ETS 880 Secure e-Commerce

1
ETS 880 Secure e-Commerce

• Bluetooth and M-Commerce

Presented by David Johnson Wireless
Specialist Icomtek CSIR
2
(No Transcript)
3
Contents of Bluetooth lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-Commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

4
Contents of Bluetooth Lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-Commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

5
Origins of Bluetooth

• In 1994 Ericsson initiated a study to investigate
  the feasibility of a low-power low-cost radio
  interface between mobile phones and their
  accessories
• In Feb 1998, five companies Ericsson, Nokia, IBM,
  Toshiba and Intel formed a Special Interest Group
  (SIG)

• In July 1999 the first bluetooth specification
  1.0 was released
• The bluetooth consortium today is comprised of 9
  promoter companies who are leaders in telecomms,
  computing and networking and more than 2000
  adopter companies
• Bluetooth is the fastest growing technology since
  the internet or the cellular phone, incredible
  considering that its first public outing was in
  mid 1998

6
Origins of Bluetooth
7
History of Bluetooth

• Harald I Bluetooth (Danish Harald Blåtand) was
  the King of Denmark between 940 and 985 AD who
  united Denmark and Norway

• As Harald Bluetooth united Denmark and Norway,
  Bluetooth of today will unite the many worlds of
  personal devices around us

Rune stone in Danish town, Jelling depicting
Harold Bluetooth
8
Contents of Bluetooth Lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-Commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

9
What Bluetooth can do - definition
Bluetooth is a low-power, low-cost short range
radio system intended to replace cables between
fixed and portable devices. It is intended to
replace many propriety cables with one universal
radio link.
10
What Bluetooth can do - domains
11
What Bluetooth can do user level

• Hot spot scenario Let your laptop or PDA connect
  wireless to Internet or office while at the
  airport, hotel etc
• Automatically sync mail, calendar, notes etc.
  between your PDA and PC, as soon as you get into
  your office
• Physical access control
• Let your PC, Stereo and TV all connect without
  cables to your loudspeakers. Let the PC, phone or
  PDA control them all
• Take a picture with a digital camera, and send it
  via BT to a mobile phone, which forwards the
  picture to an email recipient via WAP
• Pay the cab driver via the phone.
• Withdrawal of money at ATMs
• Setup ad-hoc wireless network at a conference

12
What Bluetooth can do technical level

• Data links Can establish up to 7 simultaneous
  data connections between a master and its slaves
  (piconet)
• Voice links Can establish up to 3 simultaneous
  voice connections between a master its slaves
  (piconet)
• Maximum asymmetrical data rate of 723 kbps (57.6
  kbps return channel)
• Maximum Symmetrical data rate of 432.6 kbps
• Can have up to ten multiple self contained
  networks (piconets) sharing spectrum in the same
  area (scatternet)
• Range can be up to 10m for non-amplified
  bluetooth devices and up to 100m for amplified
  bluetooth devices
• Very low power consumption
• Ability to discover available services on another
  device

13
Contents of Bluetooth lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the Bluetooth
  Stack
• Bluetooth Security and M-Commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

14
Building blocks of Bluetooth the Bluetooth stack

• The Bluetooth Stack Overview
• Bluetooth Stack Radio
• Bluetooth Stack Baseband
• Bluetooth Stack Link controller
• Bluetooth Stack Link Manager
• Bluetooth Stack HCI
• Bluetooth Stack L2CAP
• Bluetooth Stack RFCOMM
• Bluetooth Stack SDP

15
The Bluetooth Stack Overview
16
The Bluetooth Stack Overview
17
Bluetooth Stack - Overview
Headset Bluetooth Stack
18
Bluetooth Stack - Overview

• Access Point Bluetooth Stack

19
Building blocks of Bluetooth the Bluetooth stack

• The Bluetooth Stack Overview
• Bluetooth Stack Radio
• Bluetooth Stack Baseband
• Bluetooth Stack Link controller
• Bluetooth Stack Link Manager
• Bluetooth Stack HCI
• Bluetooth Stack L2CAP
• Bluetooth Stack RFCOMM
• Bluetooth Stack SDP

