Bluetooth module pairing method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a Bluetooth module pairing method and device, electronic equipment and a readable storage medium, and belongs to the technical field of electronic equipment. The Bluetooth module pairing method comprises the following steps: sending a Bluetooth pairing broadcast according to a network state of first electronic equipment and trusted service management; negotiating a first shared key with the second electronic device based on a negotiation rule matched with the Bluetooth pairing broadcast; performing encrypted communication with the second electronic device based on the first shared key to obtain Bluetooth pairing information; establishing Bluetooth pairing with the second electronic equipment according to the Bluetooth pairing information; wherein negotiating the first shared secret key with the second electronic equipment based on a negotiation rule matched with the Bluetooth pairing broadcast comprises the following steps: negotiating the first shared secret key with the second electronic equipment through trusted service management under the condition that the network state is networking; and negotiating a first shared key with the second electronic equipment based on the first certificate and the second certificate under the condition that the network state is offline.

Description

Technical Field

[0001] The present application belongs to the technical field of electronic devices, and specifically relates to a Bluetooth module pairing method, device, electronic device, and readable storage medium. Background Art

[0002] Electronic devices can perform short-range Bluetooth communication through the Bluetooth modules they carry. The Bluetooth modules in two electronic devices rely on Bluetooth pairing to ensure data encryption during Bluetooth communication. Bluetooth pairing can be achieved by manually inputting a pairing code by the user or by exchanging pairing information through Near Field Communication (NFC) technology. However, the security of Bluetooth pairing methods in related technologies needs to be further improved. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a Bluetooth module pairing method, device, electronic device and readable storage medium, which can solve the problem of low security of the Bluetooth pairing method.

[0004] In a first aspect, an embodiment of the present application provides a Bluetooth module pairing method, which is applied to a first electronic device, and the method includes:

[0005] Sending a Bluetooth pairing broadcast according to the network status between the first electronic device and the trusted service management;

[0006] Negotiate a first shared key with a second electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0007] Performing encrypted communication with the second electronic device based on the first shared key to obtain Bluetooth pairing information;

[0008] Establishing Bluetooth pairing with a second electronic device according to the Bluetooth pairing information;

[0009] Wherein, based on the negotiation rule matching the Bluetooth pairing broadcast, negotiating the first shared key with the second electronic device includes:

[0010] When the network state is connected to the network, the first shared key is negotiated with the second electronic device via the trusted service management;

[0011] When the network status is disconnected, the first shared key is negotiated with the second electronic device based on the first certificate and the second certificate, the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

[0012] In a second aspect, an embodiment of the present application provides a Bluetooth module pairing method, which is applied to a second electronic device, and the method includes:

[0013] Receiving a Bluetooth pairing broadcast sent by the first electronic device, where the Bluetooth pairing broadcast is sent by the first electronic device according to a network status between the first electronic device and the trusted service management;

[0014] Negotiate a first shared key with the first electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0015] Performing encrypted communication with the first electronic device based on the first shared key to obtain Bluetooth pairing information;

[0016] Establishing Bluetooth pairing with the first electronic device according to the Bluetooth pairing information;

[0017] Wherein, based on the negotiation rule matching the Bluetooth pairing broadcast, negotiating the first shared key with the first electronic device includes:

[0018] When the network state is connected to the network, the first shared key is negotiated with the first electronic device via the trusted service management;

[0019] When the network status is disconnected, a first shared key is negotiated with the first electronic device based on a first certificate and a second certificate, wherein the first certificate is a digital certificate pre-issued to the first electronic device by a trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by a trusted service management.

[0020] In a third aspect, an embodiment of the present application provides a Bluetooth module pairing device, comprising:

[0021] A first broadcast module, configured to send a Bluetooth pairing broadcast according to a network status between the first electronic device and the trusted service management;

[0022] A first sharing module, configured to negotiate a first shared key with a second electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0023] A first communication module, configured to perform encrypted communication with a second electronic device based on a first shared key to obtain Bluetooth pairing information;

[0024] A first pairing module, used to establish Bluetooth pairing with a second electronic device according to the Bluetooth pairing information;

[0025] Wherein, the first sharing module includes:

[0026] A first sharing unit is used to negotiate a first shared key with a second electronic device via a trusted service management when the network state is connected to the network;

[0027] The second sharing unit is used to negotiate a first shared key with the second electronic device based on the first certificate and the second certificate when the network status is disconnected, the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

[0028] In a fourth aspect, an embodiment of the present application provides a Bluetooth module pairing device, comprising:

[0029] A second receiving module is used to receive a Bluetooth pairing broadcast sent by the first electronic device, where the Bluetooth pairing broadcast is sent by the first electronic device according to a network status between the first electronic device and the trusted service management;

[0030] A second sharing module, configured to negotiate a first shared key with the first electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0031] The second communication module is used to perform encrypted communication with the first electronic device based on the first shared secret key to obtain Bluetooth pairing information

[0032] A second pairing module, used to establish Bluetooth pairing with the first electronic device according to the Bluetooth pairing information;

[0033] Wherein, the second shared module includes:

[0034] A third sharing unit is used to negotiate a first shared key with the first electronic device via the trusted service management when the network state is connected to the network;

[0035] The fourth sharing unit is used to negotiate a first shared key with the first electronic device based on the first certificate and the second certificate when the network status is disconnected, the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

[0036] In a fifth aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the methods of the first and second aspects are implemented.

[0037] In a sixth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method of the first aspect and the second aspect are implemented.

[0038] In the seventh aspect, an embodiment of the present application provides a chip, the chip including a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the methods of the first and second aspects.

[0039] In an eighth aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the methods of the first and second aspects.

[0040] In an embodiment of the present application, when the network state is connected, the first shared key is negotiated with the second electronic device through trusted service management to improve the security of the obtained first shared key; when the network state is disconnected, the first shared key is negotiated with the second electronic device based on the first certificate and the second certificate to improve the security of the obtained first shared key; the first electronic device and the second electronic device perform encrypted communication based on the first shared key, and establish Bluetooth pairing according to the obtained Bluetooth pairing information, so as to improve the identity security of the first electronic device and the second electronic device through the first shared key, improve the security of information transmitted between the first electronic device and the second electronic device, and improve the security of Bluetooth pairing between the two. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a flowchart of a Bluetooth module pairing method provided in an embodiment of the present application;

[0042] Figure 2 This is one of the structural schematic diagrams of the first electronic device and the second electronic device provided in an embodiment of the present application;

[0043] Figure 3 This is one of the flow charts of the Bluetooth module pairing method provided in one embodiment of the present application;

[0044] Figure 4 This is a second structural schematic diagram of a first electronic device and a second electronic device provided in an embodiment of the present application;

[0045] Figure 5 This is a second flow chart of a Bluetooth module pairing method provided in an embodiment of the present application;

[0046] Figure 6 This is a third flow chart of a Bluetooth module pairing method provided in an embodiment of the present application;

[0047] Figure 7 This is a third structural schematic diagram of a first electronic device and a second electronic device provided in an embodiment of the present application;

[0048] Figure 8 This is a fourth flow chart of a Bluetooth module pairing method provided in an embodiment of the present application;

[0049] Fig. 9 This is a fourth structural diagram of the first electronic device and the second electronic device provided in an embodiment of the present application;

[0050] Fig.10 This is a fifth flow chart of a Bluetooth module pairing method provided in an embodiment of the present application;

[0051] Fig.11 is a structural diagram of a Bluetooth module pairing device provided in an embodiment of the present application;

[0052] Fig.12 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0053] Fig.13 It is a schematic diagram of the hardware structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0055] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0056] The following, in conjunction with the accompanying drawings, describes in detail the Bluetooth module pairing method, device, electronic device, readable storage medium and computer program product provided in the embodiments of the present application through specific embodiments and their application scenarios.

[0057] See also Figure 1 , an embodiment of the present application provides a Bluetooth module pairing method, applied to a first electronic device, the method comprising:

[0058] S100, sending a Bluetooth pairing broadcast according to the network status between the first electronic device and the trusted service management;

[0059] S200, negotiating a first shared key with a second electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0060] S300, performing encrypted communication with a second electronic device based on the first shared key to obtain Bluetooth pairing information;

[0061] S400, establishing Bluetooth pairing with a second electronic device according to the Bluetooth pairing information;

[0062] Among them, S200 includes:

[0063] S210, when the network state is connected, negotiate a first shared key with the second electronic device via the trusted service management;

[0064] S220, when the network status is disconnected, negotiate a first shared key with the second electronic device based on the first certificate and the second certificate, the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

[0065] Trusted Service Manager (TSM) is a comprehensive platform that integrates management and services. Trusted Service Manager can establish a secure channel with the trusted security element and transmit data through the secure channel to achieve the management of the security element. Data is transmitted based on the secure channel established with the Trusted Service Manager to ensure the authenticity of the data.

[0066] The first electronic device includes a first Bluetooth module and a first security element that are communicatively connected. The first Bluetooth module can send a Bluetooth pairing broadcast outward. A secure channel is established between the trusted service management and the first security element. The second electronic device can refer to the first electronic device, and the second electronic device includes a second Bluetooth module and a second security element that are communicatively connected. A secure channel is established between the trusted service management and the second security element. The trusted service management can transmit data to the first security element and the second security element through the secure channel respectively to ensure the authenticity of the data. The data can be interactive data for negotiating a first shared key between the first security element and the second security element. The trusted service management can act as a transfer party to forward the interactive data sent by the first security element to the second security element, and forward the interactive data sent by the second security element to the first security element to ensure the security of the received interactive data. The data can also be the interactive data required for the trusted service management to issue a digital certificate to the security element.

[0067] When the network status is connected, the first electronic device can directly communicate with the trusted service management through the established secure channel, and the first electronic device and the second electronic device forward data through the trusted service management to enable the first electronic device and the second electronic device to negotiate the first shared key.

[0068] When the network status is connected, the first electronic device cannot communicate with the trusted service management, and thus cannot forward data to the second electronic device through the trusted service management. The first electronic device can use the first certificate pre-issued to the first electronic device by the trusted service management, and the second electronic device can use the second certificate pre-issued to the first electronic device by the trusted service management to confirm the identity and the security of the information sent between the two, thereby negotiating to obtain the first shared key.

