Low-power-consumption radio frequency encryption communication system

Abstract

The invention, which relates to the technical field of network security, discloses a low-power-consumption radio frequency encryption communication system comprising a front-end data acquisition module which communicates with a plurality of data acquisition terminals through a central gateway; the encryption channel establishment module quickly verifies the legality of the data acquisition terminal and the central gateway, dynamically generates a one-time shared session key as an encryption key, and optimizes an AES algorithm to perform encryption transmission on a plaintext data block; and the back-end result output module processes the decrypted transmission data and outputs a result according to a service demand. Through four-stage fusion of identity authentication, physical layer secret key, optimization encryption and data processing, the channel encryption problem is solved, a full-process security closed loop from physical world information collection to digital world application output is constructed, a session key is generated by using the physical characteristics of a wireless channel, and the security of the session key is improved. Each communication key is unique and unpredictable, the traditional static key reuse risk is thoroughly solved, and forward security is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a low-power radio frequency encryption communication system. Background Art

[0002] A low-power RF encrypted communication system combines RF communication and encryption technologies to provide secure and efficient wireless data transmission. With the rapid development of the Internet of Things (IoT), smart homes, connected vehicles, and health monitoring, the demand for low-power, high-security communications is increasing. Choosing the right encryption algorithm and optimization techniques is crucial to achieving low power consumption. Overly complex encryption algorithms increase computational burden and power consumption. RF communication involves spectrum allocation and management, and achieving efficient encrypted communication within limited spectrum resources is a challenge that needs to be addressed.

[0003] Currently, a Chinese invention patent application with application number CN201811146824.4 discloses an encryption method for radio frequency cards, comprising the following steps: reader activation → radio frequency card entry into the working area → radio frequency card feedback → client receiving signal → client initial encryption → client secondary encryption → client data transmission → data decryption by network server → data verification by network server → completion. This invention utilizes a rational process, and the product developed based on this process is compact and more practical, capable of integration with the internet. Using existing algorithms, the radio frequency card uses a different key each time it transmits information, achieving a one-time, one-pad encryption. This eliminates attackers from using exhaustive or interception methods to steal information from IC cards, and its widespread application has significant economic and social benefits. However, traditional low-power devices typically rely on pre-set static keys. Once leaked, the security of the entire system collapses. Traditional physical layer key generation involves complex computations and interactions, and traditional asymmetric encryption algorithms used for key negotiation are computationally intensive. Traditional data encryption transmission schemes are either insecure or energy-intensive. Summary of the Invention

[0004] The technical problem solved by the present invention is that traditional low-power devices usually rely on preset static keys. Once leaked, the security of the entire system will collapse. The calculation and interaction of the traditional physical layer key generation link are complex, and the traditional asymmetric encryption algorithm used for key negotiation has a huge amount of calculation. Traditional data encryption transmission schemes are either insecure or too energy-consuming.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: a low-power radio frequency encryption communication system, comprising a front-end data acquisition module, an encryption channel establishment module, and a back-end result output module: The front-end data acquisition module is used to collect information from the physical world and communicate with several data acquisition terminals through the central gateway; The encryption channel establishment module is used to quickly verify the legitimacy of the data acquisition terminal and the central gateway, dynamically generate a one-time shared session key, use the shared session key as the encryption key, and optimize the AES algorithm to encrypt and transmit plaintext data blocks; The back-end result output module is used to process the decrypted transmission data and output the results according to business needs.

[0006] Preferably, the front-end data acquisition module includes: Collecting information about the physical world through a data acquisition terminal, wherein the data acquisition terminal comprises a sensor, a low-power microcontroller, a radio frequency transceiver module, and a battery; Communicate with several data acquisition terminals through a central gateway, verify the identities of the data acquisition terminals respectively, and simultaneously perform operations of receiving data, processing data, and outputting data. The central gateway is composed of an advanced communication processor, a radio frequency transceiver processor, and a connection interface with the external network. The external network includes Ethernet, Wi-Fi, 4G and 5G networks.

