Intercom terminal multi-hop long-range communication system

Abstract

This invention relates to the field of intelligent communication technology and discloses a multi-hop long-distance communication system for walkie-talkies. The system includes a signature module, an encryption module, a feature acquisition module, a communication establishment module, an operation command encryption module, and an operation determination module. The target walkie-talkie signs the authentication request and sends the signature and digital certificate to the authentication platform. After verifying the certificate's validity, the platform encrypts a random number using the walkie-talkie's public key and sends it back. The walkie-talkie decrypts the random number using its private key and uses the hash values ​​of the two random numbers as feature parameters. The platform verifies these parameters to complete two-way authentication, issues an authentication token, and negotiates the establishment of a secure channel. Through this channel, the command initiator encrypts plaintext commands using a session key. The walkie-talkie decrypts the commands, executes them, and returns an operation result digest for confirmation of completion. This invention can improve the high-security read / write and communication efficiency of walkie-talkies.

Description

Technical Field

[0001] This invention relates to the field of intelligent communication technology, and in particular to a multi-hop long-distance communication system for intercom terminals. Background Technology

[0002] During the reading and writing operations and communication of walkie-talkies, there are significant shortcomings in data transmission security. Existing technologies often lack robust authentication mechanisms, making it difficult to effectively defend against malicious attacks such as unauthorized access and data tampering. This results in the communication link between the walkie-talkie and the associated platform being easily compromised, and sensitive operation commands and transmitted data facing the risk of leakage, failing to meet the needs of use cases with high security requirements.

[0003] Existing technologies lack rigorous design in data encryption transmission and operation execution verification. Their encryption algorithms are simplistic, and key management is crude, making them prone to encryption failure. Furthermore, there is a lack of reliable verification methods for the execution results of operation commands, making it difficult to accurately confirm whether commands have been fully executed and whether the results are genuine and valid. This affects the accuracy and reliability of walkie-talkie read / write operations, reducing overall communication and data processing efficiency. Summary of the Invention

[0004] This invention provides a multi-hop long-distance communication system for intercom terminals to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides a multi-hop long-distance communication system for intercom terminals, characterized in that the system includes a signature module, an encryption module, a feature acquisition module, a communication establishment module, an operation instruction encryption module, and an operation determination module, wherein:

[0006] The signature module is used to sign the authentication request sent by the authentication platform to the target walkie-talkie, obtain the first signature data of the target walkie-talkie, and send the first signature data and the digital certificate of the target walkie-talkie to the authentication platform.

[0007] The encryption module is used to encrypt a second random number generated by the authentication platform using the public key of the target walkie-talkie when the authentication platform verifies that the digital certificate is valid, thereby obtaining the first encrypted data of the target walkie-talkie.

[0008] The feature acquisition module is used to, after the target walkie-talkie decrypts the first encrypted data using its own private key, use the hash value of the first random number in the authentication request and the second random number obtained by decryption as the first feature parameter.

[0009] The communication establishment module is used by the authentication platform to calculate the identity authentication of the first feature parameter. After successful authentication, the authentication token of the target walkie-talkie is obtained, and a secure communication channel is negotiated between the authentication platform and the target walkie-talkie.

[0010] The operation command encryption module is used to generate a plaintext command through the command initiator of the secure communication channel, and encrypt the plaintext command using the current session key to obtain the first ciphertext command of the target walkie-talkie.

[0011] The operation determination module is used for the target walkie-talkie to decrypt the first ciphertext command to obtain the operation instruction of the target walkie-talkie. After the execution end of the target walkie-talkie executes the operation instruction, it returns a digest value of the operation result. The command initiating end confirms the execution completion degree of the execution end based on the digest value.

[0012] In a preferred embodiment, when the signature module signs the authentication request sent by the authentication platform to the target walkie-talkie to obtain the first signature data of the target walkie-talkie, it is specifically used for:

[0013] The target walkie-talkie receives an authentication request sent by the authentication platform and extracts a first random number from the authentication request;

[0014] The target walkie-talkie performs a hash operation on the first random number to obtain the first intermediate digest of the target walkie-talkie;

[0015] The target walkie-talkie uses a preset private key to encrypt and sign the first intermediate digest, thereby obtaining the first signature data of the target walkie-talkie.

[0016] In a preferred embodiment, when the authentication platform verifies the digital certificate as valid, the encryption module specifically performs the following: The public key of the target walkie-talkie is used to encrypt a second random number generated by the authentication platform to obtain the first encrypted data of the target walkie-talkie.

[0017] After verifying the validity of the digital certificate, the authentication platform immediately generates a second random number for the digital certificate.

[0018] The authentication platform extracts the public key of the target walkie-talkie from the verified digital certificate;

[0019] The authentication platform uses the public key to encrypt the second random number to obtain the first encrypted data of the target walkie-talkie.

[0020] In a preferred embodiment, when the feature acquisition module executes the decryption of the first encrypted data using the target walkie-talkie's private key, and uses the hash value of the first random number in the authentication request and the decrypted second random number as the first feature parameter, it is specifically used for:

[0021] The target walkie-talkie decrypts the received first encrypted data according to a preset private key to obtain a second random number from the authentication platform;

[0022] The target walkie-talkie extracts the first random number from the received authentication request;

[0023] The first random number and the second random number are concatenated to obtain the combined data to be hashed;

[0024] A hash operation is performed on the combined data to generate a unique digest value, which is used as the first feature parameter of the target walkie-talkie.

[0025] In a preferred embodiment, when the communication establishment module performs identity authentication on the first feature parameter calculated by the authentication platform and obtains the authentication token of the target walkie-talkie after successful authentication, it is specifically used for:

[0026] The local hash value of the authentication platform is calculated based on the first random number and the second random number generated and stored by the authentication platform.

[0027] The received first feature parameter is compared with the local hash value;

[0028] When the comparison matches, the authentication platform determines that the identity authentication is successful;

[0029] When identity authentication is successful, the authentication platform generates an authentication token;

[0030] The authentication platform uses a symmetric encryption algorithm and key pre-negotiated with the target walkie-talkie to encrypt the authentication token, thereby obtaining the authentication platform's encrypted token.

[0031] The authentication platform sends the encryption token to the target walkie-talkie.

[0032] In a preferred embodiment, when the communication establishment module performs the negotiation to establish a secure communication channel between the authentication platform and the target walkie-talkie, it is specifically used for:

[0033] The authentication platform and the target walkie-talkie generate a temporary session seed based on the authentication token;

[0034] The authentication platform exchanges public-key encrypted random parameters with the target walkie-talkie;

[0035] The authentication platform and the target walkie-talkie use the temporary session seed and the random parameters to generate a session key through the same key derivation function.

[0036] The secure transmission protocol is initialized using the session key to establish a secure communication channel between the authentication platform and the target walkie-talkie.

[0037] In a preferred embodiment, when the operation instruction encryption module generates a plaintext command at the command initiator through the secure communication channel and encrypts the plaintext command using the current session key to obtain the first ciphertext command of the target walkie-talkie, it is specifically used for:

[0038] The command initiator of the secure communication channel generates initial command data for the target walkie-talkie based on the operation type and operation parameters to be executed.

