2018 IEEE 15th International Conference on Mobile Ad-hoc and Sensor Systems

BF-IoT: Securing the IoT Networks via

Fingerprinting-based Device Authentication
Tianbo Gu, Prasant Mohapatra
Department of Computer Science, University of California Davis, USA
Emails: {tbgu, pmohapatra}@ucdavis.edu

Abstract—Bluetooth low energy (BLE) based devices are al- to its low energy consumption which increases the lifetime
ready deployed in massive quantity as Internet-of-things (IoT) of the service provision [7]. It is used in almost every smart
becomes prominent in the last two decades. In order to lower device we can think of, ranging from smart light-bulb, health
the energy consumption, BLE devices have to compromise with
security and privacy problems. Existing research work shows that tracker to intelligent vehicle, smart city, etc. In the year 2017,
BLE devices can be easily spoofed and leveraged to gain access to 4.4 billion BLE enabled devices had been purchased over the
a networking system. In this paper, we propose BF-IoT, the first world. BLE is becoming indispensable parts of the wireless
IoT secure communication framework for BLE-based networks communication protocol in IoT.
that guards against device spoofing via monitoring the work- However, BLE differs from conventional wireless commu-
life cycles of devices. We dig into the BLE protocol stack and
extract the unique network-flow features from the link layer and nications such as WiFi, Zigbee, Bluetooth, etc. The stringent
ATT/GATT service layer so as to generate the fingerprints for low energy transmission pushes the BLE devices to compro-
device authentication. BF-IoT provides two-phase defense against mise with security, especially, BLE is vulnerable to identity
malicious entities: continuously authenticating device identity spoofing-based attacks [8], [9]. For instance, by forging the
before the connection setup and during session establishment. MAC address of a temperature sensor, a malicious entity can
We build a customized system to validate the effectiveness of
our mechanism. We extensively evaluate BF-IoT with a dozen of send counterfeit temperature report to the smart home con-
different off-the-shelf commodity IoT devices which shows that troller. The smart home controller guides the air conditioner
the devices can be accurately authenticated via only sniffing the and may mistakenly adjust the room temperature. This poses
transmission characteristics. an imminent threat to the assistive living. In another case,
Index Terms—Internet of Things (IoT), Bluetooth Lower a malicious agent can forge the same beacon advertisement
Energy (BLE), Device authentication, Fingerprinting, Network
security messages of a wireless headset, which enables the agent to
eavesdrop on conversations and sniffs all the conversation
with that victim smartphone. Thus, authenticating an intended
I. I NTRODUCTION
device is of utmost importance in smart living.
IoT has become a household name during the last few years Fingerprint-based identification and authentication mecha-
due to the rapid growth of smart devices. We are surrounded nisms had been used in our society for a long time because
by many IoT devices throughout the day which is changing no two entities can pose the same fingerprint. Similarly, in
our lifestyle. International Data Corporation forecasts that in cybersecurity, the term fingerprinting represents a process by
the year 2018, the worldwide spending of IoT devices will be which a device or an active agent can be distinguished by
around 772 billion [1]. By the year 2020, 24 billion devices observing some external characteristics. There exist some re-
will be connected worldwide, and by 2022, on average 500 search works about fingerprinting in wireless communications.
devices will be connected per household [2]. It is expected For example, packet inter-arrival time [10] and the frames’
that a more significant portion of these devices will be used for duration field in 802.11 [11] can be utilized for identifying
monitoring the activity of daily life (ADL), such as sleeping, WiFi devices as the observed characteristics that are dependent
exercise, eating habits, etc. ADL monitoring will be critical on the particular device driver. However, these approaches
in evaluating our health status, predicting long-term chronic targeting the 802.11 cannot be applied to BLE due to the
disease and providing medical advice for elderly people. distinct protocol characteristics.
With its rapid growth, IoT brings unprecedented security Hardware-based characteristics, such as clock skew [12]
and privacy challenges due to its unique characteristics and or radio frequency signature [13], are also used to uniquely
widespread deployment [3], [4]. Due to its attachment to our identify a network device. However, these works require
life, the security of these devices become very crucial to sophisticated signal processing with additional hardware and
our daily living. However, IoT devices are constrained by its also usually take an extended period to fingerprint devices,
power and compromised with its security. Most IoT devices which are not applicable in the real-time BLE communica-
are connected to the Internet through short-range wireless tion. [14] uses the inter-arrival time of packets sent by a
communication protocols. IEEE published a few standards device for a specific type of traffic (e.g., SCP, ICMP, etc.) to
specifically for low power device communications [5]. Blue- implement device-type identification. But the particular type
tooth low energy (BLE) [6] dominates in the IoT world due of traffic cannot be obtained in BLE communication thereby

