block-beta
  columns 10
  title1["Flags Data"]:3 title2["Manufacturer Data"]:7
  1 2 3 4 5 6 7 8 9 10
  
  loc1["2"] loc2["0x01"] loc3["0x06"] loc4["22"] loc5["0xFF"] loc6["0x5A"] loc7["0x05"] loc8["0x05"] loc9["0x00"] loc10["0x00"]
  
  ins1["长度"] ins2["类型:Flags\n Data"] ins3["此设备是BLE only,\n处于General \nDiscoverable Mode"] ins4["长度"] ins5["类型:Manufacturer\n Data"] ins6_7["Company ID:0x055A\n(代表CANDY HOUSE Inc.)"]:2 ins8_9["设备类型(厂家私有)"]:2 ins10["设备状态(厂家私有)"]

classDef titledef1 fill:#E7E882
class title1 titledef1
classDef titledef2 fill:#38F5ED
class title2 titledef2

classDef privatedef fill: #f9fb0c
class loc8,loc9,loc10 privatedef

block-beta
  columns 10
  title2["Manufacturer Data"]:10
  11 12 13 14 15 16 17 18 19 20
  
  loc1["0x01"] loc2["0x02"] loc3["0x03"] loc4["0x04"] loc5["0x05"] loc6["0x06"] loc7["0x07"] loc8["0x08"] loc9["0x09"] loc10["0x0A"]
  
  ins1["\n设备UUID(共16个Bytes)\n"]:10
  
classDef titledef2 fill:#38F5ED
class title2 titledef2

classDef privatedef fill: #f9fb0c
class loc1,loc2,loc3,loc4,loc5,loc6,loc7,loc8,loc9,loc10 privatedef

block-beta
  columns 10
  title2["Manufacturer Data (Continued)"]:6 title3["Service UUID"]:4
  21 22 23 24 25 26 27 28 29 30
  
  loc1["0x11"] loc2["0x12"] loc3["0x13"] loc4["0x14"] loc5["0x15"] loc6["0x16"] loc7["3"] loc8["0x03"] loc9["0x81"] loc10["0xFD"]
  
  ins1_6["设备UUID(共16个Bytes)(续)"]:6 ins7["长度"] ins8["数据类型\n(0x03表示\nBLE Service UUID)"] ins9_10["BLE Service UUID\n(0xFD81代表\nSesame Service)"]:2
  
  
classDef titledef1 fill:#E7E882
class title3 titledef1
classDef titledef2 fill:#38F5ED
class title2 titledef2  

classDef privatedef fill: #f9fb0c
class loc1,loc2,loc3,loc4,loc5,loc6 privatedef

block-beta

columns 5

space:4
block:upper_right:1
	columns 1
    ur1["ciphertext"] 
    ur2["plaintext"]
end


T1["Application Layer"]:1
block:ID:2
	columns 1
	block
		A [" Item Code "] 
		B ["Parameter"]
	end
    G ["Application PDU"]
end
space:2
style T1 fill:#0,stroke-width:0px


T2["Security Layer"]:1
T21	["Encrypted Application PDU
    (AES加密后,密文与明文长度相同)"]:2
T22	["Mic
    (Message Integrity Code)"]:1
space:1


T3["Transport Layer"]:1
block:Content3:4
	columns 1
	block:updonw
        columns 4
        block:ID31
            A311 ["SEG0"]
            B312 ["Segment0"]
        end
        block:ID32
            A321 ["SEG1"]
            B322 ["Segment1"]
        end
        temp ("......")
        block:ID3n
            A32n ["SEGn"]
            B32n ["Segmentn"]
        end        
        
    end
	text3["Segment_0+Segment_1+...+Segment_n = Encrypted Application PDU + MIC"]
end

T4["Bearer"]:1
%%Content4 ["GATT"]:4
block:total_transfer:4
    columns 1
	Content4 ["GATT"]
    total4["总共要传输的资料 = Segment_0+Segment_1+...+Segment_n = n x MTU"] 
end

classDef ciphertextDef fill:#f20000
class ur1,T21 ciphertextDef

classDef commentDef fill:#e8e8e8
class total4,text3 commentDef

classDef tDef fill:#cbcbdb
class T1,T2,T3,T4 tDef

block-beta
  columns 2
  SEG["SEG"]:2
  i00["bit7 - bit1"] i01["bit0"]
  i10["parsing_type"] i11["is_start"]
  
    classDef titleDef fill:#55acaf
    class SEG titleDef

block-beta
  columns 3
  space i01["is_start==1"] i02["is_start==0"]
  i10["parsing_type!=0"] i11["A single segment content.
  是头也是尾(明文or密文)"]	i12["End of content
  尾(明文or密文)"]
  i20["parsing_type==0"] i21["Start of content.头"] i22["Middle of content.中"]
  
    classDef titleDef fill:#faea9a
    class i01,i02 titleDef
    
    classDef rowDef fill:#e3db8b
    class i10,i20 rowDef

sequenceDiagram
    participant Central as iOS/Android/ESP32<br/>BLE Central app
    participant Peripheral as Sesame<br/>BLE Peripheral
    
