BLE connection state signal detection method in non-cooperative scene

Abstract

The invention discloses a BLE connection state signal detection method in a non-cooperative scene, and belongs to the technical field of wireless communication. In order to solve the problem that a BLE connection state signal cannot be effectively detected under the condition that a connection request packet is not captured, signal detection is realized by combining IQ sample phase compensation, frequency offset estimation and candidate access address screening through a lead code detection and cross-layer access address matching technology based on cross-correlation matching. According to the invention, the lead code initial position, the access address and the data packet length of the BLE signal can be accurately determined in a non-cooperative scene, and stable and reliable connection state signal detection is realized.

Description

Technical Field

[0001] This invention belongs to the field of wireless communication technology and relates to a method for detecting BLE connected state signals in non-cooperative scenarios. Background Technology

[0002] With the rapid development of the Internet of Things (IoT), various wireless protocols have been widely adopted, especially Bluetooth, known for its low power consumption and low cost, which has become the mainstream communication technology for wearable devices. However, some key organizations have high regulatory requirements for wireless devices, and the proprietary address and connection protocols of Bluetooth devices make them undetectable by conventional Bluetooth scanning devices. Existing BLE (Bluetooth Low Energy) signal detection technologies mainly employ two types of signal detection methods:

[0003] Bluetooth device detection based on broadcast channels: The system searches for a preamble sequence of 10101010 or 01010101 in the GFSK (Gaussian Frequency Shift Keying) demodulated bit sequence (using the 1M bitrate mode preamble length as an example). It then checks if the access address is 0x8E89BED6. If a match is found, it's identified as a broadcast packet; otherwise, the system searches for the next preamble sequence. Once a broadcast packet is identified, the payload is extracted based on the length field in the header and a CRC check is performed. Since the initial CRC value of a broadcast packet is always 0x555555, verifying the integrity of the broadcast packet is straightforward. Finally, the random address in the broadcast packet is used as the Bluetooth device identifier.

[0004] Bluetooth device detection based on the data channel: The parsing process is the same as that for broadcast packets. However, unlike broadcast packets, the access address and initial CRC value are unknown. Therefore, most methods first observe the CONNECT_IND packet on the broadcast channel. This packet contains most of the parameters needed by the master and slave devices, including the access address and initial CRC value. Then, based on the observed results, a preamble sequence is searched, matched against the observed access address, and the CRC is calculated to complete the data packet parsing for the data channel. Finally, connected Bluetooth devices are detected based on the access address.

[0005] In recent years, Bluetooth device detection has gradually become a research hotspot. For example, the sdr4iot-ble-rx open-source project can only detect BLE broadcast signals and cannot detect connected signals. The most widely used Ubertooth open-source project requires sniffing the CONNECT_IND connection request packet before it can be tracked. Once the connection request packet is missed, the connected BLE signal cannot be detected.

[0006] Existing technologies have significant shortcomings in practical applications of BLE connected state detection. Broadcast-channel-based BLE signal detection cannot detect BLE devices in a connected state because connected Bluetooth devices typically only send connection data packets. While there are instances where connected BLE devices still send broadcast signals, broadcast functionality is usually disabled to reduce power consumption. Furthermore, data-channel-based BLE signal detection relies on connection request packets; missing these packets makes parsing difficult because verification cannot determine if the access address is correct. Summary of the Invention

[0007] The purpose of this invention is to propose a method for detecting BLE connection-state signals in non-cooperative scenarios. By using preamble detection based on cross-correlation matching and cross-layer access address matching technology, this method solves the problem that existing technologies cannot effectively detect connection-state BLE signals when connection request packets are not captured, thus achieving accurate and stable detection of connection-state BLE signals in non-cooperative scenarios.

