SlideShare a Scribd company logo
BLE as Active RFID
Tutorial presented by Jeffrey Dungen
at IEEE RFID 2017
What’s BLE? (Bluetooth Low Energy)
Bluetooth 4.0
Bluetooth LE
(Ericsson 199x)
(Nokia 200x)
(2007)
IEEE RFID 2017Jeffrey Dungen
What’s Active RFID?
Device which spontaneously transmits,
via radio frequencies,
its identifier,
using its own source of power.
IEEE RFID 2017Jeffrey Dungen
Is BLE Active RFID?
❏ spontaneously transmits (“advertises”)
❏ radio frequencies (2400MHz)
❏ identifier
❏ own source of power
✓
✓
✓
✓
IEEE RFID 2017Jeffrey Dungen
Is BLE anything else?
Indeed!
Many other things!
IEEE RFID 2017Jeffrey Dungen
But let’s talk about the Active RFID part
because it’s often overshadowed by the rest...
Motivation #1
IEEE RFID 2017Jeffrey Dungen
BLE has become the de facto standard.
No longer need to create yet-another-standard.
I’ve had the (dis)pleasure of developing Active RFID protocols from scratch
at Purelink Technology (5.8GHz) and at reelyActive (sub-GHz).
Couldn’t be happier to adopt BLE as a global standard!
Motivation #2
IEEE RFID 2017Jeffrey Dungen
Billions of products, places and even people
are carrying Active RFID devices right now!
If you had told me a decade ago that this would happen (voluntarily even!),
I would not have believed you.
IncrediBLE! Now let’s put this to good use!
Questions we’ll answer
IEEE RFID 2017Jeffrey Dungen
➔ How are BLE devices identified?
➔ What can you include in the payload?
➔ What about privacy and security?
➔ What best (and worst) practices are emerging?
➔ Can you build a RTLS with BLE?
➔ What tools are available?
IEEE RFID 2017Jeffrey Dungen
How are
BLE devices
identified?
BLE Device Identification
IEEE RFID 2017Jeffrey Dungen
MANDATORY
➔ 48-bit advertiser address
OPTIONAL
➔ Short name (ASCII)
➔ 128-bit UUID
➔ 16-bit company code
➔ 16-bit member services
➔ EUI-48 / EUI-64
➔ User-defined IDs
48:b1:7a:dd:4e:55
Example
48-bit Advertiser Address
IEEE RFID 2017Jeffrey Dungen
PUBLIC OPTION
➔ IEEE-assigned MAC
➔ Static
A single header bit, txAdd, affords two options:
RANDOM OPTION
➔ Choose your own!
➔ Change it whenever and
as often as you like!
MANDATORY
Local Name
IEEE RFID 2017Jeffrey Dungen
Choose a short ASCII string, ex:
✓ ✓
((( I <3 RFID )))
OPTIONAL
128-bit UUID
IEEE RFID 2017Jeffrey Dungen
Choose your own, ex:
✓ ✓
128B171D-1EEE-4F1D-2017-85004C090517
OPTIONAL
16-bit Company Code
IEEE RFID 2017Jeffrey Dungen
Request from the Bluetooth SIG, ex:
~ ✓
004C → Apple
OPTIONAL
16-bit Member Services
IEEE RFID 2017Jeffrey Dungen
Purchase from the Bluetooth SIG, ex:
x ✓
FEAA →
OPTIONAL
Identification Summary
IEEE RFID 2017Jeffrey Dungen
Every packet includes a 48-bit advertiser address.
Each packet may also contain one or more additional
identifiers, limited by the max payload of the packet.
IEEE RFID 2017Jeffrey Dungen
What can I include
in the payload?
BLE Packet Overview*
IEEE RFID 2017Jeffrey Dungen
Preamble &
Access Address
5 Bytes
Packet Data Unit
8-39 Bytes
CRC
3 Bytes
Header
2 Bytes
Advertiser Address
6 Bytes
Optional Payload
Up to 31 Bytes
* Bluetooth 4.x advertising packets
31 Bytes of Payload Freedom?
IEEE RFID 2017Jeffrey Dungen
Sure, as long as you respect the Generic Access Profile (GAP):
Data Type
1 Byte
Length
1 Byte
Data
Up to 29 Bytes
Data
Up to 29 Bytes
...
Pick and choose data types, as long as together they all fit!
Data Type
1 Byte
Length
1 Byte
What’s a GAP Data Type?
IEEE RFID 2017Jeffrey Dungen
Full list: www.bluetooth.com/specifications/assigned-numbers/generic-access-profile
0x01 Flags
0x07 Complete List of 128-bit Service Class UUIDs
0x09 Complete Local Name
0x16 Service Data - 16-bit UUID
0xff Manufacturer Specific Data
Examples
IEEE RFID 2017Jeffrey Dungen
How about some ASCII text and a 128-bit UUID:
Data Type
0x09
Length
18
Complete Local Name
((( I <3 RFID )))
Complete List of 128-bit Service Class UUIDs
128B171D-1EEE-4F1D-2017-85004C090517
Together they’re over 31 bytes so won’t fit in a single packet!
Data Type
0x07
Length
17
Service Data
IEEE RFID 2017Jeffrey Dungen
Eddystone uses member service data to squeeze in a URL:
Data Type
0x16
Length
18
Member Service
0xfeaa
URL & TX Power
reelyactive.com
Eddystone specification: github.com/google/eddystone
Purchased Defined
Manufacturer Specific Data
IEEE RFID 2017Jeffrey Dungen
Apple uses manufacturer specific data extensively:
Data Type
0xff
Length
--
Company Code
0x004c
iBeacon, AirPlay, AirDrop,
Nearby, Handoff, etc.
iBeacon is an open standard. Others are not.
Requested Defined
Payload Data we’ve Observed
IEEE RFID 2017Jeffrey Dungen
X
Y
Z
Accelerometer
Gyroscope
Magnetometer
Battery Level
Appearance
URL
Temperature
Pressure
Humidity
Typically closed/proprietary standards, poorly documented or
incorrectly implemented!
➔ Nonetheless, can often be deciphered through observation
Payload Summary
IEEE RFID 2017Jeffrey Dungen
Up to 27-bytes which you can stuff as you please.
Respect GAP and vendor-defined open standards.
IEEE RFID 2017Jeffrey Dungen
What about
privacy and
security?
Overview of Concerns
IEEE RFID 2017Jeffrey Dungen
Can I now be identified &
tracked by all the BLE
devices I carry???
Can my identity or sensor
payload be spoofed???
Normal ALERT!
Advertiser Beware
IEEE RFID 2017Jeffrey Dungen
Transmissions on the advertising channels
can be observed on the advertising channels.
BLE affords plenty of flexibility for privacy/security.
Apply best practices to reach the best compromise!
IEEE RFID 2017Jeffrey Dungen
Best and worst
practices?
NotaBLE Practices
IEEE RFID 2017Jeffrey Dungen
➔ Privacy-sensitive identification
➔ Making standards work for you
