication request may be generated based on the digital signature.

[0056] In some embodiments, after obtaining the concatenated value, the concatenated value may be further encrypted based on the generated first session key to obtain the encrypted digital signature, and a key authentication request may be generated based on the encrypted digital signature.

[0057] In some embodiments, the key authentication request is used to instruct the second terminal device to authenticate the key authentication request and generate a key authentication response when the authentication is successful. Exemplarily, after receiving the key authentication request, the second terminal device can authenticate the key authentication request based on the first random number, the second random number and the confirmed target material and generate a second session key, and send a key authentication response to the first terminal device when the authentication is successful. The method by which the second terminal device authenticates the key authentication request can correspond to the method by which the first terminal device generates the key authentication request, and the method by which the second terminal device generates the second session key can correspond to the method by which the first terminal device generates the first session key.

[0058] Step 140 : When the authentication is successful, perform encrypted communication with the second terminal device based on the first session key. In some embodiments, step 140 may be implemented by the first communication module 640 in the Bluetooth communication system 600 .

[0059] In some embodiments, the first terminal device may receive a key authentication response sent by the second terminal device to indicate that the authentication is successful, and the key authentication response may include a session identifier generated by the second terminal device. Exemplarily, the session identifier may be a session ID randomly generated by the second terminal device. In subsequent communication processes, the data sent by the first terminal device and the second terminal device may both carry the session identifier to enhance the security of Bluetooth communication.

[0060] In some embodiments, when the target material includes a target encryption algorithm confirmed from the candidate material, the session identifier and communication data can also be encrypted based on the first session key and the target encryption algorithm, and communication can be performed with the second terminal device based on the encrypted session identifier and the encrypted communication data. Exemplarily, the first terminal device can encrypt the session identifier and communication data respectively by the target encryption algorithm and the calculated first session key, and send the encrypted session identifier and the encrypted communication data to the second terminal device; when receiving the communication content sent by the second terminal device, the communication content is decrypted by the target encryption algorithm and the calculated first session key, and the session identifier in the communication content is verified. When the verification is successful, a response can be made to the communication content sent by the second terminal device.

[0061] In order to further improve the security of Bluetooth communication, the first session key may be periodically updated based on the validity period, and re-authentication may be performed with the second terminal device. Figure 2 This is an exemplary flow chart of a re-authentication method according to some embodiments of this specification. Figure 2 The process 200 shown can be executed by the first terminal device, for example, can be implemented by the Bluetooth communication system 600 deployed on the first terminal device. Figure 2 As shown, process 200 may include the following steps.

[0062] Step 210 , receiving a fast authentication request sent by the second terminal device. In some embodiments, step 210 may be implemented by the first re-authentication module 650 .

[0063] In some embodiments, a quick authentication request is generated when a validity period expires. The validity period may be a preset period, for example, 30 seconds or 60 seconds. Exemplarily, after generating the second session key, the second terminal device may start calculating the validity period, and when the validity period expires, the second terminal device generates a quick authentication request.

[0064] In some embodiments, the quick authentication request includes the second random number updated by the second terminal device and the updated target material. Exemplarily, the second terminal device can regenerate the second random number when the validity period expires, re-confirm the target material from the candidate materials, and send the quick authentication request including the updated second random number and the updated target material to the first terminal device.

[0065] Step 220 , based on the updated second random number and the updated target material, generates a fast authentication response and a new first session key, and sends the fast authentication response to the second terminal device. In some embodiments, step 220 may be implemented by the first re-authentication module 650 .

[0066] In some embodiments, after receiving the fast authentication request, the first terminal device can recalculate a new first session key based on the updated second random number and the updated target material and generate a fast authentication response, and the fast authentication response is used to instruct the second terminal device to authenticate the fast authentication response. Exemplarily, the first terminal device can recalculate a new first session key based on the first random number, the updated second random number, and the updated target material and generate a fast authentication response. The description of generating a fast authentication response based on the first random number, the updated second random number, and the updated target material is similar to the description of generating a key authentication request based on the first random number, the second random number, and the target material in the previous text. The description of generating a new first session key based on the first random number, the updated second random number, and the updated target material is similar to the description of generating a first session key based on the first random number, the second random number, and the target material in the previous text. For details, please refer to the description in the previous step 120, which will not be repeated here.

[0067] Step 230 : When the authentication is successful, communicate with the second terminal device based on the new first session key. In some embodiments, step 230 may be implemented by the first communication module 640 .

[0068] In some embodiments, after receiving the quick authentication response, the second terminal device can authenticate the quick authentication response based on the first random number, the updated second random number, and the updated target material and recalculate a new second session key. When the authentication is passed, a new session identifier can be generated, and the new session identifier can be encrypted based on the new second session key and sent to the first terminal device. The first terminal device can decrypt the content sent by the second terminal device based on the new first session key to obtain a new session identifier, and in subsequent Bluetooth communication processes, perform encrypted communication with the second terminal device based on the new first session key and the new session identifier.

[0069] By periodically updating the first session key and reauthenticating with the second terminal device, the session key and target material used in the Bluetooth communication process can be dynamically updated to prevent the risk caused by the leakage of the first session key or target material, thereby further improving the security of Bluetooth communication.

