BLE-based device batch configuration method, system, device and storage medium

Abstract

The application discloses a kind of based on BLE's equipment batch configuration method, system, equipment and storage medium, it is related to information security technical field.The application in order to realize that server can be given client for data write and configuration in batches, first, when connecting, both will first be authenticated according to service UUID, judge whether it is same series equipment;If it is same series equipment, then carry out key negotiation, respectively with plaintext mode to inform the RSA public key of opposite party;Then using the way of asymmetric encryption to carry out data exchange, mutually send identity authentication information, respectively confirm the authenticity of opposite party;After confirming completion, server can be conveniently given client and write data.The application reduces the cost required for private data transmission, guarantees the security and high efficiency of data transmission between intelligent terminal equipment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, more particularly, it relates to a BLE (Bluetooth Low Energy) based device batch configuration method, system, device and storage medium. BACKGROUND

[0002] With the development of modern information technology, the production and possession of electronic devices are increasing, and in the production and use process, for products with too many personalized parameter configurations, how to perform batch configuration or convenient configuration according to the scene becomes more and more important. For example, how to batch write the same default value to all products in production; in life, some products need different configurations in different scenes, and this method can quickly and unobtrusively configure the devices entering the scene, and the distance-based authentication also ensures the universality of the scene setting and reduces the spatial conflict.

[0003] The current device batch configuration method is usually manually written data one by one. For example, the device to be configured is connected to the computer by wire or wireless, and then the data is manually written, but this use method needs to repeatedly write the same data to different devices when a large number of devices are configured, and the efficiency is relatively low. Or use a server to distribute the same configuration to the device when the device requests, but this configuration method repeatedly requests the same resource from the server, repeatedly performs the same operation, resulting in resource waste and low efficiency. Referring to "a batch device configuration method, device and configuration manager", Huang Zhiju, Li Lifeng, application number CN201811521383.1. SUMMARY

[0004] In view of the low efficiency of the device batch configuration in the prior art, the present application provides a BLE based device batch configuration method, system, device and storage medium, which realizes lightweight, secure intelligent terminal device batch configuration and information transmission, and ensures the convenient function of the intelligent terminal device in production and daily use.

[0005] A BLE based device batch configuration method, the specific steps are as follows:

[0006] Step 1, the server scans all the clients around, collects the device information of each client, and identifies the UUID (Universally Unique Identifier) of the client, judges whether each UUID is a specific service, if yes, the server actively establishes a BLE connection with the client; otherwise, these clients are ignored.

[0007] The device information includes a device BLE service UUID, a WIFI MAC address of the device, and a device identity recognition unique identification string. Specifically, the device identity recognition unique identification string is a macro definition during programming or information stored in SPIFFS. The UUID implicitly contains time information of the latest version configuration, and the UUID can be used as part of identity authentication.

[0008] The server identifies the UUID of the client, sends an access request to the client, and judges whether the server version is higher than the client by using a small amount of non-sensitive device information in the UUID of the server. If yes, the two directly establish a connection; otherwise, the access request is ignored.

[0009] After the server and the client are connected, the two exchange battery voltage data through plaintext transmission, calculate the distance between the two, and judge whether the distance meets the safety distance set by the server. If yes, step three is performed; otherwise, the connection between the two is disconnected.

[0010] The server performs multiple Bluetooth scans on the client, obtains the correct RSSI through filtering and calculation of the average value, and accurately calculates the Bluetooth power through the voltage data, and further calculates the accurate distance between the two.

[0011] In step three, the server and the client exchange RSA public keys through BLE, and save each other's public keys in the memory.

[0012] In step four, the server and the client send each other's identity information encrypted by the public key of the other party, and perform mutual identity authentication, and ensure that the other party can decrypt it with the private key after receiving it, and it will not be obtained by the intermediate person.

[0013] The identity information includes a WIFI MAC address and a device identity recognition unique identification string, and the device identity recognition unique identification string is data stored in any terminal and cannot be erased or modified.

[0014] The mutual identity authentication is as follows:

[0015] After receiving the encrypted identity information of the sender, the receiver uses its own RSA private key to decrypt the plaintext, compares the decrypted plaintext with the device information database stored in SPIFFS, checks whether the WIFI MAC exists, and compares whether the device identity recognition unique identification string and the WIFI MAC correspond. If both exist and correspond, the identity authentication is successful, the two maintain the connection, and data exchange is performed; otherwise, the identity authentication fails, one of the two actively disconnects the connection, the client UUID changes the implicit state information to identity authentication failure, and avoids the same server from connecting it again.

