The basic concept of Bluetooth Low Energy (BLE) is short packet transmission and transient connection. It can quickly establish a connection, send data, and quickly disconnect, so that neighbor discovery is frequent a...The basic concept of Bluetooth Low Energy (BLE) is short packet transmission and transient connection. It can quickly establish a connection, send data, and quickly disconnect, so that neighbor discovery is frequent and becomes an important issue. In the neighbor discovery which includes advertising and scanning, the BLE specification defines several important parameters. The parameters on the advertiser side include advertising interval, advertising duration, etc. On the scanner side, there are scan interval, scan window, etc. How to configure these parameters for quick neighbor discovery has been troublesome for BLE implementers. Prior analyses on BLE discovery process also showed some disagreements or made some incorrect assumptions. In this paper, we use rigorous probability-theory based derivations to obtain different kinds of successful discovery probabilities. We clarify disagreements in prior works and also provide insights on how to configure parameters for maximizing discovery probability. In particular, we prove that the discovery probabilities on each of the three channels are correlated. We also find that, when the advertising duration is set close to some multiples of the scan interval, an ill-fated synchronization problem will occur. To have a high discovery probability, both scan window and scan interval should be set at a large value, though it might not be good for energy saving.展开更多
Wearable devices are becoming more popular in our daily life.They are usually used to monitor health status,track fitness data,or even do medical tests,etc.Since the wearable devices can obtain a lot of personal data,...Wearable devices are becoming more popular in our daily life.They are usually used to monitor health status,track fitness data,or even do medical tests,etc.Since the wearable devices can obtain a lot of personal data,their security issues are very important.Motivated by the consideration that the current pairing mechanisms of Bluetooth Low Energy(BLE)are commonly impractical or insecure for many BLE based wearable devices nowadays,we design and implement a security framework in order to protect the communication between these devices.The security framework is a supplement to the Bluetooth pairing mechanisms and is compatible with all BLE based wearable devices.The framework is a module between the application layer and the GATT(Generic Attribute Profile)layer in the BLE architecture stack.When the framework starts,a client and a server can automatically and securely establish shared fresh keys following a designed protocol;the services of encrypting and decrypting messages are provided to the applications conveniently by two functions;application data are securely transmitted following another protocol using the generated keys.Prudential principles are followed by the design of the framework for security purposes.It can protect BLE based wearable devices from replay attacks,Man-in-The-Middle attacks,data tampering,and passive eavesdropping.We conduct experiments to show that the framework can be conveniently deployed with practical operational cost of power consumption.The protocols in this framework have been formally verified that the designed security goals are satisfied.展开更多
针对当前资产定位系统定位精度、建设成本和部署灵活性难以有效平衡的问题,基于BLE Mesh采用多维标度分析(MultiDimensional Scaling-Map,MDS-MAP)定位算法设计了一种资产定位系统。系统首先对原始接收信号强度(Received Signal Strengt...针对当前资产定位系统定位精度、建设成本和部署灵活性难以有效平衡的问题,基于BLE Mesh采用多维标度分析(MultiDimensional Scaling-Map,MDS-MAP)定位算法设计了一种资产定位系统。系统首先对原始接收信号强度(Received Signal Strength Indicator,RSSI)进行高斯-卡尔曼融合滤波,提高了RSSI值的准确性;然后利用生存时间(Time To Live,TTL)对中继节点进行约束,提高了数据传输的有效性;最后利用半径弥补法与Bellman-Ford融合迭代方案对生成的距离矩阵进行修正,减小了测距误差。实验结果表明,所设计的系统可有效完成蓝牙标签信息更新以及位置展示,平均定位精度达到了0.94 m。本系统具有成本低、工程实施方便的优点,有一定的应用价值和发展前景。展开更多
In the era of the Internet of Things,Bluetooth low energy(BLE/BTLE)plays an important role as a wellknown wireless communication technology.While the security and privacy of BLE have been analyzed and fixed several ti...In the era of the Internet of Things,Bluetooth low energy(BLE/BTLE)plays an important role as a wellknown wireless communication technology.While the security and privacy of BLE have been analyzed and fixed several times,the threat of side-channel attacks to BLE devices is still not well understood.In this work,we highlight a side-channel threat to the re-keying protocol of BLE.This protocol uses a fixed long term key for generating session keys,and the leakage of the long term key could render the encryption of all the following(and previous)connections useless.Our attack exploits the side-channel leakage of the re-keying protocol when it is implemented on embedded devices.In particular,we present successful correlation electromagnetic analysis and deep learning based profiled analysis that recover long term keys of BLE devices.We evaluate our attack on an ARM Cortex-M4 processor(Nordic Semiconductor nRF52840)running Nimble,a popular open-source BLE stack.Our results demonstrate that the long term key can be recovered within only a small amount of electromagnetic traces.Further,we summarize the features and limitations of our attack,and suggest a range of countermeasures to prevent it.展开更多
