Bluetooth Low Energy Devices Research Articles

Address Privacy of Bluetooth Low Energy

Bluetooth low energy (LE) devices have been widely used in the Internet of Things (IoT) and wireless personal area networks (WPAN). However, attackers may compromise user privacy by tracking the addresses of the LE device. The resolvable private address (RPA) mechanism provides address privacy protection for the LE device. Similar to Zhang and Lin’s work in CCS 2022, we investigate the privacy of the RPA mechanism in this paper. Our contributions are threefold. First, we discover that the RPA mechanism has a privacy weakness. The attacker can track the targeted device by exploiting the runs of the RPA mechanism when he intercepts the targeted device’s obsolete RPA value. Second, we propose an improved RPA mechanism to overcome the privacy weakness in the RPA mechanism. The improved RPA mechanism leads to a small amount of extra overheads without requiring modification to the basic cryptographic tools used in the standard specification. Third, we formalize a privacy model to capture the address privacy of the RPA mechanisms. Our improved RPA mechanism provides enhanced privacy guarantees to Bluetooth LE devices in wireless personal applications.

A Safety System based on Bluetooth Low Energy (BLE) to prevent the misuse of Personal Protection Equipment (PPE) in construction

In this paper we address the issue of safety in the use of Personal Protection Equipment (PPE) in construction, industrial, or similar sites where power tools are used. We propose a novel solution that can control actively the power of the tool depending on the worker–tool distance. It is based on RSSI information transmitted by BLE devices arranged in a particular rig, combined with a Bayesian distance estimator. Such an approach minimizes the required instrumentation of the workplace and also the number of configuration parameters; therefore it enables a wide range of applications. Our aim is not only to signal risky situations caused by the misuse of the PPE (either due to its bad fitting or a wrong distance to the tool), but to intervene in a fast and robust way to avoid the safety risk.This solution is built upon previous results on the statistically sound measurement of distances and closeness in construction sites. Here, we contribute with a thorough analysis of collocating several BLE transmitters near orthogonally, which reduces interferences while avoiding the cost of more advanced technologies. We study how many transmitters are needed and what parameters are the best in the Bayesian filter for the optimal performance of the system.Real experiments with a prototype have been conducted in a construction workshop where a person operates a miter saw. The results show how the correct use of the PPE (an earmuff equipped with the BLE transmitters) can be inferred from the distance estimation in a robust and reliable way.

Explainable indoor localization of BLE devices through RSSI using recursive continuous wavelet transformation and XGBoost classifier

Indoor localization systems with higher precision and integrity are being highly demanded because of their numerous applications in superstores, smart homes, smart cities, elderly care, and disaster management. Although there are many technologies for indoor positioning e.g., Wireless Fidelity (Wi-Fi), Bluetooth Low Energy (BLE), and Radio-Frequency Identification (RFID), the high precision localization is still challenging because of the multipath effect and non-line of sight propagation of radio waves in complex indoor environment. This research proposes an explainable indoor localization (EIL) method for higher precision and integrity in IPS. The proposed localization method considered received signal strength indicator (RSSI) from BLE devices for predicting their precise locations. A recursive continuous Wavelet transform (R-CWT) method is proposed to extract discriminative features from the beacon signals for efficient localization. The extracted features are then fed to the extreme gradient boosting machine for the accurate classification of indoor positions. Moreover, to ensure integrity in indoor position classification, the Shapley additive explanations (SHAP) method is introduced to interpret the results obtained from the gradient boosting machine. The proposed method (EIL) precisely localize BLE devices within 1.5 m in a superstore environment with an accuracy of 98.04% which is much higher than the reported accuracies in existing studies.

CREATION, IMPLEMENTATION AND EVALUATION OF AN INDOOR NAVIGATION SYSTEM FOR USERS WITH DISABILITIES

Abstract. Indoor navigation is a complex task for people and especially for visually impaired ones. This research proposes an indoor navigation system oriented to visually impaired users, integrating the OGC IndoorGML and CityGML standards with Bluetooth Low Energy devices (BLE) by using the RSSI signal loss value and the Weighted Path Loss - techniques to calculate the user’s location. This paper describes the design of the system and its implementation as a functional prototype in a mobile web application. Several operational tests were conducted to determine both the accuracy and precision of the user location. The user’s positioning results show a root-mean-squared error (RMSE) of 0.88 m in a scenario with obstacles and no height difference of the BLE devices location, and a RMSE of 1.06 m in a scenario with obstacles and height difference. These results confirm the potential of the implemented prototype to grow into a fully operational system.

