Bluetooth Mesh Security Overview

 

The Criticality of Security

One of the most discussed issues related to the Internet of Things (IoT) is security. From agriculture to hospitals, from residential smart homes to commercial smart buildings, and from power stations to traffic management systems, IoT systems and technologies will touch many parts of the world we live in. Security breaches in IoT systems could have catastrophic consequences.

Bluetooth^® mesh networking was designed with security as its number one priority and from the ground up. In this article, you’ll get an overview of the key security features and the security issues addressed. Further articles in the series will examine aspects of Bluetooth mesh networking security in more detail.

Security in Bluetooth Mesh Networking is Mandatory

Bluetooth^® Low Energy (LE) GATT devices may implement a range of security measures as defined in the Bluetooth core specification. It’s the responsibility of the product designer to decide what security measures are required and it’s permissible to decide to adopt none of the available security features at all. In other words, security in Bluetooth Low Energy GATT is optional. This makes sense if we’re talking about the security of a single device and its connection with one other device, provided the product designer performs their risk assessment correctly. However, security in Bluetooth mesh networking is concerned with the security of more than individual devices or connections between peer devices; it’s concerned with the security of an entire network of devices and of various groupings of devices in the network.

Consequently, security in Bluetooth mesh networking is mandatory.

Bluetooth Mesh Networking Security Fundamentals

The following fundamental security statements apply to all Bluetooth mesh networks:

Encryption and Authentication	All Bluetooth mesh messages are encrypted and authenticated.
Separation of Concerns	Network security, application security, and device security are addressed independently. See Separation of Concerns below.
Area Isolation	A Bluetooth mesh network can be divided into subnets, each cryptographically distinct and secure from the others.
Key Refresh	Security keys can be changed during the life of the Bluetooth mesh network via a Key Refresh procedure.
Message Obfuscation	Message obfuscation makes it difficult to track messages sent within the network and, as such, provides a privacy mechanism to make it difficult to track nodes.
Replay Attack Protection	Bluetooth mesh security protects the network against replay attacks.
Trashcan Attack Protection	Nodes can be removed from the network securely, in a way which prevents trashcan attacks.
Secure Device Provisioning	The process by which devices are added to the Bluetooth mesh network to become nodes is a secure process.

 

Separation of Concerns and Security Keys

At the heart of Bluetooth^® mesh security are three types of security keys. These keys provide security to different aspects of the Bluetooth mesh network and achieve a critical capability in Bluetooth mesh networking security called a separation of concerns.

Consider a mesh light which acts as a relay. In its capacity as a relay, it may find itself handling messages relating to the building’s Bluetooth mesh door and window security system. A light has no business accessing and processing the details of these messages, but it does need to relay them to other nodes.

To deal with this potential conflict of interest, Bluetooth mesh uses different security keys called AppKeys for securing messages at the network layer from those used to secure data relating to specific applications, such as lighting, physical security, heating, etc.

All nodes in a Bluetooth mesh network possess one or more Network Keys (NetKey), each corresponding to a subnet which may be the primary subnet. It’s possession of a network key which makes a node a member of the network. Network Encryption Keys and Privacy Keys are derived directly from the NetKey.

Being in possession of a NetKey allows a node to decrypt and authenticate up to the Network Layer so that network functions, such as relaying, can be carried out. It does not allow application data to be decrypted.

Each node also has a unique security key called the Device Key or DevKey. The DevKey is used in the provisioning and configuration of the node.

Area Isolation

Possession of the primary NetKey defines membership of and grants access to the Bluetooth^® mesh network. But it’s also possible to divide the network into distinct subnets, each with its own subnet key. This means that only devices in possession of a given subnet key can communicate with other devices that are members of that subnet. Subnet keys can be created and assigned on an adhoc basis too. A great example is isolating nodes in different hotel rooms from each other.

Node Removal, Key Refresh, and Trashcan Attacks

As described above, nodes contain various Bluetooth^® mesh security keys. Should a node become faulty and need to be disposed of, or if the owner decides to sell the node to another owner, it’s important that the device and the keys it contains cannot be used to mount an attack on the network the node was taken from.