➔ Security by obscurity
Privacy-Sensitive Identification
IEEE RFID 2017Jeffrey Dungen
Periodically cycle the 48-bit advertiser address to
hamper repeat-visit tracking and spoofing:
Type: random
Cycle: every TX
Type: random
Cycle: ~15 mins
Type: random
Cycle: never
BALANCEDEXCESSIVE INSUFFICIENT
GOOD: ~15 min cycle
IEEE RFID 2017Jeffrey Dungen
➔ easily track you for up to ~15 mins (ex: store visit)
➔ possibly track you for longer, while in range
➔ not associate you with a previous visit
➔ identify device type, at best, by company code
or other identifiers, if present
An observer can:
(Potentially) BAD: no cycle
IEEE RFID 2017Jeffrey Dungen
Jeff’s Fitbit Charge HR has used the same identifier
for over two years now...
d9:01:4f:6b:a8:b2
Not good for privacy.
- but -
Convenient for demos!
BIZARRE: cycle + static ID
IEEE RFID 2017Jeffrey Dungen
Estimote sticker changes its address constantly, but
includes static ID in payload...
Excessive address cycling can
wreak havoc on observers with
resource-constrained BLE stacks!
xx:xx:xx:xx:xx:xx
2b-ad-2b-ad-2b-ad-2b-ad
Standards = Interoperability
IEEE RFID 2017Jeffrey Dungen
Beneficial that any observer understand your broadcasts?
21°C 21°C
Advertiser from
Company X
Observer from
Company Y
OBSERVE EXISTING STANDARDS
Standard Precedence
IEEE RFID 2017Jeffrey Dungen
1. Check Bluetooth GAP Types
2. Check Bluetooth GATT Services
3. Check open standards by vendors
No standard? Check again.
Still no? Create your own open standard.
Temperature Example
IEEE RFID 2017Jeffrey Dungen
GAP: No.
https://www.bluetooth.com/specifications/assigned-numbers/generic-access-profile
GATT: Yes, service & characteristic.
https://www.bluetooth.com/specifications/gatt/services
Service 0x181a: Environmental Sensing | Characteristic 0x2a6e: Temperature
Open Standards: Yes. Eddystone-TLM, ...
https://github.com/google/eddystone/tree/master/eddystone-tlm
Temperature-as-a-Service
IEEE RFID 2017Jeffrey Dungen
Data Type
0x16
Length
5
Service
0x2a6e
Temperature
2100 = 0x0834 = 21°C
* we’ve observed this practice from
reputable vendors and assume it
conforms to the core specification!
Temperature as Eddystone-TLM
IEEE RFID 2017Jeffrey Dungen
Data Type
0x16
Length
5
Service
0xfeaa
Eddystone-TLM
0x2000----1500...
Security by Obscurity
IEEE RFID 2017Jeffrey Dungen
Beneficial that no foreign observer understand your
broadcasts?
21°C WTF
Advertiser from
Company X
Observer from
Company Y
DESIGN YOUR OWN CLOSED STANDARD
Obscure Thoughts
IEEE RFID 2017Jeffrey Dungen
➔ Encryption keys
➔ Cyclic counts
➔ Random noise bits
➔ Secret, deterministic address cycling (id & period)
A clever security design will allow your packet to be transported via any channel and
subsequently decoded and authenticated by a trusted recipient. Think M2M.
*Encrypted* Eddystone-TLM
IEEE RFID 2017Jeffrey Dungen
Data Type
0x16
Length
5
Service
0xfeaa
Eddystone-TLM
0x2001--------...
Alternatively, use or inspire yourself from
existing open standards:
Best Practices Summary
IEEE RFID 2017Jeffrey Dungen
Be sensitive to privacy concerns. Understand it’s a
compromise.
Stick to standards whenever possible.
Leverage BLE’s flexibility for elegant DIY security.
IEEE RFID 2017Jeffrey Dungen
How about BLE
real-time location?
BLE RTLS Overview
IEEE RFID 2017Jeffrey Dungen
Observers can estimate the location of a device each
time it transmits an advertising packet.
ID is within
10m of meID
The flexibility of BLE affords many options...
BLE RTLS Approaches
IEEE RFID 2017Jeffrey Dungen
Broadcaster Observer Vendors
Vendor Vendor 9Solutions, Kontakt.io, ...
Any* Vendor Quuppa
Any Vendor Bluvision, (reelyActive), ...
Any Any reelyActive
Consistency
Opportunity
* requires specific bit-pattern in payload
“Bring-your-own-device” & “use-our-device” strategies:
BLE SCAN is “Exciting” stuff
IEEE RFID 2017Jeffrey Dungen
ADV_DISCOVER_IND
SCAN_REQ
SCAN_RSP
“Readers” can incite devices to
transmit a SCAN_REQ packet which
they may in turn observe.
IEEE RFID 2017Jeffrey Dungen
What tools are
available?
Overview of Tools
IEEE RFID 2017Jeffrey Dungen
As BLE matures, an increasing number of tools and
documentation are becoming available - but - most
focus on paired applications (central-peripheral)
rather than Active RFID (broadcaster-observer).
Heed the distinction!
Breakdown of Tools
IEEE RFID 2017Jeffrey Dungen
Advertise Observe Interpret
➔ Mobile apps/SDKs
➔ Commercial beacons
➔ Dev kits
➔ Your PC / SBC
➔ Commercial sniffers
➔ Dev kits
➔ Open source software
➔ Commercial software
➔ Develop from scratch
Sniff and Learn on Mobile!
IEEE RFID 2017Jeffrey Dungen
RaMBLE for Android
“RaMBLE collects BLE advertising
packets, and tries to identify devices
based on their MAC address and the
content of these packets.”
www.contextis.com/services/research/ramble-android-bluetooth-le-scanner/
Sniff and Learn on a Pi!
IEEE RFID 2017Jeffrey Dungen
Raspberry Pi 3 BLE Sniffer
Detect, visualise and explore BLE
advertising packets using the
ubiquitous Raspberry Pi, open
source software and an easy to
follow tutorial.
reelyactive.github.io/make-a-pi-hub.html
Open Source Projects
IEEE RFID 2017Jeffrey Dungen
advlib
Javascript library to decode
BLE packets.
reelyactive.github.io/advlib
Presented at IEEE WF-IoT 2015
Sniffypedia
“Phone book” of BLE
identifiers and metadata.
sniffypedia.org
Open Database License
Live Demo!
IEEE RFID 2017Jeffrey Dungen
This dashboard is open source under MIT License:
reelyactive.github.io/dashboard-template-angular
advlib +
Sniffypedia
getpareto.com
Commercial version
BLE as Active RFID
@reelyActive | jeff@reelyactive.com