    Central->>Peripheral: Request<br/>(基於 BLE Write without response 實作)
    Peripheral-->>Central: Response<br/>(基於 BLE Notify 實作)
    Peripheral->>Peripheral: Process
    Peripheral-->>Central: Publish<br/>(基於 BLE Notify 實作)

flowchart TD
    subgraph Sesame5
    a1[设备是否被注册?]--否-->a4[设备时间timestamp与手机手机timestamp相同]-->a5[secp256r1函数生成publicKeyS,privateKeyS]-->a6[Secret=secp256r1函数,Device secret的前16Bytes]-->a7["Token=AES_CMAC(Device secret,random code)"]-->a8["回复(注册成功,机械状态,机械设定,publicKeyS)"]
    a1--是-->a2[回复已注册]-->a3(结束)
    end
	
    subgraph "Sesame (APP)"
    c1(#9899;)-->c2("secp256r1函数生成公钥与私钥{publicKeyA,privateKeyA} = secp256r1()")
    c2-->c3("发送{发送publicKeyA,手机timestamp,注册命令}")
    c4[设定设备机械状态,机械设定]-->c5["Secret = secp256r1(publicKeyS,privateKeyA)"]
    end    
	c3-->a1
	a8-->c4

sequenceDiagram
APP->>APP: {公钥A,私钥A}=secp256r1()
APP->>bleprofile: 发送{公钥A,手机timestamp,注册命令}
bleprofile-->>APP: ssm5是否被注册?未注册回复,已注册不回复
bleprofile->>bleprofile: {公钥s,私钥s}=secp256r1()
bleprofile->>bleprofile: Secret=secp256r1(公钥s,私钥s),Device secret=Secret前16bytes
bleprofile->>bleprofile: Token=AES_CMAC(Device secret,random code)
bleprofile-->>APP: 回复(注册成功,机械状态,机械设定,公钥S)
APP->>APP: 设定ssm5机械状态,机械设定
APP->>APP: Secret=secp256r1(公钥S,私钥A),Device secret = Secret前16bytes
APP->>APP: Token = AES_CMAC(Device secret, random code)
bleprofile-)APP: 上报设备时间误差

sequenceDiagram
critical [APP Login]
    APP->>APP: 有public_key,手机secret_key_pair
    Sesame5-->>APP: ADV(registered status)
    APP->>Sesame5: BLE connect,connected,discover & enable notification
    Sesame5-->>APP: publish(random,code[session token])
    APP->>Sesame5: (plaintext) 手机app_public_key,手机timestamp
    Sesame5-->>APP: (success) MechStatus
end

sequenceDiagram
critical [Send command]
    APP->>APP: Generate command data
    APP->>Sesame5: Send command data
    Sesame5-->>APP: Response,command,status
    APP->>APP: Refresh user interface from device status
    Note over Sesame5: Sesame5 directly disconnect on any error
    Sesame5-->>APP: (success) MechStatus
end

stateDiagram-v2

    state Sesame(APP) {
        [*] --> noBleSignal1
        noBleSignal1 --> receviedBle
        receviedBle --> bleConnecting
        bleConnecting --> waitingGatt
        waitingGatt --> isRegistered?
        
        locked --> unlocked 
        unlocked --> [*]
        
        noBleSignal2 --> [*]
        
        noBleSignal1 : noBleSignal
        noBleSignal2 : noBleSignal
    }
    
    state Sesame5 {
    	isRegistered? --> readyToRegister : No!
    		readyToRegister --> registering
    		registering --> locked
    	isRegistered? --> bleLogining : Yes!
    		bleLogining --> isLogin?
    			isLogin? --> bleDisconnecting : No!
    				bleDisconnecting --> noBleSignal2
    			isLogin? --> moved : Yes!
    				moved --> ready
    					ready --> [*]
    }

sequenceDiagram
autonumber
actor User
participant SesameApp
participant BleDevice