[0070] Some embodiments of this specification also propose a Bluetooth communication method, which is applied to a second terminal device, by establishing a connection with a first terminal device, exchanging random numbers with the first terminal device, and negotiating with the first terminal device the target material used for Bluetooth communication, authenticating with the first terminal device based on the random number and the target material determined by negotiation with the first terminal device and generating a second session key, and when the authentication is passed, performing encrypted communication with the first terminal device based on the second session key. Thus, the target material to be used is negotiated in a customized manner before data communication, and then the authentication and the second session key are dynamically performed, effectively improving the security of Bluetooth communication.

[0071] Figure 3 It is an exemplary flow chart of another Bluetooth communication method shown in some embodiments of this specification. Figure 3 The process 300 shown can be executed by the second terminal device, for example, it can be implemented by the Bluetooth communication system 700 deployed on the second terminal device. In some embodiments, the second terminal device can be a Bluetooth device, such as a smart door lock, smart socket, smart desk lamp, etc. that supports Bluetooth communication. Figure 3 As shown, process 300 may include the following steps.

[0072] Step 310 , establishing a connection with the first terminal device. In some embodiments, step 310 may be implemented by the second connection module 710 in the Bluetooth communication system 700 .

[0073] In some embodiments, the first terminal device may be a control terminal supporting Bluetooth communication, such as a desktop computer, a laptop computer, a mobile phone, and a tablet computer.

[0074] In some embodiments, the second terminal device can establish a connection with the first terminal device based on the Just Works mode. Exemplarily, the second terminal device can turn on the Bluetooth function to broadcast, so as to allow the surrounding terminal devices supporting Bluetooth communication to discover the second terminal device, the first terminal device turns on the Bluetooth function and searches for nearby Bluetooth devices, the first terminal device selects the second terminal device in the search results and establishes a connection with the second terminal device, so that the connection between the first terminal device and the second terminal device can be quickly established without the user entering a password.

[0075] Step 320 : exchanging random numbers with the first terminal device and negotiating with the first terminal device the target material used for Bluetooth communication. In some embodiments, step 320 may be implemented by the second negotiation module 720 in the Bluetooth communication system 700 .

[0076] In some embodiments, the second terminal device may receive a key negotiation request sent by the first terminal device, where the key negotiation request includes a first random number and candidate material generated by the first terminal device. For a detailed description of the key negotiation request sent by the first terminal device and the first random number and candidate material included in the key negotiation request, reference may be made to the description in step 120 above, which will not be repeated here.

[0077] In some embodiments, after receiving the key negotiation request, the second terminal device may generate a second random number and confirm a target material from the candidate materials, and send a key negotiation response including the second random number and the target material to the first terminal device.

[0078] In some embodiments, the second terminal device may generate a second random number of preset bytes through a random number generator. The length of the second random number may affect the security of Bluetooth communication. Generally speaking, the longer the length of the second random number, the higher the security of Bluetooth communication.

[0079] In some embodiments, the target material may include a target authentication method. In some other embodiments, the target material may also include at least one of a target encryption algorithm, a target signature algorithm, and a target verification algorithm. Taking the confirmation of the target authentication method as an example, the second terminal device may randomly determine one of the more than one candidate authentication methods sent by the first terminal device according to the authentication methods supported by itself as the target authentication method. The method for confirming the target encryption algorithm, the target signature algorithm, and the target verification algorithm is similar to the method for confirming the target authentication method, and will not be repeated here.

[0080] In some embodiments, the key negotiation response may be sent in the form of a message. Exemplarily, the structure of the message may include a fixed header, a payload, and a check value. Among them, the payload may include specific message content, such as a second random number and a target material. The check value is used to verify whether the message has been tampered with or an error has occurred during the transmission process. The fixed header may include basic data of the message for identifying and managing the message. Exemplarily, the fixed header may include the ID of the receiver and the sender, a sequence number, a message type, a payload length, etc. The ID of the receiver and the sender may be, for example, a device identifier of the first terminal device and the second terminal device. The sequence number may be, for example, a unique sequence number for identifying the message. The message type may be, for example, a key negotiation request, a key negotiation response, etc. For example, the number 2 indicates that the message type is a key negotiation response. The payload length is used to determine the size of the payload. In some embodiments, the second terminal device may pre-configure the target material supported by itself and the identifier corresponding to the target material. When sending a message of a key negotiation response to the first terminal device, the target material in the message may be the identifier of the target material.

[0081] By negotiating with the first terminal device to determine the target material to be used before data communication with the first terminal device, the material to be used in this communication is dynamically negotiated, and authentication and data encryption are performed based on the dynamically negotiated material in the subsequent stage, which effectively improves the security of Bluetooth communication. And because the material negotiation is performed at the application layer, the second terminal device can customize the protocol according to the algorithm or authentication method it supports, so that the first terminal device and the second terminal device can interact in a private scenario, enhancing the security of Bluetooth communication.

[0082] Step 330 , based on the random number and the target material determined by negotiation with the first terminal device, authentication is performed with the first terminal device and a second session key is generated. In some embodiments, step 330 may be implemented by a second authentication module 730 in the Bluetooth communication system 700 .

