NFC security authentication and WiFi data encryption transmission method for multi-protocol loT device

Abstract

The application discloses a kind of NFC security authentication and WiFi data encryption transmission method of multi-protocol loT device, it is related to internet data service technical field, comprising the following steps: obtaining near field duration, round trip delay, permission code, count, device identity and protocol capability and combined into two-way authentication data, generate device authentication response, check gateway authentication response, generate session root information and start WiFi permission after, according to session root information and wireless state encryption service payload, generate wireless ciphertext data packet and networking security adaptation table.In the application, through the continuous binding of near field parameters, device identity, protocol capability and authentication response, the authentication result is extended to WiFi transmission and multi-protocol access control, the service payload encryption is jointly constrained by channel, strength, retransmission and serial number, reduces the risk of replay, fake permission, key exposure and packet sequence tampering, improves the consistency of device source, transmission context and networking authority.

Description

Technical Field

[0001] This invention relates to the field of Internet data service technology, and in particular to a method for NFC security authentication and WiFi data encryption transmission of multi-protocol IoT devices. Background Technology

[0002] The field of internet data service technology involves data processing methods that encode, encapsulate, encrypt, authenticate, and retrieve data collected, transmitted, and stored by networked devices through computer systems. Among these methods, the traditional NFC security authentication and WiFi data encryption transmission method for multi-protocol IoT devices involves the IoT terminal verifying its identity via NFC, Bluetooth, or a local interface before accessing the network or transmitting business data. The IoT terminal then reads business data from sensors, peripheral interfaces, or internal storage units, writes the data to a buffer, and calls a software encryption program to generate encrypted data packets. These encrypted data packets are then sent to a gateway, server, or cloud data receiving program via a WiFi communication interface.

[0003] Existing multi-protocol IoT device access processes typically rely on NFC, Bluetooth, or local interfaces for identity verification. Business data is then processed by software encryption programs after passing through a buffer. The authentication link and data transmission link are separated, making it difficult to form continuous constraints on device identity, protocol capabilities, channel status, and transmission sequence numbers. The buffer writing and software operation processes are susceptible to replay, forged licenses, key exposure, and packet order tampering. When multiple communication methods coexist, access permissions lack unified linkage control, making it difficult for the gateway to confirm the data source, transmission context, and consistency of network permissions. Summary of the Invention

[0004] The purpose of this invention is to provide a method for NFC security authentication and WiFi data encryption transmission of multi-protocol IoT devices, which enables IoT devices to form a continuous and interconnected security processing flow between near-field authentication, wireless local area network transmission permission, service payload encryption and multi-protocol access control, avoiding the separation of authentication data, transmission context and network permissions, and improving the consistency of device source verification, wireless data transmission and multi-protocol access control. To achieve the above objectives, this invention provides a method for NFC security authentication and WiFi data encryption transmission of multi-protocol IoT devices, comprising the following steps: acquiring near-field stability duration, near-field round-trip time, reader / writer license code, authentication initiation count, device identity value, and protocol capability information, and combining them into two-way authentication data in a predetermined order; generating a device authentication response based on the two-way authentication data and the device key operation value in the hardware-level key storage unit, receiving a gateway authentication response, and comparing the license information in the gateway authentication response with the two-way authentication data to determine the authentication pass status; when the authentication pass status is valid, based on the device authentication response, the gateway authentication response, the authentication initiation count, and the protocol capability information... The system generates session root information and enables wireless LAN transmission permission; it obtains the wireless channel number, received signal strength, retransmission count, and transmission sequence number; it determines an encryption control segment based on the session root information, the wireless channel number, the received signal strength, the retransmission count, and the transmission sequence number; it performs bit reordering and bit-by-bit difference judgment on the service payload based on the encryption control segment to generate a ciphertext payload and a protection header; it concatenates the ciphertext payload and the protection header into a wireless ciphertext data packet; it generates a network security adaptation table based on the protocol capability information, the authentication pass status, and the session root information; it restricts access permissions for Bluetooth, wireless LAN, and near-field communication according to the network security adaptation table; and it outputs the wireless ciphertext data packet.

[0005] Further, the process of generating the two-way authentication data includes: after obtaining the near-field stable duration and the near-field round-trip time, comparing the near-field stable duration with a lower limit of stable duration, and comparing the near-field round-trip time with an upper limit of round-trip time; when the near-field stable duration reaches the lower limit of stable duration and the near-field round-trip time does not exceed the upper limit of round-trip time, determining a valid near-field link flag; when the near-field stable duration does not reach the lower limit of stable duration or the near-field round-trip time exceeds the upper limit of round-trip time, generating a invalid near-field link flag and stopping the combination of the two-way authentication data. After confirming the validity of the near-field link, the reader license code, the authentication initiation count, the device identity value, and the protocol capability information are obtained and written into the authentication buffer in a fixed field order: the near-field link validity flag, the reader license code, the authentication initiation count, the device identity value, and the protocol capability information. Boundary checks are performed on the writing positions of each field. When the writing positions of each field are all within the corresponding field boundaries of the authentication buffer, the two-way authentication data is generated. When the writing position of any field exceeds the corresponding field boundary, the written field in the authentication buffer is deleted and a field boundary anomaly flag is generated.