Maximized Effective Transmission Rate Model for Advanced Neighbor Discovery Process in Bluetooth Low Energy 5.0

Bluetooth low-energy (BLE) technology is one of the most promising communication technologies applicable to a variety of Internet of Things (IoT) services. The neighbor discovery process (NDP) plays a key role in BLE-enabled IoT services. The basic NDP (B-NDP) specified in BLE specification 4.0 has a limitation in supporting large numbers of BLE devices, owing to its use of three channels. To overcome the limitation of B-NDP, advanced NDP (A-NDP) has been recently introduced in BLE specification 5.0. However, most existing studies have focused on B-NDP, with very few studies having been conducted on A-NDP. In this article, we propose a model for analyzing the effective transmission rate for a BLE advertiser with an A-NDP operation. Using the proposed model, we also propose a performance model to maximize the transmission rate by optimally setting the BLE parameters. The proposed models are validated by comparing with extensive simulation results. It also demonstrates that the maximum transmission rate by the proposed models can be achieved with low energy consumption.

Autonomous Vehicles Management in Agriculture with Bluetooth Low Energy (BLE) and Passive Radio Frequency Identification (RFID) for Obstacle Avoidance

Obstacle avoidance is a key aspect for any autonomous vehicles, and their usage in agriculture must overcome additional challenges such as handling interactions with agricultural workers and other tractors in order to avoid severe accidents. The simultaneous presence of autonomous vehicles and workers on foot definitely calls for safer designs, vehicle management systems and major developments in personal protective equipment (PPE). To cope with these present and future challenges, the “SMARTGRID” project described in this paper deploys an integrated wireless safety network infrastructure based on the integration of Bluetooth Low Energy (BLE) devices and passive radio frequency identification (RFID) tags designed to identify obstacles, workers, nearby vehicles and check if the right PPE is in use. With the aim of detecting workers at risk by scanning for passive RFID-integrated into PPE in danger areas, transmitting alerts to workers who wear them, tracking of near-misses and activating emergency stops, a deep analysis of the safety requirements of the obstacle detection system is shown in this study. Test programs have also been carried out on an experimental farm with detection ranging from 8 to 12 meters, proving that the system might represent a good solution for collision avoidance between autonomous vehicles and workers on foot.

Fingerprinting and analysis of Bluetooth devices with automata learning

Automata learning is a technique to automatically infer behavioral models of black-box systems. Today’s learning algorithms enable the deduction of models that describe complex system properties, e.g., timed or stochastic behavior. Despite recent improvements in the scalability of learning algorithms, their practical applicability is still an open issue. Little work exists that actually learns models of physical black-box systems. To fill this gap in the literature, we present a case study on applying automata learning on the Bluetooth Low Energy (BLE) protocol. It shows that not only the size of the system limits the applicability of automata learning. Also, the interaction with the system under learning creates a major bottleneck that is rarely discussed. In this article, we propose a general automata learning architecture for learning a behavioral model of the BLE protocol implemented by a physical device. With this framework, we can successfully learn the behavior of six investigated BLE devices. Furthermore, we extended the learning technique to learn security critical behavior, e.g., key-exchange procedures for encrypted communication. The learned models depict several behavioral differences and inconsistencies to the BLE specification. This shows that automata learning can be used for fingerprinting black-box devices, i.e., characterizing systems via their specific learned models. Moreover, learning revealed a crashing scenario for one device.

An Accurate UAV Ground Landing Station System Based on BLE-RSSI and Maximum Likelihood Target Position Estimation

Earth observation with unmanned aerial vehicles (UAVs) offers an extraordinary opportunity to bridge the gap between field observations and traditional air and space-borne remote sensing. In this regard, ground landing stations (GLS) systems play a central role to increase the time and area coverage of UAV missions. Bluetooth low energy (BLE) technology and the received signal strength indicator (RSSI) techniques have been proposed for target location during UAV landing. However, these RSSI-based techniques present a lack of precision due to the propagation medium characteristics, which leads to UAV position vagueness. In this sense, the development of a novel low-cost GLS system for UAV tracking and landing is proposed. The GLS system has been embodied for the purpose of testing the UAV landing navigation capability. The maximum likelihood estimator (MLE) algorithm is addressed on an embedded microcontroller for the position estimation based on the RSSI acquired from an array of BLE devices. Experimental results demonstrate the feasibility and accuracy of the ground landing station system, achieving average errors of less than 0.04 m with the UAV-MLE target position estimation approach. This 0.04 m distance represents an order of magnitude increase in location precision over other currently available solutions. In many cases, this increased precision can enable more innovative docking mechanisms, less likelihood of mishaps in docking, and also quicker docking. It may also facilitate docking procedures where the docking station is itself moving, which may be the case if the docking unit is a mobile ground rover.