[0069] When both the first electronic device and the second electronic device have the first shared key, the two can implement encryption and decryption of information directly transmitted between the two based on the first shared key, for example: Bluetooth pairing information is transmitted between the two to ensure the security of information transmitted between the two, as well as the security of the identities of the two, and improve the security of the electronic device that implements Bluetooth pairing. The Bluetooth pairing information may include a Bluetooth pairing request, feedback information on the Bluetooth pairing request, a pairing code, etc. When a third electronic device that does not have the first shared key receives the Bluetooth pairing information sent by the first electronic device, since the third electronic device cannot decrypt the Bluetooth pairing information, the third electronic device cannot establish Bluetooth pairing with the first electronic device. When a third electronic device that does not have the first shared key imitates the second electronic device to send Bluetooth pairing information, since the third electronic device cannot correctly encrypt the Bluetooth pairing information, the first electronic device can identify the third electronic device as an electronic device that has not been authorized by the trusted service management.

[0070] In the Bluetooth module pairing method provided in the present application, when the network state is connected, the first shared key is negotiated with the second electronic device through the trusted service management to improve the security of the obtained first shared key; when the network state is disconnected, the first shared key is negotiated with the second electronic device based on the first certificate and the second certificate to improve the security of the obtained first shared key; the first electronic device and the second electronic device perform encrypted communication based on the first shared key, and establish Bluetooth pairing according to the obtained Bluetooth pairing information, so as to improve the identity security of the first electronic device and the second electronic device through the first shared key, improve the security of information transmitted between the first electronic device and the second electronic device, and improve the security of Bluetooth pairing between the two.

[0071] In some embodiments, S210 includes:

[0072] S211, when the network state is connected, generate a first key pair, the first key pair including a first public key and a first private key;

[0073] S222, sending the first public key to the trusted service management through the secure channel established with the trusted service management, so that the trusted service management forwards the first public key to the second electronic device;

[0074] S233, receiving a second public key sent by the trusted service management through a secure channel, where the second public key is a secret key generated by the second electronic device according to the first public key and sent to the trusted service management;

[0075] S234, receiving a second public key sent by the trusted service management through a secure channel, where the second public key is a secret key generated by the second electronic device according to the first public key and sent to the trusted service management.

[0076] In the present application, unless otherwise specified, information transmitted between the first electronic device and the trusted service management, and between the second electronic device and the trusted service management is transmitted through an established secure channel.

[0077] The first electronic device generates a first public key and a first private key through a preset encryption algorithm, and sends the first public key to the second electronic device through a trusted service management to ensure the security of the first public key received by the second electronic device, and the first public key is sent to the second electronic device. The second electronic device generates a second public key and a second private key through a preset encryption algorithm, and sends the second public key to the first electronic device through a trusted service management to ensure the security of the second public key received by the first electronic device, and the second public key is sent to the first electronic device. Since the first electronic device and the second electronic device use the same encryption algorithm, the first electronic device can calculate the first shared key through the generated first private key and the received second public key, and the second electronic device can calculate the first shared key through the generated second private key and the received first public key. Optionally, the preset encryption algorithm is a Diffie-Hellman (DH) algorithm.

[0078] In some embodiments, S100 includes:

[0079] S110, when the network state is connected, sending a Bluetooth pairing broadcast, where the Bluetooth pairing broadcast carries a first identity resolution key;

[0080] S300 includes:

[0081] S310, sending the first identity resolution key to the trusted service management through a secure channel, so that the trusted service management forwards the first identity resolution key to the second electronic device;

[0082] S320, receiving a Bluetooth connection request sent by the second electronic device according to the first identity resolution key;

[0083] S330, establishing a connection with a second electronic device according to the Bluetooth connection request;

[0084] S340: Use the first shared key to perform encrypted communication with the second electronic device to obtain Bluetooth pairing information.

[0085] The first electronic device can broadcast a resolvable private address (RPA) to the outside, so that electronic devices near the first electronic device can scan the resolvable private address RPA. The resolvable private address includes an identity resolving key (IRK), through which the identity of the device can be identified.

[0086] The first identity resolution key is forwarded to the second electronic device through the trusted service management, so that the second electronic device can identify the resolvable random address broadcast by the first electronic device from the one or more resolvable random addresses obtained by scanning, so as to send a Bluetooth connection request to the correct first electronic device. After the first electronic device and the second electronic device establish a connection, the first shared key is used for encrypted communication to achieve Bluetooth pairing.

[0087] In some embodiments, in S300, the Bluetooth pairing information transmitted between the first electronic device and the second electronic device is out-of-band pairing information.

[0088] The out-of-band pairing information is out-of-band (OOB) data to improve the security of information transmission between the first electronic device and the second electronic device. The out-of-band pairing information generated by the first electronic device is encrypted by the first shared key and sent to the second electronic device, and the out-of-band pairing information generated by the second electronic device is encrypted by the first shared key and sent to the first electronic device. The first electronic device decrypts the received out-of-band pairing information by the first shared key, and the second electronic device decrypts the received out-of-band pairing information by the first shared key, so that the first electronic device and the second electronic device can establish Bluetooth pairing with the received out-of-band pairing information.

[0089] For example, see Figure 2 and Figure 3 The first electronic device includes a first security element 11 and a first Bluetooth module 12, and the second electronic device includes a second security element 21 and a second Bluetooth module 22; a security channel is established between the first security element 11 and the trusted service management 3, and a security channel is established between the second security element 21 and the trusted service management 3.

[0090] The first Bluetooth module 12 broadcasts a resolvable random address (RPA) externally, and the resolvable random address includes an identity resolution key IRK; the first Bluetooth module 12 sends the IRK to the first security element 11. The first security element 11 generates a first private key SK1 and a first public key PK1, and the first security element 11 sends the first public key PK1 and IRK to the trusted service management 3 through a secure channel, and the trusted service management 3 forwards the first public key PK1 and IRK to the second security element 21; after receiving the first public key PK1, the second security element 21 generates a pair of second private key SK2 and second public key PK2, and the second security element 21 sends the second public key PK2 to the trusted service management 3 through a secure channel, and the trusted service management 3 forwards the second public key PK2 to the first security element 11; the first security element 11 and the second security element 21 both obtain each other's public key PK, and calculate the first shared key CK through the DH algorithm.

[0091] The second security element 21 sends the received IRK to the second Bluetooth module 22. The second Bluetooth module 22 scans the RPA broadcast by the first Bluetooth module 12 according to the IRK. The second Bluetooth module 22 establishes a Bluetooth connection with the first Bluetooth module 12 based on the scanned RPA with the identity resolution key IRK.

[0092] The first Bluetooth module 12 generates the first out-of-band pairing information OOB1, which is encrypted by the first security element 11 using the first shared key CK, and then sent to the second Bluetooth module 22 through the first Bluetooth module 12. The encrypted first out-of-band pairing information OOB1 data is decrypted by the second security element 21 to obtain the first out-of-band pairing information OOB1. The second Bluetooth module 22 generates the second out-of-band pairing information OOB2, which is encrypted by the second security element 21 using the first shared key CK, and then sent to the first Bluetooth module 12 through the second Bluetooth module 22. The encrypted second out-of-band pairing information OOB2 is decrypted by the first security element 11 to obtain the second out-of-band pairing information OOB2. The first Bluetooth module 12 and the second Bluetooth module 22 perform secure connection pairing based on the first out-of-band pairing information OOB1 and the second out-of-band pairing information OOB2.

[0093] When the trusted service management manages the first electronic device and the second electronic device at the same time, that is, the trusted service management establishes secure channels with the first electronic device and the second electronic device respectively, and the first electronic device and the second electronic device can both communicate normally with the trusted service management during Bluetooth pairing, the first shared key can be obtained based on the exchange of the aforementioned first public key and the second public key, and Bluetooth pairing can be achieved based on the first shared key.

[0094] In some other embodiments, S220 includes:

[0095] S221, when the network status is disconnected, receiving a second certificate sent by a second electronic device;

[0096] S222, when the second certificate is successfully verified, parse the first shared key based on the pre-stored third private key and the fourth public key in the second certificate;

[0097] S223, sending the first certificate to the second electronic device, so that the second electronic device can parse the first shared key based on the pre-stored fourth private key and the third public key in the first certificate when the first certificate is successfully verified;

[0098] Among them, the first certificate is the device entity certificate issued by the trusted service management for the third public key, the third public key and the third private key are a paired key pair, and the second certificate is the device entity certificate issued by the trusted service management for the fourth public key, the fourth public key and the fourth private key are a paired key pair.

[0099] The first security element of the first electronic device generates a third public key and a third private key based on a preset encryption algorithm, and the generated third public key and the third private key are a key pair; the second security element of the second electronic device generates a fourth public key and a fourth private key based on a preset encryption algorithm, and the generated fourth public key and the fourth private key are a key pair. The preset encryption algorithm used by the first security element is the same as the preset encryption algorithm used by the second security element. Optionally, the preset encryption algorithm is a Diffie-Hellman (DH) algorithm.

[0100] The trusted service management can sign the first public key through its root certificate and intermediate certificate to obtain the device entity certificate. When the first electronic device establishes communication based on a secure channel with the trusted service management, the first electronic device sends the third public key to the trusted service management, the trusted service management issues a first certificate for the third public key, and the first electronic device stores the first certificate. The first certificate includes the third public key and a digital signature, and the digital signature is issued by the trusted service management to prove the legitimacy of the first certificate.

[0101] When the second electronic device establishes communication based on a secure channel with the trusted service management, the second electronic device sends the fourth public key to the trusted service management, the trusted service management issues a second certificate for the fourth public key, and the second electronic device stores the second certificate. The second certificate includes the fourth public key and a digital signature, and the digital signature is issued by the trusted service management to prove the legitimacy of the second certificate.