[0006] Preferably, the fixed field order is as follows: the near-field stabilization duration and the near-field round-trip delay are converted into a fixed-length near-field state field; the reader / writer license code is written after the near-field state field; the authentication initiation count is written after the reader / writer license code; the device identity value is written after the authentication initiation count; and the protocol capability information is written to the end field. When the length of any field is shorter than the corresponding fixed length, a padding marker is written at the end of the corresponding field; when the length of any field is longer than the corresponding fixed length, a preset high-order field is truncated to generate a consistent authentication field sequence, and the authentication field sequence is determined as the field content of the two-way authentication data.

[0007] Further, determining the authentication pass status includes: acquiring the two-way authentication data and the device key operation value output by the hardware-level key storage unit; binding the two-way authentication data and the device key operation value according to the field order of the two-way authentication data to generate a device-side digest fragment; and associating and encapsulating the device-side digest fragment with the device identity value to generate the device authentication response. Upon receiving the gateway authentication response, parsing the permission information, count echo field, and protocol echo field in the gateway authentication response; comparing the permission information, count echo field, and protocol echo field with the corresponding fields in the two-way authentication data for consistency; determining the authentication pass status as valid when all comparison results are consistent, and determining the authentication pass status as invalid when any comparison result is inconsistent.

[0008] Further, in the consistency comparison, the reader license echo value in the license information is read, and the reader license echo value is compared field by field with the reader license code in the two-way authentication data; the count echo value in the count echo field is read, and the count echo value is compared sequentially with the authentication initiation count in the two-way authentication data; the protocol capability echo value in the protocol echo field is read, and the protocol capability echo value is compared for consistency with the protocol capability information in the two-way authentication data. When the reader license echo value matches the reader license code, the count echo value matches the authentication initiation count, and the protocol capability echo value matches the protocol capability information, an authentication consistency flag is generated; when any comparison object is inconsistent, an authentication inconsistency flag is generated.

[0009] Further, the process of generating the session root information and enabling the wireless local area network (WLAN) transmission license includes: when the authentication pass status is valid, parsing the device-side digest fragment from the device authentication response, parsing the gateway-side digest fragment from the gateway authentication response, and writing the authentication initiation count as a session freshness field into the session buffer; performing field concatenation and digest compression processing in the order of the device-side digest fragment, the gateway-side digest fragment, the session freshness field, and the protocol capability information to generate the session root information. When the protocol capability information indicates that the WLAN is in an available state, writing the index identifier of the session root information into the WLAN transmission license table, setting the license flag to valid, and enabling the WLAN transmission license; when the protocol capability information indicates that the WLAN is in an unavailable state, keeping the license flag in the WLAN transmission license table invalid.

[0010] Further, the process of determining the encrypted control segment includes: after obtaining the wireless channel number, the received signal strength, the retransmission count, and the transmission sequence number, performing channel legality interval judgment on the wireless channel number, strength lower limit judgment on the received signal strength, retransmission count upper limit judgment on the retransmission count, and incremental relationship judgment on the transmission sequence number to generate a wireless status verification result. When the wireless status verification result is valid, the session root information is associated with the wireless channel number, the received signal strength, the retransmission count, and the transmission sequence number according to fixed field boundaries and written, and the field sequence after association writing is truncated to generate the encrypted control segment; when the wireless status verification result is invalid, the generation of the encrypted control segment is stopped and a wireless status abnormality flag is output.

[0011] Further, the process of generating the wireless state verification result includes: matching the wireless channel number with a pre-stored channel license table to determine a channel license flag; comparing the received signal strength with the lower limit of the strength to determine a signal stability flag; and comparing the retransmission count with the upper limit of the retransmission count to determine a link congestion flag. When the channel license flag is licensed, the signal stability flag is stable, the link congestion flag is not congested, and the transmission sequence number satisfies an increasing relationship relative to the locally stored historical transmission sequence numbers, the generated wireless state verification result is valid; when the channel license flag is rejected, the signal stability flag is unstable, the link congestion flag is congested, or the transmission sequence number does not satisfy the increasing relationship, the generated wireless state verification result is invalid.

