CN112640513B - Method and device for detecting Bluetooth vulnerability attack - Google Patents

Abstract

The application discloses a method and a device for detecting Bluetooth vulnerability attack, which can realize man-in-the-middle attack detection aiming at different communication stages involved in a Bluetooth protocol and solve the problem that effective precautionary measures aiming at the Bluetooth man-in-the-middle attack are rare in the prior art. The method comprises the following steps: identifying the Bluetooth equipment to be detected in a preset range, and determining the Bluetooth equipment pair to be detected according to the pairing result of the Bluetooth equipment to be detected; acquiring and analyzing first communication data from a communication data transmitting device in the first Bluetooth device pair, and acquiring and analyzing second communication data from a communication data receiving device in the first Bluetooth device pair; and judging whether the first communication data is the same as the second communication data, and if not, determining that the first Bluetooth equipment attacks the man-in-the-middle.

Description

Method and device for detecting Bluetooth vulnerability attack

technical field

The present application relates to the field of communication technologies, and in particular, to a method and device for detecting a Bluetooth vulnerability attack.

Background technique

Bluetooth is a technology for low-cost, short-range wireless communication between mobile phones and other accessories. With the continuous development of smart phones, smart homes, and smart medical care, the application scenarios of Bluetooth communication continue to expand, and devices with Bluetooth functions have penetrated into all aspects of daily work and life. The subsequent Bluetooth attacks are also increasing, and Bluetooth vulnerabilities have become Disclosing an important part of the vulnerability library and preventing the harm caused by Bluetooth vulnerability attacks has also become one of the important tasks of related equipment manufacturers.

At present, with the development of Bluetooth technology, the attack technologies against Bluetooth are also evolving, mainly including replay attacks, denial-of-service attacks, and man-in-the-middle attacks. Among many attack technologies, man-in-the-middle attack is a commonly used technique. Man-in-the-middle attacks can monitor, collect and even tamper with the communication content of the two communication parties, interrupting normal communication, while the communication parties are often difficult to find and think that they are still in normal communication. , for the man-in-the-middle attack, the current preventive measures are very limited, and the effect is minimal, and the effective preventive measures against the Bluetooth man-in-the-middle attack are even rarer.

SUMMARY OF THE INVENTION

The present application provides a method and device for detecting Bluetooth vulnerability attacks, so as to solve the problem that effective preventive measures against Bluetooth man-in-the-middle attacks are scarce in the prior art.

In a first aspect, an embodiment of the present application provides a method for detecting a Bluetooth vulnerability attack, including: identifying a Bluetooth device to be detected within a preset range, and determining a to-be-detected Bluetooth device according to a pairwise pairing result of the to-be-detected Bluetooth device. The pair of Bluetooth devices; the first communication data is collected and parsed from the communication data sending device in the first Bluetooth device pair, and the second communication data is collected and parsed from the communication data receiving device in the first Bluetooth device pair. ; wherein, the first pair of bluetooth devices is any pair of bluetooth devices to be detected, the first communication data is the communication data sent by the communication data sending device to the communication data receiving device through a Bluetooth connection, and the The second communication data is the communication data that is received by the communication data receiving device through the Bluetooth connection and carries the identification information of the communication data sending device; determine whether the first communication data and the second communication data are the same, if not Similarly, it is determined that there is a man-in-the-middle attack on the first pair of Bluetooth devices.

Based on the above technical solutions, for different communication stages involved in the Bluetooth protocol, the communication data in the same communication stage when the communication data transmitting device and the communication data receiving device in the first Bluetooth device pair are collected and analyzed are obtained during Bluetooth communication, That is, the first communication data and the second communication data, if there is no man-in-the-middle attack between the communication data sending device and the communication data receiving device, the communication data of the communication data sending device and the communication data receiving device in the same communication stage should be the same. If there is a man-in-the-middle attack between the communication data sending device and the communication data receiving device, the middle man will tamper with the communication data in the same communication stage when the communication data sending device and the communication data receiving device are conducting Bluetooth communication, resulting in the same communication stage. The communication data of the communication data sending device is different from the communication data of the communication data receiving device. By judging whether the first communication data and the second communication data are the same, it is determined whether there is a man-in-the-middle attack on the first Bluetooth device. From the perspective of the layered characteristics of the Bluetooth protocol, the method provided by the embodiment of the present application expands the applicable scope of the man-in-the-middle attack detection. Attack detection. And the detection device only needs to have the function of collection and analysis and data comparison, and does not need to have complex functions such as cryptographic algorithm negotiation, data encryption and decryption, and device pairing, and the cost is low.

In a possible design, the first communication data is collected and parsed from the communication data sending device in the first Bluetooth device pair, and the first communication data is collected and parsed from the communication data receiving device in the first Bluetooth device pair. The second communication data includes: when the first Bluetooth device pair performs encryption key negotiation, collecting all encryption key length negotiation requests sent by the communication data transmission device through the Bluetooth connection from the communication data transmission device, Collect all encryption key length negotiation requests received by the communication data receiving device through the Bluetooth connection from the communication data receiving device; The first encryption key length negotiation request sent to the communication data receiving device is determined from all the encryption key length negotiation requests sent by the data sending device through the Bluetooth connection, and all encryption keys received from the communication data receiving device through the Bluetooth connection are determined. The second encryption key length negotiation request carrying the identification information of the communication data sending device is determined in the key length negotiation request; it is determined that the first encryption key length in the first encryption key length negotiation request is the the first communication data, and determining that the second encryption key length in the second encryption key length negotiation request is the second communication data.

In a possible design, the judging whether the first communication data and the second communication data are the same, and if not, determining that the first Bluetooth device has a man-in-the-middle attack, including: judging the first encryption Whether the length of the key is the same as the length of the second encryption key; if the length of the first encryption key is not the same as the length of the second encryption key, it is determined that there is a man-in-the-middle attack on the first Bluetooth device pair.

In a possible design, the first communication data is collected and parsed from the communication data sending device in the first Bluetooth device pair, and the first communication data is collected and parsed from the communication data receiving device in the first Bluetooth device pair. The second communication data includes: collecting all communication data sent by the communication data sending device through the Bluetooth connection from the communication data sending device in the first Bluetooth device pair, and receiving the communication data from the communication data receiving device in the first Bluetooth device pair All communication data received by the communication data receiving device through the Bluetooth connection is collected at the The first communication data is determined from the communication data, and the second communication data is determined from all the communication data received by the communication data receiving device through the Bluetooth connection.

In a possible design, the identifying a Bluetooth device to be detected within a preset range includes: acquiring a Bluetooth broadcast message of the Bluetooth device within the preset range; wherein the Bluetooth broadcast message carries the information of the Bluetooth device. identification information; according to the Bluetooth broadcast message, determine the Bluetooth device to be detected within the preset range.

In a possible design, after determining that the first Bluetooth device pair has a man-in-the-middle attack, the method further includes: judging whether the first Bluetooth device pair has encrypted session data; if there is encrypted session data, determining The first Bluetooth device pair has a man-in-the-middle attack and the attack is successful; if there is no encrypted session data, it is determined that the first Bluetooth device pair has a man-in-the-middle attack but the attack is unsuccessful.

In a possible design, the judging whether there is encrypted session data includes: starting encrypted transmission if the communication data sending device is collected from the communication data sending device and sent to the communication data receiving device through a Bluetooth connection. request, or a request to start encrypted transmission that carries the identification information of the communication data sending device and is received by the communication data receiving device through a Bluetooth connection and is collected from the communication data receiving device, then it is determined that encrypted session data exists; or, The communication data between the communication data sending device and the communication data receiving device is collected and analyzed, and whether there is encrypted session data is determined according to the statistical characteristics of the communication data.

Based on the above technical solution, for the encryption key negotiation stage involved in the Bluetooth protocol, collect and parse out the encryption key negotiation between the communication data sending device and the communication data receiving device in the first Bluetooth device pair during Bluetooth communication. Communication data, that is, the length of the first encryption key and the length of the second encryption key, by judging whether the length of the first encryption key and the length of the second encryption key are the same, determine whether there is a man-in-the-middle attack on the first Bluetooth device, and realize the encryption Man-in-the-middle attack detection during key negotiation phase.

In a possible design, the first communication data is collected and parsed from the communication data sending device in the first Bluetooth device pair, and the first communication data is collected and parsed from the communication data receiving device in the first Bluetooth device pair. The second communication data includes: collecting first bidirectional communication data between the communication data transmission device and the communication data reception device from the communication data transmission device when the first Bluetooth device pair performs encrypted transmission , collect the second two-way communication data between the communication data receiving device and the communication data sending device from the communication data receiving device; according to the first two-way communication data and the second two-way communication data, determine The first encrypted session data and the second encrypted session data are used as the first communication data and the second communication data, respectively.

In a possible design, the judging whether the first communication data and the second communication data are the same, and if not, determining that the first Bluetooth device has a man-in-the-middle attack, including: judging the first encryption Whether the session data is the same as the second encrypted session data; if the first encrypted session data is the same as the second encrypted session data, it is determined that there is no man-in-the-middle attack on the first Bluetooth device; If the encrypted session data is different from the second encrypted session data, it is determined that there is a man-in-the-middle attack on the first Bluetooth device.

Based on the above technical solution, for the encrypted transmission stage involved in the Bluetooth protocol, the communication data in the encrypted transmission of the communication data transmitting device and the communication data receiving device in the first Bluetooth device pair during the Bluetooth communication is collected and analyzed, that is, The first encrypted session data and the second encrypted session data are determined whether there is a man-in-the-middle attack on the first Bluetooth device by judging whether the first encrypted session data and the second encrypted session data are the same, so as to realize the man-in-the-middle attack detection after the encrypted session is established.