2155-6814/18/$31.00 ©2018 IEEE 254

DOI 10.1109/MASS.2018.00047
impeding usage of such an approach. The gap in research a network to get access to secured data connection that other
on fingerprinting-based authentication in BLE motivates us to untrusted devices cannot have.
design a secure communication framework that utilizes the Our goal is to design a wireless communication framework
unique protocol features in BLE to authenticate the devices to restrict the unauthenticated devices from connecting to
irrespective of the location or environment. the network via IoT gateway so that an adversary is unable
In this paper, we propose BF-IoT, the first secure communi- to connect to a secured application or communicate with
cation framework in BLE-based IoT networks via fingerprint- other devices by exploiting a spoofed ID of a trusted device.
ing technique. In summary, our contributions break down into Continuously monitoring cross-layer data transmission is to
the following aspects: be performed in order to detect malicious activities before
• We dig into the BLE protocol stack and explore the
and during connection establishment. In the next section,
unique features set from the link layer and ATT/GATT we present how devices can be identified based on their
service layer in BLE. Based on the cross-layer transmis- transmission signature.
sion characteristics, BF-IoT is able to fingerprint the IoT III. S YSTEM A RCHITECTURE
devices and implement the device authentication.
The BF-IoT works by continuously sniffing transmission
• BF-IoT provides two-phase defense mechanisms across
characteristics of devices from multiple protocol layers in
devices’ work lifecycle: before connection establishment
BLE. The BF-IoT employs two-phase authentication mecha-
and during connection establishment, which enhances the
nisms: before connection establishment and during connection
accuracy of authentication and further secure the IoT
establishment. Before discussing the actual implementation,
networks. Compared to the existing approaches, BF-IoT
this section provides the overview of the BF-IoT system
can efficiently fingerprint and authenticate devices in a
components and its characteristics.
relatively short time.
• We utilize a machine learning based model to differentiate A. System components
and authenticate IoT devices in a real-time way. We build 1) IoT gateway: IoT gateway is the entity that both connects
a customized system and work around with a dozen of to the cloud and the peripheral devices. The major function
typical BLE-based IoT commodity devices. The extensive of IoT gateway is to establish links with peripheral devices
evaluation shows that our fingerprinting technique can for collecting data and then send to the cloud for the usage of
reach approximately 100% accuracy thereby validating applications. IoT gateway can be a smartphone, smart router
the effectiveness of our mechanism. or a hub like the Samsung SmartThings at a smart-home.
II. A DVERSARY MODEL 2) Gatekeeper: Gatekeeper is a software running and de-
In this work, the system in consideration is deployed in ployed inside IoT gateway. It monitors all the packets from
typical BLE-based IoT network (such as a smart home, smart multiple protocol layers in BLE and sends the required and
city, industrial plant, forest fire monitory service, etc.) where compressed data to the cloud in a specific format after pre-
the BLE devices are connected to the outside world through processing. Gatekeeper also receives the authenticate decision
a common IoT gateway. The open and broadcast nature of from the cloud and blacklist or whitelist devices and grants
wireless communication enables an adversary to observe the network access permissions to devices.
data transfer of other devices in the connected network. The 3) Fingerprinting engine: Fingerprinting engine is the key
weak common security mechanism used in these gateways component in BF-IoT and deployed in the cloud. It analyzes
exposes the network to different malicious attacks [15], [16]. the received transmission fingerprints to determine the authen-
These devices may leak the common security credential such ticity of the source device. The decision process is based on the
as PIN code during connection establishment [17], [18]. We recorded fingerprints in the whitelist and blacklist databases.
assume that IoT devices may be benign or malicious when The ultimate decision is then delivered to the corresponding
they initially connect to the system. An adversary can attack IoT gateway to execute.
specific service at a precise point, or they can be corrupted
by malicious software to target common vulnerabilities in the 4) Whitelist and blacklist database: In BF-IoT, we create a
connected network devices. Some existing work can be found database to store the fingerprints of whitelisted and blacklisted
that demonstrates how to spoof a BLE device [19]–[21]. devices which are generated by the fingerprinting engine. In
Device spoofing can have serious implications for network our framework, whitelisted devices are the comparably small
security. Also, by getting control of one device, an adversary list of trusted and secured devices that a network frequently
can exploit the weak security requirements of the network connects. A device is enlisted as a blacklisted device when it
behind the firewall and attack other devices. The malicious does not show any fingerprint matching with the whitelisted
device may have intentions such as sniffing data or security devices. Note that, blacklisted devices are not known, and we
credentials from other devices, compromising other devices in build their fingerprints database online/runtime. We use this
the network by probing them with well-known vulnerabilities fingerprints database of blacklisted devices for avoiding later
or injecting false information into the system. A malicious spoofing attack by the known compromised devices and refrain
device can spoof the identity of another trusted device inside any connection with those devices.