[0012] Further, the generation process of the ciphertext payload and the protection header includes: acquiring the service payload, determining the payload segment boundaries according to the bit order selection field in the encryption control segment, dividing the service payload into at least one payload segment, performing alternating rearrangement of the bit positions within each payload segment, generating rearrangement boundary markers based on the payload segment boundaries, and generating a rearranged payload sequence; reading the difference judgment field in the encryption control segment, comparing the rearranged payload sequence with the difference judgment field bit by bit for similarity or dissimilarity, and rewriting the corresponding bits in the rearranged payload sequence according to the comparison results to generate the ciphertext payload; extracting the payload length, the transmission sequence number, and the rearrangement boundary markers of the service payload, associating them with the protection field, and generating the protection header.

[0013] Further, the output process of the wireless encrypted data packet includes: acquiring the encrypted payload and the protection header; reading the payload length field and sequence number field in the protection header; comparing the payload length field with the actual length of the encrypted payload and comparing the sequence number field with the transmission sequence number; when the comparison results are consistent, writing the protection header into the header area and the encrypted payload into the payload area to generate the wireless encrypted data packet; when any comparison result is inconsistent, deleting the written content in the header area and the payload area and generating a data packet connection anomaly flag. Simultaneously, acquiring the protocol capability information, the authentication pass status, and the session root information; determining the protocol availability status from the protocol capability information, the authentication validity status from the authentication pass status, and the session index identifier from the session root information; associating the protocol availability status, the authentication validity status, and the session index identifier into the network security adaptation table; and generating access permission statuses for Bluetooth, wireless LAN, and near-field communication respectively based on the network security adaptation table, and outputting the wireless encrypted data packet.

[0014] The present invention has the following beneficial effects: In this invention, by sequentially binding near-field stabilization duration, round-trip delay, reader / writer license code, authentication initiation count, device identity value, and protocol capability information, bidirectional authentication data is formed. Device authentication response and gateway authentication response jointly participate in the generation of session root information, so that the identity verification result continuously constrains the wireless local area network transmission license. Then, by combining the wireless channel number, received signal strength, retransmission count, and transmission sequence number to determine the encryption control segment, the service payload is reordered and bit-by-bit difference judgment is performed, which can suppress the risks of replay forgery and packet order tampering. Based on the protocol capability information, authentication status, and session root information, a network security adaptation relationship is generated to keep the access licenses of Bluetooth, wireless local area network, and near-field communication consistent. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the NFC authentication and WiFi encrypted transmission process of the present invention; Figure 2 This is a schematic diagram illustrating the generation of two-way authentication data according to the present invention; Figure 3 This is a schematic diagram illustrating the authentication response and session root information generation of the present invention; Figure 4 This is a schematic diagram illustrating the generation of the wireless status verification and encryption control segment of the present invention; Figure 5 This is a schematic diagram of the business payload encryption process of the present invention; Figure 6 This is a schematic representation of the wireless encrypted data packet and network security adaptation of the present invention. Detailed Implementation

[0016] The technical solution described in this invention will be further explained below with reference to the accompanying drawings. The following embodiments are described primarily based on the authentication of multi-protocol IoT devices under near-field communication conditions, and the application of the authentication results to wireless local area network transmission licensing, service payload encryption, and multi-protocol access restrictions. For ease of understanding, near-field stability duration, near-field round-trip time, reader license code, authentication initiation count, device identity value, and protocol capability information are used as the source fields for bidirectional authentication data; device authentication response, gateway authentication response, authentication pass status, session root information, encrypted control segment, ciphertext payload, protection header, wireless ciphertext data packet, and network security adaptation table are all explained according to the data sources and processing results in subsequent steps.

[0017] Please see Figures 1 to 6 This embodiment provides a method for NFC security authentication and WiFi data encryption transmission of multi-protocol IoT devices. Before transmitting wireless local area network (WLAN) service data, the method first uses near-field communication (NFC) to form bidirectional authentication data and determines the authentication pass status based on the authentication responses from the device side and the gateway side. When the authentication pass status is valid, session root information is generated based on the authentication response, authentication initiation count, and protocol capability information, and WLAN transmission permission is granted accordingly. Subsequently, the encryption control segment is determined by combining the wireless channel number, received signal strength, retransmission count, and transmission sequence number. The service payload is reordered and bit-by-bit difference is judged to generate a wireless encrypted data packet. Access permissions for Bluetooth, WLAN, and NFC are limited through a network security adaptation table.

[0018] S1. Obtain near-field stability duration, near-field round-trip time, reader license code, authentication initiation count, device identity value, and protocol capability information, and combine them into two-way authentication data in a predetermined order.

[0019] In S1, the near-field stability duration represents the duration for which the IoT device and the reader maintain near-field communication, and the near-field round-trip time represents the round-trip time between a near-field communication request and response. The reader license code identifies the source of the reader license, the authentication initiation count distinguishes the current authentication initiation process, the device identity value identifies the current IoT device, and the protocol capability information indicates the device's support status for Bluetooth, Wi-Fi, and near-field communication.

