KR102292022B1 - Selection Method of dangerous Bluetooth Device based on connection with Bluetooth Device - Google Patents

Abstract

According to an embodiment, the detection step of the screening device finding a Bluetooth device; a connection step of connecting the screening device to the detected Bluetooth device; and an estimation step of estimating, by the screening device, a dangerous Bluetooth device from among the Bluetooth devices found in the detection step, based on at least one result of the result of the detection step and the result of the connection step. A method for screening is disclosed.

Description

Selection Method of dangerous Bluetooth Device based on connection with Bluetooth Device

The present invention relates to a method for screening a dangerous Bluetooth device based on a connection with the Bluetooth device.

Bluetooth is a technical standard that wirelessly connects mobile devices, including portable PCs or mobile phones, within a narrow range. Bluetooth supports, for example, a radio frequency of 245 MHZ ISM (Industrial Scientific Medical) band so that various digital devices can transmit and receive voice and data without a physical cable. For example, a module for Bluetooth communication is embedded in a mobile communication terminal and a laptop computer to support wireless communication. Due to this convenience, Bluetooth is used in PDA (Personal Digital Assistant), desktop, FAX, keyboard, or joystick, as well as almost all digital devices.

According to an embodiment of the present invention, a method for screening a dangerous Bluetooth device and a screening device used therefor may be provided.

According to an embodiment of the present invention

detecting, by the screening device, finding a Bluetooth device;

a connection step of connecting the screening device to the detected Bluetooth device; and

an estimation step of estimating, by the screening device, a dangerous Bluetooth device among the Bluetooth devices found in the detection step based on at least one result of the result of the detection step and the result of the connection step;

The detection step

A first scanning step of scanning advertising packets broadcast from Bluetooth devices and a finishing packet for disconnecting already connected Bluetooth devices are broadcast before the detection step is performed. comprising the step of casting,

The connection step

A method for selecting a dangerous Bluetooth device, wherein the screening device performs a connection operation with the Bluetooth device found in the detection step, and performs a device information acquisition operation for acquiring service information from the Bluetooth device to which the screening device is connected is provided

According to an embodiment of the present invention, it is possible to select a Bluetooth device having a bad purpose such as hacking.

1 to 3 are diagrams for explaining an apparatus for selecting a dangerous Bluetooth device based on a connection with the Bluetooth device according to an embodiment of the present invention.
4 is a diagram for explaining a method of screening a dangerous Bluetooth device based on a connection with the Bluetooth device according to an embodiment of the present invention.
5 is a diagram for explaining a detection step according to an embodiment of the present invention.
6 is a diagram for explaining a detection step according to another embodiment of the present invention.
7 is a diagram for explaining a dangerous device estimation step according to an embodiment of the present invention.

The above objects, other objects, features and advantages of the present invention will be easily understood through the following preferred embodiments in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments described herein and may be embodied in other forms. The embodiments described below are exemplary embodiments provided to sufficiently convey the spirit of the present invention to those skilled in the art.

Definition of Terms

As used herein, the term 'software' refers to a technology that moves hardware in a computer, and the term 'hardware' refers to a tangible device or device (CPU, memory, input device, output device, peripheral device, etc.) constituting the computer. and, the term 'step' means a series of processes or operations connected in time series to achieve a predetermined goal, the term 'program means a set of instructions that are combined to be processed by a computer, and the term 'program recording medium' means It means a computer-readable recording medium on which a program used for installing, executing, or distributing a program is recorded.

In this specification, when terms such as first, second, etc. are used to describe components, these components should not be limited by these terms. These terms are only used to distinguish one component from another. The embodiments described and illustrated herein also include complementary embodiments thereof.

As used herein, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, the terms 'comprise' and/or 'comprising' do not exclude the presence or addition of one or more other components.

In the present specification, the term 'management' is used to include 'reception', 'transmission', 'storage', 'modification', and 'deletion' of data.

In this specification, 'component A and/or component B' means 'component A', 'component B' or 'component A and component B'.