[0016] Step five, after identity authentication is completed, the client and the server keep the already constructed security channel to encrypt and protect subsequent data transmission, the server sends information to the client in cipher text, lets the client write new configuration, or obtains private information, meanwhile, the information contains time information, ensures that the client can generate a new UUID according to the information, carries new version information, and avoids secondary configuration.

[0017] Step six, after information transmission is completed, the client is disconnected with the server, at this time, the server will continue to scan, or select the next client from the existing scanning list to perform the same operation, until all clients in a specific space range of the server are written with the same information.

[0018] A BLE-based device batch configuration system, comprising:

[0019] A scanning module is used for scanning the UUID of the surrounding BLE device, and judging the information implied in the UUID, including whether the UUID is an authenticable device UUID and time information;

[0020] A key exchange module is used for directly sending the public key of the device through plaintext after the BLE connection is established.

[0021] A judgment authentication module is used for generating a random number through time and re-sending the encrypted information to the other party when the public key of the other party is received, and then using the private key to decrypt the received cipher text, and judging the correctness of the content according to the time to verify the correctness of the connection.

[0022] A data exchange module is used for keeping the existing encrypted connection, and sending the sensitive information encrypted by the public key of the other party through BLE.

[0023] A computer device, comprising a memory and a processor, the memory stores a computer program, and the processor executes the computer program to realize the steps of the above method.

[0024] A computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the steps of the above method.

[0025] The present application has the following beneficial effects:

[0026] (1) The BLE-based device batch configuration method of the present application proposes a "end-to-end" high-speed secure private information sharing mechanism with identity authentication, and any security authentication and data transmission task will be judged by the server according to the space condition, and a connection will be established with the client in the space range and meeting the version number low, and the configuration information will be transmitted by encryption. At the same time, the information stored in the SPIFFS memory of the server and the client will be downloaded through the public network server, which ensures that the information of the opposite device is included, and at the same time, it is stored locally in encryption. Such authentication mechanism and information sharing mechanism realize the end-to-end security authentication and encrypted data transmission between intelligent terminal devices, thereby greatly reducing the cost required for private data transmission and reducing the time cost of batch configuration.

[0027] (2) The BLE-based device batch configuration method of the present application uses RSSI ranging, and only in the specified range can the relevant operation be carried out, which ensures the safety in space and avoids the security problem, quantity problem and delay problem of data transmission through the server, greatly reducing the risk of information leakage.

[0028] (3) The BLE-based device batch configuration method of the present application will encrypt the identity information and any sensitive data and directly send them to all clients in the range through BLE batch, avoiding the huge burden of massive data transmission to the server, and also eliminating the security problem of sensitive data uploaded to the server.

[0029] (4) The BLE-based device batch configuration system of the present application realizes lightweight and secure batch information transmission and data sharing of intelligent terminal devices, ensures the safety and efficiency of data transmission between intelligent terminal devices, and avoids mutual interference. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 is a flowchart of the BLE-based device batch configuration method of the present application;

[0031] Figure 2 is a structural block diagram of the BLE-based device batch configuration system of the present application;

[0032] Figure 3 is a schematic diagram of the internal structure of the BLE-based device batch configuration computer device of the present application. DETAILED DESCRIPTION

[0033] The present application will be further described in detail below in combination with the drawings and examples.

[0034] In order to make the objects, features and advantages of the present application more apparent, the specific embodiments of the present application will be described in detail below with reference to the accompanying drawings. The present application is illustrated by several embodiments in the drawings. However, the present application can be realized in many different forms and is not limited to the embodiments described herein.

[0035] In the present application, unless otherwise explicitly specified and limited, the terms "client" and "server" are only used for the purpose of description, and cannot be understood as indicating or implying the relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined with "client" and "server" can be explicitly or implicitly included one or more of the features.

[0036] The present application will be described in detail below with reference to the accompanying drawings and embodiments.

[0037] The present application is a technology for identity authentication and configuration using BLE low-power Bluetooth, which is divided into BLE server and client. The server can write data and configure the client in batches. When connected, the two will first perform basic authentication according to the service UUID to determine whether they are the same series of devices. If they are the same series of devices, key negotiation will be performed, and the RSA public key of the other party will be notified in plaintext. Then, data exchange is performed using asymmetric encryption, and identity authentication information is sent to each other to confirm the authenticity of the other party. After the confirmation is completed, the server can conveniently write data to the client in batches.

[0038] A BLE-based device batch configuration method, as shown in Figure 1 , comprising:

[0039] Step 100, the server scans all Bluetooth device information around, judges the distance between the server and the client according to RSSI (Received Signal Strength Indication), and judges whether the two are connected for configuration according to UUID.

