Co-Located Wi-Fi Obfuscation for BLE Ranging MITM Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
BLE ranging and localization solutions are vulnerable to man-in-the-middle (MITM) attacks, particularly in secure entry applications, where intruders can manipulate BLE packet timing to gain unauthorized access.
Innovation Solution
Utilize co-located Wi-Fi radios to transmit signals that overlap with BLE RTT packets in time and/or frequency domains, obfuscating the BLE signals and requiring intruders to manipulate both transmissions to launch successful attacks, thereby increasing their complexity and cost.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If BLE RTT packets are transmitted for ranging and localization, then positioning accuracy is improved, but security against MITM attacks deteriorates
Solution Approach 1:
A co-located Wi-Fi radio acts as an intermediary to transmit obfuscating signals during BLE ranging operations. The Wi-Fi radio is already present in the device but operates independently to provide additional security layer, perfectly illustrating the intermediary principle where a mediating element is introduced to protect the vulnerable BLE communication without disrupting the positioning function
Solution Approach 2:
The system performs preliminary anti-action by transmitting obfuscating Wi-Fi signals before and during BLE RTT packet transmission. This preemptive measure degrades the ability of intruding devices to intercept and manipulate BLE packets before the attack can succeed, while the legitimate receiving device can still properly process the BLE signals
2Reliability
If co-located Wi-Fi radios transmit obfuscating signals, then security against MITM attacks is improved, but device complexity increases
Solution Approach 1:
The co-located Wi-Fi radio serves multiple functions: it provides obfuscating signals for security during BLE ranging operations, and can independently perform Wi-Fi communication tasks. This multi-functionality reduces the need for additional dedicated security hardware, as the existing Wi-Fi radio is leveraged for both standard communication and security enhancement purposes
Solution Approach 2:
The system utilizes already-present components (co-located Wi-Fi radio and antenna) to provide security functionality. Rather than requiring entirely new dedicated security hardware, the existing Wi-Fi infrastructure serves the additional purpose of securing BLE ranging operations, reducing overall device complexity
Data Source
AI summary
Techniques are disclosed to leverage co-located radios such as BLE and Wi-Fi radios to increase the security of BLE ranging and localization. In one aspect, a transmitting BLE device may use a co-located Wi-Fi radio to transmit signals to interfere with an intruding device's interception of BLE RTT packets. The obfuscating Wi-Fi transmission may overlap a BLE RTT packet in the time domain with or without overlapping in the frequency domain. In one aspect, the co-located Wi-Fi radio may transmit pre-determined signature Wi-Fi signals concurrently with the BLE RTT packets to a receiver with co-located BLE and Wi-Fi radios. The receiver may detect a change in the pre-determined relationship between the two types of communication to reveal an intrusion attempt. In one aspect, a co-located Wi-Fi radio may capture parts of BLE RTT packets concurrently with a BLE radio transmitting or receiving BLE RTT packets to detect an intrusion attempt.