[0020] S111. After obtaining the near-field stable duration and near-field round-trip time (RTD), the near-field stable duration is compared with the lower limit of the stable duration, and the near-field RTD is compared with the upper limit of the RTD. In practical applications, the lower limit of the near-field stable duration is set to 150ms, and the upper limit of the RTD is set to 20ms. Accurate near-field RTD is calculated using multiple consecutive handshake samples, employing the existing time difference averaging formula: Formula 1: ; in, For the final calculated near-field round-trip time, The number of samples (in this embodiment, it is taken as...) =5), For the first The timestamp of the first received response. For the first The timestamp of the first request sent. The device's internal firmware handles inherent latency (calibrated to 3ms in this embodiment). The currently measured actual near-field stabilization time is 185ms, and the actual near-field round-trip time measured using Formula 1 is 8.5ms. When the near-field stabilization time reaches the lower limit of the stabilization time and the near-field round-trip time does not exceed the upper limit of the round-trip time, a valid near-field link is identified; when the near-field stabilization time does not reach the lower limit of the stabilization time, or the near-field round-trip time exceeds the upper limit of the round-trip time, an invalid near-field link is generated, and the combination of bidirectional authentication data is stopped.

[0021] S112. After the near-field link valid marker is determined, the reader / writer license code, authentication initiation count, device identity value, and protocol capability information are obtained and written to the authentication buffer in a fixed field order. In this embodiment, the total capacity of the authentication buffer allocated by the system is 128 bytes, of which the device identity value is a 16-byte hardware MAC address derivative code, and the protocol capability information is 1 byte (e.g., a value of 0x07, indicating support for three protocols). During writing, boundary checks are performed on the writing positions of each field; when the writing positions of each field are all within the corresponding field boundaries of the authentication buffer, bidirectional authentication data is generated; when the writing position of any field exceeds the corresponding field boundary, the written field in the authentication buffer is deleted, and a field boundary anomaly marker is generated.

[0022] S113. The fixed field order is as follows: the near-field stabilization duration and near-field round-trip delay are converted into a fixed-length near-field status field. The reader / writer license code is written after the near-field status field, the authentication initiation count is written after the reader / writer license code, the device identity value is written after the authentication initiation count, and the protocol capability information is written to the end field. When the length of any field is shorter than the corresponding fixed length, a padding mark is written at the end of the corresponding field; when the length of any field is longer than the corresponding fixed length, the preset high-order field is truncated to form a consistent authentication field sequence, and the authentication field sequence is used as the field content of the two-way authentication data.

[0023] Through the above processing, the near-field status, permission, count, device identity, and protocol capabilities in the two-way authentication data have a fixed order and fixed field boundaries (in this embodiment, the total length of the two-way authentication data is strictly defined as 64 bytes). Subsequent device authentication response generation and gateway authentication response verification can be performed according to this field order for location and comparison.

[0024] S2. Generate a device authentication response based on the two-way authentication data and the device key operation value in the hardware-level key storage unit, receive the gateway authentication response, and compare the license information in the gateway authentication response with the two-way authentication data to determine the authentication pass status.

[0025] In S2, the device key calculation value is output by the hardware-level key storage unit and participates in the generation of the device authentication response along with the two-way authentication data. This device key calculation value is used for authentication calculations and is not written as a plaintext field into the wireless service data transmission path.

[0026] S211. After obtaining the two-way authentication data and the device key operation value, bind the two-way authentication data and the device key operation value according to the field order of the two-way authentication data to generate a device-side digest fragment. To ensure the randomness and anti-guessing properties of the two-way authentication data before the binding operation, the existing Shannon entropy formula is used to quantitatively evaluate its information entropy: Formula 2: ; in, The information entropy of the two-way authentication data, The possible value range of the data bytes is 256. For the first byte value The probability of it appearing in the data. This is determined when calculating the entropy value of the 64 bytes of two-way authentication data. When the value exceeds 7.2 bits / byte, a 32-byte device-side digest fragment is generated by combining the 256-bit device key operation value with the standard digest algorithm. Subsequently, the device-side digest fragment is associated and encapsulated with the device identity value to generate a device authentication response. The device authentication response retains the correspondence between the device-side digest fragment and the device identity value for parsing during subsequent session root information generation.

[0027] S212. After receiving the gateway authentication response, parse the license information, count echo field, and protocol echo field in the gateway authentication response. The license information contains the reader / writer license echo value, the count echo field contains the count echo value, and the protocol echo field contains the protocol capability echo value. After reading the above fields, compare the reader / writer license echo value with the reader / writer license code in the two-way authentication data field by field, compare the count echo value with the authentication initiation count in the two-way authentication data for sequential consistency, and compare the protocol capability echo value with the protocol capability information in the two-way authentication data for consistency. Assuming that the authentication initiation count is 10042 and the protocol capability information is 0x07, the device will extract the corresponding fields from the underlying registers and perform a strict comparison.

