{"id":10021269,"date":"2026-02-22T11:35:21","date_gmt":"2026-02-22T03:35:21","guid":{"rendered":"https:\/\/itmax.cn\/?p=10021269"},"modified":"2026-02-22T11:35:21","modified_gmt":"2026-02-22T03:35:21","slug":"%e7%89%a9%e8%81%94%e7%bd%91%e5%ae%89%e5%85%a8%e5%92%8c%e8%ae%a4%e8%af%81%e6%8a%80%e6%9c%af","status":"publish","type":"post","link":"https:\/\/itmax.cn\/?p=10021269","title":{"rendered":"\u7269\u8054\u7f51\u5b89\u5168\u548c\u8ba4\u8bc1\u6280\u672f"},"content":{"rendered":"

\u5927\u5bb6\u597d\uff0c\u6211\u662f\u826f\u8bb8\u3002<\/p>\n

\u6700\u8fd1\u5728\u505a\u4e00\u4e2a\u667a\u80fd\u5bb6\u5c45\u9879\u76ee\u7684\u65f6\u5019\uff0c\u5ba2\u6237\u63d0\u51fa\u4e86\u4e00\u4e2a\u8ba9\u6211\u5934\u75bc\u7684\u95ee\u9898\uff1a”\u4f60\u4eec\u7684\u8bbe\u5907\u5b89\u5168\u5417\uff1f\u4f1a\u4e0d\u4f1a\u88ab\u9ed1\u5ba2\u653b\u51fb\uff1f”<\/p>\n

\u8fd9\u4e2a\u95ee\u9898\u8ba9\u6211\u610f\u8bc6\u5230\uff0c\u5728\u7269\u8054\u7f51\u65f6\u4ee3\uff0c\u5b89\u5168\u95ee\u9898\u5df2\u7ecf\u4e0d\u518d\u662f\u53ef\u6709\u53ef\u65e0\u7684\u9644\u52a0\u529f\u80fd\uff0c\u800c\u662f\u5fc5\u987b\u4ece\u8bbe\u8ba1\u4e4b\u521d\u5c31\u8981\u8003\u8651\u7684\u6838\u5fc3\u8981\u7d20\u3002<\/p>\n

\u4eca\u5929\u5c31\u548c\u5927\u5bb6\u804a\u804a\u7269\u8054\u7f51\u5b89\u5168\u548c\u8ba4\u8bc1\u6280\u672f\u8fd9\u4e2a\u8bdd\u9898\u3002<\/p>\n

1. \u7269\u8054\u7f51\u5b89\u5168\u9762\u4e34\u7684\u6311\u6218<\/h2>\n

1.1 \u7269\u8054\u7f51\u8bbe\u5907\u7684\u8106\u5f31\u6027<\/h3>\n

\u7269\u8054\u7f51\u8bbe\u5907\u548c\u4f20\u7edf\u7684 PC \u6216\u670d\u52a1\u5668\u4e0d\u540c\uff0c\u5b83\u4eec\u5f80\u5f80\u8d44\u6e90\u53d7\u9650\uff0c\u8ba1\u7b97\u80fd\u529b\u5f31\uff0c\u5b58\u50a8\u7a7a\u95f4\u5c0f\u3002<\/p>\n

\u6211\u4e4b\u524d\u505a\u8fc7\u4e00\u4e2a\u9879\u76ee\uff0c\u4f7f\u7528\u7684\u662f STM32F103 \u7cfb\u5217\u5355\u7247\u673a\uff0cFlash \u53ea\u6709 64KB\uff0cRAM \u53ea\u6709 20KB\u3002<\/p>\n

\u5728\u8fd9\u6837\u7684\u786c\u4ef6\u6761\u4ef6\u4e0b\uff0c\u60f3\u8981\u5b9e\u73b0\u590d\u6742\u7684\u52a0\u5bc6\u7b97\u6cd5\u548c\u5b89\u5168\u673a\u5236\uff0c\u786e\u5b9e\u662f\u4e2a\u4e0d\u5c0f\u7684\u6311\u6218\u3002<\/p>\n

\u66f4\u8981\u547d\u7684\u662f\uff0c\u5f88\u591a\u7269\u8054\u7f51\u8bbe\u5907\u90e8\u7f72\u5728\u65e0\u4eba\u503c\u5b88\u7684\u73af\u5883\u4e2d\uff0c\u6bd4\u5982\u667a\u80fd\u7535\u8868\u3001\u73af\u5883\u76d1\u6d4b\u4f20\u611f\u5668\u7b49\u3002<\/p>\n

\u8fd9\u4e9b\u8bbe\u5907\u4e00\u65e6\u88ab\u90e8\u7f72\uff0c\u53ef\u80fd\u51e0\u5e74\u90fd\u4e0d\u4f1a\u6709\u4eba\u53bb\u7ef4\u62a4\uff0c\u8fd9\u5c31\u7ed9\u653b\u51fb\u8005\u63d0\u4f9b\u4e86\u5145\u8db3\u7684\u65f6\u95f4\u53bb\u7814\u7a76\u548c\u653b\u51fb\u3002<\/p>\n

\u6211\u89c1\u8fc7\u4e00\u4e2a\u6848\u4f8b\uff0c\u67d0\u4e2a\u667a\u80fd\u95e8\u9501\u56e0\u4e3a\u56fa\u4ef6\u66f4\u65b0\u673a\u5236\u4e0d\u5b8c\u5584\uff0c\u88ab\u9ed1\u5ba2\u5229\u7528\u6f0f\u6d1e\u8fdc\u7a0b\u5f00\u9501\uff0c\u9020\u6210\u4e86\u4e25\u91cd\u7684\u5b89\u5168\u4e8b\u6545\u3002<\/p>\n

1.2 \u901a\u4fe1\u94fe\u8def\u7684\u5b89\u5168\u98ce\u9669<\/h3>\n

\u7269\u8054\u7f51\u8bbe\u5907\u901a\u5e38\u901a\u8fc7\u65e0\u7ebf\u65b9\u5f0f\u901a\u4fe1\uff0c\u6bd4\u5982 WiFi\u3001\u84dd\u7259\u3001LoRa\u3001NB-IoT \u7b49\u3002<\/p>\n

\u8fd9\u4e9b\u65e0\u7ebf\u901a\u4fe1\u5929\u7136\u5c31\u5b58\u5728\u88ab\u7a83\u542c\u3001\u88ab\u7be1\u6539\u7684\u98ce\u9669\u3002<\/p>\n

\u6211\u5728\u505a\u6c7d\u8f66\u7535\u5b50\u9879\u76ee\u65f6\uff0c\u5c31\u9047\u5230\u8fc7 CAN \u603b\u7ebf\u88ab\u6076\u610f\u6ce8\u5165\u6570\u636e\u5305\u7684\u60c5\u51b5\uff0c\u867d\u7136 CAN \u603b\u7ebf\u662f\u6709\u7ebf\u901a\u4fe1\uff0c\u4f46\u5982\u679c\u6ca1\u6709\u9002\u5f53\u7684\u5b89\u5168\u63aa\u65bd\uff0c\u540c\u6837\u5bb9\u6613\u53d7\u5230\u653b\u51fb\u3002<\/p>\n

\u65e0\u7ebf\u901a\u4fe1\u7684\u53e6\u4e00\u4e2a\u95ee\u9898\u662f\u91cd\u653e\u653b\u51fb\u3002<\/p>\n

\u653b\u51fb\u8005\u53ef\u4ee5\u622a\u83b7\u5408\u6cd5\u7684\u901a\u4fe1\u6570\u636e\u5305\uff0c\u7136\u540e\u5728\u7a0d\u540e\u7684\u65f6\u95f4\u91cd\u65b0\u53d1\u9001\uff0c\u4ece\u800c\u6b3a\u9a97\u7cfb\u7edf\u3002<\/p>\n

\u6bd4\u5982\uff0c\u653b\u51fb\u8005\u622a\u83b7\u4e86\u5f00\u95e8\u7684\u6307\u4ee4\uff0c\u7136\u540e\u5728\u4e3b\u4eba\u79bb\u5f00\u540e\u91cd\u653e\u8fd9\u4e2a\u6307\u4ee4\uff0c\u5c31\u80fd\u975e\u6cd5\u8fdb\u5165\u623f\u95f4\u3002<\/p>\n

1.3 \u6570\u636e\u9690\u79c1\u4fdd\u62a4<\/h3>\n

\u7269\u8054\u7f51\u8bbe\u5907\u6536\u96c6\u7684\u6570\u636e\u5f80\u5f80\u6d89\u53ca\u7528\u6237\u9690\u79c1\u3002<\/p>\n

\u667a\u80fd\u624b\u73af\u8bb0\u5f55\u4f60\u7684\u8fd0\u52a8\u8f68\u8ff9\u548c\u5065\u5eb7\u6570\u636e\uff0c\u667a\u80fd\u97f3\u7bb1\u53ef\u80fd\u5f55\u4e0b\u4f60\u7684\u5bf9\u8bdd\uff0c\u667a\u80fd\u6444\u50cf\u5934\u66f4\u662f\u76f4\u63a5\u62cd\u6444\u4f60\u7684\u751f\u6d3b\u573a\u666f\u3002<\/p>\n

\u5982\u679c\u8fd9\u4e9b\u6570\u636e\u6ca1\u6709\u5f97\u5230\u59a5\u5584\u4fdd\u62a4\uff0c\u540e\u679c\u4e0d\u582a\u8bbe\u60f3\u3002<\/p>\n

\u6211\u66fe\u7ecf\u53c2\u4e0e\u8fc7\u4e00\u4e2a\u667a\u80fd\u533b\u7597\u8bbe\u5907\u7684\u9879\u76ee\uff0c\u8bbe\u5907\u9700\u8981\u91c7\u96c6\u60a3\u8005\u7684\u751f\u7406\u6570\u636e\u5e76\u4e0a\u4f20\u5230\u4e91\u7aef\u3002<\/p>\n

\u5728\u8bbe\u8ba1\u9636\u6bb5\uff0c\u6211\u4eec\u5c31\u5fc5\u987b\u8003\u8651\u5982\u4f55\u5bf9\u8fd9\u4e9b\u654f\u611f\u6570\u636e\u8fdb\u884c\u52a0\u5bc6\u5b58\u50a8\u548c\u4f20\u8f93\uff0c\u786e\u4fdd\u5373\u4f7f\u6570\u636e\u88ab\u622a\u83b7\uff0c\u653b\u51fb\u8005\u4e5f\u65e0\u6cd5\u89e3\u8bfb\u5176\u5185\u5bb9\u3002<\/p>\n

2. \u7269\u8054\u7f51\u8ba4\u8bc1\u6280\u672f<\/h2>\n

2.1 \u8bbe\u5907\u8eab\u4efd\u8ba4\u8bc1<\/h3>\n

\u5728\u7269\u8054\u7f51\u7cfb\u7edf\u4e2d\uff0c\u9996\u5148\u8981\u89e3\u51b3\u7684\u95ee\u9898\u662f”\u4f60\u662f\u8c01”\u3002<\/p>\n

\u8bbe\u5907\u8eab\u4efd\u8ba4\u8bc1\u5c31\u662f\u786e\u4fdd\u8fde\u63a5\u5230\u7f51\u7edc\u7684\u8bbe\u5907\u662f\u5408\u6cd5\u7684\u3001\u53ef\u4fe1\u7684\u3002<\/p>\n

