Bluetooth Security

This first-of-its-kind book, from expert authors actively contributing to the evolution of Bluetooth specifications, provides an overview and detailed descriptions of all the security functions and features of this standard's latest core release. After categorizing all the security issues involved in ad hoc networking, this hands-on volume shows you how to design a highly secure Bluetooth system and implement security enhancements. The book also helps you fully understand the main security risks involved with introducing Bluetooth-based communications in your organization.

Ben Smeets is an Ericsson expert in security systems and data compression at Ericsson Mobile Platforms AB.

Preface

xi

Part I: Bluetooth Security Basics

1

(120)

Introduction

3

(24)

Bluetooth system basics

3

(16)

Background

3

(1)

Trade-offs

4

(1)

Bluetooth protocol stack

4

(2)

Physical layer

6

(1)

Baseband

7

(6)

Link manager protocol

13

(2)

Logical link control and adaptation protocol

15

(1)

Host control interface

15

(2)

Profiles

17

(2)

Bluetooth security basics

19

(8)

User scenarios

19

(3)

Notions and terminology

22

(3)

References

25

(2)

Overview of the Bluetooth Security Architecture

27

(16)

Key types

27

(2)

Pairing and user interaction

29

(1)

Authentication

30

(1)

Link privacy

31

(6)

Protect the link

32

(1)

Encryption algorithm

32

(2)

Mode of operation

34

(2)

Unicast and broadcast

36

(1)

Communication security policies

37

(6)

Security modes

38

(4)

Security policy management

42

(1)

References

42

(1)

Bluetooth Pairing and Key Management

43

(22)

Pairing in Bluetooth

43

(1)

HCI protocol

44

(1)

LM protocol

45

(1)

Baseband events

46

(7)

Initialization key generation

47

(1)

Unit key generation

47

(2)

Combination key generation

49

(1)

Authentication

50

(2)

Master key generation

52

(1)

User interaction

53

(1)

Cipher key generation

54

(4)

Encryption key Kc

54

(1)

Constraint key K'c

55

(2)

Payload key Kp

57

(1)

Key databases

58

(7)

Unit keys generation requirements

58

(1)

Combination key generation requirements

58

(2)

Key databases

60

(3)

Semipermanent keys for temporary use

63

(1)

References

63

(2)

Algorithms

65

(16)

Crypto algorithm selection

65

(2)

Block ciphers

65

(1)

Stream ciphers

66

(1)

SAFER+

67

(6)

Authentication algorithm E1

70

(1)

Unit key algorithm E21

71

(1)

Initial key algorithm E22

72

(1)

Encryption key algorithm E3

73

(1)

Encryption engine

73

(1)

Ciphering algorithm E0

74

(5)

Initialization

77

(2)

Implementation aspects

79

(2)

References

80

(1)

Broadcast Encryption

81

(6)

Overview

81

(1)

Preparing for broadcast encryption

82

(1)

Switching to broadcast encryption

83

(4)

References

85

(2)

Security Policies and Access Control

87

(10)

Objectives

87

(3)

Trust relations

88

(1)

Security levels

88

(1)

Flexibility

89

(1)

Implementation considerations

89

(1)

Security manager architecture

90

(7)

Overview

90

(1)

Device trust level

91

(1)

Security level for services

92

(1)

Connection setup

92

(3)

Database contents and registration procedure

95

(1)

Reference

96

(1)

Attacks, Strengths, and Weaknesses

97

(24)

Eavesdropping

97

(8)

Impersonation

105

(2)

Pairing

107

(2)

Improper key storage

109

(3)

Disclosure of keys

110

(1)

Tampering with keys

111

(1)

Denial of service

111

(1)

Unit key

112

(1)

Location tracking

113

(3)

Bluetooth device address and location tracking

113

(2)

Five different types of location tracking attacks

115

(1)

Implementation flaws

116

(5)

References

117

(4)

Part II: Bluetooth Security Enhancements

121

(66)

Providing Anonymity

123

(16)

Overview of the anonymity mode

123

(1)

Address usage

124

(4)

The fixed device address, BD_ADDR_fixed

124

(1)

The active device address, BD_ADDR

125

(3)

Alias addresses, BD_ADDR_alias

128

(1)

Modes of operation

128

(1)

Inquiry and paging

129

(2)

Connectable mode

129

(1)

Private connectable mode

130

(1)

General connectable mode

131

(1)

Alias authentication

131

(2)

Pairing

133

(1)

Anonymity mode LMP commands

133

(3)

Address update, LMP active address

134

(1)

Alias address exchange, LMP alias address

134

(1)

Fixed address exchange, LMP fixed address

135

(1)

Pairing example

136

(3)

References

138

(1)

Key Management Extensions

139

(28)

Improved pairing

140

(9)

Requirements on an improved pairing protocol

140

(1)

Improved pairing protocol

141

(6)

Implementation aspects and complexity

147

(2)

Higher layer key exchange

149

(5)

IEEE 802.1x port-based network access control

150

(2)

Higher layer key exchange with EAP TLS

152

(2)

Autonomous trust delegation

154

(13)

Security group extension method

154

(6)

Public key--based key management

160

(3)

Group extension method versus public key method

163

(1)

References

164

(3)

Security for Bluetooth Applications

167

(20)

Headset

168

(5)

Headset security model

168

(1)

Pass-key and key management

169

(2)

Example

171

(2)

Network access

173

(8)

Common access keys

174

(1)

Security architecture

175

(1)

Network service subscription

175

(2)

Initial connection

177

(2)

Subsequent access to NAcPs

179

(2)

SIM access

181

(6)

The SIM access profile

181

(1)

Securing SIM access

182

(2)

References

184

(3)

Glossary

187

(2)

List of Acronyms and Abbreviations

189

(6)

About the Authors

195

(2)

Index

197

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Summary

Author Biography

Table of Contents

Supplemental Materials