A directional interference method and device for low-power Bluetooth

Abstract

A directional interference method and device for low-power Bluetooth mainly includes the following steps: identifying BLE connected state data packets from passive data reception and performing analysis to extract connected state information including access addresses; when a target access address is detected, triggering data packet capture, continuously saving multiple data packets belonging to the same connection, performing reverse solving of the data packets based on CRC calculation process to obtain CRC initial value; based on protocol stack exception triggering mechanism, constructing data channel interference packets for target connection; triggering interference packet transmission at regular intervals; and result verification and success determination. The device and method induce target equipment to trigger connection exception handling based on MIC integrity check failure, and realize precise directional interference for single BLE encrypted connection instance.

Description

Technical Field

[0001] This invention belongs to the field of low-power wireless communication security and radio frequency signal control technology, and specifically relates to a method and apparatus for directional interference against Bluetooth Low Energy. Background Technology

[0002] In the existing BLE (Bluetooth Low Energy) communication system, after devices complete pairing and encryption establishment, the link layer employs AES-CCM (AES encryption algorithm + CCM working mode) encryption and MIC (Message Integrity Check) message integrity verification mechanism to ensure the data's resistance to tampering during air interface transmission. When the receiving end detects a MIC verification failure, it usually determines that the current connection is abnormal and may trigger a retransmission mechanism or directly enter the disconnection process, thereby ensuring link security and consistency.

[0003] Bluetooth Low Energy (BLE) operates in the 2.4 GHz ISM band. After a connection is established, the master and slave devices periodically interact in the data channel according to connection events, based on the access address, connection interval, channel mapping, and frequency hopping parameters. In encrypted connections, the BLE link layer verifies data integrity through MIC verification in addition to CRC checksum. When the receiving end receives a data packet with a correct CRC but an incorrect MIC, it usually assumes that the link data has been tampered with or that the communication status is abnormal, and may trigger retransmission, exception handling, or connection termination procedures.

[0004] Existing BLE interference techniques mainly include power suppression interference and protocol-aware selective interference. The former covers the BLE operating frequency band with noise or frequency sweep signals, reducing the signal-to-noise ratio at the receiver and preventing the target device from receiving data packets. While simple to implement, this method typically covers one or more wireless channels, making it difficult to precisely target a specific BLE connection instance. In dense 2.4GHz wireless device environments, power suppression interference can not only affect the target BLE device but also collaterally impact other BLE connections, BLE broadcasting devices, and Wi-Fi and other wireless systems operating in the same frequency band, resulting in interference spillover, significant spectrum occupancy, and insufficient directionality.

[0005] The latter method, by monitoring BLE broadcast channels or specific message characteristics, triggers interference upon detecting a target signal. While offering better selectivity and energy efficiency compared to continuous power suppression, its essence remains primarily focused on disrupting the reception process. This type of method typically superimposes interference energy within the target message transmission window, preventing the receiver from correctly receiving or verifying data packets. It does not fully utilize the access addresses, connection event timings, master-slave interactions, and encryption integrity verification mechanisms within the BLE connected state. Therefore, its targeting granularity is mostly limited to the frequency band, channel, broadcast address, or message level, making it difficult to achieve precise state guidance for a single encrypted connection.

[0006] Existing solutions lack connection instance-level targeted interference methods for BLE encrypted connection states, based on access addresses and connection event timing, making it difficult to reduce the impact on communication of other devices while acting on a single target connection. Summary of the Invention

[0007] To overcome the shortcomings of existing BLE jamming methods, such as insufficient directionality, susceptibility to non-target devices, and incomplete utilization of BLE encrypted connection state mechanisms, this disclosure provides a directional jamming technique for Bluetooth Low Energy. This method identifies the target BLE connection access address and connection event timing, sends customized link-layer data packets within a specific communication window, and induces the target device to trigger connection anomaly handling based on the MIC integrity verification failure mechanism. This achieves precise jamming of a single BLE encrypted connection instance while minimizing the impact on the communication of other surrounding wireless devices.

[0008] The directional interference method for Bluetooth Low Energy disclosed herein mainly includes the following steps: S1, Identify BLE connection-state data packets from passively received data, parse them, and extract connection-state information including the access address; S2, When the target access address is detected, packet capture is triggered, multiple packets belonging to the same connection are continuously saved, and the reverse solution based on the CRC calculation process is performed on these packets to obtain the initial CRC value; S3, after obtaining the access address and initial CRC value, constructs a data channel interference packet for the target connection based on the protocol stack exception triggering mechanism; S4, timed triggering and jamming packet transmission; S5, Result Verification and Success Determination.