[0008] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0009] A method for detecting BLE connection-state signals in non-cooperative scenarios includes the following steps:

[0010] 1) Receive the IQ (In-phase and Quadrature) sample sequence of the BLE signal and generate the local IQ template signal of the BLE preamble;

[0011] 2) Perform cross-correlation calculation between the received IQ sample sequence and the local preamble template signal to determine the preamble start position and cross-correlation peak phase;

[0012] 3) Phase compensation is performed on the received IQ sample sequence using the cross-correlation peak phase to estimate the frequency offset information of the BLE signal;

[0013] 4) Sample the received IQ sample sequence according to the BLE symbol period, select the center position of each symbol period as the sampling point, and demodulate the sampling result according to the estimated frequency offset information to obtain the bit sequence.

[0014] 5) Use the demodulated bit sequence to perform multiple starting position offsets and data packet parsing to obtain candidate access addresses and corresponding data packet lengths;

[0015] 6) Estimate the physical layer duration of the BLE signal based on the physical layer characteristics of the received IQ samples, and compare the candidate data packet length with the physical layer duration to filter valid access addresses;

[0016] 7) Among all candidate access addresses, select the final access address based on the bit error rate or physical layer matching degree, and use it as the identifier for BLE connection state signal detection.

[0017] Further, in step 1), generating the local preamble template signal means selecting a preamble length of 1 byte or 2 bytes according to the BLE rate and taking the value (0x55, 0xAA) or (0x5555, 0xAAAA) to generate the IQ template signal.

[0018] Furthermore, the steps of cross-correlation operation in step 2) include: performing cross-correlation calculation on the received IQ sample sequence and the template signal to obtain a cross-correlation sequence, and searching for the position of the maximum peak and its corresponding phase in the cross-correlation sequence.

[0019] Furthermore, in step 2), the transient delay portion of the received IQ sample sequence is skipped during the cross-correlation operation to determine the actual start position of the preamble and the peak phase of the cross-correlation.

[0020] Furthermore, the specific processing steps for phase compensation in step 3) include: compensating the received IQ sample using the peak phase, unfolding the phase and calculating the phase difference, thereby estimating the frequency offset information.

[0021] Furthermore, in step 4), the bit sequence after sampling from the symbol center is further subjected to error detection and correction to improve the accuracy of candidate access address resolution.

[0022] Further, in step 4), GFSK (Gaussian Frequency Shift Keying) demodulation is performed based on the estimated frequency offset information.

[0023] Furthermore, in step 5), during the parsing process, the access address field and the PDU (Protocol Data Unit) length field are parsed at each offset position.

[0024] Furthermore, in step 6), the number of sampling points of the BLE signal is estimated based on the sampling settings, and the physical layer duration of the BLE signal is estimated by combining the transient delay and the tailing.

[0025] Further, in step 7), the access address with the lowest bit error rate or the highest matching degree with the physical layer duration is selected from all candidate access addresses.

[0026] The beneficial effects achieved by this invention are as follows:

[0027] 1. This invention can detect BLE connection state signals in non-cooperative scenarios without capturing the connection request packet CONNECT_IND. Even if the access address is unknown, signal detection can be achieved, making it suitable for dynamic or real-time monitoring scenarios.

[0028] 2. This invention, through a preamble detection method based on cross-correlation matching, can accurately locate the preamble start position of a BLE signal, exhibits robustness against transient delays and noise interference, and utilizes the peak phase of cross-correlation for phase compensation and frequency offset estimation, thereby improving the demodulation accuracy of received IQ samples and ensuring the reliability of the bit sequence.

[0029] 3. This invention uses a cross-layer access address matching method to correlate and verify physical layer features with link layer parsing results, which can accurately filter valid access addresses and determine data packet length. At the same time, it integrates bit error rate and physical layer duration matching degree during the candidate access address filtering process to improve the accuracy of access address selection.

[0030] 4. The method of the present invention can perform end-to-end processing of BLE signals, including preamble detection, phase compensation, frequency offset estimation, bit demodulation, candidate access address parsing, and final access address selection, realizing a complete signal detection process.