[0102] The first electronic device and / or the second electronic device may not have an active networking function, and the first electronic device and / or the second electronic device may establish a secure channel with the trusted service management by wired or wireless means during preparation to obtain a device entity certificate. The first electronic device and / or the second electronic device may also have an active networking function, and the first electronic device and / or the second electronic device obtains a device entity certificate when in a scenario of communicating with the trusted service management. Optionally, the network status of the first electronic device and the second electronic device are both disconnected, and in a scenario where the first electronic device is disconnected from the trusted service management communication, the first electronic device and the second electronic device use the pre-obtained device entity certificate to achieve Bluetooth pairing.

[0103] Since both the first certificate and the second certificate are issued by the trusted service management, if the first electronic device successfully verifies the second certificate, it means that the fourth public key carried in the second certificate is legitimate, and if the second electronic device successfully verifies the first certificate, it means that the third public key carried in the first certificate is legitimate. Therefore, in the scenario where either the first electronic device or the second electronic device cannot communicate with the trusted service management, the first electronic device and the second electronic device can also prove that each is an electronic device authorized by the trusted service management through the first certificate and the second certificate.

[0104] In some embodiments, before S100, the process includes:

[0105] S500, generating a third private key, a third public key and a certificate signing request related to the third public key, and sending the certificate signing request to the trusted service management through a secure channel established with the trusted service management;

[0106] S600, receiving an intermediate certificate and a first certificate sent by the trusted service management according to a certificate signing request, wherein the intermediate certificate is a certificate issued by the trusted service management through the first root certificate, and the first certificate is a certificate issued by the trusted service management according to the private key of the intermediate certificate to the third public key;

[0107] S222 includes:

[0108] When the second certificate is successfully verified through the intermediate certificate, the first shared key is parsed based on the third private key and the fourth public key, and the second certificate is a certificate issued by the trusted service management based on the private key of the intermediate certificate to the fourth public key.

[0109] The Certificate Signing Request (CSR) is a certificate request file generated when applying for a digital certificate. The certificate signing request associated with the third public key is to request the recipient to digitally sign the third public key so that the digital signature can prove the authenticity of the third public key.

[0110] When the second electronic device is communicating with the trusted service management, the second electronic device can generate a fourth private key, a fourth public key, and a certificate signing request related to the fourth public key before or after receiving the first certificate. The second electronic device sends a certificate signing request for the fourth public key to the trusted service management to obtain a second certificate issued for the fourth public key.

[0111] Trusted service management has a first root certificate, which can be a pre-stored device OEM (Original Equipment Manufacturer) root certificate. The first root certificate issues an intermediate certificate, which can be used to issue other device entity certificates. By using the first root certificate to issue intermediate certificates, a trusted path is established for the subsequent certificate issuance process.

[0112] After receiving the certificate signing request, the trusted service management uses the private key corresponding to the intermediate certificate to issue the first certificate about the third public key. The trusted service management sends the issued first certificate and the intermediate certificate together to the first electronic device. After the first electronic device receives these two certificates, it can use the first certificate to perform identity authentication and other operations, while the intermediate certificate is used to verify the legitimacy of the first certificate to ensure the trust relationship of the entire certificate system.

[0113] When the first electronic device receives the second certificate, the first electronic device can verify the authenticity of the second certificate through the intermediate certificate to determine whether the second certificate is issued by the trusted service management. If the second certificate is successfully verified through the intermediate certificate, it means that the second certificate is issued by the trusted service management, and the fourth public key it carries is the public key authorized by the trusted service management.

[0114] In this embodiment, when the first electronic device is not connected to the trusted service management for Bluetooth pairing, the device entity certificate sent by the other party can be verified based on the intermediate certificate held by each party, and the third public key and the fourth public key can be exchanged through the device entity certificate held by each party, so as to obtain the first shared secret key, and encrypted communication is performed based on the first shared secret key to transmit Bluetooth pairing information. By setting the first root certificate to issue the intermediate certificate, setting the intermediate certificate to issue the first certificate for the third public key, and setting the intermediate certificate to issue the second certificate for the fourth public key, the first electronic device can verify the authenticity of the second certificate through the intermediate certificate, and the second electronic device can verify the authenticity of the first certificate through the intermediate certificate, so that the first electronic device and the second electronic device can confirm the legal identity based on the first certificate and the second certificate.

[0115] In some embodiments, the first electronic device has a second root certificate that is the same as the first root certificate, and the second root certificate is a pre-stored device OEM root certificate; after S600, the method further includes:

[0116] In the event that the intermediate certificate is successfully verified by the second root certificate, the intermediate certificate and the first certificate are stored.

[0117] The first electronic device uses the public key in the intermediate certificate to verify the digital signature on the first certificate. The digital signature is generated by the trusted service management using the private key in the intermediate certificate to encrypt the relevant content of the first certificate. By decrypting the digital signature, the first electronic device can obtain the information summary and other contents contained in the signature, and compare it with the information summary recalculated from the content in the first certificate. If the two are consistent, it can be considered that the first certificate has not been tampered with during the transmission process and is issued by the correct trusted service management, thereby verifying the authenticity and integrity of the first certificate.

[0118] For the intermediate certificate itself, the first electronic device can check whether it is correctly issued by the first root certificate. The first electronic device is pre-installed with a second root certificate, which can be pre-installed by the manufacturer of the second electronic device. The first electronic device uses the public key of the second root certificate to verify the digital signature on the intermediate certificate. The process is similar to verifying the first certificate. By comparing the information digest obtained by decryption and the recalculated information digest to see if they are consistent, it is determined whether the intermediate certificate is authentic and complete.

[0119] The first electronic device starts from the first certificate, verifies that its issuer is the intermediate certificate, and then verifies that the issuer of the intermediate certificate is the first root certificate, thereby forming a complete trust chain to confirm that the first certificate and the intermediate certificate form a complete and correct certificate chain.

[0120] In some embodiments, S100 includes:

[0121] S120, when the network status is disconnected, generating a first random number, and generating first security information according to the first device identification information of the first electronic device and the first random number;

[0122] S130, encrypting the first security information by using a second shared key to obtain a second identity resolution key, where the second shared key is a key issued by the trusted service management;

[0123] S140, broadcasting a Bluetooth pairing broadcast carrying the second identity resolution key and the first random number, so that the second electronic device verifies the second identity resolution key according to the first device identification information, the received first random number and the pre-stored second shared key.

[0124] Different devices can be distinguished by device identification information, which can be generated by the electronic device itself or distributed by a trusted service management. The first random number can be a randomly generated string. The first device identification information and the first random number can be spliced, inserted at intervals, and calculated based on a preset formula to obtain the first security information, so that other devices except the second electronic device cannot directly obtain the first device identification information and the first random number after receiving the first security information.

[0125] When issuing the first certificate, the trusted service management can simultaneously send the second shared key. The second shared key is a global key generated by the trusted service management, that is, when issuing the second certificate, the trusted service management can simultaneously send the second shared key to the second electronic device.

[0126] The Bluetooth pairing broadcast may be a resolvable private address (RPA). The first electronic device may broadcast the resolvable private address RPA externally so that electronic devices located near the first electronic device may scan the resolvable private address RPA. The resolvable private address includes a second identity resolving key (IRK).

[0127] Before S221, including:

[0128] S224, receiving a Bluetooth connection request sent by the second electronic device according to the successfully verified second identity resolution key;

[0129] S225: Establish a second channel with the second electronic device according to the Bluetooth connection request.

[0130] S221, including:

[0131] A second certificate sent by a second electronic device through a second channel is received.

[0132] The user can input the device identification information expectedID of the electronic device expected to be connected to the second electronic device. When the second electronic device receives the resolvable random address RPA broadcast by the first electronic device, it can generate the first verification information according to the preset rules adopted by the first electronic device when generating the first security information based on the received expectedID and the first random number carried in the resolvable random address RPA. Since the first electronic device and the second electronic device trusted by the trusted service management both pre-store the second shared key, the first verification information is decrypted by the second shared key. If the second verification information can be decrypted normally, the second verification information is continued to be verified with the second identity resolution key in the resolvable random address. If the decryption and verification are successful, it means that the first electronic device has been correctly searched. If the second electronic device cannot decrypt the first verification information normally through the second shared key, and the second verification information obtained by decryption is different from the received second identity resolution key, the resolvable random address is rescanned until a Bluetooth connection request is sent to the correct first electronic device.

[0133] By setting the first electronic device and the second electronic device to pre-store the second shared secret key issued by the trusted service management, the second electronic device can pre-screen the Bluetooth pairing broadcast sent by the first electronic device in the scanned Bluetooth pairing broadcast, and then the first electronic device and the second electronic device establish a connection, and transmit the first certificate and the second certificate through the established second channel to achieve further identification and authentication. This prevents the second electronic device from blindly establishing a Bluetooth connection with the scanned electronic device and sending the second certificate.

[0134] In some embodiments, the trusted service management sends the intermediate certificate to the first electronic device according to the certificate signing request, and sends the first certificate and the second shared key encrypted by the third public key to the first electronic device. The trusted service management sends the intermediate certificate to the second electronic device according to the certificate signing request, and sends the second certificate and the second shared key encrypted by the fourth public key to the second electronic device.

[0135] If the first electronic device fails to verify the intermediate certificate and the first certificate through the second root certificate, it means that the authenticity of the second shared key encrypted by the third public key is in doubt. If the encrypted second shared key cannot be decrypted by the third private key, it means that the received information is incorrect. Other electronic devices except the first electronic device do not have the third private key, so that when other electronic devices except the first electronic device receive the encrypted second shared key, they cannot decrypt the encrypted second shared key.

[0136] When the first electronic device successfully verifies the intermediate certificate and the first certificate through the second root certificate, the encrypted second shared key is decrypted by the third private key to obtain the second shared key. The intermediate certificate, the second shared key and the first certificate can be stored. When Bluetooth pairing with the second electronic device is achieved, the intermediate certificate, the second shared key and the first certificate are used to verify the identity of the second electronic device and the authenticity of the transmitted Bluetooth pairing information, without the need for trusted service management to participate, thereby achieving secure Bluetooth pairing between the first electronic device and the second electronic device without connecting to trusted service management.