A procedure for removing a node from a network is defined. The Provisioner application is used to add the node to a reject list and then a Key Refresh Procedure is initiated.

The Key Refresh Procedure issues all nodes in the network, except those which are members of the reject list, new network keys, application keys, and all related, derived data. In other words, the entire set of security keys which form the basis for network and application security are replaced.

As such, a node which was removed from the network, and which contains an old NetKey and old set of AppKeys, is no longer a member of the network and poses no threat.

Privacy

A Privacy Key, derived from the NetKey, is used to obfuscate network PDU header values, such as the source address. Obfuscation ensures that casual, passive eavesdropping cannot be used to track nodes and the people using them. It also makes attacks based upon traffic analysis difficult.

Replay Attacks

In network security, a replay attack is a technique whereby an eavesdropper intercepts and captures one or more messages and simply retransmits them later, with the goal of tricking the recipient into carrying out something which the attacking device is not authorized to do. A commonly cited example is a car’s keyless entry system being compromised by an attacker who intercepts the authentication sequence between the car’s owner and the car, later replaying those messages to gain entry to the car and steal it.

Bluetooth^® mesh networking protects against replay attacks by using two network PDU fields called the Sequence Number (SEQ) and IV Index. Elements increment the SEQ value every time they publish a message. A node which receives a message from an element containing an SEQ value less than or equal to that of the last valid message will discard it since it likely relates to a replay attack. Similarly, IV Index is a separate field considered alongside SEQ. IV Index values within messages from a given element must always be equal to or greater than the last valid message from that element.

Cryptography Toolbox

Most of the security features of Bluetooth mesh networking rely upon industry-standard cryptographic algorithms and procedures. Reference will be made to them in other security-related articles in this series, but we’ll explain the most important ones here.

There are two key security functions used in the Bluetooth mesh stack: AES-CMAC and AES-CCM. These are fundamental encryption and authentication functions, and all other functions used for key generation are based upon them.

AES-CMAC

Cipher-based Message Authentication Code (CMAC) is an algorithm which can generate a fixed length, 128-bit message authentication value for any variable length input. The formula for generating a message authentication code MAC using the AES-CMAC algorithm is written as:

        MAC = AES-CMAC_k(m)

The inputs to AES-CMAC are:

k – the 128-bit key.
m – the variable length data to be authenticated.

AES-CMAC has excellent error-detection capabilities. Other techniques, involving the verification of a checksum or use of an error-detecting code, may detect only accidental modifications of the data. AES-CMAC is designed to detect intentional, unauthorized modifications of the data, as well as accidental modifications. If you are interested in learning more about this function, please refer to RFC4493 which defines it. 

AES-CCM

AES-CCM is a generic, authenticated encryption algorithm, intended for use with cryptographic block ciphers. In the Bluetooth mesh specification, AES-CCM is used as the basic encryption and authentication function in all cases. The formula for its use is as follows:

ciphertext , MIC = AES-CCM_k (n,m,a)

There are four inputs to AES-CCM:

              k – the 128-bit key.

              n – a 104-bit nonce.

              m – the variable length data to be encrypted and authenticated.

a – the variable length data to be authenticated but not encrypted, also known as Additional Data. This input parameter may be zero bytes in length.

There are two outputs from AES-CCM:

              ciphertext – the variable length data after it has been encrypted.

              MIC – the Message Integrity Check value of m and a.

Figure 1 shows a plain-text payload, which may be from the Bluetooth^® mesh network layer or upper transport layer, being processed by AES-CCM with an input encryption key, nonce, and plaintext payload. An encrypted payload and MIC is output.

Figure 1 – AES-CCM used for packet payload encryption and authentication

SALT Generation

Bluetooth^® mesh security defines a SALT generation function known as s1, which uses the AES-CMAC function. As explained above, AES-CMAC has two input parameters: k and m. When used for SALT generation though, only the input parameter m varies. k is always set to the 128-bit value: 0x0000 0000 0000 0000 0000 0000 0000 0000, which is referred to as ZERO in the Bluetooth mesh specification.