In this specification, a 'user terminal device' is a computer, and may be, for example, a device such as a desktop computer, a notebook computer, a smart phone, or a PDA.

As used herein, 'computer' includes a computer processor and storage device, operating system, firmware, application program, communication unit, and other resources, where the operating system (OS: OPERATING SYSTEM) is other hardware, firmware, or application program (eg For example, a management program) can be operatively linked. The communication unit means a module composed of software and hardware for transmitting and receiving data with the outside. In addition, the computer processor and the storage device, operating system, application program, firmware, communication unit, and other resources are operatively connected to each other. On the other hand, the description or drawings for the above-mentioned components are described or shown within the limit for the purpose of the description of the present invention.

In this specification, a reference to component 'A' transmitting information, details, and/or data to component 'B' means that component 'A' transmits directly to component 'B' or component 'A' is used in the meaning including transmission to component 'B' through at least one other component.

In this specification, the term 'Bluetooth device' refers to a device that communicates using a wireless communication technology called Bluetooth.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

1 to 3 are diagrams for explaining an apparatus for screening a dangerous Bluetooth device based on a connection with the Bluetooth device according to an embodiment of the present invention.

1 to 3 , an apparatus (hereinafter, referred to as a 'selecting apparatus') 100 for selecting a dangerous Bluetooth device based on a connection with a Bluetooth device according to an embodiment of the present invention is detected Detecting action, Connecting action, Acquiring action of device information, and Predicting action are performed.

On the other hand, for the purpose of the description of the present invention, there are four Bluetooth devices (S, M1, M2, M3), among them, with respect to the Bluetooth device (S), the remaining Bluetooth devices (M1, M2, M3) are masters. assume that That is, the Bluetooth device S is a slave, and the Bluetooth devices M1, M2, and M3 are masters. On the other hand, the slave and the master are relative to each other. For example, when the Bluetooth device M1 and the Bluetooth device M2 want to connect to each other, one of them will be a slave and the other will become a master. According to an embodiment, the selection device 100 according to the present invention may be a slave or a master with respect to the Bluetooth devices S, M1, M2, and M3.

Masters (M1, M2, M3) for the connection (Connection) with the slave (S), the advertising packet (Advertising packet) broadcast from the slave (S) (hereinafter referred to as 'AD packet') Scan periodically. The masters M1, M2, and M3 may request access from the slave S when the slave S broadcasts an AD packet. After the master (M1) is connected to the slave (S), the master (M1) sets the timing (timing) and performs a data exchange operation with the slave (S).

The slave S periodically broadcasts an AD packet in order to connect with another Bluetooth device. When the master M1 receives the AD packet and transmits a connection request to the slave S, the slave S permits the connection request and establishes a connection. For example, when the master (M1) and the slave (S) are connected to each other (Connection), the slave (S) hops the channel (Channel) in accordance with the timing specified by the master (M1) while hopping (hopping) Data is exchanged with the master (M1).

The AD packet includes, for example, a Media Access Control Address (hereinafter referred to as a 'MAC address'), a universally unique identifier (UUID), a vendor unique number, and data indicating the type of Bluetooth device. may include

Here, the MAC address is a unique identifier assigned to a network interface for communication in the data link layer of the network segment. The MAC address is used as a network address in most IEEE 802 network technologies, including ethernet and Wi-Fi.

A universally unique identifier (UUID) is a unique number that identifies a software service. According to the Bluetooth standard, services provided by Bluetooth devices have a unique UUID value to distinguish them from each other. In the case of a service defined in the Bluetooth standard, a service defined in the Bluetooth standard has a previously defined 16-bit UUID value. Meanwhile, a user-defined service created by the user has a 128-bit UUID.

The unique vendor number is information that can identify the manufacturer of the Bluetooth device.

detection behavior

The detection operation is an operation in which the selection device 100 searches for the Bluetooth devices S, M1, M2, and M3.

In the present embodiment, the detection operation is an operation of detecting all Bluetooth devices S, M1, M2, and M3 existing in an area to be detected (hereinafter, referred to as a 'detection area'). The detection targets are Bluetooth devices that are already connected to each other (ie, paired) and Bluetooth devices that are not yet connected to each other but are attempting to connect.