[0137] For example, see Figure 4 , Figure 5 , the trusted service management 3 uses the first root certificate to issue the intermediate certificate DevOEM1.CACert, and generates a globally unique second shared key EncKey; the first security element 11 generates a third public key SE1.PK and a third private key SE1.SK, the first security element 11 generates a certificate signing request CSR about the first public key SE1.PK and sends it to the trusted service management 3, the trusted service management 3 uses the intermediate certificate DevOEM1.SK1 to issue the first certificate SE1.Cert, and sends the first certificate SE1.Cert and the intermediate certificate DevOEM1.CACert to the first security element 11; the trusted service management 3 uses the third public key SE1.PK to encrypt the second shared key EncKey, and sends it to the first security element 11, the first security element 11 uses the second root certificate to verify the intermediate certificate DevOEM1.CACert and the first certificate SE1.Cert, after the verification is successful, the first security element 11 uses the third private key SE1.SK to decrypt the encrypted second shared key EncKey to obtain the second shared key EncKey.

[0138] The second security element generates a fourth public key SE2.PK and a fourth private key SE2.SK. The first security element 11 generates a certificate signing request CSR regarding the fourth public key SE2.PK and sends it to the trusted service management 3. The trusted service management 3 uses the intermediate certificate DevOEM1.SK1 to issue the second certificate SE2.Cert, and sends the second certificate SE2.Cert and the intermediate certificate DevOEM1.CACert to the second security element. The trusted service management 3 uses the fourth public key SE2.PK to encrypt the second shared key EncKey, and sends it to the second security element. After the second security element successfully verifies the intermediate certificate DevOEM1.CACert and the second certificate SE2.Cert, the second security element uses the fourth private key SE2.SK to decrypt the encrypted second shared key EncKey to obtain the second shared key EncKey.

[0139] Please refer to Figure 6The first security element 11 randomly generates a first random number Salt, connects the first device identification information ID with the first random number Salt, and encrypts it using the second shared key EncKey to obtain a second identity resolution key tIRK. The first security element 11 sends the second identity resolution key tIRK, the first device identification information ID and the random number Salt to the first Bluetooth module 12; the first Bluetooth module 12 uses a resolvable random address RPA including the second identity resolution key for broadcasting, and the broadcast data packet carries the first random number Salt.

[0140] The second security element 21 of the second electronic device receives the device identification information expectedID of the expected connection input by the user, and the second Bluetooth module 22 starts Bluetooth scanning. When a Bluetooth pairing broadcast is scanned, the first random number Salt and the resolvable random address RPA in the broadcast data packet are sent to the second security element 21 for verification; the second security element 21 connects the expected connection identification information expectedID and the received first random number Salt, and uses the first shared key EncKey to decrypt. If the decryption can be normal to obtain the second identity resolution key tIRK, the second identity resolution key tIRK will continue to be used to verify the resolvable random address RPA. If the decryption and verification are both successful, it means that the first electronic device to be connected has been correctly searched.

[0141] The second security element 21 sends the second certificate SE2.Cert to the second Bluetooth module 22, which is then sent to the first Bluetooth module 12 via the second Bluetooth module 22, and finally transmitted to the first security element 11; after the first security element 11 successfully verifies the second certificate SE2.Cert using the intermediate certificate DevOEM1.CACert, it sends the first certificate SE1.Cert to the second Bluetooth module 22 via the first Bluetooth module 12, and then sent to the second security element 21 via the second Bluetooth module 22. The second security element 21 uses the intermediate certificate DevOEM1.CACert to verify the first certificate SE1.Cert.

[0142] The first security element 11 uses the third private key SE1.SK and the fourth public key SE2.PK in the verified second certificate SE2.Cert to calculate the first shared key CK through the DH algorithm; the second security element 21 uses the fourth private key SE2.SK and the third public key SE1.PK in the verified first certificate SE1.Cert to calculate the first shared key CK through the DH algorithm. The first Bluetooth module 12 generates local Bluetooth pairing information OOB1, which is encrypted by the first security element 11 using the first shared key CK and sent to the second Bluetooth module 22 through the second channel. The second Bluetooth module 22 decrypts the encrypted data through the first security element 11 to obtain the other party's Bluetooth pairing information OOB1. The second Bluetooth module 22 also uses the same method to send the Bluetooth pairing information OOB2 to the first Bluetooth module 12, and after decryption by the first security element 11, the other party's Bluetooth pairing information OOB2 is obtained. The first Bluetooth module 12 and the second Bluetooth module 22 perform secure connection pairing based on the Bluetooth pairing information OOB1 and the Bluetooth pairing information OOB2.

[0143] In some embodiments, before S200, the process includes:

[0144] S710, receiving third security information sent by a first trusted service management, the third security information including a fifth public key generated by a second trusted service management, the first trusted service management is a trusted service management for managing a first electronic device, and the second trusted service management is a trusted service management for managing a second electronic device;

[0145] S720, generate a second random number, and encrypt the second random number using a fifth public key;

[0146] S730, sending the encrypted second random number to the second trusted service management via the first trusted service management;

[0147] S740: Establish a first secure channel with the second trusted service management based on the encrypted second random number.

[0148] In this embodiment, the first trusted service management authorizes the management of the first security element in the first electronic device, and a secure channel exists between the first electronic device and the first trusted service management, and the secure transmission of information can be achieved through the secure channel between the first electronic device and the first trusted service management. The second trusted service management authorizes the management of the second security element in the second electronic device, and a secure channel exists between the second electronic device and the second trusted service management, and the secure transmission of information can be achieved through the secure channel between the second electronic device and the second trusted service management.

[0149] It is because the first electronic device and the second electronic device are respectively managed by different trusted service managements. During the pairing process of the first electronic device and the second electronic device, the forwarding of information participated by the first trusted service management will lead to distrust of the second electronic device, and the forwarding of information participated by the second trusted service management will lead to distrust of the first electronic device. Through S710~S740, a first security channel is established between the first electronic device and the second trusted service management, and then information transmission between the first electronic device and the second trusted service management is realized through the first security channel, thereby eliminating the need for the first trusted service management to participate in the forwarding of information between the first electronic device and the second electronic device for Bluetooth pairing.

[0150] The second trusted service management can generate a fifth public key and a fifth private key, and the fifth public key and the fifth private key are a pair of keys. The fifth public key is transmitted to the first trusted service management through a trusted transmission method, for example: the fifth public key is transmitted offline through a storage medium such as a USB flash drive or a CD. The second trusted service management sends the fifth public key to the first trusted service management, so that the first trusted service management can send the third security information including the fifth public key to the first electronic device. The first electronic device generates a second random number, encrypts the second random number through the fifth public key, and sends the encrypted second random number to the first trusted service management. Since the first trusted service management does not have the fifth private key, the first trusted service management cannot decrypt and obtain the second random number. The first trusted service management sends the encrypted second random number to the second trusted service management, and the second trusted service management decrypts the encrypted second random number through the fifth private key to obtain the second random number, and the first electronic device and the second trusted service establish a first security channel through the second random number.

[0151] In some embodiments, S210 includes:

[0152] When the network state is connected to the network, negotiating a first shared key with the second electronic device via a first secure channel established with the second trusted service management;

[0153] In some other embodiments, S220 includes:

[0154] When the network status is disconnected, based on the first certificate pre-issued to the first electronic device by the second trusted service management through the first secure channel, and the second certificate pre-issued to the second electronic device by the second trusted service management through the first secure channel, the first shared key is negotiated with the second electronic device.

[0155] A first secure channel is established in advance between the first electronic device and the second trusted service management, so that when the first electronic device and the second electronic device are paired by Bluetooth in the case of a network connection, the first electronic device and the second electronic device both use the second trusted service management as a transfer party to forward data; the first certificate and the second certificate can be issued in advance by the second trusted service management, and when the first electronic device and the second electronic device are paired by Bluetooth in the case of a network disconnection, the first electronic device and the second electronic device can be paired by Bluetooth through the first certificate and the second certificate issued by the second trusted service management. The trusted service management involved in the aforementioned S100 to S400 is the second trusted service management.

[0156] In some embodiments, the third security information further includes signature information of the first trusted service management on the third public key; S720 includes:

[0157] S721, when the signature information of the third security information is successfully verified, generate a second random number, encrypt the second random number using the fifth public key, and sign the encrypted second random number;

[0158] The S730 includes:

[0159] S731, sending the signed second random number to the first trusted service management, so that the first trusted service management forwards the signed second random number to the second trusted service management, and the second trusted service management decrypts the encrypted second random number by the fifth private key matching the fifth public key when the signed second random number is successfully verified.

[0160] The first trusted service management can use the root certificate private key of the device OEM to sign the fifth public key and then send it to the first security element. The first security element verifies the signature of the third security information using the root certificate of the device OEM. The signature information of the third security information is successfully verified, confirming that the received fifth public key is legitimate, and improving the security of the fifth public key transmitted between the first electronic device and the first trusted service management.

[0161] The first security element randomly generates a second random number, encrypts it with the fifth public key, and then signs it with the private key of the self-supported digital certificate. The signed encrypted second random number and the digital certificate are sent to the first trusted service management, which then forwards it to the second trusted service management. The second trusted service management verifies the digital certificate using the root certificate of the manufacturer of the first security element, and then verifies whether the encrypted second random number is legal using the digital certificate, and finally decrypts it using the fifth private key to obtain the second random number. By adding a signature to the encrypted second random number, the encrypted second random number can be verified, thereby improving the security of the received second random number.

