Search

KR-20260067992-A - SYSTEM FOR BLUETOOTH DEVICE IDENTIFICATION AND PROCESS THEREFOR

KR20260067992AKR 20260067992 AKR20260067992 AKR 20260067992AKR-20260067992-A

Abstract

A computing system and method for performing type identification of computing devices communicating via a wireless Bluetooth protocol are disclosed. The computing system includes a custom or non-custom computing system configured to transmit queries via the protocols described in the Bluetooth specification and vendor-specific protocols. To establish identification of all computing devices communicating via Bluetooth, the computing system analyzes behavioral data and raw data combined with ground truth data for known devices. In the absence of ground truth data, device identification is inferred along with an associated confidence level based on the aggregation of all collected data.

Inventors

  • 제노 코바

Assignees

  • 다크 멘토 엘엘씨

Dates

Publication Date
20260513
Application Date
20251028
Priority Date
20241106

Claims (20)

  1. Memory that stores a program for executing process steps, A database that stores data received from a Targeted Identification Device (DTI), One or more Bluetooth chip processors having a transceiver that detects nearby Bluetooth communication devices and identifies identifiable target devices of the area Low Energy (BLE) and Basic Rate/Enhanced Data Rate (BR/EDR) types, A collection channel connected to each of one or more Bluetooth chip processors to collect data received from a detected identified target device, and A step of selecting a known packet type of interest protocol/profile received from a detected identified target device, A step of transmitting each individual packet type externally to collect information from a detected identified target device, A step of receiving a response (including protocol/profile layer) for each packet type transmitted from the identified target device and storing the received response in a database, A step of determining whether the received protocol/profile layer has an action that can be used to determine device identification (DID), A step of selecting a known device distinction action for each received protocol/profile layer, A step of performing an operation evaluation of the device to be identified, and Includes a step of formatting collected data to store it in a database including a main processor configured to execute process steps Bluetooth Device Identification System (DIS).
  2. Memory for storing a program containing an instruction set corresponding to each of one or more process steps, A database stored in memory to store and/or track response data values generated by transmitting a query packet to one or more identified devices as response data values from identified Bluetooth devices (DTI) and storing the actual response packet value when a response packet is received, One or more Bluetooth chip processors having a transceiver that detects a target device of the Low Energy (BLE) and/or Basic Rate/Enhanced Data Rate (BR/EDR) type present within the area, A collection channel connected to each of one or more Bluetooth chip processors to collect data received from a detected identification target device, and As a program and a corresponding process step, A step of selecting one or more known query packet types for one or more interest protocols and/or profiles received from a detected identified target device, A step of transmitting each of the selected individual query packet types to one or more of the detected identified target devices to generate a response packet from the detected identified target devices, A step of receiving one or more response packets containing protocol and/or profile information from an identified target device in response to each query packet type, and storing the corresponding response data values in a database, and Includes a step of formatting collected data to store it in a database including at least one processor configured to execute a process step Bluetooth Device Identification System (DIS).
  3. In paragraph 2, The above database is a Bluetooth device identification system (DIS) that can also store the corresponding no-response packet value when a response packet for a given query packet is not received.
  4. In paragraph 2, The above process steps A step of determining whether there is a layer among the received protocol/profile layers that has an action that can be used to determine device identification (DID), A step of selecting a known device distinguishing action for each of the received protocol/profile layers having the corresponding action, and A step further comprising performing a behavioral evaluation of the identified target device to collect additional response data values Bluetooth Device Identification System (DIS).
  5. In paragraph 2, The above database may also store the corresponding "no response" packet value if a response packet is not received in response to a given query packet, and The above process steps A step of determining whether the received protocol/profile layer has an action that can be used to determine device identification (DID), A step of selecting a known device distinction action for each received protocol/profile layer; and A step further comprising performing a behavioral evaluation of the identified target device to collect additional response data values Bluetooth Device Identification System (DIS).
  6. In paragraph 5, The above process steps A step of determining whether the failure to receive a response packet for a given query packet is more likely to be due to packet loss during transmission, a response error by the given target device, or the given target device not possessing a corresponding response value for the given query packet. A step of using the judgment of the previous step as a factor for determining known device distinction behavior for each received protocol/profile layer, and A step further comprising including a known device distinction action determined in a previous step as part of the operation evaluation of the target device to be identified for collecting additional response data values. Bluetooth Device Identification System (DIS).