[0031] 5. This invention can stably detect BLE connected state signals under normal signal-to-noise ratio conditions, effectively cope with noise interference, and ensure the detection quantity and detection accuracy. Attached Figure Description

[0032] Figure 1 This is a flowchart illustrating BLE connection state signal detection in a non-cooperative scenario as described in the embodiment.

[0033] Figure 2 This is a flowchart of the preamble detection process based on cross-correlation matching in the embodiment.

[0034] Figure 3 This is a flowchart of the cross-layer access address matching process in the embodiment.

[0035] Figure 4 This is a diagram of the physical layer time domain structure of the BLE signal in the example.

[0036] Figure 5 This is the RSSI curve of the BLE connected state signal detection result in the example. Detailed Implementation

[0037] To make the various technical features, advantages, or effects of the present invention more apparent and understandable, the following detailed description is provided through embodiments and in conjunction with the accompanying drawings.

[0038] This invention specifically provides a method for detecting BLE connection-state signals in non-cooperative scenarios, such as... Figure 1 The process shown is described below, and its specific handling procedure is explained in detail.

[0039] 1. Preamble detection based on cross-correlation matching

[0040] To avoid the influence of noise on preamble recognition, this invention proposes a preamble detection method based on cross-correlation matching to determine the preamble start position of the BLE signal, such as... Figure 2 As shown. Unlike broadcast Bluetooth signals, which can be verified using a fixed access address, connected signals have unknown access addresses in non-cooperative scenarios, and cannot be correctly identified once the preamble is interfered with by noise. Therefore, this invention generates a local preamble template signal and performs cross-correlation calculations with the received IQ samples to find the most likely preamble start position.

[0041] In the specific implementation, firstly, the BLE preamble is set to 0x55 or 0xAA, with a length of 1 byte at 1 Mbps and 2 bytes at 2 Mbps. Secondly, since the RF circuitry of the BLE chip needs to be activated when transmitting data packets, the received IQ signal contains a transient delay. Therefore, the goal of preamble detection is to overcome this transient delay and determine the actual starting position of the preamble for subsequent data packet parsing. Finally, considering environmental noise interference, the preamble after GFSK (Gaussian Frequency Shift Keying) demodulation is not a continuous sequence of "0"s and "1"s. Therefore, the optimal preamble position needs to be found using the maximum cross-correlation matching function, and phase compensation is performed based on this to improve demodulation accuracy.

[0042] The specific processing flow of this method is as follows:

[0043] (1) The receiving end generates a local preamble IQ template signal, denoted as t[k];

[0044] (2) Perform cross-correlation operation between the received IQ sample sequence r[n] and the local template signal t[k] to obtain the cross-correlation sequence;

[0045] (3) Find the position n of the maximum cross-correlation peak in the cross-correlation sequence. peak And record its corresponding phase.

[0046] (4) Based on peak phase Estimate the fine time offset Δt and combine it with the sampling rate f. s Calculate the preamble start index position est index =n peak -Δt·f s ;

[0047] (5) Utilizing peak phase Phase compensation is performed on the received IQ sample sequence r[n] to obtain the phase-corrected signal;

[0048] (6) Perform phase expansion and phase difference calculation on the compensated signal to estimate the frequency offset information;

[0049] (7) Sample the frequency offset at the symbol center position and demodulate the received signal according to the offset direction to obtain the final bit stream output.

[0050] By following the steps above, the preamble position and BLE signal bit stream of the BLE signal can be accurately located and demodulated even in the presence of noise interference and transient delay, providing reliable input for subsequent data packet parsing.