[0162] See also Figure 7and Figure 8 , exemplarily, the first trusted service management 3a manages the configuration of the first security element 11 so that the first security element 11 supports trusted pairing across different trusted service managements. The second trusted service management 3b generates a fifth private key AP.SK and a fifth public key AP.PK, and transmits the fifth public key AP.PK to the first trusted service management 3a; the first trusted service management 3a signs the fifth public key AP.PK using the root certificate private key of the device OEM2, and then sends it to the first security element 11; the first security element 11 verifies the signature using the root certificate of the device OEM2, and confirms that the fifth public key AP.PK is legitimate; the first security element 11 generates a second random number RK, and encrypts it using the fifth public key AP.PK and signs it using the private key of the digital certificate SE; the signed encrypted second random number RK and the digital certificate SE are sent to the second trusted service management 3b via the first trusted service management 3a; the second trusted service management 3b verifies the digital certificate SE using the root certificate of the manufacturer of the first security element 11, and then verifies whether the encrypted second random number RK is legitimate using the digital certificate SE, and decrypts it using the fifth private key AP.SK to obtain the second random number RK. A first secure channel may be established between the second trusted service management 3b and the first security element 11 according to the second random number RK, and the first trusted service management 3a cannot learn the second random number RK.

[0163] Optionally, the first electronic device and the second electronic device are devices produced by different manufacturers. The first electronic device is a vehicle, the second electronic device is a mobile phone, and the first electronic device and the second electronic device establish Bluetooth pairing so that the second electronic device can be used as a Bluetooth key to start the first electronic device.

[0164] The present application also provides another Bluetooth module pairing method, which is applied to a second electronic device, and the method includes:

[0165] S10, receiving a Bluetooth pairing broadcast sent by the first electronic device, where the Bluetooth pairing broadcast is sent by the first electronic device according to a network status between the first electronic device and the trusted service management;

[0166] S20, negotiating a first shared key with the first electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0167] S30, performing encrypted communication with the first electronic device based on the first shared key to obtain Bluetooth pairing information;

[0168] S40, establishing Bluetooth pairing with the first electronic device according to the Bluetooth pairing information;

[0169] Among them, S20 includes:

[0170] S21, when the network state is connected, negotiate a first shared key with the first electronic device via the trusted service management;

[0171] S22, when the network status is disconnected, negotiate a first shared key with the first electronic device based on the first certificate and the second certificate, the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

[0172] When the second electronic device executes S10 to S40, the first electronic device may execute S100 to S400 to achieve Bluetooth pairing between the first electronic device and the second electronic device, and the beneficial effects of the first electronic device executing S100 to S400 may be achieved, which will not be repeated here.

[0173] In some embodiments, S21 includes:

[0174] Upon receiving a first public key sent by the trusted service management through a secure channel, generating a second key pair, the second key pair including a second public key and a second private key, the first public key being generated for the first electronic device;

[0175] Sending the second public key to the trusted service management through a secure channel so that the trusted service management forwards the second public key to the first electronic device;

[0176] A first shared key is calculated based on the second private key and the first public key.

[0177] In some embodiments, S30 includes:

[0178] Receiving a first identity resolution key sent by the trusted service management through a secure channel, where the first identity resolution key is generated by the first electronic device;

[0179] When the Bluetooth pairing broadcast is successfully verified according to the first identity resolution key, a Bluetooth connection request is sent to the first electronic device, where the Bluetooth pairing broadcast carries the first identity resolution key;

[0180] Establishing a connection with the first electronic device according to the Bluetooth connection request;

[0181] The first shared key is used to perform encrypted communication with the first electronic device to obtain Bluetooth pairing information.

[0182] In some embodiments, S22 includes:

[0183] Receiving a first certificate sent by a first electronic device;

[0184] When the first certificate is verified successfully, the first shared key is parsed based on the pre-stored fourth private key and the third public key in the first certificate. The first certificate is a device entity certificate issued by the trusted service management for the third public key, and the second certificate is a device entity certificate issued by the trusted service management for the fourth public key. The fourth public key and the fourth private key are a paired key pair.

[0185] In some embodiments, S10 includes:

[0186] Receive the first device identification information input by the user, and scan the Bluetooth pairing broadcast sent by the first electronic device, the Bluetooth pairing broadcast includes a second identity resolution key and a first random number, the second identity resolution key is the first security information encrypted by the second shared key, the first security information is generated according to the first device identification information of the first electronic device and the first random number, and the second shared key is a key issued by the trusted service management;

[0187] Verify the second identity resolution key according to the first device identification information, the received first random number, and the pre-stored second shared key;

[0188] When the second identity resolution key is successfully verified, a Bluetooth connection request is sent to the first electronic device to establish a second channel with the first electronic device;

[0189] The second certificate is sent to the first electronic device through the second channel.

[0190] In some embodiments, before S22, the process includes:

[0191] S51, sending the second security information and the first identity resolution key in the Bluetooth pairing broadcast to the second trusted service management, so that the second trusted service management is forwarded to the first trusted service management, the first trusted service management is the trusted service management for managing the first electronic device, and the second trusted service management is the trusted service management for managing the second electronic device;

[0192] S52, receiving a signed sixth public key sent by the second trusted service manager, where the signed sixth public key is a public key generated by the first trusted service manager and signed by the second trusted service manager,

[0193] S53, when the signed sixth public key is successfully verified, generating a fourth random number, encrypting the fourth random number using the sixth public key, and signing the encrypted fourth random number;

[0194] S54, sending the signed fourth random number to the second trusted service management, so that the second trusted service management forwards the signed fourth random number to the first trusted service management, and the first trusted service management decrypts the signed fourth random number by using the sixth private key to obtain the fourth random number when the signed fourth random number is successfully verified, where the sixth private key and the sixth public key are a paired key pair;

[0195] S55: Establish a third secure channel with the first trusted service management based on the fourth random number.

[0196] The first trusted service management and the second trusted service management are different trusted service managements. When the first electronic device is disconnected from the network and the second electronic device needs to be paired with the first electronic device via Bluetooth, a third secure channel can be established between the second electronic device and the first trusted service management through S51 to S55, and data transmission can be achieved through the third secure channel, thereby achieving Bluetooth pairing between the first electronic device and the second electronic device.

[0197] The first electronic device may obtain the first certificate issued by the first trusted service management in advance, and when the first electronic device and the second electronic device are paired with each other via Bluetooth, the first electronic device may establish Bluetooth pairing with the second electronic device through the first certificate without connecting to the first trusted service management. The second electronic device may establish a third secure channel with the second trusted service management through Bluetooth pairing broadcast, and then obtain the second certificate issued by the first trusted service management.

[0198] The Bluetooth pairing broadcast sent by the first electronic device carries a resolvable random address, and the resolvable random address includes a third identity resolution key and a first random number. The first electronic device can refer to S120~S140 to send a Bluetooth pairing broadcast, and refer to the second identity resolution key to generate a third identity resolution key. The second electronic device scans the Bluetooth pairing broadcast sent by the first electronic device, and sends the device identification information expectedID of the electronic device to be connected, the third identity resolution key carried by the Bluetooth pairing broadcast, and the first random number to the second trusted service management, and the second trusted service management transmits the device identification information expectedID, the third identity resolution key and the first random number to the first trusted service management. The first trusted service management generates the first verification information according to the received device identification information expectedID and the first random number carried in the resolvable random address RPA, according to the preset rules used by the first electronic device when generating the first security information. Since the first trusted service management generates and stores the second shared key, the first trusted service management decrypts the first verification information through the second shared key. If the second verification information can be decrypted normally, the second verification information and the third identity resolution key in the resolvable random address are used for verification. If the decryption and verification are successful, it means that the second electronic device has correctly searched for the first electronic device. The first trusted service management generates the sixth public key and the sixth private key, and sends the sixth public key to the second trusted service management. The second trusted service management can sign the sixth public key to improve the security of the sixth public key transmitted to the second electronic device.

[0199] The second security element can generate a fourth random number, encrypt the fourth random number through the sixth public key, sign the encrypted fourth random number with the private key of the self-held digital certificate, and then send the encrypted and signed fourth random number and digital certificate to the first trusted service management through the second trusted service management. After the first trusted service management successfully verifies the device OEM root certificate of the second security element, it uses the sixth private key to decrypt and obtain the fourth random number. The second electronic device establishes a third security channel with the first trusted service management based on the fourth random number, and the second trusted service management cannot know the fourth random number.

[0200] S23 includes:

[0201] When the network status is disconnected, based on the first certificate pre-issued to the first electronic device by the first trusted service management and the second certificate pre-issued to the second electronic device by the first trusted service management through the third secure channel, the first shared key is negotiated with the first electronic device.

[0202] After the second electronic device establishes the third security channel with the first trusted service management based on the fourth random number, it can obtain the second certificate issued by the first trusted service management, and then negotiate the first shared key with the first electronic device through the first certificate and the second certificate.

[0203] For example, see Fig. 9 and Fig.10 , the first security element 11 randomly generates a first random number Salt, connects the first identity identification information ID and the first random number Salt, encrypts them using the second shared key EncKey1, obtains a third identity resolution key tIRK, uses the third identity resolution key tIRK to broadcast a resolvable random address RPA, and carries the first random number Salt in the broadcast data packet;

[0204] The second Bluetooth module 22 starts scanning, and transmits the first random number Salt and the resolvable random address RPA to the second security element 21. The second security element 21 transmits the expected identity information expectedID, the first random number Salt and the resolvable random address RPA to the first trusted service management 3a via the second trusted service management 3b;

[0205] The first trusted service management 3a uses the identity identification information expectedID and the first random number Salt to concatenate, and then encrypts it with the second shared secret key EncKey1 to obtain the first verification information. If the first verification information is consistent with the third identity resolution key tIRK, the verification is successful. The first trusted service management 3a returns the sixth public key AP.PK to the second trusted service management 3b. The second trusted service management 3b signs the sixth public key AP.PK with the private key of the device OEM and sends it back to the second security element 121.

[0206] After the second security element 21 successfully verifies the signature of the sixth public key AP.PK, it generates a fourth random number RK, encrypts the fourth random number RK using the sixth public key AP.PK, and signs it using the private key of the digital certificate SE;

[0207] The second security element 21 sends the encrypted and signed fourth random number RK and digital certificate SE to the first trusted service management 3a via the second trusted service management 3b. After the first trusted service management 3a successfully verifies the manufacturer's root certificate of the second security element 21, it uses the sixth private key AP.SK to decrypt and obtain the fourth random number RK; a third security channel can be established between the first trusted service management 3a and the second security element 21 based on the fourth random number RK.