255
 %ODFNOLVWDQGZKLWHOLVW devices that frequently attempt to establish the link with
)LQJHUSULQWHQJLQH
%
%),R76HUYLFH GDWDEDVH the IoT gateway in the future. The abnormal behavior
of blacklisted devices could be reported to the network
operator.
(4) Spoofing attacks: If a malicious device imitates the be-
haviors of trusted devices and attempts to connect to the
IoT gateway and makes malicious activities to the IoT
,R7*DWHZD\
networks, it has to bypass dual authentication procedures.
)LQJHUSULQWLQJEDVHG*DWH.HHSHU The extracted features set from multiple layer packets in
'HYLFHPRQLWRULQJ (QIRUFHPHQW BLE are unique and hard for an attacker to mimic all the
%/(SURWRFROVWDFN behaviors that the trusted devices perform before. If any
malicious behavior is detected, an appropriate alert is sent
to the IoT gateway and cloud. IoT gateway will prevent the
device from connecting the networks, and the connections
with the corresponding applications will be terminated off
3HULSKHUDOGHYLFHV
immediately. The device’s fingerprints will be recorded in
Fig. 1: BF-IoT system architecture the blacklist for future authentication.
C. System characteristics
B. System design
In summary, BF-IoT poses the following characteristics:
The architecture of BF-IoT is illustrated in Figure 1. The i) It guarantees the authenticity of a device in a two-phase
fingerprinting procedures are described as following: mechanism: before link establishment and during the
(1) Preliminary fingerprints generated: For each newly in- connection establishment.
stalled device, the BF-IoT trusts the device that has ii) It uses cross-layer traffic characteristics in BLE to en-
been granted access by the network operator. BF-IoT hance the accuracy of fingerprinting devices, and then
keeps sniffing the link layer and service layers packets detect insecure or compromised devices in the network.
and extracts the corresponding features to generate the iii) The authentication mechanism can be easily integrated
fingerprints for the trusted device. Then the device is into any existing IoT framework and allows vendors to
added to the whitelist and its fingerprints are also stored blacklist and whitelist devices from particular actions or
in the cloud. The fingerprints are subsequently leveraged network permissions.
to authenticate the device for the future connection. iv) The network-flow based approach can authenticate de-
(2) First phase authentication: BF-IoT provides two-phase vices in a fast and real-time manner with lower overhead.
procedure to enhance the authentication mechanism. The
IV. BLE DEVICE AUTHENTICATION
first phase is executed before link establishment. The Gate-
keeper at the gateway keeps monitoring the advertisement In this section, we study the BLE protocol stack and
packets from the link layer and obtains the first phase investigate the unique cross-layer features set in BLE. A
fingerprints of the device. Fingerprinting engine checks machine learning based classifier is used for fingerprinting and
the fingerprints with the whitelist database. If it finds a therefore authenticating the devices. The proposed approach
match with an entry in the whitelist, the Gatekeeper allows can distinguish between different devices (e.g., a smart bulb
the device to advance to the second phase for further and a Fitbit) and between same devices from two different
authentication. Otherwise, the Gatekeeper forestalls all manufacturers, but it is somewhat difficult to distinguish two
the connections with that device and adds the device’s devices of the same type from the same manufacturer.
fingerprints to the blacklist if it is not on the blacklist yet. Actually, the adversary model we are considering is that
(3) Second phase authentication: In the second phase, the attacker attempts to use the customized hardware to imitate
Gatekeeper attempts to establish a connection with the the behaviors of trusted devices and bypass the two-phase
peripheral device. It monitors all the service layer packets authenticate mechanism to gain trust from the IoT networks.
received during the procedure. Fingerprinting engine com- The proposed approach may not be able to detect the attacker
putes the service layer fingerprints and compares with the who purchases the same type of device from the same manu-
whitelist database for further authentication. If the finger- facturer and use exactly the same device hardware to execute
prints of the device match with an entry in the whitelist, spoofing attack. In our scenario, the attacker can learn and
the device is authenticated and allowed to establish a imitate the behavior of trusted devices. But it is challenging for
connection with the IoT gateway for data transmission. the attacker to guess and infer what the exact device hardware
Otherwise, the device is blocked and refrained from any it is among billions of IoT devices in the world. Our goal is to
further connection with IoT gateway. Meanwhile, the de- find the unique fingerprinting features that are hard to mimic
vice is added to the blacklist. The fingerprints of devices in for the attacker, which is more practical in the real world. In
the blacklist are utilized for identifying the untrustworthy the future, we will incorporate the application layer data into