[0051] 2. Cross-layer access address matching

[0052] like Figure 3 As shown, this invention designs a cross-layer access address matching method. By comparing physical layer features (the physical wavelength of the BLE signal) with the link layer parsing results, it determines whether the decoding is correct, thereby identifying the access address of the BLE connection-state signal and using it as an identifier for signal detection. For broadcast channels, since the access address is fixed, this algorithm does not perform matching. However, on data channels, the access address needs to be negotiated through the CONNECT_IND packet. If this packet is missed, the access address cannot be directly obtained, which will lead to some data not being parsed correctly and reducing the communication performance of the covert channel. To solve this problem, this invention uses received physical layer IQ samples to infer the approximate length L of the BLE signal. PHY The demodulated bit sequence is then subjected to multiple start position offsets and parsing to obtain different candidate (access address, packet length) key-value pairs, among which the length is close to L. PHY The candidate can be considered the correct access address.

[0053] In this step, the access address is determined by cross-layer correlation of physical layer features and link layer resolution results. The specific processing procedure is as follows:

[0054] (1) Estimate the physical layer duration of the BLE signal using the received physical layer IQ sample r[n] to obtain the desired signal length L. PHY ;

[0055] (2) The demodulated bit sequence b[i] is processed multiple times with a starting position offset δ, and the data packet is parsed at each offset position δ to obtain the candidate access address and the corresponding length (A). Addr (δ),Length(δ));

[0056] (3) Retrieve the length of each candidate data packet Length(δ) from L PHY Compare the results; if Length(δ)≈L PHY Then the candidate access address (A) is considered to be...Addr (δ),δ) are valid results and are stored as candidate access addresses;

[0057] (4) When there is a known mapping relationship (access address that appears multiple times), use the mapping to further filter the candidate access address;

[0058] (5) Among all candidate results, select the access address with the lowest bit error rate or the highest matching degree as the final access address A. Addr And use it as an identifier for BLE connected state signal detection.

[0059] It should be noted that this step performs access address matching for the data channel. This is because the access address of the data channel is negotiated and determined in the connection request packet (CONNECT_IND). If the connection request packet is not captured, the specific access address cannot be directly determined. Through the aforementioned cross-layer matching mechanism, correct parsing of the data channel can still be achieved even in the absence of the connection request packet, thereby ensuring the detection accuracy of connected-state BLE signals and the performance of covert channel communication.

[0060] The following example uses a captured BLE IQ signal for illustration:

[0061] Figure 4 This is a time-domain plot of a normal BLE IQ signal acquired by this invention, with a sampling rate f. s The frequency is 4MHz. This invention can divide the IQ signal of a BLE device into multiple parts: transient delay, preamble, access address, PDU, CRC, and tail bits.

[0062] First, based on the received IQ samples, the physical layer duration of the BLE signal can be estimated, thus determining the physical wavelength T. PHY :

[0063]

[0064] Among them, L sample T represents the number of sampling points for a complete BLE signal. td and T tb These represent the transient delay and tailing of the signal, respectively. s Let f be the sampling rate of the signal. s =4MHz, each sampling point (Sample Index) corresponds to 1 / 4μs, and the total number of Sample Indices for this signal is 545. T td The value of T is obtained by the preamble cross-correlation matching algorithm. The algorithm returns the preamble starting position as the 68th Sample Index, and calculates T. td It is approximately 14.50 μs. The wake trailing T...tb The typical sample index is 10-12, i.e., T. tb ≈2.75μs. Therefore, the following can be calculated:

[0065]

[0066] Next, the theoretical transmission duration T of the signal is parsed according to the BLE protocol field. the :

[0067]

[0068] Among them, L Pre The preamble length is V, which is related to the BLE rate. mode The value depends on L; AA The access address length is fixed at 4 bytes; L hdr The length of the PDU header is fixed at 2 bytes; L payload Extracted from the Length field in the PDU Header; L Crc Fixed as 3B; V mode For BLE rate, the value is 1 or 2. In this example, the parsing result shows a Length value of 0x05 in the header field, indicating a payload length of 5 bytes and a PDU length of header (2 bytes) + payload (5 bytes), for a total length of 7 bytes. Therefore, the total length of the entire data packet is the total length of the preamble, access address, PDU, and CRC, totaling 15 bytes. Considering the preamble is only 1 byte, the BLE rate is 1M mode, therefore the transmission time T for 15 bytes is... the =120μs.