In this embodiment, the detection area is typically defined as several meters to several tens of meters, and is defined as an area in which the Bluetooth devices to be investigated are located. For example, when a dangerous Bluetooth device is to be selected from Bluetooth devices located in a specific office, the detection area is determined as an internal space of the specific office. Referring to FIG. 2 , a detection area r is indicated, and Bluetooth devices S, M1, M2, and M3 are located within the detection area r. As will be described later, the Bluetooth device M4 is not located in the detection area r.

The detection operation may include, for example, an operation of scanning an AD packet broadcast from Bluetooth devices, and an operation of storing an AD packet received as a result of scanning. The detection operation may be performed, for example, by the method described with reference to FIG. 5 (first embodiment) or by the method described with reference to FIG. 6 (second embodiment).

The detection operation according to the first embodiment includes an operation in which the selection apparatus 100 scans an AD packet in a detection area (hereinafter, referred to as 'first scanning'), and broadcasting a finishing packet in the detection area. operation and scanning the AD packet (hereinafter referred to as 'second scanning').

The detection operation according to the first embodiment scans the AD packet first, and then broadcasts the finishing packet to disconnect the Bluetooth devices already connected before the detection operation is performed, and then scans the AD packet secondarily. it's an action Since the Bluetooth devices already connected before the detection operation is performed are not detected by the AD packet scanning operation, the connection of the existing Bluetooth devices is released by broadcasting a finishing packet.

When Bluetooth devices that are already connected receive the finishing packet, they disconnect from each other. Bluetooth devices that have been disconnected broadcast AD packets in order to reconnect, and these broadcast AD packets are detected by the secondary scanning operation.

In the detection operation according to the second embodiment, the selection apparatus 100 broadcasts a finishing packet in the detection area and performs an operation of scanning the AD packet. That is, according to the second embodiment, the detection operation is an operation of broadcasting the finishing packet to the detection area to disconnect the Bluetooth devices previously connected to each other, and then scanning the AD packet. As described above, the disconnected Bluetooth devices broadcast AD packets in order to reconnect, and these broadcast AD packets are detected by a scanning operation.

connection action

The access operation is an operation in which the selection device 100 sequentially connects to the Bluetooth devices found by the detection operation.

The connection operation is an operation in which the selection device 100 sequentially connects to all Bluetooth devices detected in the detection operation and acquires device information from the connected Bluetooth devices (hereinafter, 'device information acquisition operation'). For example, the selection device 100 may sequentially connect with the Bluetooth devices S, M1, M2, and M3, and obtain device information from the connected Bluetooth devices S, M1, M2, and M3. have.

The above-described device information acquisition operation is an operation for acquiring service information of a Bluetooth device connected to the selection device 100 . For example, when the selection device 100 connects to the Bluetooth device M2, the selection device 100 may obtain service information from the Bluetooth device M2. According to an embodiment, the service information may include data indicating which service the Bluetooth device M2 provides and data indicating the type of the Bluetooth device M2. In this embodiment, the service information may further include data indicating the current location of the Bluetooth device M2. Alternatively, data indicating the current location of the Bluetooth device may be included in the AD packet.

Hazardous Device Estimated Behavior

The dangerous device estimation operation is an operation of estimating a dangerous Bluetooth device among the Bluetooth devices S, M1, M2, and M3 based on at least one result of a detection operation result and a connection operation result. That is, the dangerous device estimation operation is i) estimating the dangerous Bluetooth device based on the result of the detection operation, ii) estimating the dangerous Bluetooth device based on the result of the connection operation, or iii) the result of the detection operation and the connection operation It is an operation of estimating a dangerous Bluetooth device based on the result of .

An embodiment of estimating a dangerous Bluetooth device based on a result of a detection operation will be described.