[0009] Furthermore, the specific method of step S1 includes: Passive acquisition of baseband IQ data is performed on the target Bluetooth communication frequency band; based on power estimation, suspected BLE data packet fragments are separated from the continuous IQ stream as candidate signal fragments; The extracted candidate signal segments are preprocessed and demodulated, and the preamble pattern is searched in the demodulated bitstream. Upon detecting a suspected preamble, the following four consecutive bytes are parsed as candidate access addresses; Extract the payload length declared in the packet from the link layer header following the access address; Candidate packets are filtered based on physical layer length consistency verification; In addition to length consistency verification, access address validity verification and Header field rule matching are added; Output connection state detection results, including: candidate access address, channel, timestamp of occurrence, packet duration, estimated RSSI, frequency offset characteristics, number of packets that passed the check, and confidence score.

[0010] Furthermore, in step S1, the specific method for filtering candidate packets based on physical layer length consistency verification includes: Count the number of sample points for candidate signal segments and calculate their true duration based on the sampling rate: in, This represents the number of sample points corresponding to the candidate package. Sampling rate; Based on the PHY rate, estimate the number of bits and bytes corresponding to the candidate packet in the air interface: The actual air interface length of the candidate packet is estimated as follows: in, This refers to the BLE physical layer rate, measured in bits per second. On the other hand, based on the Length field in the parsed Header, the theoretically required air interface length of the data packet can be calculated. For unencoded BLE connection-state packets, their total length is... Composed of preamble, access address, header, payload, CRC and Calculation complete; If the actual estimated length With theoretical length If the results are consistent within the allowable error range, the preamble location, access address resolution, and header length resolution are considered to have high reliability; if the differences are significant, the candidate packet is considered to be caused by noise, interference, or misidentification of the preamble and is therefore discarded.

[0011] Furthermore, the specific method of step S2 includes: Based on the identification of the target access address in step S1, continue to monitor the corresponding data channel. When the target access address is detected, trigger packet capture and continuously save multiple packets belonging to the same connection. For each candidate data packet, the payload boundary is determined based on the Length field in the Header, and the data packet is divided into Header, Payload and last 3 bytes of CRC check value; Based on the reverse solution of the CRC calculation process in BLE, the initial state that makes the calculation result of "Header + Payload" equal to the CRC field of the packet tail is obtained. Extract the Header, Payload, and CRC fields from multiple data packets with the same access address, and solve or verify the same initial CRC value. If a certain CRCInit can pass the CRC check of multiple data packets simultaneously, then the value is considered to be a valid initial CRC value for the target connection; if the results obtained from different data packets are inconsistent, it indicates that there may be missynchronization, misparsing, bit errors caused by low signal-to-noise ratio, or incorrect access address matching. In this case, the abnormal packets are removed and the calculation is recalculated.

[0012] Furthermore, the specific method of step S3 includes: The access address obtained in step S1 is used as the access address of the constructed data packet; Set the length of the constructed data packet's Payload field. This field should contain at least 1 byte of data content and 4 bytes of MIC field, meaning the Payload length should be at least 5 bytes. The detection end constructed an incorrect MIC field; Based on the initial CRC value obtained in step S2, recalculate the correct CRC for the entire constructed data packet; According to the BLE data channel packet structure, the preamble, access address, header, payload, and CRC fields are filled in sequentially, wherein the payload contains the data content and the error MIC field; After the fields are filled in, whitening and modulation are performed according to the channel.

[0013] Furthermore, the specific method of step S4 includes: Once the jamming data packet is constructed, the radio frequency device continues to listen on the selected BLE data channel, using the target access address as the trigger condition. When a data packet containing the access address is detected, the direction and timing of the data packet are first determined, and the data packet sent by the master device to the slave device is used as the first triggering reference. Using the end-of-packet time of the master device's data packet as a reference point, the jamming packet constructed in the previous step is transmitted approximately 150 μs later, causing it to fall into the target device's receiving time slot.