2.1.1 \u57fa\u4e8e\u5bc6\u94a5\u7684\u8ba4\u8bc1<\/h4>\n

\u6700\u5e38\u89c1\u7684\u8ba4\u8bc1\u65b9\u5f0f\u662f\u57fa\u4e8e\u9884\u5171\u4eab\u5bc6\u94a5\uff08PSK\uff09\u3002<\/p>\n

\u5728\u8bbe\u5907\u51fa\u5382\u65f6\uff0c\u5c31\u4e3a\u6bcf\u4e2a\u8bbe\u5907\u5206\u914d\u4e00\u4e2a\u552f\u4e00\u7684\u5bc6\u94a5\uff0c\u8fd9\u4e2a\u5bc6\u94a5\u540c\u65f6\u5b58\u50a8\u5728\u8bbe\u5907\u548c\u670d\u52a1\u5668\u7aef\u3002<\/p>\n

\u5f53\u8bbe\u5907\u8fde\u63a5\u5230\u7f51\u7edc\u65f6\uff0c\u901a\u8fc7\u5bc6\u94a5\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u3002<\/p>\n

\u4e0b\u9762\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u57fa\u4e8e HMAC-SHA256 \u7684\u8ba4\u8bc1\u793a\u4f8b\u4ee3\u7801\uff1a<\/p>\n