[0007] Preferably, the process of collecting information by the data collection terminal includes: Step S11: When a preset terminal trigger condition is met, the data acquisition terminal is awakened from the initial dormant state. The terminal trigger condition includes a timer interrupt reaching a predetermined time, a sensor detecting a value exceeding a threshold, and an external physical button being pressed. Step S12: After being awakened, the data acquisition terminal immediately controls the currently connected sensor to measure raw data, and temporarily stores the measured raw data in the memory; Step S13: When the memory is full, the data acquisition terminal sends a packaged predefined communication request signal to the central gateway.

[0008] Preferably, the encrypted channel establishment module includes a lightweight identity authentication unit, a session key generation and negotiation unit, and an optimized AES encrypted data transmission unit, wherein the lightweight identity authentication unit includes: Step S201: The central gateway generates a random number and broadcasts or sends it to the terminal to be authenticated via a radio frequency channel; Step S202: After receiving the random number fed back by the central gateway, the data collection terminal concatenates the unique identity key preset in the current device of the data collection terminal and the random number as input data, calculates and authenticates the input data into a token Token through a lightweight hash function, and sends it to the central gateway; Step S203: When the central gateway receives the token Token, it retrieves the corresponding unique identity key and the original pre-generated random number stored in the local database, calculates the expected token Expected_Token twice using the same lightweight hash function as the data collection terminal, and compares the token Token with the expected token Expected_Token; If the token Token is consistent with the expected token Expected_Token, the authentication is successful; If the token Token is inconsistent with the expected token Expected_Token, the current authentication result is recorded as an illegal access attempt, the communication channel is closed, and the currently requested data acquisition terminal is ignored.

[0009] Preferably, the session key generation and negotiation unit includes: Step S211: The central gateway sends a predefined pilot pseudo-random binary sequence to the data acquisition terminal in current communication. The data acquisition terminal performs channel estimation based on the pilot pseudo-random binary sequence to obtain channel state information of the data acquisition terminal, where the channel state information includes channel amplitude and phase characteristics. Step S212: the data acquisition terminal sends a pilot pseudo-random binary sequence in reverse to the central gateway, and the central gateway obtains the channel state information of the central gateway according to step S32; Step S212: converting the channel state information of the data acquisition terminal and the central gateway into a binary key respectively through a quantization rule; Step S213: Using a lightweight information negotiation protocol, the terminal initial key and the gateway initial key are grouped into 8-bit segments. The data acquisition terminal sends the parity bits of each group to the central gateway. The central gateway compares the received parity bits with the local parity bits of the central gateway. If the comparison results are consistent, the terminal initial key and the gateway initial key of the current group are verified to be correct; If the comparison results are inconsistent, it is marked that there is an error bit in the terminal initial key and the gateway initial key of the current group. The error bit position is located and corrected through binary search method; Step S214: Repeat step S213 until the verification results of all groups are correct, and finally obtain a completely consistent shared session key.

[0010] Preferably, the quantization rules include: Setting a channel amplitude threshold, and discretizing continuous amplitude values ​​into 0 or 1 bits according to the channel amplitude threshold. The discretization process includes discretizing amplitude values ​​exceeding the channel amplitude threshold into 1 and amplitude values ​​below the channel amplitude threshold into 0. Discretizing the phase information includes: quantizing the phase information with a phase difference exceeding π / 2 radians to 1, and quantizing the phase information with a phase difference less than π / 2 radians to 0; The terminal initial key of the data acquisition terminal and the gateway initial key generated by the central gateway are obtained respectively.

[0011] Preferably, the optimized AES encrypted data transmission unit includes: Step S221: The data collection terminal and the central gateway generate n groups of round keys based on the shared session key using the AES key expansion algorithm. Each group of round keys corresponds to 128 bits. The S-box and the inverse S-box of each group of round keys are pre-stored in a read-only memory ROM. Step S222: Optimizing the AES key expansion algorithm, the optimization includes performing multiple rounds of encryption on the transmitted plaintext data block at the data acquisition terminal side; Step S223: The optimization includes performing a decryption operation on the transmitted plaintext data block at the central gateway side. The decryption operation includes: performing a nonlinear replacement on the current group ciphertext using an inverse S-box, performing an inverse cyclic shift on each row, performing an inverse column obfuscation operation on each column, performing an XOR operation on the current decryption state matrix and the round key, and restoring the original plaintext data; Step S224: After the data transmission is completed, the shared session key and all round keys are erased from the memory.