With the rapid development of the Internet of Things(IoT),wireless technology has become an indispensable part of modern computing platforms and embedded systems.Wireless device fingerprint identification is deemed as...With the rapid development of the Internet of Things(IoT),wireless technology has become an indispensable part of modern computing platforms and embedded systems.Wireless device fingerprint identification is deemed as a promising solution towards enhancing the security of device access authentication and communication process in the IoT scenario.However,the extraction of features from the network layer and its upper layers often confront restrictions from specific devices:the association with a certain wireless network and the access to the plaintext of the payload.Meanwhile,Bluetooth Low Energy(BLE)packets have been encrypted above the link layer,which makes those features difficult to extract.To tackle these problems,we introduce a novel method to identify BLE devices based on the fingerprint features in the data link layer.Initially,the BLE packets are collected through a receiver based on software-defined radio technology.Then,fields that reflect device differences in BLE broadcast packets are extracted through traffic analysis.Finally,a MultiLayer Perceptron(MLP)model is employed to recognize the category of BLE devices.An experimental result on a dataset with 15 types of BLE devices shows that the identification accuracy of the proposed method can reach 99.8%,which accomplishes better performance over previous work.展开更多
文摘The basic concept of Bluetooth Low Energy (BLE) is short packet transmission and transient connection. It can quickly establish a connection, send data, and quickly disconnect, so that neighbor discovery is frequent and becomes an important issue. In the neighbor discovery which includes advertising and scanning, the BLE specification defines several important parameters. The parameters on the advertiser side include advertising interval, advertising duration, etc. On the scanner side, there are scan interval, scan window, etc. How to configure these parameters for quick neighbor discovery has been troublesome for BLE implementers. Prior analyses on BLE discovery process also showed some disagreements or made some incorrect assumptions. In this paper, we use rigorous probability-theory based derivations to obtain different kinds of successful discovery probabilities. We clarify disagreements in prior works and also provide insights on how to configure parameters for maximizing discovery probability. In particular, we prove that the discovery probabilities on each of the three channels are correlated. We also find that, when the advertising duration is set close to some multiples of the scan interval, an ill-fated synchronization problem will occur. To have a high discovery probability, both scan window and scan interval should be set at a large value, though it might not be good for energy saving.
文摘Wearable devices are becoming more popular in our daily life.They are usually used to monitor health status,track fitness data,or even do medical tests,etc.Since the wearable devices can obtain a lot of personal data,their security issues are very important.Motivated by the consideration that the current pairing mechanisms of Bluetooth Low Energy(BLE)are commonly impractical or insecure for many BLE based wearable devices nowadays,we design and implement a security framework in order to protect the communication between these devices.The security framework is a supplement to the Bluetooth pairing mechanisms and is compatible with all BLE based wearable devices.The framework is a module between the application layer and the GATT(Generic Attribute Profile)layer in the BLE architecture stack.When the framework starts,a client and a server can automatically and securely establish shared fresh keys following a designed protocol;the services of encrypting and decrypting messages are provided to the applications conveniently by two functions;application data are securely transmitted following another protocol using the generated keys.Prudential principles are followed by the design of the framework for security purposes.It can protect BLE based wearable devices from replay attacks,Man-in-The-Middle attacks,data tampering,and passive eavesdropping.We conduct experiments to show that the framework can be conveniently deployed with practical operational cost of power consumption.The protocols in this framework have been formally verified that the designed security goals are satisfied.