In a second aspect, the present application further provides a device for detecting a Bluetooth vulnerability attack, the device for detecting a Bluetooth vulnerability attack having a function of implementing the first aspect or any possible method in design of the first aspect, the function It can be realized by hardware, or can be realized by executing corresponding software by hardware. The hardware or software includes one or more modules corresponding to the above functions, such as a first determination module, a collection and analysis module, and a second determination module.

The first determining module is used to identify the Bluetooth devices to be detected within a preset range, and to determine the pair of Bluetooth devices to be detected according to the result of pairing the Bluetooth devices to be detected in pairs;

The collection and analysis module is used to collect and parse the first communication data from the communication data sending device in the first Bluetooth device pair, and collect and parse the first communication data from the communication data receiving device in the first Bluetooth device pair. Two communication data; wherein, the first Bluetooth device pair is any Bluetooth device pair to be detected, and the first communication data is communication data sent by the communication data sending device to the communication data receiving device through a Bluetooth connection , the second communication data is the communication data that carries the identification information of the communication data sending device and is received by the communication data receiving device through a Bluetooth connection;

The second determining module is configured to determine whether the first communication data and the second communication data are the same, and if not, determine that there is a man-in-the-middle attack on the first Bluetooth device.

In a possible design, the collection and analysis module is specifically configured to: collect the communication data transmission device from the communication data transmission device and connect via Bluetooth when the first Bluetooth device pair performs encryption key negotiation. All encryption key length negotiation requests sent, collect all encryption key length negotiation requests received by the communication data receiving device through the Bluetooth connection from the communication data receiving device; send the device and the communication data according to the communication data The identification information of the receiving device, the first encryption key length negotiation request sent to the communication data receiving device is determined from all the encryption key length negotiation requests sent by the communication data sending device through the Bluetooth connection, and the first encryption key length negotiation request sent to the communication data receiving device is determined from the communication data. The receiving device determines the second encryption key length negotiation request that carries the identification information of the communication data sending device from all the encryption key length negotiation requests received through the Bluetooth connection; it is determined that the first encryption key length negotiation request contains The first encryption key length is the first communication data, and it is determined that the second encryption key length in the second encryption key length negotiation request is the second communication data.

In a possible design, the second determination module is specifically configured to: determine whether the length of the first encryption key is the same as the length of the second encryption key; if the length of the first encryption key is the same as the length of the second encryption key; If the length of the second encryption key is different, it is determined that there is a man-in-the-middle attack on the first Bluetooth device.

In a possible design, the collection and analysis module is specifically configured to: collect all communication data sent by the communication data transmission device through the Bluetooth connection from the communication data transmission device in the first Bluetooth device pair, and from the first Bluetooth device pair. The communication data receiving device in a Bluetooth device pair collects all the communication data received by the communication data receiving device through the Bluetooth connection; The first communication data is determined from all communication data sent by the sending device through the Bluetooth connection, and the second communication data is determined from all the communication data received by the communication data receiving device through the Bluetooth connection.

In a possible design, the first determining module is specifically configured to: obtain a Bluetooth broadcast message of a Bluetooth device to be detected within a preset range; wherein, the Bluetooth broadcast message carries the identification information of the Bluetooth device; according to The Bluetooth broadcast message determines the Bluetooth device to be detected within a preset range.

In a possible design, after determining that there is a man-in-the-middle attack on the first Bluetooth device pair, the second determining module is further configured to: determine whether the first Bluetooth device pair has encrypted session data; if there is encrypted session data, Then it is determined that there is a man-in-the-middle attack on the first Bluetooth device pair and the attack is successful; if there is no encrypted session data, it is determined that there is a man-in-the-middle attack on the first Bluetooth device pair but the attack is unsuccessful.

In a possible design, after the second determination module determines that the first Bluetooth device has a man-in-the-middle attack, it is specifically used for: if the communication data transmission device is collected from the communication data transmission device and connected through Bluetooth A request to start encrypted transmission sent to the communication data receiving device, or a start encryption received by the communication data receiving device through a Bluetooth connection and carrying the identification information of the communication data sending device collected from the communication data receiving device If there is a transmission request, it is determined that encrypted session data exists; or, the communication data between the communication data sending device and the communication data receiving device is collected and analyzed, and whether there is encrypted session data is determined according to the statistical characteristics of the communication data. .

In a possible design, the collection and analysis module is specifically configured to: collect the communication data transmission device and the communication data from the communication data transmission device when the first Bluetooth device pair performs encrypted transmission. receiving the first two-way communication data between the devices, and collecting the second two-way communication data between the communication data receiving device and the communication data sending device from the communication data receiving device; according to the first two-way communication data and the second bidirectional communication data, determining the first encrypted session data and the second encrypted session data as the first communication data and the second communication data, respectively.

In a possible design, the second determination module is specifically configured to: determine whether the first encrypted session data is the same as the second encrypted session data; if the first encrypted session data is the same as the second encrypted session data If the encrypted session data is the same, it is determined that there is no man-in-the-middle attack on the first Bluetooth device pair; if the first encrypted session data and the second encrypted session data are different, it is determined that there is a man-in-the-middle attack on the first Bluetooth device pair .

In a third aspect, the present application further provides a device for detecting a Bluetooth vulnerability attack, the device for detecting a Bluetooth vulnerability attack may include: at least one processor; and a memory and a communication interface communicatively connected to the at least one processor; Wherein, the memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the first aspect or any one of the possible first aspects by executing the instructions stored in the memory. The function of the method in the design.

In a fourth aspect, the present application further provides a computer-readable storage medium, where the computer-readable storage medium includes a computer program, and when the computer program runs on a computer, causes the computer to execute the first aspect or the first aspect. Any possible in-design approach.

In a fifth aspect, the present application further provides a program product that, when the program product runs on a computer, causes the computer to execute the first aspect or any possible method in design of the first aspect.

In a sixth aspect, the present application further provides a chip, which can be coupled to a memory of a device for detecting a Bluetooth vulnerability attack, and is used to call a computer program stored in the memory and execute the first aspect or any one of the first aspects. possible in-design methods.

Description of drawings

FIG. 1 is a schematic diagram of the principle of an existing SSL man-in-the-middle attack;

2 is a schematic diagram of a system architecture provided by an embodiment of the present application;

3 is a schematic diagram of a user interface provided by an embodiment of the present application;

4 is a schematic diagram of another user interface provided by an embodiment of the present application;

5 is a schematic flowchart of a method for detecting a Bluetooth vulnerability attack provided by an embodiment of the present application;

FIG. 6a is a schematic diagram of the principle of a Bluetooth communication provided by an embodiment of the application;

6b is a schematic diagram of a Bluetooth vulnerability attack in an encryption key negotiation stage provided by an embodiment of the present application;

6c is a schematic diagram of a Bluetooth vulnerability attack in an encrypted transmission phase provided by an embodiment of the present application;

7 is a schematic structural diagram of an apparatus for detecting a Bluetooth vulnerability attack provided by an embodiment of the present application;

FIG. 8 is a schematic structural diagram of another apparatus for detecting a Bluetooth vulnerability attack according to an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application.

In order to facilitate understanding of the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained below first.

Along with the development of Bluetooth (bluetooth, BT) technology, the attack technology for Bluetooth also evolves continuously, mainly including attack technology such as replay attack, denial of service attack and man-in-the-middle attack.

1. Replay attack

Replay attack, also known as replay attack or replay attack, means that the attacker sends a data packet that the destination host has received to the system to deceive the system. It is mainly used to destroy the correctness of the authentication during the authentication process. Replay attacks can be carried out by the initiator or by an attacker who intercepts and resends the packets. The attacker uses network monitoring or other methods to steal the authentication credentials, and then resend the authentication credentials to the authentication server. Replay attacks can occur in any network communication process and are one of the common attack methods used by hackers in the computer world.

The denial of service attack

A denial of service attack means that the attacker tries to stop the target machine from providing services. It is one of the commonly used attack methods by hackers.

3. Man-in-the-Middle Attack ("MITM attack")

MITM attack is an "indirect" intrusion attack. This attack mode is to virtually place a computer controlled by an intruder between two communicating computers in a network connection through various technical means. This computer is called for the "middleman". In short, the so-called MITM attack is to intercept normal network communication data, and perform data tampering and sniffing, without the two parties of the communication knowing. MITM attack is a long-standing network attack technology, and there is still extensive room for development, such as server message block (SMB) session hijacking, domain name system (domain name system, DNS) spoofing and other attacks are typical MITM attack.

With the complexity of network technology, MITM attacks are becoming more and more diverse. Initially, networks such as hypertext transfer protocol (HTTP), file transfer protocol (FTP), and Telnet are all plaintext transmissions. Attackers only need to set the computer's network card to promiscuous mode and pretend to be a proxy server. Traffic monitoring can complete the attack. Later, with the widespread use of switches, man-in-the-middle attacks based on sniffing have been unsuccessful, and address resolution protocol (ARP) spoofing must be performed first. Now, most network service providers (such as online banking, mailboxes, social software, browsers, etc.) use encrypted communication methods based on secure sockets layer (SSL) protocols, such as hypertext transfer protocol secure (hyperTexttransfer protocol secure). , HTTPS), file transfer protocol secure (file transfer protocolsecure, FTPS), etc., are encryption protocols built on SSL. As shown in Figure 1, which is a schematic diagram of the existing SSL man-in-the-middle attack, a man-in-the-middle attack on the communication between the client and the server requires more complex operations. In the process of establishing communication between the client and the server, if a man-in-the-middle attack occurs, the actual communication process is: the client establishes communication with the middleman, the server establishes communication with the middleman; and the middleman pretends to be the client and establishes SSL communication with the server, and the middleman forges The certificate establishes SSL communication with the client. Realize that the client thinks that it is communicating with the server, and the server thinks that it is communicating with the client, and then the middleman exchanges keys with the communication parties respectively, establishes an encrypted transmission channel, and completes the attack.