According to this embodiment, the selection device 100 extracts MAC addresses of Bluetooth devices from AD packets detected by the detection operation, and searches for Bluetooth devices having the same MAC addresses among the extracted MAC addresses. , it is assumed that Bluetooth devices having the same MAC address are dangerous Bluetooth devices. For example, when the MAC address extracted from the AD packet broadcast from the Bluetooth device M1 and the MAC address extracted from the AD packet broadcast from the Bluetooth device M2 are the same, the selection device 100 may , it is assumed that the Bluetooth device M1 and the Bluetooth device M2 are dangerous Bluetooth devices.

Another embodiment of estimating a dangerous Bluetooth device based on the result of the detection operation will be described.

According to the present embodiment, the selection apparatus 100 extracts a MAC address (Max address) from AD packets detected by the detection operation, and checks whether there is a MAC address having an atypical shape among the extracted MAC addresses. The screening device 100 estimates that a Bluetooth device having an atypical type of MAC address is a dangerous Bluetooth device.

In the present specification, the term "atypical form of MAC address" means that it is configured in a form different from the MAC address assigned to conventional Bluetooth devices.

Typically, a typical MAC address has a unique number (hereinafter, a 'vendor unique number') for each device vendor, and thus can be used as information that can identify the manufacturer of the device through the MAC address.

The non-typical form of the MAC address may include a vendor-specific number of a company that does not commercially manufacture Bluetooth devices.

An embodiment of estimating a dangerous Bluetooth device based on the result of the detection operation and the result of the connection operation will be described.

According to the present embodiment, when the signal strength of the AD packet found by the search operation is greater than the 'reference value' and the location of the Bluetooth device that transmitted the AD packet is out of the 'reference range' , it can be estimated that the Bluetooth device is a dangerous device. Here, the 'reference range' refers to a range within the reference distance with respect to the screening apparatus 100 (eg, the portion marked with the pattern in FIG. 2 is the 'reference range')

For example, assuming that the Bluetooth devices S, M1, M2, and M3 are located in the detection area r, the 'reference value' is defined based on the signal strength of AD packets. can be done For example, the reference value, the 'reference value' may be the smallest value among the signal strengths of AD packets.

The 'reference distance' (h) may be determined based on the size of the detection area (r). For example, the reference distance h may be defined as a distance between two Bluetooth devices that are virtually arranged so that when two Bluetooth devices are virtually arranged to be farthest from each other in the detection area r. . Referring to FIG. 2 , a distance between locations P1 and P2 that are farthest from each other within a detection area r of two Bluetooth devices may be defined as a reference distance h.

The 'reference range' (A) may be defined as an area within a reference distance (h) with respect to the screening apparatus 100 . Referring to FIG. 2 , a 'reference range' (A) is indicated as an area within a reference distance (h) with respect to the screening apparatus 100 .

Referring to FIG. 2 , the location of the Bluetooth device M4 is out of the 'reference range'. If the signal strength of the AD packet from the Bluetooth device M4 is greater than the reference value, the selection device 100 regards the Bluetooth device M4 as a dangerous device because the location of the Bluetooth device M4 is out of the 'reference range'. can be estimated

Meanwhile, location data (eg, GPS coordinates) indicating the location of the Bluetooth device may be included in service information provided when connecting to the Bluetooth device or in an AD packet transmitted from the Bluetooth device. The selection device 100 may know the distance between the Bluetooth device and the selection device 100 by using service information provided from the Bluetooth device or location data included in the AD packet.

Another example of estimating a dangerous Bluetooth device based on the result of the detection operation and the result of the connection operation will be described.

The sorting device 100 compares the type of service found from the AD packet with the type of service found from service information provided by accessing the Bluetooth device, and if they are different, it is estimated that the Bluetooth device is a dangerous device. For example, the type of service found out from the UUID included in the AD packet received by the selection device 100 from the Bluetooth device M3 and the Bluetooth device when the selection device 100 is connected to the Bluetooth device M3 ( If the types of services found from the service information provided from M3) are different from each other, the selection device 100 estimates that the Bluetooth device M3 is a dangerous device.

Another example of estimating a dangerous Bluetooth device based on the result of the detection operation and the result of the connection operation will be described.