[0083] In some embodiments, the key authentication request is generated based on the first random number, the second random number, and the target material. After the first terminal device receives the key negotiation response sent by the second terminal device, it can generate a key authentication request and a first session key based on the first random number, the second random number, and the target material, and send the key authentication request to the second terminal device. For a specific description of how the first terminal device generates the key authentication request and the first session key, please refer to the description in the previous step 130 and will not be repeated here.

[0084] In some embodiments, after receiving the key authentication request sent by the first terminal device, the second terminal device can authenticate the key authentication request based on the first random number, the second random number and the target material and generate a second session key. The specific method for authenticating the key authentication request and generating the second session key is described below.

[0085] Regarding the generation of the second session key, in some embodiments, when the target material includes a target authentication method confirmed from the candidate material, the second session key can be generated based on the first random number, the second random number and the target authentication method. Exemplarily, when the target authentication method is password authentication, the first random number, the second random number and the preset password corresponding to the password authentication method can be concatenated, and the concatenated values ​​can be hashed based on a preset authentication algorithm to obtain a hash value, which is used as the second session key. The preset authentication algorithm can be a shared authentication algorithm pre-configured in the first terminal device and the second terminal device, such as a hash algorithm (such as MD5, SHA, SM3, etc.) pre-configured in the first terminal device and the second terminal device.

[0086] In some embodiments, when the target material further includes a target verification algorithm confirmed from the candidate material, a second session key can also be generated based on the first random number, the second random number and the target verification algorithm. Exemplarily, the first random number and the second random number can be concatenated, and the concatenated random number can be hashed based on the target verification algorithm to obtain a hash value, which is used as the second session key. In other embodiments, the second session key can also be generated based on the first random number, the second random number, the target authentication method and the target verification algorithm. Exemplarily, when the target authentication method is password authentication, the first random number, the second random number and the preset password corresponding to the password authentication method can be concatenated, and the concatenated value can be hashed based on the target verification algorithm to obtain a hash value, which is used as the second session key.

[0087] In some embodiments, there are multiple ways to splice random numbers or splice random numbers with other values. For example, the values ​​of the preset positions in the first random number and the second random number can be spliced, or a preset password can be added between the first random number and the second random number, or the preset password can be inserted into the preset positions in the first random number and the second random number.

[0088] In some embodiments, the way in which the second terminal device generates the second session key corresponds to the way in which the first terminal device generates the first session key, so as to generate symmetric first session key and second session key, so that in subsequent communication processes, the first terminal device can decrypt the communication data sent by the second terminal device based on the first session key, and the second terminal device can decrypt the communication data sent by the first terminal device based on the second session key.

[0089] For authenticating the key authentication request, in some embodiments, the key authentication request can be authenticated based on the first random number, the second random number and the target authentication method. Exemplarily, when the target authentication method is password authentication, the first random number, the second random number and the preset password corresponding to the password authentication method can be spliced ​​to obtain a spliced ​​value, and the spliced ​​value is signed based on a preset signature algorithm to obtain a digital signature, and the digital signature is verified to be consistent with the digital signature in the key authentication request. When they are consistent, the authentication is confirmed to be passed, and a key authentication response is sent to the first terminal device. Among them, the preset signature algorithm can be a shared signature algorithm pre-configured in the first terminal device and the second terminal device, such as a hash algorithm (such as MD5, SHA, SM3, etc.) pre-configured in the first terminal device and the second terminal device.

[0090] In some embodiments, when the target material further includes a target signature algorithm confirmed from the candidate material, the key authentication request can also be authenticated based on the target signature algorithm, the target authentication method, the first random number and the second random number. Exemplarily, when the target authentication method is password authentication, the first random number, the second random number and the preset password corresponding to the password authentication method can be spliced ​​to obtain a spliced ​​value, and the spliced ​​value is signed based on the target signature algorithm to obtain a digital signature, and the digital signature is verified to be consistent with the digital signature in the key authentication request. When they are consistent, the authentication is confirmed to be passed, and a key authentication response is sent to the first terminal device.

[0091] When the digital signature in the key authentication request is encrypted with the first session key, after receiving the key authentication request, the second terminal device can first decrypt the key authentication request sent by the first terminal based on the second session key, and then authenticate the decrypted digital signature.

[0092] Step 340 : When the authentication is successful, encrypted communication is performed with the first terminal device based on the second session key. In some embodiments, step 340 may be implemented by the second communication module 740 in the Bluetooth communication system 700 .

[0093] In some embodiments, after confirming that the first terminal device has been authenticated, the second terminal device may also generate a session identifier, which may be included in the key authentication response sent to the first terminal device. Exemplarily, the session identifier may be a session ID randomly generated by the second terminal device. In subsequent communication processes, the data sent by the first terminal device and the second terminal device may both carry the session identifier to enhance the security of Bluetooth communication.

