| Preface |
|
xi | |
|
Part I: Bluetooth Security Basics |
|
|
1 | (120) |
|
|
|
3 | (24) |
|
|
|
3 | (16) |
|
|
|
3 | (1) |
|
|
|
4 | (1) |
|
|
|
4 | (2) |
|
|
|
6 | (1) |
|
|
|
7 | (6) |
|
|
|
13 | (2) |
|
Logical link control and adaptation protocol |
|
|
15 | (1) |
|
|
|
15 | (2) |
|
|
|
17 | (2) |
|
Bluetooth security basics |
|
|
19 | (8) |
|
|
|
19 | (3) |
|
|
|
22 | (3) |
|
|
|
25 | (2) |
|
Overview of the Bluetooth Security Architecture |
|
|
27 | (16) |
|
|
|
27 | (2) |
|
Pairing and user interaction |
|
|
29 | (1) |
|
|
|
30 | (1) |
|
|
|
31 | (6) |
|
|
|
32 | (1) |
|
|
|
32 | (2) |
|
|
|
34 | (2) |
|
|
|
36 | (1) |
|
Communication security policies |
|
|
37 | (6) |
|
|
|
38 | (4) |
|
Security policy management |
|
|
42 | (1) |
|
|
|
42 | (1) |
|
Bluetooth Pairing and Key Management |
|
|
43 | (22) |
|
|
|
43 | (1) |
|
|
|
44 | (1) |
|
|
|
45 | (1) |
|
|
|
46 | (7) |
|
Initialization key generation |
|
|
47 | (1) |
|
|
|
47 | (2) |
|
Combination key generation |
|
|
49 | (1) |
|
|
|
50 | (2) |
|
|
|
52 | (1) |
|
|
|
53 | (1) |
|
|
|
54 | (4) |
|
|
|
54 | (1) |
|
|
|
55 | (2) |
|
|
|
57 | (1) |
|
|
|
58 | (7) |
|
Unit keys generation requirements |
|
|
58 | (1) |
|
Combination key generation requirements |
|
|
58 | (2) |
|
|
|
60 | (3) |
|
Semipermanent keys for temporary use |
|
|
63 | (1) |
|
|
|
63 | (2) |
|
|
|
65 | (16) |
|
Crypto algorithm selection |
|
|
65 | (2) |
|
|
|
65 | (1) |
|
|
|
66 | (1) |
|
|
|
67 | (6) |
|
Authentication algorithm E1 |
|
|
70 | (1) |
|
|
|
71 | (1) |
|
Initial key algorithm E22 |
|
|
72 | (1) |
|
Encryption key algorithm E3 |
|
|
73 | (1) |
|
|
|
73 | (1) |
|
|
|
74 | (5) |
|
|
|
77 | (2) |
|
|
|
79 | (2) |
|
|
|
80 | (1) |
|
|
|
81 | (6) |
|
|
|
81 | (1) |
|
Preparing for broadcast encryption |
|
|
82 | (1) |
|
Switching to broadcast encryption |
|
|
83 | (4) |
|
|
|
85 | (2) |
|
Security Policies and Access Control |
|
|
87 | (10) |
|
|
|
87 | (3) |
|
|
|
88 | (1) |
|
|
|
88 | (1) |
|
|
|
89 | (1) |
|
Implementation considerations |
|
|
89 | (1) |
|
Security manager architecture |
|
|
90 | (7) |
|
|
|
90 | (1) |
|
|
|
91 | (1) |
|
Security level for services |
|
|
92 | (1) |
|
|
|
92 | (3) |
|
Database contents and registration procedure |
|
|
95 | (1) |
|
|
|
96 | (1) |
|
Attacks, Strengths, and Weaknesses |
|
|
97 | (24) |
|
|
|
97 | (8) |
|
|
|
105 | (2) |
|
|
|
107 | (2) |
|
|
|
109 | (3) |
|
|
|
110 | (1) |
|
|
|
111 | (1) |
|
|
|
111 | (1) |
|
|
|
112 | (1) |
|
|
|
113 | (3) |
|
Bluetooth device address and location tracking |
|
|
113 | (2) |
|
Five different types of location tracking attacks |
|
|
115 | (1) |
|
|
|
116 | (5) |
|
|
|
117 | (4) |
|
Part II: Bluetooth Security Enhancements |
|
|
121 | (66) |
|
|
|
123 | (16) |
|
Overview of the anonymity mode |
|
|
123 | (1) |
|
|
|
124 | (4) |
|
The fixed device address, BD_ADDR_fixed |
|
|
124 | (1) |
|
The active device address, BD_ADDR |
|
|
125 | (3) |
|
Alias addresses, BD_ADDR_alias |
|
|
128 | (1) |
|
|
|
128 | (1) |
|
|
|
129 | (2) |
|
|
|
129 | (1) |
|
|
|
130 | (1) |
|
|
|
131 | (1) |
|
|
|
131 | (2) |
|
|
|
133 | (1) |
|
Anonymity mode LMP commands |
|
|
133 | (3) |
|
Address update, LMP active address |
|
|
134 | (1) |
|
Alias address exchange, LMP alias address |
|
|
134 | (1) |
|
Fixed address exchange, LMP fixed address |
|
|
135 | (1) |
|
|
|
136 | (3) |
|
|
|
138 | (1) |
|
Key Management Extensions |
|
|
139 | (28) |
|
|
|
140 | (9) |
|
Requirements on an improved pairing protocol |
|
|
140 | (1) |
|
Improved pairing protocol |
|
|
141 | (6) |
|
Implementation aspects and complexity |
|
|
147 | (2) |
|
Higher layer key exchange |
|
|
149 | (5) |
|
IEEE 802.1x port-based network access control |
|
|
150 | (2) |
|
Higher layer key exchange with EAP TLS |
|
|
152 | (2) |
|
Autonomous trust delegation |
|
|
154 | (13) |
|
Security group extension method |
|
|
154 | (6) |
|
Public key--based key management |
|
|
160 | (3) |
|
Group extension method versus public key method |
|
|
163 | (1) |
|
|
|
164 | (3) |
|
Security for Bluetooth Applications |
|
|
167 | (20) |
|
|
|
168 | (5) |
|
|
|
168 | (1) |
|
Pass-key and key management |
|
|
169 | (2) |
|
|
|
171 | (2) |
|
|
|
173 | (8) |
|
|
|
174 | (1) |
|
|
|
175 | (1) |
|
Network service subscription |
|
|
175 | (2) |
|
|
|
177 | (2) |
|
Subsequent access to NAcPs |
|
|
179 | (2) |
|
|
|
181 | (6) |
|
|
|
181 | (1) |
|
|
|
182 | (2) |
|
|
|
184 | (3) |
| Glossary |
|
187 | (2) |
| List of Acronyms and Abbreviations |
|
189 | (6) |
| About the Authors |
|
195 | (2) |
| Index |
|
197 | |