Data encryption transmission method, device, system and storage medium

Abstract

The embodiment of the application provides a data encryption transmission method, device, system and storage medium, the method comprises the steps that a near field point-to-point data communication link is established between a first communication node and a second communication node, wherein the first communication node is a control terminal, and the second communication node is a controlled Bluetooth network device;A network key of a network to which the second communication node belongs is acquired;The encryption key of the transparent data in the near field point-to-point data communication link is determined based on the network key;The encryption key is used to encrypt the plaintext data to be transmitted, and the encrypted data frame is obtained;The encrypted data frame is transmitted between the first communication node and the second communication node via the near field point-to-point data communication link.The application solves the technical problems of low security and low communication efficiency in the related art when data encryption transmission is carried out.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to a data encryption transmission method, apparatus, system, and storage medium. Background Technology

[0002] Bluetooth Mesh technology is widely used in the Internet of Things (IoT) due to its powerful networking capabilities. After devices are paired with the network, a network key (NetKey) is generated to ensure network layer security. However, in the transparent transmission configuration of the Generic Attribute Profile (GATT) between the control terminal and the controlled Bluetooth network device, some solutions use plaintext transmission, making the data vulnerable to eavesdropping or tampering, resulting in insufficient security. In addition, some solutions design a separate key negotiation mechanism for the GATT channel, which increases system complexity, development costs, and communication overhead, prolongs connection time, and thus reduces communication efficiency.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a data encryption transmission method, apparatus, system, and storage medium to at least solve the technical problems of low security and low communication efficiency in related technologies when performing data encryption transmission.

[0005] According to one aspect of the embodiments of this application, a data encryption transmission method is provided, comprising: establishing a near-field point-to-point data communication link between a first communication node and a second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device; obtaining a network key of the network to which the second communication node belongs; determining an encryption key for transparent data in the near-field point-to-point data communication link based on the network key; encrypting plaintext data to be transmitted using the encryption key to obtain an encrypted data frame; and transmitting the encrypted data frame between the first communication node and the second communication node via the near-field point-to-point data communication link.

[0006] Optionally, the data encryption transmission method further includes: initializing the first serial number in the first communication direction and the second serial number in the second communication direction, respectively, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

[0007] Optionally, encrypting the plaintext data to be transmitted using an encryption key to obtain an encrypted data frame includes: encrypting the plaintext data using an encryption key and a first sequence number to obtain ciphertext data; generating verification information based on the encryption key and the ciphertext data; and sequentially combining the first sequence number, the ciphertext data, and the verification information to obtain an encrypted data frame.

[0008] Optionally, encrypting plaintext data using an encryption key and a first sequence number to obtain ciphertext data includes: determining a one-time number based on the first sequence number; and encrypting plaintext data using an encryption key and a one-time number to obtain ciphertext data.

[0009] Optionally, determining the one-time number based on the first serial number includes: obtaining the direction identifier corresponding to the first serial number; and combining the direction identifier, the first serial number, and the padding data to generate the one-time number.

[0010] Optionally, the field length of the direction identifier is 1 byte, the field length of the first sequence number is 2 bytes, and the field length of the padding data is 10 bytes.

[0011] Optionally, the data encryption transmission method further includes: converting the format of the first serial number to obtain additional authentication data.

[0012] Optionally, generating verification information based on the encryption key and ciphertext data includes: generating verification information based on the encryption key, ciphertext data, one-time number, and additional authentication data, wherein the field length of the verification information is 4 bytes.

[0013] According to another aspect of the embodiments of this application, a data encryption transmission method is provided, comprising: establishing a near-field point-to-point data communication link between a first communication node and a second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device; obtaining a network key of the network to which the second communication node belongs; determining an encryption key for transparent data in the near-field point-to-point data communication link based on the network key, wherein the encryption key is used by the first communication node to encrypt plaintext data to be transmitted to obtain an encrypted data frame; receiving the encrypted data frame from the first communication node via the near-field point-to-point data communication link; and decrypting the encrypted data frame to obtain plaintext data.

[0014] Optionally, decrypting the encrypted data frame to obtain plaintext data includes: decrypting the encrypted data frame to obtain a first sequence number, ciphertext data, and verification information, wherein the first sequence number is used to identify the transmission order of the encrypted data frame, the ciphertext data is the encrypted plaintext data, and the verification information is used to perform integrity verification on the encrypted data frame; and decrypting the ciphertext data based on the first sequence number, encryption key, and verification information to obtain plaintext data.

[0015] Optionally, decrypting the ciphertext data based on the first sequence number, encryption key, and verification information to obtain plaintext data includes: determining whether the first sequence number matches the local sequence number of the second communication node; in response to the match between the first sequence number and the local sequence number, constructing a one-time number and additional authentication data based on the encryption key; and using the encryption key, one-time number, and additional authentication data to decrypt and verify the integrity of the ciphertext data to obtain plaintext data.

[0016] Optionally, the data encryption transmission method further includes: in response to the disconnection of the near-field point-to-point data communication link, resetting the first sequence number in the first communication direction and the second sequence number in the second communication direction, respectively, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

[0017] Optionally, the data encryption transmission method further includes: in response to the original service data to be transmitted by the first communication node exceeding the maximum single transmission load of the near-field point-to-point data communication link, splitting the original service data into plaintext segments to obtain plaintext data.

[0018] According to another aspect of the embodiments of this application, a data encryption transmission system is also provided, comprising: a control terminal, configured to establish a near-field point-to-point data communication link between the control terminal and a controlled Bluetooth network device; obtain a network key of the network to which the controlled Bluetooth network device belongs; determine an encryption key for transparent data in the near-field point-to-point data communication link based on the network key; encrypt plaintext data to be transmitted using the encryption key to obtain an encrypted data frame; and transmit the encrypted data frame to the controlled Bluetooth network device via the near-field point-to-point data communication link; and the controlled Bluetooth network device, configured to decrypt the encrypted data frame to obtain plaintext data.

[0019] According to another aspect of the embodiments of this application, a data encryption transmission device is also provided, comprising: a first establishment module, configured to establish a near-field point-to-point data communication link between a first communication node and a second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device; a first acquisition module, configured to acquire a network key of the network to which the second communication node belongs; a first determination module, configured to determine an encryption key for transparently transmitted data in the near-field point-to-point data communication link based on the network key; an encryption module, configured to encrypt plaintext data to be transmitted using the encryption key to obtain an encrypted data frame; and a transmission module, configured to transmit the encrypted data frame between the first communication node and the second communication node via the near-field point-to-point data communication link.

[0020] Optionally, the data encryption transmission device further includes: an initialization module, used to initialize the first serial number in the first communication direction and the second serial number in the second communication direction, respectively, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

[0021] Optionally, the encryption module is further configured to: encrypt plaintext data using an encryption key and a first sequence number to obtain ciphertext data; generate verification information based on the encryption key and the ciphertext data; and combine the first sequence number, the ciphertext data, and the verification information in sequence to obtain an encrypted data frame.

[0022] Optionally, the encryption module is also used to: determine a one-time number based on the first serial number; and encrypt the plaintext data using the encryption key and the one-time number to obtain ciphertext data.

[0023] Optionally, the encryption module is also used to: obtain the direction identifier corresponding to the first sequence number; and combine the direction identifier, the first sequence number, and the padding data to generate a one-time number.

[0024] Optionally, the field length of the direction identifier is 1 byte, the field length of the first sequence number is 2 bytes, and the field length of the padding data is 10 bytes.

[0025] Optionally, the data encryption transmission device further includes a conversion module for converting the format of the first serial number to obtain additional authentication data.

[0026] Optionally, the encryption module is also used to generate verification information based on the encryption key, ciphertext data, one-time number, and additional authentication data, wherein the field length of the verification information is 4 bytes.

[0027] According to another aspect of the embodiments of this application, a data encryption transmission device is also provided, comprising: a second establishment module, configured to establish a near-field point-to-point data communication link between a first communication node and a second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device; a second acquisition module, configured to acquire a network key of the network to which the second communication node belongs; a second determination module, configured to determine an encryption key for transparent data in the near-field point-to-point data communication link based on the network key, wherein the encryption key is used by the first communication node to encrypt plaintext data to be transmitted to obtain an encrypted data frame; a receiving module, configured to receive the encrypted data frame from the first communication node via the near-field point-to-point data communication link; and a decryption module, configured to decrypt the encrypted data frame to obtain plaintext data.