[0028] S213. When the reader permission echo value matches the reader permission code, the count echo value matches the authentication initiation count, and the protocol capability echo value matches the protocol capability information, an authentication consistency flag is generated, and the authentication pass status is determined to be valid. When any comparison object is inconsistent, an authentication inconsistency flag is generated, and the authentication pass status is determined to be invalid. When the authentication pass status is invalid, the session root information corresponding to this authentication is not generated, and no wireless LAN transmission permission is set.

[0029] S3. When the authentication pass status is valid, generate session root information based on the device authentication response, gateway authentication response, authentication initiation count and protocol capability information, and enable wireless local area network transmission permission.

[0030] In S3, the session root information is formed jointly by the authentication results from the device side and the gateway side, and is combined with the authentication initiation count and protocol capability information. The authentication initiation count serves as the source of freshness for this session, while the protocol capability information serves as the basis for determining whether the wireless LAN can be enabled.

[0031] S311. When the authentication pass status is valid, the device-side summary fragment is parsed from the device authentication response, the gateway-side summary fragment is parsed from the gateway authentication response, and the authentication initiation count is written to the session cache as a session freshness field. The device-side summary fragment, gateway-side summary fragment, session freshness field, and protocol capability information are written to the session cache in a predetermined order.

[0032] S312. Perform field concatenation and digest compression on the device-side digest fragment, gateway-side digest fragment, session freshness field, and protocol capability information in the session buffer to generate session root information (output as a 32-byte core session key resource). After the session root information is generated, a corresponding index identifier is formed, which is used for subsequent association writing of the wireless LAN transmission license table and network security adaptation table.

[0033] S313. When the protocol capability information indicates that the wireless local area network (WLAN) is available, the index identifier of the session root information is written into the WLAN transmission license table, and the license flag is set to valid to enable WLAN transmission license. When the protocol capability information indicates that the WLAN is unavailable, the license flag in the WLAN transmission license table remains invalid.

[0034] Through S3 processing, a correspondence is established between authentication success status, protocol capability information, and WLAN transmission permission. WLAN transmission permission is only set when the authentication success status is valid and the protocol capability information indicates that the WLAN is available.

[0035] S4. Obtain the wireless channel number, received signal strength, retransmission count, and transmission sequence number. Determine the encryption control segment based on the session root information, wireless channel number, received signal strength, retransmission count, and transmission sequence number. Based on the encryption control segment, perform bit-order rearrangement and bit-by-bit difference judgment on the service payload to generate ciphertext payload and protection header.

[0036] In S4, the wireless channel number is used to identify the current wireless transmission channel, the received signal strength is used to identify the current wireless link strength, the retransmission count is used to identify the current transmission retry status, and the transmission sequence number is used to identify the transmission order of the wireless ciphertext data packets. These wireless state data, together with the session root information, participate in the generation of the encrypted control segment.

[0037] S411. After obtaining the wireless channel number, received signal strength, retransmission count, and transmission sequence number, match the wireless channel number with the pre-stored channel licensing table to determine the channel licensing flag; compare the received signal strength with the lower limit to determine the signal stability flag; compare the retransmission count with the upper limit to determine the link congestion flag; and determine the incremental relationship between the transmission sequence number and the locally stored historical transmission sequence numbers. The currently measured WiFi wireless channel number is 6 (center frequency 2437MHz). To suppress signal fluctuations caused by multipath effects, the received signal strength is calibrated and verified based on the existing logarithmic distance path loss model. Formula 3: ; in, The received signal strength (currently measured at -65dBm) is used for measurement. The reference signal strength (calibrated to -40dBm) is located 1 meter from the gateway. The path loss index for the current environment (typical indoor value is 2.5). The estimated distance between the device and the gateway (currently estimated at 10 meters). The system's configured strength lower limit is -80dBm, the current retransmission count is 0 (upper limit is 3), and the transmission sequence number is 405.

[0038] S412. When the channel grant flag is granted, the signal stability flag is stable, the link congestion flag is not congested, and the transmission sequence number satisfies an increasing relationship relative to the locally stored historical transmission sequence numbers, the generated radio state verification result is valid. When the channel grant flag is rejected, the signal stability flag is unstable, the link congestion flag is congested, or the transmission sequence number does not satisfy the increasing relationship, the generated radio state verification result is invalid, and a radio state abnormality flag is output.

[0039] S413. When the wireless status check result is valid, the session root information is associated with the wireless channel number, received signal strength, retransmission count, and transmission sequence number according to fixed field boundaries and written. The field sequence after association and writing is then truncated to generate an encrypted control fragment (a 16-byte control word is generated). When the wireless status check result is invalid, the generation of the encrypted control fragment is stopped.

