Unique Id of a device needed

[marko]

Hi​,

I am looking for the possibility of getting an unforgeable unique ID of a bonded device within a BLE connection. Using nRF51422 with SD310 for the peripheral, any smartphone or tablet for the central is intended.

After a peripheral has been bonded to a central device, the peripheral will offer some data. But offering data should only happen, when the central device has informed the peripheral about his identity. This ID information must not be stored in the centrals application because it is not possible for us to secure this ID. So it is necessary to use some kind of device identifier, which is coupled to the hardware, but not changeable by users.

The intention is that there are few specified central devices and thousands of peripherals. All these peripherals are connectable to any central and give some information. But for the few specified centrals they will grant access to deeper information. Which token of the BLE connection could I use?

First I wanted to use the MAC address but it did not work because it could change. The difficulty is to find somewhat which is not able to be manipulated by the centrals application. Even if the centrals application is copied to another central, the unique ID should be useless. Therefore I want to use some hardware-coupled ble specific token.

I would appreciate if someone can help me! Thanks a lot.

Best Regards, Marko

[Ulrich Myhre]

Hi,

There have been some questions about this earlier:

devzone.nordicsemi.com/.../

devzone.nordicsemi.com/.../

The take-away is that there are no identifiers that are guaranteed to be unique in the chip's factory registry. They are randomly generated however, so it is quite unlikely that they will be re-used. DEVICEID, DEVICEADDR, ER and IR are all randomly generated (except 2 bytes of DEVICEADDR for the address type) and together these could make do as a likely unique identifier.

These values are also not possible to change.

[Ulrich Myhre]

Thank you for clarifying, I thought you had control of the central in this scenario. Unfortunately, there are no identifiable parameters to a connection that cannot be changed by the peer. The closest is probably reading the remote version, but this is a link-layer feature - often not visible to the app. It is also the same value for all devices using the same SoftDevice version. But even here there could be "rogue" peers that will fake this value if they need to.

It's possible that you will have to implement some application security layer yourself, using a verified cryptographic scheme. This requires you to have an application that supports it on both sides, however.