256
 $'9B,1' $'9B,1' $'9B,1' $'9B,1' $'9B,1' $'9B,1' required to transmit data in different frequency based on their
hardware and functionalities characteristics. Small advertising
$GYBLG[  $GYBLG[  $GYBLG[  $GYBLG[  $GYBLG[  $GYBLG[ 
event interval means the central device can fast discover them
DGY,QWHUYDO 'HOD\
HOD\
DGY'HOD\ DGY,QWHUYDO DGY'HOD\ once the data transmission is requested. Some devices that
$GYHUWLVLQJ
$GYHUWLVLQJ synchronize data with central device few times a day may need
$GYHUWLVLQJ HYHQWFORVHG
HYHQWVWDUWHG
HYHQWFORVHG
$GYHUWLVLQJ
HYHQWVWDUWHG
relatively large advertising event interval so as to save energy.
2) Advertising channel sequence: Advertising PDUs are sent
Fig. 2: Advertising event with only advertising PDUs via three advertising channels within each advertising event.
There are total six possible combinations of channel sequence:
our framework to distinguish two devices of the same type (37, 38, 39), (37, 39, 38), etc. IoT devices select one of the
from the same manufacturer. combinations to transmit advertising packets in round-robin
A. BLE overview fashion which decreases the probability of packet transmission
collision from multiple devices in the meantime. 3) Advertising
BLE is a wireless technology specially designed for low
delay distribution: In the typical IoT environment, there are
power devices that operate in the 2.4GHz ISM band [5]. In
many IoT devices that periodically send advertising packets
this band, BLE has 40 channels, where each channel is 2
in the meantime. In order to minimize the possibilities of
MHz wide, and they are numbered from 0 to 39. BLE uses
transmission collision in the same channel, the advertising
3 channels (37, 38 and 39) for advertisement, where BLE
events are perturbed in time using the adv Delay. The random
peripheral devices transmit advertisement packets to announce
adv Delay can be generated by using different probability
their presence and establish connections with the central
distributions that IoT devices select.
devices. The rest of the channels are used for data transmission
The adverting event interval, channel sequence, and random
between peripheral and central devices. Note that, BLE uses
delay distribution constitute the unique advertising pattern
frequency hopping mechanism to transmit data packets at
for different IoT devices. Such pattern can be utilized as
different channels by using a pseudo-random sequence that
the fingerprints of the first phase device authentication. The
is known to both peripheral and central devices. BLE is a
first phase authentication is not a one-off but a continuous
connection-oriented peer-to-peer communication technology
procedure. BF-IoT keeps monitoring the link layer packets of
where peripheral and central devices communicate in a peer-
ambient devices and compares their advertising patterns with
to-peer fashion. BLE protocol stack is designed to support such
the fingerprints recorded in the database. If the device passes
peer-to-peer communication. In the following subsections, we
the preliminary first phase authentication, it is allowed to enter
present transmission feature extraction from multiple layers in
into the second phase authentication procedures in order to
BLE protocol stack.
establish a trusted data transmission link with central device.
B. Link layer feature
C. ATT/GATT layer feature
Peripheral devices may stay in sleep mode in the most time
so as to save energy. But they must periodically broadcast In BLE protocol stack, the ATT layer allows a device to
advertisement packets for being able to discover once data expose certain pieces of data or attributes to another peer
transmission is required. IoT devices send the advertising device or central device. In typical IoT networks, peripheral
packets with distinct patterns. Upon discovering a peripheral devices usually sense data and send to the central device to
device, a central device decides whether to initiate a connec- provide associated services and functionalities. The state or
tion for data transmission. data is exposed as one or more values called attributes. All
The advertisement event is the smallest unit that is used for attributes have handles, which are used to address an individual
transmitting advertising packets. In Figure 2, three PDUs are attribute. The attributes also have a type described by a
sent on three advertising channels within one advertisement universally unique identifier (UUID). The UUID determines
event. The advertising event could be terminated after the what the attribute value means. The length of attributes varies
last advertising PDU is sent or the advertiser may close an from 0 to 512 bytes.
event earlier to accommodate other functionality. The time The ATT layer protocol manages discovering, reading, and
(T advEvent) between the start of two consecutive advertising writing attributes on a peer device. The ATT defines the
events is computed as follows for each advertising event: communication protocol between two devices playing the roles
of server and client respectively on top of a dedicated L2CAP
T advEvent = adv Interval + adv Delay channel. The server, usually a peripheral device, maintains the
The adv Interval is an integer multiple of 0.625 ms in the data as one or more attributes and exposes them to a client.
range of 20 ms to 10.24 s. The adv Delay is a pseudo-random The client, usually a central device, fetches the attributes using
value with a range of 0 ms to 10 ms generated by the link the handle from one or more servers. The client can access the
layer for each advertising event. server’s attributes by sending requests, which trigger response
Feature extraction: The advertising patterns from IoT de- messages from the server.
vices are distinct and accommodate to hardware and software- The GATT defines a framework that uses the ATT for
based characteristics. 1) Advertising event interval: devices are the discovery of services, and the exchange of characteristics

