Is there a tradeoff between privacy and security in BLE-based IoT applications: Using a smart vehicle of a major Taiwanese brand as example

Abstract

In current Bluetooth Low Energy (BLE)-based Internet of Things (IoT) applications, people may need to prove their identities to Internet services to obtain credentials to pair with IoT devices. In this case, the bluetooth MAC address of a device could be used to increase the security of pairing processes. However, current BLE devices, especially smartphones, usually use random addresses to prevent others from tracking the devices with original bluetooth MAC addresses. While devices cannot identify one another with addresses, using random address may lead to higher security risk. This study uses a smart vehicle from a major Taiwanese brand as an example to illustrate this security impact of using BLE random addresses. Afterwards, the study provides generalized security requirements based the example scenario and a scheme to fulfill the requirement.