[0028] Optionally, the decryption module is further configured to: decrypt the encrypted data frame to obtain a first sequence number, ciphertext data, and verification information, wherein the first sequence number is used to identify the sending order of the encrypted data frame, the ciphertext data is the encrypted plaintext data, and the verification information is used to perform integrity verification on the encrypted data frame; and decrypt the ciphertext data based on the first sequence number, encryption key, and verification information to obtain plaintext data.

[0029] Optionally, the decryption module is further configured to: determine whether the first sequence number matches the local sequence number of the second communication node; in response to the match between the first sequence number and the local sequence number, construct a one-time number and additional authentication data based on the encryption key; and use the encryption key, the one-time number, and the additional authentication data to decrypt and verify the integrity of the ciphertext data to obtain plaintext data.

[0030] Optionally, the data encryption transmission device further includes: a reset module, used to reset the first serial number in the first communication direction and the second serial number in the second communication direction respectively in response to the disconnection of the near-field point-to-point data communication link, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

[0031] Optionally, the data encryption transmission device further includes: a splitting module, used to split the original business data into plaintext segments in response to the original business data to be transmitted by the first communication node exceeding the maximum single transmission load of the near-field point-to-point data communication link, to obtain plaintext data.

[0032] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to perform the methods of various embodiments of this application.

[0033] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the methods of various embodiments of this application.

[0034] In this embodiment, a near-field point-to-point data communication link is established between a first communication node and a second communication node. The network key of the network to which the second communication node belongs is obtained. Based on the network key, an encryption key for the transparent data in the near-field point-to-point data communication link is determined. The plaintext data to be transmitted is encrypted using the encryption key to obtain an encrypted data frame. The encrypted data frame is then transmitted via the near-field point-to-point data communication link. This achieves the technical effect of encrypting and authenticating near-field transparent data using the Bluetooth Mesh network key, thereby improving the security and communication efficiency of near-field communication. This solves the technical problems of low security and low communication efficiency in related technologies when performing encrypted data transmission. Attached Figure Description

[0035] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0036] Figure 1 This is a flowchart of an optional data encryption transmission method according to an embodiment of this application;

[0037] Figure 2 This is a schematic diagram of an optional encrypted data frame according to an embodiment of this application;

[0038] Figure 3 This is a schematic diagram of an optional one-time digit according to an embodiment of this application;

[0039] Figure 4 This is a flowchart of another optional data encryption transmission method according to an embodiment of this application;

[0040] Figure 5 This is a schematic diagram of an optional data encryption transmission method according to an embodiment of this application;

[0041] Figure 6 This is a structural block diagram of an optional data encryption transmission device according to an embodiment of this application;

[0042] Figure 7 This is a structural block diagram of another optional data encryption transmission device according to an embodiment of this application. Detailed Implementation

[0043] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0044] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0045] With the rapid development of IoT technology, Bluetooth Mesh networks, with their many-to-many (m:m) communication capabilities, self-organizing network characteristics, and strong coverage, are widely used in smart homes, industrial control, and other scenarios. In a typical Bluetooth Mesh application architecture, terminal devices join the network through a configuration process and generate a network key (NetKey) to ensure the security of network layer message transmission. However, in practical applications, users often need to use mobile terminals such as smartphones to perform near-field interactions with specific devices in the Mesh network to complete configuration, debugging, or status queries. Currently, these near-field interactions are typically based on the Bluetooth Low Energy (BLE) Generic Attribute Profile (GATT) to establish point-to-point connections for data pass-through.

[0046] The relevant GATT pass-through solutions suffer from the following technical drawbacks: First, insufficient security. These solutions use plaintext transmission over the GATT channel, making business data highly susceptible to eavesdropping or tampering, posing a serious security risk. Second, complex key management. While some solutions introduce encryption mechanisms, they design a separate key negotiation and management process for the GATT channel. This not only increases the system's hardware and software complexity and development costs but also prolongs connection establishment time due to additional handshake interactions, reducing communication efficiency. Finally, significant resource waste. Devices acquire and store high-security NetKeys during the Mesh network configuration phase, but these are not effectively reused during near-field GATT communication, resulting in idle security resources.

[0047] Because the proxy service in the Bluetooth Mesh standard only handles encrypting data packets at the network layer and forwarding them via GATT, it does not provide independent encryption protection for application layer data transmission. Therefore, related technologies still need to leverage existing Mesh network keys to provide highly secure and low-overhead encryption protection for the GATT transmission channel while maintaining a lightweight system.

[0048] According to an embodiment of this application, a method embodiment for encrypted data transmission is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0049] Figure 1 This is a flowchart of an optional data encryption transmission method according to an embodiment of this application, such as... Figure 1 As shown, the process includes the following steps:

[0050] Step S101: Establish a near-field point-to-point data communication link between the first communication node and the second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device.

[0051] Step S102: Obtain the network key of the network to which the second communication node belongs;

[0052] Step S103: Determine the encryption key for transparent data in the near-field point-to-point data communication link based on the network key;

[0053] Step S104: Encrypt the plaintext data to be transmitted using the encryption key to obtain an encrypted data frame;

[0054] Step S105: Transmit encrypted data frames between the first communication node and the second communication node via a near-field point-to-point data communication link.

[0055] The first communication node can be the control terminal that initiates the near-field data communication request. In application scenarios, it is usually manifested as a smartphone application (APP) or configuration tool, which is responsible for sending control commands to the controlled device or receiving device status data.

[0056] The second communication node can be a controlled Bluetooth network device that responds to near-field data communication requests. In application scenarios, it is usually manifested as Internet of Things (IoT) terminal devices such as smart bulbs, switches, or sensors that have joined the Bluetooth Mesh network, responsible for executing control commands or reporting operating status.

[0057] A near-field point-to-point data communication link can be a direct connection channel established between a control terminal and a controlled Bluetooth network device via Bluetooth Low Energy, used to enable data interaction between devices at close range. In this embodiment, the link is used to carry transparent data between the control terminal and the controlled Bluetooth network device.

[0058] For example, when establishing a near-field point-to-point data communication link between the first communication node and the second communication node, the first communication node, i.e., the control terminal, scans for nearby Bluetooth Low Energy broadcast signals, identifies the second communication node, i.e., the controlled Bluetooth network device, that supports a specific service, and initiates a connection request. After receiving the connection request, the controlled Bluetooth network device completes a link-layer handshake, establishing a stable Bluetooth Low Energy connection and providing a physical channel for subsequent data transmission. This step establishes a physical connection between the control terminal and the controlled Bluetooth network device, providing a basic transmission environment for secure communication.

[0059] In an optional embodiment, communication between the control terminal and the controlled Bluetooth network device needs to be conducted via a specific GATT service and feature. For example, a specific GATT service with UUID 0xFE00 can be used. The control terminal sends the generated encrypted data frame to the controlled Bluetooth network device by performing a "Write" operation on the feature with UUID 0xFE02. The controlled Bluetooth network device pushes the generated encrypted data frame to the control terminal by sending a "Notify" operation on the feature with UUID 0xFE01.

[0060] A network key is a protection key used in a Bluetooth Mesh network to encrypt and authenticate messages at the network layer. It is generated and distributed by Bluetooth Mesh devices during the network configuration process to ensure the security of message transmission within the Mesh network.

[0061] For example, after the control terminal and the controlled Bluetooth network device establish a near-field point-to-point data communication link, both parties need to perform a key acquisition step. The controlled Bluetooth network device can obtain the network key of its mesh network from its internal Bluetooth Mesh protocol stack. The control terminal can obtain this network key from the controlled Bluetooth network device through the near-field point-to-point data communication link, or the control terminal can read the network key associated with the controlled Bluetooth network device from its local cache. This step achieves secure acquisition of the network key, providing a foundation for subsequent reuse of the key for near-field communication encryption.

[0062] Transparent data can be business data generated and transmitted directly by the application layer in a near-field point-to-point data communication link without application layer protocol encapsulation and conversion.