[0094] In some embodiments, when the target material includes a target encryption algorithm confirmed from the candidate material, the session identifier and communication data may also be encrypted based on the second session key and the target encryption algorithm, and communication may be performed with the first terminal device based on the encrypted session identifier and the encrypted communication data. Exemplarily, the second terminal device may encrypt the session identifier and communication data respectively by the target encryption algorithm and the calculated second session key, and send the encrypted session identifier and the encrypted communication data to the first terminal device; when receiving the communication content sent by the first terminal device, the communication content may be decrypted by the target encryption algorithm and the calculated second session key, and the session identifier in the communication content may be verified, and when the verification is successful, a response may be made to the communication content sent by the first terminal device.

[0095] In order to further improve the security of Bluetooth communication, the second session key may be periodically updated based on the validity period corresponding to the second session key, and re-authentication may be performed with the first terminal device. Figure 4 This is an exemplary flow chart of another re-authentication method shown in some embodiments of this specification. Figure 4 The process 400 shown may be executed by the first terminal device, for example, may be implemented by the second re-authentication module 750 in the Bluetooth communication system 700 deployed on the first terminal device. Figure 4 As shown, process 400 may include the following steps.

[0096] Step 410 , when the validity period expires, regenerate the second random number and update the target material, and send a fast authentication request including the updated second random number and the updated target material to the first terminal device. In some embodiments, step 410 may be implemented by the second re-authentication module 750 .

[0097] In some embodiments, a quick authentication request is generated when a validity period expires. The validity period may be a preset period corresponding to the second session key, for example, a validity period of 30 seconds or 60 seconds. Exemplarily, after generating the second session key, the second terminal device may start calculating the validity period, and regenerate a quick authentication request when the validity period expires.

[0098] In some embodiments, when the validity period expires, the second terminal device may regenerate the second random number, for example, the second terminal device may regenerate the second random number of preset bytes through a random number generator to update the second random number. In some embodiments, when the validity period expires, the second terminal device may also reconfirm the target material from the candidate materials based on the candidate materials in the key agreement request sent by the first terminal device, and send a fast authentication request containing the updated second random number and the updated target material to the first terminal device.

[0099] In some embodiments, the fast authentication request is used to instruct the first terminal device to generate a fast authentication response based on the updated second random number and the updated target material. The specific description of the first terminal device generating a fast authentication response can be referred to the description in the above step 220, which will not be repeated again.

[0100] Step 420 , receiving the fast authentication response sent by the first terminal device, and authenticating the fast authentication response based on the updated second random number and the updated target material. In some embodiments, step 420 may be implemented by the second re-authentication module 750 .

[0101] In some embodiments, when the second terminal device receives the fast authentication response sent by the first terminal device, the fast authentication response can be authenticated based on the first random number, the updated second random number, and the updated target material. The description of authenticating the fast authentication response based on the first random number, the updated second random number, and the updated target material is similar to the description of authenticating the key authentication request based on the first random number, the second random number, and the target material in the previous text. For details, please refer to the description in the previous step 330, which will not be repeated here.

[0102] In some embodiments, when the second terminal device receives the fast authentication response sent by the first terminal device, a new second session key may also be generated. Exemplarily, a new second session key may be regenerated based on the first random number, the updated second random number, and the updated target material. The description of regenerating a new second session key based on the first random number, the updated second random number, and the updated target material is similar to the description of generating the second session key based on the first random number, the second random number, and the target material in the previous text. For details, please refer to the description in the previous step 330, which will not be repeated here.

[0103] Step 430 : When the authentication is successful, communicate with the first terminal device based on the new second session key. In some embodiments, step 430 may be implemented by the second communication module 740 .

[0104] In some embodiments, when the authentication is passed, the second terminal device can also generate a new session identifier, encrypt the new session identifier based on a new second session key, and send it to the first terminal device, and in subsequent Bluetooth communication processes, perform encrypted communication with the first terminal device based on the new second session key and the new session identifier.

[0105] By periodically updating the second session key and reauthenticating with the first terminal device, the session key and target material used in the Bluetooth communication process can be dynamically updated to prevent the risk of leakage of the second session key or target material, thereby further improving the security of Bluetooth communication.

[0106] Figure 5 It is an exemplary flow chart of another Bluetooth communication method shown in some embodiments of this specification. Figure 5 The process 500 shown can be executed by the first terminal device and the second terminal device. In some embodiments, the first terminal device can be a control terminal supporting Bluetooth communication, such as a desktop computer, a laptop computer, a mobile phone, and a tablet computer. In some embodiments, the second terminal device can be a Bluetooth device, such as a smart door lock, a smart socket, a smart desk lamp, etc. supporting Bluetooth communication. Figure 5 As shown, process 500 may include the following steps.

[0107] Step 510 : The first terminal device establishes a connection with the second terminal device. In some embodiments, step 510 may be implemented by the first connection module 610 and the second connection module 710 .

[0108] The description of this step is similar to that in the previous text. For details, please refer to the description in the previous step 110 or step 310, which will not be repeated here.

[0109] Step 520 : The first terminal device sends a key negotiation request to the second terminal device. In some embodiments, step 520 may be implemented by the first negotiation module 620 .

[0110] In some embodiments, the first terminal device may generate a first random number and send a key negotiation request including the first random number and a candidate material to the second terminal device, wherein the key negotiation request is used to instruct the second terminal device to exchange random numbers and confirm a target material from the candidate material.