note over User,BleDevice: Preparation
alt BLE status == ON
    SesameApp->>SesameApp: Scan for Bluetooth devices
    SesameApp->>+BleDevice: Connect
    SesameApp->>SesameApp: Discover services
    SesameApp->>SesameApp: Discover characteristics
    SesameApp->>BleDevice: 5.Enable notifications
    BleDevice->>-SesameApp: 6.Initialization successful and a random code returned
    SesameApp->>SesameApp: 7.Save random code (session token)
    SesameApp->>SesameApp: 8.Generate key pair A
else BLE status != ON
	SesameApp->>SesameApp: Remind the user to turn on Bluetooth
end


note over User,BleDevice: Registration

User->>+SesameApp: Add device

par SesameS/Bike2/Open Sensor/Sesame Touch
	SesameApp->>SesameApp: Generate command data using public key of key pair A + timestamp
	SesameApp->>+BleDevice: Send command data
	BleDevice->>BleDevice: Synchronize time
	BleDevice->>BleDevice: Generate key pair B
	BleDevice->>BleDevice: Generate key with public key of key pair A and private key of key pair B
	BleDevice->>-SesameApp: Return status, settings, public key of key pair B
and WiFiModule2
    SesameApp->>SesameApp: Generate command data using public key of key pair A
    SesameApp->>+BleDevice: Send command data
    BleDevice->>BleDevice: Generate key pair B
    BleDevice->>BleDevice: Generate key with public key of key pair A and private key of key pair B
    BleDevice->>-SesameApp: Return public key of key pair B
    SesameApp->>SesameApp: Scan WiFi, set password, connect WiFi
end
SesameApp->>SesameApp: Generate key with private key of key pair A and public key of key pair B
SesameApp->>SesameApp: Update command encoder/decoder
SesameApp->>SesameApp: Insert device information with key
SesameApp->>SesameApp: Restore device state from shadow
SesameApp->>-User: Add device Result


Note over User,BleDevice: Login


par SesameS/Bike2/Open Sensor/Sesame Touch
    SesameApp->>SesameApp: Generate session authorization with signature
    SesameApp->>SesameApp: Without signature, generate session authorization with session token and key
    SesameApp->>SesameApp: Update command encoder/decoder
    
    SesameApp->>+BleDevice: Send command data
    BleDevice->>SesameApp: Verify key consistency
    BleDevice-->>-SesameApp: Return timestamp

    alt abs(device timestamp - app timestamp) >= 3
        SesameApp->>SesameApp: Get current time
        SesameApp->>BleDevice: Send command data
        BleDevice->>BleDevice: Synchronize time from App
    end
and WiFiModule2
    SesameApp->>SesameApp: Update command encoder/decoder
    SesameApp->>SesameApp: Generate command data with key and session token
    SesameApp->>BleDevice: Send command data
end
BleDevice-->>SesameApp: Response successful
BleDevice-->>SesameApp: Publish device status
SesameApp->>SesameApp: Respond with device status



Note over User,BleDevice: Send command
User->>SesameApp: Tap Sesame
par SesameS/Bike2/Open Sensor/Sesame Touch
	alt BLE connected
        SesameApp->>SesameApp: Generate command data
        SesameApp->>+BleDevice: Send command data
        BleDevice-->>-SesameApp: Publish device status
        SesameApp->>SesameApp: Restore interface from device status
    end
and WiFiModule2
    SesameApp->>SesameApp: Generate command data (key and public key when needed)
    SesameApp->>+BleDevice: Send command data
    BleDevice-->>-SesameApp: Publish device status
    SesameApp->>SesameApp: Restore interface from device status
end
SesameApp->>User: Return Result

sequenceDiagram
发送->>发送: 收到资料: A A B B
发送->>发送: 资料: A A B B
发送->>接收: 加上封包头 3 A A B B
接收->>接收: 收到: 3 A A B B
接收->>接收: 去除封包头还原资料: A A B B

sequenceDiagram
发送->>发送: 收到资料: A A A A B B B B

发送->>发送: 拆解资料: A A A A
发送->>接收: 加上封包头: 1 A A A A
接收->>接收: 收到: 1 A A A A
接收->>接收: 判断资料还没送完,等待下一个封包

发送->>发送: 拆解资料: B B B B
发送->>接收: 加上封包头: 2 B B B B
接收->>接收: 收到: 2 B B B B
接收->>接收: 资料接收完成,组合封包
接收->>接收: 去除封包头还原资料: A A A A B B B B

sequenceDiagram
发送->>发送: 收到资料: A A A A B B B B C C C C

发送->>发送: 拆解资料: A A A A
发送->>接收: 加上封包头: 1 A A A A
接收->>接收: 收到: 1 A A A A
接收->>接收: 判断资料还没送完,等待下一个封包