[0012] Preferably, the multi-round encryption process includes: Step S2221: Perform an XOR operation on the plaintext data block and the round key of round 0 to obtain an initial state; Step S2222: Perform encryption operation on the data collection terminal side, the encryption operation includes 9 rounds of iterations; Step S2223: Perform nonlinear replacement of the bytes in the state matrix twice using S-boxes, perform cyclic shift on each row of the state matrix, perform XOR operation on the current state matrix and the round key of the last round, and obtain the current 128-bit group ciphertext.

[0013] Preferably, each of the 9 iterations includes: Step S22221: Use predefined S-boxes to perform nonlinear replacement on each byte to enhance obfuscation; Step S22222: cyclically shift each row of the state matrix, with the specific shift times being 0, 1, 2, or 3 bytes; Step S22223: perform finite field multiplication on each column of the state matrix; Step S22224: perform an XOR operation on the current state matrix and the round key of this round.

[0014] The key is changed for each communication, giving the system dynamic defense capabilities. Even if an attacker manages to decrypt a single communication at great expense, the long-term security of the system cannot be threatened, making it perfectly suited for long-term, unattended deployment environments.

[0015] Preferably, the backend result output module includes: Step S31: The central gateway pre-processes the decrypted original plaintext data. The pre-processing includes: Record the exact time of data collection, check whether the original plaintext data is within the preset range, mark it as abnormal if it exceeds the preset range, and compare it with the average and extreme values ​​of the data in the past 24 hours to identify sudden changes in data; Step S32: The processed data is stored in the local database of the central gateway and encrypted and uploaded to the cloud platform via the TLS / HTTPS protocol; Step S33: Sending control instructions to other devices according to preset rules; Step S34: After receiving the encrypted ACK confirmation from the central gateway or completing data transmission, the data acquisition terminal turns off the RF module and sensor power supply and enters a low-power sleep mode, retaining only the real-time clock RTC to maintain timing, waiting for the next trigger event, which includes timed wake-up and external interrupt, to complete a complete working cycle.

[0016] Beneficial effects of the present invention: The present invention not only solves the channel encryption problem through the integration of the four stages of "identity authentication-physical layer key-optimized encryption-data processing", but also builds a full-process security closed loop from "physical world information collection" to "digital world application output", ensuring the security of the entire link from data collection to application output, and using the physical characteristics of the wireless channel to generate session keys. Each communication key is unique and unpredictable, which completely solves the risk of traditional static key reuse and has forward security. The "authentication first, then negotiation" design avoids invalid devices from consuming key negotiation resources; the physical layer key and AES encryption complement each other to resist various threats such as man-in-the-middle attacks and replay attacks. It seamlessly connects to the existing Internet of Things architecture, supports diversified outputs such as local storage, cloud reporting, sound and light alarms, and device linkage, and meets the needs of scenarios such as industrial monitoring and smart homes. This method achieves a delicate balance between "strong security" and "low power consumption" in algorithm selection. It avoids this and instead adopts an innovative approach based on physical channels. At the same time, during the data encryption stage, it does not sacrifice security for the pursuit of low power consumption. Instead, it selects the international standard encryption algorithm AES and adopts an implementation solution optimized for embedded systems. It can not only enjoy the standardized and high-strength encryption protection brought by AES-128, but also adapt to the limited computing power of low-power microcontrollers, making high-level security protection possible on low-cost IoT devices. The design of "event triggering + lightweight authentication + dynamic key" ensures that the data collection terminal only works when necessary, and the authentication overhead is extremely low, greatly extending battery life. This combination enables this method to be widely used in various RF communication scenarios with strict requirements on cost, power consumption and security, solving the dilemma that traditional solutions are either unsafe or too energy-consuming. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic diagram of the basic flow of a low-power radio frequency encryption communication system provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0019] Reference Figure 1 , as an embodiment of the present invention, provides a low-power radio frequency encryption communication system, including a front-end data acquisition module, an encryption channel establishment module and a back-end result output module: The front-end data acquisition module is used to collect information from the physical world and communicate with several data acquisition terminals through the central gateway; The encryption channel establishment module is used to quickly verify the legitimacy of the data acquisition terminal and the central gateway, dynamically generate a one-time shared session key, use the shared session key as the encryption key, and optimize the AES algorithm to encrypt and transmit plaintext data blocks; The back-end result output module is used to process the decrypted transmission data and output the results according to business needs.