[0014] Furthermore, step S4 also includes: Considering the processing delay of the radio frequency equipment, the transmission start delay, the timestamp error, and the air interface propagation time, a slight advance compensation is made for the transmission time so that the constructed packet arrives at the target receiver before the normal response data packet.

[0015] Furthermore, the specific method of step S5 includes: After the data packet is constructed and sent, the detection device continues to monitor and parse the target access address according to the BLE connection state detection process in step S1. This includes: the radio frequency device continues to capture IQ data on the target data channel or the preset monitoring channel, and determines whether the original access address still appears in the air interface data packet through energy detection, preamble matching, access address parsing, header field rule matching and length consistency verification. If the target access address can be reliably detected before the construction packet is sent, and the access address cannot be detected again in multiple consecutive listening windows after the construction packet is sent, then the interference is considered successful.

[0016] A directional jamming device for Bluetooth Low Energy using the above method mainly includes: The access address acquisition module is used to identify and parse BLE connection state data packets from passively received data, and extract connection state information including the access address. The CRC initial value acquisition module is used to capture data packets after detecting the target access address, continuously save multiple data packets belonging to the same connection, and perform reverse calculation based on the CRC calculation process on these data packets to obtain the initial CRC value. The data channel jamming packet construction module is used to construct data channel jamming packets oriented towards the target connection based on the protocol stack exception triggering mechanism. The jamming packet transmission module is used for timed triggering and jamming packet transmission; Result verification and success determination module.

[0017] Compared with the prior art, the beneficial effects of this disclosure are: ① By combining physical layer feature consistency verification, access address recovery, CRC initial value inversion, and protocol field rule constraints under non-cooperative passive monitoring conditions, reliable identification and parameter reconstruction of BLE connected-state data packets are achieved. In complex RF environments, it can effectively suppress the effects of noise false detection, preamble missynchronization, and random bit interference, improving the accuracy and robustness of connected-state access address detection and link parameter recovery.

[0018] ② At the same time, by combining the physical layer detection results with the structural constraints of the link layer header field, the dependence on the complete connection establishment process is reduced, and the need for cooperation information and key information is reduced, thereby improving the applicability under unknown device and unknown link conditions.

[0019] ③ By further integrating the protocol stack anomaly triggering mechanism, the observability of connection state changes is enhanced, providing an effective technical means for BLE connection behavior analysis, protocol security verification, and wireless link state monitoring. Attached Figure Description

[0020] The above and other objects, features and advantages of this disclosure will become more apparent from the more detailed description of exemplary embodiments of this disclosure taken in conjunction with the accompanying drawings, in which the same reference numerals generally represent the same components.

[0021] Figure 1 The flow chart of the directional jamming system according to this disclosure; Figure 2 For envelope-based candidate segment signal detection; Figure 3 For BLE access address detection in non-cooperative scenarios; Figure 4 Settings for directional jamming include target frequency and target address; Figure 5 shows the contents of the data packets constructed using directional interference; Figure 6 shows the BLE timing captured by the Ellisys device; Unknown represents interference packets. Figure 7 shows the timing diagram of the BLE spectrum captured by the Ellisys device. Detailed Implementation

[0022] Preferred embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0023] This disclosure provides a method for targeted interference during Bluetooth Low Energy connected state communication, which can be applied to wireless communication security assessment, protocol robustness testing, and wireless link state control and analysis in specific scenarios.

[0024] This method identifies the target BLE connection access address and connection event timing, sends customized link layer data packets within a specific communication window, and uses data packets with correct CRC but incorrect MIC in the encrypted connection to trigger the integrity verification failure of the target device, inducing the target device to perform connection anomaly processing, thereby inducing it to actively disconnect. This achieves precise interference for a single BLE encrypted connection instance and reduces the impact on the communication of other surrounding wireless devices.

[0025] In one exemplary implementation, the specific process is as follows: Figure 1 As shown, the main steps include: 1. Testing of BLE devices in non-cooperative environments In non-cooperative detection scenarios, the detection end does not participate in the pairing, connection, and data interaction process of the target device, nor can it obtain the CONNECT_IND / AUX_CONNECT_REQ packets during the BLE connection establishment phase in advance. Therefore, it cannot directly obtain information such as connection parameters, initial CRC value, channel mapping, frequency hopping increment, and connection interval. In this case, the detection end's goal is to identify BLE connected-state data packets in the passively received data in the 2.4 GHz band and extract the connected-state session identifier, i.e., the 32-bit Access Address (AA).