More Related Content

What's hot

Rfid Tags India
Rfid Tags IndiaRfid Tags India
Rfid Tags India
EcartesTech1
 
Rfid technology
Rfid technologyRfid technology
Rfid technology
hkpeterpeter
 
RFID Technology
RFID TechnologyRFID Technology
RFID Technology
Saptha Wanniarachchi
 
Rfid security workshop v0.9 -nahuel_grisolia
Rfid security workshop v0.9  -nahuel_grisoliaRfid security workshop v0.9  -nahuel_grisolia
Rfid security workshop v0.9 -nahuel_grisolia
Positive Hack Days
 
RFID PROTOCOL
RFID PROTOCOLRFID PROTOCOL
RFID PROTOCOL
Ammar Yasir
 
What is rfid
What is rfidWhat is rfid
What is rfid
aniket0507
 
Evolving Fast Fourier Transform and Deoxyribonucleic Acid for Security of RFI...
Evolving Fast Fourier Transform and Deoxyribonucleic Acid for Security of RFI...Evolving Fast Fourier Transform and Deoxyribonucleic Acid for Security of RFI...
Evolving Fast Fourier Transform and Deoxyribonucleic Acid for Security of RFI...
IRJET Journal
 
RFID technology fundamentals. How to choose an RFID tag?
RFID technology fundamentals. How to choose an RFID tag?RFID technology fundamentals. How to choose an RFID tag?
RFID technology fundamentals. How to choose an RFID tag?
Trace ID Communications Department
 
RFID and Wireless Sensor Networks
RFID and Wireless Sensor NetworksRFID and Wireless Sensor Networks
RFID and Wireless Sensor Networks
Kartik Kachhadiya
 
wireless technology (RFID)
wireless technology (RFID)wireless technology (RFID)
wireless technology (RFID)
KOPPOLI KIRANKUMAR
 
Radio Frequency Identification (RFID)
Radio Frequency Identification (RFID) Radio Frequency Identification (RFID)
Radio Frequency Identification (RFID)
Kandarp Vyas
 
Presentation 1 rfid introduction
Presentation 1 rfid introductionPresentation 1 rfid introduction
Presentation 1 rfid introduction
Mouhanad Alkhaldi
 
RFID Technology
RFID TechnologyRFID Technology
RFID Technology
Kshitij Varma
 
Basics Of Rfid Technology
Basics Of Rfid TechnologyBasics Of Rfid Technology
Basics Of Rfid Technology
Vineet M Srivastav
 
RFID Basics
RFID BasicsRFID Basics
RFID Basics
fizzyjazzy
 
RFID (Radio Frequency Identification)
RFID (Radio Frequency Identification) RFID (Radio Frequency Identification)
RFID (Radio Frequency Identification)
Chetan Pandey
 
My best effort
My best effortMy best effort
My best effort
sujataray
 
RFID Technology
RFID TechnologyRFID Technology
RFID Technology
davidtowers
 
The Economics, Practical Applications and Constraints in Enterprise-Wide RFID...
The Economics, Practical Applications and Constraints in Enterprise-Wide RFID...The Economics, Practical Applications and Constraints in Enterprise-Wide RFID...
The Economics, Practical Applications and Constraints in Enterprise-Wide RFID...
Manos Theocharopoulos
 
RFID (Radio Frequency Identification)
RFID (Radio Frequency Identification)RFID (Radio Frequency Identification)
RFID (Radio Frequency Identification)
Amber Bhaumik
 

What's hot (20)

Rfid Tags India
Rfid Tags IndiaRfid Tags India
Rfid Tags India
 
Rfid technology
Rfid technologyRfid technology
Rfid technology
 
RFID Technology
RFID TechnologyRFID Technology
RFID Technology
 
Rfid security workshop v0.9 -nahuel_grisolia
Rfid security workshop v0.9  -nahuel_grisoliaRfid security workshop v0.9  -nahuel_grisolia
Rfid security workshop v0.9 -nahuel_grisolia
 
RFID PROTOCOL
RFID PROTOCOLRFID PROTOCOL
RFID PROTOCOL
 
What is rfid
What is rfidWhat is rfid
What is rfid
 
Evolving Fast Fourier Transform and Deoxyribonucleic Acid for Security of RFI...
Evolving Fast Fourier Transform and Deoxyribonucleic Acid for Security of RFI...Evolving Fast Fourier Transform and Deoxyribonucleic Acid for Security of RFI...
Evolving Fast Fourier Transform and Deoxyribonucleic Acid for Security of RFI...
 
