Bluetooth Low Energy Address Randomization Against Passive and Active Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Bluetooth Low Energy (BLE) devices are vulnerable to MAC address tracking attacks due to flawed randomization schemes in the Bluetooth protocol, allowing attackers to track devices by passively sniffing or actively replaying MAC addresses, despite the use of allowlists for security.
Innovation Solution
Implement a synchronized, interval-unpredictable Resolvable Private Address (RPA) generation scheme with timestamps to generate one-time-only MAC addresses, and synchronize randomization between central and peripheral devices to prevent both passive and active MAC address tracking attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If MAC address randomization is implemented using current Bluetooth protocol, then device privacy is improved, but the system becomes vulnerable to replay attacks where attackers can sniffed MAC addresses to probe device responses
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing a table of valid random MAC addresses before they are needed for communication. When a device needs to generate a MAC address, it selects from pre-generated valid addresses rather than generating them on-demand, preventing replay attacks because the table only contains addresses that have been validated as usable.
Solution Approach 2:
The patent uses copying by creating a table that copies and stores valid MAC address patterns. Instead of generating unique random addresses each time, the system copies from a pre-validated set of address patterns, ensuring that replayed addresses cannot be used to probe device responses since the copied addresses are already accounted for in the validation table.
2Reliability
If allowlist filtering is enabled to prevent untrusted device connections, then device security is improved, but MAC address tracking attacks become possible through behavioral analysis of packet responses
Solution Approach 1:
The patent applies parameter changes by dynamically modifying the MAC address parameter based on the allowlist filtering mechanism. When a device is filtered out by the allowlist, the system changes the MAC address parameter to a different value, making it impossible for attackers to track devices through consistent MAC address behavior patterns while maintaining the security benefits of allowlist filtering.
Solution Approach 2:
The patent implements dynamics by making the MAC address assignment dynamic rather than static. The system dynamically selects and assigns MAC addresses from the valid table based on the current communication context and allowlist status, preventing attackers from using static MAC address tracking methods to identify and monitor specific devices.
3Stability of the object's composition
If MAC address randomization interval is extended to reduce frequency of changes, then device stability is improved, but address tracking becomes easier over extended periods
Solution Approach 1:
The patent uses preliminary action by pre-generating and storing a comprehensive table of valid random MAC addresses before the randomization interval expires. This allows the system to maintain extended stability periods while still preventing tracking, because the pre-computed table provides a fresh set of valid addresses that cannot be used for tracking even though the interval is extended.
Solution Approach 2:
The patent applies parameter changes by updating the MAC address parameter from the pre-generated table at extended intervals. The system changes the MAC address parameter less frequently (improving stability) while using addresses from a pre-validated table that prevents tracking (maintaining privacy), resolving the contradiction between stability and tracking prevention.
Data Source
AI summary
Bluetooth Address Tracking (BAT) is an allowlist-based side channel attack to track Bluetooth devices, by either passively sniffing the Bluetooth packets, or actively replaying the sniffed ones. Securing addresses of Bluetooth Low Energy (BLE) is described, which uses an interval unpredictable, central and peripheral synchronized random media access control (MAC) address generation scheme to defend against passive BAT attacks, and uses a current timestamp to derive random MAC addresses to defeat active BAT attacks, such that attackers can no longer be able to replay them.