[0039] The initial command data is appended with a current timestamp and a unique sequence identifier to obtain the structured command data of the target walkie-talkie;

[0040] The structured command data is digested to obtain a command digest of the structured command data;

[0041] The command digest is appended to the end of the structured command data to obtain the plaintext command of the secure communication channel;

[0042] Using the current session key, the first ciphertext command of the target walkie-talkie is obtained by symmetrically encrypting the plaintext command.

[0043] In a preferred embodiment, the operation instruction encryption module performs digest calculation on the structured command data to obtain a command digest of the structured command data, specifically for:

[0044] Obtain the byte sequence of the structured command data, and obtain the dynamic random factor currently derived from the authentication token;

[0045] The byte sequence is mixed with the dynamic random factor to obtain the mixed data sequence of the secure communication channel;

[0046] The mixed data sequence is digested to obtain a command digest of the structured command data. The formula for calculating the digest value in the command digest is as follows:

[0047] ;

[0048] In the formula, For summary value, This is a standard SHA-256 cryptographic hash function operation. For the integer representation of the mixed data sequence, This is the integer representation of the dynamic random factor. For bitwise XOR operation, For data concatenation operations, This is an integer representation of the sequence identifier attached to the structured command data. This is an integer representation of the timestamps attached to the structured command data. For modulo operation, The modulus of a prime number is a predefined prime number.

[0049] In a preferred embodiment, when the operation determination module executes the target walkie-talkie to decrypt the first ciphertext command to obtain the operation instruction of the target walkie-talkie, and the execution end of the target walkie-talkie returns a digest value of the operation result after executing the operation instruction, and the command initiating end confirms the execution completion degree of the execution end based on the digest value, it is specifically used for:

[0050] The target walkie-talkie uses the current session key to decrypt the received first ciphertext command to obtain the plaintext command from the command initiator.

[0051] The target walkie-talkie parses the specific operation instructions and auxiliary parameters from the plaintext command;

[0052] The execution terminal within the target walkie-talkie performs corresponding read / write operations according to the operation instructions and auxiliary parameters to obtain the original operation results of the target walkie-talkie;

[0053] The target walkie-talkie performs normalization processing on the original operation results to obtain a result summary of the target walkie-talkie;

[0054] The target walkie-talkie returns the original operation result and the result summary to the command initiator;

[0055] After receiving the original operation result and the result summary, the command initiator recalculates the local summary.

[0056] The recalculated local digest is compared with the received result digest. If they match, the execution of the execution terminal is confirmed to be complete and error-free.

[0057] In a preferred embodiment, when the operation determination module performs normalization processing on the original operation result by the target walkie-talkie to obtain the result summary of the target walkie-talkie, it is specifically used for:

[0058] The status code, data fields, and time information contained in the original operation result are converted according to a predefined unified data format to obtain the result data of the target walkie-talkie.

[0059] The target walkie-talkie's standardized data sequence is obtained by sorting the fields in the result data lexicographically based on their field identifiers.

[0060] The standardized data sequence is byte-encoded to obtain a standardized byte stream to be digested in the target walkie-talkie;

[0061] The standard byte stream to be digested is subjected to the same digest processing as the command initiator to obtain the result digest of the target walkie-talkie.

[0062] Compared with the prior art, the present invention has the following beneficial effects:

[0063] 1. This invention establishes a robust security defense through multiple layers of security mechanisms, including signature verification, identity authentication, and multi-round encrypted transmission, from identity verification to data transmission. This effectively resists risks such as unauthorized access, data tampering, and leakage, ensuring the security of communication and read / write operations between the walkie-talkie and the authentication platform, and meeting the needs of high-security scenarios.

[0064] 2. This invention employs dynamic session key generation and command digest verification, which not only ensures data transmission stability through standardized encryption algorithms and key derivation mechanisms, but also accurately confirms the completion of operation commands through digest comparison, avoiding command loss or execution deviation. At the same time, it simplifies the authentication and encryption process and improves the overall efficiency of walkie-talkie read / write operations and communication. Attached Figure Description

[0065] Figure 1 This is a system architecture diagram of a multi-hop long-distance communication system for intercom terminals provided in an embodiment of the present invention;

[0066] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments belong to some, but not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “said” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0069] Depending on the context, the word "if" or "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0070] Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0071] In practice, the server-side equipment deployed in a multi-hop long-distance communication system for intercom terminals may consist of one or more devices. This multi-hop long-distance communication system can be implemented as: a service instance, a virtual machine, or hardware devices. For example, it can be implemented as a service instance deployed on one or more devices in a cloud node. Simply put, it can be understood as software deployed on a cloud node to provide a multi-hop long-distance communication system for each user terminal. Alternatively, it can be implemented as a virtual machine deployed on one or more devices in a cloud node, with application software installed to manage each user terminal. Or, it can also be implemented as a server composed of numerous identical or different types of hardware devices, with one or more hardware devices configured to provide a multi-hop long-distance communication system for each user terminal.

[0072] In terms of implementation, a multi-hop long-distance communication system for intercom terminals and the user terminal are mutually compatible. That is, if the multi-hop long-distance communication system for intercom terminals is implemented as an application installed on a cloud service platform, then the user terminal is implemented as a client that establishes a communication connection with the application; or if the multi-hop long-distance communication system for intercom terminals is implemented as a website, then the user terminal is implemented as a webpage; or if the multi-hop long-distance communication system for intercom terminals is implemented as a cloud service platform, then the user terminal is implemented as a mini-program in an instant messaging application.

[0073] like Figure 1 The diagram shown is a system architecture diagram of a multi-hop long-distance communication system for intercom terminals provided in an embodiment of the present invention.

[0074] The multi-hop long-distance communication system 100 for intercom terminals described in this invention can be installed on a cloud server. In terms of implementation, it can function as one or more service devices, or as an application installed on the cloud (e.g., a mobile service operator's server, server cluster, etc.), or it can be developed as a website. Depending on the functions implemented, the multi-hop long-distance communication system 100 for intercom terminals may include a signature module 101, an encryption module 102, a feature acquisition module 103, a communication establishment module 104, an operation instruction encryption module 105, and an operation determination module 106. The modules described in this invention can also be referred to as units, which are a series of computer program segments that can be executed by the processor of an electronic device and perform a fixed function, stored in the memory of the electronic device.

[0075] In this embodiment of the invention, in a multi-hop long-distance communication system for intercom terminals, each of the above-mentioned modules can be implemented independently and can call other modules. Here, "calling" can be understood as a module connecting to multiple modules of another type and providing corresponding services to those connected modules. The multi-hop long-distance communication system for intercom terminals provided by this embodiment of the invention allows for adjustment of the applicability of the system architecture without modifying the program code, through adding modules and directly calling them, achieving cluster-based horizontal expansion to quickly and flexibly expand the multi-hop long-distance communication system. In practical applications, the above-mentioned modules can be set in the same device or different devices, or they can be set in a virtual device, such as a service instance in a cloud server.

[0076] The following describes, with reference to specific embodiments, the various components and specific workflow of a multi-hop long-distance communication system for intercom terminals:

[0077] The signature module 101 is used to sign the authentication request sent by the authentication platform to the target walkie-talkie, obtain the first signature data of the target walkie-talkie, and send the first signature data together with the digital certificate of the target walkie-talkie to the authentication platform.