RFID technology fundamentals. How to choose an RFID tag?
RFID technology fundamentals. How to choose an RFID tag?RFID technology fundamentals. How to choose an RFID tag?
RFID technology fundamentals. How to choose an RFID tag?
 
RFID and Wireless Sensor Networks
RFID and Wireless Sensor NetworksRFID and Wireless Sensor Networks
RFID and Wireless Sensor Networks
 
wireless technology (RFID)
wireless technology (RFID)wireless technology (RFID)
wireless technology (RFID)
 
Radio Frequency Identification (RFID)
Radio Frequency Identification (RFID) Radio Frequency Identification (RFID)
Radio Frequency Identification (RFID)
 
Presentation 1 rfid introduction
Presentation 1 rfid introductionPresentation 1 rfid introduction
Presentation 1 rfid introduction
 
RFID Technology
RFID TechnologyRFID Technology
RFID Technology
 
Basics Of Rfid Technology
Basics Of Rfid TechnologyBasics Of Rfid Technology
Basics Of Rfid Technology
 
RFID Basics
RFID BasicsRFID Basics
RFID Basics
 
RFID (Radio Frequency Identification)
RFID (Radio Frequency Identification) RFID (Radio Frequency Identification)
RFID (Radio Frequency Identification)
 
My best effort
My best effortMy best effort
My best effort
 
RFID Technology
RFID TechnologyRFID Technology
RFID Technology
 
The Economics, Practical Applications and Constraints in Enterprise-Wide RFID...
The Economics, Practical Applications and Constraints in Enterprise-Wide RFID...The Economics, Practical Applications and Constraints in Enterprise-Wide RFID...
The Economics, Practical Applications and Constraints in Enterprise-Wide RFID...
 
RFID (Radio Frequency Identification)
RFID (Radio Frequency Identification)RFID (Radio Frequency Identification)
RFID (Radio Frequency Identification)
 

Similar to BLE as Active RFID

XBee and RFID
XBee and RFIDXBee and RFID
XBee and RFID
Tinker
 
XBee and RFID
XBee and RFIDXBee and RFID
XBee and RFID
Tinker London
 
Make Your Own IoT Device by ZigBee
Make Your Own IoT Device by ZigBeeMake Your Own IoT Device by ZigBee
Make Your Own IoT Device by ZigBee
Okis Chuang
 
Zigbee module interface with ARM 7
Zigbee module interface with ARM 7Zigbee module interface with ARM 7
Zigbee module interface with ARM 7
Pantech ProLabs India Pvt Ltd
 
DEFCON 23 - Joshua Smith - high def fuzzing - exploitation over HDMI-CEC
DEFCON 23 - Joshua Smith - high def fuzzing - exploitation over HDMI-CECDEFCON 23 - Joshua Smith - high def fuzzing - exploitation over HDMI-CEC
DEFCON 23 - Joshua Smith - high def fuzzing - exploitation over HDMI-CEC
Felipe Prado
 
Access control system using RFID and zigbee
 Access control system using  RFID and zigbee  Access control system using  RFID and zigbee
Access control system using RFID and zigbee
Pradheep Shrinivasan
 
Desert Code Camp 2014.2 Intro to Bluetooth Low Energy
Desert Code Camp 2014.2 Intro to Bluetooth Low EnergyDesert Code Camp 2014.2 Intro to Bluetooth Low Energy
Desert Code Camp 2014.2 Intro to Bluetooth Low Energy
jjrosent
 
Enhancement of security in rfid using rsa algorithm
Enhancement of security in rfid using rsa algorithmEnhancement of security in rfid using rsa algorithm
Enhancement of security in rfid using rsa algorithm
Alexander Decker
 
Malware vs Big Data
Malware vs Big DataMalware vs Big Data
Malware vs Big Data
Frank Denis
 
Arrow israel
Arrow israelArrow israel
Arrow israel
Amir Sherman
 
Начало работы с Intel IoT Dev Kit
Начало работы с Intel IoT Dev KitНачало работы с Intel IoT Dev Kit
Начало работы с Intel IoT Dev Kit
Intel® Developer Zone Россия
 
09
0909
Videoconference
VideoconferenceVideoconference
Videoconference
eonx_32
 
NFC & RFID on Android
NFC & RFID on AndroidNFC & RFID on Android
NFC & RFID on Android
todbotdotcom
 
Wideband Audio Conferencing with Asterisk
Wideband Audio Conferencing with AsteriskWideband Audio Conferencing with Asterisk
Wideband Audio Conferencing with Asterisk
Saúl Ibarra Corretgé
 
Introduction To NIDS
Introduction To NIDSIntroduction To NIDS
Introduction To NIDS
Michael Boman
 
Invengo Profile V2.4
Invengo Profile V2.4Invengo Profile V2.4
Invengo Profile V2.4
pcalderbank
 
Michael Graves Astricon 2009 Hd Voice Demo Rev2
Michael Graves Astricon 2009 Hd Voice Demo Rev2Michael Graves Astricon 2009 Hd Voice Demo Rev2
Michael Graves Astricon 2009 Hd Voice Demo Rev2
Michael Graves
 
Rfid101 rfid introduction_lr
Rfid101 rfid introduction_lrRfid101 rfid introduction_lr
Rfid101 rfid introduction_lr
Cecile Tan
 
Rfid101 rfid introduction_lr
Rfid101 rfid introduction_lrRfid101 rfid introduction_lr
Rfid101 rfid introduction_lr
Cecile Tan
 

Similar to BLE as Active RFID (20)

XBee and RFID
XBee and RFIDXBee and RFID
XBee and RFID
 
XBee and RFID
XBee and RFIDXBee and RFID
XBee and RFID
 
Make Your Own IoT Device by ZigBee
Make Your Own IoT Device by ZigBeeMake Your Own IoT Device by ZigBee
Make Your Own IoT Device by ZigBee
 
Zigbee module interface with ARM 7
Zigbee module interface with ARM 7Zigbee module interface with ARM 7
Zigbee module interface with ARM 7
 