A Method of Indoor Positioning by Signal Fitting and PDDA Algorithm Using BLE AOA Device

Though Global Navigation Satellite System (GNSS) has been pretty mature and widely used in our daily life, the positioning of the indoor environment cannot be realized due to the shielding of concretes or glasses by GNSS. Many positioning methods have been proposed to solve that problem, and Bluetooth Low Energy (BLE) is one of the most widely used wireless technologies. This paper takes BLE Angle of Arrival (AOA) as the research object and proposes a method based on signal fitting and Propagator Direct Data Acquisition (PDDA) angle estimation algorithm. This method can be applied to both linear antenna array and rectangular antenna array and has good positioning performance. The method proposed in this paper does not need to calculate the phase differences between antennas, making it unnecessary to calculate the intersection of cones during spatial positioning. The angle estimation is divided into two steps. Firstly, the frequency deviation of Constant Tone Extension (CTE) is calculated based on the IQ samples captured during the reference period, and the received signal matrix of all antennas is fitted based on frequency deviation. Secondly, the antenna received signal model is established based on hardware antenna arrangement, and the arrival angle is estimated by the PDDA algorithm. In order to verify the effectiveness of the proposed method, the plane and spatial positioning experiments are carried out using the BLE devices of Nordic Company, which shows a good positioning accuracy. In spatial positioning, the average positioning accuracy of BLE in channel 37, channel 38, and channel 39 is 0.59m, 0.74m, and 0.77m, respectively, which can meet the basic indoor positioning requirements and cover a large area by one receiver. Compared with the classical MUSIC algorithm, the PDDA algorithm has the same positioning accuracy but lower computational complexity, so it has certain advantages.

From Conception to Retirement: A Lifetime Story of a 3-Year-Old Wireless Beacon System in the Wild

We report a 3-year city-wide study of an operational indoor sensing system based on Bluetooth Low Energy (BLE) called <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">aBeacon</monospace> (short for <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">a</u> libaba <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Beacon</u> ). <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">aBeacon</monospace> is pilot-studied, A/B tested, deployed, and operated in Shanghai, China to infer the indoor status of Alibaba couriers, e.g., arrival and departure at the merchants participating in the Alibaba Local Services platform. In its full operation stage (2018/01-2020/04), <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">aBeacon</monospace> consists of customized BLE devices at 12,109 merchants, interacting with 109,378 couriers to infer their status to assist the scheduling of 64 million delivery orders for 7.3 million customers with a total amount of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\$ $ </tex-math></inline-formula> 600 million order values. Although in an academic setting, using BLE devices to detect arrival and departure looks straightforward, it is non-trivial to design, build, deploy, and operate <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">aBeacon</monospace> from its conception to its retirement at city scale in a metric-based approach by considering the tradeoffs between various practical factors (e.g., cost and performance) during long-term system evolution. We report our study in two phases, i.e., an 8-month pilot study and a 28-month deployment and operation in the wild. We focus on an in-depth reporting on the five lessons learned and provide their implications in other systems with long-term operation and broad geospatial coverage, e.g., Edge Computing.

Development and Evaluation of Bluetooth Low-Energy Device for Electronic Encounter Metrics.

The coronavirus disease 2019 (COVID-19) pandemic led to the need for tracking of physical contacts and potential exposure to disease. Traditional contact tracing can be augmented by electronic tools called "electronic contact tracing" or "exposure notification.". Some methods were built to work with smartphones; however, smartphones are not prevalent in some high-contact areas (e.g., schools and nursing homes). We present the design and initial testing of low-cost, highly privacy preserving wearable exposure notification devices. Several devices were constructed based on existing hardware and operated independently of a smartphone. The method (devices and analyses) was not able to reliably use the received signal strength indicator (RSSI) as a proxy for distance between pairs of devices; the accuracy of RSSI as a proxy for distance decreased dramatically outside of the idealized conditions. However, even an imperfect device could be useful for research on how people use and move through spaces. With some improvement, these devices could be used to understand disease spread and human or animal interaction in indoor environments.