[0020] This system is a complete end-to-end solution designed for resource-constrained, low-power devices in scenarios such as the Internet of Things and wireless sensor networks. It aims to securely and reliably complete the entire process from front-end information collection, encrypted channel establishment, and confidential data transmission to back-end result output. The core of the system lies in the integration of lightweight identity authentication, dynamic key generation based on the physical characteristics of wireless channels, and the AES encryption algorithm optimized for embedded devices. The result is a secure communication system that can resist eavesdropping and forgery attacks while minimizing the energy consumption of terminal devices.

[0021] The front-end data acquisition module includes: Collect information about the physical world through a data acquisition terminal, which consists of a sensor, a low-power microcontroller, a radio frequency transceiver module, and a battery; It communicates with several data acquisition terminals through the central gateway, verifies the identities of the data acquisition terminals respectively, and simultaneously performs operations of receiving data, processing data, and outputting data. The central gateway is composed of an advanced communication processor, a radio frequency transceiver processor, and a connection interface with the external network. The external network includes Ethernet, Wi-Fi, 4G and 5G networks.

[0022] The process of collecting information by the data collection terminal includes: Step S11: When a preset terminal trigger condition is met, the data acquisition terminal is awakened from the initial dormant state. The terminal trigger condition includes a timer interrupt reaching a predetermined time, a sensor detecting a value exceeding a threshold, and an external physical button being pressed. Step S12: After being awakened, the data acquisition terminal immediately controls the currently connected sensor to measure raw data, and temporarily stores the measured raw data in the memory; Step S13: When the memory is full, the data acquisition terminal sends a packaged predefined communication request signal to the central gateway, informing the central gateway that there is data that needs to be reported.

[0023] The encrypted channel establishment module includes a lightweight identity authentication unit, a session key generation and negotiation unit, and an optimized AES encryption data transmission unit. The lightweight identity authentication unit includes: The lightweight identity authentication unit is used to quickly verify the legitimacy of terminals and gateways without consuming a large amount of computing resources, prevent malicious devices from entering subsequent processes, and defend against resource-consuming attacks.

[0024] Step S201: The central gateway generates a random number and broadcasts it to the terminal to be authenticated via a radio frequency channel or sends it in a targeted manner. The random number challenge ensures that the initial interaction of each communication is unpredictable to avoid replay attacks. Step S202: After the data acquisition terminal receives the random number fed back by the central gateway, it concatenates the unique identity key preset in the current device of the data acquisition terminal and the random number as input data, calculates and authenticates the input data as a token through a lightweight hash function, and sends it to the central gateway. By utilizing the privacy of the unique identity key and the irreversibility of the hash function, it ensures that only the data acquisition terminal holding the legal unique identity key can generate the correct token, and the calculation overhead is extremely low, which is suitable for low-power terminals; Step S203: When the central gateway receives the token Token, it retrieves the corresponding unique identity key and the original pre-generated random number stored in the local database, calculates the expected token Expected_Token twice using the same lightweight hash function as the data collection terminal, and compares the token Token with the expected token Expected_Token; If the token Token is consistent with the expected token Expected_Token, the authentication is successful; If the token Token is inconsistent with the expected token Expected_Token, the current authentication result is recorded as an illegal access attempt, the communication channel is closed, and the currently requested data acquisition terminal is ignored.

[0025] This quickly screens legitimate devices and prevents unauthorized devices from entering the key negotiation phase, reducing the risk of subsequent attacks. Illegal devices are rejected during the first phase of lightweight authentication, preventing them from consuming the power and computing resources of legitimate devices by continuously initiating key negotiation requests. Only authenticated legitimate devices can proceed to the subsequent process, avoiding wasted resources with invalid devices. This is crucial for low-power devices, where power is extremely precious.