It can be seen that the current man-in-the-middle attack detection technology is mainly aimed at the SSL protocol in the TCP protocol stack, and needs to combine multiple links involved in the SSL encryption protocol. Therefore, the detection technologies for such man-in-the-middle attacks include: certificate verification-based man-in-the-middle detection technology , DNS man-in-the-middle detection based on trusted address list, and man-in-the-middle detection technology based on HTTP proxy server identification. To enhance the detection effect, the above methods can be used in combination, such as SSL man-in-the-middle attack detection technology based on the combination of certificate and trusted address list. Compared with the IP encryption communication protocol SSL protocol, as the Bluetooth protocol for short-distance wireless communication, there are few researches on the man-in-the-middle detection method.

In view of this, the embodiments of the present application implement effective preventive measures against the man-in-the-middle attack against Bluetooth by performing man-in-the-middle attack detection on the encryption key negotiation and encrypted transmission involved in the Bluetooth protocol.

It should be understood that the embodiments of the present application can be applied to a system for detecting a Bluetooth vulnerability attack. The system includes an electronic device and at least two Bluetooth devices, and the electronic device is used to perform Bluetooth vulnerability attack detection on the Bluetooth communication between the Bluetooth devices ( That is, the method of the embodiment of the present application is implemented).

或者其它操作系统的便携式电子设备。上述便携式电子设备也可以是其它便携式电子设备，诸如具有触敏表面(例如触控面板)的膝上型计算机(laptop)等。还应当理解的是，在本申请其他一些实施例中，上述电子设备也可以不是便携式电子设备，而是具有触敏表面(例如触控面板)的台式计算机。还应当理解的是，在本申请实施例中电子设备可以支持蓝牙功能，也可以是不支持蓝牙功能，当电子设备支持蓝牙功能时，为了避免该电子设备本身被中间人攻击，该电子设备将关闭蓝牙功能。为了方便说明，本申请实施例以电子设备支持蓝牙功能为例。The electronic device may be a portable electronic device including functions such as a personal digital assistant and/or a music player, such as a mobile phone, a tablet computer, a wearable device (such as a smart watch) with a wireless communication function, and the like. Exemplary embodiments of portable electronic devices include, but are not limited to, carry-on

Or portable electronic devices with other operating systems. The portable electronic device described above may also be other portable electronic devices, such as a laptop or the like having a touch-sensitive surface (eg, a touch panel). It should also be understood that, in some other embodiments of the present application, the above-mentioned electronic device may not be a portable electronic device, but a desktop computer having a touch-sensitive surface (eg, a touch panel). It should also be understood that, in this embodiment of the present application, the electronic device may support the Bluetooth function or may not support the Bluetooth function. When the electronic device supports the Bluetooth function, in order to avoid the electronic device itself being attacked by a man-in-the-middle, the electronic device will be turned off. Bluetooth function. For convenience of description, the embodiment of the present application takes the electronic device supporting the Bluetooth function as an example.

Bluetooth devices may include mobile phones, Bluetooth headsets, Bluetooth mice, tablet computers, notebook computers, desktop computers, display screens, Bluetooth keyboards, Bluetooth printers, Bluetooth fax machines, Internet of Vehicles devices, etc. Take IoT devices as an example.

Exemplarily, as shown in FIG. 2 , which is a schematic diagram of a system architecture provided in an embodiment of the present application, the system includes an electronic device 100 and may also include a plurality of IoV devices. In FIG. 2 , three vehicles are exemplarily drawn. The connected devices are respectively the connected car device 200 , the connected car device 300 and the connected car device 400 . The specific form of the Internet of Vehicles device is not limited in the embodiments of the present application, and any device that performs Bluetooth communication in the Internet of Vehicles scenario can be used as the Internet of Vehicles device. Vehicle information (such as vehicle identification), road condition information, vehicle owner information, etc. can be transmitted between vehicles after a Bluetooth connection is established.

The connected vehicle device can also be a road facility. The road facility can be a speed measuring device or a monitoring device set on the side of the road, which can monitor the speed of passing vehicles. The road facility can also be a base station, and the base station can broadcast information to the passing vehicles, collect vehicle information or vehicle owner information of the passing vehicles, and the like. The road facility can also be an intelligent traffic light set at an intersection, and the intelligent traffic light can adjust the lighting time of the traffic light according to the real-time traffic flow at the intersection or road section. The road facility can also be an automatic toll station or an automatic gas station set on the roadside. The automatic toll station can obtain the information of the passing vehicles and deduct the fees for the passing vehicles. The automatic gas station can obtain the information of the vehicles that need to be refueled. After the information authentication of the vehicle is passed, the vehicle can be refueled and a charge deduction request can be initiated to the vehicle. In addition to interacting with vehicles, road facilities can also interact with other road facilities, such as between two smart traffic lights at adjacent intersections. One smart traffic light can connect to another smart traffic light after establishing a Bluetooth connection. The traffic flow of the road section is sent to another smart traffic light, and the other smart traffic light can adjust the lighting time of the traffic light according to the traffic flow of the intersection or road section after receiving the traffic flow.

In the system architecture shown in FIG. 2 , only the IoV device 200 and IoV device 300 are vehicles, and the IoV device 400 is a road facility as an example, the embodiments of the present application do not limit the types of IoV devices included in the system. quantity and form.

The electronic device 100 is used to perform Bluetooth vulnerability attack detection (ie, implement the method of the embodiment of the present application) on the Bluetooth communication between the Internet of Vehicles devices (such as the Internet of Vehicles device 200, the Internet of Vehicles device 300, and the Internet of Vehicles device 400). In this embodiment of the present application, the electronic device 100 may be connected to a car networking device (eg, the car networking device 200 , the car networking device 300 , and the car networking device 400 ). For example, the electronic device 100 is wired to a collection device placed on the Internet of Vehicles device 300. When the Internet of Vehicles device 300 communicates with the Internet of Vehicles device 200 via Bluetooth, the electronic device 100 can acquire the data collected on the Internet of Vehicles device 300 through wired transmission. The communication data of the Internet of Vehicles device 300 during Bluetooth communication collected by the acquisition device on the Internet of Vehicles device 300 can be acquired by the electronic device 100 through wireless transmission (for example, WiFi). 200 Communication data during Bluetooth communication. The electronic device 100 may also not be connected to the Internet of Vehicles device, which is not specifically limited in this embodiment of the present application. For convenience of description, the embodiment of the present application takes the electronic device 100 not connected to the Internet of Vehicles device as an example.

It should be understood that in this embodiment of the present application, because the acquisition technology used by the acquisition device is the air interface acquisition technology, it is only necessary to determine that the Internet of Vehicles device is within the effective range of the acquisition device, that is, the Internet of Vehicles device does not need to be modified. If the Internet of Vehicles device is a road If the IoV is a vehicle, because the vehicle is in a moving state for a long time, the acquisition device needs to be placed on the IoV device.

It should be understood that the electronic device 100 in this embodiment of the present application generally provides various functions for the user through an application program. Exemplarily, the application may be a system application (also referred to as a native application) or a third-party application. For example, drawing, presentation, word processing, gaming, telephony, video player, music player, email, instant messaging, photo management, camera, browser, calendar, clock, payment, marketplace, desktop and health management, etc. application. Exemplarily, the electronic device 100 in this embodiment of the present application may run multiple application programs at the same time.

Exemplarily, a in FIG. 3 is a schematic diagram of a graphical user interface according to an embodiment of the present application. Hereinafter, the graphical user interface is simply referred to as the user interface. The electronic device 100 displays the user interface through the display screen. Specifically, the user interface may be a main interface, a negative screen, or a user interface of an application, or the like. For example, the main interface may be a user interface 300 as shown in a in FIG. 3 . As shown in the figure, the user interface 300 may include a status bar 301, a time and weather widget 302, a hideable navigation bar 303, and icons of multiple applications such as a setting icon 304 and the like. Wherein, the status bar 301 may include the name of the operator (China Mobile), the mobile network (eg 4G), the time and the remaining power. In some other embodiments of the present application, the status bar 301 may include the name of the operator (China Mobile), the signal strength of the mobile network, the time and the remaining power. In some other embodiments of the present application, the status bar 301 may further include one or more of a Bluetooth icon, a WiFi icon, a screen lock icon, an external device icon, and the like. For example, taking the Bluetooth icon as an example, in the embodiment of the present application, the electronic device 100 may display the Bluetooth icon in the status bar 301 after the Bluetooth function is turned on, and do not display the Bluetooth icon in the status bar 301 when the Bluetooth function is turned off. The navigation bar 303 may include a back button, a home button, and a menu button for historical tasks. It is also understood that, in some other embodiments, the user interface 300 may also include a Dock bar. The Dock can include icons of commonly used applications, such as a phone icon, a short message icon, an email icon, and a weather icon. It should be understood that the user can set icons of commonly used applications in the Dock according to their own needs.