A survey on Bluetooth Low Energy security and privacy

Since its introduction in 2009, Bluetooth Low Energy (BLE) has become a remarkable success. Due to its unique properties of low power requirements and its ubiquitous availability in practically every smartphone, it outnumbered classic Bluetooth BR/EDR in most areas. It enabled a multitude of new product categories like smart watches or connected health care devices that would not be feasible without such a technology. We are currently facing version 5.2 of the specification which is the result of a number of major and minor revisions, each fixing problems of earlier versions while adding new features and capabilities. This includes more secure pairing methods, like secure connection pairing. Cyber security was considered from the beginning of the Bluetooth specification and has been improved with each specification release. On the other hand, security weaknesses in the specification as well as in individual Bluetooth stack implementations have been identified. Designing a secure BLE device, or analyzing its security is a complicated task due to the overwhelming number of possible configurations. As the specification introduces constantly new features and subtle changes regarding privacy and security, this will become an even more complex task. To the best of our knowledge, no systematic overview over the current state of BLE does exist that covers the security and privacy properties of the different BLE versions and features including known weaknesses and attacks in a single place. With this survey we want to fill this gap.

Security and Privacy Threats for Bluetooth Low Energy in IoT and Wearable Devices: A Comprehensive Survey

Bluetooth Low Energy (BLE) has become the de facto communication protocol for the Internet of Things (IoT) and smart wearable devices for its ultra-low energy consumption, ease of development, good enough network coverage, and data transfer speed. Due to the simplified design of this protocol, there have been lots of security and privacy vulnerabilities. As billions of health care, personal fitness wearable, smart lock, industrial automation devices adopt this technology for communication, its vulnerabilities should be dealt with high priority. Some segregated works on BLE were performed focusing on various vulnerabilities, such as the insecure implementation of encryption, device authentication, user privacy, etc. However, there has been no comprehensive survey on the security vulnerabilities of this protocol. In this survey paper, we present a comprehensive taxonomy for the security and privacy issues of BLE. We present possible attack scenarios for different types of vulnerabilities, classify them according to their severity, and list possible mitigation techniques. We also provide case studies regarding how different vulnerabilities can be exploited in real BLE devices.

Identifying the BLE Advertising Channel for Reliable Distance Estimation on Smartphones

Estimating the distance between two smartphones plays an important role in a host of applications. For this purpose, smartphones emit and scan for Bluetooth Low Energy (BLE) signals. When a device is detected, the distance is estimated by evaluating the received strength of these signals. The main insight that is exploited for distance estimation is that the attenuation of a signal increases with the distance along which it has traveled. However, besides distance, there are multiple additional factors that impact the attenuation and hence disturb the distance estimation procedure. Among them, frequency-selective hardware and signal propagation belong to the most significant ones. For example, a BLE device transmits packets on three different frequencies (channels), while the transmit power and the receiver sensitivity depend on the frequency. As a result, the received signal strength varies for each channel, even when the distance remains constant. However, the information on which wireless channel a packet has been received is not made available to a smartphone. Hence, this error cannot be compensated, e.g. by calibration. In this paper, we for the first time provide a solution to detect the wireless channel on which a packet has been received by a smartphone application. We experimentally evaluate our proposed technique on multiple different smartphone models. Our results help to make distance estimation on smartphones more robust and accurate.

ACE: A Routing Algorithm Based on Autonomous Channel Scheduling for Bluetooth Mesh Network

The Internet of Things (IoT) interconnects massive cyber-physical devices (CPD) to provide various applications, such as smart home and smart building. Bluetooth Mesh is an emerging networking technology, which can be used to organize a massive network with Bluetooth Low Energy (BLE) devices. Managed-flooding protocol is used in Bluetooth Mesh to route the data packets. Although it is a highly desirable option when data transmission is urgent, it is inefficient in a larger and denser mesh network due to the collisions of broadcast data packets. In this paper, we introduce ACE: a Routing Algorithm based on Autonomous Channel Scheduling for Bluetooth Mesh Network. ACE relies on the existing Bluetooth Mesh messages to distribute routes without additional traffic overhead and conducts a beacon-aware routing update adaptively as the topology evolves. In ACE, BLE channel resources can be efficiently utilized by a channel scheduling scheme for each node locally and autonomously without any neighborly negotiation. We implement ACE on the nRF52840 from Nordic Semiconductor and evaluate its effectiveness on our testbed. Compared to the Bluetooth Mesh, our experiments proved that ACE could reduce the end-to-end latency by 16%, alleviate packets collisions issues, and increase the packet delivery ratio (PDR) by 30% under heavy traffic. Moreover, simulation results verified that ACE has better scalability when the size and density of networks become larger and denser.