If the type of the Bluetooth device found out from the AD packet and the type of the Bluetooth device found from the service information acquired by the device information acquisition operation are not the same, the selection device 100 sets the Bluetooth device as a dangerous Bluetooth device. estimate For example, the type of the Bluetooth device M3 found by the selection device 100 from data included in the AD packet received from the Bluetooth device M3, and whether the selection device 100 is connected to the Bluetooth device M3 When the types of the Bluetooth device M3 found out from the service information provided from the Bluetooth device M3 are different from each other, the selection device 100 estimates that the Bluetooth device M3 is a dangerous device.

Referring to FIG. 3 , the device 100 for selecting a Bluetooth device includes a detection unit 101 , a connection unit 103 , an estimation unit 105 , an operating system 107 , a communication unit 109 , a computer processor 111 , and a memory. device 113 , and memory 115 .

Here, the operating system 107 is software that not only manages the hardware but also provides a hardware abstraction platform and common system services to execute application software, and the storage device 113 and the memory 115 are each stored and executed. A device that provides space for The computer processor 111 is a central processing unit (CPU), and the central processing unit is a control device of a computer that controls a computer system and executes a program operation, or a chip having a built-in function thereof.

The memory 115 and/or the storage device 113 may provide a space for storing or executing a program, and may also store reference values, reference distances, AP packets, or service information provided from Bluetooth devices.

The detection unit 101 performs the above-described detection operation. For example, the detector 101 detects all Bluetooth devices S, M1, M2, and M3 existing in the detection area. The detection targets are Bluetooth devices that are currently connected to each other (ie, paired) and Bluetooth devices that are not yet connected to each other but are attempting to connect.

The connection unit 103 performs the above-described connection operation and device information acquisition operation. For example, the connection unit 103 sequentially accesses all Bluetooth devices detected by the detection unit 101 . In addition, when the connection unit 103 is connected to the Bluetooth device, it performs a device information acquisition operation for acquiring service information of the connected Bluetooth device. For example, when connecting to the Bluetooth device M2, the connection unit 103 obtains service information from the Bluetooth device M2.

The estimator 105 performs the above-described dangerous device estimation operation. For example, the estimator 105 may be configured to, based on at least one result of an operation result by the detection unit 101 and an operation result by the connection unit 103 , the Bluetooth devices S, M1, M2, and M3. It is an operation of estimating a dangerous Bluetooth device from among them. That is, the estimator 105 i) estimates a dangerous Bluetooth device based on the operation result by the detection unit 101 , ii) estimates a dangerous Bluetooth device based on the operation result by the connection unit 103 , or , iii) A dangerous Bluetooth device is estimated based on the operation result by the detection unit 101 and the operation result by the connection unit 103 .

All or at least a part of the detection unit 101 may be configured as a program. The part composed of the program is loaded into the memory 115 and performs a port scanning operation under the control of the computer processor 111 . Other components, for example, the connection unit 103 and the estimator 105 may also be configured at least partially as a program and perform their own operations like the detection unit 101 . Meanwhile, since detailed descriptions of the detection operation, the access operation, and the dangerous device estimation operation have been described above, they will be omitted here.

4 is a diagram for explaining a method (hereinafter, referred to as a 'selection method') for screening a dangerous Bluetooth device based on a connection of a Bluetooth device with a Bluetooth device according to an embodiment of the present invention.

Hereinafter, a screening method according to an embodiment of the present invention will be described in detail on the assumption that the screening apparatus 100 described with reference to FIGS. 1 to 3 is used in the screening method according to an embodiment of the present invention. do it with

A screening method according to an embodiment of the present invention includes: a first step (hereinafter, referred to as a 'detection step') in which the screening device 100 searches for a Bluetooth device (S100); a second step (hereinafter referred to as 'connection step') in which the selection device 100 sequentially connects to the Bluetooth device found in the detection step (S100) (S200); And the selection device 100, based on at least one result of the result of the detection step (S100) and the connection result (S200), estimating a dangerous Bluetooth device from among the Bluetooth devices found in the detection step (S100) Step 3 (hereinafter referred to as 'risk device estimation step') may include (S300).