[0111] For more information about this step, please refer to the description of step 120 and step 320 above, which will not be repeated here.

[0112] Step 530 : The second terminal device sends a key negotiation response to the first terminal device. In some embodiments, step 530 may be implemented by the second negotiation module 720 .

[0113] In some embodiments, after receiving the key negotiation request sent by the first terminal device, the second terminal device can generate a second random number and confirm the target material from the candidate materials, and send a key negotiation response including the second random number and the target material to the first terminal device.

[0114] For more information about this step, please refer to the description of step 120 and step 320 above, which will not be repeated here.

[0115] Step 540 : The first terminal device sends a key authentication request to the second terminal device. In some embodiments, step 540 may be implemented by the first authentication module 630 .

[0116] In some embodiments, after the first terminal device receives the key negotiation response sent by the second terminal device, it can generate a key authentication request and a first session key based on the first random number, the second random number and the target material, and send the key authentication request to the second terminal device. The key authentication request is used to instruct the second terminal device to authenticate the key authentication request and generate a key authentication response when the authentication is successful.

[0117] For more information about this step, please refer to the description of step 130 and step 330 above, which will not be repeated here.

[0118] Step 550 : The second terminal device sends a key authentication response to the first terminal device. In some embodiments, step 550 may be implemented by the second authentication module 730 .

[0119] In some embodiments, after the second terminal device receives the key authentication request sent by the first terminal device, it can authenticate the key authentication request based on the first random number, the second random number and the target material and generate a second session key, and send a key authentication response to the first terminal device when the authentication is successful.

[0120] For more information about this step, please refer to the description of step 130 and step 330 above, which will not be repeated here.

[0121] Step 560 : The first terminal device performs encrypted communication with the second terminal device. In some embodiments, step 560 may be implemented by the first communication module 640 and the second communication module 740 .

[0122] For more information about this step, please refer to the description of step 140 and step 340 above, which will not be repeated here.

[0123] Step 570 : The second terminal device sends a quick authentication request to the first terminal device. In some embodiments, step 570 may be implemented by the second re-authentication module 750 .

[0124] In some embodiments, when the validity period expires, the second terminal device may regenerate the second random number and update the target material, and send a quick authentication request including the updated second random number and the updated target material to the first terminal device.

[0125] For more information about this step, please refer to the description of step 210 and step 410 above, which will not be repeated here.

[0126] Step 580 : The first terminal device sends a quick authentication response to the second terminal device. In some embodiments, step 580 may be implemented by the first re-authentication module 650 .

[0127] In some embodiments, after receiving the fast authentication request sent by the second terminal device, the first terminal device may generate a fast authentication response and a new first session key based on the updated second random number and the updated target material, and send the fast authentication response to the second terminal device. The second terminal device may receive the fast authentication response sent by the first terminal device, and authenticate the fast authentication response based on the updated second random number and the updated target material and generate a new second session key.

[0128] For more information about this step, please refer to the description of step 220 and step 420 above, which will not be repeated here.

[0129] Step 590 : The second terminal device performs encrypted communication with the first terminal device. In some embodiments, step 590 may be implemented by the first communication module 640 and the second communication module 740 .

[0130] In some embodiments, when the authentication is successful, the first terminal device may communicate with the second terminal device based on the new first session key, and the second terminal device may communicate with the first terminal device based on the new second session key.

[0131] For more information about this step, please refer to the description of step 230 or step 430 above, which will not be repeated here.

[0132] The present specification also provides a Bluetooth communication system, which is applied to a terminal device. The Bluetooth communication system may include a connection module, which is used to establish a connection with other terminal devices; a negotiation module, which is used to exchange random numbers with other terminal devices and negotiate with other terminal devices on target materials used for Bluetooth communication, wherein the target materials include a target authentication method; an authentication module, which is used to authenticate with other terminal devices based on random numbers and target materials determined through negotiation with other terminal devices and generate a session key; and a communication module, which is used to perform encrypted communication with other terminal devices based on the session key when the authentication is passed.

[0133] In some embodiments, the terminal device may be a first terminal device, and the other terminal device may be a second terminal device. Figure 6 is an exemplary block diagram of a Bluetooth communication system according to some embodiments of this specification. Figure 6 As shown, in some embodiments, the Bluetooth communication system 600 may include a first connection module 610 , a first negotiation module 620 , a first authentication module 630 , and a first communication module 640 .

[0134] The first connection module 610 is used to establish a connection with a second terminal device.

[0135] The first negotiation module 620 is used to exchange random numbers with the second terminal device and negotiate with the second terminal device the target material used for Bluetooth communication, where the target material includes a target authentication method.

[0136] The first authentication module 630 is used to authenticate with the second terminal device based on the random number and the target material determined through negotiation with the second terminal device and generate a first session key.

[0137] The first communication module 640 is used to perform encrypted communication with the second terminal device based on the first session key when the authentication is successful.

[0138] In some optional embodiments, the first negotiation module 620 can also be used to generate a first random number, and send a key negotiation request containing the first random number and candidate materials to the second terminal device, the key negotiation request is used to instruct the second terminal device to exchange random numbers and confirm target materials from the candidate materials; receive a key negotiation response sent by the second terminal device, the key negotiation response contains the second random number and target material generated by the second terminal device.