[0040] S414. After acquiring the service payload, the payload segment boundaries are determined according to the bit order selection field in the encrypted control segment, and the service payload is divided into at least one payload segment. Subsequently, the bit positions within each payload segment are rearranged using an alternating pattern, and rearrangement boundary markers are generated based on the payload segment boundaries, resulting in a rearranged payload sequence. In this embodiment, the length of a single service payload segment is set to 512 bytes (i.e., 4096 bits). The device performs a non-linear mapping rearrangement of the physical positions of these 4096 bits based on a pseudo-random index table generated by a 16-byte control word.

[0041] S415. Read the difference / similarity judgment field in the encrypted control segment, compare the rearranged payload sequence with the difference / similarity judgment field bit by bit for similarity or dissimilarity, and rewrite the corresponding bits in the rearranged payload sequence according to the comparison results to generate the ciphertext payload. This ciphertext payload is formed by rearranging the bit order and performing bit-by-bit difference / similarity judgment on the service payload, and no longer maintains the direct bit order output state of the original service payload.

[0042] S416. Extract the payload length, sequence number, and rearrangement boundary marker from the service payload. Associate the payload length, sequence number, and rearrangement boundary marker and write them into the protection field to generate the protection header. The protection header is used to carry fields required for ciphertext payload connection and sequence number verification, and participates in the generation of subsequent wireless ciphertext data packets together with the ciphertext payload.

[0043] Through S4 processing, the service payload encryption does not solely rely on fixed encryption inputs, but is simultaneously constrained by session root information, radio channel number, received signal strength, retransmission count, and transmission sequence number. Radio state verification before encryption control segment generation is used to limit the radio transmission state at the time of ciphertext payload generation.

[0044] S5. Concatenate the encrypted payload and protection header into a wireless encrypted data packet, and generate a network security adaptation table based on protocol capability information, authentication pass status and session root information. Based on the network security adaptation table, restrict access permissions for Bluetooth, wireless LAN and NFC, and output the wireless encrypted data packet.

[0045] In S5, before connecting the protection header and ciphertext payload, the payload length field and sequence number field are first verified for consistency. The payload length field corresponds to the actual length of the ciphertext payload, and the sequence number field corresponds to the transmission sequence number.

[0046] S511. After obtaining the ciphertext payload and protection header, read the payload length field and sequence number field from the protection header. Compare the payload length field with the actual length of the ciphertext payload, and compare the sequence number field with the transmission sequence number. When the payload length field matches the actual length of the ciphertext payload, and the sequence number field matches the transmission sequence number, write the protection header into the header area and the ciphertext payload into the payload area, generating a wireless ciphertext data packet. If any comparison result is inconsistent, delete the written content in the header area and payload area, and generate a data packet connection anomaly flag.

[0047] S512. Obtain protocol capability information, authentication pass status, and session root information. Determine the protocol availability status from the protocol capability information, the authentication validity status from the authentication pass status, and the session index identifier from the session root information. Then, associate the protocol availability status, authentication validity status, and session index identifier and write them into the network security adaptation table. The network security adaptation table configured in this scenario has a maximum capacity of 256 entries, and a 16-bit fast hash algorithm is used to generate the storage index to ensure addressing efficiency and tamper-proof capability.

[0048] S513. Generate access permission status for Bluetooth, WLAN, and NFC respectively based on the network security adaptation table. For any protocol, when the protocol availability status indicates that the protocol is available, the authentication validity status is valid, and the session index identifier corresponds to the current session root information, generate the access permission status for that protocol; when the protocol is unavailable, the authentication is invalid, or the session index identifier does not correspond to the current session root information, do not generate a valid access permission status for that protocol.

[0049] S514. When the wireless encrypted data packet has completed writing the header and payload areas and no data packet connection anomaly flag has been generated, the wireless encrypted data packet is output. The output wireless encrypted data packet includes a protection header (length set to 12 bytes) and an encrypted payload (length set to 512 bytes, total data packet length 524 bytes). The protection header includes a payload length field, a sequence number field, and a rearrangement boundary marker. The encrypted payload is derived from the service payload after bit rearrangement and bit-by-bit difference judgment.

[0050] As shown in S1 to S5, this embodiment sequentially associates near-field authentication data, device authentication response, gateway authentication response, session root information, wireless status data, service payload encryption processing, and multi-protocol access permission. The authentication initiation count participates in the comparison of two-way authentication data and gateway authentication response, and the generation of session root information; protocol capability information participates in the generation of two-way authentication data, session root information, wireless LAN transmission permission, and network security adaptation table; the transmission sequence number participates in wireless status verification, protection header generation, and wireless encrypted data packet connection verification. The processing results at each stage have a source of preceding data and are reused in subsequent steps.