[0078] In this embodiment of the invention, when the signature module signs the authentication request sent by the authentication platform to the target walkie-talkie to obtain the first signature data of the target walkie-talkie, it is specifically used for:

[0079] The target walkie-talkie receives an authentication request sent by the authentication platform and extracts a first random number from the authentication request;

[0080] The target walkie-talkie performs a hash operation on the first random number to obtain the first intermediate digest of the target walkie-talkie;

[0081] The target walkie-talkie uses a preset private key to encrypt and sign the first intermediate digest, thereby obtaining the first signature data of the target walkie-talkie.

[0082] When the target walkie-talkie is in normal working condition, it listens to the signal sent by the authentication platform in real time. When it receives the authentication request transmitted by the authentication platform, the signal parsing module inside the walkie-talkie performs complete data parsing of the authentication request. First, it performs format verification on the overall data of the authentication request. After confirming that the data format conforms to the preset interaction standard, it locates the specific data field storing the random number in the authentication request and extracts the first random number completely from the data field.

[0083] The target walkie-talkie calls its internally preset hash processing module, inputting the extracted first random number completely into the hash processing module. The hash processing module performs bit-by-bit data transformation on the first random number according to preset fixed operation rules, and performs orderly integration and calculation on the transformed data. During the calculation process, the processing result of each bit of data is verified to ensure that the data processing process is without deviation, and finally generates the corresponding data digest, which is the first intermediate digest of the target walkie-talkie.

[0084] The target walkie-talkie retrieves its private key, which is a dedicated hardware storage area for storing keys. This effectively prevents the private key from being illegally read or tampered with. The generated first intermediate digest is completely input into the signature encryption module. The signature encryption module uses the private key to perform asymmetric encryption on the first intermediate digest. The data signature is completed by bit-by-bit matching between the private key and the first intermediate digest. During the signing process, the encryption result of each step is verified to ensure the integrity and accuracy of the signed data. The data generated after the encryption and signing operation is completed is the first signature data of the target walkie-talkie.

[0085] The beneficial effects are as follows: by accurately parsing the authentication request and reliably extracting the first random number from the target walkie-talkie, the accuracy and integrity of the initial authentication data are ensured; by using hash operation to normalize the first random number to generate the first intermediate digest, the consistency and irreversibility of data processing are improved; by using a pre-set private key to encrypt and sign the first intermediate digest to generate the first signature data, combined with the independent hardware protection mechanism for private key storage, the security and uniqueness of the signature data are enhanced; the overall process realizes controllability and verifiability of each link in the authentication data processing, effectively improving the security and reliability of identity authentication between the target walkie-talkie and the authentication platform.

[0086] The encryption module 102 is used to encrypt a second random number generated by the authentication platform using the public key of the target walkie-talkie when the authentication platform verifies that the digital certificate is valid, thereby obtaining the first encrypted data of the target walkie-talkie.

[0087] In this embodiment of the invention, when the encryption module executes the process of encrypting a second random number generated by the authentication platform using the public key of the target walkie-talkie to obtain the first encrypted data of the target walkie-talkie when the authentication platform verifies that the digital certificate is valid, it is specifically used for:

[0088] After verifying the validity of the digital certificate, the authentication platform immediately generates a second random number for the digital certificate.

[0089] The authentication platform extracts the public key of the target walkie-talkie from the verified digital certificate;

[0090] The authentication platform uses the public key to encrypt the second random number to obtain the first encrypted data of the target walkie-talkie.

[0091] The authentication platform verifies the validity of the digital certificate submitted by the target walkie-talkie through a preset certificate verification module. It completes all verification processes, including certificate signature verification, certificate validity period verification, and certificate status verification. After confirming that the digital certificate is in a valid state, the random number generation module inside the platform starts the data generation process according to preset fixed rules. It generates a corresponding random number through the orderly processing of the basic data source. This random number is the second random number of the digital certificate.

[0092] The authentication platform calls its internal data extraction module, inputs the digital certificate that has completed validity verification into the module, and the data extraction module parses the overall data structure of the digital certificate, locates the specific data area in the certificate that stores the public key of the target walkie-talkie, reads and converts the data in the area completely, and finally extracts the public key of the target walkie-talkie from the verified digital certificate.

[0093] The authentication platform loads the extracted public key of the target walkie-talkie into its internal encryption module. At the same time, it inputs the generated second random number into the encryption module. The encryption module uses the loaded public key to encrypt the second random number bit by bit, and completes the encryption conversion of each bit of data through the matching operation between the public key and the second random number. The data processing results of each step in the encryption process are verified to ensure that the data is complete and unaltered. The data generated after the encryption operation is completed is the first encrypted data of the target walkie-talkie.

[0094] The beneficial effects are as follows: by verifying the full validity of digital certificates through the authentication platform, the compliance and security of subsequent authentication processes are ensured; a unique second random number is generated by the random number generation module, providing unique and secure basic data for encryption operations; the public key of the target walkie-talkie is accurately extracted from the valid digital certificate by the data extraction module, ensuring the authenticity and availability of the public key; and the second random number is specifically encrypted using the extracted public key to generate the first encrypted data, realizing the controllability and verifiability of the data encryption process and improving the security and uniqueness of data transmission between the authentication platform and the target walkie-talkie.

[0095] The feature acquisition module 103 is used to, after the target walkie-talkie decrypts the first encrypted data using its own private key, use the hash value of the first random number in the authentication request and the second random number obtained by decryption as the first feature parameter.

[0096] In this embodiment of the invention, when the feature acquisition module executes the decryption of the first encrypted data using the target walkie-talkie's private key, and uses the hash value of the first random number in the authentication request and the decrypted second random number as the first feature parameter, it is specifically used for:

[0097] The target walkie-talkie decrypts the received first encrypted data according to a preset private key to obtain a second random number from the authentication platform;

[0098] The target walkie-talkie extracts the first random number from the received authentication request;

[0099] The first random number and the second random number are concatenated to obtain the combined data to be hashed;

[0100] A hash operation is performed on the combined data to generate a unique digest value, which is used as the first feature parameter of the target walkie-talkie.

[0101] After receiving the first encrypted data transmitted by the authentication platform, the target walkie-talkie immediately retrieves the private key pre-stored in its own independent secure storage module. This secure storage module has the protection against unauthorized reading and tampering, ensuring the security and integrity of the private key. The walkie-talkie loads the private key completely into its internal decryption processing module, and simultaneously inputs all the received first encrypted data into the decryption processing module. The decryption processing module completes the decryption conversion of each bit of data by matching the private key with the first encrypted data bit by bit according to the preset asymmetric decryption fixed rules. During the decryption process, the conversion result of each step is verified in real time to ensure that the data decryption process is without deviation or omission. The data obtained after all decryption operations are completed is the second random number of the authentication platform.

[0102] The target walkie-talkie calls its internal dedicated signal analysis module, inputting the previously received authentication request completely into the module. The signal analysis module first verifies the overall data format of the authentication request. After confirming that the data format conforms to the preset interaction standard, it performs a comprehensive analysis of the data structure of the authentication request, accurately locating the dedicated data field in the authentication request that stores the first random number. It then reads and converts the data in this field completely. After reading, it performs a consistency check on the data again to ensure that the extracted data is completely consistent with the original data in the authentication request. Finally, it extracts the first random number from the authentication request.

