diff --git a/Hardware/Crypto.c b/Hardware/Crypto.c
index b3346f5..ffef1d6 100644
--- a/Hardware/Crypto.c
+++ b/Hardware/Crypto.c
@@ -52,6 +52,29 @@ static uint32_t pkcs7_pad(uint8_t* data, uint32_t data_len, uint32_t buffer_size
     return data_len + padding_len;
 }
 
+static uint32_t pkcs7_unpad(uint8_t* data, uint32_t data_len)
+{
+    uint8_t padding_len;
+    uint32_t i;
+
+    if (data_len == 0) {
+        return 0;
+    }
+
+    padding_len = data[data_len - 1];
+    if (padding_len < 1 || padding_len > 16 || padding_len > data_len) {
+        return data_len;
+    }
+
+    for (i = data_len - padding_len; i < data_len; i++) {
+        if (data[i] != padding_len) {
+            return data_len;
+        }
+    }
+
+    return data_len - padding_len;
+}
+
 uint32_t Crypto_EncryptJSON(const char* json_data, char* encrypted_output)
 {
     uint32_t json_len = strlen(json_data);
@@ -97,3 +120,37 @@ uint32_t Crypto_EncryptJSON(const char* json_data, char* encrypted_output)
 
     return encoded_len;
 }
+
+uint32_t Crypto_DecryptJSON(const char* encrypted_base64, char* plain_output, uint32_t output_size)
+{
+    uint32_t encrypted_len;
+    uint32_t binary_len;
+    uint32_t plain_len;
+    uint8_t buffer[768];
+    struct AES_ctx ctx;
+
+    if (encrypted_base64 == NULL || plain_output == NULL || output_size == 0) {
+        return 0;
+    }
+
+    encrypted_len = strlen(encrypted_base64);
+    if (encrypted_len == 0 || encrypted_len > BASE64_ENCODE_SIZE(sizeof(buffer))) {
+        return 0;
+    }
+
+    binary_len = base64_decode(encrypted_base64, encrypted_len, buffer);
+    if (binary_len == 0 || (binary_len % 16) != 0 || binary_len >= sizeof(buffer)) {
+        return 0;
+    }
+
+    AES_init_ctx_iv(&ctx, AES_KEY, AES_IV);
+    AES_CBC_decrypt_buffer(&ctx, buffer, binary_len);
+    plain_len = pkcs7_unpad(buffer, binary_len);
+    if (plain_len >= output_size) {
+        return 0;
+    }
+
+    memcpy(plain_output, buffer, plain_len);
+    plain_output[plain_len] = '\0';
+    return plain_len;
+}
diff --git a/Hardware/Crypto.h b/Hardware/Crypto.h
index b1d8e66..076a921 100644
--- a/Hardware/Crypto.h
+++ b/Hardware/Crypto.h
@@ -14,6 +14,15 @@
  */
 uint32_t Crypto_EncryptJSON(const char* json_data, char* encrypted_output);
 
+/**
+ * @brief 解密Base64编码的AES-CBC数据
+ * @param encrypted_base64 加密后的Base64字符串
+ * @param plain_output 输出明文缓冲区
+ * @param output_size 输出缓冲区大小
+ * @return 明文字节数，失败返回0
+ */
+uint32_t Crypto_DecryptJSON(const char* encrypted_base64, char* plain_output, uint32_t output_size);
+
 /**
  * @brief 获取加密后数据的最大长度
  * @param json_length JSON字符串长度
diff --git a/Hardware/Serial.c b/Hardware/Serial.c
index e385353..5613766 100644
--- a/Hardware/Serial.c
+++ b/Hardware/Serial.c
@@ -2,7 +2,7 @@
 #include "Delay.h" // Get_Time_ms 在这里，所以我们包含它
 #include <string.h>
 
-#define RX_BUFFER_SIZE 1024  // ← 增大到1024字节，支持完整HTTP响应
+#define RX_BUFFER_SIZE 2048  // 加密响应会因Base64膨胀，需保留完整HTTP响应
 char RxBuffer[RX_BUFFER_SIZE];
 uint16_t RxCounter = 0;
 
diff --git a/Hardware/aes.c b/Hardware/aes.c
index 9b8425c..614e8ce 100644
--- a/Hardware/aes.c
+++ b/Hardware/aes.c
@@ -26,12 +26,32 @@ static const uint8_t sbox[256] = {
     0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
 };
 
+static const uint8_t rsbox[256] = {
+    0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
+    0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,
+    0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
+    0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,
+    0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,
+    0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
+    0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,
+    0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,
+    0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
+    0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,
+    0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,
+    0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
+    0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
+    0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,
+    0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
+    0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
+};
+
 // Rcon
 static const uint8_t Rcon[11] = {
     0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36
 };
 
 #define getSBoxValue(num) (sbox[(num)])
+#define getSBoxInvert(num) (rsbox[(num)])
 
 // 密钥扩展
 static void KeyExpansion(uint8_t* RoundKey, const uint8_t* Key)
@@ -185,6 +205,81 @@ static void Cipher(uint8_t* state, const uint8_t* RoundKey)
     AddRoundKey(10, state, RoundKey);
 }
 