DEFCON 23 - Joshua Smith - high def fuzzing - exploitation over HDMI-CEC
DEFCON 23 - Joshua Smith - high def fuzzing - exploitation over HDMI-CECDEFCON 23 - Joshua Smith - high def fuzzing - exploitation over HDMI-CEC
DEFCON 23 - Joshua Smith - high def fuzzing - exploitation over HDMI-CEC
 
Access control system using RFID and zigbee
 Access control system using  RFID and zigbee  Access control system using  RFID and zigbee
Access control system using RFID and zigbee
 
Desert Code Camp 2014.2 Intro to Bluetooth Low Energy
Desert Code Camp 2014.2 Intro to Bluetooth Low EnergyDesert Code Camp 2014.2 Intro to Bluetooth Low Energy
Desert Code Camp 2014.2 Intro to Bluetooth Low Energy
 
Enhancement of security in rfid using rsa algorithm
Enhancement of security in rfid using rsa algorithmEnhancement of security in rfid using rsa algorithm
Enhancement of security in rfid using rsa algorithm
 
Malware vs Big Data
Malware vs Big DataMalware vs Big Data
Malware vs Big Data
 
Arrow israel
Arrow israelArrow israel
Arrow israel
 
Начало работы с Intel IoT Dev Kit
Начало работы с Intel IoT Dev KitНачало работы с Intel IoT Dev Kit
Начало работы с Intel IoT Dev Kit
 
09
0909
09
 
Videoconference
VideoconferenceVideoconference
Videoconference
 
NFC & RFID on Android
NFC & RFID on AndroidNFC & RFID on Android
NFC & RFID on Android
 
Wideband Audio Conferencing with Asterisk
Wideband Audio Conferencing with AsteriskWideband Audio Conferencing with Asterisk
Wideband Audio Conferencing with Asterisk
 
Introduction To NIDS
Introduction To NIDSIntroduction To NIDS
Introduction To NIDS
 
Invengo Profile V2.4
Invengo Profile V2.4Invengo Profile V2.4
Invengo Profile V2.4
 
Michael Graves Astricon 2009 Hd Voice Demo Rev2
Michael Graves Astricon 2009 Hd Voice Demo Rev2Michael Graves Astricon 2009 Hd Voice Demo Rev2
Michael Graves Astricon 2009 Hd Voice Demo Rev2
 
Rfid101 rfid introduction_lr
Rfid101 rfid introduction_lrRfid101 rfid introduction_lr
Rfid101 rfid introduction_lr
 
Rfid101 rfid introduction_lr
Rfid101 rfid introduction_lrRfid101 rfid introduction_lr
Rfid101 rfid introduction_lr
 

More from reelyActive

Pareto Features Overview
Pareto Features OverviewPareto Features Overview
Pareto Features Overview
reelyActive
 
reelyActive Smart Office Solution
reelyActive Smart Office SolutionreelyActive Smart Office Solution
reelyActive Smart Office Solution
reelyActive
 
reelyActive Brick & Mortar Retail Solution
reelyActive Brick & Mortar Retail SolutionreelyActive Brick & Mortar Retail Solution
reelyActive Brick & Mortar Retail Solution
reelyActive
 
reelyActive Digital Out Of Home Solution
reelyActive Digital Out Of Home SolutionreelyActive Digital Out Of Home Solution
reelyActive Digital Out Of Home Solution
reelyActive
 
reelyActive's First Ever Pitch, FounderFuel 2012
reelyActive's First Ever Pitch, FounderFuel 2012reelyActive's First Ever Pitch, FounderFuel 2012
reelyActive's First Ever Pitch, FounderFuel 2012
reelyActive
 
The medium of exchange for your data in the sharing economy?
The medium of exchange for your data in the sharing economy?The medium of exchange for your data in the sharing economy?
The medium of exchange for your data in the sharing economy?
reelyActive
 
Quel est l'avenir de l'expérience client?
Quel est l'avenir de l'expérience client?Quel est l'avenir de l'expérience client?
Quel est l'avenir de l'expérience client?
reelyActive
 
Bluetooth & IoT
Bluetooth & IoTBluetooth & IoT
Bluetooth & IoT
reelyActive
 
Advertise Yourself! - reelyActive at Bluetooth World 2014
Advertise Yourself! - reelyActive at Bluetooth World 2014Advertise Yourself! - reelyActive at Bluetooth World 2014
Advertise Yourself! - reelyActive at Bluetooth World 2014
reelyActive
 
What is the Future of Customer Experience?
What is the Future of Customer Experience?What is the Future of Customer Experience?
What is the Future of Customer Experience?
reelyActive
 

More from reelyActive (10)

Pareto Features Overview
Pareto Features OverviewPareto Features Overview
Pareto Features Overview
 
reelyActive Smart Office Solution
reelyActive Smart Office SolutionreelyActive Smart Office Solution
reelyActive Smart Office Solution
 
reelyActive Brick & Mortar Retail Solution
reelyActive Brick & Mortar Retail SolutionreelyActive Brick & Mortar Retail Solution
reelyActive Brick & Mortar Retail Solution
 
reelyActive Digital Out Of Home Solution
reelyActive Digital Out Of Home SolutionreelyActive Digital Out Of Home Solution
reelyActive Digital Out Of Home Solution
 
reelyActive's First Ever Pitch, FounderFuel 2012
reelyActive's First Ever Pitch, FounderFuel 2012reelyActive's First Ever Pitch, FounderFuel 2012
reelyActive's First Ever Pitch, FounderFuel 2012
 
The medium of exchange for your data in the sharing economy?
The medium of exchange for your data in the sharing economy?The medium of exchange for your data in the sharing economy?
The medium of exchange for your data in the sharing economy?
 
Quel est l'avenir de l'expérience client?
Quel est l'avenir de l'expérience client?Quel est l'avenir de l'expérience client?
Quel est l'avenir de l'expérience client?
 
Bluetooth & IoT
Bluetooth & IoTBluetooth & IoT
Bluetooth & IoT
 
Advertise Yourself! - reelyActive at Bluetooth World 2014
Advertise Yourself! - reelyActive at Bluetooth World 2014Advertise Yourself! - reelyActive at Bluetooth World 2014
Advertise Yourself! - reelyActive at Bluetooth World 2014
 
What is the Future of Customer Experience?
What is the Future of Customer Experience?What is the Future of Customer Experience?
What is the Future of Customer Experience?
 