[0103] The target walkie-talkie activates its internal data splicing module, simultaneously inputting the extracted first random number and the decrypted second random number into the module. The data splicing module integrates the two random numbers in a predetermined fixed order. First, it arranges all the data content of the first random number, and then it appends all the data content of the second random number to the end of the first random number's data content, achieving continuous connection between the two random number data contents. After integration, the spliced ​​data is checked for integrity. Once it is confirmed that there is no missing or redundant data, the generated data is the combined data to be hashed.

[0104] The target walkie-talkie calls its internally preset hash processing module, inputting the combined data to be hashed completely into the module. The hash processing module iterates through the combined data bit by bit according to preset fixed operation rules, performs corresponding transformation processing on each bit, and performs orderly integration and calculation on all transformed data. During the calculation process, the results of each step are verified in real time to avoid data processing errors. After the calculation is completed, a unique digest value is generated. This digest value has a unique characteristic; different combinations of data correspond to different digest values. This digest value is the first characteristic parameter of the target walkie-talkie.

[0105] The beneficial effects are as follows: the accurate decryption of the first encrypted data by the pre-set private key of the target walkie-talkie ensures the accuracy and security of the second random number restoration; the deep analysis and data verification of the authentication request by the signal analysis module enables the reliable extraction of the first random number; the orderly integration and integrity verification of the two random numbers by the data splicing module generates standardized and unified data to be hashed; the bit-by-bit processing and result verification of the combined data by hash operation yields a unique first feature parameter; the entire process improves the security, accuracy and uniqueness of the target walkie-talkie identity authentication data processing through multi-stage data verification and standardization.

[0106] The communication establishment module 104 is used by the authentication platform to calculate the identity authentication of the first feature parameter. After successful authentication, the authentication token of the target walkie-talkie is obtained, and a secure communication channel is negotiated between the authentication platform and the target walkie-talkie.

[0107] In this embodiment of the invention, when the communication establishment module performs identity authentication on the first feature parameter calculated by the authentication platform and obtains the authentication token of the target walkie-talkie after successful authentication, it is specifically used for:

[0108] The local hash value of the authentication platform is calculated based on the first random number and the second random number generated and stored by the authentication platform.

[0109] The received first feature parameter is compared with the local hash value;

[0110] When the comparison matches, the authentication platform determines that the identity authentication is successful;

[0111] When identity authentication is successful, the authentication platform generates an authentication token;

[0112] The authentication platform uses a symmetric encryption algorithm and key pre-negotiated with the target walkie-talkie to encrypt the authentication token, thereby obtaining the authentication platform's encrypted token.

[0113] The authentication platform sends the encryption token to the target walkie-talkie.

[0114] When the communication establishment module negotiates and establishes a secure communication channel between the authentication platform and the target walkie-talkie, it is specifically used for:

[0115] The authentication platform and the target walkie-talkie generate a temporary session seed based on the authentication token;

[0116] The authentication platform exchanges public-key encrypted random parameters with the target walkie-talkie;

[0117] The authentication platform and the target walkie-talkie use the temporary session seed and the random parameters to generate a session key through the same key derivation function.

[0118] The secure transmission protocol is initialized using the session key to establish a secure communication channel between the authentication platform and the target walkie-talkie.

[0119] The authentication platform calls its internal data reading module to completely read the first and second random numbers previously generated and stored in the dedicated encrypted data storage area. During the reading process, the data format of the two random numbers is verified. After confirming that the data format has not been tampered with, the two random numbers are input into the hash operation processing module in a preset fixed order. The hash operation processing module iterates and transforms the two random numbers bit by bit according to the established operation rules, and performs ordered integration and calculation on the transformed data. During the calculation process, the results of each step are verified in real time to avoid data omissions or calculation errors. After the operation is completed, a corresponding data digest is generated, which is the local hash value of the authentication platform.

[0120] The authentication platform activates its internal data comparison module, inputting the first characteristic parameter of the target walkie-talkie and the generated local hash value into the module simultaneously. The data comparison module first checks the length of the two data sets for consistency. After confirming that the lengths are exactly the same, it then performs a bit-by-bit matching check on all the contents of the two data sets, comparing the value and order of each data set in turn. During the comparison process, the matching status of each data set is recorded to ensure that there are no data discrepancies.

[0121] The authentication platform determines the comparison status based on the verification results of the data comparison module. When the data comparison module returns a verification result showing that the first feature parameter and every bit of the local hash value are completely matched without any difference, the authentication platform immediately determines that the identity authentication with the target walkie-talkie is successful.

[0122] After successful identity authentication, the authentication platform calls its internal token generation module. This module integrates basic data such as authentication time, platform identifier, and target walkie-talkie device identifier according to preset token generation rules. It performs standardized format conversion and content verification on the integrated data to ensure that the basic data is authentic and valid. Then, it extracts features and integrates and encodes the verified data to generate unique and time-sensitive authentication identifier data, which is the authentication token.

[0123] The authentication platform retrieves the symmetric encryption algorithm and corresponding key, which were pre-agreed upon with the target walkie-talkie. This key is stored in the platform's internal secure key storage module. When reading the key, an authentication mechanism is required to prevent unauthorized access. The symmetric encryption algorithm is then loaded into the encryption processing module, along with the generated authentication token and key. The encryption processing module performs a bit-by-bit matching operation between the key and the authentication token, following the fixed rules of the symmetric encryption algorithm. Each step of the encryption process is verified to ensure the integrity and accuracy of the encrypted data. The data generated after the encryption operation is completed is the authentication platform's encryption token.

[0124] The authentication platform activates its internal signal transmission module, encapsulates the generated encryption token according to a preset communication protocol, adds a data verification field during the encapsulation process for integrity verification after transmission, and performs format verification on the encapsulated data after the encapsulation is completed. Once the data format is confirmed to conform to the transmission standard, the encryption token is sent to the target walkie-talkie through a preset encrypted communication link.

[0125] The authentication platform and the target walkie-talkie each call their internal seed generation modules, inputting the previously generated authentication tokens completely into their respective seed generation modules. The seed generation modules of the two devices perform deep data parsing on the authentication tokens according to the same processing rules, extracting the core feature data from the tokens, and performing standardized transformation and integration processing on the extracted feature data. During the processing, the data consistency is checked to ensure that the processing results of the two devices are exactly the same, and finally the same basic data is generated, which is the temporary session seed.

[0126] The authentication platform and the target walkie-talkie each call their internal random parameter generation module to generate unique random parameters. During the generation process, the randomness and uniqueness of the random parameters are verified to ensure that the parameters are not repeated and cannot be predicted. The two devices call the public key encryption module, load their respective public keys into the encryption module, and use the public keys to encrypt the generated random parameters bit by bit. During the encryption process, the encryption result of each bit of data is verified to avoid encryption errors. After encryption is completed, the public key-encrypted random parameters are sent and exchanged with each other through a preset secure communication link.

[0127] The authentication platform and the target walkie-talkie each call their internal key derivation function processing module, inputting their respective generated temporary session seeds and exchanged random parameters encrypted with the public key into the module. The processing modules of the two devices perform bit-by-bit traversal, transformation, and integration calculations on the input data according to the same key derivation function processing rules. During the calculation process, the results of each step are verified in real time to ensure that the calculation process is without deviation. After the calculation is completed, the validity of the generated key data is verified, and finally the same key data is generated, which is the session key.