+static uint8_t Multiply(uint8_t x, uint8_t y)
+{
+    return (((y & 1) * x) ^
+            (((y >> 1) & 1) * xtime(x)) ^
+            (((y >> 2) & 1) * xtime(xtime(x))) ^
+            (((y >> 3) & 1) * xtime(xtime(xtime(x)))) ^
+            (((y >> 4) & 1) * xtime(xtime(xtime(xtime(x))))));
+}
+
+static void InvSubBytes(uint8_t* state)
+{
+    uint8_t i;
+    for (i = 0; i < 16; ++i) {
+        state[i] = getSBoxInvert(state[i]);
+    }
+}
+
+static void InvShiftRows(uint8_t* state)
+{
+    uint8_t temp;
+    temp = state[13];
+    state[13] = state[9];
+    state[9] = state[5];
+    state[5] = state[1];
+    state[1] = temp;
+
+    temp = state[2];
+    state[2] = state[10];
+    state[10] = temp;
+    temp = state[6];
+    state[6] = state[14];
+    state[14] = temp;
+
+    temp = state[3];
+    state[3] = state[7];
+    state[7] = state[11];
+    state[11] = state[15];
+    state[15] = temp;
+}
+
+static void InvMixColumns(uint8_t* state)
+{
+    uint8_t i;
+    uint8_t a, b, c, d;
+
+    for (i = 0; i < 4; ++i) {
+        a = state[i * 4 + 0];
+        b = state[i * 4 + 1];
+        c = state[i * 4 + 2];
+        d = state[i * 4 + 3];
+
+        state[i * 4 + 0] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^ Multiply(d, 0x09);
+        state[i * 4 + 1] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^ Multiply(d, 0x0d);
+        state[i * 4 + 2] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^ Multiply(d, 0x0b);
+        state[i * 4 + 3] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^ Multiply(d, 0x0e);
+    }
+}
+
+static void InvCipher(uint8_t* state, const uint8_t* RoundKey)
+{
+    uint8_t round;
+
+    AddRoundKey(10, state, RoundKey);
+
+    for (round = 9; ; --round) {
+        InvShiftRows(state);
+        InvSubBytes(state);
+        AddRoundKey(round, state, RoundKey);
+        if (round == 0) {
+            break;
+        }
+        InvMixColumns(state);
+    }
+}
+
 // ========== 公开API函数 ==========
 
 void AES_init_ctx(struct AES_ctx* ctx, const uint8_t* key)
@@ -222,16 +317,25 @@ void AES_CBC_encrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, size_t length)
     }
 }
 
-// STM32端不需要解密功能
 void AES_ECB_decrypt(const struct AES_ctx* ctx, uint8_t* buf)
 {
-    (void)ctx;
-    (void)buf;
+    InvCipher(buf, ctx->RoundKey);
 }
 
 void AES_CBC_decrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, size_t length)
 {
-    (void)ctx;
-    (void)buf;
-    (void)length;
+    size_t i;
+    uint8_t j;
+    uint8_t store_next_iv[AES_BLOCKLEN];
+
+    for (i = 0; i < length; i += AES_BLOCKLEN) {
+        memcpy(store_next_iv, buf + i, AES_BLOCKLEN);
+        InvCipher(buf + i, ctx->RoundKey);
+
+        for (j = 0; j < AES_BLOCKLEN; ++j) {
+            buf[i + j] ^= ctx->Iv[j];
+        }
+
+        memcpy(ctx->Iv, store_next_iv, AES_BLOCKLEN);
+    }
 }
diff --git a/Hardware/esp8266.c b/Hardware/esp8266.c
index 8ed8ca5..dea98ea 100644
--- a/Hardware/esp8266.c
+++ b/Hardware/esp8266.c
@@ -11,6 +11,7 @@
 #include "Serial.h"
 #include "Delay.h"
 #include "Debug.h"
+#include "Crypto.h"
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>  // ← 添加atoi函数声明
@@ -98,6 +99,42 @@ static void EpochToDateTimeUTC8(uint32_t epoch_seconds, ESP8266_DateTime* dateti
     datetime->day = (uint8_t)(days + 1U);
 }
 
+static uint8_t ESP8266_CopyDecryptedBody(char* response,
+                                         char* body_start,
+                                         uint16_t body_len,
+                                         char* response_buffer,
+                                         uint16_t buffer_size)
+{
+    uint8_t encrypted = 0;
+    char saved_char;
+    uint32_t plain_len;
+
+    if (strstr(response, "X-Encrypted: AES128-CBC") != NULL) {
+        encrypted = 1;
+    }
+
+    if (!encrypted) {
+        if (body_len >= buffer_size) {
+            body_len = buffer_size - 1;
+        }
+        strncpy(response_buffer, body_start, body_len);
+        response_buffer[body_len] = '\0';
+        return ESP8266_SUCCESS;
+    }
+
+    saved_char = body_start[body_len];
+    body_start[body_len] = '\0';
+    plain_len = Crypto_DecryptJSON(body_start, response_buffer, buffer_size);
+    body_start[body_len] = saved_char;
+
+    if (plain_len == 0) {
+        DEBUG_ERROR("[ESP8266] Failed to decrypt encrypted HTTP response");
+        return ESP8266_FAIL;
+    }
+
+    return ESP8266_SUCCESS;
+}
+
 /* --- 公共接口函数实现 --- */
 