20
Bluetooth Stack - Radio

• Bluetooth radio is a short range radio link
  capable of data and voice
• Three classes of operating range are defined (
  Class3 1mw 10cm, Class2 10mw 10m, Class1
  100mw 100m )
• Uses a radio link at 2.4Ghz (2400-2483.5MHz )
  which is the unlicensed ISM band also used by
  WLAN
• GFSK (Guassian Frequency Shift Keying) modulation
  scheme
• Uses frequency hopping spread spectrum technology
  (1600 hops/s)
• The signal hops among 79 frequencies which have a
  bandwidth of 1MHz which improves interference
  immunity
• Channel has a symbol rate of 1 Mb/s

21
Building blocks of Bluetooth the Bluetooth stack

• The Bluetooth Stack Overview
• Bluetooth Stack Radio
• Bluetooth Stack Baseband
• Bluetooth Stack Link controller
• Bluetooth Stack Link Manager
• Bluetooth Stack HCI
• Bluetooth Stack L2CAP
• Bluetooth Stack RFCOMM
• Bluetooth Stack SDP

22
Bluetooth Stack - Baseband

• Baseband is responsible for channel coding and
  decoding and low level timing control and
  management of the link within the domain of a
  single data packet transfer
• Each registered device has a unique 48-bit device
  address
• Bluetooth uses TDM where the duration of a slot
  is 625µs
• A Master and Slave transmit on alternate time
  slots with the master always initiating data
  exchange
• Larger packets can use multiple slots
• The Master and slave devices need to synchronize
  their clocks to enable reliable communication to
  take place

23
Bluetooth Stack - Baseband

• Timing diagrams for data packets

24
Bluetooth Stack - Baseband

• Bluetooth is able to form point-to-point links
  and point-to-multipoint links
• The network of bluetooth devices is defined as a
  Personal Area network (PAN)
• A Piconet is an arbitrary collection of Bluetooth
  enabled devices which are physically close enough
  to communicate
• A Scatternet is formed when there are two
  overlapping Piconets, where one of the Slaves of
  one Piconet also forms the Master of another
  Piconet
• A supervision timeout ensures that links are
  closed down when Bluetooth devices move out of
  range of the Piconet.

25
Bluetooth Stack - Baseband

• Piconets (a b) and Scatternets ( c )

26
Bluetooth Stack - Baseband
27
Bluetooth Stack - Baseband

• Two types of links are defined
• Data Links - ACL (Asynchronous Connection-Less)
• Voice Links SCO (Synchronous Connection
  Orientated)
• An ACL link is a packet switched data link which
  is established between a Master and Slave as soon
  as a connection has been established.
• ACL Data is carried in DH (Data High rate)
  packets with no FEC (Forward Error Correction) or
  DM (Data Medium rate) packets with FEC
• A SCO link provides a circuit switched link
  between a Master and Slave with reserved channel
  bandwidth.
• SCO Data is carried in HV (High Quality Voice)
  packets a number of selectable error correction
  packets

28
Bluetooth Stack - Baseband

• Packet Types

29
Building blocks of Bluetooth the Bluetooth stack

• The Bluetooth Stack Overview
• Bluetooth Stack Radio
• Bluetooth Stack Baseband
• Bluetooth Stack Link controller
• Bluetooth Stack Link Manager
• Bluetooth Stack HCI
• Bluetooth Stack L2CAP
• Bluetooth Stack RFCOMM
• Bluetooth Stack SDP

30
Bluetooth Stack Link Controller

• The Link Control Layer is a state machine which
  drives the baseband through various stages to
  establish links.
• It is responsible for managing device
  discoverability, establishing connections and
  once connected, maintaining the on-air links
• It can drive a device through the following
  stages
• Host Inquiry
• Inquiry Scan
• FHS (Frequency Hop Synchronization) packet
  response
• Paging
• Page Scan
• Connection

31
Bluetooth Stack - Link Controller

• State Diagram for Link Controller

32
Bluetooth Stack - Link Controller

• Inquiry procedure (typical time 2s)

33
Bluetooth Stack - Link Controller

• Inquiry procedure (continued)

34
Bluetooth stack Link Controller

• Bluetooth Inquiry procedure at packet level

35
Bluetooth Stack - Link Controller

• Paging Procedure (typical time 0.6s)

36
Bluetooth Stack - Link Controller

• Paging Procedure (Continued)

• The frequency hop sequence used in the connected
  state is calculated from the Master BD Address
  and Clock
• A connection is established once the Slave has
  received the Masters native clock and bluetooth
  address and a poll packet has been sent to
  confirm the connection is working