Detection step (S100)

The detection step S100 according to the present embodiment is an operation for finding the Bluetooth devices S, M1, M2, and M3.

In the detection step S100, an operation of detecting all the Bluetooth devices S, M1, M2, and M3 existing in the detection area r is performed. The detection targets are Bluetooth devices that are currently connected to each other (ie, paired) and Bluetooth devices that are not yet connected to each other but are attempting to connect.

The detection step ( S100 ) may include, for example, a step ( S101 ) of scanning an AD packet broadcast from Bluetooth devices, and a step ( S107 ) of storing the received AD packet as a result of the scanning. The detection step S100 may be performed, for example, by the method described with reference to FIG. 5 (first embodiment) or by the method described with reference to FIG. 6 (second embodiment). .

The first embodiment will be described with reference to FIG. 5, the detection step (S100) includes the step (S101) of the screening device 100 scanning AD packets in the detection area (hereinafter referred to as 'first scanning') (S101); Broadcasting the finishing packet to the detection area (S103), and scanning the AD packet (hereinafter referred to as 'second scanning') (S105). That is, according to the first embodiment, in the detection step ( S100 ), the AD packet is scanned first, and a finishing packet is broadcasted thereafter to disconnect the existing Bluetooth devices connected to each other, and then the AD packet is secondarily is a scanning operation. Since Bluetooth devices already connected before the detection step S100 are not detected by the AD packet scanning operation, an operation of releasing the connection of the existing Bluetooth devices by broadcasting a finishing packet is performed.

When the Bluetooth devices connected to each other receive the finishing packet, they disconnect from each other. Bluetooth devices that have been disconnected broadcast AD packets in order to reconnect, and these broadcast AD packets are detected by the secondary scanning operation.

The second embodiment will be described with reference to FIG. 6 , in which the detection step ( S100 ) includes the step ( S102 ) of the screening device 100 broadcasting a finishing packet in the detection area, and the steps of scanning the AD packet. (S104) is performed. That is, according to the second embodiment, the detection step ( S100 ) is an operation of broadcasting the finishing packet to the detection area to disconnect the Bluetooth devices previously connected to each other, and then scanning the AD packet. Since Bluetooth devices already connected before the detection step S100 are not detected by the AD packet scanning operation, an operation for disconnecting existing Bluetooth devices is performed by broadcasting a finishing packet.

As described above, the disconnected Bluetooth devices broadcast AD packets in order to reconnect, and these broadcast AD packets are detected by a scanning operation.

Connection step (S200)

In the connection step ( S200 ), the connection unit 103 performs the above-described connection operation and device information acquisition operation. For example, the access step ( S200 ) performs an operation of sequentially accessing all Bluetooth devices detected by the detection step ( S100 ). Also, in the connection step ( S200 ), when the Bluetooth device is connected, a device information acquisition operation of acquiring service information of the connected Bluetooth device is performed. For example, in the connection step S200 , when the Bluetooth device M2 is connected, service information is obtained from the Bluetooth device M2.

Estimation step (S300)

In the estimation step (S300), the above-described dangerous device estimation operation is performed.

For example, in the estimation step S300, the Bluetooth devices S, M1, M2, M3 based on at least one result of the operation result of the detection step S100 and the operation result of the connection step S200. ) to estimate a dangerous Bluetooth device. That is, the estimating step ( S300 ) estimates a dangerous Bluetooth device based on the operation result of the detection step ( S100 ), estimating a dangerous Bluetooth device based on the operation result of the access step ( S200 ), or the detection step A dangerous Bluetooth device is estimated based on the operation result by (S100) and the operation result by the connection step (S200).

According to an embodiment, the estimation step ( S300 ) extracts a MAC address from the AD packets found in the detection step ( S100 ), and among the MAC addresses extracted in the step of extracting the MAC address, Bluetooth having the same MAC address as each other Devices can be presumed to be dangerous Bluetooth devices.