[0026] The session key generation and negotiation unit includes: By leveraging the physical properties of wireless channels, such as reciprocity, a one-time session key S_Key is dynamically generated to implement one-time-one-pad, ensuring that the key is unpredictable and non-reusable, thereby improving forward security.

[0027] Step S211: The central gateway sends a predefined pilot pseudo-random binary sequence to the data acquisition terminal in current communication. The data acquisition terminal performs channel estimation based on the pilot pseudo-random binary sequence and obtains the channel state information of the data acquisition terminal. The channel state information includes channel amplitude and phase characteristics. Step S212: The data acquisition terminal sends a pilot pseudo-random binary sequence in reverse to the central gateway, and the central gateway obtains the channel state information of the central gateway according to step S32; The reciprocity of the wireless channel (in a short period of time, the channel characteristics of A→B and B→A are highly similar) ensures that the channel status information of the central gateway and the channel status information of the data acquisition terminal are theoretically consistent (in reality, there are slight differences due to noise).

[0028] Step S212: converting the channel state information of the data acquisition terminal and the central gateway into a binary key respectively through a quantization rule; Step S213: Using a lightweight information negotiation protocol, such as parity-based error correction, the terminal initial key and the gateway initial key are grouped into 8-bit segments. The data acquisition terminal sends the parity bits of each group to the central gateway. The central gateway compares the received parity bits with the local parity bits of the central gateway. If the comparison results are consistent, the terminal initial key and the gateway initial key of the current group are verified to be correct; If the comparison results are inconsistent, it is marked that there is an error bit in the terminal initial key and the gateway initial key of the current group. The error bit is located and corrected (flipped) by binary search. Step S214: Repeat step S213 until the verification results of all groups are correct, and finally a completely consistent shared session key is obtained; a small amount of verification information (not the key itself) is exchanged through an open channel to correct the difference without leaking the key, ensuring that the keys of both parties are consistent and that an eavesdropper cannot obtain the complete key.

[0029] Quantification rules include: Setting a channel amplitude threshold, and discretizing continuous amplitude values ​​into 0 or 1 bits according to the channel amplitude threshold. The discretization process includes discretizing amplitude values ​​exceeding the channel amplitude threshold into 1 and amplitude values ​​below the channel amplitude threshold into 0. Discretizing the phase information includes: quantizing the phase information with a phase difference exceeding π / 2 radians to 1, and quantizing the phase information with a phase difference less than π / 2 radians to 0; The terminal initial key of the data acquisition terminal and the gateway initial key generated by the central gateway are obtained respectively.

[0030] Optimized AES encrypted data transmission unit includes: Both parties use the shared session key generated in the previous step as the encryption key to encrypt and transmit the actual business data. Taking into account the computing power and memory limitations of low-power devices, an optimized AES algorithm is used to balance the high security of AES with the computing limitations of low-power devices.

[0031] Step S221: The data acquisition terminal and the central gateway generate n sets of round keys based on the shared session key using the AES key expansion algorithm, where n is a manually set optimal natural number. Each set of round keys corresponds to 128 bits. For an 8-bit single-chip microcomputer, the S-box and inverse S-box of each set of round keys are pre-stored in a read-only memory (ROM) to avoid real-time calculation and reduce CPU overhead. Step S222: Optimizing the AES key expansion algorithm, the optimization includes performing multiple rounds of encryption on the transmitted plaintext data block at the data acquisition terminal side; Step S223: The optimization includes performing a decryption operation on the transmitted plaintext data block at the central gateway side. The decryption operation includes: performing a nonlinear replacement on the current group ciphertext using an inverse S-box, performing an inverse cyclic shift on each row, performing an inverse column obfuscation operation on each column, performing an XOR operation on the current decryption state matrix and the round key, and restoring the original plaintext data; Step S224: After the data transmission is completed, the shared session key and all round keys are erased from the memory.

[0032] To ensure forward security, these keys must be overwritten with random values ​​to prevent attackers from decrypting historical or future communication data after obtaining a session key.

