蓝牙位置隐私保护安全协议设计

Design of Security Protocol on Bluetooth Location Privacy Protection

针对蓝牙规范固定设备地址易导致用户位置隐私泄露的问题,从蓝牙查询、寻呼和会话连接三个方面入手,建立了蓝牙地址保护层次模型,通过引入加密和身份认证等安全机制,系统设计了蓝牙安全查询、寻呼及会话更新协议,并对协议的安全性进行了分析,保证了蓝牙跳频通信过程中设备地址安全。在此基础上,结合FPGA硬件开发平台和蓝牙射频模块,构建了蓝牙位置隐私保护实验环境,对协议的执行性能进行了仿真与测试分析。实验结果表明,协议不仅能够有效抵抗窃听攻击、重放攻击、中间人攻击、查询地址和会话地址跟踪攻击等,而且存储和计算开销较小,满足嵌入式蓝牙系统要求。

The leakage of users’ location privacy was caused by fixed bluetooth device address defined in the bluetooth specification. To solve the problem, a bluetooth address protection hierarchical model was established in terms of inquiry, paging and conversation. With the introduction of security mechanisms such as encryption and authentication, security protocols for inquiry, paging and conversation update were designed and analyzed to protect bluetooth device address during frequency hopping communication. With FPGA hardware and bluetooth radio module, an experiment environment was constructed and the performance of security protocols was simulated and tested. The experiment results show that the protocols can not only resist eavesdropping, replay attack, man-in-the-middle attack, inquiry address and conversation address tracking attack, but also have little computing and storage cost and meet the requirements of embedded bluetooth system.