#include "stm32f4xx_hal.h"\n#include "mbedtls\/md.h"\n#include <string.h>\n\u200b\n\/\/ \u8bbe\u5907\u552f\u4e00\u5bc6\u94a5\uff08\u5b9e\u9645\u5e94\u7528\u4e2d\u5e94\u8be5\u5b89\u5168\u5b58\u50a8\uff09\nconst uint8_t device_key[32] = {\n    0x01\uff0c 0x23\uff0c 0x45\uff0c 0x67\uff0c 0x89\uff0c 0xAB\uff0c 0xCD\uff0c 0xEF\uff0c\n    0xFE\uff0c 0xDC\uff0c 0xBA\uff0c 0x98\uff0c 0x76\uff0c 0x54\uff0c 0x32\uff0c 0x10\uff0c\n    0x01\uff0c 0x23\uff0c 0x45\uff0c 0x67\uff0c 0x89\uff0c 0xAB\uff0c 0xCD\uff0c 0xEF\uff0c\n    0xFE\uff0c 0xDC\uff0c 0xBA\uff0c 0x98\uff0c 0x76\uff0c 0x54\uff0c 0x32\uff0c 0x10\n};\n\u200b\n\/\/ \u751f\u6210\u8ba4\u8bc1\u4ee4\u724c\nint generate_auth_token(const char* device_id\uff0c uint32_t timestamp\uff0c \n                        uint8_t* token\uff0c size_t token_len)\n{\n    mbedtls_md_context_t ctx;\n    const mbedtls_md_info_t* md_info;\n    uint8_t message[128];\n    int ret;\n    \n    \/\/ \u6784\u9020\u5f85\u7b7e\u540d\u7684\u6d88\u606f\uff1a\u8bbe\u5907ID + \u65f6\u95f4\u6233\n    snprintf((char*)message\uff0c sizeof(message)\uff0c "%s:%lu"\uff0c device_id\uff0c timestamp);\n    \n    \/\/ \u521d\u59cb\u5316HMAC-SHA256\n    mbedtls_md_init(&ctx);\n    md_info = mbedtls_md_info_from_type(MBEDTLS_MD_SHA256);\n    \n    ret = mbedtls_md_setup(&ctx\uff0c md_info\uff0c 1); \/\/ 1\u8868\u793a\u542f\u7528HMAC\n    if (ret != 0) {\n        return -1;\n    }\n    \n    \/\/ \u8bbe\u7f6e\u5bc6\u94a5\n    ret = mbedtls_md_hmac_starts(&ctx\uff0c device_key\uff0c sizeof(device_key));\n    if (ret != 0) {\n        mbedtls_md_free(&ctx);\n        return -1;\n    }\n    \n    \/\/ \u8ba1\u7b97HMAC\n    ret = mbedtls_md_hmac_update(&ctx\uff0c message\uff0c strlen((char*)message));\n    if (ret != 0) {\n        mbedtls_md_free(&ctx);\n        return -1;\n    }\n    \n    ret = mbedtls_md_hmac_finish(&ctx\uff0c token);\n    if (ret != 0) {\n        mbedtls_md_free(&ctx);\n        return -1;\n    }\n    \n    mbedtls_md_free(&ctx);\n    return 0;\n}\n\u200b\n\/\/ \u9a8c\u8bc1\u8ba4\u8bc1\u4ee4\u724c\nint verify_auth_token(const char* device_id\uff0c uint32_t timestamp\uff0c\n                      const uint8_t* received_token)\n{\n    uint8_t calculated_token[32];\n    \n    \/\/ \u751f\u6210\u9884\u671f\u7684\u4ee4\u724c\n    if (generate_auth_token(device_id\uff0c timestamp\uff0c calculated_token\uff0c \n                           sizeof(calculated_token)) != 0) {\n        return -1;\n    }\n    \n    \/\/ \u6bd4\u8f83\u4ee4\u724c\n    if (memcmp(calculated_token\uff0c received_token\uff0c 32) == 0) {\n        return 0; \/\/ \u9a8c\u8bc1\u6210\u529f\n    }\n    \n    return -1; \/\/ \u9a8c\u8bc1\u5931\u8d25\n}<\/code><\/pre>\n
\u8fd9\u6bb5\u4ee3\u7801\u5c55\u793a\u4e86\u5982\u4f55\u4f7f\u7528 HMAC-SHA256 \u7b97\u6cd5\u751f\u6210\u548c\u9a8c\u8bc1\u8ba4\u8bc1\u4ee4\u724c\u3002<\/p>\n
\u8bbe\u5907\u4f7f\u7528\u81ea\u5df1\u7684\u5bc6\u94a5\u548c\u5f53\u524d\u65f6\u95f4\u6233\u751f\u6210\u4ee4\u724c\uff0c\u670d\u52a1\u5668\u7aef\u4f7f\u7528\u76f8\u540c\u7684\u7b97\u6cd5\u9a8c\u8bc1\u4ee4\u724c\u7684\u6709\u6548\u6027\u3002<\/p>\n
\u65f6\u95f4\u6233\u7684\u52a0\u5165\u53ef\u4ee5\u9632\u6b62\u91cd\u653e\u653b\u51fb\uff0c\u56e0\u4e3a\u65e7\u7684\u4ee4\u724c\u4f1a\u56e0\u4e3a\u65f6\u95f4\u6233\u8fc7\u671f\u800c\u5931\u6548\u3002<\/p>\n
2.1.2 \u57fa\u4e8e\u8bc1\u4e66\u7684\u8ba4\u8bc1<\/h4>\n
\u5bf9\u4e8e\u5b89\u5168\u8981\u6c42\u66f4\u9ad8\u7684\u573a\u666f\uff0c\u53ef\u4ee5\u4f7f\u7528\u57fa\u4e8e X.509 \u8bc1\u4e66\u7684\u8ba4\u8bc1\u673a\u5236\u3002<\/p>\n
\u6bcf\u4e2a\u8bbe\u5907\u90fd\u6709\u4e00\u4e2a\u7531\u53ef\u4fe1 CA \u7b7e\u53d1\u7684\u6570\u5b57\u8bc1\u4e66\uff0c\u8bc1\u4e66\u4e2d\u5305\u542b\u8bbe\u5907\u7684\u516c\u94a5\u548c\u8eab\u4efd\u4fe1\u606f\u3002<\/p>\n
\u5728\u8ba4\u8bc1\u8fc7\u7a0b\u4e2d\uff0c\u8bbe\u5907\u51fa\u793a\u81ea\u5df1\u7684\u8bc1\u4e66\uff0c\u670d\u52a1\u5668\u9a8c\u8bc1\u8bc1\u4e66\u7684\u6709\u6548\u6027\uff0c\u5e76\u901a\u8fc7\u516c\u94a5\u52a0\u5bc6\u7684\u65b9\u5f0f\u786e\u8ba4\u8bbe\u5907\u62e5\u6709\u5bf9\u5e94\u7684\u79c1\u94a5\u3002<\/p>\n
\u6211\u5728\u505a\u6c7d\u8f66\u7535\u5b50\u9879\u76ee\u65f6\uff0c\u5c31\u91c7\u7528\u4e86\u8fd9\u79cd\u65b9\u6848\u3002<\/p>\n
\u8f66\u8f7d ECU \u4e4b\u95f4\u7684\u901a\u4fe1\u4f7f\u7528 TLS \u534f\u8bae\uff0c\u6bcf\u4e2a ECU \u90fd\u6709\u81ea\u5df1\u7684\u8bc1\u4e66\u3002<\/p>\n
\u8fd9\u6837\u5373\u4f7f CAN \u603b\u7ebf\u88ab\u7269\u7406\u63a5\u5165\uff0c\u653b\u51fb\u8005\u4e5f\u65e0\u6cd5\u4f2a\u9020\u5408\u6cd5\u7684 ECU\uff0c\u56e0\u4e3a\u4ed6\u6ca1\u6709\u5bf9\u5e94\u7684\u79c1\u94a5\u3002<\/p>\n
2.2 \u7528\u6237\u8eab\u4efd\u8ba4\u8bc1<\/h3>\n
\u9664\u4e86\u8bbe\u5907\u8ba4\u8bc1\uff0c\u7528\u6237\u8eab\u4efd\u8ba4\u8bc1\u540c\u6837\u91cd\u8981\u3002<\/p>\n
\u7528\u6237\u901a\u8fc7\u624b\u673a APP \u6216 Web \u754c\u9762\u8bbf\u95ee\u7269\u8054\u7f51\u8bbe\u5907\u65f6\uff0c\u9700\u8981\u8bc1\u660e\u81ea\u5df1\u7684\u8eab\u4efd\u3002<\/p>\n
2.2.1 \u591a\u56e0\u7d20\u8ba4\u8bc1<\/h4>\n
\u5355\u7eaf\u7684\u7528\u6237\u540d\u5bc6\u7801\u8ba4\u8bc1\u5df2\u7ecf\u4e0d\u591f\u5b89\u5168\u4e86\u3002<\/p>\n
\u73b0\u5728\u8d8a\u6765\u8d8a\u591a\u7684\u7269\u8054\u7f51\u7cfb\u7edf\u91c7\u7528\u591a\u56e0\u7d20\u8ba4\u8bc1\uff08MFA\uff09\uff0c\u6bd4\u5982\u5bc6\u7801\u52a0\u77ed\u4fe1\u9a8c\u8bc1\u7801\uff0c\u6216\u8005\u5bc6\u7801\u52a0\u751f\u7269\u8bc6\u522b\uff08\u6307\u7eb9\u3001\u4eba\u8138\u7b49\uff09\u3002<\/p>\n
\u6211\u5728\u8bbe\u8ba1\u4e00\u4e2a\u667a\u80fd\u95e8\u9501\u7cfb\u7edf\u65f6\uff0c\u5c31\u5b9e\u73b0\u4e86\u4e09\u5c42\u8ba4\u8bc1\uff1a\u9996\u5148\u662f\u624b\u673a APP \u7684\u767b\u5f55\u5bc6\u7801\uff0c\u7136\u540e\u662f\u84dd\u7259\u914d\u5bf9\u9a8c\u8bc1\uff0c\u6700\u540e\u662f\u95e8\u9501\u672c\u8eab\u7684\u6307\u7eb9\u8bc6\u522b\u3002<\/p>\n
\u53ea\u6709\u4e09\u5c42\u9a8c\u8bc1\u90fd\u901a\u8fc7\uff0c\u95e8\u9501\u624d\u4f1a\u6253\u5f00\u3002<\/p>\n
\u8fd9\u79cd\u591a\u5c42\u9632\u62a4\u673a\u5236\u5927\u5927\u63d0\u9ad8\u4e86\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u3002<\/p>\n
2.2.2 OAuth 2.0 \u6388\u6743<\/h4>\n
\u5bf9\u4e8e\u9700\u8981\u7b2c\u4e09\u65b9\u670d\u52a1\u96c6\u6210\u7684\u7269\u8054\u7f51\u7cfb\u7edf\uff0cOAuth 2.0 \u662f\u4e00\u4e2a\u5f88\u597d\u7684\u9009\u62e9\u3002<\/p>\n
\u7528\u6237\u53ef\u4ee5\u6388\u6743\u7b2c\u4e09\u65b9\u5e94\u7528\u8bbf\u95ee\u81ea\u5df1\u7684\u7269\u8054\u7f51\u8bbe\u5907\uff0c\u800c\u4e0d\u9700\u8981\u628a\u81ea\u5df1\u7684\u8d26\u53f7\u5bc6\u7801\u544a\u8bc9\u7b2c\u4e09\u65b9\u3002<\/p>\n
\u6bd4\u5982\uff0c\u4f60\u53ef\u4ee5\u6388\u6743 Google Assistant \u63a7\u5236\u4f60\u7684\u667a\u80fd\u706f\u6ce1\uff0c\u4f46 Google \u53ea\u80fd\u83b7\u5f97\u6709\u9650\u7684\u6743\u9650\uff0c\u4e0d\u80fd\u8bbf\u95ee\u4f60\u7684\u5176\u4ed6\u8bbe\u5907\u6216\u4e2a\u4eba\u4fe1\u606f\u3002<\/p>\n
\u8fd9\u79cd\u6388\u6743\u673a\u5236\u65e2\u65b9\u4fbf\u4e86\u7528\u6237\uff0c\u53c8\u4fdd\u62a4\u4e86\u9690\u79c1\u3002<\/p>\n
2.3 \u6570\u636e\u5b8c\u6574\u6027\u9a8c\u8bc1<\/h3>\n
\u9664\u4e86\u8eab\u4efd\u8ba4\u8bc1\uff0c\u6211\u4eec\u8fd8\u9700\u8981\u786e\u4fdd\u6570\u636e\u5728\u4f20\u8f93\u8fc7\u7a0b\u4e2d\u6ca1\u6709\u88ab\u7be1\u6539\u3002<\/p>\n
\u8fd9\u5c31\u9700\u8981\u7528\u5230\u6d88\u606f\u8ba4\u8bc1\u7801\uff08MAC\uff09\u6216\u6570\u5b57\u7b7e\u540d\u6280\u672f\u3002<\/p>\n
\u4e0b\u9762\u662f\u4e00\u4e2a\u4f7f\u7528 CRC32 \u8fdb\u884c\u6570\u636e\u5b8c\u6574\u6027\u6821\u9a8c\u7684\u7b80\u5355\u793a\u4f8b\uff1a<\/p>\n
