One of the big breakthroughs with Bluetooth BLE 5.2 is added security.
This enhanced Bluetooth security in BLE 5.2 is largely due to an updated SoC (system-on-a-chip) solution.
These new SoCs in BLE 5.2 provide a security feature called Secure Boot with root of trust and secure loader (RTSL) that uses a two-stage bootloader designed to ensure that an EFR32BG22-based system boots only with authenticated firmware.
Conceptually, Secure Boot with RTSL addresses a weakness in older single-stage bootloader systems that permitted hackers to take complete control of a connected system by booting it with compromised firmware.
The use of signed firmware would seem to provide a solution to this problem. In practice, however, the use of counterfeit certificates to sign firmware or use of legitimate certificates fraudulently obtained by bad actors can leave even signed booting methods exposed to attack.
In contrast, an EFR32BG22-based system establishes a root of trust built on a first stage bootloader that pulls trusted firmware from ROM. In turn, this trusted software uses strict authentication methods to verify the source and integrity of the second stage bootloader code, which in turn verifies and loads the application code.
The ability to build a system solution on a root of trust allows developers to deliver products with high confidence in the ongoing integrity of the software even through over the air (OTA) firmware update cycles.
One of the sharpest criticisms of past Bluetooth versions focused on security vulnerabilities, including Sweyn Tooth, which consisted of 12 potentially severe security vulnerabilities that affected millions of Bluetooth-enabled wireless smart devices worldwide.
Want to learn more? Tonex offers Bluetooth Security Training, a 2-day course covering the security capabilities of Bluetooth. The course provides coverage on Bluetooth weaknesses, threat vectors, Bluetooth security features, Bluetooth attacks and guidelines to organizations employing Bluetooth technologies on securing them effectively.
Additionally, Tonex offers nearly three dozen more courses in Cybersecurity Foundation. This includes cutting edge courses like:
—Cybersecurity Fundamentals (2 days)
—Electric Grid Cybersecurity Master Certification (4 weeks)
—Network Security Training (2 days)
—Software Security Training (2 days)
—ICS Cybersecurity Training (4 days)
For more information, questions, comments, contact us.