Figure 2 – The SALT generation function

The input to the SALT generation function is:

              m – a non-zero length octet array or ASCII encoded string.

The output is a 128-bit MAC value and the s1 formula is written as:

s1(m) = AES-CMAC_ZERO(m)

Other security functions

In the Bluetooth mesh networking specification section 3.8.2, Security Toolbox, you will find other security functions defined, such as various key derivation functions. All of them are based on AES-CMAC and the SALT generation function, s1 (the SALT generation function is also based on AES-CMAC).

Onwards!

Security is an important issue for Bluetooth, and the topic will come up repeatedly in our series on Bluetooth mesh networking. After reading this article, you should have a good understanding of the primary Bluetooth^® mesh networking security features and some of the underlying cryptography techniques involved. You’re now ready to take a deeper dive into Bluetooth mesh network security when we cover the subject in future articles.

Secure Design for Low Energy Bluetooth (BLE) Applications

 Low Energy Bluetooth (BLE) is widely used in various smart devices and IoT scenarios as a low-power, short-range wireless communication technology. However, due to the characteristics of BLE, it is susceptible to various security threats. Therefore, when designing and developing BLE applications, it is crucial to focus on security issues and implement appropriate security measures to protect communication data and user privacy.

Firstly, Security Measures for Bluetooth Pairing

In the pairing process between BLE devices, it is essential to use FIPS-approved algorithms such as AES-CMAC and P-256 elliptic curve to ensure the security of pairing information. Pairing information should be stored in a secure storage location on the device to prevent malicious attackers from stealing it.
For authentication and encryption, FIPS-approved algorithms should also be used to ensure the confidentiality and integrity of communication data. For example, the use of AES-CCM algorithm can encrypt and protect data transmission, while also ensuring the integrity of messages. In healthcare devices, such as a health wristband communicating with a smartphone, the use of AES-CCM algorithm encrypts the user's health data to ensure its confidentiality.
To prevent passive eavesdropping and man-in-the-middle attacks, user-assisted secure simple pairing methods can be used. For instance, using the ECDHE algorithm for Simple Secure Pairing (SSP) to prevent passive eavesdropping attacks, and employing the user-assisted digital method Passkey Entry to prevent man-in-the-middle attacks.
Here is the description of the Bluetooth Simple Secure Pairing (SSP) implementation example:
Device Preparation
• Device A (Initiator): a Bluetooth device, such as a smartphone.
• Device B (Responder): a Bluetooth device, such as a Bluetooth speaker.
Pairing Steps
1. Device A and Device B both support Bluetooth 2.1 or higher and SSP.
2. Device A and Device B are both in discoverable mode, ready to pair.
3. Device A sends a pairing request to Device B, and Device B starts the pairing process upon receiving the request.
Pairing Process
1. Device B generates a random number (Nonce) and sends it to Device A.
2. Device A receives the random number and generates its own random number (Nonce), which is sent to Device B.
3. Device A and Device B both use their own random numbers and the other's random number to calculate a shared secret key (Shared Secret).
4. Device A and Device B both use the shared secret key to calculate a pairing key (Pairing Key).
5. Device A and Device B both use the pairing key to encrypt their identity information (Identity Information) and send it to each other.
6. Device A and Device B both verify each other's identity information, and if the verification is successful, the pairing is complete.
Verification Steps
1. Device A and Device B both compare the other's identity information with their own, and if they match, the verification is successful.
2. Device A and Device B both store the pairing key in their devices for future connections.