[0063] The encryption key can be a protection parameter used to encrypt and decrypt transparent data. In this embodiment, the encryption key is the same as the network key used to ensure the security of network layer messages in the Bluetooth Mesh network. It is obtained by the first and second communication nodes through multiplexing after establishing a near-field connection, thus avoiding the overhead of independent key negotiation.

[0064] For example, the encryption key for transparent data in the near-field point-to-point data communication link is determined based on the network key. The control terminal and the controlled Bluetooth network device configure the acquired network key as an encryption key using the Advanced Encryption Standard with Counter with Cipher Block Chaining Message Authentication Code (AES-128-CCM) algorithm, respectively, for subsequent data encryption and decryption operations. This step achieves unified key configuration, avoids designing a separate key negotiation process for near-field communication, reduces system complexity, enables network key reuse, and directly elevates the security level of near-field communication to the same level as the Bluetooth Mesh network layer.

[0065] Plaintext data can be the raw application layer service data that has not been encrypted, that is, user instructions, configuration parameters or device status information before being transmitted through the near-field point-to-point data communication link. This data is converted into ciphertext as input during the encryption process to ensure its confidentiality in the wireless channel.

[0066] An encrypted data frame can be a data unit composed of a sequence number, ciphertext, and message integrity check code in sequence, used to ensure the confidentiality, integrity, and replay protection of data during transmission.

[0067] For example, after obtaining the encryption key, the plaintext data to be transmitted is encrypted using the encryption key to obtain an encrypted data frame. The sender obtains the sequence number of the current direction, uses the sequence number as additional authentication data, constructs a one-time number (Nonce) containing the direction identifier, sequence number, and padding data, performs encryption operations on the plaintext data using the encryption key, generates ciphertext and a message integrity check code, and concatenates the sequence number, ciphertext, and message integrity check code to form an encrypted data frame. This step realizes the confidentiality protection and integrity authentication of application layer business data, ensuring that the data is not eavesdropped on, tampered with, or replayed during transmission, reflecting the collaborative security design of one-time number construction and additional authentication data selection.

[0068] For example, after acquiring the encrypted data frame, it is transmitted between the first and second communication nodes via a near-field point-to-point data communication link. The sender writes the encrypted data frame into the Bluetooth Low Energy (BLE) feature value, and the receiver acquires the encrypted data frame by listening for BLE feature value notifications or reading responses, and performs sequence number verification and message integrity verification. This step achieves secure transmission of encrypted data, ensuring the efficiency and reliability of the communication process.

[0069] Based on the above steps S101 to S105, this embodiment of the application establishes a near-field point-to-point data communication link between the first communication node and the second communication node, obtains the network key of the network to which the second communication node belongs, determines the encryption key for the transparent data in the near-field point-to-point data communication link based on the network key, encrypts the plaintext data to be transmitted using the encryption key to obtain an encrypted data frame, and transmits the encrypted data frame via the near-field point-to-point data communication link. This realizes the encryption and authentication of near-field transparent data using the Bluetooth Mesh network key, thereby achieving the technical effect of improving the security and communication efficiency of near-field communication, and thus solving the technical problems of low security and low communication efficiency in related technologies when performing encrypted data transmission.

[0070] Optionally, the data encryption transmission method further includes: initializing the first serial number in the first communication direction and the second serial number in the second communication direction, respectively, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

[0071] The first communication direction can be the data transmission path for the control terminal to send data to the controlled Bluetooth network device. It can be represented by Seq_APP_to_Dev and is used to implement the downlink transmission of control commands or configuration information.

[0072] The first sequence number (Seq1) can be a unique count value used to identify the order of data transmission in the first communication direction. The first sequence number occupies 2 bytes and is stored in little-endian order. This value is incremented with each frame of data sent to prevent replay attacks and ensure the orderly reception of data packets.

[0073] The second communication direction can be the data transmission path for the controlled Bluetooth network device to send data to the control terminal. It can be represented by Seq_Dev_to_APP and is used to realize the uplink transmission for device status feedback or data reporting.

[0074] The second sequence number (Seq2) can be a unique counter value used to identify the order of data transmission in the second communication direction. This value increments with each frame of data sent to prevent replay attacks and ensure the orderly reception of data packets.

[0075] Initialization can be achieved by setting the initial values ​​of the first and second sequence numbers to zero or a pre-agreed starting value to ensure that both communicating parties are in a synchronized state at the start of the session.

[0076] For example, during initialization, when the control terminal and the controlled Bluetooth network device establish a near-field point-to-point data communication link, the control terminal resets the first sequence number used for communication from the control terminal to the controlled Bluetooth network device to its initial value. Simultaneously, the controlled Bluetooth network device also resets its second sequence number used for communication from the controlled Bluetooth network device to the control terminal to its initial value, or both communicating parties mutually confirm that the other's sequence number has been reset to its initial value. This step ensures that each new near-field communication session starts from a known and consistent baseline state by maintaining independent sequence number counters for the two independent communication directions and synchronously resetting the counters when the connection is established, thus avoiding sequence number asynchronization issues caused by device restarts or prolonged offline periods.

[0077] Based on the above optional embodiments, this application embodiment initializes the first sequence number in the first communication direction and the second sequence number in the second communication direction respectively, thereby synchronizing the sequence number status of both communicating parties at the beginning of each near-field communication session, ensuring the uniqueness and continuity of the data frame sequence, effectively resisting replay attacks, simplifying the sequence number status maintenance logic, and improving the reliability and security of the communication connection.

[0078] Optionally, encrypting the plaintext data to be transmitted using an encryption key to obtain an encrypted data frame includes: encrypting the plaintext data using an encryption key and a first sequence number to obtain ciphertext data; generating verification information based on the encryption key and the ciphertext data; and sequentially combining the first sequence number, the ciphertext data, and the verification information to obtain an encrypted data frame.

[0079] Ciphertext is unreadable data generated by encrypting plaintext data using an encryption algorithm. It has the same length as the original plaintext data.

[0080] The verification information can be a Message Integrity Check (MIC) used to verify data integrity and prevent tampering. In this embodiment, the verification information can be a 4-byte Message Integrity Check.

[0081] For example, when encrypting plaintext data to be transmitted using an encryption key to obtain an encrypted data frame, the plaintext data is first encrypted using the encryption key and a first sequence number to obtain ciphertext data. The sender obtains the first sequence number of the current first communication direction, configures this first sequence number as additional authentication data, constructs a one-time number containing a direction identifier, the first sequence number, and padding data, and uses the encryption key to perform an Advanced Encryption Standard-Counter Mode combined with a Cryptographic Block Chaining Message Authentication Code (CLC) algorithm on the plaintext data to generate ciphertext data. This step achieves confidentiality protection of business data, ensures that data is not eavesdropped on in the wireless channel, and uses a network key for application layer data encryption, avoiding the complexity of independent key negotiation.

[0082] Based on the encryption key and ciphertext data, verification information is generated. For example, during the encryption process, the sender calculates a message integrity check code using the encryption key, a one-time digit, and additional authentication data (i.e., the first sequence number). This verification information is bound to the first sequence number and the ciphertext data, and is used by the receiver to verify whether the data has been tampered with. This step achieves data integrity authentication, includes the sequence number in the verification scope, prevents attackers from replacing the sequence number to disrupt the receiver's state, and demonstrates a collaborative security design between the one-time digit construction and the selection of additional authentication data.

[0083] After obtaining the ciphertext data and verification information, the first sequence number, ciphertext data, and verification information are combined in sequence to obtain an encrypted data frame. For example, the sender concatenates a 2-byte first sequence number, N bytes of ciphertext data, and 4 bytes of verification information in a specific order to form an encrypted data frame structure that meets the requirements of Bluetooth Low Energy transmission. This step implements standard encapsulation of the data frame, ensuring that the receiver can correctly parse and decrypt the data, and improving the compatibility and execution efficiency of the communication protocol.

[0084] Figure 2 This is a schematic diagram of an optional encrypted data frame according to an embodiment of this application, such as... Figure 2 As shown, this encrypted data frame consists of a 2-byte sequence number (Seq), N bytes of ciphertext data, and a 4-byte checksum (MIC) concatenated in a specific order. The sequence number, located at the beginning of the data frame and stored in little-endian format, identifies the order in which data packets are sent, preventing replay attacks. The ciphertext data is located in the middle, where N depends on the length of the original plaintext data. The checksum, or MIC, is located at the end of the data frame and is used by the receiver to verify whether the data has been tampered with during transmission, ensuring data integrity. This compact frame structure design ensures high security while minimizing communication overhead, adapting to the transmission requirements of Bluetooth Low Energy (BLE) environments.

