BLE Connection security

RE: BLE Connection security

AHaug — Fri, 09 Jun 2023 07:09:07 GMT

Hi,

[quote user="AHaug"]This corresponds to my understanding as well, but I will ask with a colleague of mine when I get to the office tomorrow (Friday 9th) just to be sure we're not missing any available options for your design.[/quote]

I have discussed this item with a colleague of mine and I can confirm that your understanding is correct, and "Just works" is the only option with the configuration you mention. You could add a static passkey to your app, but that won't do much for security other than ensuring that you connect to the correct device more easily.

Kind regards,
Andreas

RE: BLE Connection security

AHaug — Thu, 08 Jun 2023 18:03:02 GMT

Hi Mike,

[quote user="Mike Austin (LPI)"]This might seem like a dumb question, but how do I setup BLE connections in my device to require the Client to Pair?[/quote]

No such thing as a dumb question, so no worries. The BLE fundamentals course at academy.nordicsemi.com showcases both how to do this and some theory for how to do this. Spefically lesson 3 takes you through the Connection process and lesson 5 takes you through the pairing process

I do believe that taking this course should answer your questions, but please feel free to ask follow up questions in case you still have any questions left unanswered after having a look at the topics in the BLE course

[quote user="Mike Austin (LPI)"]We’ve implemented Private/Public key signing of the firmware, but as I understand it that will only prevent someone trying to put unauthorized firmware into our device. It won’t stop them “sniffing” the image file being sent across to our device and taking that. Is that correct?[/quote]

Your understanding is 100% correct. There will be ways to get access to the firmware if you only do signing of the image, but signing the image stops a large portion of the malicious activities regarding getting access to the product.

[quote user="Mike Austin (LPI)"]Our device has no user input or display method, so the only security we can implement is the Just Works option if I understand things correctly. Longer term we might look at OOB pairing with NFC.[/quote]

This corresponds to my understanding as well, but I will ask with a colleague of mine when I get to the office tomorrow (Friday 9th) just to be sure we're not missing any available options for your design.

I'll get back to you tomorrow regarding the last item

Kind regards,
Andreas

RE: BLE Connection security

Mike Austin (LPI) — Wed, 07 Jun 2023 21:17:51 GMT

Thanks Andreas.

This might seem like a dumb question, but how do I setup BLE connections in my device to require the Client to Pair?

We’ve implemented Private/Public key signing of the firmware, but as I understand it that will only prevent someone trying to put unauthorized firmware into our device. It won’t stop them “sniffing” the image file being sent across to our device and taking that. Is that correct?

We’re probably not at the point where we are able to develop our own encryption/decryption solution just yet.

Our device has no user input or display method, so the only security we can implement is the Just Works option if I understand things correctly. Longer term we might look at OOB pairing with NFC.

Regatds,

Mike

RE: BLE Connection security

AHaug — Wed, 07 Jun 2023 13:00:27 GMT

Hi Mike,

[quote user=""]1. Is the DFU via SMP Service a secure, encypted connection by default?[/quote]

The connection is not encrypted by default unless you pair/bond the devices. If the case is that the devices are paired, then the BLE link is encrypted

Regarding 2. and 3. I need to know a bit more about what your goals are regarding the encryption

If your aim is to tamperproof your DFU-procedure, I would recommend you to have a look at how to sign the firmware. This will ensure that any firmware that has been tampered with will be revoked in the DFU procedure
If your aim is to perform encrypted DFU, then we unfortunately don't have support for this and you will have to create your own proprietary solution

Let me know if this answers your questions and feel free to ask follow up questions regarding this topic

Kind regards,
Andreas