Secondly, Security Measures for Bluetooth Privacy

To protect the privacy of BLE devices, address randomization can enhance device security. By frequently changing the Bluetooth device address, it reduces the difficulty for attackers to track BLE devices over a long period. Furthermore, to reconnect known devices, the device's private address must be resolvable by other devices, which requires using the device identity resolution key exchanged during pairing to generate the private address. For example, in a retail store's iBeacon system, changing the iBeacon device's Bluetooth address frequently can prevent malicious tracking of user behavior, thus protecting user privacy.
Here is the implementation example:
Device A (BLE Device)
• Hardware: BLE microcontroller with a random number generator (RNG)
• Software: BLE stack with address randomization and pairing process implementation
Device B (Central Device)
• Hardware: BLE microcontroller with a random number generator (RNG)
• Software: BLE stack with pairing process implementation and device identity resolution key storage
Address Randomization Process
1. Device A generates a new random address (RA) using its RNG.
2. Device A sets the new RA as its Bluetooth address.
3. Device A stores the RA and a corresponding index (e.g., a counter) in its memory.
Pairing Process
1. Device A and Device B initiate a pairing process using a standard BLE pairing protocol (e.g., SMP).
2. During the pairing process, Device A and Device B exchange their respective public keys (PK_A and PK_B).
3. Device A and Device B use their public keys to generate a shared secret key (SSK) using a key agreement protocol (e.g., ECDH).
4. Device A and Device B use the SSK to generate a device identity resolution key (DIRK).
5. Device A and Device B store the DIRK in their respective memories.
Private Address Generation
1. Device A uses its RNG to generate a new private address (PA) based on the RA and the DIRK.
2. Device A sets the PA as its new Bluetooth address.
Reconnection Process
1. When Device B wants to reconnect to Device A, it uses the DIRK to generate the PA.
2. Device B sends a connection request to the PA.
3. Device A receives the connection request and verifies the PA using the DIRK.
4. If the verification is successful, Device A accepts the connection request and the two devices reconnect.
Security Benefits
• The frequent change of the Bluetooth address (RA) makes it difficult for an attacker to track the device for an extended period.
• The use of the DIRK to generate the PA ensures that only authorized devices can resolve the private address and reconnect to the device.
• The private address (PA) is not publicly visible, protecting the device's privacy.
This implementation example demonstrates how address randomization and private address generation using a device identity resolution key can enhance the security and privacy of BLE devices.

Thirdly, Security Measures for Bluetooth Denial of Service Attacks

A common form of Bluetooth denial of service attack involves attackers continuously maliciously connecting or pairing with Bluetooth devices, causing the Bluetooth channel to be occupied and therefore unusable. To prevent denial of service attacks, a Bluetooth firewall mechanism can be used. When faced with denial of service attacks, enabling a whitelist mechanism and gradually increasing the delay time for new pairing can prevent continuous brute-force attacks by malicious devices. During the delay period, only devices within the whitelist are allowed to connect, ensuring the availability of Bluetooth services.

For example, the following is an example of the protection measures inspired by iPhone 6S unlocking attacks prevention using increasing delay times to prevent continuous brute-force attacks that render Bluetooth services unavailable. The attempt number resets after a successful connection or pairing.

ATTEMPT NUMBER	NEW CONNECTION PAIRING EXECUTION DELAY
1-4	None
5-9	1 minute
10-14	10 minutes
15	1 hour
16-∞	1 hour (max delay)

Fourthly, Security Measures for Bluetooth Relay Attacks

Relay attacks are a common Bluetooth security threat where attackers use a relay device to pass communication data between communication parties, aiming to steal sensitive information or execute malicious operations. Limiting the communication distance between BLE devices can effectively prevent relay attacks. By controlling the transmission power of BLE devices or using location technologies, the distance between communication parties can be kept within a controllable range, reducing the likelihood of relay attacks.
Implementation Example:
Device A (BLE Device)
• Hardware: BLE microcontroller with a power amplifier and a distance measurement unit (e.g., RSSI or TOF)
• Software: BLE stack with transmit power control and distance measurement implementation
Device B (BLE Device)
• Hardware: BLE microcontroller with a power amplifier and a distance measurement unit (e.g., RSSI or TOF)
• Software: BLE stack with transmit power control and distance measurement implementation
Distance-based Relay Attack Prevention
1. Device A and Device B are configured to operate at a minimum transmit power level to ensure a maximum communication distance of a given meter.
2. When Device A and Device B are paired, they exchange their respective transmit power levels and distance measurement parameters.
3. During communication, Device A and Device B continuously measure the received signal strength (RSSI) or time of flight (TOF) to estimate the distance between them.
4. If the estimated distance exceeds a predefined threshold (e.g., 2 meters), Device A and Device B will reduce their transmit power levels to minimize the communication distance.
5. If the estimated distance continues to exceed the threshold, Device A and Device B will terminate the connection to prevent a potential relay attack.