[0139] In some optional embodiments, the first authentication module 630 can also be used to generate a key authentication request and a first session key based on the first random number, the second random number and the target material, and send the key authentication request to the second terminal device, where the key authentication request is used to instruct the second terminal device to authenticate the key authentication request and generate a key authentication response when the authentication is successful.

[0140] In some optional embodiments, the target material also includes a target verification algorithm confirmed from the candidate material; the first authentication module 630 can also be used to generate a first session key based on the first random number, the second random number and the target verification algorithm; and generate a key authentication request based on the first random number, the second random number and the target authentication method.

[0141] In some optional embodiments, the target material also includes a target signature algorithm confirmed from the candidate material; the first authentication module 630 can also be used to sign the first random number and the second random number based on the target signature algorithm and the target authentication method to generate a key authentication request containing a digital signature.

[0142] In some optional embodiments, the target material also includes a target encryption algorithm confirmed from the candidate material; the first communication module 640 can also be used to receive a key authentication response sent by the second terminal device to indicate that the authentication is successful, and the key authentication response includes a session identifier generated by the second terminal device; based on the first session key and the target encryption algorithm, the session identifier and communication data are encrypting, and communicating with the second terminal device based on the encrypted session identifier and the encrypted communication data.

[0143] In some optional embodiments, the Bluetooth communication system 600 may further include a first re-authentication module 650, which is used to periodically update the first session key based on the validity period corresponding to the first session key, and re-authenticate with the second terminal device.

[0144] In some optional embodiments, the first re-authentication module 650 can also be used to receive a quick authentication request sent by a second terminal device, the quick authentication request is generated when the validity period expires, and the quick authentication request includes an updated second random number and an updated target material of the second terminal device; generate a quick authentication response and a new first session key based on the updated second random number and the updated target material, and send the quick authentication response to the second terminal device, the quick authentication response is used to instruct the second terminal device to authenticate the quick authentication response; when the authentication is successful, communicate with the second terminal device based on the new first session key.

[0145] In some other embodiments, the terminal device may be the second terminal device, and the other terminal device may be the first terminal device. Figure 7 FIG. 1 is an exemplary block diagram of another Bluetooth communication system according to some embodiments of this specification. Figure 7 As shown, in some embodiments, the Bluetooth communication system 700 may include a second connection module 710 , a second negotiation module 720 , a second authentication module 730 , and a second communication module 740 .

[0146] The second connection module 710 is used to establish a connection with the first terminal device.

[0147] The second negotiation module 720 is used to exchange random numbers with the first terminal device and negotiate with the first terminal device the target material used for Bluetooth communication, where the target material includes a target authentication method.

[0148] The second authentication module 730 is used to authenticate with the first terminal device based on the random number and the target material determined through negotiation with the first terminal device and generate a second session key.

[0149] The second communication module 740 is used to perform encrypted communication with the first terminal device based on the second session key when the authentication is successful.

[0150] In some optional embodiments, the second negotiation module 720 can also be used to receive a key negotiation request sent by the first terminal device, the key negotiation request including a first random number and candidate materials generated by the first terminal device; generate a second random number and confirm a target material from the candidate materials, and send a key negotiation response including the second random number and the target material to the first terminal device.

[0151] In some optional embodiments, the second authentication module 730 can also be used to receive a key authentication request sent by the first terminal device, wherein the key authentication request is generated based on a first random number, a second random number and a target material; authenticate the key authentication request based on the first random number, the second random number and the target material and generate a second session key; and send a key authentication response to the first terminal device when the authentication is successful.

[0152] In some optional embodiments, the Bluetooth communication system 700 may further include a second re-authentication module 750 that periodically updates the second session key based on the validity period corresponding to the second session key and re-authenticates with the first terminal device.

[0153] In some optional embodiments, the second re-authentication module 750 can also be used to regenerate the second random number and update the target material when the validity period expires, send a quick authentication request containing the updated second random number and the updated target material to the first terminal device, the quick authentication request is used to instruct the first terminal device to generate a quick authentication response based on the updated second random number and the updated target material; receive the quick authentication response sent by the first terminal device, and authenticate the quick authentication response based on the updated second random number and the updated target material; when the authentication is successful, communicate with the first terminal device based on the new second session key.

[0154] For more information about each module, see Figures 1 to 5 The relevant description of will not be repeated here. It should be understood that Figure 6 and Figure 7The system and its modules shown can be implemented in various ways. For example, in some embodiments, the system and its modules can be implemented by hardware, software, or a combination of software and hardware. Among them, the hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will understand that the above methods and systems can be implemented using computer executable instructions and / or control codes contained in a processor, such as a disk, CD or DVD-ROM, etc., and such codes are provided in a carrier medium or a memory of a programmable device. The system and its modules of this specification can not only be implemented by hardware circuits such as ultra-large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., but can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above hardware circuits and software (e.g., firmware).

[0155] It should be noted that the above description of the system and its modules is only for convenience of description and does not limit this specification to the scope of the embodiments. It is understandable that for those skilled in the art, after understanding the principle of the system, it is possible to arbitrarily combine the modules without deviating from this principle to form a subsystem connected to other modules. Or some modules may be split to obtain more modules or multiple units under the module. Such variations are all within the scope of the disclosure of this specification.