37
Bluetooth stack Link Controller

• Bluetooth Paging procedure at packet level

38
Bluetooth Stack - Link Controller

• Low Power connected states (Can re-establish
  connection in 2ms)
• Connection Hold Device ceases to support ACL
  traffic for a defined period of time to free up
  bandwidth for other operations such as paging or
  inquiring, maintains AM address, after hold time
  expires the device resynchronizes to the CAC and
  listens for traffic again
• Connection Sniff Device is given a predefined
  slot time and periodicity to listen for traffic,
  on reception of a packet during this time it will
  continue to listen until packets with its AM
  address stop and the timeout period ceases, it
  then waits until the next sniff period
• Connection Park Slave gives up its AM address
  and only listens for traffic at predefined beacon
  intervals between this it can enter a low power
  state. At these intervals even if there is no
  traffic it will synchronize its clock to the CAC.

39
Building blocks of Bluetooth the Bluetooth stack

• The Bluetooth Stack Overview
• Bluetooth Stack Radio
• Bluetooth Stack Baseband
• Bluetooth Stack Link controller
• Bluetooth Stack Link Manager
• Bluetooth Stack HCI
• Bluetooth Stack L2CAP
• Bluetooth Stack RFCOMM
• Bluetooth Stack SDP

40
Bluetooth Stack Link Manager

• Commands the Link Controller/Baseband
• Attaches/Detaches slaves to a piconet and
  allocates their Active Member addresses
• Configures the link which inlcudes a master-slave
  switch
• Establishes ACL (data) and SCO (voice) links
• Puts connections in low-power modes Hold, Sniff,
  Park
• Controls test modes
• Controls Power levels
• Communicates with Link Managers on other
  Bluetooth devices using the Link Management
  Protocol (LMP)
• These LMP commands are used to exchange
  information necessary for security negotiation
• Requesting a SCO connection or Master/Slave
  switch is also done through LMP commands

41
Bluetooth Stack Link Manager
42
Building blocks of Bluetooth the Bluetooth stack

• The Bluetooth Stack Overview
• Bluetooth Stack Radio
• Bluetooth Stack Baseband
• Bluetooth Stack Link controller
• Bluetooth Stack Link Manager
• Bluetooth Stack HCI
• Bluetooth Stack L2CAP
• Bluetooth Stack RFCOMM
• Bluetooth Stack SDP
• Bluetooth Stack Other Higher Layers

43
Bluetooth Stack - HCI

• The Host Controller Interface is necessary when
  there is system partitioning between the baseband
  and Link Manager on one processor and the higher
  layers such as L2CAP, SDP and RFCOMM running on a
  serperate host processor
• This can reduce the processing power needed by
  the bluetooth device and hence reduce cost
• Creates a standard interface that can be used by
  different manufactures of Bluetooth devices
• Three types of HCI packets are used
• Command packets used by host to control the
  module
• Event packets used by the module to inform the
  host
• Data packets used to pass voice and data between
  host and module
• A transport layer (USB, RS-232) is also required
  to carry HCI packets

44
Bluetooth Stack - HCI

• Position of the HCI in the Bluetooth Stack

45
Building blocks of Bluetooth the Bluetooth stack

• The Bluetooth Stack Overview
• Bluetooth Stack Radio
• Bluetooth Stack Baseband
• Bluetooth Stack Link controller
• Bluetooth Stack Link Manager
• Bluetooth Stack HCI
• Bluetooth Stack L2CAP
• Bluetooth Stack RFCOMM
• Bluetooth Stack SDP
• Bluetooth Stack Other Higher Layers

46
Bluetooth Stack Logical Link Control and
Adaptation Protocol (L2CAP)

• Takes data from higher layers of the stack and
  from applications and sends it over the lower
  layers of the stack this is achieved by
  multiplexing using dedicated channel numbers and
  associated PSMs
• Segmentation and reassembly to transfer packets
  larger than the lower layers support
• Quality of service management for high layer
  protocols
• Group management, provides one-way transmission
  to a group of bluetooth devices