[0033] Through the above steps, the secure transmission of data is ensured and the performance of the encryption process is optimized to adapt to low-power and resource-constrained hardware environments.

[0034] Optimizations also include using lookup tables to accelerate S-box and column confusion calculations, as well as streamlining code implementation to reduce memory usage and instruction cycles.

[0035] The multi-round encryption process includes: Step S2221: Perform an XOR operation on the plaintext data block and the round key of round 0 to obtain an initial state; Step S2222: Perform encryption operation on the data collection terminal side, the encryption operation includes 9 rounds of iterations; Step S2223: Perform nonlinear replacement of the bytes in the state matrix twice using S-boxes, perform cyclic shift on each row of the state matrix, perform XOR operation on the current state matrix and the round key of the last round, and obtain the current 128-bit group ciphertext.

[0036] Each of the 9 iterations consists of: Step S22221: Use predefined S-boxes to perform nonlinear replacement on each byte to enhance obfuscation; Step S22222: cyclically shift each row of the state matrix by 0, 1, 2, or 3 bytes to enhance diffusion. Step S22223: perform finite field multiplication on each column of the state matrix to enhance diffusion; this step is omitted in the final round; Step S22224: perform an XOR operation on the current state matrix and the round key of this round.

[0037] The key is changed for each communication, giving the system dynamic defense capabilities. Even if an attacker manages to decrypt a single communication at great expense, the long-term security of the system cannot be threatened, making it perfectly suited for long-term, unattended deployment environments.

[0038] The backend result output modules include: The encrypted data transmission module is used to perform in-depth processing on the decrypted transmission data and output the results according to business needs, completing the complete closed loop of "perception-transmission-application".

[0039] Step S31: The central gateway pre-processes the decrypted original plaintext data. The pre-processing includes: Record the exact time of data collection, check whether the original plaintext data is within the preset range, mark it as abnormal if it exceeds the preset range, and compare it with the average and extreme values ​​of the data in the past 24 hours to identify sudden changes in data; Step S32: The processed data is stored in the local database of the central gateway and encrypted and uploaded to the cloud platform via TLS / HTTPS protocol for real-time monitoring by mobile app or web terminal, such as temperature curve visualization; Step S33: Send control instructions to other devices according to preset rules. For example, when the temperature is ≥30°C, turn off the air conditioner power supply or turn on the fan via the 485 bus. Step S34: After receiving the encrypted ACK confirmation from the central gateway or completing data transmission, the data acquisition terminal turns off the RF module and sensor power supply and enters low-power sleep mode. The low-power sleep mode is set to a current of ≤1μA, and only the real-time clock RTC is retained to maintain timing, waiting for the next trigger event. The trigger event includes timed wake-up and external interruption to complete a complete working cycle.

[0040] The present invention not only solves the channel encryption problem through the integration of the four stages of "identity authentication-physical layer key-optimized encryption-data processing", but also builds a full-process security closed loop from "physical world information collection" to "digital world application output", ensuring the security of the entire link from data collection to application output. The physical characteristics of the wireless channel are used to generate session keys. Each communication key is unique and unpredictable, which completely solves the risk of traditional static key reuse and has forward security. The "authentication first, then negotiation" design avoids invalid devices from consuming key negotiation resources; the physical layer key and AES encryption complement each other to resist various threats such as man-in-the-middle attacks and replay attacks. It seamlessly connects to the existing Internet of Things architecture, supports diversified outputs such as local storage, cloud reporting, sound and light alarms, and device linkage, and meets the needs of scenarios such as industrial monitoring and smart homes. This method achieves a delicate balance between "strong security" and "low power consumption" in algorithm selection. It avoids this and instead adopts an innovative approach based on physical channels. At the same time, during the data encryption stage, it does not sacrifice security for the pursuit of low power consumption. Instead, it selects the international standard encryption algorithm AES and adopts an implementation solution optimized for embedded systems. It can not only enjoy the standardized and high-strength encryption protection brought by AES-128, but also adapt to the limited computing power of low-power microcontrollers, making high-level security protection possible on low-cost IoT devices. The design of "event triggering + lightweight authentication + dynamic key" ensures that the data collection terminal only works when necessary, and the authentication overhead is extremely low, greatly extending battery life. This combination enables this method to be widely used in various RF communication scenarios with strict requirements on cost, power consumption and security, solving the dilemma that traditional solutions are either unsafe or too energy-consuming.

