A Bluetooth expert debunks myths and untangles messy methodologies that have resulted in security snafus in the Internet of Things
With more smart products arriving every day, the benefits of connectivity are advancing, but so are security and privacy concerns. The Bluetooth Special Interest Group (SIG) works with more than 26,000 member companies, and we consistently see the same five setbacks that occur during the development of a new product and its security strategy.
1. Assuming security is a hassle
Security gets a bad rap for being cumbersome to implement. Legacy security processes that left developers and consumers with bad memories also resulted in outdated practices.
For example, developers are often under the false impression that Bluetooth pairing is a challenging burden for consumers. A lot has changed in pairing since 2004. Updates to the Bluetooth specification have not only made the process of connecting devices simple, but also more secure with features that cover encryption, trust, data integrity, and privacy of the user’s data. Depending on the user’s requirements and the capability of the device, Bluetooth provides several options for pairing for a user-friendly, secure connection.
The latest version of Bluetooth Smart technology builds upon the government-grade, Federal Information Processing Standard (FIPS) compliant security features to offer AES encryption, Elliptic Curve Diffie Hellman (ECDH) cryptography, and new low-energy secure connections. While many implementations might not require ECDH key generation or 128-bit AES encryption, Bluetooth offers the ability to implement this high level of encryption as the developer sees fit.
2. Lack of education
A common misconception is that beacons track people or users. All beacons are actually capable of doing is sending out a broadcast signal. While an application on a smart device might be able to assess a user’s progression through a store based on whether or not a device receives a message, the only personal connection to that information comes when a user downloads and activates the application. The beacon itself doesn’t do any collection of data.
Clarifying the interactions, and ultimately the security factors in place and how consumers have control of their security, can quickly address many of the common fears and misconceptions. For example, Bluetooth pairing is more than just a method to establish device connection. It’s also a security measure put right in the hands of the users.
3. Ignoring consumer access
Giving consumers easy, transparent access to their security puts them squarely in the driver’s seat and gives them confidence that their device interaction is secure. For instance, the ability to turn on and off location-based services for each specific application enables direct control and allows the user to decide what the app can and cannot do. When building the next smart product, developers should consider ways to enhance the user’s access to control.
A new feature in version 4.2 of the specification makes it difficult for eavesdroppers to track a device through its Bluetooth connection without permission. This feature causes the MAC address within the advertising packets to be replaced with a random value that changes at timing intervals determined by the manufacturer.
4. Not balancing functionality and security
In any scenario, developers must assess appropriate security requirements for the device. In many situations, additional security can limit functionality by excluding types of connectivity.
For example, the security needs of a pedometer would differ from those of a smart lock. Consumers buy a pedometer to monitor their steps; the advertising of step data may not be overly protected because personally identifiable information isn’t associated with it. However, with a smart lock, security is naturally more important and essential to device functionality.
5. Ending with security
Security can’t be an afterthought, tagged on at the end of development. It must be contemplated from the beginning, and throughout the entire process.
Start considering all the security solutions possible. Think through the potential issues that could arise for your product or service. Learn from both successful and failed security implementations by other developers, and know the full range of security implementations available to you.
The developer world has already shifted to an open environment, with tools and resources like the Bluetooth Developer Studio. When considering your product’s security options, you need to think about the various trade-offs and make the right ones for your users. Otherwise, you’ll not only lose the trust of your customers, but you’ll lose their mindshare and wallets as well.
-- Steve Hegenderfer is Director of Developer Programs at the Bluetooth SIG