47
Bluetooth Stack Logical Link Control and
Adaptation Protocol (L2CAP)

• Example setting up an L2CAP connection over HCI

48
Bluetooth Stack Logical Link Control and
Adaptation Protocol (L2CAP)

• Segmentation and transport of L2CAP packets

49
Building blocks of Bluetooth the Bluetooth stack

• The Bluetooth Stack Overview
• Bluetooth Stack Radio
• Bluetooth Stack Baseband
• Bluetooth Stack Link controller
• Bluetooth Stack Link Manager
• Bluetooth Stack HCI
• Bluetooth Stack L2CAP
• Bluetooth Stack RFCOMM
• Bluetooth Stack SDP
• Bluetooth Stack Other Higher Layers

50
Bluetooth Stack - RFCOMM

• RFCOMM is a simple reliable transport protocol
  which can emulate the serial cable link settings
  and status of an RS-232 serial port
• It can handle multiple concurrent connections by
  relying on the multiplexing features of L2CAP
• It provides the following provisions
• Modem status RTS/CTS, DSR/DTR, DCD and RI
• Remote line status Break, Overrun, Parity
• Remote port settings Baud rate, parity, data
  bits etc.
• Parameter negotiation (frame size)
• Optional credit based flow control

51
Building blocks of Bluetooth the Bluetooth stack

• The Bluetooth Stack Overview
• Bluetooth Stack Radio
• Bluetooth Stack Baseband
• Bluetooth Stack Link controller
• Bluetooth Stack Link Manager
• Bluetooth Stack HCI
• Bluetooth Stack L2CAP
• Bluetooth Stack RFCOMM
• Bluetooth Stack SDP
• Bluetooth Stack Other Higher Layers

52
Bluetooth Stack Service Discovery Protocol

• Provides a means for an SDP client to access
  information about service offered by SDP servers
  (examples printing services, Dial-up networking,
  LAN access)
• SDP servers maintain a database of service
  records which provide information that a client
  needs to access a service (This will be the
  service name, protocols needed for this service
  and even URLs for executables and documentation)
• Services have UUIDs (Universally Unique
  Identifiers) which have been allocated for the
  standard bluetooth profiles but service providers
  can define their own using a method that
  guarantees they cannot be duplicated (there is no
  need for a central authority to allocate these)
• Fits in well with Universal Plug and Play
  architecture

53
Contents of Bluetooth lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

54
Bluetooth Security and M-commerce

• Bluetooth Security Overview
• Bluetooth Security - M-commerce
• Bluetooth Security Security Levels
• Bluetooth Security - Components
• Bluetooth Security Link keys
• Bluetooth Security Generating keys
• Bluetooth Security key exchange
• Bluetooth Security - Authentication
• Bluetooth Security - Encryption
• Bluetooth Security - Architecture
• Bluetooth Security Security Manager
• Bluetooth Security Service Device Databases
• Bluetooth Security Flow diagrams
• Bluetooth Security - Weaknesses

55
Bluetooth Security - Overview

• Wireless signals can be easily intercepted and
  are vulnerable to spoofing and eavesdropping
• Bluetooth offers the following inherent security
  features
• Two different modes of accessibility
  (confidentiality)
• Discoverable mode Anyone can discover the
  device
• Non-discoverable, Limited discoverability,
  General discoverability
• Connectible mode Only trusted devices can
  connect to the devices
• Frequency hopping
• Limited Range
• Bluetooth offers the following specific security
  services
• Authentication to verify the devices identity
• Authorization to allow a device access to
  specific services
• Encryption to protect the link privacy

56
Bluetooth Security - Overview
57
Bluetooth Security M-commerce

• M-commerce (mobile commerce) is the buying and
  selling of goods and services through wireless
  handheld devices such as cellular telephones and
  personal digital assistants (PDAs). Known as
  next-generation e-commerce, m-commerce enables
  users to access the Internet without needing to
  find a place to plug in. The emerging technology
  behind m-commerce is based on the Wireless
  Application Protocol (WAP)
• Bluetooth could become a new carrier for
  M-commerce traffic in Personal Area Networks and
  security will be a key component of this
• Bluetooth can also act as a carrier for longer
  range gateway such as a POT or mobile phone (eg.
  Between a PDA and a cellphone making an online
  purchase)

58
Bluetooth Security M-commerce

• Walkup Bluetooth Kiosks provide local
  information in many venues such as shopping
  malls, airports and exhibits (maps, coupons,
  special offers, and so on)
• allow multiple users to access the kiosks
  simultaneously.
• Enable mobility - information could be
  transferred to a personal device, available even
  when the user is not near a kiosk.
• Ultimate Queue-killer Peer-to-peer
  transactions enable local m-commerce transactions
  without having to stand in line for access to a
  resource (machine and/or person).
• Consumers make purchases, get discount
  authorizations, and do other transactions
  wirelessly at the point of presence.