[0128] The authentication platform and the target walkie-talkie each call the internal secure transmission protocol initialization module, load the generated session key into the module, and the initialization module completes the matching and configuration of the session key and various parameters of the secure transmission protocol according to the preset protocol rules. It verifies the various parameters required for the protocol to run to ensure that the parameter settings are accurate. Then, the secure transmission protocol is started, and the transmitted data is encrypted and decrypted in real time through the session key, thereby establishing a secure communication channel between the authentication platform and the target walkie-talkie.

[0129] The beneficial effects are as follows: by generating a local hash value through standardized calculation of stored random numbers by the authentication platform, and by comparing it bit by bit with the first feature parameter, the accuracy and reliability of the identity authentication result are ensured. Relying on the exclusive generation and symmetric encryption processing of the authentication token, the security and uniqueness of authentication data transmission are improved. By using the authentication platform and the target walkie-talkie to generate the same temporary session seed based on the authentication token, and with the public key encryption random parameter exchange mechanism, the consistency and security of session key generation are ensured. The secure communication channel is established by initializing the secure transmission protocol using the session key, realizing full encryption protection for data transmission between the authentication platform and the target walkie-talkie, and comprehensively improving the security, stability and uniqueness of the entire identity authentication and communication process.

[0130] The operation command encryption module 105 is used to generate a plaintext command through the command initiator of the secure communication channel, and encrypt the plaintext command using the current session key to obtain the first ciphertext command of the target walkie-talkie.

[0131] In this embodiment of the invention, when the operation instruction encryption module generates a plaintext command at the command initiator through the secure communication channel and encrypts the plaintext command using the current session key to obtain the first ciphertext command of the target walkie-talkie, it is specifically used for:

[0132] The command initiator of the secure communication channel generates initial command data for the target walkie-talkie based on the operation type and operation parameters to be executed.

[0133] The initial command data is appended with a current timestamp and a unique sequence identifier to obtain the structured command data of the target walkie-talkie;

[0134] The structured command data is digested to obtain a command digest of the structured command data;

[0135] The command digest is appended to the end of the structured command data to obtain the plaintext command of the secure communication channel;

[0136] Using the current session key, the first ciphertext command of the target walkie-talkie is obtained by symmetrically encrypting the plaintext command.

[0137] The operation instruction encryption module performs digest calculation on the structured command data to obtain a command digest of the structured command data, specifically for:

[0138] Obtain the byte sequence of the structured command data, and obtain the dynamic random factor currently derived from the authentication token;

[0139] The byte sequence is mixed with the dynamic random factor to obtain the mixed data sequence of the secure communication channel;

[0140] The mixed data sequence is digested to obtain a command digest of the structured command data. The formula for calculating the digest value in the command digest is as follows:

[0141] ;

[0142] In the formula, For summary value, This is a standard SHA-256 cryptographic hash function operation. For the integer representation of the mixed data sequence, This is the integer representation of the dynamic random factor. For bitwise XOR operation, For data concatenation operations, This is an integer representation of the sequence identifier attached to the structured command data. This is an integer representation of the timestamps attached to the structured command data. For modulo operation, The modulus of a prime number is a predefined prime number.

[0143] The integer representation of the mixed data sequence is derived from the mixed data sequence of the secure communication channel. This mixed data sequence is the result of mixing the byte sequence of structured command data with a dynamic random factor, and then converting the mixed data sequence into integer form.

[0144] The integer representation of the dynamic random factor originates from the dynamic random factor derived from the authentication token. This dynamic random factor is generated in real time based on the core feature data of the authentication token, and is then converted into integer form. The integer representation of the sequence identifier originates from the sequence identifier attached to the structured command data. This sequence identifier is a unique sequence identifier attached to the initial command data, and is then converted into integer form.

[0145] The integer representation of the timestamp comes from the timestamp attached to the structured command data. This timestamp is the current timestamp appended to the initial command data, and then converted into integer form. The predefined prime modulus is a fixed value that is set in advance and is not generated or converted from other data.

[0146] The formula's significance lies in generating the digest value of the command digest. First, the integer representation of the mixed data sequence is concatenated with the integer representations of the dynamic random factor, sequence identifier, and timestamp, and then a bitwise XOR operation is performed. The result is then input into the SHA256 hash function, which iterates through the input data bit by bit, performs feature transformation and integration calculations, and generates the corresponding hash result. Simultaneously, a modulo operation is performed on the integer representation of the mixed data sequence, and the modulo result is multiplied by the integer representation of the dynamic random factor. Finally, the hash result and the multiplication result are bitwise XORed, and the result is the digest value. This digest value can uniquely correspond to the structured command data and is used to verify the integrity of the data.

[0147] The formula's trend is reflected in the fact that if any change occurs in the mixed data sequence, its integer representation will change accordingly. After steps such as bitwise XOR and hash operations, the digest value will change significantly. If the dynamic random factor, sequence identifier, or timestamp changes, the concatenated data will change, affecting the subsequent hash result through bitwise XOR operations, ultimately changing the digest value. The predefined prime modulus is a fixed value and will not affect the trend of digest value changes. Overall, the digest value will present completely different results with slight changes in the input data, exhibiting high sensitivity and uniqueness.

[0148] The command initiator of the secure communication channel calls the internal command generation module, inputting the operation type to be executed and the corresponding operation parameters into the module. The command generation module encodes the operation type according to preset command data format rules, performs format conversion and compliance verification on the operation parameters, and after confirming that the operation parameters meet the execution requirements of the target walkie-talkie, it integrates the encoded operation type and the verified operation parameters in an orderly manner. After integration, the generated data is checked again for completeness and validity to ensure that the data can be accurately identified and executed by the target walkie-talkie, and finally generates the initial command data of the target walkie-talkie.

[0149] The command initiator activates its internal data appending module, inputting the generated initial command data into the module. Simultaneously, it retrieves the current timestamp generated in real time by the system clock and the unique sequence identifier pre-assigned by the command initiator. The data appending module adds the current timestamp to the beginning of the initial command data in a preset fixed order, and then adds the unique sequence identifier to the specified middle field of the initial command data. After the addition is completed, the integrated data is checked for field position and data format to confirm that there is no missing data or format errors, and finally the structured command data of the target walkie-talkie is obtained.

[0150] The command initiator calls the internal byte sequence extraction module, inputting the structured command data into this module. This module parses the structured command data character by character, converting each character into corresponding byte data. Then, it arranges and integrates all the byte data consecutively according to the original order of the structured command data. After the arrangement is completed, the length of the byte sequence and the data content are verified to ensure that the byte sequence completely corresponds to the structured command data, thus obtaining the byte sequence corresponding to the structured command data. At the same time, the command initiator calls the internal dynamic factor generation module. This module performs real-time derivation processing based on the core feature data of the authentication token. Through bit-by-bit feature extraction and dynamic transformation of the authentication token data, it generates the corresponding dynamic random factor.

[0151] The command initiator starts the internal data mixing module, inputting the extracted byte sequence and the derived dynamic random factor into the module simultaneously. The data mixing module performs bit-by-bit cross-integration of the byte sequence and dynamic random factor according to the preset fixed mixing rules. First, it extracts one bit of data from the byte sequence, then extracts one bit of data from the dynamic random factor, and so on to complete the cross-arrangement of all data. During the integration process, the mixing result of each bit of data is verified in real time, and the data length and feature value before and after mixing are compared to ensure that there is no data deviation or data loss during the mixing process, and finally a mixed data sequence for the secure communication channel is obtained.