#include "stm32f4xx_hal.h"\n\u200b\n\/\/ CRC32\u591a\u9879\u5f0f\uff08\u4ee5\u592a\u7f51\u6807\u51c6\uff09\n#define CRC32_POLYNOMIAL 0xEDB88320\n\u200b\n\/\/ \u8ba1\u7b97CRC32\nuint32_t calculate_crc32(const uint8_t* data\uff0c size_t length)\n{\n    uint32_t crc = 0xFFFFFFFF;\n    \n    for (size_t i = 0; i < length; i++) {\n        crc ^= data[i];\n        for (int j = 0; j < 8; j++) {\n            if (crc & 1) {\n                crc = (crc >> 1) ^ CRC32_POLYNOMIAL;\n            } else {\n                crc = crc >> 1;\n            }\n        }\n    }\n    \n    return ~crc;\n}\n\u200b\n\/\/ \u53d1\u9001\u5e26CRC\u6821\u9a8c\u7684\u6570\u636e\u5305\ntypedef struct {\n    uint8_t header;\n    uint8_t device_id;\n    uint16_t data_length;\n    uint8_t data[256];\n    uint32_t crc32;\n} __attribute__((packed)) secure_packet_t;\n\u200b\nint send_secure_packet(UART_HandleTypeDef* huart\uff0c uint8_t device_id\uff0c\n                       const uint8_t* data\uff0c uint16_t length)\n{\n    secure_packet_t packet;\n    \n    \/\/ \u586b\u5145\u6570\u636e\u5305\n    packet.header = 0xAA;\n    packet.device_id = device_id;\n    packet.data_length = length;\n    memcpy(packet.data\uff0c data\uff0c length);\n    \n    \/\/ \u8ba1\u7b97CRC32\uff08\u4e0d\u5305\u62ecCRC\u5b57\u6bb5\u672c\u8eab\uff09\n    packet.crc32 = calculate_crc32((uint8_t*)&packet\uff0c \n                                   sizeof(packet) - sizeof(uint32_t));\n    \n    \/\/ \u53d1\u9001\u6570\u636e\u5305\n    if (HAL_UART_Transmit(huart\uff0c (uint8_t*)&packet\uff0c \n                         sizeof(packet.header) + sizeof(packet.device_id) +\n                         sizeof(packet.data_length) + length + sizeof(uint32_t)\uff0c\n                         1000) != HAL_OK) {\n        return -1;\n    }\n    \n    return 0;\n}\n\u200b\n\/\/ \u63a5\u6536\u5e76\u9a8c\u8bc1\u6570\u636e\u5305\nint receive_secure_packet(UART_HandleTypeDef* huart\uff0c secure_packet_t* packet)\n{\n    uint32_t calculated_crc;\n    \n    \/\/ \u63a5\u6536\u6570\u636e\u5305\u5934\n    if (HAL_UART_Receive(huart\uff0c (uint8_t*)packet\uff0c 4\uff0c 1000) != HAL_OK) {\n        return -1;\n    }\n    \n    \/\/ \u9a8c\u8bc1\u5305\u5934\n    if (packet->header != 0xAA) {\n        return -2;\n    }\n    \n    \/\/ \u63a5\u6536\u6570\u636e\u548cCRC\n    if (HAL_UART_Receive(huart\uff0c packet->data\uff0c \n                        packet->data_length + sizeof(uint32_t)\uff0c \n                        1000) != HAL_OK) {\n        return -1;\n    }\n    \n    \/\/ \u8ba1\u7b97\u5e76\u9a8c\u8bc1CRC\n    calculated_crc = calculate_crc32((uint8_t*)packet\uff0c\n                                     sizeof(packet->header) + \n                                     sizeof(packet->device_id) +\n                                     sizeof(packet->data_length) + \n                                     packet->data_length);\n    \n    if (calculated_crc != packet->crc32) {\n        return -3; \/\/ CRC\u6821\u9a8c\u5931\u8d25\n    }\n    \n    return 0; \/\/ \u9a8c\u8bc1\u6210\u529f\n}<\/code><\/pre>\n
\u8fd9\u4e2a\u4f8b\u5b50\u5c55\u793a\u4e86\u5982\u4f55\u5728\u6570\u636e\u4f20\u8f93\u4e2d\u52a0\u5165 CRC32 \u6821\u9a8c\u3002<\/p>\n
\u867d\u7136 CRC \u4e3b\u8981\u7528\u4e8e\u68c0\u6d4b\u4f20\u8f93\u9519\u8bef\u800c\u4e0d\u662f\u9632\u6b62\u6076\u610f\u7be1\u6539\uff0c\u4f46\u5b83\u662f\u6570\u636e\u5b8c\u6574\u6027\u9a8c\u8bc1\u7684\u57fa\u7840\u3002<\/p>\n
\u5bf9\u4e8e\u66f4\u9ad8\u7684\u5b89\u5168\u8981\u6c42\uff0c\u5e94\u8be5\u4f7f\u7528 HMAC \u6216\u6570\u5b57\u7b7e\u540d\u3002<\/p>\n
3. \u6570\u636e\u52a0\u5bc6\u6280\u672f<\/h2>\n
3.1 \u5bf9\u79f0\u52a0\u5bc6<\/h3>\n
\u5bf9\u79f0\u52a0\u5bc6\u7b97\u6cd5\u4f7f\u7528\u76f8\u540c\u7684\u5bc6\u94a5\u8fdb\u884c\u52a0\u5bc6\u548c\u89e3\u5bc6\uff0c\u901f\u5ea6\u5feb\uff0c\u9002\u5408\u8d44\u6e90\u53d7\u9650\u7684\u7269\u8054\u7f51\u8bbe\u5907\u3002<\/p>\n
\u5e38\u7528\u7684\u5bf9\u79f0\u52a0\u5bc6\u7b97\u6cd5\u6709 AES\u3001DES\u30013DES \u7b49\uff0c\u5176\u4e2d AES \u662f\u76ee\u524d\u6700\u5e7f\u6cdb\u4f7f\u7528\u7684\u3002<\/p>\n
3.1.1 AES \u52a0\u5bc6\u5b9e\u73b0<\/h4>\n
\u5728 STM32 \u5e73\u53f0\u4e0a\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528\u786c\u4ef6\u52a0\u5bc6\u6a21\u5757\u6216\u8f6f\u4ef6\u5e93\u6765\u5b9e\u73b0 AES \u52a0\u5bc6\u3002<\/p>\n
\u4e0b\u9762\u662f\u4f7f\u7528 mbedTLS \u5e93\u5b9e\u73b0 AES-128-CBC \u52a0\u5bc6\u7684\u793a\u4f8b\uff1a<\/p>\n
#include "mbedtls\/aes.h"\n#include "mbedtls\/entropy.h"\n#include "mbedtls\/ctr_drbg.h"\n#include <string.h>\n\u200b\n\/\/ AES\u5bc6\u94a5\uff08128\u4f4d\uff09\nconst uint8_t aes_key[16] = {\n    0x2b\uff0c 0x7e\uff0c 0x15\uff0c 0x16\uff0c 0x28\uff0c 0xae\uff0c 0xd2\uff0c 0xa6\uff0c\n    0xab\uff0c 0xf7\uff0c 0x15\uff0c 0x88\uff0c 0x09\uff0c 0xcf\uff0c 0x4f\uff0c 0x3c\n};\n\u200b\n\/\/ \u52a0\u5bc6\u51fd\u6570\nint aes_encrypt_data(const uint8_t* plaintext\uff0c size_t plaintext_len\uff0c\n                     uint8_t* ciphertext\uff0c uint8_t* iv)\n{\n    mbedtls_aes_context aes;\n    mbedtls_entropy_context entropy;\n    mbedtls_ctr_drbg_context ctr_drbg;\n    const char* personalization = "iot_device_aes";\n    int ret;\n    size_t padded_len;\n    uint8_t padded_data[256];\n    \n    \/\/ \u521d\u59cb\u5316\u968f\u673a\u6570\u751f\u6210\u5668\n    mbedtls_entropy_init(&entropy);\n    mbedtls_ctr_drbg_init(&ctr_drbg);\n    \n    ret = mbedtls_ctr_drbg_seed(&ctr_drbg\uff0c mbedtls_entropy_func\uff0c &entropy\uff0c\n                               (const uint8_t*)personalization\uff0c\n                               strlen(personalization));\n    if (ret != 0) {\n        return -1;\n    }\n    \n    \/\/ \u751f\u6210\u968f\u673aIV\n    ret = mbedtls_ctr_drbg_random(&ctr_drbg\uff0c iv\uff0c 16);\n    if (ret != 0) {\n        return -1;\n    }\n    \n    \/\/ PKCS7\u586b\u5145\n    padded_len = ((plaintext_len \/ 16) + 1) * 16;\n    memcpy(padded_data\uff0c plaintext\uff0c plaintext_len);\n    uint8_t padding_value = padded_len - plaintext_len;\n    for (size_t i = plaintext_len; i < padded_len; i++) {\n        padded_data[i] = padding_value;\n    }\n    \n    \/\/ \u521d\u59cb\u5316AES\u4e0a\u4e0b\u6587\n    mbedtls_aes_init(&aes);\n    ret = mbedtls_aes_setkey_enc(&aes\uff0c aes_key\uff0c 128);\n    if (ret != 0) {\n        mbedtls_aes_free(&aes);\n        return -1;\n    }\n    \n    \/\/ \u6267\u884cCBC\u6a21\u5f0f\u52a0\u5bc6\n    ret = mbedtls_aes_crypt_cbc(&aes\uff0c MBEDTLS_AES_ENCRYPT\uff0c padded_len\uff0c\n                               iv\uff0c padded_data\uff0c ciphertext);\n    \n    \/\/ \u6e05\u7406\n    mbedtls_aes_free(&aes);\n    mbedtls_ctr_drbg_free(&ctr_drbg);\n    mbedtls_entropy_free(&entropy);\n    \n    return (ret == 0) ? padded_len : -1;\n}\n\u200b\n\/\/ \u89e3\u5bc6\u51fd\u6570\nint aes_decrypt_data(const uint8_t* ciphertext\uff0c size_t ciphertext_len\uff0c\n                     uint8_t* plaintext\uff0c const uint8_t* iv)\n{\n    mbedtls_aes_context aes;\n    uint8_t decrypted_data[256];\n    int ret;\n    uint8_t padding_value;\n    size_t plaintext_len;\n    \n    \/\/ \u521d\u59cb\u5316AES\u4e0a\u4e0b\u6587\n    mbedtls_aes_init(&aes);\n    ret = mbedtls_aes_setkey_dec(&aes\uff0c aes_key\uff0c 128);\n    if (ret != 0) {\n        mbedtls_aes_free(&aes);\n        return -1;\n    }\n    \n    \/\/ \u6267\u884cCBC\u6a21\u5f0f\u89e3\u5bc6\n    uint8_t iv_copy[16];\n    memcpy(iv_copy\uff0c iv\uff0c 16); \/\/ CBC\u6a21\u5f0f\u4f1a\u4fee\u6539IV\uff0c\u6240\u4ee5\u8981\u590d\u5236\n    ret = mbedtls_aes_crypt_cbc(&aes\uff0c MBEDTLS_AES_DECRYPT\uff0c ciphertext_len\uff0c\n                               iv_copy\uff0c ciphertext\uff0c decrypted_data);\n    \n    mbedtls_aes_free(&aes);\n    \n    if (ret != 0) {\n        return -1;\n    }\n    \n    \/\/ \u53bb\u9664PKCS7\u586b\u5145\n    padding_value = decrypted_data[ciphertext_len - 1];\n    if (padding_value > 16 || padding_value == 0) {\n        return -1; \/\/ \u65e0\u6548\u7684\u586b\u5145\n    }\n    \n    plaintext_len = ciphertext_len - padding_value;\n    memcpy(plaintext\uff0c decrypted_data\uff0c plaintext_len);\n    \n    return plaintext_len;\n}<\/code><\/pre>\n