[0208] The Bluetooth module pairing method provided in the embodiment of the present application can be executed by a Bluetooth module pairing device. In the embodiment of the present application, the Bluetooth module pairing method executed by the Bluetooth module pairing device is taken as an example to illustrate the Bluetooth module pairing device provided in the embodiment of the present application.

[0209] See also Fig.11 , Fig.11 is a schematic diagram of the structure of a Bluetooth module pairing device provided in another embodiment of the present application. Fig.11 As shown, the Bluetooth module pairing device may include:

[0210] The first broadcast module 111 is used to send a Bluetooth pairing broadcast according to the network status between the first electronic device and the trusted service management;

[0211] A first sharing module 112, configured to negotiate a first shared key with a second electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0212] The first communication module 113 is used to perform encrypted communication with the second electronic device based on the first shared key to obtain Bluetooth pairing information;

[0213] A first pairing module 114, configured to establish Bluetooth pairing with a second electronic device according to the Bluetooth pairing information;

[0214] The first sharing module 112 includes:

[0215] A first sharing unit is used to negotiate a first shared key with a second electronic device via a trusted service management when the network state is connected to the network;

[0216] The second sharing unit is used to negotiate a first shared key with the second electronic device based on the first certificate and the second certificate when the network status is disconnected, the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

[0217] In some embodiments, the first sharing unit is used to generate a first key pair when the network state is connected to the network, and the first key pair includes a first public key and a first private key;

[0218] sending the first public key to the trusted service management through a secure channel established with the trusted service management, so that the trusted service management forwards the first public key to the second electronic device;

[0219] Receiving a second public key sent by the trusted service management through a secure channel, where the second public key is a secret key generated by the second electronic device based on the first public key and sent to the trusted service management;

[0220] A first shared key is obtained by calculation according to the first private key and the second public key.

[0221] In some embodiments, the first broadcast module 111 is used to send a Bluetooth pairing broadcast when the network status is connected, and the Bluetooth pairing broadcast carries the first identity resolution key;

[0222] The first communication module 113 is used for:

[0223] Sending the first identity resolution key to the trusted service management through a secure channel, so that the trusted service management forwards the first identity resolution key to the second electronic device;

[0224] Receiving a Bluetooth connection request sent by a second electronic device according to the first identity resolution key;

[0225] Establishing a connection with a second electronic device according to the Bluetooth connection request;

[0226] The first shared key is used to perform encrypted communication with the second electronic device to obtain Bluetooth pairing information.

[0227] In some embodiments, the second sharing unit is used to receive a second certificate sent by the second electronic device when the network status is disconnected;

[0228] When the second certificate is successfully verified, the first shared key is parsed based on the pre-stored third private key and the fourth public key in the second certificate;

[0229] The first certificate is sent to the second electronic device, so that the second electronic device can parse the first shared key based on the pre-stored fourth private key and the third public key in the first certificate when the first certificate is successfully verified;

[0230] Among them, the first certificate is the device entity certificate issued by the trusted service management for the third public key, the third public key and the third private key are a paired key pair, and the second certificate is the device entity certificate issued by the trusted service management for the fourth public key, the fourth public key and the fourth private key are a paired key pair.

[0231] In some embodiments, the Bluetooth module pairing device further includes:

[0232] A first certificate signing request module, used to generate a third private key, a third public key and a certificate signing request related to the third public key, and send the certificate signing request to the trusted service management through a secure channel established with the trusted service management;

[0233] Receive the intermediate certificate and the first certificate sent by the trusted service management according to the certificate signing request, the intermediate certificate is a certificate issued by the trusted service management through the first root certificate, and the first certificate is a certificate issued by the trusted service management according to the private key of the intermediate certificate to the third public key;

[0234] The second sharing unit is also used to parse the first shared key based on the third private key and the fourth public key when the second certificate is successfully verified through the intermediate certificate. The second certificate is a certificate issued by the trusted service management based on the private key of the intermediate certificate to the fourth public key.

[0235] In some embodiments, the first broadcast module 111 is used to:

[0236] When the network state is disconnected, generating a first random number, and generating first security information according to the first device identification information of the first electronic device and the first random number;

[0237] The first security information is encrypted by a second shared key to obtain a second identity resolution key, where the second shared key is a key issued by the trusted service management;

[0238] Broadcasting a Bluetooth pairing broadcast carrying the second identity resolution key and the first random number, so that the second electronic device verifies the second identity resolution key according to the first device identification information, the received first random number and the pre-stored second shared key;

[0239] The Bluetooth module pairing device also includes:

[0240] A first connection module, used to receive a Bluetooth connection request sent by a second electronic device according to a successfully verified first identity resolution key;

[0241] Establishing a second channel with a second electronic device according to the Bluetooth connection request;

[0242] The second sharing unit is further used to receive a second certificate sent by the second electronic device through the second channel.

[0243] In some embodiments, the Bluetooth module pairing device further includes:

[0244] A first authentication module, configured to receive third security information sent by a first trusted service management, wherein the third security information includes a fifth public key generated by a second trusted service management, wherein the first trusted service management is a trusted service management for managing the first electronic device, and the second trusted service management is a trusted service management for managing the second electronic device;

[0245] Generate a second random number, and encrypt the second random number using the fifth public key;

[0246] Sending the encrypted second random number to the second trusted service management via the first trusted service management;

[0247] Establishing a first secure channel with a second trusted service management based on the encrypted second random number;

[0248] The first sharing unit is also used to negotiate a first shared key with the second electronic device via a first secure channel established with the second trusted service management when the network state is connected to the network;

[0249] The second sharing unit is also used to negotiate a first shared key with the second electronic device based on a first certificate pre-issued to the first electronic device by the second trusted service management through the first secure channel, and a second certificate pre-issued to the second electronic device by the second trusted service management through the first secure channel when the network status is disconnected.

[0250] In some embodiments, the third security information further includes signature information of the first trusted service management on the fifth public key; the first authentication module is further used to generate a second random number, encrypt the second random number by the fifth public key, and sign the encrypted second random number when the signature information of the third security information is successfully verified;

[0251] The signed second random number is sent to the first trusted service management, so that the first trusted service management forwards the signed second random number to the second trusted service management. When the second trusted service management successfully verifies the signed second random number, it decrypts the encrypted second random number using the fifth private key that matches the fifth public key.

[0252] Another embodiment of the present application also provides a Bluetooth module pairing device, which may include:

[0253] A second receiving module is used to receive a Bluetooth pairing broadcast sent by the first electronic device, where the Bluetooth pairing broadcast is sent by the first electronic device according to a network status between the first electronic device and the trusted service management;

[0254] A second sharing module, configured to negotiate a first shared key with the first electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0255] The second communication module is used to perform encrypted communication with the first electronic device based on the first shared secret key to obtain Bluetooth pairing information

[0256] A second pairing module, used to establish Bluetooth pairing with the first electronic device according to the Bluetooth pairing information;

[0257] Wherein, the second shared module includes:

[0258] A third sharing unit is used to negotiate a first shared key with the first electronic device via the trusted service management when the network state is connected to the network;

[0259] The fourth sharing unit is used to negotiate a first shared key with the first electronic device based on the first certificate and the second certificate when the network status is disconnected, the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

[0260] In some embodiments, the Bluetooth module pairing device further includes:

[0261] A second authentication module, used to send the third identity resolution key in the Bluetooth pairing broadcast to the second trusted service management, so that the second trusted service management is forwarded to the first trusted service management, the first trusted service management is the trusted service management for managing the first electronic device, and the second trusted service management is the trusted service management for managing the second electronic device;

[0262] receiving a signed sixth public key sent by the second trusted service manager, where the signed sixth public key is a public key generated by the first trusted service manager and signed by the second trusted service manager;

[0263] If the signed sixth public key is successfully verified, a fourth random number is generated, the fourth random number is encrypted using the sixth public key, and the encrypted fourth random number is signed;

[0264] Sending the signed fourth random number to the second trusted service management, so that the second trusted service management forwards the signed fourth random number to the first trusted service management, and the first trusted service management decrypts the signed fourth random number by using the sixth private key to obtain the fourth random number when the signed fourth random number is successfully verified, where the sixth private key and the sixth public key are a paired key pair;

[0265] Establishing a third secure channel with the first trusted service management based on the fourth random number;

[0266] The fourth sharing unit is used to negotiate a first shared key with the first electronic device based on a first certificate pre-issued to the first electronic device by the first trusted service management and a second certificate pre-issued to the second electronic device by the first trusted service management through a third secure channel when the network status is disconnected.

[0267] The Bluetooth module pairing device in the embodiment of the present application can be an electronic device, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or other devices other than a terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobilepersonal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), an ATM or a self-service machine, etc., augmented reality (augmented reality, AR), virtual reality (virtual reality, VR) equipment, etc., and the embodiment of the present application is not specifically limited.

[0268] The Bluetooth module pairing device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, a BlueOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0269] The Bluetooth module pairing device provided in the embodiment of the present application can achieve Figures 1 to 10 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0270] Alternatively, if Fig.12 As shown, an embodiment of the present application also provides an electronic device 100, including a processor 101 and a memory 102, wherein the memory 102 stores programs or instructions that can be executed on the processor 101, and when the program or instructions are executed by the processor 101, the various steps of the above-mentioned Bluetooth module pairing method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

[0271] It should be noted that the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.

[0272] Fig.13 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of the present application.

[0273] The electronic device 1000 includes but is not limited to components such as a radio frequency unit 1201, a network module 1202, an audio output unit 1203, an input unit 1204, a sensor 1205, a display unit 1206, a user input unit 1207, an interface unit 1208, a memory 1209, and a processor 1210.