发送->>发送: 拆解资料: B B B B
发送->>接收: 加上封包头: 0 B B B B
接收->>接收: 收到: 0 B B B B
接收->>接收: 判断资料还没送完,等待下一个封包

发送->>发送: 拆解资料: C C C C
发送->>接收: 加上封包头: 2 C C C C
接收->>接收: 收到: 2 C C C C
接收->>接收: 资料接收完成,组合封包
接收->>接收: 去除封包头还原资料: A A A A B B B B C C C C

sequenceDiagram
发送->>发送: 收到资料: A A B B
发送->>发送: 资料加密后: X X Y Y
发送->>接收: 加上封包头 5 X X Y Y
接收->>接收: 收到: 5 X X Y Y
接收->>接收: 去除封包头还原资料: X X Y Y
接收->>接收: 解密: A A B B

sequenceDiagram
发送->>发送: 收到资料: A A A A B B B B
发送->>发送: 资料加密后: X X X X Y Y Y Y
发送->>发送: 拆解资料: X X X X
发送->>接收: 加上封包头: 1 X X X X
接收->>接收: 收到: 1 X X X X
接收->>接收: 判断资料还没送完,等待下一个封包

发送->>发送: 拆解资料: Y Y Y Y
发送->>接收: 加上封包头: 4 Y Y Y Y
接收->>接收: 收到: 4 Y Y Y Y
接收->>接收: 资料接收完成,组合封包
接收->>接收: 去除封包头还原资料: X X X X Y Y Y Y
接收->>接收: 资料解密: A A A A B B B B

sequenceDiagram
发送->>发送: 收到资料: A A A A B B B B C C C C
发送->>发送: 资料加密: X X X X Y Y Y Y Z Z Z Z

发送->>发送: 拆解资料: X X X X
发送->>接收: 加上封包头: 1 X X X X
接收->>接收: 收到: 1 X X X X
接收->>接收: 判断资料还没送完,等待下一个封包

发送->>发送: 拆解资料: Y Y Y Y
发送->>接收: 加上封包头: 0 Y Y Y Y
接收->>接收: 收到: 0 Y Y Y Y
接收->>接收: 判断资料还没送完,等待下一个封包

发送->>发送: 拆解资料: Z Z Z Z
发送->>接收: 加上封包头: 4 Z Z Z Z
接收->>接收: 收到: 4 Z Z Z Z
接收->>接收: 资料接收完成,组合封包
接收->>接收: 去除封包头还原资料: X X X X Y Y Y Y Z Z Z Z
接收->>接收: 资料解密: A A A A B B B B C C C C

block-beta
  columns 4
  
  i01["Sesame2 
  shadow"] space:2 i02["WiFiModule2 
  shadow"] 
  
  %%i10["i10"] i11["i11"] i12["i12"] i13["i13"]
  space:4
  space:4
  
  i20["phone"] i21["phone"] space i23["WiFiModule2"]
  space:4
  space:4
  space space i32["Sesame2"] space
  
  i21--"1.WiFi Password"-->i23
  
  i21-->i32 i32-->i21
  i23--"4.Lock/Unlock"-->i32 i32-->i23
  
  i01--"Get Sesame2 status
  by Subscription"-->i20
  
  i21--"Publish 
  Sesame2 status"-->i01
  
  i23--"Publish Sesame2 status"-->i01
  
  i21--"2.Publish the 
  Sesame2 List 
  and Sesame keys 
  to the shadow"-->i02
  
  i02--"3. Get the 
  Sesame2 List 
  by Subscription"-->i23
  
  commentcloud>"表示运行在AWS IoT中"]

    classDef cloudDef fill:#f9cb9c
    class i01,i02,commentcloud cloudDef

sequenceDiagram
    participant App as 手機app
    participant WiFi as WiFiModule2  
    participant S as Server
    participant AWS as AWS_IoT

    Note over App,WiFi: 已建立BLE連線<br/>並已完成BLE_login<br/>且已建立AESCCM加密通道
    
    WiFi->>App: 返回掃到的2.4GHz的WiFi清單
    App->>WiFi: 选择WiFi的SSID 並給 該密碼
    App->>AWS: 訂閱這個WiFiModule2的Shadow

    WiFi->>S: https_request
    S-->>WiFi: server_token
    
    Note over WiFi,S: SIG=ECC( WiFiModule2_private_key, server_token )<br/>Server 用 WiFiModule2_public_key 校验請求的SIG
    
    WiFi->>S: https_request(IR, SIG, server_token)
    S->>S: 認證請求
    S->>AWS: 申請證書
    AWS-->>S: 返回证书
    AWS->>S: 附加 thing & Policy
    S->>S: 保存證書信息
    