\u8fd9\u6bb5\u4ee3\u7801\u5b9e\u73b0\u4e86\u5b8c\u6574\u7684 AES-128-CBC \u52a0\u5bc6\u548c\u89e3\u5bc6\u6d41\u7a0b\uff0c\u5305\u62ec\u968f\u673a IV \u751f\u6210\u3001PKCS7 \u586b\u5145\u7b49\u7ec6\u8282\u3002<\/p>\n
\u5728\u5b9e\u9645\u5e94\u7528\u4e2d\uff0cIV \u5fc5\u987b\u662f\u968f\u673a\u751f\u6210\u7684\uff0c\u5e76\u4e14\u9700\u8981\u548c\u5bc6\u6587\u4e00\u8d77\u4f20\u8f93\u7ed9\u63a5\u6536\u65b9\u3002<\/p>\n
3.2 \u975e\u5bf9\u79f0\u52a0\u5bc6<\/h3>\n
\u975e\u5bf9\u79f0\u52a0\u5bc6\u4f7f\u7528\u4e00\u5bf9\u5bc6\u94a5\uff1a\u516c\u94a5\u7528\u4e8e\u52a0\u5bc6\uff0c\u79c1\u94a5\u7528\u4e8e\u89e3\u5bc6\u3002<\/p>\n
\u867d\u7136\u8ba1\u7b97\u91cf\u5927\uff0c\u4f46\u5b83\u89e3\u51b3\u4e86\u5bc6\u94a5\u5206\u53d1\u7684\u95ee\u9898\uff0c\u7279\u522b\u9002\u5408\u8bbe\u5907\u521d\u59cb\u5316\u548c\u5bc6\u94a5\u4ea4\u6362\u573a\u666f\u3002<\/p>\n
3.2.1 RSA \u5bc6\u94a5\u4ea4\u6362<\/h4>\n
\u5728\u7269\u8054\u7f51\u7cfb\u7edf\u4e2d\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528 RSA \u8fdb\u884c\u5bc6\u94a5\u4ea4\u6362\u3002<\/p>\n
\u8bbe\u5907\u4f7f\u7528\u670d\u52a1\u5668\u7684\u516c\u94a5\u52a0\u5bc6\u4e00\u4e2a\u968f\u673a\u751f\u6210\u7684\u5bf9\u79f0\u5bc6\u94a5\uff0c\u7136\u540e\u53d1\u9001\u7ed9\u670d\u52a1\u5668\u3002<\/p>\n
\u670d\u52a1\u5668\u7528\u81ea\u5df1\u7684\u79c1\u94a5\u89e3\u5bc6\u5f97\u5230\u5bf9\u79f0\u5bc6\u94a5\uff0c\u4e4b\u540e\u53cc\u65b9\u5c31\u53ef\u4ee5\u4f7f\u7528\u8fd9\u4e2a\u5bf9\u79f0\u5bc6\u94a5\u8fdb\u884c\u5feb\u901f\u7684 AES \u52a0\u5bc6\u901a\u4fe1\u4e86\u3002<\/p>\n
#include "mbedtls\/rsa.h"\n#include "mbedtls\/entropy.h"\n#include "mbedtls\/ctr_drbg.h"\n\u200b\n\/\/ \u4f7f\u7528RSA\u516c\u94a5\u52a0\u5bc6AES\u5bc6\u94a5\nint rsa_encrypt_session_key(const uint8_t* session_key\uff0c size_t key_len\uff0c\n                            const mbedtls_rsa_context* rsa_public\uff0c\n                            uint8_t* encrypted_key)\n{\n    mbedtls_entropy_context entropy;\n    mbedtls_ctr_drbg_context ctr_drbg;\n    const char* pers = "rsa_encrypt";\n    int ret;\n    \n    \/\/ \u521d\u59cb\u5316\u968f\u673a\u6570\u751f\u6210\u5668\n    mbedtls_entropy_init(&entropy);\n    mbedtls_ctr_drbg_init(&ctr_drbg);\n    \n    ret = mbedtls_ctr_drbg_seed(&ctr_drbg\uff0c mbedtls_entropy_func\uff0c &entropy\uff0c\n                               (const uint8_t*)pers\uff0c strlen(pers));\n    if (ret != 0) {\n        goto cleanup;\n    }\n    \n    \/\/ \u4f7f\u7528RSA\u516c\u94a5\u52a0\u5bc6\n    ret = mbedtls_rsa_pkcs1_encrypt((mbedtls_rsa_context*)rsa_public\uff0c\n                                   mbedtls_ctr_drbg_random\uff0c &ctr_drbg\uff0c\n                                   MBEDTLS_RSA_PUBLIC\uff0c key_len\uff0c\n                                   session_key\uff0c encrypted_key);\n    \ncleanup:\n    mbedtls_ctr_drbg_free(&ctr_drbg);\n    mbedtls_entropy_free(&entropy);\n    \n    return ret;\n}\n\u200b\n\/\/ \u4f7f\u7528RSA\u79c1\u94a5\u89e3\u5bc6AES\u5bc6\u94a5\nint rsa_decrypt_session_key(const uint8_t* encrypted_key\uff0c\n                            const mbedtls_rsa_context* rsa_private\uff0c\n                            uint8_t* session_key\uff0c size_t* key_len)\n{\n    int ret;\n    \n    \/\/ \u4f7f\u7528RSA\u79c1\u94a5\u89e3\u5bc6\n    ret = mbedtls_rsa_pkcs1_decrypt((mbedtls_rsa_context*)rsa_private\uff0c\n                                   NULL\uff0c NULL\uff0c MBEDTLS_RSA_PRIVATE\uff0c\n                                   key_len\uff0c encrypted_key\uff0c session_key\uff0c 256);\n    \n    return ret;\n}<\/code><\/pre>\n
3.3 \u8f7b\u91cf\u7ea7\u52a0\u5bc6\u7b97\u6cd5<\/h3>\n
\u5bf9\u4e8e\u8d44\u6e90\u6781\u5ea6\u53d7\u9650\u7684\u8bbe\u5907\uff0c\u4f20\u7edf\u7684 AES \u548c RSA \u53ef\u80fd\u90fd\u592a”\u91cd”\u4e86\u3002<\/p>\n
\u8fd9\u65f6\u5019\u53ef\u4ee5\u8003\u8651\u4e13\u95e8\u4e3a\u7269\u8054\u7f51\u8bbe\u8ba1\u7684\u8f7b\u91cf\u7ea7\u52a0\u5bc6\u7b97\u6cd5\uff0c\u6bd4\u5982 ChaCha20\u3001Poly1305 \u7b49\u3002<\/p>\n
\u6211\u5728\u505a\u4e00\u4e2a\u57fa\u4e8e LoRa \u7684\u519c\u4e1a\u76d1\u6d4b\u9879\u76ee\u65f6\uff0c\u4f20\u611f\u5668\u8282\u70b9\u4f7f\u7528\u7684\u662f 8 \u4f4d\u5355\u7247\u673a\uff0c\u53ea\u6709 2KB \u7684 RAM\u3002<\/p>\n
\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b\uff0c\u6211\u4eec\u9009\u62e9\u4e86 ChaCha20-Poly1305 \u7b97\u6cd5\uff0c\u5b83\u5728\u4fdd\u8bc1\u5b89\u5168\u6027\u7684\u540c\u65f6\uff0c\u5bf9\u786c\u4ef6\u8d44\u6e90\u7684\u8981\u6c42\u5f88\u4f4e\uff0c\u800c\u4e14\u6027\u80fd\u4f18\u79c0\u3002<\/p>\n
4. \u5b89\u5168\u901a\u4fe1\u534f\u8bae<\/h2>\n
4.1 TLS\/DTLS \u534f\u8bae<\/h3>\n
TLS\uff08\u4f20\u8f93\u5c42\u5b89\u5168\u534f\u8bae\uff09\u662f\u4e92\u8054\u7f51\u4e0a\u4f7f\u7528\u6700\u5e7f\u6cdb\u7684\u5b89\u5168\u534f\u8bae\uff0cHTTPS \u5c31\u662f\u57fa\u4e8e TLS \u7684\u3002<\/p>\n
\u5bf9\u4e8e\u7269\u8054\u7f51\u8bbe\u5907\uff0c\u5982\u679c\u4f7f\u7528 TCP \u901a\u4fe1\uff0c\u53ef\u4ee5\u91c7\u7528 TLS\uff1b\u5982\u679c\u4f7f\u7528 UDP \u901a\u4fe1\uff08\u6bd4\u5982 CoAP \u534f\u8bae\uff09\uff0c\u5219\u5e94\u8be5\u4f7f\u7528 DTLS\uff08\u6570\u636e\u62a5\u4f20\u8f93\u5c42\u5b89\u5168\u534f\u8bae\uff09\u3002<\/p>\n
\u5728\u5d4c\u5165\u5f0f Linux \u5e73\u53f0\u4e0a\uff0c\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528 OpenSSL \u6216 mbedTLS \u5e93\u6765\u5b9e\u73b0 TLS \u901a\u4fe1\u3002<\/p>\n
\u4e0b\u9762\u662f\u4e00\u4e2a\u4f7f\u7528 mbedTLS \u5efa\u7acb TLS \u8fde\u63a5\u7684\u7b80\u5316\u793a\u4f8b\uff1a<\/p>\n
#include "mbedtls\/net_sockets.h"\n#include "mbedtls\/ssl.h"\n#include "mbedtls\/entropy.h"\n#include "mbedtls\/ctr_drbg.h"\n#include "mbedtls\/error.h"\n\u200b\ntypedef struct {\n    mbedtls_net_context net_ctx;\n    mbedtls_ssl_context ssl;\n    mbedtls_ssl_config conf;\n    mbedtls_entropy_context entropy;\n    mbedtls_ctr_drbg_context ctr_drbg;\n    mbedtls_x509_crt cacert;\n} tls_client_t;\n\u200b\n\/\/ \u521d\u59cb\u5316TLS\u5ba2\u6237\u7aef\nint tls_client_init(tls_client_t* client\uff0c const char* ca_cert_pem)\n{\n    int ret;\n    const char* pers = "tls_client";\n    \n    \/\/ \u521d\u59cb\u5316\u4e0a\u4e0b\u6587\n    mbedtls_net_init(&client->net_ctx);\n    mbedtls_ssl_init(&client->ssl);\n    mbedtls_ssl_config_init(&client->conf);\n    mbedtls_x509_crt_init(&client->cacert);\n    mbedtls_ctr_drbg_init(&client->ctr_drbg);\n    mbedtls_entropy_init(&client->entropy);\n    \n    \/\/ \u521d\u59cb\u5316\u968f\u673a\u6570\u751f\u6210\u5668\n    ret = mbedtls_ctr_drbg_seed(&client->ctr_drbg\uff0c mbedtls_entropy_func\uff0c\n                               &client->entropy\uff0c (const uint8_t*)pers\uff0c\n                               strlen(pers));\n    if (ret != 0) {\n        return ret;\n    }\n    \n    \/\/ \u52a0\u8f7dCA\u8bc1\u4e66\n    ret = mbedtls_x509_crt_parse(&client->cacert\uff0c\n                                (const uint8_t*)ca_cert_pem\uff0c\n                                strlen(ca_cert_pem) + 1);\n    if (ret != 0) {\n        return ret;\n    }\n    \n    \/\/ \u914d\u7f6eSSL\/TLS\n    ret = mbedtls_ssl_config_defaults(&client->conf\uff0c\n                                     