Page 180 - Cyber Defense eMagazine RSAC Special Edition 2025

Fortunately, Bluetooth® Mesh incorporates multiple layers of encryption, authentication, and privacy
protection to safeguard networks from cyber threats.

1. Strong Encryption & Authentication

Bluetooth® Mesh ensures that all communication is encrypted to prevent unauthorized access. It uses
AES-128 encryption with Counter with CBC-MAC (CCM) to protect data transmitted across the network.
Even if an attacker intercepts a message, they cannot read or modify it without the correct encryption
keys.

Each message also contains a message integrity check (MIC) to verify its authenticity. This prevents
attackers from injecting fake messages or altering commands sent between devices. Additionally,
Bluetooth® Mesh protects against replay attacks by using sequence numbers—ensuring that older
messages cannot be resent by an attacker to manipulate devices.

2. Secure Device Provisioning

Before a device can join a Bluetooth® Mesh network, it must go through a secure provisioning process
to prove its authenticity. This process includes:

• Out-of-Band (OOB) authentication, such as QR codes or NFC, to verify legitimate devices.
• Elliptic Curve Diffie-Hellman (ECDH) encryption, ensuring that device provisioning is secure
against man-in-the-middle (MITM) attacks.

Unlike some IoT systems that rely on default passwords or pre-configured security credentials,
Bluetooth® Mesh ensures that all devices establish secure keys during provisioning, preventing attackers
from exploiting weak authentication.

3. Network-Level Security

Bluetooth® Mesh networks use a three-tiered key system to provide strong security at different levels:

• Network Key (NetKey): Encrypts messages at the network level, ensuring all devices in the mesh
are authenticated.
• Application Key (AppKey): Used for specific applications, preventing unauthorized devices from
accessing sensitive functions (e.g., lighting control vs. security systems).
• Device Key (DevKey): Assigned to each device during provisioning, preventing rogue devices
from impersonating others.

If a device is compromised, Bluetooth® Mesh supports a key refresh mechanism, allowing administrators
to generate new encryption keys and remove unauthorized devices from the network.

4. Privacy Protection

To prevent tracking and data theft, Bluetooth® Mesh devices use randomized source addresses that
change periodically. This prevents attackers from identifying or tracking specific devices based on their
network activity.

180