[0026] The specific implementation process is as follows.

[0027] (1) First, passive acquisition of baseband IQ data was performed on the target 2.4 GHz band using USRP / SDR. Under relatively stable background noise conditions, power estimation was performed on the IQ data. Suspected BLE data packet fragments were separated from the continuous IQ stream through sliding window energy detection, noise floor estimation, and threshold decision. (See attached diagram) Figure 2 As shown.

[0028] (2) Then, the extracted candidate signal segments are preprocessed and demodulated. Preprocessing usually includes DC removal, amplitude normalization, coarse frequency offset estimation and compensation, low-pass filtering, and symbol timing recovery. Subsequently, the phase continuity characteristics of GFSK are used for frequency discrimination or differential demodulation to convert the IQ samples into soft-decision or hard-decision bitstreams.

[0029] (3) Since the BLE physical layer packet header has a fixed alternating bit preamble feature, it is necessary to search for the preamble pattern in the demodulated bit stream. For LE 1M PHY, the preamble length is 1 byte, which is represented as 0x55 or 0xaa; for LE 2M PHY, the preamble length is 2 bytes, which is represented as 0x5555 or 0xaaaa.

[0030] (4) After detecting a suspected preamble, the next 4 bytes are parsed as a candidate access address. Following the access address is a 2-byte link layer header, which contains LLID, sequence number control bits, and a Length field. For the data physical channel, the link layer PDU and CRC fields are whitened. After dewhitening, the Length field is read from the Header to obtain the declared payload length of the data packet.

[0031] (5) Since non-cooperative eavesdropping typically does not capture connection request packets, the detection end cannot obtain the CRCInit of the connection, and therefore cannot directly rely on CRC check to determine whether the data packet is parsed correctly. To address this, this embodiment introduces a physical layer length consistency check to filter candidate packets. Specifically, the method is to count the number of sample points for the candidate signal segment and calculate its true duration based on the sampling rate. in, This represents the number of sample points corresponding to the candidate package. The sampling rate is given. Based on the PHY rate, the number of bits and bytes corresponding to the candidate packet in the air interface can be further estimated. For LE 1M PHY, the air interface rate is 1 Mbps; for LE 2M PHY, the air interface rate is 2 Mbps. Therefore, the actual air interface length of the candidate packet can be estimated as follows: in, This is the BLE physical layer rate, measured in bits per second.

[0032] On the other hand, the theoretically required air interface length of the data packet can also be calculated based on the Length field in the parsed Header. For unencoded BLE connection-state data packets, the total length consists of the preamble, access address, Header, Payload, and CRC. If the actual estimated length... With theoretical length If the results are consistent within the allowable error range, it indicates that the preamble location, access address resolution, and header length resolution have high reliability. The allowable error mainly comes from energy threshold truncation error, filter group delay, symbol synchronization deviation, and packet boundary protection samples. It can generally be set to a tolerance of several bits, or 1 to 2 bytes. If the difference between the two is significant, the candidate packet is considered to be caused by noise, interference, or preamble misidentification and should be discarded.

[0033] (6) Based on the length consistency check, this embodiment further adds access address validity check and Header field rule matching to reduce the false alarm rate. Specifically: Access address validity check is used to exclude candidate values ​​that clearly do not conform to the BLE data channel access address constraints, such as all zeros, all ones, long consecutive identical bits, or confusion with the fixed access address of the broadcast channel. Header field rule matching utilizes the characteristic that the header fields of BLE connection-state data packets are not arbitrarily combined to check the parsed LLID, NESN, SN, MD, RFU, and Length fields.

[0034] (7) If the access address of the candidate packet is valid, the value of the Header field is reasonable, and the Length is consistent with the estimated packet length of the physical layer, then the access address resolution result is considered to have high credibility; otherwise, the candidate packet is considered to be caused by noise, interference or misidentification of the preamble, and the confidence level should be reduced or it should be discarded directly.

[0035] (8) Finally, the detection module outputs the connection state detection results, including candidate access address, channel, timestamp of occurrence, packet duration, estimated RSSI, frequency offset characteristics, number of packets that pass the check, and confidence score.

[0036] 2. Solving for the initial CRC value During BLE connection establishment, the initial CRC value is provided by the CRCInit field in the connection request packet, and all subsequent data channel packets in the connection use the same initial CRC value for verification. In non-cooperative monitoring scenarios, the detection end typically does not capture the connection request packet, and therefore cannot directly obtain the initial CRC value.