Recently uploaded

“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
Edge AI and Vision Alliance
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
DianaGray10
 
What is an RPA CoE? Session 2 – CoE Roles
What is an RPA CoE?  Session 2 – CoE RolesWhat is an RPA CoE?  Session 2 – CoE Roles
What is an RPA CoE? Session 2 – CoE Roles
DianaGray10
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Alex Pruden
 
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving | Modern Metal Trim, Nameplates and Appliance PanelsNorthern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving
 
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and StandardsLeveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
Neo4j
 
"$10 thousand per minute of downtime: architecture, queues, streaming and fin...
"$10 thousand per minute of downtime: architecture, queues, streaming and fin..."$10 thousand per minute of downtime: architecture, queues, streaming and fin...
"$10 thousand per minute of downtime: architecture, queues, streaming and fin...
Fwdays
 
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and BioinformaticiansBiomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Neo4j
 
Nordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptxNordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptx
MichaelKnudsen27
 
Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |
AstuteBusiness
 
Poznań ACE event - 19.06.2024 Team 24 Wrapup slidedeck
Poznań ACE event - 19.06.2024 Team 24 Wrapup slidedeckPoznań ACE event - 19.06.2024 Team 24 Wrapup slidedeck
Poznań ACE event - 19.06.2024 Team 24 Wrapup slidedeck
FilipTomaszewski5
 
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
"Scaling RAG Applications to serve millions of users",  Kevin Goedecke"Scaling RAG Applications to serve millions of users",  Kevin Goedecke
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
Fwdays
 
Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving
 
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
DanBrown980551
 
PRODUCT LISTING OPTIMIZATION PRESENTATION.pptx
PRODUCT LISTING OPTIMIZATION PRESENTATION.pptxPRODUCT LISTING OPTIMIZATION PRESENTATION.pptx
PRODUCT LISTING OPTIMIZATION PRESENTATION.pptx
christinelarrosa
 
Principle of conventional tomography-Bibash Shahi ppt..pptx
Principle of conventional tomography-Bibash Shahi ppt..pptxPrinciple of conventional tomography-Bibash Shahi ppt..pptx
Principle of conventional tomography-Bibash Shahi ppt..pptx
BibashShahi
 
GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)
Javier Junquera
 
Must Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during MigrationMust Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during Migration
Mydbops
 
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
Jason Yip
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
Jakub Marek
 

Recently uploaded (20)

“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
 
What is an RPA CoE? Session 2 – CoE Roles
What is an RPA CoE?  Session 2 – CoE RolesWhat is an RPA CoE?  Session 2 – CoE Roles
What is an RPA CoE? Session 2 – CoE Roles
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
 
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving | Modern Metal Trim, Nameplates and Appliance PanelsNorthern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
 
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and StandardsLeveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
 
"$10 thousand per minute of downtime: architecture, queues, streaming and fin...
"$10 thousand per minute of downtime: architecture, queues, streaming and fin..."$10 thousand per minute of downtime: architecture, queues, streaming and fin...
"$10 thousand per minute of downtime: architecture, queues, streaming and fin...
 
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and BioinformaticiansBiomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
 
Nordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptxNordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptx
 
Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |
 
Poznań ACE event - 19.06.2024 Team 24 Wrapup slidedeck
Poznań ACE event - 19.06.2024 Team 24 Wrapup slidedeckPoznań ACE event - 19.06.2024 Team 24 Wrapup slidedeck
Poznań ACE event - 19.06.2024 Team 24 Wrapup slidedeck
 
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
"Scaling RAG Applications to serve millions of users",  Kevin Goedecke"Scaling RAG Applications to serve millions of users",  Kevin Goedecke
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
 
Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024
 
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
 
PRODUCT LISTING OPTIMIZATION PRESENTATION.pptx
PRODUCT LISTING OPTIMIZATION PRESENTATION.pptxPRODUCT LISTING OPTIMIZATION PRESENTATION.pptx
PRODUCT LISTING OPTIMIZATION PRESENTATION.pptx
 
Principle of conventional tomography-Bibash Shahi ppt..pptx
Principle of conventional tomography-Bibash Shahi ppt..pptxPrinciple of conventional tomography-Bibash Shahi ppt..pptx
Principle of conventional tomography-Bibash Shahi ppt..pptx
 
GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)
 
Must Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during MigrationMust Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during Migration
 
