Randomized Label ID Conceals BLE Device Address
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low power mobile devices, such as Bluetooth low energy (BLE) devices, face security vulnerabilities due to unencrypted broadcasts of their device addresses, which can be exploited by malicious actors to compromise the network.
Innovation Solution
A method where a low power mobile device transmits a randomized label ID instead of its device address during wireless communication, which is mapped and resolved by a network controller to enable secure pairing with access points, reducing the risk of address decryption by malicious actors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a BLE device broadcasts its device address (BD_ADDR) for identification and pairing, then the device can be detected and paired with access points, but the device address becomes vulnerable to decryption and compromise by malicious actors
Solution Approach 1:
The patent introduces an intermediary mapping mechanism where a randomized label ID serves as a mediator between the device and access points. The label ID is used in public broadcasts instead of the actual device address, while a mapping relationship stored on the network controller allows legitimate access points to resolve the label ID to the real address for pairing purposes. This intermediary layer prevents malicious actors from obtaining the actual device address through broadcasts.
Solution Approach 2:
The patent creates a copy of the device identification function using a randomized label ID. This label ID copy performs the identification and broadcast functions normally performed by the device address, while the actual device address remains protected. The mapping relationship acts as a key to connect the copy back to the original, enabling legitimate operations without exposing the original address.
2Object-affected harmful factors
If partial BD_ADDR randomization is used with pseudo random IRK encryption, then some address protection is provided, but the pseudo random nature allows malicious actors to eventually decrypt the IRK and obtain the actual BD_ADDR
Solution Approach 1:
The patent fundamentally changes the parameter used for address randomization from a pseudo-random IRK-based approach to a purely random label ID. This parameter change eliminates the mathematical relationship that allows decryption. The label ID is generated as truly random rather than pseudo-random, making it computationally infeasible to decrypt or predict, thereby providing reliable long-term security.
3Device complexity
If the device address is broadcast in clear text for network communication, then communication setup is simplified, but the attack surface is increased and network security is reduced
Solution Approach 1:
The randomized label ID acts as an intermediary that simplifies communication setup while reducing the attack surface. The label ID can be freely broadcast in clear text for device discovery and initial communication setup, just like the original device address. However, because it is randomized and mapped through a secure mechanism, it does not expose the actual device address, thereby reducing the attack surface while maintaining communication simplicity.
Data Source
AI summary
In one embodiment, a method is disclosed for mobile device security that includes receiving a label ID from a low power mobile device via a first access point, wherein the label ID is a randomized value that substitutes a device address of the low power mobile device during wireless communication. The method includes mapping the label ID to the device address, and transmitting the device address to the first access point, and responsive to the transmitting, causing the first access point to pair with the low power mobile device.