MBEDTLS_SSL_IS_CLIENT\uff0c\n                                     MBEDTLS_SSL_TRANSPORT_STREAM\uff0c\n                                     MBEDTLS_SSL_PRESET_DEFAULT);\n    if (ret != 0) {\n        return ret;\n    }\n    \n    mbedtls_ssl_conf_authmode(&client->conf\uff0c MBEDTLS_SSL_VERIFY_REQUIRED);\n    mbedtls_ssl_conf_ca_chain(&client->conf\uff0c &client->cacert\uff0c NULL);\n    mbedtls_ssl_conf_rng(&client->conf\uff0c mbedtls_ctr_drbg_random\uff0c\n                        &client->ctr_drbg);\n    \n    ret = mbedtls_ssl_setup(&client->ssl\uff0c &client->conf);\n    if (ret != 0) {\n        return ret;\n    }\n    \n    return 0;\n}\n\u200b\n\/\/ \u8fde\u63a5\u5230\u670d\u52a1\u5668\nint tls_client_connect(tls_client_t* client\uff0c const char* host\uff0c const char* port)\n{\n    int ret;\n    \n    \/\/ \u5efa\u7acbTCP\u8fde\u63a5\n    ret = mbedtls_net_connect(&client->net_ctx\uff0c host\uff0c port\uff0c\n                             MBEDTLS_NET_PROTO_TCP);\n    if (ret != 0) {\n        return ret;\n    }\n    \n    \/\/ \u8bbe\u7f6e\u4e3b\u673a\u540d\uff08\u7528\u4e8eSNI\uff09\n    ret = mbedtls_ssl_set_hostname(&client->ssl\uff0c host);\n    if (ret != 0) {\n        return ret;\n    }\n    \n    \/\/ \u8bbe\u7f6eBIO\u56de\u8c03\n    mbedtls_ssl_set_bio(&client->ssl\uff0c &client->net_ctx\uff0c\n                       mbedtls_net_send\uff0c mbedtls_net_recv\uff0c NULL);\n    \n    \/\/ \u6267\u884cTLS\u63e1\u624b\n    while ((ret = mbedtls_ssl_handshake(&client->ssl)) != 0) {\n        if (ret != MBEDTLS_ERR_SSL_WANT_READ &&\n            ret != MBEDTLS_ERR_SSL_WANT_WRITE) {\n            return ret;\n        }\n    }\n    \n    \/\/ \u9a8c\u8bc1\u670d\u52a1\u5668\u8bc1\u4e66\n    uint32_t flags = mbedtls_ssl_get_verify_result(&client->ssl);\n    if (flags != 0) {\n        return -1;\n    }\n    \n    return 0;\n}\n\u200b\n\/\/ \u53d1\u9001\u6570\u636e\nint tls_client_send(tls_client_t* client\uff0c const uint8_t* data\uff0c size_t len)\n{\n    int ret;\n    size_t written = 0;\n    \n    while (written < len) {\n        ret = mbedtls_ssl_write(&client->ssl\uff0c data + written\uff0c len - written);\n        if (ret < 0) {\n            if (ret != MBEDTLS_ERR_SSL_WANT_READ &&\n                ret != MBEDTLS_ERR_SSL_WANT_WRITE) {\n                return ret;\n            }\n        } else {\n            written += ret;\n        }\n    }\n    \n    return written;\n}\n\u200b\n\/\/ \u63a5\u6536\u6570\u636e\nint tls_client_recv(tls_client_t* client\uff0c uint8_t* buffer\uff0c size_t max_len)\n{\n    int ret;\n    \n    do {\n        ret = mbedtls_ssl_read(&client->ssl\uff0c buffer\uff0c max_len);\n    } while (ret == MBEDTLS_ERR_SSL_WANT_READ ||\n             ret == MBEDTLS_ERR_SSL_WANT_WRITE);\n    \n    return ret;\n}\n\u200b\n\/\/ \u5173\u95ed\u8fde\u63a5\nvoid tls_client_close(tls_client_t* client)\n{\n    mbedtls_ssl_close_notify(&client->ssl);\n    mbedtls_net_free(&client->net_ctx);\n    mbedtls_x509_crt_free(&client->cacert);\n    mbedtls_ssl_free(&client->ssl);\n    mbedtls_ssl_config_free(&client->conf);\n    mbedtls_ctr_drbg_free(&client->ctr_drbg);\n    mbedtls_entropy_free(&client->entropy);\n}<\/code><\/pre>\n
\u8fd9\u4e2a\u4f8b\u5b50\u5c55\u793a\u4e86\u5982\u4f55\u4f7f\u7528 mbedTLS \u5e93\u5efa\u7acb\u4e00\u4e2a\u5b89\u5168\u7684 TLS \u8fde\u63a5\u3002<\/p>\n
\u5728\u5b9e\u9645\u5e94\u7528\u4e2d\uff0c\u8bbe\u5907\u4f1a\u9a8c\u8bc1\u670d\u52a1\u5668\u7684\u8bc1\u4e66\uff0c\u786e\u4fdd\u8fde\u63a5\u5230\u7684\u662f\u5408\u6cd5\u7684\u670d\u52a1\u5668\uff0c\u800c\u4e0d\u662f\u4e2d\u95f4\u4eba\u653b\u51fb\u8005\u3002<\/p>\n
4.2 MQTT \u5b89\u5168<\/h3>\n
MQTT \u662f\u7269\u8054\u7f51\u9886\u57df\u6700\u6d41\u884c\u7684\u6d88\u606f\u4f20\u8f93\u534f\u8bae\u4e4b\u4e00\u3002<\/p>\n
\u4e3a\u4e86\u4fdd\u8bc1 MQTT \u901a\u4fe1\u7684\u5b89\u5168\uff0c\u6211\u4eec\u9700\u8981\u505a\u4ee5\u4e0b\u51e0\u70b9\uff1a<\/p>\n
4.2.1 \u4f7f\u7528 TLS \u52a0\u5bc6<\/h4>\n
MQTT over TLS\uff08\u4e5f\u53eb MQTTS\uff09\u5728\u6807\u51c6 MQTT \u534f\u8bae\u7684\u57fa\u7840\u4e0a\u589e\u52a0\u4e86 TLS \u52a0\u5bc6\u5c42\uff0c\u7aef\u53e3\u901a\u5e38\u662f 8883\u3002<\/p>\n
\u8fd9\u6837\u53ef\u4ee5\u9632\u6b62\u6d88\u606f\u88ab\u7a83\u542c\u548c\u7be1\u6539\u3002<\/p>\n
4.2.2 \u7528\u6237\u540d\u5bc6\u7801\u8ba4\u8bc1<\/h4>\n
MQTT \u534f\u8bae\u652f\u6301\u7528\u6237\u540d\u548c\u5bc6\u7801\u8ba4\u8bc1\u3002<\/p>\n
\u5728\u8fde\u63a5\u5230 MQTT Broker \u65f6\uff0c\u5ba2\u6237\u7aef\u9700\u8981\u63d0\u4f9b\u6b63\u786e\u7684\u7528\u6237\u540d\u548c\u5bc6\u7801\u3002<\/p>\n
\u4f46\u8981\u6ce8\u610f\uff0c\u5982\u679c\u4e0d\u4f7f\u7528 TLS\uff0c\u7528\u6237\u540d\u5bc6\u7801\u4f1a\u4ee5\u660e\u6587\u4f20\u8f93\uff0c\u975e\u5e38\u4e0d\u5b89\u5168\u3002<\/p>\n
4.2.3 \u5ba2\u6237\u7aef\u8bc1\u4e66\u8ba4\u8bc1<\/h4>\n
\u66f4\u5b89\u5168\u7684\u505a\u6cd5\u662f\u4f7f\u7528\u5ba2\u6237\u7aef\u8bc1\u4e66\u8ba4\u8bc1\u3002<\/p>\n
\u6bcf\u4e2a MQTT \u5ba2\u6237\u7aef\u90fd\u6709\u81ea\u5df1\u7684\u8bc1\u4e66\u548c\u79c1\u94a5\uff0cBroker \u4f1a\u9a8c\u8bc1\u5ba2\u6237\u7aef\u8bc1\u4e66\u7684\u6709\u6548\u6027\u3002<\/p>\n
\u8fd9\u79cd\u65b9\u5f0f\u6bd4\u7528\u6237\u540d\u5bc6\u7801\u66f4\u5b89\u5168\uff0c\u56e0\u4e3a\u79c1\u94a5\u4e0d\u4f1a\u5728\u7f51\u7edc\u4e0a\u4f20\u8f93\u3002<\/p>\n
\u6211\u5728\u4e00\u4e2a\u5de5\u4e1a\u7269\u8054\u7f51\u9879\u76ee\u4e2d\u5c31\u91c7\u7528\u4e86\u8fd9\u79cd\u65b9\u6848\u3002<\/p>\n
\u6bcf\u4e2a\u4f20\u611f\u5668\u8bbe\u5907\u90fd\u6709\u72ec\u7acb\u7684\u8bc1\u4e66\uff0c\u5373\u4f7f\u67d0\u4e2a\u8bbe\u5907\u7684\u8bc1\u4e66\u6cc4\u9732\uff0c\u4e5f\u53ea\u5f71\u54cd\u8fd9\u4e00\u4e2a\u8bbe\u5907\uff0c\u4e0d\u4f1a\u6ce2\u53ca\u6574\u4e2a\u7cfb\u7edf\u3002<\/p>\n
\u800c\u4e14\u6211\u4eec\u53ef\u4ee5\u968f\u65f6\u540a\u9500\u67d0\u4e2a\u8bbe\u5907\u7684\u8bc1\u4e66\uff0c\u963b\u6b62\u5b83\u7ee7\u7eed\u8bbf\u95ee\u7cfb\u7edf\u3002<\/p>\n
5. \u5b89\u5168\u542f\u52a8\u548c\u56fa\u4ef6\u66f4\u65b0<\/h2>\n
5.1 \u5b89\u5168\u542f\u52a8\uff08Secure Boot\uff09<\/h3>\n
\u5b89\u5168\u542f\u52a8\u786e\u4fdd\u8bbe\u5907\u53ea\u8fd0\u884c\u7ecf\u8fc7\u6388\u6743\u7684\u56fa\u4ef6\u3002<\/p>\n
\u5728\u8bbe\u5907\u542f\u52a8\u65f6\uff0cBootloader \u4f1a\u9a8c\u8bc1\u56fa\u4ef6\u7684\u6570\u5b57\u7b7e\u540d\uff0c\u53ea\u6709\u7b7e\u540d\u6709\u6548\u7684\u56fa\u4ef6\u624d\u4f1a\u88ab\u52a0\u8f7d\u548c\u6267\u884c\u3002<\/p>\n
STM32 \u7b49\u73b0\u4ee3\u5fae\u63a7\u5236\u5668\u901a\u5e38\u90fd\u652f\u6301\u5b89\u5168\u542f\u52a8\u529f\u80fd\u3002<\/p>\n
\u4ee5 STM32H7 \u4e3a\u4f8b\uff0c\u5b83\u63d0\u4f9b\u4e86\u57fa\u4e8e\u786c\u4ef6\u7684\u5b89\u5168\u542f\u52a8\u673a\u5236\uff0c\u53ef\u4ee5\u5728\u82af\u7247\u5185\u90e8\u9a8c\u8bc1\u56fa\u4ef6\u7b7e\u540d\uff0c\u9632\u6b62\u56fa\u4ef6\u88ab\u7be1\u6539\u3002<\/p>\n
5.2 \u5b89\u5168\u7684\u56fa\u4ef6\u66f4\u65b0\uff08OTA\uff09<\/h3>\n
\u7269\u8054\u7f51\u8bbe\u5907\u901a\u5e38\u9700\u8981\u652f\u6301\u8fdc\u7a0b\u56fa\u4ef6\u66f4\u65b0\uff08OTA\uff0cOver-The-Air\uff09\u3002<\/p>\n
\u4f46 OTA \u8fc7\u7a0b\u5982\u679c\u4e0d\u5b89\u5168\uff0c\u53ef\u80fd\u6210\u4e3a\u653b\u51fb\u8005\u7684\u5165\u53e3\u3002\u4e00\u4e2a\u5b89\u5168\u7684 OTA \u6d41\u7a0b\u5e94\u8be5\u5305\u62ec\uff1a<\/p>\n
5.2.1 \u56fa\u4ef6\u7b7e\u540d\u9a8c\u8bc1<\/h4>\n
\u65b0\u56fa\u4ef6\u5fc5\u987b\u7ecf\u8fc7\u6570\u5b57\u7b7e\u540d\uff0c\u8bbe\u5907\u5728\u66f4\u65b0\u524d\u8981\u9a8c\u8bc1\u7b7e\u540d\u7684\u6709\u6548\u6027\u3002<\/p>\n
\u8fd9\u6837\u53ef\u4ee5\u786e\u4fdd\u56fa\u4ef6\u6765\u81ea\u53ef\u4fe1\u7684\u6e90\uff0c\u6ca1\u6709\u88ab\u7be1\u6539\u3002<\/p>\n