257
 the unique pattern for response time sequence which could be
TABLE I: Attribute Protocol PDUs
utilized to fingerprint the devices.
Function Attribute During link establishment, some peripheral devices peri-
Related Operation
Category Opcode
Find Information: Find Information Request/Response 0x04/0x05 odically send packets back to central devices in a proactive
Find By Type Value Request/Response 0x06/0x07 way without the request of central devices. According to the
Read Attributes: Read By Type Request/Response 0x08/0x09
Read Request/Response 0x0A/0x0B BLE specification, a peripheral device can send two types
Read Multiple Request/Response 0x0E/0x0F of unsolicited messages that contain attributes: notifications,
Read by Group Type Request/Response 0x10/0x11
Write Attributes: Write Request/Response 0x12/0x13
which are unconfirmed; and indications, which require the
Write command 0x52 client to send a confirmation. The unsolicited packets sequence
Server Initiated: Handle Value Notification
Handle Value Indication/Confirmation
0x1B
0x1D/0x13
can be denoted as (Pψ1 , Pψ2 , ..., Pψi ). Some peripheral devices
Error Handling: Error Response 0x01 may send one unsolicited packet at every interval. The interval
of sending such packets also differs with devices. Other
peripheral devices may periodically send consecutive packets
between peripheral and central devices. A characteristic is a set
in a burst way. These characteristics also constitute the unique
of data which includes a value and properties. Characteristics
pattern of unsolicited packets sequence which can also be used
are used to expose and exchange data between paired devices.
for fingerprinting devices.
Control information can also be formatted as a characteristic
passing from central device to peripheral device. D. Classifier for device fingerprinting
IoT devices may provide different services based on their After exploring the features, we design a machine learning
functionalities. During link establishment, the central device based model to implement our fingerprinting mechanism. We
sends requests to probe the services list of device. We use use {f1 , f2 , .., fn } to denote the features we extract from
{S1 (C1 , ..., Ci ), S2 (C1 , ..., Cj ), ..., Sm (C1 , ..., Ck )} to denote BLE-based IoT devices. {E1 , E2 , ..., Em } represents a set of
the services list with corresponding characteristics. For in- authorized IoT devices in the whitelist database. We have two
stance, a smart watch can provide multiple services, such as data sets: training data set Dtrain : {d1 , d2 , ..., dp } and test
temperature service and time service. data set Dtest : {d1 , d2 , ..., dq }. Each date subset di or di is
Feature extraction: After investigating the ATT/GATT layer generated only by one device that contains all the n features.
protocol, we determine the unique features set for the fin- In training data set Dtrain , we know that each data subset is
gerprinting. During connection establishment, the peripheral generated from which device. Our machine learning task is to
device has to communicate with the central device to ex- map any data subset di in Dtest to a specific device Ej that