[0051] In handling abnormal states, the near-field link invalidation flag is used to stop the combination of two-way authentication data; the field boundary abnormality flag is used to delete written fields in the authentication buffer; the authentication inconsistency flag is used to invalidate the authentication pass status; the wireless state abnormality flag is used to stop the generation of encrypted control segments; and the packet connection abnormality flag is used to delete written content in the packet header and payload areas. These abnormal states correspond to their respective triggering conditions and processing results, and do not affect the field definitions of other fields that have not triggered abnormalities.

[0052] The field order, field boundaries, status flags, comparison objects, cache write relationships, digest fragment parsing relationships, license table write relationships, protection header field relationships, and network security adaptation table association relationships described in the above embodiments are used to illustrate the possible implementations of the present invention. Without departing from the technical solutions described in this invention and the scope supported by the original disclosure, any equivalent substitutions, equivalent modifications, equivalent combinations, order adjustments, equivalent transformations of field names, equivalent inheritance of execution entities, or equivalent changes in carrier forms that can be made by those skilled in the art should fall within the scope of protection of this patent; however, they may not be extended to unclaimed topics, nor may the substantive correspondence between technical objects be changed through name changes.

Claims

1. A method for NFC security authentication and WiFi data encryption transmission of a multi-protocol IoT device, characterized in that, Acquire near-field stability duration, near-field round-trip time, reader license code, authentication initiation count, device identity value and protocol capability information, and combine them into two-way authentication data in a predetermined order; Based on the two-way authentication data and the device key operation value in the hardware-level key storage unit, a device authentication response is generated, a gateway authentication response is received, and the license information in the gateway authentication response is compared with the two-way authentication data to determine the authentication pass status. When the authentication pass status is valid, session root information is generated based on the device authentication response, the gateway authentication response, the authentication initiation count, and the protocol capability information, and wireless local area network transmission permission is enabled. The system obtains the wireless channel number, received signal strength, retransmission count, and transmission sequence number. Based on the session root information, the wireless channel number, the received signal strength, the retransmission count, and the transmission sequence number, it determines the encryption control segment. Based on the encryption control segment, it performs bit reordering and bit-by-bit difference judgment on the service payload to generate ciphertext payload and protection header. The encrypted payload and the protection header are concatenated into a wireless encrypted data packet. A network security adaptation table is generated based on the protocol capability information, the authentication pass status, and the session root information. Access permissions for Bluetooth, wireless LAN, and near-field communication are restricted according to the network security adaptation table, and the wireless encrypted data packet is output.

2. The method according to claim 1, characterized in that, The process of generating the two-way authentication data includes: The near-field stable duration and the near-field round-trip time are obtained. The near-field stable duration is compared with the lower limit of the stable duration, and the near-field round-trip time is compared with the upper limit of the round-trip time. When the near-field stable duration reaches the lower limit of the stable duration and the near-field round-trip time does not exceed the upper limit of the round-trip time, a valid near-field link flag is determined. When the near-field stable duration does not reach the lower limit of the stable duration or the near-field round-trip time exceeds the upper limit of the round-trip time, an invalid near-field link flag is generated and the combination of the two-way authentication data is stopped. The reader / writer license code, the authentication initiation count, the device identity value, and the protocol capability information are obtained and written into the authentication buffer in a fixed field order: the near-field link validity marker, the reader / writer license code, the authentication initiation count, the device identity value, and the protocol capability information. Boundary checks are performed on the writing positions of each field. When the writing positions of each field are all within the corresponding field boundaries of the authentication buffer, the two-way authentication data is generated. When the writing position of any field exceeds the corresponding field boundary, the written field in the authentication buffer is deleted and a field boundary anomaly marker is generated.

3. The method according to claim 2, characterized in that, The specific order of the fixed fields is as follows: The near-field stabilization duration and the near-field round-trip delay are converted into a near-field state field of fixed length. The reader license code is written into the near-field state field, the authentication initiation count is written into the reader license code, the device identity value is written into the authentication initiation count, and the protocol capability information is written into the end field. When the length of any field is less than the corresponding fixed length, a padding mark is written at the end of the corresponding field. When the length of any field is greater than the corresponding fixed length, a preset high-order field is truncated to generate an authentication field sequence with consistent order, and the authentication field sequence is determined as the field content of the two-way authentication data.

4. The method according to claim 1, characterized in that, The process of determining the authentication pass status includes: The two-way authentication data and the device key operation value output by the hardware-level key storage unit are obtained. The two-way authentication data and the device key operation value are bound and operated according to the field order of the two-way authentication data to generate a device-side digest fragment. The device-side digest fragment is associated and encapsulated with the device identity value to generate the device authentication response. The system receives the gateway authentication response, parses the permission information, count echo field, and protocol echo field in the gateway authentication response, and performs a consistency comparison between the permission information, the count echo field, and the protocol echo field and the corresponding fields in the two-way authentication data. If all comparison results are consistent, the authentication pass status is determined to be valid; if any comparison result is inconsistent, the authentication pass status is determined to be invalid.