[0041] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium may be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0042] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A low-power radio frequency encryption communication system, characterized in that: It includes front-end data acquisition module, encryption channel establishment module and back-end result output module: The front-end data acquisition module is used to collect information from the physical world and communicate with several data acquisition terminals through the central gateway; The encryption channel establishment module is used to quickly verify the legitimacy of the data acquisition terminal and the central gateway, dynamically generate a one-time shared session key, use the shared session key as the encryption key, and optimize the AES algorithm to encrypt and transmit plaintext data blocks; The back-end result output module is used to process the decrypted transmission data and output the results according to business needs.

2. The low-power radio frequency encryption communication system according to claim 1, wherein: The front-end data acquisition module includes: Collecting information about the physical world through a data acquisition terminal, wherein the data acquisition terminal comprises a sensor, a low-power microcontroller, a radio frequency transceiver module, and a battery; Communicate with several data acquisition terminals through a central gateway, verify the identities of the data acquisition terminals respectively, and simultaneously perform operations of receiving data, processing data, and outputting data. The central gateway is composed of an advanced communication processor, a radio frequency transceiver processor, and a connection interface with the external network. The external network includes Ethernet, Wi-Fi, 4G and 5G networks.

3. The low-power radio frequency encryption communication system according to claim 2, wherein: The process of collecting information by the data collection terminal includes: Step S11: When a preset terminal trigger condition is met, the data acquisition terminal is awakened from the initial dormant state. The terminal trigger condition includes a timer interrupt reaching a predetermined time, a sensor detecting a value exceeding a threshold, and an external physical button being pressed. Step S12: After being awakened, the data acquisition terminal immediately controls the currently connected sensor to measure raw data, and temporarily stores the measured raw data in the memory; Step S13: When the memory is full, the data acquisition terminal sends a packaged predefined communication request signal to the central gateway.

4. The low-power radio frequency encryption communication system according to claim 3, wherein: The encrypted channel establishment module includes a lightweight identity authentication unit, a session key generation and negotiation unit, and an optimized AES encrypted data transmission unit. The lightweight identity authentication unit includes: Step S201: The central gateway generates a random number and broadcasts or sends it to the terminal to be authenticated via a radio frequency channel; Step S202: After receiving the random number fed back by the central gateway, the data collection terminal concatenates the unique identity key preset in the current device of the data collection terminal and the random number as input data, calculates and authenticates the input data into a token Token through a lightweight hash function, and sends it to the central gateway; Step S203: When the central gateway receives the token Token, it retrieves the corresponding unique identity key and the original pre-generated random number stored in the local database, calculates the expected token Expected_Token twice using the same lightweight hash function as the data collection terminal, and compares the token Token with the expected token Expected_Token; If the token Token is consistent with the expected token Expected_Token, the authentication is successful; If the token Token is inconsistent with the expected token Expected_Token, the current authentication result is recorded as an illegal access attempt, the communication channel is closed, and the currently requested data acquisition terminal is ignored.

5. The low-power radio frequency encryption communication system according to claim 4, characterized in that: The session key generation and negotiation unit includes: Step S211: The central gateway sends a predefined pilot pseudo-random binary sequence to the data acquisition terminal in current communication. The data acquisition terminal performs channel estimation based on the pilot pseudo-random binary sequence to obtain channel state information of the data acquisition terminal, where the channel state information includes channel amplitude and phase characteristics. Step S212: the data acquisition terminal sends a pilot pseudo-random binary sequence in reverse to the central gateway, and the central gateway obtains the channel state information of the central gateway according to step S32; Step S212: converting the channel state information of the data acquisition terminal and the central gateway into a binary key respectively through a quantization rule; Step S213: Using a lightweight information negotiation protocol, the terminal initial key and the gateway initial key are grouped into 8-bit segments. The data acquisition terminal sends the parity bits of each group to the central gateway. The central gateway compares the received parity bits with the local parity bits of the central gateway. If the comparison results are consistent, the terminal initial key and the gateway initial key of the current group are verified to be correct; If the comparison results are inconsistent, it is marked that there is an error bit in the terminal initial key and the gateway initial key of the current group. The error bit position is located and corrected through binary search method; Step S214: Repeat step S213 until the verification results of all groups are correct, and finally obtain a completely consistent shared session key.