[0274] Those skilled in the art will appreciate that the electronic device 1000 may also include a power source (such as a battery) for supplying power to each component, and the power source may be logically connected to the processor 1210 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Fig.13 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0275] The processor 1210 is used to send a Bluetooth pairing broadcast according to the network status between the first electronic device and the trusted service management;

[0276] The processor 1210 is configured to negotiate a first shared key with the second electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0277] The processor 1210 is configured to perform encrypted communication with the second electronic device based on the first shared key to obtain Bluetooth pairing information;

[0278] The processor 1210 is configured to establish Bluetooth pairing with the second electronic device according to the Bluetooth pairing information;

[0279] The processor 1210 is used to negotiate a first shared key with the second electronic device via the trusted service management when the network status is connected to the network;

[0280] Processor 1210 is used to negotiate a first shared key with a second electronic device based on a first certificate and a second certificate when the network status is disconnected, wherein the first certificate is a digital certificate pre-issued to the first electronic device by a trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by a trusted service management.

[0281] Optionally, the processor 1210 is configured to send the first public key to the trusted service management through a secure channel established with the trusted service management, so that the trusted service management forwards the first public key to the second electronic device;

[0282] The processor 1210 is used to receive a second public key sent by the trusted service management through a secure channel, where the second public key is a secret key generated by the second electronic device according to the first public key and sent to the trusted service management;

[0283] The processor 1210 is configured to calculate a first shared key according to the first private key and the second public key.

[0284] Optionally, the processor 1210 is configured to send a Bluetooth pairing broadcast when the network state is connected to the network, where the Bluetooth pairing broadcast carries the first identity resolution key;

[0285] The processor 1210 is used to send the first identity resolution key to the trusted service management through the secure channel, so that the trusted service management forwards the first identity resolution key to the second electronic device;

[0286] The processor 1210 is configured to receive a Bluetooth connection request sent by the second electronic device according to the first identity resolution key;

[0287] The processor 1210 is configured to establish a connection with the second electronic device according to the Bluetooth connection request;

[0288] The processor 1210 is configured to perform encrypted communication with the second electronic device using the first shared key to obtain Bluetooth pairing information.

[0289] Optionally, the processor 1210 is configured to receive a second certificate sent by a second electronic device when the network status is disconnected;

[0290] The processor 1210 is configured to parse out the first shared key based on the pre-stored third private key and the fourth public key in the second certificate when the second certificate is successfully verified;

[0291] The processor 1210 is configured to send the first certificate to the second electronic device, so that the second electronic device can parse the first shared key based on the pre-stored fourth private key and the third public key in the first certificate when the first certificate is successfully verified;

[0292] Among them, the first certificate is the device entity certificate issued by the trusted service management for the third public key, the third public key and the third private key are a paired key pair, and the second certificate is the device entity certificate issued by the trusted service management for the fourth public key, the fourth public key and the fourth private key are a paired key pair.

[0293] Optionally, the processor 1210 is configured to generate a third private key, a third public key, and a certificate signing request related to the third public key, and send the certificate signing request to the trusted service management through a secure channel established with the trusted service management;

[0294] The processor 1210 is used to receive the intermediate certificate and the first certificate sent by the trusted service management according to the certificate signing request, where the intermediate certificate is a certificate issued by the trusted service management through the first root certificate, and the first certificate is a certificate issued by the trusted service management according to the private key of the intermediate certificate to the third public key;

[0295] Processor 1210 is used to parse the first shared key based on the third private key and the fourth public key when the second certificate is successfully verified through the intermediate certificate. The second certificate is a certificate issued by the trusted service management based on the private key of the intermediate certificate to the fourth public key.

[0296] Optionally, the processor 1210 is configured to generate a first random number when the network state is disconnected, and generate first security information according to the first device identification information of the first electronic device and the first random number;

[0297] The processor 1210 is configured to encrypt the first security information by using a second shared key to obtain a second identity resolution key, where the second shared key is a key issued by the trusted service management;

[0298] The processor 1210 is used to broadcast a Bluetooth pairing broadcast carrying the second identity resolution key and the first random number, so that the second electronic device verifies the second identity resolution key according to the first device identification information, the received first random number and the pre-stored second shared key;

[0299] The processor 1210 is configured to receive a Bluetooth connection request sent by a second electronic device according to a successfully verified first identity resolution key;

[0300] The processor 1210 is configured to establish a second channel with a second electronic device according to a Bluetooth connection request;

[0301] The processor 1210 is configured to receive a second certificate sent by a second electronic device through a second channel.

[0302] Optionally, the processor 1210 is used to receive third security information sent by the first trusted service management, where the third security information includes a fifth public key generated by the second trusted service management, the first trusted service management is a trusted service management for managing the first electronic device, and the second trusted service management is a trusted service management for managing the second electronic device;

[0303] The processor 1210 is configured to generate a second random number, and encrypt the second random number using a fifth public key;

[0304] The processor 1210 is configured to send the encrypted second random number to the second trusted service management via the first trusted service management;

[0305] The processor 1210 is configured to establish a first secure channel with a second trusted service management based on the encrypted second random number;

[0306] The processor 1210 is configured to negotiate a first shared key with the second electronic device via a first secure channel established with a second trusted service management when the network state is connected to the network;

[0307] Processor 1210 is used to negotiate a first shared key with the second electronic device based on a first certificate pre-issued to the first electronic device by the second trusted service management through the first secure channel, and a second certificate pre-issued to the second electronic device by the second trusted service management through the first secure channel when the network status is disconnected.

[0308] Optionally, the third security information further includes signature information of the first trusted service management on the fifth public key; the processor 1210 is configured to generate a second random number, encrypt the second random number using the fifth public key, and sign the encrypted second random number when the signature information of the third security information is successfully verified;

[0309] Processor 1210 is used to send the signed second random number to the first trusted service management, so that the first trusted service management forwards the signed second random number to the second trusted service management. When the second trusted service management successfully verifies the signed second random number, it decrypts the encrypted second random number using the fifth private key that matches the fifth public key.

[0310] Another embodiment of the present application also provides an electronic device, in which the processor 1210 of the electronic device is used to receive a Bluetooth pairing broadcast sent by a first electronic device, where the Bluetooth pairing broadcast is sent by the first electronic device according to a network status between the first electronic device and the trusted service management;

[0311] The processor 1210 is configured to negotiate a first shared key with the first electronic device based on a negotiation rule matching the Bluetooth pairing broadcast;

[0312] The processor 1210 is used to perform encrypted communication with the first electronic device based on the first shared key to obtain Bluetooth pairing information. The processor 1210 is used to establish Bluetooth pairing with the first electronic device according to the Bluetooth pairing information;

[0313] The processor 1210 is used to negotiate a first shared key with the first electronic device via the trusted service management when the network status is connected to the network;

[0314] Processor 1210 is used to negotiate a first shared key with a first electronic device based on a first certificate and a second certificate when the network status is disconnected, wherein the first certificate is a digital certificate pre-issued to the first electronic device by a trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by a trusted service management.

[0315] In some embodiments, the processor 1210 is used to send the third identity resolution key in the Bluetooth pairing broadcast to the second trusted service management, so that the second trusted service management is forwarded to the first trusted service management, the first trusted service management is the trusted service management that manages the first electronic device, and the second trusted service management is the trusted service management that manages the second electronic device;

[0316] The processor 1210 is configured to receive a signed sixth public key sent by the second trusted service manager, where the signed sixth public key is a public key generated by the first trusted service manager and signed by the second trusted service manager;

[0317] The processor 1210 is configured to generate a fourth random number, encrypt the fourth random number using the sixth public key, and sign the encrypted fourth random number when the signed sixth public key is successfully verified;

[0318] The processor 1210 is configured to send the signed fourth random number to the second trusted service management, so that the second trusted service management forwards the signed fourth random number to the first trusted service management, and the first trusted service management decrypts the signed fourth random number by using the sixth private key to obtain the fourth random number when the signed fourth random number is successfully verified, where the sixth private key and the sixth public key are a paired key pair;

[0319] The processor 1210 is configured to establish a third secure channel with the first trusted service management based on the fourth random number;

[0320] Processor 1210 is used to negotiate a first shared key with the first electronic device based on a first certificate pre-issued to the first electronic device by the first trusted service management and a second certificate pre-issued to the second electronic device by the first trusted service management through a third secure channel when the network status is disconnected.

[0321] It should be understood that in the embodiment of the present application, the input unit 1204 may include a graphics processor (Graphics Processing Unit, GPU) 12041 and a microphone 12042, and the graphics processor 12041 processes the image data of the static picture or video obtained by the image capture device (such as a camera module) in the video capture mode or the image capture mode. The display unit 1206 may include a display panel 12061, and the display panel 12061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 1207 includes a touch panel 12071 and at least one of other input devices 12072. The touch panel 12071 is also called a touch screen. The touch panel 12071 may include two parts: a touch detection device and a touch controller. Other input devices 12072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0322] The memory 1209 can be used to store software programs and various data. The memory 1209 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 1209 may include a volatile memory or a non-volatile memory, or the memory 1209 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 1209 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0323] The processor 1210 may include one or more processing units; optionally, the processor 1210 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 1210.

[0324] The embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned Bluetooth module pairing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0325] The processor is the processor in the electronic device in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0326] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned Bluetooth module pairing method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0327] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0328] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned Bluetooth module pairing method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0329] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0330] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0331] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A Bluetooth module pairing method, characterized in that: Applied to a first electronic device, the method includes: Sending a Bluetooth pairing broadcast according to the network status between the first electronic device and the trusted service management; Negotiate a first shared key with a second electronic device based on a negotiation rule matching the Bluetooth pairing broadcast; Performing encrypted communication with the second electronic device based on the first shared key to obtain Bluetooth pairing information; Establishing Bluetooth pairing with the second electronic device according to the Bluetooth pairing information; The step of negotiating a first shared key with a second electronic device based on a negotiation rule matching the Bluetooth pairing broadcast includes: When the network state is connected to the network, negotiating a first shared key with the second electronic device via the trusted service management; When the network status is disconnected, a first shared key is negotiated with the second electronic device based on a first certificate and a second certificate, wherein the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

2. The Bluetooth module pairing method according to claim 1, characterized in that: When the network state is connected to the network, negotiating a first shared key with the second electronic device via the trusted service management includes: When the network state is connected to the network, generating a first key pair, wherein the first key pair includes a first public key and a first private key; sending the first public key to the trusted service management through a secure channel established with the trusted service management, so that the trusted service management forwards the first public key to the second electronic device; receiving a second public key sent by the trusted service management through the secure channel, where the second public key is a secret key generated by the second electronic device according to the first public key and sent to the trusted service management; A first shared key is calculated based on the first private key and the second public key.