[0085] Based on the above optional embodiments, this application embodiment encrypts plaintext data using an encryption key and a first sequence number to obtain ciphertext data, generates verification information based on the encryption key and ciphertext data, and combines the first sequence number, ciphertext data, and verification information in sequence to obtain an encrypted data frame. This achieves confidentiality protection, integrity authentication, and anti-replay attack for application layer business data, improves the security of near-field communication, simplifies the key management process, and improves communication efficiency.

[0086] Optionally, encrypting plaintext data using an encryption key and a first sequence number to obtain ciphertext data includes: determining a one-time number based on the first sequence number; and encrypting plaintext data using an encryption key and a one-time number to obtain ciphertext data.

[0087] The one-time number (Nonce) can be a parameter used in the Advanced Encryption Standard-Counter Mode Combined with Cipher Block Chain Message Authentication Code Algorithm (AES-128-CCM) to ensure the uniqueness of each encrypted input. In the embodiments of this application, the one-time number is composed of a direction identifier, a first sequence number and padding data, with a total length of 13 bytes.

[0088] For example, when determining a one-time number based on the first sequence number, the sender constructs a one-time number containing a 1-byte direction identifier, a 2-byte first sequence number, and 10 bytes of padding data. The direction identifier is fixed at 0x01 to identify the first communication direction, and the first sequence number is embedded in the one-time number structure in little-endian format, ensuring that different sequence numbers under the same key correspond to different one-time numbers. This step ensures complete isolation of the one-time number space in bidirectional communication by introducing a direction identifier, avoiding the risk of reusing one-time numbers, while utilizing the sequence number to guarantee the diversity of encrypted inputs each time under the same direction.

[0089] After determining the one-time digit, the plaintext data is encrypted using the encryption key and the one-time digit to obtain ciphertext data. For example, the sender uses the encryption key, the constructed one-time digit, and the first sequence number as additional authentication data, inputting them into the Advanced Encryption Standard-Counter Mode combined with the Cipher Block Chaining Message Authentication Code (CBC) algorithm to perform encryption operations on the plaintext data, generating ciphertext data of the same length as the plaintext data, and simultaneously generating a message integrity check code. This step achieves confidentiality protection for application-layer business data, ensuring that data is not eavesdropped on in the wireless channel, while the uniqueness of the one-time digit guarantees the security strength of the encryption process.

[0090] Based on the above optional embodiments, this application embodiment determines a one-time number based on a first sequence number and uses an encryption key and the one-time number to encrypt plaintext data to obtain ciphertext data. This achieves the construction of a unique one-time number using a direction identifier and a sequence number to ensure the uniqueness of the encrypted input. By combining the Advanced Encryption Standard-Counter mode with the Cryptographic Block Chain Message Authentication Code algorithm, the confidentiality of the data is protected, improving the security of near-field communication, simplifying the key management process, and improving communication efficiency.

[0091] Optionally, determining the one-time number based on the first serial number includes: obtaining the direction identifier corresponding to the first serial number; and combining the direction identifier, the first serial number, and the padding data to generate the one-time number.

[0092] The direction identifier (Dir) is a one-byte data used to distinguish the direction of data transmission. In this embodiment, 0x01 represents the communication direction from the control terminal to the controlled Bluetooth network device, and 0x02 represents the communication direction from the controlled Bluetooth network device to the control terminal.

[0093] Padding data is zero-value data used to fill in the length of a single number to the fixed number of bytes required by the algorithm. In this embodiment, the padding data is 10 bytes of all zeros.

[0094] When determining a one-time number based on the first sequence number, the direction identifier corresponding to the first sequence number is first obtained. For example, the sender determines the corresponding direction identifier value based on the communication link direction in which the current data transmission is taking place. Since the first communication direction is defined as the communication direction from the control terminal to the controlled Bluetooth network device, the direction identifier obtained by the sender is 0x01.

[0095] After obtaining the direction identifier, the direction identifier, the first sequence number, and the padding data are combined to generate a one-time number. For example, the sender concatenates a 1-byte direction identifier, a 2-byte first sequence number, and 10 bytes of padding data in a specific order to form a one-time number structure with a total length of 13 bytes. This step achieves deterministic construction of the one-time number, ensuring that the one-time number changes as the first sequence number increases within the same direction. This guarantees the uniqueness of the input parameters for each encryption operation, meeting the strict requirement of uniqueness for one-time numbers in authentication encryption algorithms.

[0096] Figure 3 This is a schematic diagram of an optional one-time digit according to an embodiment of this application, such as... Figure 3As shown, this one-time number is composed of a 1-byte direction identifier (Dir), a 2-byte sequence number (Seq), and 10 bytes of padding data, concatenated in a specific order. The direction identifier is used to distinguish the direction of data transmission. The sequence number participates in the encryption operation as part of the Nonce, ensuring that the input for each encryption is unique under the same direction. The padding data is used to pad the Nonce to the required 13 bytes for the algorithm.

[0097] Based on the above optional embodiments, this application embodiment obtains the direction identifier corresponding to the first sequence number and combines the direction identifier, the first sequence number, and the padding data to generate a one-time number. This realizes the construction of a unique one-time number based on the communication direction and transmission sequence, ensuring the uniqueness and directional isolation of the input parameters of the encryption algorithm, improving the security of near-field communication, preventing replay attacks and the risk of one-time number reuse, simplifying the system implementation logic, and improving communication efficiency.

[0098] Optionally, the field length of the direction identifier is 1 byte, the field length of the first sequence number is 2 bytes, and the field length of the padding data is 10 bytes.

[0099] For example, in this embodiment, the direction identifier occupies 1 byte to provide sufficient space for direction differentiation to isolate the Nonce space under different communication paths and prevent cross-directional Nonce reuse. The first sequence number occupies 2 bytes, providing 65,536 sequence states to meet the sequence number requirements of regular near-field communication sessions while maintaining short transmission overhead. Padding data occupies 10 bytes to pad the Nonce to 13 bytes to meet the specific requirements of the AES-128-CCM algorithm for the length of a single digit. The above fixed-length field division ensures the standardization and compatibility of the Nonce structure, enabling the encryption algorithm to correctly parse the input parameters, thereby ensuring the correct execution of the encryption and decryption process.

[0100] Based on the above optional embodiments, this application embodiment constructs a one-time number structure with a total length of 13 bytes by defining the field length of the direction identifier as 1 byte, the field length of the first sequence number as 2 bytes, and the field length of the filling data as 10 bytes. This ensures that the one-time number meets the input requirements of the Advanced Encryption Standard - Counter Mode combined with the Cipher Block Chain Message Authentication Code algorithm, realizes the standardized construction of one-time numbers, ensures the normal operation of the encryption algorithm and the uniqueness of data transmission, and improves the consistency and security of the near-field communication protocol.

[0101] Optionally, the data encryption transmission method further includes: converting the format of the first serial number to obtain additional authentication data.

[0102] Additional Authenticated Data (AAD) can be data used for integrity verification but not encrypted in the Advanced Encryption Standard-Counter Mode combined with Cipher Block Chain Message Authentication Code algorithm. In this embodiment, the Additional Authenticated Data is the first sequence number.

[0103] Format conversion can be the process of converting the original storage format 2 or internal representation of the first sequence number into the specific data format required by the algorithm.

[0104] When obtaining additional authentication data, the first sequence number is format-converted to obtain the additional authentication data. For example, the sender performs a format conversion operation on the first sequence number before constructing a one-time number and inputting it as additional authentication data into the Advanced Encryption Standard-Counter Mode Combined with Cipher Block Chaining Message Authentication Code (CAPC) algorithm. Since the first sequence number is stored in little-endian in the data frame, and the algorithm's internal processing may require a specific byte order or data alignment format, this step ensures that the first sequence number participates in the calculation of the message integrity check code as additional authentication data in an algorithm-compatible format. This step, by converting the first sequence number into additional authentication data, ensures that the sequence number is not only used for replay protection but is also bound to the encrypted data; any tampering with the sequence number will cause the integrity check to fail.

