Additional security for BLE-GATT

[Ubaid_M]

Hello,

My application has a BLE-GATT interface for which I need to provide additional security to block replay attacks and also to encrypt data being sniffed, kindly help me with:

1. What are the security aspects which I can enable for BLE GATT and how to enable them and it's documentation.
2. Any sample project demonstrating BLE security

Thanks,

Ubaid

[Vidar Berg]

Hello,

Most of the SDK samples include support for bonding. You can for instance take a look at the Bluetooth: Peripheral UART sample to see how it is enabled there. This sample supports LE security mode 1 level 4 (ref. Bluetooth Core spec. 5, vol. 3, Part C, section 10.2.1). What kind of replay attack did you have in mind?

Best regards,

Vidar

[Ubaid_M]

Vidar Berg said:

What kind of replay attack did you have in mind?

Mimicking the last signal I exchanged with the device.

Basically my concern is, I have a proprietary mobile app & only this mobile app should communicate with my device via BLE.

So if there is a sniffer around who can sniff my signals and than replicate the signals from another mobile app, this will be a problem for me and need to block this. 

[Vidar Berg]

OK, the link will be encrypted with AES CCM and you can read about how the nonce for each BLE packet is constructed in vol. 6, part E, section 2.1 of the core spec.

[Ubaid_M]

Vidar Berg said:

LE security mode 1 level 4

Hello VIdar,

Is Security mode 1 level 4 compliant to various cybersecurity industrial standards..?
Please suggest

Thanks

[Vidar Berg]

Hello,

Whether this security mode covers the requirements for your use case or not is something you need to evaluate yourself, I am afraid. 

[Ubaid_M]

Hello Vidar Berg,

I was able to evaluate the nordic provided sample : "nCS\v2.2.0\zephyr\samples\bluetooth\peripheral_sc_only" and found that it satisfies my requirement for authentication.

Can you please suggest if any sample for me to evaluate data encryption at BT_LEVEL_4 security.
I want whatever data that is exchanged to be encrypted as well.

Regards

[Vidar Berg]

The Bluetooth: Peripheral UART sample supports sec. level 4. Build with CONFIG_BT_NUS_AUTHEN=y if you want to require authentication for the NUS characteristics.