Secure BLE Beacon Authentication via Pre-Shared Key Tags
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Bluetooth Low Energy (BLE) wireless beacons lack protection against unauthorized copying and alteration of transmitted data, leading to potential misuse and misleading position data, as they operate in an unlicensed frequency band with inexpensive, highly integrated transceiver devices readily available.
Innovation Solution
Incorporating authentication tags computed using secret keys shared between devices, which are included in security data packets transmitted alongside non-security data packets, allowing receivers to verify the authenticity of broadcast messages and detect unauthorized replication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication tags and secret keys are incorporated into BLE beacon communications, then security against unauthorized copying and alteration is improved, but device complexity and communication overhead increase
Solution Approach 1:
The patent applies preliminary action by pre-establishing secret keys between beacons and receiving devices before actual communication occurs. This allows authentication tags to be computed and verified without real-time key exchange, reducing communication overhead while maintaining security. The pre-shared keys enable devices to authenticate each other immediately when beacon packets are transmitted.
Solution Approach 2:
The patent uses authentication tags as an intermediary mechanism to verify beacon packet authenticity. Instead of requiring complex mutual authentication protocols, the system introduces authentication tags computed from secret keys as a mediator that simplifies the verification process. Receiving devices can quickly validate beacon packets by checking these tags against pre-shared keys, reducing computational complexity while improving security.
2Reliability
If authentication tags are included in every beacon packet, then data integrity is protected, but communication overhead and power consumption increase
Solution Approach 1:
The patent applies partial action by selectively applying authentication to only the critical portions of beacon packets. Instead of authenticating entire packets with large authentication tags, the system computes authentication tags only over essential data fields such as beacon identifier and location information. This reduces the computational overhead and energy consumption while maintaining data integrity for the most critical packet components.
3Ease of manufacture
If BLE beacons operate in unlicensed frequency band with simple transceivers, then ease of deployment and low cost are achieved, but vulnerability to spoofing and unauthorized replication increases
Solution Approach 1:
The patent addresses the spoofing vulnerability by implementing a copying detection mechanism. Each beacon packet includes an authentication tag that is computationally derived from pre-shared secret keys. When a receiving device detects a beacon packet, it can verify the authentication tag to determine if the packet is a genuine transmission or an unauthorized copy. This allows the system to maintain simple unlicensed band operation while detecting and rejecting spoofed packets.
Data Source
AI summary
Using various embodiments, methods and systems for secure Bluetooth Low Energy communications, in an unconnected state, are described herein. In one embodiment, conventional BLE transmitting device data can be supplemented with authentication information, including a message authentication field which enables receivers to determine if the received beacon/transmitted BLE peripheral data is genuine. In another embodiment, the authentication data can also include a time varying value field in order to prevent unintentional acceptance of transmitting device data from unauthorized replicated BLE peripherals. In one embodiment, the transmitting device computes an authentication tag using at least a secret key known to the receiving device and transmits the authentication tag to the receiving device. The receiving device can compute an authentication value using the secret key and other transmitting device information and determine if the transmitting device data is genuine by comparing the computed authentication value and the received the authentication tag.