[0105] In an alternative embodiment, the format conversion may include byte order conversion and data alignment. For example, byte order conversion may convert the first sequence number from little-endian to big-endian, or vice versa, to match the byte order required for internal processing by the Advanced Encryption Standard-Counter Mode Combined with Cipher Block Chaining Message Authentication Code (CLC) algorithm. Data alignment may align the first sequence number in memory or the data stream to ensure it meets the algorithm's strict requirements for integer multiples of the input data length or specific byte boundaries.

[0106] Based on the above optional embodiments, this application embodiment obtains additional authentication data by converting the format of the first serial number, thereby achieving compatibility between the first serial number and the Advanced Encryption Standard-Counter Mode combined with the Cipher Block Chain Message Authentication Code algorithm. This ensures that the first serial number can participate in the calculation of the message integrity check code as additional authentication data, enhances the binding relationship between the serial number and the encrypted content in the data frame, improves the security of near-field communication, and prevents serial number tampering attacks.

[0107] Optionally, generating verification information based on the encryption key and ciphertext data includes: generating verification information based on the encryption key, ciphertext data, one-time number, and additional authentication data, wherein the field length of the verification information is 4 bytes.

[0108] When generating verification information, the verification information is generated based on the encryption key, ciphertext data, a one-time digit, and additional authentication data. For example, the sender uses the Cipher Block Chaining Message Authentication Code (CBC-MAC) mechanism with the AES-128-CCM algorithm. It uses the network key as the encryption key, a one-time digit containing a direction identifier, a first sequence number, and padding data as the initial vector, and the first sequence number as additional authentication data. It then performs a message integrity check operation on the ciphertext data, ultimately generating 4 bytes of verification information. This step is completed before data transmission, ensuring that the receiver can reproduce the verification process using the same parameters, thereby verifying the integrity and reliability of the data's origin.

[0109] It is important to note that in actual engineering implementation, the calculation of verification information can be performed simultaneously with the encryption operation. That is, the message integrity verification code can be generated synchronously using the CBC-MAC mechanism during the encryption process.

[0110] Based on the above optional embodiments, this application embodiment generates a 4-byte field length verification information based on the encryption key, ciphertext data, one-time number and additional authentication data, thereby achieving efficient authentication of data integrity, ensuring that the first serial number is not tampered with and that each communication is unique, improving the security of near-field communication, and optimizing the transmission efficiency and reducing the communication overhead in Bluetooth Low Energy environment by using a fixed length of 4 bytes.

[0111] According to one aspect of the embodiments of this application, a data encryption transmission method is provided. Figure 4 This is a flowchart of another optional data encryption transmission method according to an embodiment of this application, such as... Figure 4 As shown. The method includes:

[0112] Step S401: Establish a near-field point-to-point data communication link between the first communication node and the second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device.

[0113] Step S402: Obtain the network key of the network to which the second communication node belongs;

[0114] Step S403: Determine the encryption key for transparent data in the near-field point-to-point data communication link based on the network key, wherein the encryption key is used by the first communication node to encrypt the plaintext data to be transmitted to obtain an encrypted data frame.

[0115] Step S404: Receive encrypted data frames from the first communication node via the near-field point-to-point data communication link;

[0116] Step S405: Decrypt the encrypted data frame to obtain plaintext data.

[0117] For example, when establishing a near-field point-to-point data communication link between the first communication node and the second communication node, the control terminal discovers the controlled Bluetooth network device through Bluetooth scanning and initiates a connection request for a general attribute profile. After the two parties complete the handshake, a direct point-to-point communication link is established, providing a physical and link layer foundation for subsequent data exchange.

[0118] For example, when obtaining the network key of the network to which the second communication node belongs, the control terminal requests the network key of the Mesh network to which the controlled Bluetooth network device belongs through the established near-field point-to-point data communication link, or reads the network key associated with the device from the local cache of the control terminal, thereby obtaining the basic key material for subsequent encrypted communication.

[0119] After obtaining the network key, the encryption key for the data transmitted transparently in the near-field point-to-point data communication link is determined based on the network key. For example, the obtained network key is directly designated as the encryption key for the data transmitted transparently in the near-field point-to-point data communication link, without the need for additional key negotiation or derivation calculations, which simplifies the key management process and establishes a unified key standard for subsequent encryption and decryption operations.

[0120] The controlled Bluetooth network device receives encrypted data frames from a first communication node via a near-field point-to-point data communication link. For example, the controlled Bluetooth network device receives, via a notification feature or write response in a general attribute profile, an encrypted data frame containing a serial number, ciphertext data, and a message integrity check code sent by the control terminal from the near-field point-to-point data communication link.

[0121] After acquiring the encrypted data frame, it is decrypted to obtain the plaintext data. For example, the controlled Bluetooth network device parses the received encrypted data frame, extracts the serial number, ciphertext data, and message integrity check code, uses the network key as the encryption key, constructs a one-time number based on the communication direction, and uses the serial number as additional authentication data to perform a message integrity check. If the check passes, the AES-128-CCM algorithm is used to decrypt the ciphertext data to recover the original plaintext data.

[0122] Based on the above steps S401 to S405, this embodiment of the application establishes a near-field point-to-point data communication link, reuses the network key as an encryption key, receives encrypted data frames and decrypts them to obtain plaintext data. This achieves the purpose of enhancing the security of near-field communication by utilizing the existing security resources of the Mesh network, avoids an independent key negotiation process, reduces system complexity and communication latency, and improves the security and efficiency of near-field communication.

[0123] Optionally, decrypting the encrypted data frame to obtain plaintext data includes: decrypting the encrypted data frame to obtain a first sequence number, ciphertext data, and verification information, wherein the first sequence number is used to identify the transmission order of the encrypted data frame, the ciphertext data is the encrypted plaintext data, and the verification information is used to perform integrity verification on the encrypted data frame; and decrypting the ciphertext data based on the first sequence number, encryption key, and verification information to obtain plaintext data.

[0124] When decrypting an encrypted data frame, the first sequence number, ciphertext data, and verification information are obtained. For example, the receiver, i.e., the second communication node, parses the received encrypted data frame and, according to the preset data frame format, separates the 2-byte first sequence number in the header, the N-byte ciphertext data in the middle, and the 4-byte verification information in the tail from the data stream, thus completing the structured parsing of the data frame.

[0125] After obtaining the first sequence number, ciphertext data, and verification information, the ciphertext data is decrypted based on the first sequence number, encryption key, and verification information to obtain plaintext data. For example, the receiver uses the network key as the encryption key and combines it with the parsed first sequence number to construct a one-time number. This one-time number contains a direction identifier, the first sequence number, and padding data. The first sequence number is then used as additional authentication data to perform AES-128-CCM algorithm decryption and integrity verification on the ciphertext data. If the verification passes, the decrypted plaintext data is output. If the verification fails, the data frame is discarded.

[0126] Based on the above optional embodiments, this application embodiment obtains the first sequence number, ciphertext data, and verification information by parsing the encrypted data frame, and decrypts the ciphertext data based on the first sequence number, encryption key, and verification information. This achieves structured parsing and reliable decryption of the data frame, ensuring that the receiver can accurately recover the original plaintext data while verifying the integrity and order of the data, thereby improving the security and reliability of near-field communication.

[0127] Optionally, decrypting the ciphertext data based on the first sequence number, encryption key, and verification information to obtain plaintext data includes: determining whether the first sequence number matches the local sequence number of the second communication node; in response to the match between the first sequence number and the local sequence number, constructing a one-time number and additional authentication data based on the encryption key; and using the encryption key, one-time number, and additional authentication data to decrypt and verify the integrity of the ciphertext data to obtain plaintext data.

[0128] The local sequence number can be the sequence number of the next data frame that the second communication node expects to receive. It is used to verify the continuity and uniqueness of the received first sequence number and to prevent replay attacks.

[0129] When decrypting ciphertext data based on the first sequence number, encryption key, and verification information to obtain plaintext data, it is first necessary to determine whether the first sequence number matches the local sequence number of the second communication node. For example, the second communication node compares the first sequence number in the received encrypted data frame with its own maintained local sequence number. If the first sequence number equals the local sequence number, it is considered a match, and subsequent decryption is allowed. If they are not equal, for example, the first sequence number is less than the local sequence number or greater than the local sequence number plus 1, it is considered a mismatch, and the encrypted data frame is discarded directly, thus effectively resisting replay attacks and out-of-order attacks.