5.2.2 \u52a0\u5bc6\u4f20\u8f93<\/h4>\n
\u56fa\u4ef6\u5728\u4f20\u8f93\u8fc7\u7a0b\u4e2d\u5e94\u8be5\u52a0\u5bc6\uff0c\u9632\u6b62\u88ab\u622a\u83b7\u548c\u5206\u6790\u3002<\/p>\n
\u5373\u4f7f\u653b\u51fb\u8005\u622a\u83b7\u4e86\u56fa\u4ef6\uff0c\u4e5f\u65e0\u6cd5\u89e3\u5bc6\u5176\u5185\u5bb9\u3002<\/p>\n
5.2.3 \u7248\u672c\u56de\u6eda\u4fdd\u62a4<\/h4>\n
\u8bbe\u5907\u5e94\u8be5\u8bb0\u5f55\u5f53\u524d\u56fa\u4ef6\u7684\u7248\u672c\u53f7\uff0c\u62d2\u7edd\u5b89\u88c5\u65e7\u7248\u672c\u7684\u56fa\u4ef6\u3002<\/p>\n
\u8fd9\u6837\u53ef\u4ee5\u9632\u6b62\u653b\u51fb\u8005\u5229\u7528\u65e7\u7248\u672c\u56fa\u4ef6\u4e2d\u7684\u5df2\u77e5\u6f0f\u6d1e\u3002<\/p>\n
5.2.4 \u5907\u4efd\u548c\u6062\u590d\u673a\u5236<\/h4>\n
\u5728\u66f4\u65b0\u8fc7\u7a0b\u4e2d\u5982\u679c\u51fa\u73b0\u95ee\u9898\uff08\u6bd4\u5982\u65ad\u7535\uff09\uff0c\u8bbe\u5907\u5e94\u8be5\u80fd\u591f\u6062\u590d\u5230\u4e4b\u524d\u7684\u53ef\u7528\u56fa\u4ef6\uff0c\u800c\u4e0d\u662f\u53d8\u6210”\u7816\u5934”\u3002<\/p>\n
\u901a\u5e38\u7684\u505a\u6cd5\u662f\u4f7f\u7528\u53cc Bank \u5b58\u50a8\uff0c\u4fdd\u7559\u65e7\u56fa\u4ef6\u76f4\u5230\u65b0\u56fa\u4ef6\u9a8c\u8bc1\u6210\u529f\u3002<\/p>\n
\u4e0b\u9762\u662f\u4e00\u4e2a\u7b80\u5316\u7684 OTA \u66f4\u65b0\u6d41\u7a0b\u793a\u4f8b\uff1a<\/p>\n
#include "stm32f4xx_hal.h"\n#include "mbedtls\/sha256.h"\n#include "mbedtls\/rsa.h"\n\u200b\n#define FIRMWARE_BANK1_ADDR  0x08010000\n#define FIRMWARE_BANK2_ADDR  0x08080000\n#define FIRMWARE_MAX_SIZE    (448 * 1024)  \/\/ 448KB\n\u200b\ntypedef struct {\n    uint32_t version;\n    uint32_t size;\n    uint8_t sha256[32];\n    uint8_t signature[256];  \/\/ RSA-2048\u7b7e\u540d\n} firmware_header_t;\n\u200b\n\/\/ \u9a8c\u8bc1\u56fa\u4ef6\u7b7e\u540d\nint verify_firmware_signature(const firmware_header_t* header\uff0c\n                              const uint8_t* firmware_data\uff0c\n                              const mbedtls_rsa_context* public_key)\n{\n    uint8_t hash[32];\n    int ret;\n    \n    \/\/ \u8ba1\u7b97\u56fa\u4ef6\u7684SHA256\u54c8\u5e0c\n    mbedtls_sha256_context sha256_ctx;\n    mbedtls_sha256_init(&sha256_ctx);\n    mbedtls_sha256_starts(&sha256_ctx\uff0c 0);\n    mbedtls_sha256_update(&sha256_ctx\uff0c firmware_data\uff0c header->size);\n    mbedtls_sha256_finish(&sha256_ctx\uff0c hash);\n    mbedtls_sha256_free(&sha256_ctx);\n    \n    \/\/ \u9a8c\u8bc1\u54c8\u5e0c\u503c\n    if (memcmp(hash\uff0c header->sha256\uff0c 32) != 0) {\n        return -1;  \/\/ \u54c8\u5e0c\u4e0d\u5339\u914d\n    }\n    \n    \/\/ \u9a8c\u8bc1RSA\u7b7e\u540d\n    ret = mbedtls_rsa_pkcs1_verify((mbedtls_rsa_context*)public_key\uff0c\n                                  NULL\uff0c NULL\uff0c MBEDTLS_RSA_PUBLIC\uff0c\n                                  MBEDTLS_MD_SHA256\uff0c 32\uff0c hash\uff0c\n                                  header->signature);\n    \n    return ret;\n}\n\u200b\n\/\/ OTA\u66f4\u65b0\u6d41\u7a0b\nint perform_ota_update(const uint8_t* new_firmware\uff0c size_t firmware_size\uff0c\n                      const mbedtls_rsa_context* public_key)\n{\n    firmware_header_t* header = (firmware_header_t*)new_firmware;\n    const uint8_t* firmware_data = new_firmware + sizeof(firmware_header_t);\n    uint32_t current_version;\n    HAL_StatusTypeDef status;\n    \n    \/\/ \u8bfb\u53d6\u5f53\u524d\u56fa\u4ef6\u7248\u672c\n    current_version = *(uint32_t*)FIRMWARE_BANK1_ADDR;\n    \n    \/\/ \u68c0\u67e5\u7248\u672c\u53f7\uff08\u9632\u6b62\u56de\u6eda\u653b\u51fb\uff09\n    if (header->version <= current_version) {\n        return -1;  \/\/ \u7248\u672c\u53f7\u4e0d\u80fd\u964d\u7ea7\n    }\n    \n    \/\/ \u9a8c\u8bc1\u56fa\u4ef6\u7b7e\u540d\n    if (verify_firmware_signature(header\uff0c firmware_data\uff0c public_key) != 0) {\n        return -2;  \/\/ \u7b7e\u540d\u9a8c\u8bc1\u5931\u8d25\n    }\n    \n    \/\/ \u89e3\u9501Flash\n    HAL_FLASH_Unlock();\n    \n    \/\/ \u64e6\u9664Bank2\n    FLASH_EraseInitTypeDef erase_init;\n    uint32_t page_error;\n    erase_init.TypeErase = FLASH_TYPEERASE_SECTORS;\n    erase_init.Sector = FLASH_SECTOR_8;  \/\/ Bank2\u8d77\u59cb\u6247\u533a\n    erase_init.NbSectors = 7;  \/\/ \u64e6\u96647\u4e2a\u6247\u533a\n    erase_init.VoltageRange = FLASH_VOLTAGE_RANGE_3;\n    \n    status = HAL_FLASHEx_Erase(&erase_init\uff0c &page_error);\n    if (status != HAL_OK) {\n        HAL_FLASH_Lock();\n        return -3;\n    }\n    \n    \/\/ \u5199\u5165\u65b0\u56fa\u4ef6\u5230Bank2\n    uint32_t dest_addr = FIRMWARE_BANK2_ADDR;\n    for (size_t i = 0; i < header->size; i += 4) {\n        uint32_t data = *(uint32_t*)(firmware_data + i);\n        status = HAL_FLASH_Program(FLASH_TYPEPROGRAM_WORD\uff0c dest_addr\uff0c data);\n        if (status != HAL_OK) {\n            HAL_FLASH_Lock();\n            return -4;\n        }\n        dest_addr += 4;\n    }\n    \n    \/\/ \u9a8c\u8bc1\u5199\u5165\u7684\u6570\u636e\n    if (memcmp((void*)FIRMWARE_BANK2_ADDR\uff0c firmware_data\uff0c header->size) != 0) {\n        HAL_FLASH_Lock();\n        return -5;  \/\/ \u6570\u636e\u9a8c\u8bc1\u5931\u8d25\n    }\n    \n    \/\/ \u9501\u5b9aFlash\n    HAL_FLASH_Lock();\n    \n    \/\/ \u5207\u6362\u542f\u52a8Bank\uff08\u9700\u8981\u91cd\u542f\u540e\u751f\u6548\uff09\n    \/\/ \u8fd9\u91cc\u7684\u5b9e\u73b0\u53d6\u51b3\u4e8e\u5177\u4f53\u7684MCU\u578b\u53f7\n    \n    return 0;  \/\/ \u66f4\u65b0\u6210\u529f\n}<\/code><\/pre>\n
\u8fd9\u4e2a\u4f8b\u5b50\u5c55\u793a\u4e86\u4e00\u4e2a\u5b8c\u6574\u7684 OTA \u66f4\u65b0\u6d41\u7a0b\uff0c\u5305\u62ec\u7248\u672c\u68c0\u67e5\u3001\u7b7e\u540d\u9a8c\u8bc1\u3001Flash \u64cd\u4f5c\u7b49\u3002<\/p>\n
\u5728\u5b9e\u9645\u5e94\u7528\u4e2d\uff0c\u8fd8\u9700\u8981\u8003\u8651\u66f4\u591a\u7684\u7ec6\u8282\uff0c\u6bd4\u5982\u65ad\u7535\u4fdd\u62a4\u3001\u8fdb\u5ea6\u62a5\u544a\u3001\u9519\u8bef\u6062\u590d\u7b49\u3002<\/p>\n
6. \u5b89\u5168\u5b58\u50a8<\/h2>\n
6.1 \u5bc6\u94a5\u5b58\u50a8<\/h3>\n
\u5bc6\u94a5\u662f\u6574\u4e2a\u5b89\u5168\u7cfb\u7edf\u7684\u57fa\u7840\uff0c\u5bc6\u94a5\u4e00\u65e6\u6cc4\u9732\uff0c\u6240\u6709\u7684\u5b89\u5168\u63aa\u65bd\u90fd\u4f1a\u5931\u6548\u3002<\/p>\n
\u56e0\u6b64\uff0c\u5bc6\u94a5\u7684\u5b89\u5168\u5b58\u50a8\u81f3\u5173\u91cd\u8981\u3002<\/p>\n
6.1.1 \u786c\u4ef6\u5b89\u5168\u6a21\u5757<\/h4>\n
\u6700\u5b89\u5168\u7684\u505a\u6cd5\u662f\u4f7f\u7528\u4e13\u95e8\u7684\u786c\u4ef6\u5b89\u5168\u6a21\u5757\uff08HSM\uff09\u6216\u5b89\u5168\u5143\u4ef6\uff08SE\uff09\u6765\u5b58\u50a8\u5bc6\u94a5\u3002<\/p>\n
\u8fd9\u4e9b\u786c\u4ef6\u6a21\u5757\u5177\u6709\u7269\u7406\u9632\u62a4\u63aa\u65bd\uff0c\u5bc6\u94a5\u6c38\u8fdc\u4e0d\u4f1a\u79bb\u5f00\u6a21\u5757\uff0c\u6240\u6709\u7684\u52a0\u5bc6\u8fd0\u7b97\u90fd\u5728\u6a21\u5757\u5185\u90e8\u5b8c\u6210\u3002<\/p>\n
\u6bd4\u5982\uff0cSTM32L5 \u7cfb\u5217\u5fae\u63a7\u5236\u5668\u96c6\u6210\u4e86 TrustZone \u6280\u672f\uff0c\u53ef\u4ee5\u521b\u5efa\u4e00\u4e2a\u5b89\u5168\u7684\u6267\u884c\u73af\u5883\uff0c\u5bc6\u94a5\u5b58\u50a8\u5728\u5b89\u5168\u533a\u57df\uff0c\u666e\u901a\u5e94\u7528\u65e0\u6cd5\u8bbf\u95ee\u3002<\/p>\n
\u6211\u5728\u4e00\u4e2a\u652f\u4ed8\u7ec8\u7aef\u9879\u76ee\u4e2d\u5c31\u4f7f\u7528\u4e86\u8fd9\u79cd\u6280\u672f\uff0c\u786e\u4fdd\u652f\u4ed8\u5bc6\u94a5\u7684\u7edd\u5bf9\u5b89\u5168\u3002<\/p>\n
6.1.2 \u5bc6\u94a5\u6d3e\u751f<\/h4>\n
\u5982\u679c\u6ca1\u6709\u786c\u4ef6\u5b89\u5168\u6a21\u5757\uff0c\u53ef\u4ee5\u4f7f\u7528\u5bc6\u94a5\u6d3e\u751f\u51fd\u6570\uff08KDF\uff09\u4ece\u4e00\u4e2a\u4e3b\u5bc6\u94a5\u6d3e\u751f\u51fa\u591a\u4e2a\u5b50\u5bc6\u94a5\u3002<\/p>\n