 uint8_t ESP8266_Setup(void)
@@ -182,6 +219,7 @@ uint8_t ESP8266_SendEncryptedData(const char* encrypted_data)
 {
     char http_request[1024];
     char cmd_buffer[32];
+    char response_body[192];
     uint32_t content_length = strlen(encrypted_data);
     char* response;
     uint8_t send_ok = 0;
@@ -202,6 +240,7 @@ uint8_t ESP8266_SendEncryptedData(const char* encrypted_data)
         "Content-Type: application/octet-stream\r\n"
         "X-Api-Token: %s\r\n"
         "X-Encrypted: AES128-CBC\r\n"
+        "X-Encrypted-Response: true\r\n"
         "Content-Length: %u\r\n"
         "Connection: close\r\n"
         "\r\n"
@@ -254,10 +293,49 @@ uint8_t ESP8266_SendEncryptedData(const char* encrypted_data)
             send_ok = 1;
         }
 
-        if (send_ok && strstr(response, "HTTP/1.1 200") != NULL &&
-            strstr(response, "\"success\":true") != NULL) {
-            DEBUG_OK("[ESP8266] POST accepted by server");
-            return ESP8266_SUCCESS;
+        if (send_ok && strstr(response, "HTTP/1.1 200") != NULL) {
+            char* ipd_marker = strstr(response, "+IPD,");
+            if (ipd_marker != NULL) {
+                char* data_start = strchr(ipd_marker, ':');
+                if (data_start != NULL) {
+                    response = data_start + 1;
+                }
+            }
+
+            char* body_start = strstr(response, "\r\n\r\n");
+            if (body_start != NULL) {
+                uint16_t body_len;
+                body_start += 4;
+                body_len = strlen(body_start);
+                char* cl_str = strstr(response, "Content-Length:");
+                if (cl_str != NULL) {
+                    uint32_t post_content_length;
+                    cl_str += 15;
+                    while (*cl_str == ' ') cl_str++;
+                    post_content_length = (uint32_t)atoi(cl_str);
+                    if (post_content_length > 0 && body_len > post_content_length) {
+                        body_len = (uint16_t)post_content_length;
+                    }
+                }
+
+                char* closed_marker = strstr(body_start, "\r\nCLOSED");
+                if (closed_marker != NULL) {
+                    *closed_marker = '\0';
+                    body_len = strlen(body_start);
+                }
+                closed_marker = strstr(body_start, "CLOSED");
+                if (closed_marker != NULL) {
+                    *closed_marker = '\0';
+                    body_len = strlen(body_start);
+                }
+
+                if (ESP8266_CopyDecryptedBody(response, body_start, body_len,
+                                              response_body, sizeof(response_body)) == ESP8266_SUCCESS
+                    && strstr(response_body, "\"success\":true") != NULL) {
+                    DEBUG_OK("[ESP8266] POST accepted by server");
+                    return ESP8266_SUCCESS;
+                }
+            }
         }
 
         if (strstr(response, "HTTP/1.1 401") != NULL ||
@@ -366,7 +444,7 @@ uint8_t ESP8266_CheckConnection(void)
  */
 uint8_t ESP8266_HttpGet(const char* path, char* response_buffer, uint16_t buffer_size)
 {
-    char http_request[256];
+    char http_request[320];
     char cmd_buffer[32];
     uint8_t request_sent = 0;
 
@@ -390,6 +468,7 @@ uint8_t ESP8266_HttpGet(const char* path, char* response_buffer, uint16_t buffer
         "GET %s HTTP/1.1\r\n"
         "Host: %s:%s\r\n"
         "X-Api-Token: %s\r\n"
+        "X-Encrypted-Response: true\r\n"
         "Connection: close\r\n"
         "\r\n",
         path,
@@ -486,12 +565,12 @@ uint8_t ESP8266_HttpGet(const char* path, char* response_buffer, uint16_t buffer
             // 5. 如果服务端给了Content-Length，必须收完整；否则才使用超时兜底
             if ((found_header && body_len >= content_length) ||
                 (!found_header && Get_Time_ms() - start_time > 3000 && body_len > 0)) {
-                if (body_len >= buffer_size) {
-                    body_len = buffer_size - 1;
+                if (found_header && body_len > content_length) {
+                    body_len = (uint16_t)content_length;
+                }
+                if (ESP8266_CopyDecryptedBody(response, body_start, body_len, response_buffer, buffer_size) != ESP8266_SUCCESS) {
+                    return ESP8266_FAIL;
                 }
-
-                strncpy(response_buffer, body_start, body_len);
-                response_buffer[body_len] = '\0';
 
                 DEBUG_PRINT("[ESP8266] Received response (%d bytes)\r\n", strlen(response_buffer));
                 DEBUG_PRINT("[ESP8266] Response: %s\r\n", response_buffer);