[0152] The command initiator calls the internal summary processing module, inputting the complete mixed data sequence into the module. The summary processing module iterates through the mixed data sequence bit by bit according to preset fixed operation rules, performs feature transformation and identifier extraction on each data bit, and performs ordered integration and calculation on all transformed feature data. During the calculation process, the results of each step are verified in real time, and the calculated feature values ​​of each step are recorded to avoid data processing errors. After the calculation is completed, a unique corresponding summary data is generated. This summary data can uniquely correspond to the mixed data sequence. Different mixed data sequences correspond to different summary data. This summary data is the command summary of the structured command data.

[0153] The command initiator starts its internal data splicing module, inputting both the structured command data and the generated command digest into the module simultaneously. The data splicing module appends the command digest completely to the end of the structured command data in a preset fixed order. After splicing, the integrated data undergoes consistency verification, checking the accuracy of the splicing position and the integrity of the spliced ​​data to confirm that the splicing position is accurate and the data has not been tampered with. At the same time, the correspondence between the command digest and the structured command data is verified to ensure that the command digest can accurately represent the characteristics of the structured command data, ultimately obtaining the plaintext command for the secure communication channel.

[0154] The command initiator retrieves the session key currently stored in the security key module. This security key module has the ability to prevent unauthorized reading and tampering, ensuring the security and integrity of the session key. The session key is then fully loaded into the internal symmetric encryption module. At the same time, the generated plaintext command is input into the encryption module. The symmetric encryption module performs encryption conversion by matching the session key and the plaintext command bit by bit according to the preset symmetric encryption rules. During the encryption process, the conversion result of each step is verified, and the data characteristics before and after encryption are compared to ensure the integrity and accuracy of the encrypted data. The data generated after the encryption operation is completed is the first ciphertext command of the target walkie-talkie.

[0155] The beneficial effects are as follows: Initial command data is generated by combining the command initiator with the operation type and parameters, ensuring the relevance and effectiveness of the command data; structured command data is generated by adding a timestamp and a unique sequence identifier, enabling traceability and preventing replay of the command data; the randomness and tamper resistance of the data are improved by mixing the extracted byte sequence with a dynamic random factor derived from the authentication token; a command digest is generated by digesting the mixed data sequence, enabling integrity verification of the structured command data; the command digest is appended to the structured command data to generate a plaintext command, ensuring the verifiability of the command data; the plaintext command is symmetrically encrypted using the current session key to generate the first ciphertext command; and combined with the protection mechanism of the secure communication channel, the security, uniqueness, and reliability of command data transmission and execution are comprehensively improved.

[0156] The operation determination module 106 is used for the target walkie-talkie to decrypt the first ciphertext command to obtain the operation instructions of the target walkie-talkie. After the execution end of the target walkie-talkie executes the operation instructions, it returns a digest value of the operation result. The command initiating end confirms the execution completion degree of the execution end based on the digest value.

[0157] In this embodiment of the invention, when the operation determination module executes the target walkie-talkie to decrypt the first ciphertext command to obtain the operation instruction of the target walkie-talkie, and the execution end of the target walkie-talkie returns a digest value of the operation result after executing the operation instruction, and the command initiating end confirms the execution completion degree of the execution end based on the digest value, it is specifically used for:

[0158] The target walkie-talkie uses the current session key to decrypt the received first ciphertext command to obtain the plaintext command from the command initiator.

[0159] The target walkie-talkie parses the specific operation instructions and auxiliary parameters from the plaintext command;

[0160] The execution terminal within the target walkie-talkie performs corresponding read / write operations according to the operation instructions and auxiliary parameters to obtain the original operation results of the target walkie-talkie;

[0161] The target walkie-talkie performs normalization processing on the original operation results to obtain a result summary of the target walkie-talkie;

[0162] The target walkie-talkie returns the original operation result and the result summary to the command initiator;

[0163] After receiving the original operation result and the result summary, the command initiator recalculates the local summary.

[0164] The recalculated local digest is compared with the received result digest. If they match, the execution of the execution terminal is confirmed to be complete and error-free.

[0165] When the operation determination module performs normalization processing on the original operation result by the target walkie-talkie to obtain the result summary of the target walkie-talkie, it is specifically used for:

[0166] The status code, data fields, and time information contained in the original operation result are converted according to a predefined unified data format to obtain the result data of the target walkie-talkie.

[0167] The target walkie-talkie's standardized data sequence is obtained by sorting the fields in the result data lexicographically based on their field identifiers.

[0168] The standardized data sequence is byte-encoded to obtain a standardized byte stream to be digested in the target walkie-talkie;

[0169] The standard byte stream to be digested is subjected to the same digest processing as the command initiator to obtain the result digest of the target walkie-talkie.

[0170] The target walkie-talkie retrieves the session key currently stored in its own security key module. This module has the ability to prevent unauthorized reading. The session key is loaded into the internal symmetric decryption module. At the same time, the received first ciphertext command is input into this module. The symmetric decryption module completes the decryption conversion by matching the session key with the first ciphertext command bit by bit according to the preset symmetric decryption rules. During the decryption process, the conversion result of each step is verified to ensure that the data is without deviation. The content obtained after decryption is the plaintext command from the command initiator.

[0171] The target walkie-talkie activates its internal command parsing module, inputting the obtained plaintext command into the module. The module first parses the overall structure of the plaintext command, locates the specified fields that store the operation instructions and auxiliary parameters, reads and converts the data in these fields segment by segment, and verifies the integrity of the data during the reading process to ensure that the operation instructions and auxiliary parameters are not missing. Finally, the specific operation instructions and auxiliary parameters are parsed from the plaintext command.

[0172] The execution terminal inside the target walkie-talkie calls the internal operation execution module, inputs the parsed operation instructions and auxiliary parameters into the module, the module determines the corresponding read and write operation process according to the type of operation instruction, and performs read and write operations on the specified data area inside the target walkie-talkie according to the requirements of the auxiliary parameters. During the operation, the execution status of each step is monitored in real time to ensure that the operation meets the instruction requirements. The feedback data obtained after the operation is completed is the original operation result of the target walkie-talkie.

[0173] The target walkie-talkie activates its internal result processing module, inputting the original operation results into the module. The module organizes and converts the original operation results according to a preset standard format, removing redundant content and standardizing the data presentation. After the conversion is completed, the validity of the processing results is verified to ensure that they meet the standards for subsequent transmission and verification, and finally, the result summary of the target walkie-talkie is obtained.

[0174] The target walkie-talkie calls its internal result transmission module, inputting the original operation result and result summary into the module simultaneously. The module encapsulates these two data items according to a preset communication protocol, adding a data identifier field during the encapsulation process to distinguish between the two items. After encapsulation, the encapsulated data is format-verified. Once it is confirmed to conform to the transmission standard, it is returned to the command initiator through a secure communication channel.

[0175] After receiving the original operation result and result summary, the command initiator calls the internal summary calculation module. The received original operation result is input into the module, which processes and converts the original operation result according to the same standard processing rules as the target walkie-talkie. After the conversion is completed, the corresponding summary data is generated, which is the recalculated local summary.