3. The Bluetooth module pairing method according to claim 2, characterized in that: The sending of a Bluetooth pairing broadcast according to the network status between the first electronic device and the trusted service management includes: When the network state is connected, sending a Bluetooth pairing broadcast, wherein the Bluetooth pairing broadcast carries a first identity resolution key; The performing encrypted communication with the second electronic device based on the first shared key to obtain Bluetooth pairing information includes: Sending the first identity resolution key to the trusted service management through the secure channel, so that the trusted service management forwards the first identity resolution key to the second electronic device; Receiving a Bluetooth connection request sent by the second electronic device according to the first identity resolution key; Establishing a connection with the second electronic device according to the Bluetooth connection request; The first shared key is used to perform encrypted communication with the second electronic device to obtain Bluetooth pairing information.

4. The Bluetooth module pairing method according to claim 1, characterized in that: When the network state is disconnected, negotiating a first shared key with the second electronic device based on the first certificate and the second certificate includes: When the network status is disconnected, receiving the second certificate sent by the second electronic device; When the second certificate is successfully verified, the first shared key is parsed based on the pre-stored third private key and the fourth public key in the second certificate; The first certificate is sent to the second electronic device, so that the second electronic device can parse the first shared key based on the pre-stored fourth private key and the third public key in the first certificate when the first certificate is successfully verified; Among them, the first certificate is the device entity certificate issued by the trusted service management for the third public key, the third public key and the third private key are a paired key pair, and the second certificate is the device entity certificate issued by the trusted service management for the fourth public key, the fourth public key and the fourth private key are a paired key pair.

5. The Bluetooth module pairing method according to claim 4, characterized in that: Before sending a Bluetooth pairing broadcast according to the network status of the first electronic device and the trusted service management, the method includes: Generate the third private key, the third public key and a certificate signing request related to the third public key, and send the certificate signing request to the trusted service management through a secure channel established with the trusted service management; Receive an intermediate certificate and a first certificate sent by the trusted service management according to the certificate signing request, wherein the intermediate certificate is a certificate issued by the trusted service management through a first root certificate, and the first certificate is a certificate issued by the trusted service management according to the private key of the intermediate certificate to the third public key; The step of parsing the first shared key based on the pre-stored third private key and the fourth public key in the second certificate when the second certificate is successfully verified includes: When the second certificate is successfully verified by the intermediate certificate, the first shared key is parsed based on the third private key and the fourth public key, and the second certificate is a certificate issued by the trusted service management based on the private key of the intermediate certificate to the fourth public key.

6. The Bluetooth module pairing method according to claim 4, characterized in that: The sending of a Bluetooth pairing broadcast according to the network status between the first electronic device and the trusted service management includes: When the network state is disconnected, generating a first random number, and generating first security information according to the first device identification information of the first electronic device and the first random number; Encrypting the first security information by using a second shared key to obtain a second identity resolution key, where the second shared key is a key issued by the trusted service management; Broadcasting a Bluetooth pairing broadcast carrying the second identity resolution key and the first random number, so that the second electronic device verifies the second identity resolution key according to the first device identification information, the received first random number and the pre-stored second shared key; Before receiving the second certificate sent by the second electronic device, the method includes: Receiving a Bluetooth connection request sent by the second electronic device according to the second identity resolution key that has been successfully verified; Establishing a second channel with the second electronic device according to the Bluetooth connection request; The receiving the second certificate sent by the second electronic device includes: The second certificate is received, which is sent by the second electronic device through the second channel.

7. The Bluetooth module pairing method according to claim 1, characterized in that: Before negotiating the first shared key with the second electronic device based on the negotiation rule matching the Bluetooth pairing broadcast, the method includes: Receiving third security information sent by a first trusted service management, the third security information including a fifth public key generated by a second trusted service management, the first trusted service management being a trusted service management for managing the first electronic device, and the second trusted service management being a trusted service management for managing the second electronic device; Generate a second random number, and encrypt the second random number using the fifth public key; Sending the encrypted second random number to the second trusted service management via the first trusted service management; Establishing a first secure channel with the second trusted service management based on the encrypted second random number; When the network state is connected to the network, negotiating a first shared key with the second electronic device via the trusted service management includes: When the network state is connected to the network, negotiating a first shared key with the second electronic device via a first secure channel established with the second trusted service management; When the network state is disconnected, negotiating a first shared key with the second electronic device based on the first certificate and the second certificate includes: When the network status is disconnected, a first shared key is negotiated with the second electronic device based on a first certificate pre-issued to the first electronic device by the second trusted service management through the first secure channel, and a second certificate pre-issued to the second electronic device by the second trusted service management through the first secure channel.

8. The Bluetooth module pairing method according to claim 7, characterized in that: The third security information also includes signature information of the first trusted service management on the fifth public key; the generating a second random number and encrypting the second random number by using the fifth public key includes: If the signature information of the third security information is successfully verified, generating a second random number, encrypting the second random number by using the fifth public key, and signing the encrypted second random number; The step of sending the encrypted second random number to the second trusted service management via the first trusted service management comprises: The signed second random number is sent to the first trusted service management, so that the first trusted service management forwards the signed second random number to the second trusted service management, and the second trusted service management decrypts the encrypted second random number by the fifth private key matching the fifth public key when the signed second random number is successfully verified.

9. A Bluetooth module pairing method, characterized in that: Applied to a second electronic device, the method includes: Receiving a Bluetooth pairing broadcast sent by a first electronic device, where the Bluetooth pairing broadcast is sent by the first electronic device according to a network status between the first electronic device and a trusted service management device; Negotiate a first shared key with the first electronic device based on a negotiation rule matching the Bluetooth pairing broadcast; Performing encrypted communication with the first electronic device based on the first shared key to obtain Bluetooth pairing information; Establishing Bluetooth pairing with the first electronic device according to the Bluetooth pairing information; The step of negotiating a first shared key with the first electronic device based on a negotiation rule matching the Bluetooth pairing broadcast includes: When the network state is connected to the network, negotiating the first shared key with the first electronic device via the trusted service management; When the network status is disconnected, a first shared key is negotiated with the first electronic device based on a first certificate and a second certificate, wherein the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

10. The Bluetooth module pairing method according to claim 9, characterized in that: When the network state is disconnected, before negotiating the first shared key with the first electronic device based on the first certificate and the second certificate, the method includes: Sending the third identity resolution key in the Bluetooth pairing broadcast to a second trusted service management, so that the second trusted service management is forwarded to a first trusted service management, the first trusted service management is a trusted service management for managing the first electronic device, and the second trusted service management is a trusted service management for managing the second electronic device; receiving a signed sixth public key sent by the second trusted service manager, where the signed sixth public key is a public key generated by the first trusted service manager and signed by the second trusted service manager; In the case where the signed sixth public key is successfully verified, a fourth random number is generated, the fourth random number is encrypted by the sixth public key, and the encrypted fourth random number is signed; sending the signed fourth random number to the second trusted service management, so that the second trusted service management forwards the signed fourth random number to the first trusted service management, and the first trusted service management decrypts the signed fourth random number by using a sixth private key to obtain the fourth random number when the signed fourth random number is successfully verified, where the sixth private key and the sixth public key are a paired key pair; Establishing a third secure channel with the first trusted service management based on the fourth random number; When the network state is disconnected, negotiating a first shared key with the first electronic device based on the first certificate and the second certificate includes: When the network status is disconnected, a first shared key is negotiated with the first electronic device based on a first certificate pre-issued to the first electronic device by the first trusted service management and a second certificate pre-issued to the second electronic device by the first trusted service management through the third secure channel.

11. A Bluetooth module pairing device, characterized in that: include: A first broadcast module, configured to send a Bluetooth pairing broadcast according to a network status between the first electronic device and the trusted service management; A first sharing module, configured to negotiate a first shared key with a second electronic device based on a negotiation rule matching the Bluetooth pairing broadcast; A first communication module, configured to perform encrypted communication with the second electronic device based on the first shared key to obtain Bluetooth pairing information; A first pairing module, configured to establish Bluetooth pairing with the second electronic device according to the Bluetooth pairing information; Wherein, the first sharing module includes: A first sharing unit, configured to negotiate a first shared key with the second electronic device via the trusted service management when the network state is connected to the network; The second sharing unit is used to negotiate a first shared key with the second electronic device based on a first certificate and a second certificate when the network status is disconnected, wherein the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

12. A Bluetooth module pairing device, characterized in that: include: A second receiving module, configured to receive a Bluetooth pairing broadcast sent by a first electronic device, wherein the Bluetooth pairing broadcast is sent by the first electronic device according to a network status between the first electronic device and the trusted service management; A second sharing module, configured to negotiate a first shared key with the first electronic device based on a negotiation rule matching the Bluetooth pairing broadcast; The second communication module is used to perform encrypted communication with the first electronic device based on the first shared secret key to obtain Bluetooth pairing information A second pairing module, configured to establish Bluetooth pairing with the first electronic device according to the Bluetooth pairing information; Wherein, the second sharing module includes: A third sharing unit is used to negotiate a first shared key with the first electronic device via the trusted service management when the network state is connected to the network; The fourth sharing unit is used to negotiate a first shared key with the first electronic device based on a first certificate and a second certificate when the network status is disconnected, wherein the first certificate is a digital certificate pre-issued to the first electronic device by the trusted service management, and the second certificate is a digital certificate pre-issued to the second electronic device by the trusted service management.

13. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the Bluetooth module pairing method as described in any one of claims 1 to 8, or the steps of the Bluetooth module pairing method as described in claims 9 to 10 are implemented.

14. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the Bluetooth module pairing method as described in any one of claims 1-8 are implemented, or when the program or instruction is executed by the processor, the steps of the Bluetooth module pairing method as described in claims 9-10 are implemented.

Images