change the device state and link parameters. The transmitted most probably generates it. We treat this as a classic multi-
ATT/GATT packets also contain distinctive attributes and class classification problem in machine learning.
services list depending on the functionalities of peripheral We use Random Forest [22], [23] supervised machine learn-
devices. Assume the exchanged packets sequence Υ is de- ing algorithm for model training. Random Forest is a classical
noted by {Pμ1 , Pν2 , Pμ3 , Pν4 , ..., Pμi , Pνi+1 }, where Pμ denotes classification algorithm that combines decision tree induction
the packet sent by the central device and Pν represents the with ensemble learning. We use the dataset Dtrain to train
packet sent by the peripheral device. Pμ and Pν can be a a classifier C, which can capture the characteristics of every
request packet or response packet, and both of them are exactly authorized device type. Then we use the classifier C to classify
timestamped. Table I provides the PDU type pairs used in the new unlabeled data in Dtest . Classifier C can output a
ATT/GATT layer protocol. Our goal is to extract the features vector of posterior probabilities Pdi = {pE1 , pE2 , ..., pEm }.
that are related to peripheral devices and can be used for Each probability pEi denotes the likelihood that the data is
fingerprinting. produced by device Ei . If there exits any pEi is larger than
Due to the differences in hardware, driver, and application the predefined classification threshold θ, then we think the data
software, the transmitted packets sequences for link establish- is produced from authorized device Ei . Otherwise, the data set
ment are different among IoT devices. The packet size, packet is considered as an ‘unknown’ device, which may be added
type, total packets transmitted, number of packets transmitted to the blacklist. The classifier C can be continuously applied
for different type of function, burst rate, burst time point, to new unlabeled data for device fingerprinting.
etc. in exchanged packets sequence Υ pose unique session- E. Two-phase device authentication
level pattern for different IoT devices. Moreover, we filter the
packets that is requested by peripheral device and responded In the first-phase, BF-IoT continuously monitors the sniffed
by central device and build the response time sequence packets sequence in the environment and computes their
1
{Rt1 2
, Rt1 3
, Rt2 4
, Rt2 , ..., Rtij , Rti+1 }, where Rtij represents the advertising patterns {P T1 , ..., P Ti } for devices {D1 , ..., Di }
j
response time of i packet pair (Pμ , Pν ) requested by central
th respectively in the whitelist. By matching the patterns that
device and responded by peripheral device, and tj represent are stored in the database, BF-IoT can detect if the device
one of the request/response type pair in Table I. The response is deviating from the right path, and then can determine if
time varies with request type, device processing power, and the device is in a healthy state or is being compromised.
other device-specific characteristics. Therefore, IoT device has Assume the adversary sniffs the advertising packets sequence