5. The method according to claim 4, characterized in that, The consistency comparison process includes: Read the reader license echo value in the license information, compare the reader license echo value with the reader license code in the two-way authentication data field by field, read the count echo value in the count echo field, compare the count echo value with the authentication initiation count in the two-way authentication data for sequential consistency, and read the protocol capability echo value in the protocol echo field, compare the protocol capability echo value with the protocol capability information in the two-way authentication data for consistency. An authentication consistency flag is generated when the reader license echo value matches the reader license code, the count echo value matches the authentication initiation count, and the protocol capability echo value matches the protocol capability information. An authentication inconsistency flag is generated when any comparison object is inconsistent.

6. The method according to claim 1, characterized in that, The process of generating the session root information and enabling wireless local area network transmission permissions includes: When the authentication pass status is valid, the device-side summary fragment is parsed from the device authentication response, the gateway-side summary fragment is parsed from the gateway authentication response, and the authentication initiation count is written into the session cache as a session freshness field; The session root information is generated by performing field concatenation and summary compression processing in the order of the device-side summary fragment, the gateway-side summary fragment, the session freshness field, and the protocol capability information. When the protocol capability information indicates that the wireless local area network is available, the index identifier of the session root information is written into the wireless local area network transmission license table, and the license flag is set to valid to enable wireless local area network transmission license. When the protocol capability information indicates that the wireless local area network is unavailable, the license flag in the wireless local area network transmission license table is kept invalid.

7. The method according to claim 1, characterized in that, The process of determining the encrypted control segment includes: The wireless channel number, the received signal strength, the retransmission count, and the transmission sequence number are obtained. The wireless channel number is judged to determine the legal interval of the channel, the received signal strength is judged to determine the lower limit of the strength, the retransmission count is judged to determine the upper limit of the number of retransmissions, and the transmission sequence number is judged to determine the incremental relationship, thereby generating a wireless status verification result. When the wireless status verification result is valid, the session root information is associated with the wireless channel number, the received signal strength, the retransmission count, and the transmission sequence number according to fixed field boundaries and written. The field sequence after association is truncated to generate the encrypted control segment. When the wireless status verification result is invalid, the generation of the encrypted control segment is stopped and a wireless status abnormality flag is output.

8. The method according to claim 7, characterized in that, The process for generating the wireless status verification result is as follows: The wireless channel number is matched with the pre-stored channel license table to determine the channel license flag; the received signal strength is compared with the lower limit value to determine the signal stability flag; and the retransmission count is compared with the upper limit value of the retransmission count to determine the link congestion flag. When the channel grant flag is granted, the signal stability flag is stable, the link congestion flag is not congested, and the transmission sequence number satisfies an increasing relationship with the locally stored historical transmission sequence number, the generated radio state verification result is valid. When the channel grant flag is rejected, the signal stability flag is unstable, the link congestion flag is congested, or the transmission sequence number does not satisfy the increasing relationship, the generated radio state verification result is invalid.

9. The method according to claim 1, characterized in that, The generation process of the ciphertext payload and the protection header includes: The service payload is obtained, the payload segment boundary is determined according to the bit order selection field in the encryption control segment, the service payload is divided into at least one payload segment, the bit positions in each payload segment are rearranged by alternation, rearrangement boundary markers are generated according to the payload segment boundaries, and rearranged payload sequence is generated. Read the difference and similarity judgment field in the encryption control segment, compare the rearranged payload sequence with the difference and similarity judgment field bit by bit for sameness or difference, and rewrite the corresponding bits in the rearranged payload sequence according to the comparison result to generate the ciphertext payload; Extract the payload length, the transmission sequence number, and the rearrangement boundary marker of the service payload, associate them with the protection field, and generate the protection header.

10. The method according to claim 1, characterized in that, The process of outputting the wireless encrypted data packet includes: The encrypted payload and the protection header are obtained. The payload length field and sequence number field in the protection header are read. The payload length field is compared with the actual length of the encrypted payload, and the sequence number field is compared with the transmission sequence number. When the comparison results are consistent, the protection header is written into the header area and the encrypted payload is written into the payload area to generate the wireless encrypted data packet. When any comparison result is inconsistent, the written content in the header area and the payload area is deleted and a data packet connection anomaly flag is generated. The protocol capability information, the authentication pass status, and the session root information are obtained. The protocol availability status is determined from the protocol capability information, the authentication validity status is determined from the authentication pass status, and the session index identifier is determined from the session root information. The protocol availability status, the authentication validity status, and the session index identifier are associated and written into the network security adaptation table. Based on the network security adaptation table, access permission statuses are generated for Bluetooth, wireless LAN, and near-field communication respectively, and the wireless encrypted data packets are output.

Images