[0130] In response to a match between the first serial number and the local serial number, a one-time number and additional authentication data are constructed based on the encryption key. For example, when the serial numbers match, the second communication node determines a direction identifier based on the communication direction, and combines this with the first serial number and preset padding data to generate a 13-byte one-time number. Simultaneously, the parsed first serial number is directly used as additional authentication data to prepare parameters for subsequent decryption and verification operations.

[0131] After obtaining the one-time digit and additional authentication data, the encrypted data is decrypted and its integrity verified using the encryption key, the one-time digit, and the additional authentication data to obtain plaintext data. For example, the second communication node uses the network key as the encryption key, the constructed one-time digit as the initial vector, and the first sequence number as the additional authentication data, inputting them into the Advanced Encryption Standard-Counter Mode combined with the Cipher Block Chaining Message Authentication Code (CACK) algorithm. The algorithm performs the decryption operation to restore the encrypted data and simultaneously calculates the message integrity check code. If the calculated message integrity check code matches the received verification information, decryption is successful, plaintext data is output, and the local sequence number is incremented by 1. If they do not match, verification fails, and the data frame is discarded.

[0132] Based on the above optional embodiments, this application embodiment achieves a replay prevention mechanism based on sequence number synchronization and a strong integrity verification based on additional authentication data by determining whether the first sequence number matches the local sequence number, constructing a one-time number and additional authentication data after matching, and using an encryption key, a one-time number and additional authentication data to decrypt and verify the integrity of the encrypted data. This ensures that decryption can only be successful when the data frame order is correct and the content has not been tampered with, thereby improving the security and data reliability of near-field communication.

[0133] Optionally, the data encryption transmission method further includes: in response to the disconnection of the near-field point-to-point data communication link, resetting the first sequence number in the first communication direction and the second sequence number in the second communication direction, respectively, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

[0134] For example, when a Bluetooth connection release or disconnection event occurs, the controlling terminal clears the first sequence number counter used for data transmission to zero, and the controlled Bluetooth network device clears the second sequence number counter used for data transmission to zero. For instance, when a GATT connection is established or disconnected, the sequence number counters in both directions for both communicating parties are reset to 0, ensuring that each session begins from a known, synchronized state. This action ensures that when a near-field point-to-point data communication link is established again, both parties re-initialize the sequence number synchronization, providing a clean starting state for subsequent secure encrypted communication. This application embodiment ensures the uniqueness and order of data frames by maintaining an independent 16-bit sequence number (Seq) for each communication direction.

[0135] Based on the above optional embodiments, this application embodiment resets the first sequence number in the first communication direction and the second sequence number in the second communication direction respectively in response to the disconnection of the near-field point-to-point data communication link. This achieves a secure reset of the communication state, avoids communication failure caused by sequence number asynchrony, simplifies the sequence number management logic, reduces system complexity, and ensures that each near-field communication session starts from the synchronized initial state, thereby improving the reliability and ease of use of the system.

[0136] Optionally, the data encryption transmission method further includes: in response to the original service data to be transmitted by the first communication node exceeding the maximum single transmission load of the near-field point-to-point data communication link, splitting the original service data into plaintext segments to obtain plaintext data.

[0137] The original business data can be application-layer business data that needs to be transmitted securely; it is a complete data unit before encryption.

[0138] The maximum payload per transmission (Max_Payload) can be defined as the maximum number of data bytes that can be transmitted in a single transmission via a near-field point-to-point data communication link without fragmentation. In this embodiment, this value is limited by the Attribute Protocol Maximum Transmission Unit (ATT_MTU), specifically: ATT_MTU minus 3 bytes of connection layer header overhead and 6 bytes of encryption frame header overhead, i.e., Max_Payload = ATT_MTU - 3 - 6. The 3-byte connection layer header overhead includes 1 byte of opcode and 2 bytes of attribute handle, while the 6-byte encryption frame header overhead includes 2 bytes of sequence number (Seq) and 4 bytes of checksum information (MIC).

[0139] Plaintext fragment splitting can be the process of cutting raw service data that exceeds the maximum payload of a single transmission into multiple data fragments whose length does not exceed the maximum payload of a single transmission. Each plaintext fragment is treated as an independent encryption unit for subsequent processing.

[0140] In this embodiment of the application, the encryption algorithm (AES-128-CCM) does not directly encrypt the original service data (Plaintext), nor does it encrypt a single BLE Protocol Data Unit (PDU) generated by the underlying Bluetooth protocol. Instead, it encrypts and decrypts the complete logical data frame assembled by the application layer. That is, the basic unit of encryption and decryption is the complete GATT data frame.

[0141] In response to the first communication node's raw service data exceeding the maximum single-transmission payload of the near-field point-to-point data communication link, the raw service data is split into plaintext segments to obtain plaintext data. For example, before preparing to send data, the first communication node obtains the ATT_MTU value negotiated and determined by the current near-field point-to-point data communication link, and subtracts the GATT header overhead, encrypted frame header overhead, and possible encryption padding length from it to calculate the maximum allowed plaintext data length. Subsequently, the first communication node compares the length of the raw service data to be transmitted with the calculated maximum plaintext data length to determine whether the length of the raw service data exceeds the maximum number of bytes allowed for a single transmission by the near-field point-to-point data communication link. If it exceeds, the splitting process is triggered. If it does not exceed, the raw service data is directly encrypted.

[0142] During the splitting process, the first communication node segments the original business data according to the calculated maximum plaintext data length, generating multiple data segments whose lengths do not exceed this limit. Each data segment is a plaintext data item, and each plaintext data item will be independently encrypted to generate an independent encrypted data frame, thereby ensuring that the total length of each encrypted data frame does not exceed the ATT_MTU limit.

[0143] In an optional embodiment, when performing the encryption process independently for each segment, a unique sequence number (Seq) is generated for each segment as additional authentication data. A nonce is constructed, and the corresponding ciphertext and message integrity check code (MIC) are generated using the AES-128-CCM algorithm. Finally, these are assembled into independent encrypted data frames containing "Seq + ciphertext + MIC" and sent one by one through the GATT (Write / Notify) channel. Upon receiving each data frame, the receiver independently performs sequence number verification, MIC verification, and decryption operations. After confirming that everything is correct, the plaintext of the segment is output, thereby achieving secure frame-by-frame transmission with low memory consumption, high fault tolerance, and strict order control.

[0144] Based on the above optional embodiments, this application embodiment achieves secure transmission of large-volume application layer data by splitting plaintext segments in response to the original business data exceeding the maximum payload of a single transmission. This ensures the independence and integrity of each encrypted data frame, avoids transmission errors and security vulnerabilities caused by excessively long data frames, and improves the support capability and transmission efficiency of near-field communication for large-load business data.

[0145] According to another aspect of the embodiments of this application, a data encryption transmission system is also provided, comprising: a control terminal, configured to establish a near-field point-to-point data communication link between the control terminal and a controlled Bluetooth network device; obtain a network key of the network to which the controlled Bluetooth network device belongs; determine an encryption key for transparent data in the near-field point-to-point data communication link based on the network key; encrypt plaintext data to be transmitted using the encryption key to obtain an encrypted data frame; and transmit the encrypted data frame to the controlled Bluetooth network device via the near-field point-to-point data communication link; and the controlled Bluetooth network device, configured to decrypt the encrypted data frame to obtain plaintext data.

[0146] The control terminal can be a device that initiates near-field communication and sends data. In this embodiment, the control terminal is a mobile terminal or computer device with Bluetooth communication function, such as a mobile application, used to send control commands or configuration information to the controlled Bluetooth network device.

[0147] The controlled Bluetooth network device can be a device that responds to near-field communication and receives data. In this embodiment, the controlled Bluetooth network device is a low-power Bluetooth device that has joined a Bluetooth Mesh network and is used to execute instructions issued by the control terminal.