[0176] The command initiator starts the internal digest comparison module, inputting the recalculated local digest and the received result digest into the module simultaneously. The module performs a bit-by-bit matching and verification of all the contents of the two digests, comparing the value and order of each data point. If every data point in the two digests is completely identical, it confirms that the execution of the target walkie-talkie is complete and error-free.

[0177] The predefined unified data format includes explicit formatting rules for status codes, data fields, and time information. Status codes uniformly use a 3-digit decimal number format. Data fields are divided into two types: numeric and character. Numeric fields are specified as decimal integers with a fixed number of decimal places, while character fields are specified as using UTF-8 encoding with a fixed preset length. Time information is uniformly formatted as a string in the format "year-month-day hour:minute:second.millisecond". The operation determination module first accurately extracts the status code, all data fields, and time information from the original operation result. For the status code, if the original status code is in hexadecimal or other non-decimal format, it is converted into a 3-digit decimal number using a digit-by-digit conversion rule. For data fields, for numeric fields, the precision of the original value is first checked. If it exceeds the preset number of decimal places, the corresponding number of digits is retained according to the rounding rule. For character fields, they are first converted into a byte sequence according to UTF-8 encoding. If the byte length is less than the preset fixed length, 0x00 bytes are added to the end to the fixed length. If it exceeds the preset length, the byte sequence is truncated and converted back to a character. For time information, if the original time information is a timestamp, the corresponding year, month, day, hour, minute, second, and millisecond values ​​are calculated based on the correspondence between the timestamp and standard time, and then concatenated into a string according to the specified format. If the original time information is in other formats, it is adjusted to a unified format according to the corresponding conversion rule. The converted status codes, all data fields, and time information are integrated into a structure of "status code - data field - time information" to form result data containing complete and uniform information. The format of each part of the result data strictly conforms to the predefined uniform data format requirements without any format deviation.

[0178] Each field in the result data is pre-assigned a unique field identifier, which consists of English letters and Arabic numerals, and the character length of each field identifier is fixed to a preset value. The lexicographical sorting rules are as follows: first, compare the ASCII values ​​of the English letters in the field identifier; letters with smaller ASCII values ​​are ranked first, and uppercase letters have lower ASCII values ​​than lowercase letters. If the English letter parts of the field identifier are completely identical, then compare the numeric parts, sorting them by decimal value, with smaller values ​​ranked first. If the field identifier consists only of letters or only of numbers, then purely letter identifiers are ranked before purely numeric identifiers. The operation determination module first traverses the result data, extracts the field identifiers corresponding to all fields, and then compares the character composition and corresponding ASCII code value or numerical value of each field identifier according to the above lexicographical sorting rules to determine the order of all field identifiers. Then, according to the sorted field identifier order, it extracts the corresponding field content from the result data in sequence and arranges these field contents continuously in sorted order to form a standardized data sequence. The arrangement order of fields in the standardized data sequence is completely consistent with the lexicographical sorting result of the field identifiers, and the content of each field is exactly the same as the content of the corresponding field in the result data, without any additions, deletions or modifications.

[0179] The byte encoding process strictly adheres to the data type and predefined unified data format requirements of each field in the result data. For each field in the standardized data sequence, the corresponding encoding operation is performed according to its type: numeric fields are first converted from decimal values ​​to strings, and then the strings are converted into byte sequences according to UTF-8 encoding rules; character fields have already undergone UTF-8 encoding and length adjustment during the format conversion stage, and the corresponding byte sequences are directly used; time information fields are converted from strings in the format "year-month-day hour:minute:second.millisecond" to byte sequences according to UTF-8 encoding rules. The operation determination module concatenates the byte sequences corresponding to each field sequentially according to the field order of the standardized data sequence. During the concatenation process, no separator bytes, identifiers, or extra data are added. Only the end of the byte sequence of the previous field is directly connected to the beginning of the byte sequence of the next field, ensuring that the concatenated byte stream is continuous and uninterrupted, ultimately forming a standardized byte stream to be digested. This byte stream completely preserves the information of all fields in the standardized data sequence, and the byte portion corresponding to each field strictly corresponds to the field content, with no data loss or disorder.

[0180] The digest processing method at the command initiator is a preset hash digest processing flow. The operation determination module executes processing steps that are completely consistent with this flow: First, the fixed byte block size is determined to be 64 bytes. The standard byte stream to be digested is divided into blocks. Starting from the beginning of the byte stream, 64 bytes are extracted each time as a byte block. If the total length of the byte stream is not an integer multiple of 64 bytes, 0x00 bytes are added to the end of the last byte block that is less than 64 bytes, until the byte block length reaches 64 bytes. Next, a 32-bit binary initial value is initialized. Each segmented byte block is processed. First, the 8-bit binary number of each byte in the byte block is input into the processing logic in sequence. Each byte is XORed with the current 32-bit binary value. After the XOR operation of all bytes is completed, the resulting 32-bit binary value is shifted left by 4 bits. The empty low bits after the shift are padded. The first byte block is then shifted and added to the sum of the decimal values ​​of all bytes in the block to obtain the processing result. The result of the first byte block is then used as the intermediate total result. This process of XOR, shift, and addition is repeated for each subsequent byte block, with the current byte block's processing result XORed with the previous intermediate total result each time, updating the intermediate total result. After all byte blocks have been processed, the final intermediate total result is converted to a hexadecimal string. During the conversion, every 4 binary bits correspond to 1 hexadecimal bit, converting from high to low bits. If the result is less than 32 bits, high bits are padded with 0s, resulting in a 32-bit hexadecimal string, which is the result digest for the target walkie-talkie. The entire processing logic, byte block size, initial values, and conversion rules are completely consistent with the command initiator, ensuring the consistency and comparability of the result digest.

[0181] The beneficial effects are as follows: the target walkie-talkie uses a session key to accurately decrypt the first ciphertext command, ensuring the accurate restoration of the plaintext command; the command parsing module performs in-depth parsing of the plaintext command, enabling reliable extraction of operation instructions and auxiliary parameters; the execution end performs read and write operations according to the instructions and parameters and generates the original operation results, ensuring the relevance and effectiveness of the operation execution; the standardized processing of the original operation results generates a result digest, providing a basis for verifying the integrity of the operation results; the original operation results and result digest are synchronously returned to the command initiator; and with the recalculation and comparison of the local digest, the entire execution process is verified, comprehensively improving the security, accuracy, and reliability of the command execution and result feedback process.

[0182] Unified data format conversion ensures the standardization and consistency of the result data, avoiding subsequent processing anomalies caused by format differences; sorting by field identifier lexicographical order fixes the arrangement logic of the standardized data sequence, eliminating the impact of disordered field order on the summary results; the byte encoding process retains all field information and has no redundant data, ensuring the integrity and conciseness of the standardized byte stream; the same summary processing flow as the command initiator ensures the accuracy and comparability of the result summary, enabling the result summary of the target walkie-talkie to be effectively verified with the summary result of the command initiator, improving the reliability of operation result transmission and verification.