[0040] The device information includes: device BLE service UUID, device WiFi MAC address, and device identity recognition unique identification string. Specifically, the device identity recognition unique identification string can be a macro definition when programming or information stored in SPIFFS.

[0041] The server identifies the client according to the service UUID, judges that the service needs to be configured, and actively establishes a BLE connection. After connection, the battery voltage data will be exchanged first, which is not sensitive data, so it can be transmitted directly in plaintext. Then, the two will estimate the distance between them according to the received battery voltage data. After the measured distance meets the safety distance set by the server, the next operation is performed, otherwise the connection is disconnected.

[0042] The distance authentication between the server and the client includes:

[0043] After the connection is established, the server and the client directly transmit the battery voltage data to each other, and the server and the client will accurately calculate the Bluetooth power according to the voltage data, so as to facilitate the distance calculation.

[0044] Subsequently, the server can perform multiple Bluetooth scans according to the settings, filter and calculate the average value, obtain the correct RSSI, and calculate the accurate distance through the Bluetooth power. Only the client within the set distance range will maintain the connection to perform the next identity authentication step, otherwise the connection will be disconnected, so two servers with close distances can also configure the surrounding clients respectively without contention.

[0045] Step 200, after the server and the client establish a connection, the server and the client transmit the public key stored in the local SPIFFS memory to each other through BLE, and save the public key received from the other party in an array without non-volatile storage.

[0046] Step 300, after the public key exchange is completed, the server and the client transmit the identity information encrypted by the public key of the other party to each other, perform two-way identity authentication, ensure that the other party can decrypt it with the private key after receiving it without being obtained by the intermediate person, thereby ensuring the security of sensitive data in the identity authentication process.

[0047] Step 400, after the identity authentication is completed, the server transmits information to the client using the ciphertext, lets the client write new configurations, or obtains private information, at the same time, the information contains time, version number and other information, which ensures that the client can generate a new UUID according to the information, carries new version information, and avoids secondary configuration.

[0048] Step 500, after all information is transmitted, the server and the client disconnect the connection. The time for one-time configuration is in the order of milliseconds, so a large number of clients can also complete all configurations at a high speed within the range of the same server.

[0049] In practical application, the server scans the UUID of the surrounding device, and sends an access request to the client if the condition is met. The client judges whether the server version is higher than itself through a small amount of non-sensitive device information in the UUID of the server. If so, the two establish a connection. Then the client and the server send public keys to each other. After the public key exchange is completed, the identity authentication information encrypted with the public key of the other party is sent to the other party, and the two-way identity authentication is performed. After the two-way identity authentication of the client and the server is successful, the secure channel between the client and the server will be kept, and the subsequent data transmission will be encrypted and protected, so as to realize the end-to-end collaborative fast information exchange configuration system. The client and the server can be smart mobile phones, iPads and other smart terminal devices. Through this method, any smart terminal device can send local information as a server and perform security authentication at the same time. The two can realize high-speed batch secure information sharing between any smart terminal devices through lightweight BLE communication.

[0050] Further, when the client and the server perform key negotiation authentication, the client and the server receive the public key of the other party, and then perform a communication verification of the correctness of the public key. Specifically:

[0051] The two will generate a string of random numbers by connecting a string of numbers of digital year, month, day, hour and minute as a random number seed, and record the string of numbers. The random number is encrypted by the public key of the other party and sent to the other party. After receiving the ciphertext, the other party will decrypt it by its own private key, and obtain the random number after decryption. Because the time sent by the two parties must be the same (with minute as the minimum unit), the time stamp saved by itself is used as a seed to regenerate a random number and compare it with the decrypted plaintext. If they are consistent, it means success. If any party determines that they are not consistent, the connection will be disconnected. If the connection is maintained, the next step of identity authentication will be performed.

[0052] Further, the two-way identity authentication comprises:

[0053] After receiving the public key sent by the other party, the WIFI MAC address and the unique identifier stored in the SPIFFS memory of the device are encrypted by the public key of the other party and sent to the other party.

[0054] The receiving party decrypts the encrypted information using its own stored private key, compares the decrypted plaintext with the device information database stored in the SPIFFS memory, checks whether the WIFI MAC exists, and compares whether the unique identifier and the WIFI MAC correspond.