[0156] Some embodiments of the present specification also provide a computer program product, including computer instructions. When at least part of the computer instructions are executed by a processor, the present specification can be implemented. Figures 1 to 5 In some embodiments, the computer program product may only involve computer instructions, which may be carried by a storage medium or a processing device. In other embodiments, the computer program product may also be a storage medium or a processing device containing the aforementioned computer instructions. The processing device may include one or more processors and a storage medium.

[0157] In some embodiments, the processor may be a combination of one or more of the following processors: a central processing unit (CPU), an application specific integrated circuit (ASIC), an application specific instruction set processor (ASIP), a graphics processing unit (GPU), a physical processing unit (PPU), a digital signal processor (DSP), a field programmable gate array (FPGA), a programmable logic device (PLD), a programmable logic controller (PLC), a reduced instruction set computer (RISC), and a microprocessor.

[0158] In some embodiments, the storage medium may include a combination of one or more of the following: a mass storage, a removable storage, a volatile read-write memory, and a read-only memory (ROM). Exemplary mass storage may include a magnetic disk, an optical disk, a solid-state hard disk, and the like. Exemplary removable storage may include a flash disk, a floppy disk, an optical disk, a memory card, a compressed hard disk, a magnetic tape, and the like. Exemplary volatile read-write memory may include a random access memory (RAM). Exemplary random access memory may include a dynamic random access memory (DRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), a static random access memory (SRAM), a thyristor random access memory (T-RAM), and a zero capacitance memory (Z-RAM), and the like. Exemplary read-only memory may include a masked read-only memory (MROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a compact disk read-only memory (CD-ROM), and a digital multifunction hard disk read-only memory, and the like.

[0159] The beneficial effects that may be brought about by the embodiments of this specification include but are not limited to: (1) by establishing a connection with a second terminal device, exchanging random numbers with the second terminal device, and negotiating with the second terminal device the target material used for Bluetooth communication, based on the random number and the target material determined by negotiation with the second terminal device, the second terminal device is authenticated and a first session key is generated. When the authentication is successful, encrypted communication is performed with the second terminal device based on the first session key, thereby customizing the target material to be used before data communication, and then dynamically authenticating and generating the first session key, effectively improving the security of Bluetooth communication; (2) by periodically updating the first session key and re-authenticating with the second terminal device, the session key and target material used in the Bluetooth communication process can be dynamically updated to prevent the risk caused by the leakage of the first session key or target material, thereby further improving the security of Bluetooth communication; (3) by establishing a connection with a first terminal device, exchanging random numbers with the first terminal device, and negotiating with the first terminal device the target material used for Bluetooth communication, based on the random number and the target material determined by negotiation with the first terminal device, the first terminal device is authenticated and a second session key is generated. When the authentication is successful, encrypted communication is performed with the first terminal device based on the second session key. Thus, the target material to be used is negotiated in a customized manner before data communication, and then authentication and second session key are dynamically performed and generated, effectively improving the security of Bluetooth communication; (4) By periodically updating the second session key and re-authenticating with the first terminal device, the session key and target material used in the Bluetooth communication process can be dynamically updated to prevent the risk caused by the leakage of the second session key or target material, further improving the security of Bluetooth communication; (5) By negotiating and determining the target material to be used before data communication, the material to be used in this communication is dynamically negotiated, and authentication and data encryption are performed based on the dynamically negotiated material in the subsequent stage, effectively improving the security of Bluetooth communication. And because the material negotiation is performed at the application layer, the second terminal device can customize the protocol according to the algorithm or authentication method it supports, so that the first terminal device and the second terminal device interact in a private scenario, enhancing the security of Bluetooth communication. It should be noted that different embodiments may produce different beneficial effects. In different embodiments, the beneficial effects that may be produced may be any one or a combination of the above, or any other beneficial effects that may be obtained.

[0160] The basic concepts have been described above. Obviously, for those skilled in the art, the above detailed disclosure is only for example and does not constitute a limitation of this specification. Although not explicitly stated here, those skilled in the art may make various modifications, improvements and corrections to this specification. Such modifications, improvements and corrections are taught in this specification, so such modifications, improvements and corrections still belong to the spirit and scope of the exemplary embodiments of this specification.

Claims

1. A Bluetooth communication method, applied to a first terminal device, characterized in that: The method comprises: Establishing a connection with a second terminal device; exchanging random numbers with the second terminal device, and negotiating with the second terminal device target materials used for the Bluetooth communication, the target materials including a target authentication method; Authenticate with the second terminal device based on the random number and the target material determined through negotiation with the second terminal device and generate a first session key; When the authentication is successful, encrypted communication is performed with the second terminal device based on the first session key.

2. The method according to claim 1, characterized in that The exchanging of random numbers with the second terminal device and negotiating with the second terminal device the target material used for the Bluetooth communication includes: Generate a first random number, and send a key negotiation request including the first random number and a candidate material to the second terminal device, wherein the key negotiation request is used to instruct the second terminal device to exchange random numbers and confirm the target material from the candidate material; A key negotiation response is received from the second terminal device, where the key negotiation response includes a second random number generated by the second terminal device and the target material.

