Bluetooth^® Mesh Private Beacons

Technical Overview

View Table of Contents

Release :	1.0.0
Document Version :	1.0
Last updated :	September 19, 2023
Authors :	Martin Woolley, Bluetooth SIG Omkar Kulkarni, Nordic Semiconductor

Revision History

Version	Date	Author	Changes
1.0.0	September 19, 2023	Martin Woolley, Bluetooth SIG Omkar Kulkarni, Nordic Semiconductor	Initial version

 

Note The Bluetooth Mesh Profile Specification has been renamed and is now called the Bluetooth Mesh Protocol Specification. References in this and related papers will use this name when referring to the version 1.1 specification but continue to refer to the version 1.0 specification as the Bluetooth Mesh Profile Specification.

 

1. Background

1.1 Privacy and Device Tracking

A device which regularly transmits static information constitutes a privacy risk to the device or network user, since it may become possible to track the device as it moves around the network and deduce information about the device, the user of the device, and, perhaps, the network as a whole.

1.2 Secure Network Beacons

Bluetooth Mesh defines a type of beacon message known as the Secure Network Beacon. Secure Network Beacons are used during two important procedures, namely the Key Refresh procedure and the IV Update procedure.

Secure Network Beacons contain static information which identifies a subnet plus an encrypted authentication value. The static network information in a Secure Network Beacon message is transmitted unencrypted.

The IV Index field, which is an important value used in Bluetooth Mesh security and shared by all nodes in a network, is an example of static network information that is transmitted in Secure Network Beacons.

1.3 Proxy Nodes

Proxy nodes support both Bluetooth^® LE with GAP and GATT and Bluetooth Mesh. The proxy acts as an intermediary and makes it possible for applications on devices such as smartphones to send and receive mesh messages to and from the network over a GATT connection to the proxy.

Proxy nodes use Bluetooth LE advertising to allow their discovery by other devices and applications and indicate their support for the GATT Mesh Proxy Service in a field called Service UUID.   

1.4 Network and Node Identities

Proxy nodes advertise identity information of one of two types in the Service Data field of their advertising packets. Either the node’s identity is advertised or that of the subnet(s) that the node is a part of. These two variants are known as Private Network Identity advertising and Private Node Identity advertising respectively.

2. About Private Beacons

2.1 Capabilities and Benefits

Private beacons are a type of beacon that was introduced in Bluetooth Mesh version 1.1 which do not contain static information. Bluetooth Mesh Private beacons improve network security by eliminating the possibility of tracking devices using the data contained within beacon messages.

2.2 Technical Highlights

2.2.1 Bluetooth Mesh Private Beacons

Table 1, reproduced from the Bluetooth^® Mesh Protocol Specification, shows the content of Bluetooth Mesh Private beacons.

Field	Size (octets)	Description
Beacon Type	1	0x02 – Bluetooth Mesh Private beacon
Random	13	Random number used as entropy for obfuscation and authentication of the Bluetooth Mesh Private beacon.
Obfuscated Private Beacon Data	5	Flags representing the status of Key Refresh and IV Update operations plus the IV Index value for the network.
Authentication Tag	8	Authentication tag for beacon

Table 1 – Bluetooth Mesh Private beacon format

Bluetooth Mesh Private beacons obfuscate static network data by encrypting it using a key called the PrivateBeaconKey and a random 13 octet number. The PrivateBeaconKey is derived from the main network key, and, therefore, the obfuscated data can only be decrypted by nodes that are part of the same network. Furthermore, both the random number and the Bluetooth^® device address (BD_ADDR) in the Bluetooth LE packet change periodically and at the same time (by default every 10 minutes) so that the obfuscated data also changes. This combination of measures provides protection against the possibility of tracking devices.

2.2.2 Private Proxy Nodes

The proxy feature has been enhanced to provide better privacy. A proxy node which has enabled the new capabilities is called a private proxy node.

2.2.2.1 Private Network Identity Advertising

Private proxy nodes can advertise their availability using a new form of network identity advertising called Private Network Identity advertising. Private Network Identity advertising safeguards the privacy of the node by obfuscating the network identity in a similar way to that which is used with Bluetooth Mesh Private beacons. A random number is one of the inputs to an obfuscation function, and this random number is included in the ServiceData field. The obfuscation function produces an 8 octet hash value. A node receiving the obfuscation data can determine which network it relates to by creating hash values for each of the subnets the node is a member of and comparing the calculated hash values with the hash value in the ServiceData field of the advertising packet.

The random number value and device BD_ADDR value should each change at the same time, every ten minutes. In this way, the privacy of the advertising proxy node is protected.

2.2.2.2 Private Node Identity Advertising

A new form of node identity advertising called Private Node Identity advertising is also defined. This is identical to the original node identity advertising except that the Identification Type field contains a value of 0x03 instead of the value of 0x01 used without privacy. The purpose of the new Identification Type value is to indicate to the proxy client the type of beacon message it will first receive after it has connected to the proxy server. Private Node Identity advertising means that the beacon message will be a Secure Network Beacon whereas Private Node Identity advertising means that the beacon message will be a Bluetooth Mesh Private beacon. Proxy clients that are compliant with Bluetooth^® Mesh Profile Version 1.0 can therefore use the Identification Type to decide whether or not they are compatible with each discovered proxy server node.

2.2.3 Models

Two models named the Bluetooth Mesh Private Beacon Client model and the Bluetooth Mesh Private Beacon Server model support the use of Bluetooth Mesh Private beacons. The server model contains states which enable or disable the ability to transmit as a Bluetooth Mesh Private beacon and allow the update period for the random number value to be configured.

Proxy nodes may be prompted to start advertising using a new feature called Proxy Solicitation (See the Bluetooth^® Mesh Feature Enhancements: Version 1.1 Release Overview paper for details). The On-Demand Private Proxy client and server models allow the capability of a proxy node to support proxy solicitation to be enabled or disabled.

3. Close

Bluetooth Mesh Private beacons improve Bluetooth^® Mesh security by eliminating the use of static data in beacon messages.