[0069] Comparison of physical wavelength T PHY ≈119μs and theoretical transmission duration T the =120μs, which indicates that the parsing was correct, based on the access address A determined in step 2). Addr =0xb8acd954 is the correct access address and can be used as an identifier for BLE connection state signal detection. Figure 5 The results of BLE connection-state signal detection are shown. The detected access address 0xb8acd954 is used as the access address, and the RSSI is calculated based on the iq signal strength to determine the signal location.

[0070] This example clearly demonstrates that the method described in this invention can accurately determine the preamble start position, access address, and data packet length of a BLE signal in actual signal capture and parsing, thereby achieving reliable detection of BLE connection-state signals in non-cooperative scenarios.

[0071] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention should be covered within the protection scope of the present invention, which is defined by the claims.

Claims

1. A method for detecting BLE connected state signals in a non-cooperative scenario, characterized in that, Includes the following steps: 1) Receive the orthogonal component IQ sample sequence of the Bluetooth Low Energy (BLE) signal and generate the local IQ template signal of the BLE preamble; 2) Perform cross-correlation calculation between the received IQ sample sequence and the local preamble template signal to determine the preamble start position and cross-correlation peak phase; 3) Phase compensation is performed on the received IQ sample sequence using the cross-correlation peak phase to estimate the frequency offset information of the BLE signal; 4) Sample the received IQ sample sequence according to the BLE symbol period, select the center position of each symbol period as the sampling point, and demodulate the sampling result according to the estimated frequency offset information to obtain the bit sequence. 5) Use the demodulated bit sequence to perform multiple starting position offsets and data packet parsing to obtain candidate access addresses and corresponding data packet lengths; 6) Estimate the physical layer duration of the BLE signal based on the physical layer characteristics of the received IQ samples, and compare the candidate data packet length with the physical layer duration to filter valid access addresses; 7) Among all candidate access addresses, select the final access address based on the bit error rate or physical layer matching degree, and use it as the identifier for BLE connection state signal detection.

2. The method as described in claim 1, characterized in that, Step 1) generates the local preamble template signal by selecting a preamble length of 1 byte or 2 bytes according to the BLE rate and taking the value (0x55, 0xAA) or (0x5555, 0xAAAA) to generate the IQ template signal.

3. The method as described in claim 1, characterized in that, Step 2) includes the following steps for cross-correlation calculation: cross-correlation calculation is performed on the received IQ sample sequence and the template signal to obtain a cross-correlation sequence, and the position of the maximum peak and its corresponding phase are searched in the cross-correlation sequence.

4. The method as described in claim 1 or 3, characterized in that, In step 2), the transient delay portion of the received IQ sample sequence is skipped during the cross-correlation operation in order to determine the actual start position of the preamble and the peak phase of the cross-correlation.

5. The method as described in claim 1, characterized in that, The specific processing steps for phase compensation in step 3) include: compensating the received IQ sample using the peak phase, unfolding the phase and calculating the phase difference to estimate the frequency offset information.

6. The method as described in claim 1, characterized in that, In step 4), the bit sequence after sampling the symbol center is further subjected to error detection and correction to improve the accuracy of candidate access address resolution.

7. The method as described in claim 1, characterized in that, In step 4), Gaussian frequency shift keying (GFSK) demodulation is performed based on the estimated frequency offset information.

8. The method as described in claim 1, characterized in that, In step 5), during the parsing process, the access address field and the protocol data unit (PDU) length field are parsed at each offset position.

9. The method as described in claim 1, characterized in that, In step 6), the number of sampling points of the BLE signal is estimated based on the sampling settings, and the physical layer duration of the BLE signal is estimated by combining the transient delay and the tailing.

10. The method as described in claim 1, characterized in that, In step 7), select the access address with the lowest bit error rate or the highest matching degree with the physical layer duration from all candidate access addresses.

Images