Measurement and Analysis of RSS Using Bluetooth Mesh Network for Localization Applications

Bluetooth low energy (BLE)-based location service technology has become one of the fastest growing applications for Bluetooth. Received signal strength (RSS) is often used in localization techniques for ranging or location fingerprinting. However, RSS-based localization solutions have poor performance in multipath environments. In this paper, we present a measurement system designed using multiple ESP32 BLE modules and the Bluetooth mesh networking technology, which is capable of exploiting the space, time, and frequency diversities in measurements. To enable channel-aware multi-device RSS measurements, we also designed a communication protocol to associate channel ID information to advertising messages. Based on channel measurement and analysis, we demonstrate that with a six-receiver configuration and space-time-frequency diversity combining, we can significantly reduce the residual linear regression fitting errors in path loss models. Such a reduction leads to more accurately correlating RSS measurements to the distance between the transmitter and receiver devices and thus to achieving improved performance with the RSS-based localization techniques. More importantly, the reduction in the fitting errors is achieved without differentiating the three advertising channels, making it possible to conveniently implement the proposed six-receiver configuration using commercially available BLE devices and the standard Bluetooth mesh networking protocol stack.

IoT Security Mechanisms in the Example of BLE

In recent years, a lot of IoT devices, wireless sensors, and smart things contain information that must be transmitted to the server for further processing. Due to the distance between devices, battery power, and the possibility of sudden device failure, the network that connects the devices must be scalable, energy efficient, and flexible. Particular attention must be paid to the protection of the transmitted data. The Bluetooth mesh was chosen as such a network. This network is built on top of Bluetooth Low-Energy devices, which are widespread in the market and whose radio modules are available from several manufacturers. This paper presents an overview of security mechanisms for the Bluetooth mesh network. This network provides encryption at two layers: network and upper transport layers, which increases the level of data security. The network uses sequence numbers for each message to protect against replay attacks. The introduction of devices into the network is provided with an encryption key, and the out-of-band (OOB) mechanism is also supported. At the moment, a comparison has been made between attacks and defense mechanisms that overlap these attacks. The article also suggested ways to improve network resiliency.

Investigation on magnetometer as potential sensors for infusion pump utilisation status

The utilisation of medical device e.g. an infusion pump is commonly treated as non-trivial process in service and maintenance section albeit in actuality, it is a crucial process for determining its correct maintenance cycle. Therefore, a discussion on the capability of magnetometer sensor as one of potential sensors to be used to keep track the utilisation status of infusion pump. The variation of magnetic flux density and its frequency produced by the stepper motor inside the infusion pump is measured and analysed through magnetometer sensor, embedded inside a Bluetooth Low Energy (BLE) device. Obtained result shows that magnetometer sensor has the potential to track the utilisation status of the tested infusion pumps.

Universal API for wellness and fitness BLE sensors

Abstract Background A number of Bluetooth wellness and fitness devices were analysed to explore ways to access their raw data, using Bluetooth and the Generic Attribute Profile specification, while developing a Rest API using the .Net Core framework to provide a way to easily access said data in real time, in order to provide it to other uses, like dashboards or data science applications. Methods Two Bluetooth Low Energy devices were chosen for this experiment for their ability to record and transmit heart rate data in real-time, and as such our primary focus during development would be in obtaining this raw data. After collecting all the services and characteristics of the device, a method was implemented to read a value from a particular characteristic uuid, in our case the heart rate measurement. The resulting values obtained from the API follows the format specified in the corresponding XML file of the Bluetooth-SIG specification. Results The developed API worked as expected and provided useful information to advance its development to cover more devices, services, and features. We were able to obtain data not only from Heart Rate Monitoring, but also from the Battery Service and Device Information. Conclusions With these results it will be possible to expand the compatibility of the API to other devices, and also to other services present on the devices analysed, which were not considered in this preliminary analysis. The ultimate goal is the integration of this API on a rehabilitation oriented device being developed for this project.

Modeling of co-channel interference in bluetooth low energy based on measurement data

The intense use of the 2.4 GHz ISM band by several wireless technologies has resulted in increased co-channel interference between networks operating in this frequency band. The aim of this paper is to investigate modeling techniques of co-channel interference affecting bluetooth low energy devices. The models are derived from recorded interference. Two types of models are introduced: a time domain model utilizing IQ data as reference and a spectrum-based model in which the reference signal is captured in frequency domain by a real-time spectrum analyzer. The recorded interference is also used as a reference to analyze the accuracy of proposed models. The proposed IQ-based model shows a degradation in performance for the environments with dominant bluetooth interfering signals. The frequency-based model not only addresses this problem, but also results in a huge data decimation in recording the interference.