6. The low-power radio frequency encryption communication system according to claim 5, characterized in that: The quantification rules include: Setting a channel amplitude threshold, and discretizing continuous amplitude values ​​into 0 or 1 bits according to the channel amplitude threshold. The discretization process includes discretizing amplitude values ​​exceeding the channel amplitude threshold into 1 and amplitude values ​​below the channel amplitude threshold into 0. Discretizing the phase information includes: quantizing the phase information with a phase difference exceeding π / 2 radians to 1, and quantizing the phase information with a phase difference less than π / 2 radians to 0; The terminal initial key of the data acquisition terminal and the gateway initial key generated by the central gateway are obtained respectively.

7. The low-power radio frequency encryption communication system according to claim 6, wherein: The optimized AES encryption data transmission unit includes: Step S221: The data collection terminal and the central gateway generate n groups of round keys based on the shared session key using the AES key expansion algorithm. Each group of round keys corresponds to 128 bits. The S-box and the inverse S-box of each group of round keys are pre-stored in a read-only memory ROM. Step S222: Optimizing the AES key expansion algorithm, the optimization includes performing multiple rounds of encryption on the transmitted plaintext data block at the data acquisition terminal side; Step S223: The optimization includes performing a decryption operation on the transmitted plaintext data block at the central gateway side. The decryption operation includes: performing a nonlinear replacement on the current group ciphertext using an inverse S-box, performing an inverse cyclic shift on each row, performing an inverse column obfuscation operation on each column, performing an XOR operation on the current decryption state matrix and the round key, and restoring the original plaintext data; Step S224: After the data transmission is completed, the shared session key and all round keys are erased from the memory.

8. The low-power radio frequency encryption communication system according to claim 7, wherein: The multi-round encryption process includes: Step S2221: Perform an XOR operation on the plaintext data block and the round key of round 0 to obtain an initial state; Step S2222: Perform encryption operation on the data collection terminal side, the encryption operation includes 9 rounds of iterations; Step S2223: Perform nonlinear replacement of the bytes in the state matrix twice using S-boxes, perform cyclic shift on each row of the state matrix, perform XOR operation on the current state matrix and the round key of the last round, and obtain the current 128-bit group ciphertext.

9. The low-power radio frequency encryption communication system according to claim 8, wherein: Each of the 9 iterations consists of: Step S22221: Use predefined S-boxes to perform nonlinear replacement on each byte to enhance obfuscation; Step S22222: cyclically shift each row of the state matrix, with the specific shift times being 0, 1, 2, or 3 bytes; Step S22223: perform finite field multiplication on each column of the state matrix; Step S22224: perform an XOR operation on the current state matrix and the round key.

10. The low-power radio frequency encryption communication system according to claim 1, wherein: The back-end result output module includes: Step S31: The central gateway pre-processes the decrypted original plaintext data. The pre-processing includes: Record the exact time of data collection, check whether the original plaintext data is within the preset range, mark it as abnormal if it exceeds the preset range, and compare it with the average and extreme values ​​of the data in the past 24 hours to identify sudden changes in data; Step S32: The processed data is stored in the local database of the central gateway and encrypted and uploaded to the cloud platform via the TLS / HTTPS protocol; Step S33: Sending control instructions to other devices according to preset rules; Step S34: After receiving the encrypted ACK confirmation from the central gateway or completing data transmission, the data acquisition terminal turns off the RF module and sensor power supply and enters a low-power sleep mode, retaining only the real-time clock RTC to maintain timing, waiting for the next trigger event, which includes timed wake-up and external interrupt, to complete a complete working cycle.

Images