[0055] Specifically, the device unique identifier is encrypted and stored in any terminal, and is not erasable and modifiable. After the server and the client establish a connection, the public keys are exchanged, and then a bidirectional identity authentication request is issued, that is, the WIFI MAC address and the device identity recognition unique identifier string of the two are sent to each other, respectively. After the receiving terminal receives the ciphertext sent by the sender, the WIFI MAC address and the device identity recognition unique identifier string of the sender are obtained by decryption through the RSA private key, and are compared with the device table encrypted and stored in the SPIFFS non-volatile storage. The two will go through the same process. If the verification is successful, the two will maintain the connection and exchange data. Otherwise, the key negotiation authentication of the client and the server fails, indicating that the authentication is not passed, that is, any party does not have the right to access, or is fake, and the two are disconnected. The UUID of the client will be changed, indicating that it has not passed the verification of the server, avoiding the server and the client from connecting again.

[0056] Further, the client and the server use the RSA algorithm in the key negotiation authentication process. The client and the server will go through the same steps. The two can use the preset RSA public key and private key, or generate a new public key and private key before each connection. Then, only the public key of the client is sent to the other party in plaintext. Since the public key can only be used for encryption and cannot be used for decryption, man-in-the-middle attacks can be prevented. The private key is reserved, and after the other party sends the data encrypted by the public key, the private key is used for decryption to ensure the security of the channel.

[0057] Further, the client and the server respectively determine whether to continue to maintain the connection according to the device information, including:

[0058] If the client and the server identity authentication fails, either party disconnects and saves the information of the other party, and prepares to upload to the server after encryption. The cloud server will select whether to add the information of the device to the existing database through manual judgment and the like. Then, the server establishes a connection with some servers and updates the data of these servers. When the updated database and the client establish a connection and authenticate successfully, the database of the client is updated through the BLE method of the application.

[0059] After the database of the client is updated, if it establishes a connection with another server, an update database request is sent to the server before the information sharing is completed and the connection is disconnected. If the server accepts the request, all database data of the client will be obtained, and the local will be incrementally modified and saved.

[0060] The database is distributed to any server device by the cloud server, and it is possible to update all terminal device stored information after sufficient connection requests and data exchange.

[0061] As Figure 2 shown, the application also provides a BLE-based device batch configuration system, comprising:

[0062] The scanning module 10 is used for scanning the broadcast information of all BLE devices around the client, and the service will directly establish a connection with the client if the specific UUID is met;

[0063] The key exchange module 20 is used for exchanging RSA public keys after the client and the server establish a connection, so as to prepare for subsequent data transmission;

[0064] The judgment authentication module 30 is used for sending the device information of the other party encrypted by the public key of the other party to each other after the public key exchange is completed, and the receiver will use its own private key to decrypt and match the information in the local database;

[0065] The data exchange module 40 is used for maintaining the connection after completing the authentication, and sending the required transmission information encrypted by the RSA public key of the other party to the other party.

[0066] The above-mentioned various modules of the BLE-based device batch configuration system can be realized by software, hardware and their combinations. The above-mentioned various modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to call and execute the operations of the above-mentioned various modules by the processor.

[0067] Further, the scanning module 10 comprises:

[0068] The server scans all existing BLE devices around and traverses the service UUID information of the device. If it is judged as the client device of the application according to the UUID, and the distance of the device is calculated according to the device RSSI, if the set space condition is met, and the UUID is legal, a connection is established, and the key exchange module 20, the judgment authentication module 30 and the data exchange module 40 are sequentially entered into work. After the work of the key exchange module 20, the judgment authentication module 30 and the data exchange module 40 are completed, the scanning module 10 will continue to work, and then traverse all the client information scanned, if there are still devices meeting the conditions, the connection is established to perform the operations of the key exchange module 20, the judgment authentication module 30 and the data exchange module 40. The number of times can be set, and after completing a certain number of data transmissions, the scanning module is re-performed to obtain the information of the devices around. Since the BLE transmission data speed is very fast, for the legal devices within the space range, the configuration process can be quickly completed. The change of UUID will avoid repeated configuration, and the continuous work of the scanning module can also detect whether there are new devices in real time and establish new connections with them.

[0069] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing relevant hardware, such as Figure 3 As shown in the above-mentioned embodiments, the computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database, or other medium used in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0070] The technical features of the above-mentioned embodiments can be combined in any manner. In order to make the description simple, not all possible combinations of the technical features in the above-mentioned embodiments are described, however, as long as the combinations of the technical features do not contradict, they should be considered as the scope of the present application.

Claims

1. A BLE-based device bulk configuration system, characterized in that, The server realizes data writing and configuration to the client in batches through BLE transmission, including: A scanning module is used for scanning the UUID of the surrounding BLE device, and judging whether the information implied in the UUID contains a device UUID that can be authenticated and time information; A key exchange module is used for directly sending the public key of the server through plaintext after the server and the client establish a BLE connection; A judgment authentication module is used for generating a random number through time after the public key of the opposite party has been received, and re-sending it to the opposite party after encryption by the public key of the opposite party, and then using the private key of the server to decrypt after receiving the ciphertext of the opposite party, and then judging the correctness of the content according to the time to verify the correctness of the connection; A data exchange module is used for maintaining the existing encrypted connection between the two, and sending sensitive information encrypted by the public key of the opposite party through BLE.