59
Bluetooth Security M-commerce

• Bluetooth Application Roadmap

60
Bluetooth Security Security Levels

• Not all applications warrant the use of security
• Bluetooth defines three levels of security
• Mode 1 Absence of security for users accessing
  non-critical applications in public areas such as
  airports or for example exchanging business cards
• Mode2 Service level security which will enable
  or disable security depending on the particular
  application which in run. For example a hotel
  bluetooth network could have no security for
  accessing local town information but could add
  security if you wanted to access your email.
• Mode3 Link-level security where security is
  enforced at a common level for all applications
  for example if ATM transactions were done via
  bluetooth.

61
Bluetooth Security - Components

• Security is based on the SAFER security protocol
• All link-level security is based on 128-bit link
  keys
• A secret PIN number (variable from 4 to 16
  octets) which is common to the two devices
  wishing to communicate forms one of the key
  inputs into forming the initial link key.
• Authentication in Bluetooth uses a
  device-to-device challenge and response scheme to
  determine if the two devices share a common link
  key
• Encryption generates a cipher stream based on an
  encryption key which is generated from a common
  link key encryption is symmetrical
• Link keys can be semi-permanent or temporary

62
Bluetooth Security Link keys

• In order to accommodate for different types of
  applications, four types of link keys have been
  defined
• the unit key KA Semi permanent key generated in
  every unit only once during factory setup
• the combination key KAB This is dependent on two
  units and is unique for a particular pair of
  devices more secure than a unit key
• the master key Kmaster Temporary key used for
  point to multipoint broadcast communications and
  will replace the current link key until
  peer-to-peer communications resume
• the initialization key Kinit The is a temporary
  key which is used when no combination or unit
  keys have been exchanged yet. It is generated
  using a PIN code as one of its inputs
• In addition to these keys there is an encryption
  key, denoted Kc. This key is derived from the
  current link key.

63
Bluetooth Security Link keys

• Link keys need to be distributed among bluetooth
  devices wishing to communicate in a secure
  manner, these are encrypted using the current key
  (initialization key for devices connecting for
  the first time)
• During the initialization phase of bluetooth the
  following steps occur for devices connecting for
  the first time
• 1. generation of an initialization key
• 2. generation of link key
• 3. link key exchange
• 4. authentication
• 5. Generating of encryption key in each unit
  (optional)
• Only steps 4 and 5 will be necessary if link keys
  have already been stored in memory in the case of
  devices which have previously connected (trusted
  pair)

64
Bluetooth Security Generating keys

• Generation of Keys

• Algorithm E22 is used to generate Initialization
  keys and Master keys where PIN is a combination
  of the bluetooth address and the PIN and L is
  derived from the number of octets in the PIN
• Algorithm E21 is used to generate Unit keys and
  Combination keys where RAND is a 128-bit random
  number and BD_ADDR is the units bluetooth address

65
Bluetooth Security Generating keys

• Formal definition for E21

66
Bluetooth Security Generating keys

• Formal definition for E22

67
Bluetooth Security key exchange

• Exchange of unit keys

• A sends the unit key KA to unit B securely by
  XORing with Kinit
• Unit B will store KA as the link key KBA.
• Usually the application will let the unit with
  restricted memory abilities send its unit key to
  be used as the link key since this unit only has
  to remember its own unit key
• Kinit is discarded once keys have been exchanged

68
Bluetooth Security key exchange

• Creation and exchange of combination keys

• Random numbers (LK_RANDA and LK_RANDB) are
  generated in Unit A and Unit B
• These are exchanged securely by XORing them with
  the current link key K
• Two new random numbers (LK_KA and LK_KB) are
  generated for LK_RANDA and LK_RANDB using the E21
  algorithm
• These two random numbers are XORed together to
  form a new combination key KAB on unit A and KBA
  on unit B