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
 

BLE as Active RFID

  • 1. BLE as Active RFID Tutorial presented by Jeffrey Dungen at IEEE RFID 2017
  • 2. What’s BLE? (Bluetooth Low Energy) Bluetooth 4.0 Bluetooth LE (Ericsson 199x) (Nokia 200x) (2007) IEEE RFID 2017Jeffrey Dungen
  • 3. What’s Active RFID? Device which spontaneously transmits, via radio frequencies, its identifier, using its own source of power. IEEE RFID 2017Jeffrey Dungen
  • 4. Is BLE Active RFID? ❏ spontaneously transmits (“advertises”) ❏ radio frequencies (2400MHz) ❏ identifier ❏ own source of power ✓ ✓ ✓ ✓ IEEE RFID 2017Jeffrey Dungen
  • 5. Is BLE anything else? Indeed! Many other things! IEEE RFID 2017Jeffrey Dungen But let’s talk about the Active RFID part because it’s often overshadowed by the rest...
  • 6.
  • 7.
  • 8. Motivation #1 IEEE RFID 2017Jeffrey Dungen BLE has become the de facto standard. No longer need to create yet-another-standard. I’ve had the (dis)pleasure of developing Active RFID protocols from scratch at Purelink Technology (5.8GHz) and at reelyActive (sub-GHz). Couldn’t be happier to adopt BLE as a global standard!
  • 9. Motivation #2 IEEE RFID 2017Jeffrey Dungen Billions of products, places and even people are carrying Active RFID devices right now! If you had told me a decade ago that this would happen (voluntarily even!), I would not have believed you. IncrediBLE! Now let’s put this to good use!
  • 10.
  • 11. Questions we’ll answer IEEE RFID 2017Jeffrey Dungen ➔ How are BLE devices identified? ➔ What can you include in the payload? ➔ What about privacy and security? ➔ What best (and worst) practices are emerging? ➔ Can you build a RTLS with BLE? ➔ What tools are available?
  • 12. IEEE RFID 2017Jeffrey Dungen How are BLE devices identified?
  • 13. BLE Device Identification IEEE RFID 2017Jeffrey Dungen MANDATORY ➔ 48-bit advertiser address OPTIONAL ➔ Short name (ASCII) ➔ 128-bit UUID ➔ 16-bit company code ➔ 16-bit member services ➔ EUI-48 / EUI-64 ➔ User-defined IDs 48:b1:7a:dd:4e:55 Example
  • 14. 48-bit Advertiser Address IEEE RFID 2017Jeffrey Dungen PUBLIC OPTION ➔ IEEE-assigned MAC ➔ Static A single header bit, txAdd, affords two options: RANDOM OPTION ➔ Choose your own! ➔ Change it whenever and as often as you like! MANDATORY
  • 15. Local Name IEEE RFID 2017Jeffrey Dungen Choose a short ASCII string, ex: ✓ ✓ ((( I <3 RFID ))) OPTIONAL
  • 16. 128-bit UUID IEEE RFID 2017Jeffrey Dungen Choose your own, ex: ✓ ✓ 128B171D-1EEE-4F1D-2017-85004C090517 OPTIONAL
  • 17. 16-bit Company Code IEEE RFID 2017Jeffrey Dungen Request from the Bluetooth SIG, ex: ~ ✓ 004C → Apple OPTIONAL
  • 18. 16-bit Member Services IEEE RFID 2017Jeffrey Dungen Purchase from the Bluetooth SIG, ex: x ✓ FEAA → OPTIONAL
  • 19. Identification Summary IEEE RFID 2017Jeffrey Dungen Every packet includes a 48-bit advertiser address. Each packet may also contain one or more additional identifiers, limited by the max payload of the packet.
  • 20. IEEE RFID 2017Jeffrey Dungen What can I include in the payload?
  • 21. BLE Packet Overview* IEEE RFID 2017Jeffrey Dungen Preamble & Access Address 5 Bytes Packet Data Unit 8-39 Bytes CRC 3 Bytes Header 2 Bytes Advertiser Address 6 Bytes Optional Payload Up to 31 Bytes * Bluetooth 4.x advertising packets
  • 22. 31 Bytes of Payload Freedom? IEEE RFID 2017Jeffrey Dungen Sure, as long as you respect the Generic Access Profile (GAP): Data Type 1 Byte Length 1 Byte Data Up to 29 Bytes Data Up to 29 Bytes ... Pick and choose data types, as long as together they all fit! Data Type 1 Byte Length 1 Byte
  • 23. What’s a GAP Data Type? IEEE RFID 2017Jeffrey Dungen Full list: www.bluetooth.com/specifications/assigned-numbers/generic-access-profile 0x01 Flags 0x07 Complete List of 128-bit Service Class UUIDs 0x09 Complete Local Name 0x16 Service Data - 16-bit UUID 0xff Manufacturer Specific Data
  • 24. Examples IEEE RFID 2017Jeffrey Dungen How about some ASCII text and a 128-bit UUID: Data Type 0x09 Length 18 Complete Local Name ((( I <3 RFID ))) Complete List of 128-bit Service Class UUIDs 128B171D-1EEE-4F1D-2017-85004C090517 Together they’re over 31 bytes so won’t fit in a single packet! Data Type 0x07 Length 17
  • 25. Service Data IEEE RFID 2017Jeffrey Dungen Eddystone uses member service data to squeeze in a URL: Data Type 0x16 Length 18 Member Service 0xfeaa URL & TX Power reelyactive.com Eddystone specification: github.com/google/eddystone Purchased Defined
  • 26. Manufacturer Specific Data IEEE RFID 2017Jeffrey Dungen Apple uses manufacturer specific data extensively: Data Type 0xff Length -- Company Code 0x004c iBeacon, AirPlay, AirDrop, Nearby, Handoff, etc. iBeacon is an open standard. Others are not. Requested Defined
  • 27. Payload Data we’ve Observed IEEE RFID 2017Jeffrey Dungen X Y Z Accelerometer Gyroscope Magnetometer Battery Level Appearance URL Temperature Pressure Humidity Typically closed/proprietary standards, poorly documented or incorrectly implemented! ➔ Nonetheless, can often be deciphered through observation
  • 28. Payload Summary IEEE RFID 2017Jeffrey Dungen Up to 27-bytes which you can stuff as you please. Respect GAP and vendor-defined open standards.
  • 29. IEEE RFID 2017Jeffrey Dungen What about privacy and security?
  • 30. Overview of Concerns IEEE RFID 2017Jeffrey Dungen Can I now be identified & tracked by all the BLE devices I carry??? Can my identity or sensor payload be spoofed??? Normal ALERT!
  • 31.
  • 32. Advertiser Beware IEEE RFID 2017Jeffrey Dungen Transmissions on the advertising channels can be observed on the advertising channels. BLE affords plenty of flexibility for privacy/security. Apply best practices to reach the best compromise!
  • 33. IEEE RFID 2017Jeffrey Dungen Best and worst practices?