[0148] For example, when the control terminal establishes a near-field point-to-point data communication link between the control terminal and the controlled Bluetooth network device, it discovers the controlled Bluetooth network device through Bluetooth scanning and initiates a connection request for a generic attribute profile. After the two parties complete the handshake, a direct point-to-point communication link is established, providing a physical and link layer foundation for subsequent data exchange.

[0149] For example, when obtaining the network key of the network to which the controlled Bluetooth network device belongs, the control terminal requests the network key of the Mesh network to which the controlled Bluetooth network device belongs through the established near-field point-to-point data communication link, or reads the network key associated with the device from the local cache of the control terminal, thereby obtaining the basic key material for subsequent encrypted communication.

[0150] After obtaining the network key, the encryption key for the transparent data in the near-field point-to-point data communication link is determined based on the network key. For example, the control terminal directly designates the obtained network key as the encryption key for the transparent data in the near-field point-to-point data communication link, without the need for additional key negotiation or derivation calculations, thus establishing a unified key standard for subsequent encryption and decryption operations.

[0151] For example, the plaintext data to be transmitted is encrypted using an encryption key to obtain an encrypted data frame. The control terminal prepares the plaintext data to be transmitted, obtains the first sequence number in the current direction, constructs a one-time number and additional authentication data, encrypts the plaintext data using the AES-128-CCM algorithm with the encryption key, generates ciphertext data and a message integrity check code, and combines the first sequence number, ciphertext data, and message integrity check code into an encrypted data frame.

[0152] After acquiring the encrypted data frame, the control terminal transmits the encrypted data frame to the controlled Bluetooth network device via a near-field point-to-point data communication link. For example, the control terminal sends the generated encrypted data frame to the controlled Bluetooth network device using a generic attribute profile feature.

[0153] After receiving an encrypted data frame, the controlled Bluetooth network device decrypts the encrypted data frame to obtain the plaintext data. For example, upon receiving an encrypted data frame, the controlled Bluetooth network device parses out a first sequence number, ciphertext data, and a message integrity check code. It then verifies whether the first sequence number matches the local sequence number. If they match, it uses the encryption key to construct a one-time numeric key and additional authentication data to decrypt and verify the integrity of the ciphertext data. If the verification passes, the original plaintext data is recovered.

[0154] Based on the above optional embodiments, this application embodiment establishes a near-field point-to-point data communication link, obtains a network key, determines an encryption key, uses the encryption key to encrypt the plaintext data to be transmitted to obtain an encrypted data frame, transmits the encrypted data frame to the controlled Bluetooth network device via the near-field point-to-point data communication link, and decrypts the encrypted data frame to obtain plaintext data. This realizes a technical solution that uses the existing network key of the Mesh network as the encryption key for near-field communication, avoids the complexity and delay caused by independent key negotiation, and improves the security level and transmission efficiency of near-field communication.

[0155] Figure 5 This is a schematic diagram of an optional data encryption transmission method according to an embodiment of this application, such as... Figure 5 As shown in the figure, this diagram illustrates the overall interaction process for establishing a near-field point-to-point data communication link and conducting secure data transmission and reception between the control terminal and the controlled Bluetooth network device. This process mainly covers three parts: the initialization phase, the sender's encryption process, and the receiver's decryption process.

[0156] During the initialization phase, the first communication node, i.e., the control terminal, establishes a near-field point-to-point data communication link with the second communication node, i.e., the controlled Bluetooth network device. Both parties obtain the network key of the network to which the device belongs from their respective Mesh protocol stacks, and use this network key as the encryption key for data transmitted transparently in subsequent near-field point-to-point data communication links. Simultaneously, both parties reset the first sequence number for the communication direction from the control terminal to the controlled Bluetooth network device and the second sequence number for the communication direction from the controlled Bluetooth network device to the control terminal to 0, ensuring that the session state starts from a known synchronization state. Furthermore, when the communication link connection is established or disconnected, the sequence number counters for both directions of communication are reset to 0.

[0157] In the sender's encryption process, the sender prepares the plaintext data to be transmitted. If the plaintext data exceeds the maximum payload of a single transmission on the near-field point-to-point data communication link, the plaintext data is fragmented to obtain the plaintext data. The sender obtains the sequence number of the current communication direction, i.e., the first sequence number, and uses this sequence number in little-endian format as additional authentication data. It then combines this sequence number with the direction identifier and preset padding data to construct a one-time number. Subsequently, the plaintext data is encrypted using the encryption key, the one-time number, and the additional authentication data to generate ciphertext data and verification information. The first sequence number, ciphertext data, and verification information are then sequentially combined into an encrypted data frame, which is finally transmitted to the receiver via the near-field point-to-point data communication link.

[0158] In the receiver's decryption process, the receiver parses the received encrypted data frame, extracting the sequence number, ciphertext data, and verification information. The receiver first checks if the sequence number matches its local sequence number. If the sequence number does not match, the encrypted data frame is discarded to prevent replay attacks. If the sequence number matches, the receiver determines the direction identifier based on the communication direction, constructs a one-time numeric value by combining the sequence number and padding data, and uses the sequence number as additional authentication data. Subsequently, the ciphertext data is decrypted and message integrity is verified using the encryption key, the one-time numeric value, and the additional authentication data. If the message integrity verification passes, decryption is successful, yielding the plaintext data, and the local sequence number counter is incremented by 1; otherwise, the encrypted data frame is discarded.

[0159] In an optional embodiment, at the key management level, this application may also employ a Key Derivation Function (KDF) to derive independent encryption and authentication keys based on the original NetKey, or dynamically rotate the session key during communication to enhance forward security and reduce the risk of long-term use of a single key.

[0160] In terms of data frame structure, this application can also introduce a 1-byte payload type field or device address information into the additional authentication data (AAD) to distinguish service types and prevent cross-device nonce reuse. It also supports variable-length MICs, such as 1 to 16 bytes, to adapt to scenarios with different security levels and bandwidth requirements.

[0161] In terms of transmission mechanism, this application can implement application-level acknowledgment (ACK) mechanism and sliding window flow control to deal with packet loss in unreliable wireless environments, or support multi-frame aggregation transmission to reduce header overhead and improve throughput.

[0162] Furthermore, this application can introduce a non-volatile global monotonic counter to replace the volatile serial number counter, thereby eliminating the risk of replay attacks after device restart. Combined with rate limiting and permission masking mechanisms, it can achieve brute-force attack prevention and fine-grained access control for the GATT channel, thus constructing a Bluetooth near-field communication solution with high security, high reliability and high scalability.

[0163] According to an embodiment of this application, a device embodiment for a data encryption transmission apparatus is provided. It should be noted that the apparatus can be used to execute the above-described data encryption transmission method. Figure 6 This is a structural block diagram of an optional data encryption transmission device according to an embodiment of this application, such as... Figure 6 As shown. The device includes: a first establishment module 601, used to establish a near-field point-to-point data communication link between a first communication node and a second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device; a first acquisition module 602, used to acquire the network key of the network to which the second communication node belongs; a first determination module 603, used to determine the encryption key for transparent data in the near-field point-to-point data communication link based on the network key; an encryption module 604, used to encrypt the plaintext data to be transmitted using the encryption key to obtain an encrypted data frame; and a transmission module 605, used to transmit the encrypted data frame between the first communication node and the second communication node via the near-field point-to-point data communication link.

[0164] Optionally, the data encryption transmission device further includes: an initialization module, used to initialize the first serial number in the first communication direction and the second serial number in the second communication direction, respectively, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

[0165] Optionally, the encryption module 604 is further configured to: encrypt plaintext data using an encryption key and a first sequence number to obtain ciphertext data; generate verification information based on the encryption key and the ciphertext data; and combine the first sequence number, the ciphertext data, and the verification information in sequence to obtain an encrypted data frame.

[0166] Optionally, the encryption module 604 is further configured to: determine a one-time number based on the first serial number; and encrypt the plaintext data using the encryption key and the one-time number to obtain ciphertext data.

[0167] Optionally, the encryption module 604 is also used to: obtain the direction identifier corresponding to the first sequence number; and combine the direction identifier, the first sequence number, and the padding data to generate a one-time number.

[0168] Optionally, the field length of the direction identifier is 1 byte, the field length of the first sequence number is 2 bytes, and the field length of the padding data is 10 bytes.

[0169] Optionally, the data encryption transmission device further includes a conversion module for converting the format of the first serial number to obtain additional authentication data.