69
Bluetooth Security key exchange

• Creation and exchange of a master key

• The master device generates two random numbers
  (RAND1 and RAND2) and uses the E22 algorithm to
  generate a random key Kmaster
• A third random number (RAND) is generated by the
  master and sent to the slave
• The slave and the master compute an overlay (OVL)
  using the E22 algorithm with the current key and
  the new random as inputs
• The master key (Kmaster) is sent from the master
  to the slave by XORing it with the overlay
• The slave which has the identical overlay,
  recalculates Kmaster

70
Bluetooth Security - Authentication

• Authentication process

• Authentication uses a challenge response scheme
  to check the claimants knowledge of a secret key
  (current link key)
• The verifier challenges the claimant to
  authenticate a random number (AU_RANDA) with an
  authentication code, E1, and return a result,
  SRES, which is compared against its own
  generated code SRES
• Authentication is often mutual Unit A verifying
  Unit B is followed by Unit B verifying Unit A

71
Bluetooth Security - Authentication

• The formal definition of E1 is

• The authentication function E1 is often called a
  MAC
• E1 uses the encryption function SAFER
• The ACO (Authenticated Ciphering Offset) produced
  is used later for encryption

72
Bluetooth Security - Encryption

• Generating the Encryption Key

• The encryption key Kc is generated by E3 from a
  COF (Ciphering Offset Number), the current link
  key and a 128-bit random number
• The COF is either derived from the BD_ADDR of the
  master if the current link key is a master key
  otherwise it is generated from the ACO created
  during authentication
• Even though the generated key length is 128 bits
  this may be shortened due to export encryption
  laws

73
Bluetooth Security - Encryption

• Formal definition of E3

See equation 36 for description of the hashing
function
74
Bluetooth Security - Encryption

• Encryption process

75
Bluetooth Security - Architecture

• Security architecture

76
Bluetooth Security Security Manager

• A Security manager is essential especially in a
  Mode 2 system where various levels of security
  are needed for different services
• A security manager carries out the following
  functions
• Stores security related information on services
  in service database
• Stores security related information on devices in
  device database
• Responds to access requests
• Enforce authentication and/or encryption before
  connection the application
• Initiating or processing input from an external
  security control entity such as a user interface
  prompting for a PIN
• Initiating Pairing

77
Bluetooth Security Service Device Databases

• Service database will contain the following
  entries for each service/application

Entry Status
Authorization required M
Authentication required M
Encryption required M
PSM (Protocol/Service multiplexer) M
Broadcasting Allowed O

• Device database will contain the following
  entries for each device

Entry Status Contents
BD_ADDR (bluetooth address) M 48-bit MAC address
Trust level M Trusted/Untrusted
Link Key M Bit field (up to 128 bits)
Device Name O String (to avoid name request)
78
Bluetooth Security Flow diagrams

• Flow diagram for Security manager

79
Bluetooth Security Flow diagrams

• Flow diagram for authentication

80
Bluetooth Security Flow diagrams

• Flow diagram for authorization

81
Bluetooth Security - Weaknesses

• Strength of the challenge-response pseudo-random
  generator is not known.
• PINs are only 4 digits.
• An elegant way to generate and distribute PINs
  does not exist.
• Initialization key may be too weak.
• Unit key is reusable and becomes public once
  used.
• The master key is shared.
• Repeating attempts for authentication.
• Negotiable key length.
• Eavesdropping resulting from unit key sharing.

82
Contents of Bluetooth Lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

83
Example Applications Bluetooth Profiles

• The blueooth SIG has created profiles which give
  a clear description of how the bluetooth
  specification should be used for a given end-user
  function this is to ease interoperation between
  different bluetooth devices
• Currently defined profiles
• Cordless Telephony
• Intercom
• Headset
• Dial-up networking
• FAX
• LAN Access
• File Transfer
• Object Push
• Synchronization

84
Contents of Bluetooth Lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

85
Bluetooth Products
Notebooks Printers and keyboards
Camcorders
Access points
PC and flash cards
Phones and accessories
Headsets
PDAs and accessories
USB and serial ports
86
Bluetooth Products - Bluetags

• Track Registration of the tagged item leaving a
  predefined area or range.
• Search Registration of the tagged item entering
  a predefined area or range
• Write Information can be written and stored
  directly in the BlueTag
• Read Information stored in the BlueTag can be
  accessed and read