[0183] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0184] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A talk-around terminal multihop long-range communication system, characterized by The system includes a signature module, an encryption module, a feature acquisition module, a communication establishment module, an operation instruction encryption module, and an operation determination module, wherein: The signature module is used to sign the first random number in the authentication request sent by the authentication platform to the target walkie-talkie, to obtain the first signature data of the target walkie-talkie, and to send the first signature data and the digital certificate of the target walkie-talkie to the authentication platform. The encryption module is used to encrypt a second random number generated by the authentication platform using the public key of the target walkie-talkie when the authentication platform verifies that the digital certificate is valid, thereby obtaining the first encrypted data of the target walkie-talkie. The feature acquisition module is used to, after the target walkie-talkie decrypts the first encrypted data using its own private key, use the hash value of the first random number in the authentication request and the second random number obtained by decryption as the first feature parameter. The communication establishment module is used by the authentication platform to calculate the identity authentication based on the first feature parameter. After successful authentication, the authentication token of the target walkie-talkie is obtained, and a secure communication channel is negotiated and established between the authentication platform and the target walkie-talkie, including: The local hash value of the authentication platform is calculated based on the first random number and the second random number generated and stored by the authentication platform. The received first feature parameter is compared with the local hash value; When the comparison matches, the authentication platform determines that the identity authentication is successful; When identity authentication is successful, the authentication platform generates an authentication token; The authentication platform uses a symmetric encryption algorithm and key pre-negotiated with the target walkie-talkie to encrypt the authentication token, thereby obtaining the authentication platform's encrypted token. The authentication platform sends the encryption token to the target walkie-talkie; The authentication platform and the target walkie-talkie generate a temporary session seed based on the authentication token; The authentication platform exchanges public-key encrypted random parameters with the target walkie-talkie; The authentication platform and the target walkie-talkie use the temporary session seed and the random parameters to generate a session key through the same key derivation function. The secure transmission protocol is initialized using the session key to establish a secure communication channel between the authentication platform and the target walkie-talkie. The operation command encryption module is used to generate a plaintext command through the command initiator of the secure communication channel, and encrypt the plaintext command using the current session key to obtain the first ciphertext command of the target walkie-talkie. The operation determination module is used for the target walkie-talkie to decrypt the first ciphertext command to obtain the operation instruction of the target walkie-talkie. After the execution end of the target walkie-talkie executes the operation instruction, it returns a digest value of the operation result. The command initiating end confirms the execution completion degree of the execution end based on the digest value.

2. A talk-through terminal multihop long-range communication system as claimed in claim 1, characterized in that When the signature module signs the first random number in the authentication request sent by the target walkie-talkie to the authentication platform to obtain the first signature data of the target walkie-talkie, it is specifically used for: The target walkie-talkie receives an authentication request sent by the authentication platform and extracts a first random number from the authentication request; The target walkie-talkie performs a hash operation on the first random number to obtain the first intermediate digest of the target walkie-talkie; The target walkie-talkie uses a preset private key to encrypt and sign the first intermediate digest, thereby obtaining the first signature data of the target walkie-talkie.

3. The multi-hop long-distance communication system for intercom terminals as described in claim 2, characterized in that, When the authentication platform verifies the digital certificate as valid, the encryption module, specifically used to encrypt the second random number generated by the authentication platform using the public key of the target walkie-talkie to obtain the first encrypted data of the target walkie-talkie, performs the following operations: After verifying the validity of the digital certificate, the authentication platform immediately generates a second random number for the digital certificate. The authentication platform extracts the public key of the target walkie-talkie from the verified digital certificate; The authentication platform uses the public key to encrypt the second random number to obtain the first encrypted data of the target walkie-talkie.

4. The multi-hop long-distance communication system for intercom terminals as described in claim 3, characterized in that, When the feature acquisition module executes the decryption of the first encrypted data using the target walkie-talkie's private key, and uses the hash value of the first random number in the authentication request and the decrypted second random number as the first feature parameter, it is specifically used for: The target walkie-talkie decrypts the received first encrypted data according to a preset private key to obtain a second random number from the authentication platform; The target walkie-talkie extracts the first random number from the received authentication request; The first random number and the second random number are concatenated to obtain the combined data to be hashed; A hash operation is performed on the combined data to generate a unique digest value, which is used as the first feature parameter of the target walkie-talkie.

5. A multi-hop long-distance communication system for intercom terminals as described in claim 1, characterized in that, When the operation command encryption module generates a plaintext command at the command initiator through the secure communication channel, and encrypts the plaintext command using the current session key to obtain the first ciphertext command of the target walkie-talkie, it is specifically used for: The command initiator of the secure communication channel generates initial command data for the target walkie-talkie based on the operation type and operation parameters to be executed. The initial command data is appended with a current timestamp and a unique sequence identifier to obtain the structured command data of the target walkie-talkie; The structured command data is digested to obtain a command digest of the structured command data; The command digest is appended to the end of the structured command data to obtain the plaintext command of the secure communication channel; Using the current session key, the first ciphertext command of the target walkie-talkie is obtained by symmetrically encrypting the plaintext command.

6. The multi-hop long-distance communication system for intercom terminals as described in claim 5, characterized in that, The operation instruction encryption module performs digest calculation on the structured command data to obtain a command digest of the structured command data, specifically for: Obtain the byte sequence of the structured command data, and obtain the dynamic random factor currently derived from the authentication token; The byte sequence is mixed with the dynamic random factor to obtain the mixed data sequence of the secure communication channel; The mixed data sequence is digested to obtain a command digest of the structured command data. The formula for calculating the digest value in the command digest is as follows: ； In the formula, For summary value, This is a standard SHA-256 cryptographic hash function operation. For the integer representation of the mixed data sequence, This is the integer representation of the dynamic random factor. For bitwise XOR operation, For data concatenation operations, This is an integer representation of the sequence identifier attached to the structured command data. This is an integer representation of the timestamps attached to the structured command data. For modulo operation, The modulus of a prime number is a predefined prime number.

7. A multi-hop long-distance communication system for intercom terminals as described in claim 1, characterized in that, The operation determination module, when executing the target walkie-talkie to decrypt the first ciphertext command to obtain the operation instructions of the target walkie-talkie, and the execution end of the target walkie-talkie returns a digest value of the operation result after executing the operation instructions, and the command initiating end confirms the execution completion degree of the execution end based on the digest value, is specifically used for: The target walkie-talkie uses the current session key to decrypt the received first ciphertext command to obtain the plaintext command from the command initiator. The target walkie-talkie parses the specific operation instructions and auxiliary parameters from the plaintext command; The execution terminal within the target walkie-talkie performs corresponding read / write operations according to the operation instructions and auxiliary parameters to obtain the original operation results of the target walkie-talkie; The target walkie-talkie performs normalization processing on the original operation results to obtain a result summary of the target walkie-talkie; The target walkie-talkie returns the original operation result and the result summary to the command initiator; After receiving the original operation result and the result summary, the command initiator recalculates the local summary. The recalculated local digest is compared with the received result digest. If they match, the execution of the execution terminal is confirmed to be complete and error-free.

8. A multi-hop long-distance communication system for intercom terminals as described in claim 7, characterized in that, When the operation determination module performs normalization processing on the original operation result by the target walkie-talkie to obtain the result summary of the target walkie-talkie, it is specifically used for: The status code, data fields, and time information contained in the original operation result are converted according to a predefined unified data format to obtain the result data of the target walkie-talkie. The target walkie-talkie's standardized data sequence is obtained by sorting the fields in the result data lexicographically based on their field identifiers. The standardized data sequence is byte-encoded to obtain a standardized byte stream to be digested in the target walkie-talkie; The standard byte stream to be digested is subjected to the same digest processing as the command initiator to obtain the result digest of the target walkie-talkie.

Images