[0170] Optionally, the encryption module 604 is also used to: generate verification information based on the encryption key, ciphertext data, one-time number and additional authentication data, wherein the field length of the verification information is 4 bytes.

[0171] According to another aspect of the embodiments of this application, a data encryption transmission device is also provided. Figure 7 This is a structural block diagram of another optional data encryption transmission device according to an embodiment of this application, such as... Figure 7 As shown. The device includes: a second establishment module 701, used to establish a near-field point-to-point data communication link between a first communication node and a second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device; a second acquisition module 702, used to acquire the network key of the network to which the second communication node belongs; a second determination module 703, used to determine the encryption key for transparent data in the near-field point-to-point data communication link based on the network key, wherein the encryption key is used by the first communication node to encrypt the plaintext data to be transmitted to obtain an encrypted data frame; a receiving module 704, used to receive the encrypted data frame from the first communication node via the near-field point-to-point data communication link; and a decryption module 705, used to decrypt the encrypted data frame to obtain plaintext data.

[0172] Optionally, the decryption module 705 is further configured to: decrypt the encrypted data frame to obtain a first sequence number, ciphertext data, and verification information, wherein the first sequence number is used to identify the sending order of the encrypted data frame, the ciphertext data is the encrypted plaintext data, and the verification information is used to perform integrity verification on the encrypted data frame; and decrypt the ciphertext data based on the first sequence number, encryption key, and verification information to obtain plaintext data.

[0173] Optionally, the decryption module 705 is further configured to: determine whether the first sequence number matches the local sequence number of the second communication node; in response to the match between the first sequence number and the local sequence number, construct a one-time number and additional authentication data based on the encryption key; and use the encryption key, the one-time number, and the additional authentication data to decrypt and verify the integrity of the ciphertext data to obtain plaintext data.

[0174] Optionally, the data encryption transmission device further includes: a reset module, used to reset the first serial number in the first communication direction and the second serial number in the second communication direction respectively in response to the disconnection of the near-field point-to-point data communication link, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

[0175] Optionally, the data encryption transmission device further includes: a splitting module, used to split the original business data into plaintext segments in response to the original business data to be transmitted by the first communication node exceeding the maximum single transmission load of the near-field point-to-point data communication link, to obtain plaintext data.

[0176] Embodiments of this application also provide a computer-readable storage medium including a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to perform the methods of various embodiments of this application.

[0177] Embodiments of this application also provide a computer program product, including a computer program that, when executed by a processor, implements the methods of various embodiments of this application.

[0178] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0179] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0180] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0181] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0182] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0183] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0184] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for encrypted data transmission, characterized in that, include: A near-field point-to-point data communication link is established between a first communication node and a second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device; Obtain the network key of the network to which the second communication node belongs; The encryption key for transparent data in the near-field point-to-point data communication link is determined based on the network key. The plaintext data to be transmitted is encrypted using the encryption key to obtain an encrypted data frame; The encrypted data frame is transmitted between the first communication node and the second communication node via the near-field point-to-point data communication link.

2. The data encryption transmission method according to claim 1, characterized in that, The data encryption transmission method further includes: The first serial number of the first communication direction and the second serial number of the second communication direction are initialized respectively, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

3. The data encryption transmission method according to claim 2, characterized in that, The encrypted data frame is obtained by encrypting the plaintext data to be transmitted using the encryption key, including: The plaintext data is encrypted using the encryption key and the first sequence number to obtain ciphertext data; Based on the encryption key and the ciphertext data, generate verification information; The first sequence number, the ciphertext data, and the verification information are combined in sequence to obtain the encrypted data frame.

4. The data encryption transmission method according to claim 3, characterized in that, The plaintext data is encrypted using the encryption key and the first sequence number to obtain the ciphertext data, which includes: A one-time number is determined based on the first serial number; The plaintext data is encrypted using the encryption key and the one-time number to obtain the ciphertext data.

5. The data encryption transmission method according to claim 4, characterized in that, Determining the one-time number based on the first serial number includes: Obtain the direction identifier corresponding to the first sequence number; The direction identifier, the first serial number, and the fill data are combined to generate the one-time number.

6. The data encryption transmission method according to claim 5, characterized in that, The field length of the direction identifier is 1 byte, the field length of the first sequence number is 2 bytes, and the field length of the filling data is 10 bytes.

7. The data encryption transmission method according to claim 4, characterized in that, The data encryption transmission method further includes: The first serial number is formatted to obtain additional authentication data.

8. The data encryption transmission method according to claim 7, characterized in that, Based on the encryption key and the ciphertext data, generating the verification information includes: The verification information is generated based on the encryption key, the ciphertext data, the one-time number, and the additional authentication data, wherein the field length of the verification information is 4 bytes.

9. A method for encrypted data transmission, characterized in that, include: A near-field point-to-point data communication link is established between a first communication node and a second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device; Obtain the network key of the network to which the second communication node belongs; The encryption key for transparent data in the near-field point-to-point data communication link is determined based on the network key, wherein the encryption key is used by the first communication node to encrypt the plaintext data to be transmitted to obtain an encrypted data frame. The encrypted data frame is received from the first communication node via the near-field point-to-point data communication link. The encrypted data frame is decrypted to obtain the plaintext data.

10. The data encryption transmission method according to claim 9, characterized in that, Decrypting the encrypted data frame yields the plaintext data, which includes: The encrypted data frame is decrypted to obtain a first sequence number, ciphertext data, and verification information. The first sequence number is used to identify the sending order of the encrypted data frame, the ciphertext data is the encrypted plaintext data, and the verification information is used to perform integrity verification on the encrypted data frame. The ciphertext data is decrypted based on the first serial number, the encryption key, and the verification information to obtain the plaintext data.

11. The data encryption transmission method according to claim 10, characterized in that, The ciphertext data is decrypted based on the first sequence number, the encryption key, and the verification information to obtain the plaintext data, which includes: Determine whether the first sequence number matches the local sequence number of the second communication node; In response to a match between the first serial number and the local serial number, a one-time number and additional authentication data are constructed based on the encryption key; The encrypted data is decrypted and its integrity is verified using the encryption key, the one-time number, and the additional authentication data to obtain the plaintext data.

12. The data encryption transmission method according to claim 9, characterized in that, The data encryption transmission method further includes: In response to the disconnection of the near-field point-to-point data communication link, the first sequence number of the first communication direction and the second sequence number of the second communication direction are reset respectively, wherein the first communication direction is the communication direction from the control terminal to the controlled Bluetooth network device, and the second communication direction is the communication direction from the controlled Bluetooth network device to the control terminal.

13. The data encryption transmission method according to claim 9, characterized in that, The data encryption transmission method further includes: In response to the fact that the original service data to be transmitted by the first communication node exceeds the maximum single transmission load of the near-field point-to-point data communication link, the original service data is split into plaintext segments to obtain the plaintext data.

14. A data encryption transmission device, characterized in that, include: The first establishment module is used to establish a near-field point-to-point data communication link between the first communication node and the second communication node, wherein the first communication node is a control terminal and the second communication node is a controlled Bluetooth network device. The first acquisition module is used to acquire the network key of the network to which the second communication node belongs; The first determining module is used to determine the encryption key for transparent data in the near-field point-to-point data communication link based on the network key; An encryption module is used to encrypt the plaintext data to be transmitted using the encryption key to obtain an encrypted data frame; The transmission module is used to transmit the encrypted data frame between the first communication node and the second communication node via the near-field point-to-point data communication link.

15. A data encryption transmission system, characterized in that, include: A control terminal, used to establish a near-field point-to-point data communication link between the control terminal and the controlled Bluetooth network device; Obtain the network key of the network to which the controlled Bluetooth network device belongs; The encryption key for transparent data in the near-field point-to-point data communication link is determined based on the network key. The plaintext data to be transmitted is encrypted using the encryption key to obtain an encrypted data frame; And the encrypted data frame is transmitted to the controlled Bluetooth network device via the near-field point-to-point data communication link; The controlled Bluetooth network device is used to decrypt the encrypted data frame to obtain the plaintext data.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the storage medium is located to perform the data encryption transmission method according to any one of claims 1 to 13.

17. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the data encryption transmission method according to any one of claims 1 to 13.

Images