In some other embodiments, as shown in a in FIG. 3 , the electronic device 100 may further include a home screen key 305 . The home screen key 305 may be a physical key or a virtual key. The home screen key 305 is used to return the user interface of a certain application displayed on the display screen or a user interface such as a negative screen to the main interface according to the user's operation, so that the user can view the main interface at any time, and the user interface on the main interface can be easily checked. Controls (such as icons, etc.) to operate. The above operation may specifically be that the user presses the home screen key 305 . In some other embodiments of the present application, the home screen key 305 may also integrate a fingerprint sensor, so that when the user presses the home screen key 305, the electronic device 100 can perform fingerprint collection, thereby confirming the user's identity. In other embodiments, the electronic device 100 may not include the home key 305 .

Exemplarily, when the display screen of the electronic device 100 displays the user interface 300, the system setting interface may be displayed on the display screen in response to the user's touch operation on the setting icon 304. The system setting interface includes various function buttons, which are used to perform corresponding settings on the electronic device 100 . For example, the system setting interface may be a user interface 310 as shown in b in FIG. 3 , including a Bluetooth button 311 . In addition, the user interface 310 may further include function buttons such as account login, enabling cloud backup, and screen locking. The electronic device 100 may display a Bluetooth setting interface on the display screen in response to the user's operation of the Bluetooth button 311 . Among them, the bluetooth setting interface is used to turn on or turn off the bluetooth function.

Exemplarily, when the Bluetooth function of the electronic device 100 is not enabled, the Bluetooth setting interface may be the user interface 320 shown in c in FIG. 3 . As shown in c in FIG. 3 , the user interface 320 includes a Bluetooth button 321, and the Bluetooth button 321 is in an OFF state. When the Bluetooth button 321 is in an off state, the Bluetooth function of the electronic device 100 is not enabled. The electronic device 100 may turn the Bluetooth button 321 on (ON) in response to the user's operation of the Bluetooth button 321, thereby enabling the Bluetooth function. The Bluetooth setting interface may be the user interface 320 shown in d in FIG. 3, and the list of available devices 322 includes Sql, 200 and Watch.

In addition, in other embodiments, when the display screen of the electronic device 100 displays a certain user interface (eg, the user interface 300 ) after being locked or unlocked, the display screen may display a certain user interface (for example, the user interface 300 ) in response to the user's pull-down operation or pull-up operation. Quick settings user interface. Specifically, the shortcut setting interface includes shortcut buttons for setting various functions, such as a shortcut button for enabling or disabling the Bluetooth function. For example, the quick setting user interface may be the user interface 400 shown in FIG. 4 . The user interface 400 includes a Bluetooth button 401 . The electronic device 100 can turn on or turn off the Bluetooth function in response to the user's operation of the Bluetooth button 401 . For example, when the bluetooth function is not turned on, the electronic device 100 can turn on the bluetooth function in response to the user's operation on the bluetooth button 401 . For another example, when the bluetooth function is turned on, the electronic device 100 can turn off the bluetooth function in response to the user's operation on the bluetooth button 401 . In addition, in some embodiments, the user interface 400 may further include function buttons such as WiFi, personal hotspot, airplane mode, do not disturb, ringtone, mobile data, brightness adjustment, etc., so that the user can quickly set corresponding functions. It should be noted that, in the embodiment of the present application, the electronic device 100 may also enable or disable the Bluetooth function in other ways, such as voice commands, shortcut gesture operations, etc., which are not limited.

The electronic device and the Internet of Vehicles device provided by the embodiments of the present application are described above. Next, the method for detecting a Bluetooth vulnerability attack provided by the embodiments of the present application is introduced with reference to the accompanying drawings.

It should be understood that the terms "first" and "second" in the embodiments of the present application are only used for description purposes, and cannot be interpreted as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may expressly or implicitly include one or more of that feature. "At least one" means one or more, and "plurality" means two or more. "And/or", which describes the association relationship of the associated objects, indicates that there can be three kinds of relationships, for example, A and/or B, which can indicate: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A, B can be singular or plural. The character "/" generally indicates that the associated objects are an "or" relationship. "At least one item(s) below" or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (a) of a, b, or c may represent: a, b, c, a and b, a and c, b and c, or a and b and c.

As shown in FIG. 5 , a schematic flowchart of a method for detecting a Bluetooth vulnerability attack provided by an embodiment of the present application, the method for detecting a Bluetooth vulnerability attack may be applied to the above-mentioned FIG. 2-FIG. 4 in a system with a similar functional structure. The specific process of the method for detecting a Bluetooth vulnerability attack is described as follows.

S501. The electronic device 100 identifies a Bluetooth device to be detected within a preset range.

In some embodiments, when the IoV device has the Bluetooth function enabled, it will broadcast a message, and the electronic device 100 can receive IoV devices (eg, the IoV device 200 , the IoV device 300 , the IoV device 300 , the IoV device 300 , the IoV device 300 , the IoV device 200 , the IoV device 300 , the IoV device 200 , the IoV device 300 , the IoV device 200 , the IoV device 300 The broadcast message of the device 400 ), wherein the IoV device with the Bluetooth function turned on within the preset range can periodically broadcast the message, which is helpful for the electronic device 100 to identify and discover.

It should be noted that, in this embodiment of the present application, the broadcast message may be a specific Bluetooth broadcast. The Bluetooth broadcast may be a connectable undirected event type and may include broadcast data and scan response data. Alternatively, the Bluetooth broadcast may be a scannableundirected event type, also known as a discoverable broadcast, which cannot be used to initiate a Bluetooth connection, but allows other devices to scan for devices sending the broadcast, but not A Bluetooth connection is established based on this broadcast. Of course, the broadcast message may also be other content, which is not limited here.

Taking the electronic device 100 receiving the broadcast message of the Internet of Vehicles device 200 as an example, the broadcast message of the Internet of Vehicles device 200 includes the device identification of the Internet of Vehicles device 200. Specifically, the device identification is the information used to uniquely identify the Internet of Vehicles device, wherein, If the IoV device 200 is a vehicle, the identifier of the IoV device 200 may be a license plate and a vehicle identification number (VIN). If the IoV device 200 is a road facility, the identifier of the IoV device 200 may also be a device of a road facility logo. The embodiments of the present application do not limit the type of identification, and any information that can identify the IoV device 200 is applicable to the embodiments of the present application. It should be understood that when the electronic device 100 receives the broadcast message of the Internet of Vehicles device 200, the electronic device 100 determines that the Internet of Vehicles device 200 is a Bluetooth device to be detected within a preset range.

It should be noted that, in this embodiment of the present application, the electronic device 100 may also broadcast an identification request, so that the IoV devices (such as the IoV device 200 , the IoV device 300 , the IoV device 400 ) that have the Bluetooth function enabled within a preset range ) after receiving the identification request, send an identification response to the electronic device 100, so that the electronic device 100 discovers a connected vehicle device with the Bluetooth function enabled within a preset range.

It should be noted that, in this embodiment of the present application, the electronic device 100 is used as a device for detecting Bluetooth vulnerability attacks. In order to prevent the electronic device 100 from being attacked by a man-in-the-middle, the electronic device 100 will turn off the Bluetooth function. For example, the electronic device 100 may respond to the user's The operation of the first bluetooth button displays a bluetooth setting interface on the display screen, wherein the bluetooth setting interface includes a function key for enabling or disabling the bluetooth function (for example: the second bluetooth button), when the second bluetooth button is turned off (OFF) In the state, the Bluetooth function of the electronic device 100 is not enabled, and the electronic device 100 can turn off the second Bluetooth button in response to the user's operation of the second Bluetooth button, thereby turning off the Bluetooth function.

S502: Determine the pair of Bluetooth devices to be detected according to the result of pairing the Bluetooth devices to be detected.

In some embodiments, the electronic device 100 may perform two steps according to the Internet of Vehicles device after recognizing the Internet of Vehicles devices (such as the Internet of Vehicles device 200 , the Internet of Vehicles device 300 , and the Internet of Vehicles device 400 ) with the Bluetooth function turned on within a preset range. Based on the results of the two pairings, the pair of Bluetooth devices to be detected is determined, so that any Bluetooth device pair to be detected is detected for Bluetooth vulnerability attacks to determine whether there is a man-in-the-middle attack between the pair of Bluetooth devices. Specifically, if the electronic device 100 determines that the IoV devices with the Bluetooth function turned on within the preset range are the IoV device 200, the IoV device 300, and the IoV device 400, then according to the IoV device 200, IoV device 300 and IoV device 400 As a result of pairing the devices 400, it is determined that the pair of Bluetooth devices to be detected are the IoV device 200 and IoV device 300, the IoV device 200 and IoV device 400, the IoV device 300 and IoV device 400, and the electronic device 100 Any one of the pair of Bluetooth devices to be detected can be detected.

Taking the IoV device 200 as an example, when the IoV device 200 has the Bluetooth function enabled, it can be scanned and discovered as a slave device (slave) by a nearby IoV device with the Bluetooth function enabled, or it can be used as a master device (master) to scan and discover nearby IoV devices. Connected vehicles with Bluetooth enabled. Exemplarily, if both the IoV device 200 and the IoV device 300 have the Bluetooth function enabled, and the IoV device 300 is located near the IoV device 200, the IoV device 200 is the master device and the IoV device 300 is the slave device, The IoV device 200 can perform a device scanning process to discover the IoV device 300 after the Bluetooth function is enabled, so that the IoV device 200 can establish a Bluetooth connection with the IoV device 300 . If the IoV device 200 and the IoV device 300 are both Bluetooth devices to be detected within the preset range determined by the electronic device 100, after the IoV device 200 and the IoV device 300 establish a Bluetooth connection, the electronic device 100 can connect to the vehicle The Bluetooth communication between the Internet-connected device 200 and the car-connected device 300 is detected.