    S-->>WiFi: 返回证书
    
    WiFi->>AWS: 持有該證書去連結 AWS_IoT 網絡
    AWS-->>WiFi: MQTT Connected
    WiFi->>AWS: 訂閱自己的Shadow
    WiFi->>AWS: 回報MQTT Connected狀態<br/>(並寫在LWT, Last Will and Testament)

    AWS-->>App: 收到 WiFiModule2網絡設定 成功

sequenceDiagram
title WiFiModule2 BLE login
participant App as 手機app
participant Module as WiFiModule2

critical login
    Note over App: 有 WiFiModule_public_key,<br/>持手機app_key_pair

    Module->>App: ADV(registered status)
    App->>Module: BLE connect, connected, discover & enable notification
    Module->>App: publish(WiFiModule_token)
    App->>Module: (plaintext) key_idx, 手機app_public_key, 手機app_session_token, session_auth

    Note over App,Module: session_token = 手機app_session_token+WiFiModule_session_token<br/>session_auth計算SIG = AES-CMAC(user_key, key_idx+手機app_public_key+session_token)<br/>session_key = AES-CMAC(ECDH_shared_secret, session_token)

    Note over Module: WiFiModule2 will directly disconnect on any error

    Module-->>App: (encrypted) login info

end

sequenceDiagram
	title 设定WiFiModule2
    participant App as 手機app
    participant WiFi as WiFiModule2
    participant S as Server
    participant AWS as AWS_IoT
    
    Note over App,WiFi: 已建立BLE連線<br/>並已完成BLE_login<br/>且已建立AESCCM加密通道
    
    WiFi->>App: 返回掃到的2.4GHz的WiFi清單
    App->>WiFi: 選擇WiFi的SSID 並給 該密碼
    App->>AWS: 訂閱這個WiFiModule2的Shadow
    
    WiFi->>S: https_request
    S-->>WiFi: server_token
    
    Note over WiFi,S: SIG=ECC( WiFiModule2_private_key, server_token )<br/>Server 用 WiFiModule2_public_key 校驗請求的SIG
    
    WiFi->>S: https_request(IR, SIG, server_token)
    S->>S: 校驗請求
    S->>AWS: 申請證書
    AWS-->>S: 返回證書
    S->>AWS: 附加thing & Policy
    S->>S: 保存證書信息
    
    S-->>WiFi: 返回結果
    WiFi->>AWS: 持有該證書去連結 AWS_IoT 網絡
    AWS-->>WiFi: MQTT Connected
    WiFi->>AWS: 訂閱自己的Shadow
    WiFi->>AWS: 回覆MQTT Connected狀態<br/>(並更新LWT, Last Will and Testament)
    
    AWS-->>App: 收到 WiFiModule2網絡設定 成功

sequenceDiagram

title 配对WiFiModule2
	participant App as 手機app
box rgba(212,140,100,0.1) AWS IoT
    participant WM2S as WiFiModule2 Shadow
    participant S2S as Sesame2 Shadow
end
    participant WM2 as WiFiModule2
    participant S2 as Sesame2

    App->>WM2S: 同步 Sesame清單<br/>同步 低耗限user_key
    WM2S->>WM2: 同步 Sesame清單<br/>同步 低耗限user_key

    Note over WM2,S2: 建立 BLE連線<br/>進行 BLE_login<br/>建立 AESCCH加密通道

    S2->>WM2: Sesame狀態<br/>(是否鎖上?, 電池, 角度)
    WM2->>S2S: 同步 Sesame狀態<br/>(是否鎖上?, 電池, 角度)
    
    S2S->>App: 同步 Sesame狀態<br/>(是否鎖上?, 電池, 角度)

sequenceDiagram
	title 配对WiFiModule2与Sesame2
    participant App as 手機app
box rgba(212,140,100,0.1) AWS IoT
    participant WM2S as WiFiModule2 Shadow
    participant S2S as Sesame2 Shadow
end
    participant WM2 as WiFiModule2
    participant S2 as Sesame2

    Note over WM2: 初始狀態是藍芽中心設備

    App->>WM2S: 同步 Sesame清單<br/>同步 低耗限user_key
    WM2S->>WM2: 同步 Sesame清單<br/>同步 低耗限user_key
    Note over WM2,S2: 建立 BLE連線<br/>進行 BLE_login<br/>建立 AESCCH加密通道
    
    S2->>WM2: Sesame狀態<br/>(是否鎖上?, 電池, 角度)
    WM2->>S2S: 同步 Sesame狀態<br/>(是否鎖上?, 電池, 角度)
    S2S->>App: 同步 Sesame狀態<br/>(是否鎖上?, 電池, 角度)