Selectively Connecting To Devices

RE: Selectively Connecting To Devices

jcady92 — Fri, 21 Nov 2014 17:36:19 GMT

This could potentially be a solution. I've looked, but I can't find any examples of how to set the device address on Android. Perhaps this isn't the best place to ask, but I'm not sure if it's possible.

Also, it would also seem if someone is designing an app to be malicious, they could relatively easily get an address from the phone that has been whitelisted on the module and set it as the same in the malicious app.

I do appreciate the ideas!

RE: Selectively Connecting To Devices

David Edwin — Fri, 21 Nov 2014 10:27:03 GMT

One more method: Support multiple Bluetooth addresses on your devices, associate each peer phone to a different Bluetooth address, so this means none of the existing phones can block the advertising when you change over to a new address which is unknown to them, thus allowing new devices to get added.

Will this work for you ?

RE: Selectively Connecting To Devices

jcady92 — Thu, 20 Nov 2014 17:40:58 GMT

Unfortunately, adding devices in private is not possible with our product. Once the module ships, it advertises in a public location and new devices can be added at any time. It looks like I really would need a form of blacklist to block certain phones rather than allow others (because we have no way of know at runtime which phones will be attempting a connection).

RE: Selectively Connecting To Devices

David Edwin — Thu, 20 Nov 2014 10:58:51 GMT

Then I suggest that the addition process be done in a private location so there is no possibility of an attacker getting added. Once the addition has been done, use whitelisting for regular operation, manage the whitelist as suggested by @user9384 above. So during normal operation, addition of the phone will not be allowed and whitelisting will be done to manage the phones, this will prevent an attacker from maliciously connecting and blocking the device.

Will this resolve your issue ?

RE: Selectively Connecting To Devices

jcady92 — Tue, 18 Nov 2014 17:23:21 GMT

I too do not think whitelisting will accomplish my goal.

I do have control over the app side, so that is an option. Right now I am maintaining a temporary blacklist on the app side with the device name as the identifier. This sounds similar to what you're proposing. The downside to letting the blacklisting reside on the app side is that it leaves the BLE module open to a type of denial of service attack, if it accepts any connection. A malicious device could continuously try to connect to the module, blocking other devices from attempting a connection. This is a consumer device, so that is a concern.

RE: Selectively Connecting To Devices

David Edwin — Tue, 18 Nov 2014 12:13:44 GMT

The white-listing will work if and only if your application on the BLE device is aware of phone 1 and phone 2. If the application is not aware of phone 2 and does not want phone 1 to connect, it cannot add phone 2 to the whitelist. This whitelist logic may not work well when adding 2 phones to the the device as known peers.

To manage the addition process: One possible method is to add an ID to the advertising packet. This ID can be a reference to the phones that have the ID should not connect so phones that do not have this ID yet will connect. This works only when you are using your own app on the phone to manage the BLE connections.

Will this work for you ?

RE: Selectively Connecting To Devices

Knut Eldhuset — Tue, 18 Nov 2014 06:11:03 GMT

The ble_gap_evt_connected_t struct contains the address of the peer.
There is no blacklist feature. When setting up your module, you would have to accept connections until you get Phone 2. Then you can add only Phone 2 to the whitelist, which will then prevent Phone 1 from connecting. Both phones should have an equal chance of connecting to your module, so this should work out fine.