In conclusion, the application of secure design for low energy Bluetooth (BLE) needs to comprehensively consider security mechanisms such as pairing, binding, authentication, encryption, message integrity, relay protection, Bluetooth privacy, and firewall to ensure the security and reliability of BLE communication. Only by fully considering security during product design and development can potential security threats be effectively mitigated, safeguarding the security of user data and privacy.

The History of Bluetooth: From Concept to Ubiquity

 In the 1990s, the world was on the cusp of a wireless revolution. The rise of mobile phones, laptops, and personal digital assistants (PDAs) had created a demand for a technology that could connect these devices without the need for cables. This was the genesis of Bluetooth, a wireless personal area network (PAN) technology that has since become ubiquitous in modern life.

The Conceptual Phase (1994-1997)

In 1994, a team of engineers at Intel, led by Dr. Jaap Haartsen, began exploring the concept of a wireless technology that could connect devices over short distances. They were joined by engineers from IBM, Toshiba, and Nokia, and together they formed the Bluetooth Special Interest Group (SIG). The name "Bluetooth" was chosen in honor of a 10th-century Danish king, Harald Blåtand, who united warring factions in Denmark – a fitting moniker for a technology that aimed to unite disparate devices.

The First Specification (1998)

In 1998, the Bluetooth SIG released the first public specification, version 1.0. This initial release defined the core principles of Bluetooth, including the use of radio frequency (RF) signals to transmit data between devices, and the concept of device discovery and pairing. The specification also outlined the various profiles, or use cases, that Bluetooth would support, such as headset and file transfer.

Early Adoption (1999-2002)

The first Bluetooth devices began appearing in 1999, with the introduction of Bluetooth-enabled headsets and adapters. However, early adoption was slow, due in part to the limited range and speed of the technology. It wasn't until 2002, with the release of version 1.1, that Bluetooth began to gain traction. This update improved data transfer rates and introduced new profiles, such as the ability to transfer files between devices.

Mainstream Success (2003-2007)

The release of version 2.0 in 2004 marked a significant turning point for Bluetooth. This update introduced Enhanced Data Rate (EDR), which increased data transfer rates to 3 Mbps. The addition of EDR made Bluetooth a viable alternative to wired connections, and adoption rates began to soar. By 2007, Bluetooth had become a standard feature in many devices, including mobile phones, laptops, and headphones.

Advancements and Expansions (2008-Present)

In the years that followed, Bluetooth continued to evolve and expand its capabilities. The release of version 3.0 in 2009 introduced High Speed (HS) data transfer, which allowed for faster data transfer rates over Wi-Fi. The subsequent releases of version 4.0 in 2010 and version 5.0 in 2016 further improved data transfer rates and range, as well as introduced new features such as low-energy mode and mesh networking.

Today, Bluetooth is an ubiquitous technology, used in everything from smart home devices to medical equipment. The Bluetooth SIG continues to develop and refine the technology, with a focus on emerging areas such as the Internet of Things (IoT) and augmented reality.

In conclusion, the history of Bluetooth is a testament to the power of innovation and collaboration. From its humble beginnings as a concept to its current status as a ubiquitous technology, Bluetooth has come a long way. As we look to the future, it will be exciting to see how Bluetooth continues to evolve and shape the world of wireless connectivity.

copyright: The History of Bluetooth: From Concept to Ubiquity (tosdn.com)