3. The method according to claim 2, characterized in that The step of authenticating with the second terminal device based on the random number and the target material determined through negotiation with the second terminal device and generating a first session key comprises: A key authentication request and the first session key are generated based on the first random number, the second random number and the target material, and the key authentication request is sent to the second terminal device, wherein the key authentication request is used to instruct the second terminal device to authenticate the key authentication request and generate a key authentication response when the authentication is successful.

4. The method according to claim 3, characterized in that The target material also includes a target verification algorithm confirmed from the candidate material; The generating a key authentication request and the first session key based on the first random number, the second random number and the target material comprises: generating the first session key based on the first random number, the second random number, and the target authentication algorithm; The key authentication request is generated based on the first random number, the second random number, and the target authentication method.

5. The method according to claim 4, characterized in that The target material also includes a target signature algorithm confirmed from the candidate material; The generating the key authentication request based on the first random number, the second random number and the target authentication mode includes: The first random number and the second random number are signed based on the target signature algorithm and the target authentication method to generate the key authentication request including the digital signature.

6. The method according to claim 1, characterized in that The target material also includes a target encryption algorithm identified from the candidate material; When the authentication is passed, performing encrypted communication with the second terminal device based on the first session key includes: Receiving a key authentication response sent by the second terminal device and used to indicate that the authentication is successful, wherein the key authentication response includes a session identifier generated by the second terminal device; The session identifier and communication data are encrypted based on the first session key and the target encryption algorithm, and communication is performed with the second terminal device based on the encrypted session identifier and the encrypted communication data.

7. The method according to claim 1, characterized in that Also includes: The first session key is periodically updated based on a validity period, and re-authentication is performed with the second terminal device.

8. The method according to claim 7, characterized in that The periodically updating the first session key based on the validity period corresponding to the first session key and re-authenticating with the second terminal device includes: receiving a quick authentication request sent by the second terminal device, the quick authentication request being generated when the validity period expires, and the quick authentication request including a second random number updated by the second terminal device and an updated target material; Generate a fast authentication response and a new first session key based on the updated second random number and the updated target material, and send the fast authentication response to the second terminal device, where the fast authentication response is used to instruct the second terminal device to authenticate the fast authentication response; When the authentication is successful, communication is performed with the second terminal device based on the new first session key.

9. A Bluetooth communication method, applied to a second terminal device, characterized in that: The method comprises: Establishing a connection with a first terminal device; exchanging random numbers with the first terminal device, and negotiating with the first terminal device target materials used for the Bluetooth communication, the target materials including a target authentication method; Authenticate with the first terminal device based on the random number and the target material determined through negotiation with the first terminal device and generate a second session key; When the authentication is successful, encrypted communication is performed with the first terminal device based on the second session key.

10. The method according to claim 9, characterized in that The exchanging of random numbers with the first terminal device and negotiating with the first terminal device the target material used for the Bluetooth communication includes: receiving a key negotiation request sent by the first terminal device, wherein the key negotiation request includes a first random number and a candidate material generated by the first terminal device; Generate a second random number and confirm the target material from the candidate materials, and send a key negotiation response including the second random number and the target material to the first terminal device.

11. The method according to claim 10, characterized in that The step of authenticating with the first terminal device based on the random number and the target material determined through negotiation with the first terminal device and generating a second session key comprises: receiving a key authentication request sent by the first terminal device, wherein the key authentication request is generated based on the first random number, the second random number, and the target material; authenticating the key authentication request and generating the second session key based on the first random number, the second random number, and the target material; When the authentication is successful, a key authentication response is sent to the first terminal device.

12. The method according to claim 19, characterized in that Also includes: The second session key is periodically updated based on the validity period corresponding to the second session key, and re-authentication is performed with the first terminal device.

13. The method according to claim 12, characterized in that The periodically updating the second session key based on the validity period corresponding to the second session key and reauthenticating with the first terminal device includes: When the validity period expires, regenerate a second random number and update the target material, and send a fast authentication request including the updated second random number and the updated target material to the first terminal device, wherein the fast authentication request is used to instruct the first terminal device to generate a fast authentication response based on the updated second random number and the updated target material; receiving the quick authentication response sent by the first terminal device, and authenticating the quick authentication response based on the updated second random number and the updated target material; When the authentication is successful, communication is performed with the first terminal device based on the new second session key.

14. A Bluetooth communication system, applied to a terminal device, characterized in that: The system comprises: A connection module, used to establish a connection with other terminal devices; A negotiation module, used to exchange random numbers with the other terminal devices, and negotiate with the other terminal devices the target material used for the Bluetooth communication, wherein the target material includes a target authentication method; an authentication module, configured to authenticate with the other terminal device and generate a session key based on the random number and a target material determined through negotiation with the other terminal device; The communication module is used to perform encrypted communication with the other terminal device based on the session key when the authentication is passed.

15. A computer program product, characterized in that The invention comprises a computer program, and when at least a part of the computer program is executed by a processor, the method according to any one of claims 1 to 13 can be implemented.

Images