  7. In paragraph 2, At least one of the above query packet types has one or more possible valid configurations, and The above process steps A step of transmitting at least one query packet with at least two valid configurations to obtain a first response packet having a first response data value and a second response packet having a second response data value, A step of generating a distinction value by comparing the first response data value and the second response data value, and using the distinction value as a factor for determining a known device distinction operation for each received protocol/profile layer, and A step of additionally including a step of collecting additional response data values by including a known device distinction behavior determined in the previous step as part of the behavior evaluation of the device to be identified. Bluetooth Device Identification System (DIS).
  8. In paragraph 2, A Bluetooth device identification system (DIS) in which the above Bluetooth chip processor can also passively detect one or more independent packets transmitted by a target Bluetooth device in the area, each independent packet has an independent data value, and the above Bluetooth chip processor can store the independent data packet value in a database.
  9. In paragraph 4, A Bluetooth device identification system (DIS) wherein the Bluetooth chip processor can also passively detect one or more independent packets transmitted by a target Bluetooth device within the area, each independent packet has an independent data value, the Bluetooth chip processor can store the independent data packet values in a database, and the independent data packet values can be used as a second factor in determining a known device distinction operation for a given target device.
  10. In paragraph 2, The above Bluetooth device identification system can transmit one or more bad query packets, wherein the bad query packets are configured not to intentionally conform to one or more valid Bluetooth protocols and/or Bluetooth standards, and the response packet transmitted by a given device to be identified in response to the bad query packets generates a bad query response data value that can be stored in a database.
  11. In paragraph 4, The above Bluetooth device identification system can transmit one or more bad query packets, wherein the bad query packets are configured not to intentionally conform to one or more valid Bluetooth protocols and/or Bluetooth standards, and the response packet transmitted by a given target device in response to the bad query packets generates a bad query response data value that can be used as a second factor in determining a known device distinction operation for the given target device.
  12. In paragraph 2, At least one of the above query packet types is a state machine query packet capable of changing the entire state machine configuration of a given identified device, and in response to the reception of the given state machine query packet, the entire state machine configuration of the given identified device is determined by the device identification system to generate an entire state machine response value, and the entire state machine response value can be stored in a database. Bluetooth device identification system (DIS).
  13. In paragraph 4, At least one of the above query packet types is a state machine query packet capable of changing the entire state machine configuration of a given target device for identification, and in response to the reception of the given state machine query packet, the entire state machine configuration of the given target device for identification is determined by the device identification system to generate an entire state machine response value, and the entire state machine response value can be used as a second factor in determining a known device distinction operation for the given target device for identification, a Bluetooth device identification system (DIS).
  14. In Paragraph 12, The above device identification system is a Bluetooth device identification system (DIS) that stores or dynamically generates a minimum distinguishable packet sequence (MDPS) that can be used to determine a query packet sequence capable of distinguishing two or more target devices having a full state machine configuration within an arbitrary similarity range.
  15. In Paragraph 13, The above device identification system is a Bluetooth device identification system (DIS) that stores or dynamically generates a minimum distinguishable packet sequence (MDPS) that can be used to determine a query packet sequence capable of distinguishing two or more target devices having a full state machine configuration within an arbitrary similarity range.
  16. In paragraph 2, The above process steps Determining whether a given identified target device has transmitted and/or will transmit a response packet containing one or more device-specific actual values, and if applicable, additionally including a step of masking the device-specific actual values when the corresponding response data values are stored in a database. Bluetooth Device Identification System (DIS).
  17. In paragraph 4, The above process steps Determining whether a given identified target device has transmitted and/or will transmit a response packet containing one or more device-specific actual values, and if applicable, masking the device-specific actual values when the corresponding response data values are stored in a database, and A step further comprising using one or more attributes of one or more response data values containing actual values per masked device (including, but not limited to, whether any of the response data values contain masked data values) as a second factor for determining a known device distinction behavior for a given target device for identification. Bluetooth Device Identification System (DIS).
  18. In paragraph 2, A Bluetooth device identification system (DIS) in which the processor, the memory, and at least one Bluetooth chip processor and/or field programmable gate array (FPGA) capable of receiving and interpreting Bluetooth signals are part of a single integrated circuit.
  19. In paragraph 4, A Bluetooth device identification system (DIS) in which the processor, the memory, and at least one Bluetooth chip processor and/or field programmable gate array (FPGA) capable of receiving and interpreting Bluetooth signals are part of a single integrated circuit.
  20. In Paragraph 12, A Bluetooth device identification system (DIS) that can more accurately identify a given target device by determining the actual sub-state configuration in response to a given state machine query packet, such that at least two of the total state machine configurations that may exist in a given target device are identical at the edges but have different internal sub-state configurations.

