具有Hm10外围设备的iOS核心蓝牙BLE安全性

Question

Can someone suggest if it is possible in BLE communication to authenticate the central from peripherial before connection is established?

Example: 1) Peripherial Advertises continuously 2) Central discovers Peripherial and sends connection request 3) Connection is Established and Advertising stops 3) Peripherial authenticates central via AES or Pairing etc. 4) If authentication is succesful transfer data.

Either ways once this malicious central has connected to peripherial the Genuine Central will not be able to as each peripherial. If I have understood properly, Peripherial can not end connection or start connection and peripherial do not allow simultaneous connections.

How can I solve this problem? Even if some way of terminating connection from peripherial is made possible, the malicious central will keep reconnecting hence essentially performing DENIAL OF SERVICE(DOS) attack.

Thank You!

Answer 1

You have the sequence slightly wrong. It should be -

1. Peripheral advertises
2. Central discovers peripheral and attempts to connect
3. PIN is requested if central is not already paired
4. Connection completes if pairing is successful. If not return to state 1
5. If connection is successful advertising stops and data can be transferred.

So, the security is based on the PIN being kept a secret. If the PIN is well-known (ie defaults to 0000) or can be easily discovered (printed/displayed on the device and physical access is possible) then security is compromised.

In theory a DOS attack is also possible by making repeated connection attempts, but this does still leave an opportunity for the legitimate central to connect.

Answer 2

Okay, this is a little late, but anyway: from v515 upwards you can use the AT+TYPEx command to change the authentication behaviour.

x can be, according to the docs:

• 0:Not need PIN Code (default)
• 1:Auth not need PIN
• 2:Auth with PIN
• 3:Auth and bond