[0037] To address this issue, based on the previously identified target access address, the corresponding data channel can be monitored. Upon detecting the target access address, packet capture is triggered, and multiple packets belonging to the same connection are continuously saved. For each candidate packet, the detection end first performs dewhitening processing based on the channel it belongs to, and then determines the payload boundary based on the Length field in the Header, thereby dividing the packet into Header, Payload, and a 3-byte CRC checksum at the end.

[0038] The basic principle of CRC initial value inversion is as follows: The CRC-24 calculation process used by BLE is a deterministic linear feedback shift process. Given the input data bits and the final CRC check value, the only unknown is the 24-bit CRCInit. Therefore, the CRC calculation process can be reversed to find the initial state that makes the "Header + Payload" calculation result equal to the packet tail CRC field.

[0039] To improve reliability, in practice, we should not rely on a single data packet, but extract the Header, Payload and CRC fields from multiple data packets with the same access address, and solve or verify the same initial CRC value.

[0040] If a CRCInit value passes the CRC check of multiple data packets simultaneously, it is considered a valid initial CRC value for the target connection. If the results obtained from different data packets are inconsistent, it indicates potential synchronization errors, parsing errors, bit errors due to low signal-to-noise ratio, or incorrect access address matching. Abnormal packets need to be removed and recalculated. Abnormal packets refer to data packets that were parsed incorrectly. Since there is no prior information, the physical layer length consistency check in step 1 cannot guarantee that the parsed data packets are correct. The accuracy of the data packets is guaranteed by CRC. Only when the CRC passes can the data packet be considered correct. If the CRC fails, it indicates a parsing error, and it is an abnormal packet with parsing errors.

[0041] This step allows the connection-state CRC check parameters to be recovered even without capturing the connection request packet, thereby further verifying the correctness of the target access address.

[0042] 3. Interference packet construction After obtaining the access address and initial CRC value, a data channel interference packet oriented towards the target connection can be constructed. The core requirement of this step is that the constructed data packet should conform to the BLE data channel packet structure as much as possible in terms of physical layer and link layer format, enabling the target device to complete preamble synchronization, access address matching, and CRC verification; however, it should trigger MIC verification failure during the encryption verification stage, thereby causing connection anomalies or disconnection.

[0043] Specifically, constructing a jamming packet requires the Access Address and CRCInit obtained in the first two steps. The Access Address is used to make the receiving end recognize the packet as a data channel packet in the current connection, and the CRCInit is used to calculate the correct CRC check value so that the packet can pass the underlying CRC check.

[0044] Since the MIC field only exists in packets of encrypted connections, and empty packets do not contain the MIC field, the constructed packet cannot be an empty packet with a length of 0, but should contain a payload of a certain length. In order for the packet to contain the MIC field, the payload should contain at least 1 byte of data content and 4 bytes of the MIC field, that is, the payload length should be at least 5 bytes.

[0045] This method utilizes an exception handling mechanism of "CRC correct but MIC incorrect": the detection end does not need to know the session key, nor does it need to generate the correct MIC, but deliberately constructs an incorrect MIC field; at the same time, it recalculates the correct CRC for the entire constructed data packet, so that it appears as a legitimate data packet during the physical layer and link layer verification stages, but fails when the receiving end performs encryption integrity verification.

[0046] After selecting the fields, fill in the preamble, access address, header, payload (containing data content and error MIC field), and CRC field sequentially according to the BLE data channel packet structure. Then, perform whitening processing and modulation transmission based on the channel. (See attached image.) Figure 5 As shown.

[0047] In this way, after receiving the data packet, the target device will first check the access address and CRC, but then consider the integrity of the link data to be compromised due to the failure of the MIC check, thereby triggering the exception handling logic in the protocol stack.

[0048] 4. Timed triggering and jamming packet transmission.

[0049] Once the jamming packets are constructed, the radio frequency device continues to listen on the selected BLE data channel, using the target access address as the trigger condition. Directional jamming settings are attached. Figure 4 As shown, this includes the target frequency and the target address.

[0050] When a data packet containing the access address is detected, the direction and timing of the data packet are first determined, and the data packet sent by the master device to the slave device is selected as the trigger reference.