258
from device Di and learns the advertising pattern. Then the
,R7*DWHZD\
adversary forges the same MAC address of the device and &HQWUDO'HYLFH
attempts to bypass the first-phase authentication via mimicking
the device’s behavior and sending the advertising packets using
the same pattern. Actually, it is arduous for the adversary
to exactly mimic the advertising pattern even if it learns the
pattern. Usually, the device has its own clock drift pattern due
to the hardware difference of crystal oscillator. Even for the
identical devices from the same manufacturer, there is still a 8EHUWRRWK6QLIIHU
subtle change in the manufacturing procedure. Therefore, the
Fig. 3: BF-IoT system platform
adversary may unwittingly stray from the primitive advertising
pattern. On the other hand, BF-IoT monitors the devices’ state
that consists of a Raspberry Pi 3 and two Ubertooths [24].
in a real-time way, if two devices almost behave the same
Raspberry Pi 3 is built on the latest Broadcom 2837 ARMv8
way, BF-IoT can effectively detect them and stop the attacks.
64 bit processor. Raspberry Pi 3 supports more powerful
Furthermore, the first-phase is pre-connection authentication.
external USB devices and comes with built-in WiFi and BLE
As an auxiliary authentication of the second-phase, it makes
connectivity. Ubertooth is an open source wireless platform
no difference if the adversary ultimately bypasses the first-
suitable for BLE development. Ubertooth is equipped with
phase authentication. Then the adversary has to think how to
CC2400, a single-chip 2.4 GHz RF transceiver. Ubertooth has
pass the second-phase authentication.
a capable BLE sniffer and can sniff data traffic from multiple
The adversary cannot do any malicious activities although it
layers in BLE.
passes the first-phase authentication. It has to continue to pass
The Raspberry Pi 3 works as an IoT gateway that communi-
the second-phase thereby establishing a real link with a central
cates with the cloud and peripheral devices. Two Ubertooths
device. We cannot prevent the adversary from sniffing the
are connected to the gateway via USB, which is displayed
ATT/GATT service layer packets, and the adversary can also
in Figure 3. The processor (LPC175x) in Ubertooth decodes
learn the pattern that how the trusted peripheral communicates
the raw data received from the CC2400 RF transceiver and
with the central device. Here the communication scheme is
sends to the queue in USB buffer. Then Raspberry Pi 3 reads
not a secret. But even if the adversary knows the secret, it is
packets from the queue in the USB buffer. In order to exactly
hard to imitate the time series based packets sequence. For
capture the time that Ubertooth receives packets, we modify
the read/write requests, the peripheral devices have different
the Ubertooth firmware code [25] to time-stamp the packet
response time pattern due to both the hardware and driver
with 100 ns resolution once the preamble of the packet is
based characteristics. The request handle way and process
detected.
power are diverse among different devices, which constitutes
We implement the functionalities of IoT gateway in the
the unique pattern of time-stamped packets sequence. The
Raspberry Pi 3. The IoT gateway collects the data from
adversary has to figure out the detailed hardware and driver
peripheral devices and extracts and compresses the required
information and also exactly clone the way that requests are
data and delivers them to the cloud. IoT gateway also works
processed if it wants to generate the same fingerprints. But it
as the Gatekeeper to control the network access permission
is challenging in the real world.
of the devices. The IoT gateway is connected with a variety
The only way that can bypass the second-phase authentica-
of commercial IoT devices. The devices are comprised of
tion is that the adversary exactly uses the same device from
different types of devices, such as smart bulb, smart watch,
the same manufacturer, which could generate the same pattern.
heart rate monitor, etc, and also the same type of devices from
Then the adversary transmits the identical packet sequence
different manufacturers, such as smart bulbs from Avea and
following the same time series but injects the malicious content
iLink companies. We usually have two for each device type.
inside the packet. However, there are millions of IoT devices
This diversity of devices can help us thoroughly examine the
deployed in the world. By sniffing the packets, the adversary
performance of our fingerprinting mechanism.
cannot exactly infer the device information and purchase the
same device in the market. Therefore, we do not seek to B. Performance analysis of cross-layers features
identify two devices from the same type and manufacturer 1) Link layer: We use Ubertooth to capture BLE advertising
in this paper. Ultimately, if the device passes the two-phase packets in the link layer. The Ubertooth is responsible for
authentication, it is allowed to establish a trusted link with capturing BLE advertising packets from the link layer. The
central device and begins to transmit the real data. Otherwise, Ubertooth sniffs the advertising packets on channel 37, 38
it will be prevented from connection and added to the blacklist. and 39. The link layer packets are sniffed for the ambient
V. E VALUATION IoT devices and used to constitute their advertising patterns.
An advertising event can be one of the following types:
A. System implementation connectable undirected event, connectable directed event, non-
In order to validate the effectiveness of our secure IoT connectable undirected event and scannable undirected event.
communication framework, we build a customized system For each device, we run our system for five days and collect