2. The method for implementing batch configuration of devices by the BLE-based batch configuration system according to claim 1, wherein, The specific steps are as follows: Step one, the server scans all the clients around, and establishes a BLE connection with the client after screening; The process of the server screening the client is as follows: Firstly, the server collects the device information of each client, and identifies the UUID of the client to judge whether to connect with the client for configuration, if yes, the server actively establishes a BLE connection with the client; otherwise, these clients are ignored; Then, after the server and the client establish a BLE connection, they exchange battery voltage data through plaintext transmission, calculate the distance between them, and judge whether the distance meets the safety distance set by the server, if yes, execute step two; otherwise, disconnect the connection between them; Step two, the server and the client perform key negotiation authentication based on RSA algorithm through BLE connection, if the authentication is passed, execute step three; if the authentication fails, disconnect the connection between them, and update the UUID state information of the client; Step three, the client and the server maintain the existing secure channel to encrypt and protect the subsequent transmission data, the server sends information to the client with ciphertext, so that the client writes new configuration or obtains private information, at the same time, the client generates a new UUID according to the updated information, and carries new version information; Step four, after the information transmission is completed, the client disconnects with the server, at this time, returns to step two, the server continues to transmit information to the remaining unconfigured clients in the existing scanning list, until all the clients in the specific space range of the server are written with the same information; at the same time, the server scans again after a certain number of information transmission, if there is a new client, return to step one and establish a new connection with it.

3. The BLE-based device bulk configuration method of claim 2, wherein, The device information of the client includes: device BLE service UUID, device WIFI MAC address, device identity identification unique identifier string, and time information implied in the UUID of the latest version configuration.

4. The BLE-based device bulk configuration method according to claim 2 or 3, characterized in that, The server identifies the UUID of the client, sends an access request to the client, and the client judges whether the server version is higher than itself through the non-sensitive device information in the UUID of the server, if yes, the two directly establish a connection; otherwise, ignore the access request. 5.The BLE-based device bulk configuration method of claim 2, wherein, The distance calculation process between the server and the client is as follows: The server and the client accurately calculate the Bluetooth power according to the voltage data, and then the server performs several times of Bluetooth scanning, obtains the correct RSSI through filtering and calculating the average value, and calculates the accurate distance through the Bluetooth power. 6.The BLE-based device bulk configuration method of claim 2, wherein, The RSA algorithm-based key agreement authentication comprises: Firstly, the server and the client exchange RSA public keys through BLE connection, and save the public keys of each other in the memory; Then, the server and the client respectively encrypt their WIFI MAC addresses and device identification unique identification strings through the public key of the other party and send them to the other party, and perform bidirectional identity authentication.

7. The BLE-based device bulk configuration method of claim 6, wherein, After the public key exchange, the server and the client perform a communication to verify the correctness of the public key, specifically as follows: Firstly, the server and the client respectively generate a string of random numbers by taking a string of numbers composed of digital years, months, days, hours and minutes as a random number seed, and record the string of numbers, and send the random numbers encrypted through the public key of the other party to the other party; Then, after receiving the random number ciphertext, both sides decrypt the random number ciphertext through their own private keys, and obtain the random number after decryption; Finally, because the time random numbers sent by the two parties are necessarily the same, the time stamp saved by the self is taken as a seed to regenerate a random number, and the regenerated random number is compared with the decrypted plaintext, if they are consistent, it means success, and any party will disconnect the connection if they are inconsistent. 8.The BLE-based device bulk configuration method of claim 6, wherein, The bidirectional identity authentication specifically comprises: After receiving the encrypted identity information of the sender, the receiver decrypts the encrypted identity information using the RSA private key stored by the receiver, compares the decrypted plaintext with the device information database stored in the SPIFFS memory, checks whether the WIFI MAC exists, and compares whether the device identification unique identification string and the WIFI MAC correspond, if both exist and correspond, the identity authentication is successful, the two parties maintain the connection and exchange data; Otherwise, the identity authentication fails, one of the two parties actively disconnects the connection, and the client changes the implicit state information to identity authentication failure. 9.A computer device, comprising a memory and a processor, and characterized in that, The memory stores a computer program, and the processor executes the computer program to realize the steps of the method of any one of claims 2-8.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method of any one of claims 2-8.

Images