文摘针对当前资产定位系统定位精度、建设成本和部署灵活性难以有效平衡的问题,基于BLE Mesh采用多维标度分析(MultiDimensional Scaling-Map,MDS-MAP)定位算法设计了一种资产定位系统。系统首先对原始接收信号强度(Received Signal Strength Indicator,RSSI)进行高斯-卡尔曼融合滤波,提高了RSSI值的准确性;然后利用生存时间(Time To Live,TTL)对中继节点进行约束,提高了数据传输的有效性;最后利用半径弥补法与Bellman-Ford融合迭代方案对生成的距离矩阵进行修正,减小了测距误差。实验结果表明,所设计的系统可有效完成蓝牙标签信息更新以及位置展示,平均定位精度达到了0.94 m。本系统具有成本低、工程实施方便的优点,有一定的应用价值和发展前景。
基金supported by the National Natural Science Foundation of China under Grant No.62072307。
文摘In the era of the Internet of Things,Bluetooth low energy(BLE/BTLE)plays an important role as a wellknown wireless communication technology.While the security and privacy of BLE have been analyzed and fixed several times,the threat of side-channel attacks to BLE devices is still not well understood.In this work,we highlight a side-channel threat to the re-keying protocol of BLE.This protocol uses a fixed long term key for generating session keys,and the leakage of the long term key could render the encryption of all the following(and previous)connections useless.Our attack exploits the side-channel leakage of the re-keying protocol when it is implemented on embedded devices.In particular,we present successful correlation electromagnetic analysis and deep learning based profiled analysis that recover long term keys of BLE devices.We evaluate our attack on an ARM Cortex-M4 processor(Nordic Semiconductor nRF52840)running Nimble,a popular open-source BLE stack.Our results demonstrate that the long term key can be recovered within only a small amount of electromagnetic traces.Further,we summarize the features and limitations of our attack,and suggest a range of countermeasures to prevent it.
基金supported by the National Natural Science Foundation of China(Nos.61972085,62072103,62232004)the Jiangsu Provincial Key R&D Program(Nos.BE2021729,BE2022680,BE2022065-4)+3 种基金the Jiangsu Provincial Key Laboratory of Network and Information Security(No.BM2003201)the Key Laboratory of Computer Network and Information Integration of Ministry of Education of China(No.93K-9)the Collaborative Innovation Center of Novel Software Technology and Industrialization,the Fundamental Research Funds for the Central Universities,the CCF-Baidu Open Fund(No.2021PP15002000)the Future Network Scientific Research Fund Project(No.FNSRFP-2021-YB-02).
文摘With the rapid development of the Internet of Things(IoT),wireless technology has become an indispensable part of modern computing platforms and embedded systems.Wireless device fingerprint identification is deemed as a promising solution towards enhancing the security of device access authentication and communication process in the IoT scenario.However,the extraction of features from the network layer and its upper layers often confront restrictions from specific devices:the association with a certain wireless network and the access to the plaintext of the payload.Meanwhile,Bluetooth Low Energy(BLE)packets have been encrypted above the link layer,which makes those features difficult to extract.To tackle these problems,we introduce a novel method to identify BLE devices based on the fingerprint features in the data link layer.Initially,the BLE packets are collected through a receiver based on software-defined radio technology.Then,fields that reflect device differences in BLE broadcast packets are extracted through traffic analysis.Finally,a MultiLayer Perceptron(MLP)model is employed to recognize the category of BLE devices.An experimental result on a dataset with 15 types of BLE devices shows that the identification accuracy of the proposed method can reach 99.8%,which accomplishes better performance over previous work.