[0051] In BLE connection events, data packet exchange between master and slave devices typically occurs at 150 μs frame intervals. This means that after one data packet ends, the other end sends a response data packet approximately 150 μs later. Therefore, the jamming device uses the end-of-packet time of the master device's data packet as a reference point and transmits a jamming packet constructed in the previous step approximately 150 μs later, causing it to fall into the target device's receiving time slot.

[0052] As a preferred approach, to ensure that the constructed packet arrives at the target receiver before the normal response packet, factors such as the processing delay of the RF device, the transmission start delay, the timestamp error, and the air interface propagation time need to be considered, and a slight advance compensation needs to be made for the transmission time. For example, after experimental calibration, the trigger time can be set slightly earlier than 150 μs, such as about 149.5 μs, so that the actual air interface transmission start point is as close as possible to the leading edge of the target device's receiving window.

[0053] To improve the success rate of triggering, the operation of "listening to the access address - identifying the target data packet - periodically sending the constructed packet" can be repeated in multiple connection events, and the link status changes after each trigger can be recorded, such as whether the constructed data packet was successfully generated.

[0054] 5. Result verification and success determination.

[0055] After the constructed data packet is sent, the detection device continues to monitor and parse the target access address according to the BLE connection-state detection process in the first step. Specifically, the radio frequency device continues to capture IQ data on the target data channel or the preset monitoring channel, and determines whether the original access address still appears in the air interface data packet through energy detection, preamble matching, access address parsing, header field rule matching, and length consistency verification.

[0056] If the target access address can be reliably detected before the construction packet is sent, but cannot be detected again in multiple consecutive listening windows after the construction packet is sent, it indicates that the original BLE connection may have been abnormally interrupted, and the interference can be considered to have been successfully triggered.

[0057] In this embodiment, under non-cooperative passive reception conditions, reliable recovery of the BLE connection state access address and CRC initial value is achieved through physical layer feature consistency constraints. Furthermore, a timing adversarial data packet is constructed by combining the protocol stack verification mechanism to achieve controllable induction and abnormal triggering verification of the target connection state.

[0058] Application Examples The operation procedure of this disclosure is described using the connection between a BLE mouse and a computer as a test object. To ensure the accuracy of the test results, the experimental environment was arranged in an anechoic chamber, ensuring that only one pair of BLE communications existed in the test environment. The test equipment included: USRP B210, Ubertooth One, Ellisys Bluetooth protocol analyzer, BLE mouse (model MM110), and a Windows computer. The BLE mouse MM110 and the Windows computer were pre-paired and a BLE connection was established. The USRP B210 was used to collect IQ data in the target frequency band, with a sampling rate set to 4 MHz, a sampling bandwidth set to 2 MHz, and a center frequency set to 2406 MHz. This frequency covers one target listening channel in the BLE data channel. The access address identification phase was conducted in a normal office environment with Wi-Fi hotspots and other Bluetooth devices present, to verify the connection-state signal detection capability of this disclosure under complex radio frequency backgrounds.

[0059] First, a USRP B210 was used to continuously collect IQ data in the 2.4 GHz band, and the collected data was sent to a PC for real-time processing. The PC processing program performed energy detection on the IQ data, extracted suspected BLE burst signal segments, and performed DC removal, normalization, frequency offset compensation, and GFSK demodulation on candidate segments. Then, BLE preamble features were searched in the demodulated bitstream, and the 4-byte access address, 2-byte header, and subsequent payload and CRC fields were parsed according to the BLE data channel packet structure. Since Wi-Fi, other Bluetooth devices, and background noise were present in the office environment, relying solely on preamble matching might result in false positives. Therefore, header field rule matching and length consistency checks were further used to filter candidate data packets.

[0060] Through the above processing, the PC parses the Access Address corresponding to the target BLE connection from the collected data. After obtaining the Access Address, the PC sends the Access Address and the target channel number to Ubertooth. Ubertooth enters a targeted listening state based on the set Access Address and channel number, capturing only data packets matching the target Access Address. Ubertooth continuously listens for and saves multiple target connection data packets, then parses the Header, Payload, and the last 3 bytes of the CRC checksum in each data packet. Based on the known data content and the CRC field, it reverse-engineers the 24-bit initial CRC state that can generate the CRC result.