  • 34. NotaBLE Practices IEEE RFID 2017Jeffrey Dungen ➔ Privacy-sensitive identification ➔ Making standards work for you ➔ Security by obscurity
  • 35. Privacy-Sensitive Identification IEEE RFID 2017Jeffrey Dungen Periodically cycle the 48-bit advertiser address to hamper repeat-visit tracking and spoofing: Type: random Cycle: every TX Type: random Cycle: ~15 mins Type: random Cycle: never BALANCEDEXCESSIVE INSUFFICIENT
  • 36. GOOD: ~15 min cycle IEEE RFID 2017Jeffrey Dungen ➔ easily track you for up to ~15 mins (ex: store visit) ➔ possibly track you for longer, while in range ➔ not associate you with a previous visit ➔ identify device type, at best, by company code or other identifiers, if present An observer can:
  • 37. (Potentially) BAD: no cycle IEEE RFID 2017Jeffrey Dungen Jeff’s Fitbit Charge HR has used the same identifier for over two years now... d9:01:4f:6b:a8:b2 Not good for privacy. - but - Convenient for demos!
  • 38. BIZARRE: cycle + static ID IEEE RFID 2017Jeffrey Dungen Estimote sticker changes its address constantly, but includes static ID in payload... Excessive address cycling can wreak havoc on observers with resource-constrained BLE stacks! xx:xx:xx:xx:xx:xx 2b-ad-2b-ad-2b-ad-2b-ad
  • 39. Standards = Interoperability IEEE RFID 2017Jeffrey Dungen Beneficial that any observer understand your broadcasts? 21°C 21°C Advertiser from Company X Observer from Company Y OBSERVE EXISTING STANDARDS
  • 40. Standard Precedence IEEE RFID 2017Jeffrey Dungen 1. Check Bluetooth GAP Types 2. Check Bluetooth GATT Services 3. Check open standards by vendors No standard? Check again. Still no? Create your own open standard.
  • 41. Temperature Example IEEE RFID 2017Jeffrey Dungen GAP: No. https://www.bluetooth.com/specifications/assigned-numbers/generic-access-profile GATT: Yes, service & characteristic. https://www.bluetooth.com/specifications/gatt/services Service 0x181a: Environmental Sensing | Characteristic 0x2a6e: Temperature Open Standards: Yes. Eddystone-TLM, ... https://github.com/google/eddystone/tree/master/eddystone-tlm
  • 42. Temperature-as-a-Service IEEE RFID 2017Jeffrey Dungen Data Type 0x16 Length 5 Service 0x2a6e Temperature 2100 = 0x0834 = 21°C * we’ve observed this practice from reputable vendors and assume it conforms to the core specification!
  • 43. Temperature as Eddystone-TLM IEEE RFID 2017Jeffrey Dungen Data Type 0x16 Length 5 Service 0xfeaa Eddystone-TLM 0x2000----1500...
  • 44. Security by Obscurity IEEE RFID 2017Jeffrey Dungen Beneficial that no foreign observer understand your broadcasts? 21°C WTF Advertiser from Company X Observer from Company Y DESIGN YOUR OWN CLOSED STANDARD
  • 45. Obscure Thoughts IEEE RFID 2017Jeffrey Dungen ➔ Encryption keys ➔ Cyclic counts ➔ Random noise bits ➔ Secret, deterministic address cycling (id & period) A clever security design will allow your packet to be transported via any channel and subsequently decoded and authenticated by a trusted recipient. Think M2M.
  • 46. *Encrypted* Eddystone-TLM IEEE RFID 2017Jeffrey Dungen Data Type 0x16 Length 5 Service 0xfeaa Eddystone-TLM 0x2001--------... Alternatively, use or inspire yourself from existing open standards:
  • 47. Best Practices Summary IEEE RFID 2017Jeffrey Dungen Be sensitive to privacy concerns. Understand it’s a compromise. Stick to standards whenever possible. Leverage BLE’s flexibility for elegant DIY security.
  • 48. IEEE RFID 2017Jeffrey Dungen How about BLE real-time location?
  • 49. BLE RTLS Overview IEEE RFID 2017Jeffrey Dungen Observers can estimate the location of a device each time it transmits an advertising packet. ID is within 10m of meID The flexibility of BLE affords many options...
  • 50. BLE RTLS Approaches IEEE RFID 2017Jeffrey Dungen Broadcaster Observer Vendors Vendor Vendor 9Solutions, Kontakt.io, ... Any* Vendor Quuppa Any Vendor Bluvision, (reelyActive), ... Any Any reelyActive Consistency Opportunity * requires specific bit-pattern in payload “Bring-your-own-device” & “use-our-device” strategies:
  • 51. BLE SCAN is “Exciting” stuff IEEE RFID 2017Jeffrey Dungen ADV_DISCOVER_IND SCAN_REQ SCAN_RSP “Readers” can incite devices to transmit a SCAN_REQ packet which they may in turn observe.
  • 52. IEEE RFID 2017Jeffrey Dungen What tools are available?
  • 53. Overview of Tools IEEE RFID 2017Jeffrey Dungen As BLE matures, an increasing number of tools and documentation are becoming available - but - most focus on paired applications (central-peripheral) rather than Active RFID (broadcaster-observer). Heed the distinction!
  • 54. Breakdown of Tools IEEE RFID 2017Jeffrey Dungen Advertise Observe Interpret ➔ Mobile apps/SDKs ➔ Commercial beacons ➔ Dev kits ➔ Your PC / SBC ➔ Commercial sniffers ➔ Dev kits ➔ Open source software ➔ Commercial software ➔ Develop from scratch
  • 55. Sniff and Learn on Mobile! IEEE RFID 2017Jeffrey Dungen RaMBLE for Android “RaMBLE collects BLE advertising packets, and tries to identify devices based on their MAC address and the content of these packets.” www.contextis.com/services/research/ramble-android-bluetooth-le-scanner/
  • 56. Sniff and Learn on a Pi! IEEE RFID 2017Jeffrey Dungen Raspberry Pi 3 BLE Sniffer Detect, visualise and explore BLE advertising packets using the ubiquitous Raspberry Pi, open source software and an easy to follow tutorial. reelyactive.github.io/make-a-pi-hub.html
  • 57. Open Source Projects IEEE RFID 2017Jeffrey Dungen advlib Javascript library to decode BLE packets. reelyactive.github.io/advlib Presented at IEEE WF-IoT 2015 Sniffypedia “Phone book” of BLE identifiers and metadata. sniffypedia.org Open Database License
  • 58. Live Demo! IEEE RFID 2017Jeffrey Dungen This dashboard is open source under MIT License: reelyactive.github.io/dashboard-template-angular advlib + Sniffypedia getpareto.com Commercial version
  • 59. BLE as Active RFID @reelyActive | jeff@reelyactive.com