It should be noted that, in the embodiment of the present application, after the IoV device 200 enables the Bluetooth function, the user interface displayed on the operable display screen of the IoV device 200 may include that the IoV device 200 can currently be connected to nearby IoVs. The prompt information of device discovery, the list of available devices, etc., wherein, the list of available devices includes at least one device identifier, and each device identifier is used to identify a nearby IoV device that has been scanned and discovered by the IoV device 200 with the Bluetooth function turned on, so that there are To help prompt the user, the device ID can include one or more of the device name, device type, or MAC address, etc. The device ID can be presented to the user in the form of graphics or text in the list of available devices, and the device name can be the device model. , or can be set by the user, which is not limited. For example, the IoV device 200 scans and finds the IoV device 300 and IoV device 400, wherein the IoV device 300 is identified as 300 and the IoV device 400 is identified as 400. The device list includes 300 and 400, and the available device list can be updated according to the electronic devices found by the IoV device 200 by scanning. After the IoV device 200 scans and updates the list of available devices according to the scan result, the IoV device 200 may select to establish a connection with any IoV device 300 and the IoV device 400 in response to the user's operation on the list of available devices. Bluetooth connection.

It should be noted that, in this embodiment of the present application, the IoV device 200 may perform the device scanning process in the following manner:

Mode 1, the IoV device 200 as the master device broadcasts a scan request after the Bluetooth function is turned on, and a nearby IoV device (such as the IoV device 300 ) with the Bluetooth function turned on can serve as a slave device after receiving the scan request. The Internet-connected device 200 sends a scan response, so that the Internet-of-Vehicle device 200 discovers a nearby electronic device with the Bluetooth function turned on;

In a second way, the IoV device 200 as the master device can receive broadcast messages from nearby IoV devices (slave devices) with the Bluetooth function enabled after the Bluetooth function is enabled, without sending a scan request. Among them, the nearby IoV devices with the Bluetooth function turned on can periodically broadcast messages, which is helpful for other electronic devices with the Bluetooth function turned on to scan and discover. For example, after the Bluetooth function is turned on, the Internet of Vehicles device 200 receives a broadcast message from the Internet of Vehicles device 300 , so as to scan and discover the Internet of Vehicles device 300 .

S503: Collect and parse the first communication data from the communication data sending device in the first Bluetooth device pair, collect and parse the second communication data from the communication data receiving device in the first Bluetooth device pair, and determine the first communication data Whether the data is the same as the second communication data, if not, it is determined that there is a man-in-the-middle attack on the first Bluetooth device.

In some embodiments, after the electronic device 100 determines the pair of Bluetooth devices to be detected according to the result of paired pairing of IoV devices, the electronic device 100 can respectively send and receive communication data from any pair of Bluetooth devices to be detected. The device collects and parses the communication data. If the communication data is not collected and parsed, it is determined that the two Bluetooth devices in the Bluetooth device pair have not established a Bluetooth connection. If the communication data is collected and parsed, it is determined whether the communication data is The same, determine whether there is a man-in-the-middle attack in the pair of Bluetooth devices according to the judgment result, for example, collect and parse the first communication data from the communication data sending device in the first pair of Bluetooth devices, and receive the communication data from the first pair of Bluetooth devices. The device collects and parses the second communication data, wherein the first communication data is the communication data sent by the communication data sending device to the communication data receiving device, and the second communication data is the communication data received by the communication data receiving device and carrying the communication data sending device. For the communication data of the identification information, it is judged whether the first communication data is the same as the second communication data, and according to the judgment result, it is determined whether there is a man-in-the-middle attack on the first Bluetooth device.

It should be noted that, in the embodiment of the present application, when any Bluetooth device pair to be detected is detected for Bluetooth vulnerability attack, the identification information of the two Bluetooth devices in the Bluetooth device pair may be determined first, and the identification information may be used according to the identification information. Obtain the data to be compared from two Bluetooth devices. For example, all communication data sent from the communication data sending device in the first pair of Bluetooth devices may be collected and sent, and all communication data received by the communication data receiving device may be collected from the communication data receiving device in the first Bluetooth device pair, and according to the communication data The identification information of the sending device and the communication data receiving device, the first communication data sent to the communication data receiving device is determined from all the communication data sent by the communication data sending device, and the first communication data sent to the communication data receiving device is determined from all the communication data received by the communication data receiving device. The communication data transmits the second communication data of the identification information of the device. If the Bluetooth vulnerability attack detection is performed when the first Bluetooth device pair performs encryption key negotiation, the above-mentioned communication data may be the encryption key length in the encryption key length negotiation request. Bluetooth vulnerability attack detection, the above communication data can be encrypted session data.

Taking the first Bluetooth device pair as the Internet of Vehicles device 200 and the Internet of Vehicles device 300 as an example, collect all the communication data sent and received by the Internet of Vehicles device 200 from the Internet of Vehicles device 200 , and collect the data sent by the Internet of Vehicles device 300 from the Internet of Vehicles device 300 And all the communication data received, according to the identification information of the car networking device 200 and the car networking device 300, from all the communication data sent and received by the car networking device 200, the car networking device 200 sent to the car networking device 300 and received from the car networking device 300 are screened out. For the communication data of the Internet of Vehicles device 300 , the communication data sent by the Internet of Vehicles device 300 to and received from the Internet of Vehicles device 200 is filtered from all the communication data sent and received by the Internet of Vehicles device 300 .

It should be noted that, in this embodiment of the present application, the first communication data and the second communication data are the communication between the communication data transmitting device and the communication data receiving device in the first Bluetooth device pair in the same communication stage when performing Bluetooth communication. For example, the communication data in the encryption key negotiation stage or the encrypted transmission stage during the Bluetooth communication between the communication data sending device and the communication data receiving device, if there is no man-in-the-middle attack between the communication data sending device and the communication data receiving device, then The first communication data and the second communication data should be the same. If there is a man-in-the-middle attack between the communication data sending device and the communication data receiving device, the middle man will tamper with the same communication between the communication data sending device and the communication data receiving device during Bluetooth communication. The communication data in the stage causes the difference between the first communication data and the second communication data.

Taking the Internet of Vehicles device 200 and the Internet of Vehicles device 300 as the first Bluetooth device pair as an example, the Internet of Vehicles device 200 is the communication data sending device in the first Bluetooth device pair, and the Internet of Vehicles device 300 is the communication data in the first Bluetooth device pair. The receiving device, the acquisition device placed on the Internet of Vehicles device 200 collects and parses the first communication data sent by the Internet of Vehicles device 200 to the Internet of Vehicles device 300 through the air interface, and sends the first communication data through wireless transmission (eg WiFi) For the electronic device 100, the collection device placed on the Internet of Vehicles device 300 collects and parses the second communication data from the Internet of Vehicles device 200 received by the Internet of Vehicles device 300 through the air interface, and transmits the second communication data wirelessly (eg WiFi) to the electronic device 100, wherein the first communication data and the second communication data are the communication data in the same communication stage when the car networking device 200 and the car networking device 300 are performing Bluetooth communication. If there is no man-in-the-middle attack between the IoV devices 300, the first communication data is the same as the second communication data. If there is a man-in-the-middle attack between the IoV device 200 and the IoV device 300, the man-in-the-middle will tamper with the IoV device 200 and the IoV device 300. The communication data of the networked device 300 in the same communication stage during Bluetooth communication, resulting in the difference between the first communication data and the second communication data, the electronic device 100 can determine whether the first communication data and the second communication data are the same, if they are the same. , it is determined that there is no man-in-the-middle attack between the IoV device 200 and the IoV device 300 , and if different, it is determined that there is a man-in-the-middle attack between the IoV device 200 and the IoV device 300 .

It should be noted that, in this embodiment of the present application, only the communication data in one communication phase of the Bluetooth communication between the communication data transmitting device and the communication data receiving device in the first Bluetooth device pair may be collected and analyzed, or Collect and parse out the communication data of the communication data sending device and the communication data receiving device in the first Bluetooth device pair in multiple communication stages during Bluetooth communication, that is, the communication data from the first Bluetooth device pair in different communication stages Different first communication data is collected and parsed at the data sending device, and different second communication data is collected and parsed from the communication data receiving device in the first Bluetooth device pair, that is, according to the sequence of collection and analysis, the different second communication data is collected and parsed. The first communication data and the second communication data are combined, and then multiple data combinations are compared, thereby improving the reliability of determining whether the first Bluetooth device has a man-in-the-middle attack, which is not specifically limited in this embodiment of the present application.

It should be noted that, in this embodiment of the present application, if the number of Bluetooth device pairs to be detected determined by the electronic device 100 is multiple, the electronic device 100 can serially perform Bluetooth vulnerability attack detection on the Bluetooth device pairs to be detected, and also Bluetooth vulnerability attack detection may be performed on the pair of Bluetooth devices to be detected in parallel. For example, if the electronic device 100 determines two Bluetooth device pairs to be detected, Bluetooth vulnerability attack detection may be performed on the first Bluetooth device pair first, and then on the second Bluetooth device. The Bluetooth vulnerability attack detection is performed on the pair, and the Bluetooth vulnerability attack detection may also be performed on the first Bluetooth device pair and the second Bluetooth device pair at the same time.