87
Bluetooth Products Ericsson Chatpen

• Used together with patterned paper it enables
  you to store and transmit basically anything you
  write or draw
• Can store several pages of information
• The information is transmitted by the Bluetooth
  transceiver, either directly to your computer, or
  forwarded to someone via a relay device such as a
  cell phone

88
Bluetooth Products Commils Cellarion system

• Your mobile phone with Bluetooth inside becomes
  your all-in-one handset a cellular phone
  outdoorsand a cordless extension of your desk
  phone at your office
• Your Bluetooth PDA becomes an extension ofyour
  PC, continuously connected to the Internet and to
  the office LAN

89
Contents of Bluetooth Lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

90
Bluetooth in South Africa

• Bluetooth is still in its infancy in South Africa
• Red-M have representation in South Afirca they
  specialize in bluetooth networking solutions for
  buildings (supply bluetooth access nodes and
  servers)
• 1000AP Access Node
• 3000AS Server
• Genosware network management
• ATIO are networking consultants who are pursuing
  bluetooth networking in buildings in partnership
  with Red-M they currently have two buildings
  bluetooth enabled (one AFROX hospital and
  Investec)

91
Bluetooth in South Africa

• Bluetooth hardware is available from the
  following companies
• Avnet Kopp Bluetooth development kit using
  Phillips chipset
• Memec Alcatel bluetooth development kit using
  Silicon Wave chipset
• Ericsson Ericsson Development kit using Ericsson
  ROK chipset
• Very little low level design work and RD is
  currently being carried out in bluetooth but a
  need exisit
• Non- OFS (Off The Shelf) solutions are needed for
  the Transport sector, Energy sector, Emergency
  services and Scientists
• Cost is a major hindrance to bluetooth
  penetration
• Currently a bluetooth chip costs 11 when
  purchased in bulk, but when a module with all the
  necessary surrounding components is manufactured
  it costs 100

92
Bluetooth in South African

• The cost of bluetooth silicon could fall to 5
  within the next two years (looking more promising
  since microsoft included bluetooth in wireless
  keyboards)
• South African markets need to create indigenous
  solutions based on the raw 11 chipset and not
  only purchase OTS solutions from overseas
  suppliers
• Current potential markets are
• Home and industrial security
• Home automation
• Emergency services (bluetooth vehicle link
  voice, data)
• Industrial control and automation
• Military
• Scientific instrumentation

93
Contents of Bluetooth Lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

94
Competing Technology
95
Competing Technology
96
Contents of Bluetooth Lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

97
The Future

• Current working groups working on Version 2.0
• High rate bluetooth 10 Mb/s
• HI_FI quality non-compressed audio, video
  suitable for video conferencing
• Coexistence of Bluetooth with other ISM band
  technologies
• Local positioning for indoor and built-up areas
• Despite the delays, Bluetooth is still projected
  to be a 5 billion market within the next five
  years (Merrill Lynch February 8, 2001).
• The majority of market forecasting for Bluetooth
  applications remain in mobile phones, headsets,
  PDAs, and PCs, accounting for over 80 of units
  by 2006.
• Bluetooth penetration rate for digital still
  cameras is expected to be 60 in 2006 and the
  same rate for digital TV is expected to hit 65
  in 2006 (Merrill Lynch, February 8, 2001).
• Cost per bluetooth chip is expected to fall to 5
  by 2003

98
The Future

• Based on analysts pricing estimates, this could
  translate to 18.5 billion of data access
  revenues, 2.4 billion of m-commerce, and 1.2
  billion of advertising revenues by 2005 (Goldman
  Sachs, Mobile Internet Primer, July 14, 2000
• Bluetooth remains a chicken or egg game where
  the benefits of Bluetooth only begin to reach
  their zenith as a function of manufacturers
  willingness to introduce new products and make
  Bluetooth a persistent element in the industry

99
Contents of Bluetooth Lecture

• Origins and history of Bluetooth
• What Bluetooth can do
• Building blocks of Bluetooth the bluetooth
  stack
• Bluetooth Security and M-commerce
• Example applications Bluetooth profiles
• Bluetooth products on the market
• Bluetooth in South Africa
• Competing technology
• The future of Bluetooth
• Demonstrations

100
Demonstrations

• Managing security on a Bluetooth Access Point
  with a Red-M system
• Device Inquiry and Service Discovery
• WAP browsing over Bluetooth
• Serial Cable replacement demo