\u4e3b\u5bc6\u94a5\u53ef\u4ee5\u5b58\u50a8\u5728\u82af\u7247\u7684 OTP\uff08\u4e00\u6b21\u6027\u53ef\u7f16\u7a0b\uff09\u533a\u57df\u6216\u52a0\u5bc6\u7684 Flash \u4e2d\uff0c\u5b50\u5bc6\u94a5\u5728\u9700\u8981\u65f6\u52a8\u6001\u751f\u6210\uff0c\u7528\u5b8c\u5c31\u9500\u6bc1\uff0c\u4e0d\u5728\u5185\u5b58\u4e2d\u957f\u671f\u4fdd\u5b58\u3002<\/p>\n
6.2 \u654f\u611f\u6570\u636e\u4fdd\u62a4<\/h3>\n
\u9664\u4e86\u5bc6\u94a5\uff0c\u8bbe\u5907\u53ef\u80fd\u8fd8\u9700\u8981\u5b58\u50a8\u5176\u4ed6\u654f\u611f\u6570\u636e\uff0c\u6bd4\u5982\u7528\u6237\u5bc6\u7801\u3001\u914d\u7f6e\u53c2\u6570\u7b49\u3002<\/p>\n
\u8fd9\u4e9b\u6570\u636e\u4e5f\u5e94\u8be5\u52a0\u5bc6\u5b58\u50a8\uff0c\u9632\u6b62\u88ab\u8bfb\u53d6\u3002<\/p>\n
\u6211\u5728\u505a\u4e00\u4e2a\u667a\u80fd\u95e8\u9501\u9879\u76ee\u65f6\uff0c\u7528\u6237\u7684\u6307\u7eb9\u6a21\u677f\u5c31\u662f\u52a0\u5bc6\u5b58\u50a8\u5728 Flash \u4e2d\u7684\u3002<\/p>\n
\u5373\u4f7f\u6709\u4eba\u62c6\u5f00\u95e8\u9501\u8bfb\u53d6 Flash \u5185\u5bb9\uff0c\u4e5f\u65e0\u6cd5\u83b7\u5f97\u539f\u59cb\u7684\u6307\u7eb9\u6570\u636e\u3002<\/p>\n
7. \u5b89\u5168\u5f00\u53d1\u5b9e\u8df5<\/h2>\n
7.1 \u6700\u5c0f\u6743\u9650\u539f\u5219<\/h3>\n
\u8bbe\u5907\u548c\u5e94\u7528\u5e94\u8be5\u53ea\u62e5\u6709\u5b8c\u6210\u4efb\u52a1\u6240\u5fc5\u9700\u7684\u6700\u5c0f\u6743\u9650\u3002<\/p>\n
\u6bd4\u5982\uff0c\u4e00\u4e2a\u6e29\u5ea6\u4f20\u611f\u5668\u53ea\u9700\u8981\u4e0a\u62a5\u6e29\u5ea6\u6570\u636e\u7684\u6743\u9650\uff0c\u4e0d\u5e94\u8be5\u6709\u63a7\u5236\u5176\u4ed6\u8bbe\u5907\u6216\u4fee\u6539\u7cfb\u7edf\u914d\u7f6e\u7684\u6743\u9650\u3002<\/p>\n
\u5728\u8bbe\u8ba1\u7269\u8054\u7f51\u7cfb\u7edf\u65f6\uff0c\u6211\u4f1a\u4e3a\u4e0d\u540c\u7c7b\u578b\u7684\u8bbe\u5907\u5206\u914d\u4e0d\u540c\u7684\u89d2\u8272\u548c\u6743\u9650\u3002<\/p>\n
\u4f20\u611f\u5668\u53ea\u80fd\u53d1\u5e03\u6570\u636e\uff0c\u4e0d\u80fd\u8ba2\u9605\u63a7\u5236\u6307\u4ee4\uff1b\u63a7\u5236\u5668\u53ef\u4ee5\u53d1\u5e03\u63a7\u5236\u6307\u4ee4\uff0c\u4f46\u4e0d\u80fd\u4fee\u6539\u8bbe\u5907\u914d\u7f6e\uff1b\u7ba1\u7406\u5458\u8d26\u6237\u624d\u6709\u5b8c\u5168\u7684\u6743\u9650\u3002<\/p>\n
\u8fd9\u79cd\u5206\u5c42\u7684\u6743\u9650\u7ba1\u7406\u5927\u5927\u964d\u4f4e\u4e86\u5b89\u5168\u98ce\u9669\u3002<\/p>\n
7.2 \u8f93\u5165\u9a8c\u8bc1<\/h3>\n
\u6c38\u8fdc\u4e0d\u8981\u4fe1\u4efb\u5916\u90e8\u8f93\u5165\u3002<\/p>\n
\u6240\u6709\u4ece\u7f51\u7edc\u3001\u7528\u6237\u754c\u9762\u3001\u4f20\u611f\u5668\u7b49\u5916\u90e8\u6765\u6e90\u7684\u6570\u636e\uff0c\u90fd\u5e94\u8be5\u7ecf\u8fc7\u4e25\u683c\u7684\u9a8c\u8bc1\u548c\u8fc7\u6ee4\uff0c\u9632\u6b62\u6ce8\u5165\u653b\u51fb\u3001\u7f13\u51b2\u533a\u6ea2\u51fa\u7b49\u5b89\u5168\u95ee\u9898\u3002<\/p>\n
\u6211\u5728\u4ee3\u7801\u4e2d\u4f1a\u5bf9\u6240\u6709\u7684\u8f93\u5165\u6570\u636e\u8fdb\u884c\u8fb9\u754c\u68c0\u67e5\u3001\u7c7b\u578b\u68c0\u67e5\u3001\u683c\u5f0f\u68c0\u67e5\u7b49\u3002<\/p>\n
\u6bd4\u5982\uff0c\u5982\u679c\u671f\u671b\u63a5\u6536\u4e00\u4e2a 0-100 \u7684\u6e29\u5ea6\u503c\uff0c\u90a3\u4e48\u8d85\u51fa\u8fd9\u4e2a\u8303\u56f4\u7684\u6570\u636e\u5c31\u5e94\u8be5\u88ab\u62d2\u7edd\u3002<\/p>\n
\u770b\u4f3c\u7b80\u5355\u7684\u68c0\u67e5\uff0c\u5374\u80fd\u907f\u514d\u5f88\u591a\u6f5c\u5728\u7684\u5b89\u5168\u95ee\u9898\u3002<\/p>\n
7.3 \u5b89\u5168\u65e5\u5fd7<\/h3>\n
\u8bb0\u5f55\u8be6\u7ec6\u7684\u5b89\u5168\u65e5\u5fd7\u5bf9\u4e8e\u53d1\u73b0\u548c\u8ffd\u8e2a\u5b89\u5168\u4e8b\u4ef6\u975e\u5e38\u91cd\u8981\u3002<\/p>\n
\u65e5\u5fd7\u5e94\u8be5\u5305\u62ec\u8ba4\u8bc1\u5931\u8d25\u3001\u5f02\u5e38\u8bbf\u95ee\u3001\u914d\u7f6e\u53d8\u66f4\u7b49\u5173\u952e\u4e8b\u4ef6\u3002<\/p>\n
\u4f46\u8981\u6ce8\u610f\uff0c\u65e5\u5fd7\u4e2d\u4e0d\u5e94\u8be5\u5305\u542b\u654f\u611f\u4fe1\u606f\uff0c\u6bd4\u5982\u5bc6\u7801\u3001\u5bc6\u94a5\u7b49\u3002<\/p>\n
\u5728\u6211\u8d1f\u8d23\u7684\u9879\u76ee\u4e2d\uff0c\u6240\u6709\u7684\u5b89\u5168\u4e8b\u4ef6\u90fd\u4f1a\u88ab\u8bb0\u5f55\u5e76\u4e0a\u4f20\u5230\u4e91\u7aef\u3002<\/p>\n
\u4e00\u65e6\u68c0\u6d4b\u5230\u5f02\u5e38\u6a21\u5f0f\uff08\u6bd4\u5982\u77ed\u65f6\u95f4\u5185\u5927\u91cf\u7684\u8ba4\u8bc1\u5931\u8d25\uff09\uff0c\u7cfb\u7edf\u4f1a\u81ea\u52a8\u544a\u8b66\uff0c\u7ba1\u7406\u5458\u53ef\u4ee5\u53ca\u65f6\u91c7\u53d6\u63aa\u65bd\u3002<\/p>\n
7.4 \u5b9a\u671f\u5b89\u5168\u5ba1\u8ba1<\/h3>\n
\u5b89\u5168\u4e0d\u662f\u4e00\u6b21\u6027\u7684\u5de5\u4f5c\uff0c\u800c\u662f\u4e00\u4e2a\u6301\u7eed\u7684\u8fc7\u7a0b\u3002<\/p>\n
\u5e94\u8be5\u5b9a\u671f\u5bf9\u7cfb\u7edf\u8fdb\u884c\u5b89\u5168\u5ba1\u8ba1\uff0c\u68c0\u67e5\u662f\u5426\u6709\u65b0\u7684\u6f0f\u6d1e\uff0c\u662f\u5426\u6709\u914d\u7f6e\u4e0d\u5f53\u7684\u5730\u65b9\u3002<\/p>\n
\u540c\u65f6\uff0c\u8981\u53ca\u65f6\u5173\u6ce8\u5b89\u5168\u516c\u544a\uff0c\u4e00\u65e6\u53d1\u73b0\u4f7f\u7528\u7684\u5e93\u6216\u7ec4\u4ef6\u6709\u5b89\u5168\u6f0f\u6d1e\uff0c\u8981\u5c3d\u5feb\u66f4\u65b0\u3002<\/p>\n
\u6211\u7684\u56e2\u961f\u6bcf\u4e2a\u5b63\u5ea6\u90fd\u4f1a\u8fdb\u884c\u4e00\u6b21\u5b89\u5168\u5ba1\u8ba1\uff0c\u5305\u62ec\u4ee3\u7801\u5ba1\u67e5\u3001\u6e17\u900f\u6d4b\u8bd5\u3001\u6f0f\u6d1e\u626b\u63cf\u7b49\u3002<\/p>\n
\u867d\u7136\u8fd9\u4f1a\u5360\u7528\u4e00\u4e9b\u5f00\u53d1\u65f6\u95f4\uff0c\u4f46\u80fd\u591f\u53ca\u65e9\u53d1\u73b0\u548c\u4fee\u590d\u5b89\u5168\u95ee\u9898\uff0c\u907f\u514d\u66f4\u5927\u7684\u635f\u5931\u3002<\/p>\n
8. \u603b\u7ed3<\/h2>\n
\u7269\u8054\u7f51\u5b89\u5168\u662f\u4e00\u4e2a\u590d\u6742\u800c\u91cd\u8981\u7684\u8bdd\u9898\uff0c\u6d89\u53ca\u5230\u786c\u4ef6\u3001\u8f6f\u4ef6\u3001\u7f51\u7edc\u3001\u5bc6\u7801\u5b66\u7b49\u591a\u4e2a\u9886\u57df\u3002<\/p>\n
\u4f5c\u4e3a\u5d4c\u5165\u5f0f\u5f00\u53d1\u8005\uff0c\u6211\u4eec\u9700\u8981\u4ece\u8bbe\u8ba1\u4e4b\u521d\u5c31\u5c06\u5b89\u5168\u7eb3\u5165\u8003\u8651\uff0c\u800c\u4e0d\u662f\u4e8b\u540e\u8865\u6551\u3002<\/p>\n
\u5728\u6211\u591a\u5e74\u7684\u7269\u8054\u7f51\u5f00\u53d1\u7ecf\u9a8c\u4e2d\uff0c\u6df1\u523b\u4f53\u4f1a\u5230\u5b89\u5168\u548c\u4fbf\u5229\u6027\u5f80\u5f80\u662f\u77db\u76fe\u7684\u3002<\/p>\n
\u8fc7\u4e8e\u4e25\u683c\u7684\u5b89\u5168\u63aa\u65bd\u4f1a\u5f71\u54cd\u7528\u6237\u4f53\u9a8c\uff0c\u4f46\u8fc7\u4e8e\u5bbd\u677e\u53c8\u4f1a\u5e26\u6765\u5b89\u5168\u98ce\u9669\u3002<\/p>\n
\u5173\u952e\u662f\u8981\u6839\u636e\u5b9e\u9645\u5e94\u7528\u573a\u666f\uff0c\u5728\u5b89\u5168\u6027\u548c\u53ef\u7528\u6027\u4e4b\u95f4\u627e\u5230\u5e73\u8861\u70b9\u3002<\/p>\n
\u5bf9\u4e8e\u667a\u80fd\u95e8\u9501\u3001\u533b\u7597\u8bbe\u5907\u3001\u5de5\u4e1a\u63a7\u5236\u7b49\u5b89\u5168\u5173\u952e\u578b\u5e94\u7528\uff0c\u5e94\u8be5\u91c7\u7528\u6700\u9ad8\u7ea7\u522b\u7684\u5b89\u5168\u63aa\u65bd\uff0c\u4e0d\u60dc\u727a\u7272\u4e00\u4e9b\u4fbf\u5229\u6027\u3002<\/p>\n
\u800c\u5bf9\u4e8e\u4e00\u822c\u7684\u6d88\u8d39\u7c7b\u4ea7\u54c1\uff0c\u53ef\u4ee5\u9002\u5f53\u7b80\u5316\u5b89\u5168\u673a\u5236\uff0c\u4f46\u57fa\u672c\u7684\u52a0\u5bc6\u548c\u8ba4\u8bc1\u662f\u5fc5\u4e0d\u53ef\u5c11\u7684\u3002<\/p>\n
\u6700\u540e\uff0c\u5b89\u5168\u662f\u4e00\u4e2a\u6301\u7eed\u6f14\u8fdb\u7684\u8fc7\u7a0b\u3002\u4eca\u5929\u5b89\u5168\u7684\u7cfb\u7edf\uff0c\u660e\u5929\u53ef\u80fd\u5c31\u4f1a\u51fa\u73b0\u65b0\u7684\u6f0f\u6d1e\u3002<\/p>\n
\u6211\u4eec\u9700\u8981\u4fdd\u6301\u5b66\u4e60\uff0c\u5173\u6ce8\u5b89\u5168\u52a8\u6001\uff0c\u4e0d\u65ad\u6539\u8fdb\u548c\u5b8c\u5584\u6211\u4eec\u7684\u4ea7\u54c1\u3002<\/p>\n
\u53ea\u6709\u8fd9\u6837\uff0c\u624d\u80fd\u5728\u7269\u8054\u7f51\u65f6\u4ee3\u4e3a\u7528\u6237\u63d0\u4f9b\u771f\u6b63\u5b89\u5168\u53ef\u9760\u7684\u670d\u52a1\u3002<\/p>\n
\u66f4\u591a\u7f16\u7a0b\u5b66\u4e60\u8d44\u6e90<\/strong><\/p>\n