It should be noted that, in the embodiments of the present application, the intermediary often attacks the encryption key negotiation phase and the encryption transmission phase in the Bluetooth communication process, and tampers with the communication data in these two phases. For example, as shown in FIG. 6a , which is a schematic diagram of a Bluetooth communication principle provided by an embodiment of the present application, after a Bluetooth connection is established between the Internet of Vehicles device 200 and the Internet of Vehicles device 300, the communication between the Internet of Vehicles device 200 and the Internet of Vehicles device 300 The Bluetooth communication will be divided into 4 stages: (1) The Internet of Vehicles device 200 as the communication data sending device (that is, the Bluetooth connection initiator) will send an encryption mode request to the communication data receiving device, the Internet of Vehicles device 300 (that is, the Bluetooth connection receiver), The IoV device 300 sends a request to accept the encryption mode to the IoV device 200; (2) The IoV device 200 sends an encryption key length negotiation request to the IoV device 300, and the IoV device 300 sends the IoV device 200 to accept the encryption key length Negotiation request; (3) IoV device 200 sends a request to start encrypted transmission to IoV device 300, and IoV device 300 sends a request to accept and start encrypted transmission to IoV device 200; (4) IoV device 200 starts with IoV device 300 Encrypted transmission. If there is an intermediary between the Internet of Vehicles device 200 and the Internet of Vehicles device 300, the intermediary can tamper with the Internet of Vehicles device 200 to send an encryption key length negotiation request to the Internet of Vehicles device 300 and the Internet of Vehicles device 300 to send an acceptance to the Internet of Vehicles device 200 Encryption key length negotiation request, or an intermediary can tamper with encrypted session data during encrypted transmission between the IoV device 200 and the IoV device 300 .

Exemplarily, as shown in FIG. 6b , which is a schematic diagram of a Bluetooth vulnerability attack in the encryption key negotiation stage provided by an embodiment of the present application, if there is a middleman between the Internet of Vehicles device 200 and the Internet of Vehicles device 300 , the Internet of Vehicles device 200 When sending an encryption key length negotiation request requesting a 16-byte encryption key to the IoV device 300, the encryption key length negotiation request will be intercepted by a middleman, and the middleman will originally request the 16-byte encryption key request information Tamper with the request information requesting a 1-byte encryption key, and send it to the IoV device 300, and the IoV device 300 sends a request for accepting the encryption key length negotiation to accept the 1-byte encryption key to the IoV device 200. The request for accepting encryption key length negotiation will also be intercepted by the intermediary, but the intermediary does not tamper with the request for accepting encryption key length negotiation, and directly sends the request for accepting encryption key length negotiation to the IoV device 200 . Then the man-in-the-middle conducts an active attack during the key length negotiation and the result of the successful attack is that when the encrypted transmission between the car networking device 200 and the car networking device 300 starts, the encryption of the session data between the car networking device 200 and the car networking device 300 is encrypted. The length of the key is only 1 byte. In normal Bluetooth communication, the length of the encryption key can reach 16 bytes. At this time, the middleman only needs to sniff the encrypted traffic, and the encrypted data can be decrypted by key blasting, and the plaintext content can be obtained by decryption. .

Exemplarily, as shown in FIG. 6c , which is a schematic diagram of a Bluetooth vulnerability attack in an encrypted transmission phase provided by an embodiment of the present application, if there is a man-in-the-middle between the car networking device 200 and the car networking device 300 , the car networking device 200 will send the The encrypted session data sent by the Internet of Vehicles device 300 and the encrypted session data sent by the Internet of Vehicles device 300 to the Internet of Vehicles device 200 will be intercepted by the middleman, who will tamper with the encrypted session data between the Internet of Vehicles device 200 and the Internet of Vehicles device 300, affecting the vehicle. Normal Bluetooth communication between the Internet-connected device 200 and the car-connected device 300 .

It can be seen that when the man-in-the-middle attacks different stages (encryption key negotiation stage and encrypted transmission stage) in the Bluetooth communication process, the electronic device 100 needs to send the communication data from the Bluetooth device pair to be detected and the communication data receiving device. The communication data collected and parsed at different places is different. The specific implementation of the two stages is described in detail below with specific examples:

(1) Detect the Bluetooth vulnerability attack in the encryption key negotiation stage

In some embodiments, when the first Bluetooth device pair performs encryption key negotiation, the electronic device 100 may acquire, from the communication data sending device, the data collected by the air interface of the collection device placed on the communication data sending device and sent to the communication data receiving device. The first encryption key length negotiation request is obtained from the communication data receiving device, and the received second encryption key length negotiation request carrying the identification information of the communication data sending device and collected by the air interface of the collecting device placed on the communication data receiving device is obtained, After determining that both the encryption key length negotiation request is obtained from the communication data sending device and the communication data receiving device, determine the first encryption key length negotiation request according to the first encryption key length negotiation request and the second encryption key length negotiation request The key length and the second encryption key length are used as the first communication data and the second communication data, respectively. Determine whether the length of the first encryption key is the same as the length of the second encryption key. If the length of the first encryption key is the same as the length of the second encryption key, it is determined that there is no man-in-the-middle attack on the first Bluetooth device. If the key length is different from the second encryption key length, it is determined that there is a man-in-the-middle attack on the first Bluetooth device pair.

Taking the Internet of Vehicles device 200 and the Internet of Vehicles device 300 as the first Bluetooth device pair as an example, the electronic device 100 can use wireless transmission (for example, WiFi) from the Internet of Vehicles device 200 and the Internet of Vehicles device 300 to perform encryption key negotiation. The IoV device 200 obtains the first encryption key length negotiation request sent by the IoV device 200 to the IoV device 300 and collected by the collection device placed on the IoV device 200, and obtains the request from the IoV device 300 and places it on the IoV device 300. The second encryption key length negotiation request received by the Internet of Vehicles device 300 from the Internet of Vehicles device 200 collected by the collection device on the device 300 over the air interface, if there is an intermediary between the Internet of Vehicles device 200 and the Internet of Vehicles device 300, the intermediary will intercept and tamper with the first encryption key length negotiation request. An encryption key length negotiation request causes the encryption key length requested by the first encryption key length negotiation request to be different from the encryption key length requested by the second encryption key length negotiation request, then the electronic device 100 can determine the After both the device 200 and the IoV device 300 obtain the encryption key length negotiation request, the first encryption key length and the second encryption key length negotiation request are determined according to the first encryption key length negotiation request and the second encryption key length negotiation request. The length of the encryption key is determined by judging whether the length of the first encryption key and the length of the second encryption key are the same to determine whether there is an intermediary between the IoV device 200 and the IoV device 300. If the length of the first encryption key is the same as that of the second encryption key, it is determined that there is no man-in-the-middle attack between the IoV device 200 and the IoV device 300. There is a man-in-the-middle attack.

It should be noted that, in this embodiment of the present application, after determining that the first Bluetooth device pair has a man-in-the-middle attack, the electronic device 100 can also determine whether the first Bluetooth device pair has encrypted session data to determine whether the man-in-the-middle attack is successful. session data, it is determined that there is a man-in-the-middle attack on the first Bluetooth device and the attack is successful, and if there is no encrypted session data, it is determined that there is a man-in-the-middle attack on the first Bluetooth device but the attack is unsuccessful. The device obtains a request to start encrypted transmission sent to the communication data receiving device, and obtains a received start encrypted transmission request that carries the identification information of the communication data sending device from the communication data receiving device, then it is determined that there is encrypted session data, or, After acquiring the communication data between the communication data sending device and the communication data receiving device, the electronic device 100 can determine whether the communication data is encrypted session data according to statistical characteristics of the communication data.

(2) Detection of Bluetooth vulnerability attacks in encrypted transmission phase

In some embodiments, when the first Bluetooth device pair performs encrypted transmission, the electronic device 100 obtains, from the communication data sending device, the difference between the communication data sending device and the communication data receiving device collected by the air interface of the collecting device placed on the communication data sending device. The first two-way communication data between the two-way communication data is obtained from the communication data receiving device, and the second two-way communication data collected between the communication data receiving device and the communication data sending device collected by the acquisition device placed on the communication data receiving device is obtained. After both the data sending device and the communication data receiving device obtain the two-way communication data, according to the first two-way communication data and the second two-way communication data, the first encrypted session data and the second encrypted session data are determined as the first communication data respectively. and second communication data. Determine whether the first encrypted session data is the same as the second encrypted session data. If the first encrypted session data is the same as the second encrypted session data, it is determined that there is no man-in-the-middle attack on the first Bluetooth device. If the encrypted session data are not the same, it is determined that there is a man-in-the-middle attack on the first pair of Bluetooth devices.

Taking the Internet of Vehicles device 200 and the Internet of Vehicles device 300 as the first Bluetooth device pair as an example, the electronic device 100 can transmit from the Internet of Vehicles through wireless transmission (eg WiFi) when the Internet of Vehicles device 200 and the Internet of Vehicles device 300 perform encrypted transmission. The device 200 obtains the first two-way communication data sent by the Internet of Vehicles device 200 to the Internet of Vehicles device 300 collected by the acquisition device placed on the Internet of Vehicles device 200, and obtains the collected data placed on the Internet of Vehicles device 300 from the Internet of Vehicles device 300 The second two-way communication data from the Internet of Vehicles device 200 and received by the Internet of Vehicles device 300 collected by the device air interface, if there is a middleman between the Internet of Vehicles device 200 and the Internet of Vehicles device 300, the intermediary will intercept and tamper with the two-way communication data, causing the Internet of Vehicles device 200 The encrypted session data at the IoV device 300 is different from the encrypted session data at the IoV device 300, then the electronic device 100 may determine that the data collected from the IoV device 200 and the IoV device 300 are both two-way communication data, according to the first two-way communication data. data and the second two-way communication data, determine the first encrypted session data and the second encrypted session data, and determine whether there is a connection between the car networking device 200 and the car networking device 300 by judging whether the first encrypted session data and the second encrypted session data are the same Man-in-the-middle, if the first encrypted session data is the same as the second encrypted session data, it is determined that there is no man-in-the-middle attack between the IoV device 200 and the IoV device 300; if the first encrypted session data and the second encrypted session data are different, then It is determined that there is a man-in-the-middle attack between the IoV device 200 and the IoV device 300 .

