Unique Id of a device needed

[marko]

Hi​,

I am looking for the possibility of getting an unforgeable unique ID of a bonded device within a BLE connection. Using nRF51422 with SD310 for the peripheral, any smartphone or tablet for the central is intended.

After a peripheral has been bonded to a central device, the peripheral will offer some data. But offering data should only happen, when the central device has informed the peripheral about his identity. This ID information must not be stored in the centrals application because it is not possible for us to secure this ID. So it is necessary to use some kind of device identifier, which is coupled to the hardware, but not changeable by users.

The intention is that there are few specified central devices and thousands of peripherals. All these peripherals are connectable to any central and give some information. But for the few specified centrals they will grant access to deeper information. Which token of the BLE connection could I use?

First I wanted to use the MAC address but it did not work because it could change. The difficulty is to find somewhat which is not able to be manipulated by the centrals application. Even if the centrals application is copied to another central, the unique ID should be useless. Therefore I want to use some hardware-coupled ble specific token.

I would appreciate if someone can help me! Thanks a lot.

Best Regards, Marko

[marko]

Thanks for your answer. I checked the link layer capabilities carefully but there does not seem to be a feature I can use. Indeed I have to implement my security functionality on application layer and this was planned too. But therefore I need this unique device ID. I further think about using the BT device address. After bonding even a private address is resolvable to the original device address if I'm right. So the question is, is it possible to use a counterfeit address for let's say an Android app? On the other hand, if I only use the application layer for authentication (without a device specific token) then copying this android app will copy the unique ID in this app. Even if the ID is not stored in the android app code then it seems to be easy to decompile android app and get info about where the ID is taken from. I heard, the android java code is not really safe

[Ulrich Myhre]

I'm still not understanding exactly what you want to accomplish. Are you trying to recognize a device that has a pre-shared secret, written directly into the app - or are you trying to just make sure you are still connecting to the same device again? What about using normal BLE security and exchanging a long-term key after pairing? Then the LTK can be this "secret", and you would need to sniff the connection during the initial pairing to be able to copy it. What about that solution would not fit your solution?

Sorry if I'm misunderstanding, but what you are asking for directly is not possible to accomplish. Everything can be forged by a peer, so I'm looking for alternative ways to solve your problem.