Security of Bluetooth Low Energy

我建议研究常见无线电技术的安全性，即蓝牙低功耗。我将主要关注蓝牙协议漏洞，但我也会研究对流行蓝牙实现的攻击，如BlueZ或我的主要微控制器制造商（德州仪器BLE SDK，北欧半导体BLE SoftDevice等）。在过去的两年里，我一直致力于构建消费者蓝牙设备，因此我对蓝牙4.0，4.1，4.2和5的工作原理有了深入的了解，并在此期间假设了这一领域的一些漏洞。我还将建议为IO有限的设备设计密码方案。像这样只有一个按钮和/或几个LED的设备通常使用蓝牙与手机通信，而手机几乎没有提供与这些设备的安全链接。存在一些类似的方案，例如PACE开发了我的BSI，但这些方案通常因需要更多的IO而不足，被专利（例如US 20140157385 A1）阻止，或者对于小型电池供电设备来说功率太高，因此未被行业采用。

I propose to investigate the security of common radio technologies, namely Bluetooth Low Energy.I will mainly focus on Bluetooth protocol exploits, however I would also research attacks on popular Bluetooth implementations, like BlueZ or those provided my major microcontroller manufacturers (Texas Instruments BLE SDK, Nordic Semiconductor BLE SoftDevice, etc). For the last two years I have worked on building consumer Bluetooth devices, and as such I have gained a deep understanding of how Bluetooth 4.0, 4.1, 4.2 and 5 work, and have hypothesised some exploits in this area during this time.I will also propose designing a cyptographic scheme for devices which have limited IO. Devices like this, which only have a single button and/or a few LEDs often use Bluetooth to communicate to a phone, which has very little provision for securing links to such devices. Some similar schemes exist, for example PACE developed my BSI, but these often fall short by requiring more IO, are blocked by patents (US20140157385A1 for example) , or are too high power for small battery powered devices and as such are not adopted by the industry.