[0061] After recovering the access address and initial CRC value, a jamming data packet is constructed. This packet is generated according to the BLE data channel packet format, including a preamble, access address, header, payload (containing the MIC field), and CRC field. The access address uses the target Access Address recovered in the previous steps, and the CRC calculation uses the recovered CRCInit. Since the MIC field only exists in packets for encrypted connections, and empty packets do not contain the MIC, the payload of the constructed data packet in this example is 9 bytes long, containing 5 bytes of payload content (0x6655443322) and 4 bytes of the MIC field (0x020105). Simultaneously, a correct CRC is recalculated, making the data packet appear as a legitimate packet during the underlying CRC verification stage, but triggering MIC verification failure when the target device performs encryption integrity verification.

[0062] Subsequently, a timed transmission and triggering experiment was conducted. During the experiment, the USRP continued to monitor the channel where the target access address was located. When it detected a data packet sent by the target master device to the slave device, the end time of that data packet was used as the trigger reference. Based on the approximately 150 μs frame interval between the master and slave devices in a BLE connection event, the RF device transmitted the aforementioned constructed data packet approximately 150 μs after the packet end, aiming to ensure it fell within the target device's receiving window. To improve the success rate of the experiment, the process of "monitoring the access address - detecting master device data packets - timed transmission of constructed packets" can be repeated in multiple connection events.

[0063] Finally, the experimental results were independently verified using the Ellisys Bluetooth Protocol Analyzer. Ellisys, as a third-party protocol analysis device, sniffed and recorded the target BLE connection process. Before the experiment, Ellisys recorded a stable connection state data exchange between the BLE mouse and the Windows computer, with the target access address continuously appearing. If the target access address remained stable before sending the constructed data packet, but disappeared within the continuous observation window after sending, and Ellisys recorded the connection disconnection or reconnection process, then the protocol security test was considered successfully triggered.

[0064] As shown in Appendix 6-7, Figure 6 shows the BLE timing captured by the Ellisys device, with "Unknown" representing the interference packet. The interference packet differs from the Empty LE (normal data packet of the master device) by s150.25u, satisfying the BLE timing, indicating successful interference.

[0065] Figure 7 shows the timing diagram of the BLE spectrum captured by the Ellisys device, and it can be observed that the interference was successfully carried out between 13s and 16s.

[0066] The above technical solutions are merely exemplary embodiments of the present invention. For those skilled in the art, based on the application methods and principles disclosed in the present invention, it is easy to make various types of improvements or modifications, and not limited to the methods described in the specific embodiments of the present invention. Therefore, the methods described above are merely preferred and not restrictive.

Claims

1. A method for directional interference against Bluetooth Low Energy, characterized in that, Includes the following steps: S1, Identify BLE connection-state data packets from passively received data, parse them, and extract connection-state information including the access address; S2, When the target access address is detected, packet capture is triggered, multiple packets belonging to the same connection are continuously saved, and the reverse solution based on the CRC calculation process is performed on these packets to obtain the initial CRC value; S3, after obtaining the access address and initial CRC value, constructs a data channel interference packet for the target connection based on the protocol stack exception triggering mechanism; S4, timed triggering and jamming packet transmission; S5, Result Verification and Success Determination.

2. The method according to claim 1, characterized in that, The specific method of step S1 includes: Passive acquisition of baseband IQ data is performed on the target Bluetooth communication frequency band; based on power estimation, suspected BLE data packet fragments are separated from the continuous IQ stream as candidate signal fragments; The extracted candidate signal segments are preprocessed and demodulated, and the preamble pattern is searched in the demodulated bitstream. Upon detecting a suspected preamble, the following four consecutive bytes are parsed as candidate access addresses; Extract the payload length declared in the packet from the link layer header following the access address; Candidate packets are filtered based on physical layer length consistency verification; In addition to length consistency verification, access address validity verification and Header field rule matching are added; Output connection state detection results, including: candidate access address, channel, timestamp of occurrence, packet duration, estimated RSSI, frequency offset characteristics, number of packets that passed the check, and confidence score.