The above embodiments can be used alone or in combination with each other to achieve different technical effects.

In the above-mentioned embodiments of the present application, the methods provided by the embodiments of the present application are introduced from the perspective of an electronic device as an execution subject. In order to implement the functions in the methods provided by the above embodiments of the present application, the electronic device may include a hardware structure and/or software modules, and implement the above functions in the form of a hardware structure, a software module, or a hardware structure plus a software module. Whether one of the above functions is performed in the form of a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraints of the technical solution.

Based on the same technical concept, an embodiment of the present application further provides an apparatus 700 for detecting a Bluetooth vulnerability attack. The apparatus 700 may be an electronic device, or an apparatus 700 in an electronic device. Module for the method shown in 6c. Exemplarily, referring to FIG. 7 , the apparatus 700 may include:

The first determining module 701 is configured to identify the Bluetooth devices to be detected within a preset range, and determine the pair of Bluetooth devices to be detected according to the result of pairing the Bluetooth devices to be detected;

The collection and analysis module 702 is used to collect and parse the first communication data from the communication data sending device in the first Bluetooth device pair, and collect and parse the second communication data from the communication data receiving device in the first Bluetooth device pair. Communication data; wherein, the first Bluetooth device pair is any Bluetooth device pair to be detected, and the first communication data is communication data sent by the communication data sending device to the communication data receiving device through a Bluetooth connection, The second communication data is communication data that is received by the communication data receiving device through a Bluetooth connection and carries the identification information of the communication data sending device;

The second determination module 703 is configured to determine whether the first communication data and the second communication data are the same, and if not, determine that there is a man-in-the-middle attack on the first Bluetooth device.

In a possible design, the collection and analysis module 702 is specifically used for:

When the first pair of Bluetooth devices performs encryption key negotiation, collect all encryption key length negotiation requests sent by the communication data transmission device through the Bluetooth connection from the communication data transmission device, and obtain from the communication data reception device collecting all encryption key length negotiation requests received by the communication data receiving device through the Bluetooth connection;

According to the identification information of the communication data sending device and the communication data receiving device, the first communication data sent to the communication data receiving device is determined from all the encryption key length negotiation requests sent by the communication data sending device through the Bluetooth connection. An encryption key length negotiation request, which determines a second encryption key length negotiation request that carries the identification information of the communication data sending device from all the encryption key length negotiation requests received by the communication data receiving device through the Bluetooth connection;

determining that the first encryption key length in the first encryption key length negotiation request is the first communication data, and determining that the second encryption key length in the second encryption key length negotiation request is the second communication data.

In a possible design, the second determining module 703 is specifically used for:

Determine whether the length of the first encryption key is the same as the length of the second encryption key;

If the length of the first encryption key is different from the length of the second encryption key, it is determined that there is a man-in-the-middle attack on the first Bluetooth device pair.

In a possible design, the collection and analysis module 702 is specifically used for:

All communication data sent by the communication data transmission device through the Bluetooth connection is collected from the communication data transmission device in the first Bluetooth device pair, and the communication data is collected from the communication data reception device in the first Bluetooth device pair. All communication data received by the device over the Bluetooth connection;

According to the identification information of the communication data sending device and the communication data receiving device, the first communication data is determined from all the communication data sent by the communication data sending device through the Bluetooth connection, and the first communication data is determined from the communication data receiving device. The second communication data is determined from all communication data received through the Bluetooth connection.

In a possible design, the first determining module 701 is specifically used for:

Obtaining a Bluetooth broadcast message of a Bluetooth device to be detected within a preset range; wherein, the Bluetooth broadcast message carries the identification information of the Bluetooth device;

According to the Bluetooth broadcast message, a Bluetooth device to be detected within a preset range is determined.

In a possible design, after the second determining module 703 determines that there is a man-in-the-middle attack on the first Bluetooth device pair, it is further used to:

judging whether the first pair of Bluetooth devices has encrypted session data;

If there is encrypted session data, it is determined that there is a man-in-the-middle attack on the first Bluetooth device and the attack is successful;

If there is no encrypted session data, it is determined that there is a man-in-the-middle attack on the first Bluetooth device, but the attack is unsuccessful.

In a possible design, after the second determining module 703 determines that there is a man-in-the-middle attack on the first Bluetooth device, it is specifically used to:

If the request to start encrypted transmission sent by the communication data sending device to the communication data receiving device through the Bluetooth connection is collected from the communication data sending device, or the communication data receiving device is collected from the communication data receiving device a request to start encrypted transmission that carries the identification information of the communication data sending device received by the device through the Bluetooth connection, it is determined that encrypted session data exists; or,

The communication data between the communication data sending device and the communication data receiving device is collected and analyzed, and whether there is encrypted session data is determined according to the statistical characteristics of the communication data.

In a possible design, the collection and analysis module 702 is specifically used for:

When the first pair of Bluetooth devices performs encrypted transmission, first two-way communication data between the communication data transmission device and the communication data reception device is collected from the communication data transmission device, and received from the communication data collecting the second bidirectional communication data between the communication data receiving device and the communication data sending device at the device;

According to the first bidirectional communication data and the second bidirectional communication data, the first encrypted session data and the second encrypted session data are determined as the first communication data and the second communication data, respectively.

In a possible design, the second determining module 703 is specifically used for:

determining whether the first encrypted session data is the same as the second encrypted session data;

If the first encrypted session data is the same as the second encrypted session data, determining that there is no man-in-the-middle attack on the first Bluetooth device pair;

If the first encrypted session data is different from the second encrypted session data, it is determined that there is a man-in-the-middle attack on the first Bluetooth device pair.

Based on the same technical concept, referring to FIG. 8 , an embodiment of the present application further provides an apparatus 800 for detecting a Bluetooth vulnerability attack, including:

at least one processor 801; and, a communication interface 803 communicatively connected to the at least one processor 801;

Wherein, the at least one processor 801 causes the apparatus 800 to execute the method shown in FIG. 5 to FIG. 6c by executing the instructions stored in the memory 802 .

Optionally, the memory 802 is located outside the apparatus 800 .

Optionally, the apparatus 800 includes the memory 802 , the memory 802 is connected to the at least one processor 801 , and the memory 802 stores instructions executable by the at least one processor 801 . FIG. 8 shows with dashed lines that memory 802 is optional to apparatus 800 .

The processor 801 and the memory 802 may be coupled through an interface circuit, or may be integrated together, which is not limited here.

The specific connection medium between the processor 801 , the memory 802 , and the communication interface 803 is not limited in the embodiments of the present application. In the embodiment of the present application, the processor 801, the memory 802, and the communication interface 803 are connected through a bus 804 in FIG. 8, and the bus is represented by a thick line in FIG. 8. The connection between other components is only for schematic illustration. , is not limited. The bus can be divided into an address bus, a data bus, a control bus, and the like. For convenience of representation, only one thick line is used in FIG. 8, but it does not mean that there is only one bus or one type of bus.

It should be understood that the processor mentioned in the embodiments of the present application may be implemented by hardware or software. When implemented in hardware, the processor may be a logic circuit, an integrated circuit, or the like. When implemented in software, the processor may be a general-purpose processor implemented by reading software codes stored in memory.

Exemplarily, the processor may be a central processing unit (central processing unit, CPU), and may also be other general-purpose processors, digital signal processors (digital signal processing or, DSP), application specific integrated circuits (application specific integrated circuits, ASIC), off-the-shelf programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

It should be understood that the memory mentioned in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory may be random access memory (RAM), which acts as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data eateSDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM) And direct memory bus random access memory (directrambus RAM, DR RAM).

It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components, the memory (storage module) can be integrated in the processor.

It should be noted that the memory described herein is intended to include, but not be limited to, these and any other suitable types of memory.

Based on the same technical concept, embodiments of the present application also provide a computer-readable storage medium, including a program or an instruction, when the program or instruction is executed on a computer, the method shown in FIG. 5-FIG. 6c is executed.

Based on the same technical concept, an embodiment of the present application further provides a chip, which is coupled to a memory and used to read and execute program instructions stored in the memory, so that the methods shown in FIGS. 5-6c are executed.

Based on the same technical concept, an embodiment of the present application also provides a computer program product, including instructions, which, when executed on a computer, cause the methods shown in FIG. 5 to FIG. 6c to be executed.