Description

Bluetooth Device Identification System and Method {SYSTEM FOR BLUETOOTH DEVICE IDENTIFICATION AND PROCESS THEREFOR} Statements regarding U.S. federal government-funded research or development : Not applicable. Copyright Notice : Part of this disclosure contains copyrighted material. The copyright holder does not object to anyone copying or reproducing the patent document or patent disclosure in the exact form described in the patent file or record of the Patent Office, but retains all other copyright rights. 37 CFR 1.71(d). The present invention relates to a computing system and a method configured for identifying a Bluetooth device, and more specifically, to a computing system and a method configured for identifying a Bluetooth device utilizing a plurality of Bluetooth protocols and other Bluetooth-related data. The Bluetooth radio protocol for information transmission was defined in 1999. Subsequent updates introduced Bluetooth Enhanced Data Rate (EDR), which was defined in 2004, and the existing Bluetooth radio protocol was retrospectively named Basic Rate (BR). These protocols are collectively referred to as Bluetooth BR/EDR. The Bluetooth Low Energy (BLE) protocol was defined in 2009 and added many new technologies and protocols that are incompatible with BR/EDR. These technologies and protocols are collectively referred to as BLE in this specification. Bluetooth defines a "profile" as "a document describing the essential functions and characteristics of each layer within the Bluetooth system"("Bluetooth Core Spec 6.0", (2024) https://www.bluetooth.com/specifications/specs/core-specification-6-0/ ). It also specifies that "profiles define vertical interactions between layers and peer-to-peer interactions of specific layers between devices." Therefore, Bluetooth profiles can be viewed as complementary specifications that go beyond the Bluetooth Core Spec. Profiles include additional data and behaviors that devices may optionally comply with to achieve interoperability. Profiles can be in a public and standardized form, or in a private and vendor-specific form. Existing research on Bluetooth device identification is classified into four categories. Category 1 Bluetooth device identification systems are systems that aim to identify a single device over time, regardless of the device type. A common use case for these systems is to perform access control, allowing access to an authorized single device while blocking access from other devices attempting to impersonate the authorized device. Examples of such systems include US 2022/312507 A1 (Wang et al.) and US 2021/058393 A1 (Alpert et al.). Another common use case is tracking a single device over time, even though the default Bluetooth device address (BDADDR) is designed to change over time to intentionally make tracking difficult. An example of this is US 2020/236004 A1 (Tavares et al.). Unlike the current systems disclosed in this specification, these systems do not deal with distinguishing and identifying, for example, an Apple® iPhone and a Samsung® TV. A Category 2 Bluetooth device identification system is a system that aims to generate a fingerprint of a specific device based on the device's unique radio characteristics. This category often overlaps with Category 1 (e.g., US 2022/312507 A1 (Wang et al.) and US 2021/058393 A1 (Alpert et al.) both use such techniques). The system of the invention disclosed herein may include such a fingerprint system as another source of multiple information sources, but this information is not a high-priority data source. This is because such information contributes primarily to identifying individual devices (e.g., Device #1 versus Device #2) over time, but does not contribute significantly to identifying the type of the device. In other words, it is not a strong signal to distinguish that Device #1 is an iPhone and Device #2 is a TV. Physical layer characteristic fingerprint recognition is more suitable for distinguishing that Device #1 uses Bluetooth chip vendor #1 and Device #2 uses Bluetooth chip vendor #2, as it better represents the Bluetooth chip radio hardware. However, this is merely one aspect of the overall device identification achieved by the system of the present invention. A Category 3 Bluetooth device identification system is a system that uses a single data source to generate a device ID (DID) "fingerprint" for a device to be identified (DTI). Examples include " Automatic Fingerprinting of Vulnerable BLE IoT Devices with Static UUIDs from Mobile Apps " (2019) ( https://web.archive.org/web/20191124060800/https://web.cse.ohio-state.edu/~lin.3021/file/CCS19a.pdf ) by Zuo et al. and " Fingerprinting Bluetooth-Low-Energy Devices Based on the Generic Attribute Profile " (2021) (https://inria.hal.science/hal-02359914/file/paper.pdf) by Celosia and Cunche. Both papers use the Generic Attribute Profile (GATT) as a single data source. GATT information consists of a hierarchical structure of "Services" and "Cha