3. The method according to claim 2, characterized in that, In step S1, the specific method for filtering candidate packets based on physical layer length consistency verification includes: Count the number of sample points for candidate signal segments and calculate their true duration based on the sampling rate: in, This represents the number of sample points corresponding to the candidate package. Sampling rate; Based on the PHY rate, estimate the number of bits and bytes corresponding to the candidate packet in the air interface: The actual air interface length of the candidate packet is estimated as follows: in, This refers to the BLE physical layer rate, measured in bits per second. On the other hand, based on the Length field in the parsed Header, the theoretically required air interface length of the data packet can be calculated. For unencoded BLE connection-state packets, their total length is... Composed of preamble, access address, header, payload, CRC and Calculation complete; If the actual estimated length With theoretical length If the results are consistent within the allowable error range, the preamble location, access address resolution, and header length resolution are considered to have high reliability; if the differences are significant, the candidate packet is considered to be caused by noise, interference, or misidentification of the preamble and is therefore discarded.

4. The method according to claim 1, characterized in that, The specific method of step S2 includes: Based on the identification of the target access address in step S1, continue to monitor the corresponding data channel. When the target access address is detected, trigger packet capture and continuously save multiple packets belonging to the same connection. For each candidate data packet, the payload boundary is determined based on the Length field in the Header, and the data packet is divided into Header, Payload and last 3 bytes of CRC check value; Based on the reverse solution of the CRC calculation process in BLE, the initial state that makes the "Header + Payload" calculation result equal to the packet tail CRC field is obtained; Extract the Header, Payload, and CRC fields from multiple data packets with the same access address, and solve or verify the same initial CRC value. If a certain CRCInit can pass the CRC check of multiple data packets simultaneously, then the value is considered to be a valid initial CRC value for the target connection; if the results obtained from different data packets are inconsistent, it indicates that there may be missynchronization, misparsing, bit errors caused by low signal-to-noise ratio, or incorrect access address matching. In this case, the abnormal packets are removed and the calculation is recalculated.

5. The method according to claim 1, characterized in that, The specific method of step S3 includes: The access address obtained in step S1 is used as the access address of the constructed data packet; Set the length of the constructed data packet's Payload field. This field should contain at least 1 byte of data content and 4 bytes of MIC field, meaning the Payload length should be at least 5 bytes. The detection end constructed an incorrect MIC field; Based on the initial CRC value obtained in step S2, recalculate the correct CRC for the entire constructed data packet; According to the BLE data channel packet structure, the preamble, access address, header, payload, and CRC fields are filled in sequentially, wherein the payload contains the data content and the error MIC field; After the fields are filled in, whitening and modulation are performed according to the channel.

6. The method according to claim 1, characterized in that, The specific method of step S4 includes: Once the jamming data packet is constructed, the radio frequency device continues to listen on the selected BLE data channel, using the target access address as the trigger condition. When a data packet containing the access address is detected, the direction and timing of the data packet are first determined, and the data packet sent by the master device to the slave device is used as the first triggering reference. Using the end-of-packet time of the master device's data packet as a reference point, the jamming packet constructed in the previous step is transmitted approximately 150 μs later, causing it to fall into the target device's receiving time slot.

7. The method according to claim 6, characterized in that, Step S4 further includes: Considering the processing delay of the radio frequency equipment, the transmission start delay, the timestamp error, and the air interface propagation time, a slight advance compensation is made for the transmission time so that the constructed packet arrives at the target receiver before the normal response data packet.

8. The method according to claim 1, characterized in that, The specific method of step S5 includes: After the data packet is constructed and sent, the detection device continues to monitor and parse the target access address according to the BLE connection state detection process in step S1. This includes: the radio frequency device continues to capture IQ data on the target data channel or the preset monitoring channel, and determines whether the original access address still appears in the air interface data packet through energy detection, preamble matching, access address parsing, header field rule matching and length consistency verification. If the target access address can be reliably detected before the construction packet is sent, and the access address cannot be detected again in multiple consecutive listening windows after the construction packet is sent, then the interference is considered successful.

9. A directional jamming device for Bluetooth Low Energy using the method of any one of claims 1-8, characterized in that, include: The access address acquisition module is used to identify and parse BLE connection state data packets from passively received data, and extract connection state information including the access address. The CRC initial value acquisition module is used to capture data packets after detecting the target access address, continuously save multiple data packets belonging to the same connection, and perform reverse calculation based on the CRC calculation process on these data packets to obtain the initial CRC value. The data channel jamming packet construction module is used to construct data channel jamming packets oriented towards the target connection based on the protocol stack exception triggering mechanism. The jamming packet transmission module is used for timed triggering and jamming packet transmission; Result verification and success determination module.

Images