According to an embodiment, the estimation step S300 extracts a MAC address from the AD packets found in the detection step S100 and estimates a Bluetooth device having an atypical MAC address from among the extracted MAC addresses as a dangerous Bluetooth device. can do.

According to an embodiment, in the estimating step S300, the signal strength of the AD packets broadcast from the Bluetooth devices is greater than the reference value, and the location of the Bluetooth device that has transmitted the AD packet having the signal strength greater than the reference value is determined. When out of the reference range, the Bluetooth device that has transmitted the AD packet having a signal strength greater than the reference value may be estimated as a dangerous Bluetooth device.

According to one embodiment, in the estimation step (S300), when the type of service found from the AD packet received from the Bluetooth device found in the detection step (S100) is not the same as the type of service found from the service information, Such a Bluetooth device can be presumed to be a dangerous Bluetooth device.

According to an embodiment, the estimating step ( S300 ) is performed when the type of the Bluetooth device found out from the AD packet received from the Bluetooth device found in the detection step ( S100 ) is not the same as the type of the Bluetooth device found from the service information. , it can be assumed that such a Bluetooth device is a dangerous Bluetooth device.

Since more detailed descriptions of the detection operation, the access operation, and the dangerous device estimation operation mentioned in the above steps have been previously described, they will be omitted here.

All or some steps of the above-described method for screening a dangerous Bluetooth device may be executed by a computer program. Such a computer program may be loaded into a memory, executed by a computer processor, and stored in a computer-readable storage medium (eg, a storage device).

As such, a person skilled in the art to which the present invention pertains can make various modifications and variations from the description of the above-described specification. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined by the following claims as well as the claims and equivalents.

100: sorting device S, M1, M2, M3, M4: Bluetooth device
101: detection unit 103: connection unit
105: estimator 107: operating system
109: communication unit 111: computer processor
113: memory 115: memory

Claims (8)

In the method of screening a dangerous Bluetooth device,
detecting, by the screening device, finding a Bluetooth device;
a connection step of connecting the screening device to the detected Bluetooth device; and
an estimation step of estimating, by the screening device, a dangerous Bluetooth device among the Bluetooth devices found in the detection step based on at least one result of the result of the detection step and the result of the connection step;
The detection step
A first scanning step of scanning advertising packets broadcast from Bluetooth devices and a finishing packet for disconnecting already connected Bluetooth devices are broadcast before the detection step is performed. a secondary scanning step of casting and scanning advertising packets broadcast from Bluetooth devices;
wherein the first scanning step, broadcasting the finishing packet, and the second scanning step are sequentially performed,
The connection step
The method of selecting a dangerous Bluetooth device, wherein the screening device performs a connection operation with the Bluetooth device found in the detection step, and the screening device performs a device information acquisition operation of acquiring service information from the connected Bluetooth device. According to claim 1,
The estimation step is
extracting a MAC address from the advertising packets found in the detection step, and estimating Bluetooth devices having the same MAC address as a dangerous Bluetooth device among the MAC addresses extracted in the step of extracting the MAC address , how to screen for dangerous Bluetooth devices. delete According to claim 1,
The estimation step is
When the signal strength of advertising packets broadcast from Bluetooth devices is greater than the reference value, and the location of the Bluetooth device that has transmitted the advertising packet having a signal strength greater than the reference value is out of the reference range, A method for selecting a dangerous Bluetooth device, wherein the Bluetooth device that has transmitted the advertising packet having a signal strength greater than the reference value is estimated as a dangerous Bluetooth device. According to claim 1,
The estimation step is
If the type of service found from the advertising packet received from the Bluetooth device found in the detection step is not the same as the service type found from the service information acquired in the device information acquisition step, the Bluetooth device is selected A method of screening a dangerous Bluetooth device, which is presumed to be a dangerous Bluetooth device. According to claim 1,
The estimation step is
If the type of Bluetooth device found from the advertising packet received from the Bluetooth device found in the detection step is not the same as the type of Bluetooth device found from the service information acquired in the device information acquisition step, the Bluetooth device A method for screening a dangerous Bluetooth device, which is to presume to be a dangerous Bluetooth device. delete delete

Images