It should be understood that, all relevant contents of the steps involved in the above method embodiments can be cited in the functional descriptions of the corresponding functional modules, which will not be repeated here.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the protection scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims (20)

1. a method for detecting bluetooth vulnerability attack, is characterized in that, comprises: Identify the Bluetooth device to be detected within the preset range; According to the pairing result of the bluetooth device to be detected, determine a first pair of bluetooth devices, and the first pair of bluetooth devices includes a communication data sending device and a communication data receiving device belonging to the bluetooth device to be detected; The first communication data is obtained by parsing the data collected from the communication data sending device, and the second communication data is obtained by parsing the data collected from the communication data receiving device, wherein the first communication data is the Communication data sent by the communication data sending device to the communication data receiving device through a Bluetooth connection, and the second communication data is the communication carried by the communication data receiving device through the Bluetooth connection and carrying the identification information of the communication data sending device data; Based on the difference between the first communication data and the second communication data, it is determined that there is a man-in-the-middle attack on the first pair of Bluetooth devices. 2. The method of claim 1, wherein the first communication data is obtained by parsing data collected from the communication data sending device, and the first communication data is obtained by parsing data collected from the communication data receiving device Obtain second communication data, including: When the first pair of Bluetooth devices performs encryption key negotiation, collect all encryption key length negotiation requests sent by the communication data transmission device through the Bluetooth connection from the communication data transmission device, and obtain from the communication data reception device collecting all encryption key length negotiation requests received by the communication data receiving device through the Bluetooth connection; According to the identification information of the communication data sending device and the communication data receiving device, the first communication data sent to the communication data receiving device is determined from all the encryption key length negotiation requests sent by the communication data sending device through the Bluetooth connection. An encryption key length negotiation request, which determines a second encryption key length negotiation request that carries the identification information of the communication data sending device from all the encryption key length negotiation requests received by the communication data receiving device through the Bluetooth connection; determining that the first encryption key length in the first encryption key length negotiation request is the first communication data, and determining that the second encryption key length in the second encryption key length negotiation request is the second communication data. 3. The method of claim 2, wherein determining that there is a man-in-the-middle attack on the first pair of Bluetooth devices based on the difference between the first communication data and the second communication data, comprising: determining that the length of the first encryption key is not the same as the length of the second encryption key; It is determined that the man-in-the-middle attack exists. 4. The method of claim 1, wherein the first communication data is obtained by parsing data collected from the communication data sending device, and the first communication data is obtained by parsing data collected from the communication data receiving device Obtain second communication data, including: When the first pair of Bluetooth devices performs encrypted transmission, first two-way communication data between the communication data transmission device and the communication data reception device is collected from the communication data transmission device, and received from the communication data collecting the second bidirectional communication data between the communication data receiving device and the communication data sending device at the device; The first encrypted session data is determined as the first communication data according to the first two-way communication data, and the second encrypted session data is determined as the second communication data according to the second two-way communication data. 5. The method according to claim 4, wherein the determining that there is a man-in-the-middle attack on the first pair of Bluetooth devices based on the difference between the first communication data and the second communication data comprises: It is determined that the man-in-the-middle attack exists based on the difference between the first encrypted session data and the second encrypted session data. 6. The method of claim 1, wherein the first communication data is obtained by parsing data collected from the communication data sending device, and the first communication data is obtained by parsing data collected from the communication data receiving device Obtain second communication data, including: Collect all communication data sent by the communication data sending device through the Bluetooth connection from the communication data sending device, and collect all the communication data received by the communication data receiving device through the Bluetooth connection from the communication data receiving device; According to the identification information of the communication data sending device and the communication data receiving device, the first communication data is determined from all the communication data sent by the communication data sending device through the Bluetooth connection, and the first communication data is determined from the communication data receiving device. The second communication data is determined from all communication data received through the Bluetooth connection. 7. The method according to any one of claims 1 to 6, wherein the identifying a Bluetooth device to be detected within a preset range comprises: acquiring a Bluetooth broadcast message of a Bluetooth device within the preset range; wherein, the Bluetooth broadcast message carries identification information of the Bluetooth device; Determine the to-be-detected Bluetooth device within the preset range according to the Bluetooth broadcast message. 8. The method according to any one of claims 1 to 6, wherein after determining that there is a man-in-the-middle attack on the first pair of Bluetooth devices, the method further comprises: judging whether the first pair of Bluetooth devices has encrypted session data; If there is encrypted session data, it is determined that the man-in-the-middle attack exists and the attack is successful; If there is no encrypted session data, it is determined that the man-in-the-middle attack exists but the attack is unsuccessful. 9. The method of claim 8, wherein the judging whether there is encrypted session data comprises: If the request to start encrypted transmission sent by the communication data sending device to the communication data receiving device through the Bluetooth connection is collected from the communication data sending device, or the communication data receiving device is collected from the communication data receiving device a request to start encrypted transmission that carries the identification information of the communication data sending device received by the device through the Bluetooth connection, it is determined that encrypted session data exists; or, Collect and analyze the communication data between the communication data sending device and the communication data receiving device, and determine whether there is encrypted session data according to the statistical characteristics of the communication data. 10. A device for detecting a Bluetooth vulnerability attack, comprising: The first determination module is used to identify the Bluetooth device to be detected within a preset range, and to determine a first Bluetooth device pair according to the pairing result of the Bluetooth device to be detected, and the first Bluetooth device pair includes belonging to the to-be-detected Bluetooth device. The communication data sending device and the communication data receiving device of the detected Bluetooth device; a collection and analysis module, configured to obtain first communication data by analyzing the data collected from the communication data sending device, and obtain second communication data by analyzing the data collected from the communication data receiving device; The first communication data is the communication data sent by the communication data sending device to the communication data receiving device through the Bluetooth connection, and the second communication data is the communication data received by the communication data receiving device through the Bluetooth connection and carries the communication data. Communication data of the identification information of the data sending device; A second determining module, configured to determine that there is a man-in-the-middle attack on the first pair of Bluetooth devices based on the difference between the first communication data and the second communication data. 11. The device according to claim 10, wherein the acquisition and analysis module is specifically used for: When the first pair of Bluetooth devices performs encryption key negotiation, collect all encryption key length negotiation requests sent by the communication data transmission device through the Bluetooth connection from the communication data transmission device, and obtain from the communication data reception device collecting all encryption key length negotiation requests received by the communication data receiving device through the Bluetooth connection; According to the identification information of the communication data transmission device and the communication data reception device, the first communication data transmission device sent to the communication data reception device is determined from all encryption key length negotiation requests sent by the communication data transmission device through the Bluetooth connection. An encryption key length negotiation request, which determines a second encryption key length negotiation request that carries the identification information of the communication data sending device from all the encryption key length negotiation requests received by the communication data receiving device through the Bluetooth connection; determining that the first encryption key length in the first encryption key length negotiation request is the first communication data, and determining that the second encryption key length in the second encryption key length negotiation request is the second communication data. 12. The apparatus of claim 11, wherein the second determining module is specifically configured to: determining that the length of the first encryption key is not the same as the length of the second encryption key; It is determined that the man-in-the-middle attack exists. 13. The device of claim 10, wherein the acquisition and analysis module is specifically used for: When the first pair of Bluetooth devices performs encrypted transmission, first two-way communication data between the communication data transmission device and the communication data reception device is collected from the communication data transmission device, and received from the communication data collecting the second bidirectional communication data between the communication data receiving device and the communication data sending device at the device; The first encrypted session data is determined as the first communication data according to the first two-way communication data, and the second encrypted session data is determined as the second communication data according to the second two-way communication data. 14. The apparatus of claim 13, wherein the second determining module is specifically configured to: It is determined that the man-in-the-middle attack exists based on the difference between the first encrypted session data and the second encrypted session data. 15. The device of claim 10, wherein the acquisition and analysis module is specifically used for: Collect all communication data sent by the communication data sending device through the Bluetooth connection from the communication data sending device, and collect all the communication data received by the communication data receiving device through the Bluetooth connection from the communication data receiving device; According to the identification information of the communication data sending device and the communication data receiving device, the first communication data is determined from all the communication data sent by the communication data sending device through the Bluetooth connection, and the first communication data is determined from the communication data receiving device. The second communication data is determined from all communication data received through the Bluetooth connection. 16. The apparatus according to any one of claims 10 to 15, wherein the first determining module is specifically configured to: acquiring a Bluetooth broadcast message of a Bluetooth device within the preset range; wherein, the Bluetooth broadcast message carries identification information of the Bluetooth device; Determine the to-be-detected Bluetooth device within the preset range according to the Bluetooth broadcast message. 17. The apparatus according to any one of claims 10 to 15, wherein after determining that the first Bluetooth device pair has a man-in-the-middle attack, the second determining module is further configured to: judging whether the first pair of Bluetooth devices has encrypted session data; If there is encrypted session data, it is determined that the man-in-the-middle attack exists and the attack is successful; If there is no encrypted session data, it is determined that the man-in-the-middle attack exists but the attack is unsuccessful. 18. The apparatus according to claim 17, wherein after the second determining module determines that there is a man-in-the-middle attack on the first Bluetooth device, the second determining module is specifically configured to: If the request to start encrypted transmission sent by the communication data sending device to the communication data receiving device through the Bluetooth connection is collected from the communication data sending device, or the communication data receiving device is collected from the communication data receiving device a request to start encrypted transmission that carries the identification information of the communication data sending device received by the device through the Bluetooth connection, it is determined that encrypted session data exists; or, Collect and analyze the communication data between the communication data sending device and the communication data receiving device, and determine whether there is encrypted session data according to statistical characteristics of the communication data. 19. A device for detecting a Bluetooth vulnerability attack, characterized in that the device comprises a memory and a processor; the memory is used to store computer instructions; the processor is used to call the computer instructions stored in the memory, to perform the method for detecting a Bluetooth vulnerability attack according to any one of claims 1-9. 20. A computer storage medium, characterized by comprising computer instructions, when the computer instructions are executed on an electronic device, the electronic device is made to perform the Bluetooth vulnerability detection according to any one of claims 1-9 method of attack.

Images