259
 5 60 4

Throughput (pkts/100ms)
Throughput (pkts/100ms)

Throughput (pkts/100ms)
4 50
3
40
3
30 2
2
20
1
1 10

0 0 0
0 20 40 60 80 100 120 0 20 40 60 80 100 120 0 20 40 60 80 100 120 140
Time (s) Time (s) Time (s)
(a) Heart Rate Monitor (b) Fitbit Alta (c) Smart bulb Avea
Fig. 4: Traffic pattern for duplicated session establishments.

Average throughput(pkts/s)
400 100 200

Burst rate(pkts/s)
80
No. of packets

300 150

60
200 100
40

100 50
20

0 0 0
nk ea lta lug tch r r
nk ea ry lta ug ch nitor ter nk ea ry lta ug ch nitor ter iLi Av ory ito mete
iLi lb Av htSto bit A art Pl t Wat me iLi lb Av htSto bit A art Pl t Wat me tSt tbit A art P t Wa Mon o
lb Mo rmo lb Mo rmo ulb Bulb Ligh Fi Sm Smar Rate erm
Bu rt Bu b Lig Fit Sm Smar Rate e Bu Bu Lig Fit Sm Smar Rate e art
B
art Th
art a ul Th art mart Bulb Th ulb kia art
S m S m B k i a a r t
S m S k i a a r t Sm Sm art B o e
art No He art No He Sm
N H
Sm Sm
IoT devices name IoT devices name IoT devices name

(a) No. of packets sent (b) Average throughput (c) Burst rate
Fig. 5: Features from the packets sequence of session establishments in ATT/GATT layers.

TABLE II: Advertisement interval for different devices the ATT/GATT service layer, we have to precisely collect
Advertising event all the transmitted data packets type and exactly record their
Device name Standard deviation
interval (s) timestamps. Applications are written and installed in the IoT
Fitbit Alta 1: 1.29002800418 0.00104526798899
Fitbit Alta 2: 1.28996685678 0.00103673292851
gateway to communicate with the targeted BLE devices. We
Smart bulb Avea: 0.104050761475 0.00218257087699 principally collect the session-level network traffic from link
Smart bulb iLink: 0.0814239081008 2.55710826474e-05 establishment stage to authenticate the IoT devices in the
Smart bulb LightStory: 0.497569043441 6.36738129605e-05
Smart plug 1: 0.103930876001 0.00217028685053
second phase. The reason is that all types of IoT devices may
Smart plug 2: 0.104025252545 0.00215880616127 have different functionalities but must have the same session
Garmin: 1.28997122261 0.00294536429203 establishment activity. For instance, smart bulbs usually have
Ambient device 1: 0.183192135081 5.53702230595e-06
Ambient device 2: 0.0315230156198 0.00289863032782
the on-off action that we can operate, but smartwatches do not
have such function. We seek to adopt the common activities
a large number of experimental data about advertising pack- across all IoT devices to extract the featured data to do fin-
ets. By observing the advertising packets, most IoT devices gerprinting. For each peripheral device, the central device(IoT
adopt connectable undirected advertising event type, and they gateway) establishes a connection with it via the corresponding
transmit advertising packets ADV IND PDU. installed the application, waits for approximately 20s and does
Table II exhibits the measured advertising event interval not do any additional action, and disconnects the connection
from different devices. According to the table, we can distin- with the peripheral device. We repeat this process 50 times
guish different types of devices via observing the adverting and collect all the packets transmitted. After collecting the
interval, such as sports bracelet (Fitbit Alta and Garmin) data for all IoT devices, we use the extracted featured data
with smart bulb (Avea, iLink, and Lighstory). Concerning the and implement and validate our fingerprinting mechanism.
same type of devices, it is still able to show the recognizable Figure 4 exposes the traffic patterns of Heart Rate Monitor,
difference, which can be observed for three smart bulbs from Fitbit Alta, and Smart Bulb Avea which are extracted from
different manufacturers Avea, iLink, and LightStory. Even for the exchanged packets sequence. As shown in the figure, the
the two devices of the same model, there is still a subtle traffic patterns are obviously distinct from each other. The
difference that we can leverage to distinguish them, which number of packets sent, average throughput and burst rate
is exposed from two Fitbit Altas and Smart Plugs. Therefore, in Figure 5 demonstrate that different devices have unique
the feature in the advertising pattern can be regarded as part transmitted packet sequence, which can be proved as a good
of fingerprints for the first phase authentication. feature of fingerprinting. After analyzing the response time
2) ATT/GATT layer: Based on the features extracted from sequence of requests, we find that the IoT devices have the

260
 0.05 0.04
0.25

Response time (s)

Response time (s)

Response time (s)

0.2 0.04
0.03
0.15 0.03
0.1 0.02
0.02
0.05
0.01
0.01
0
0 0
a a y k r g h r a a y k r g h r a a y k r g h r
Alt Ave tStor iLin onito t Plu atc mete Alt Ave tStor iLin onito t Plu atc mete Alt Ave tStor iLin onito t Plu atc mete
bit b lb r W o bit b lb r W o bit b lb r W o
Fit t Bul Ligh t Bu ate M Sma mart erm Fit t Bul Ligh t Bu ate M Sma mart erm Fit t Bul Ligh t Bu ate M Sma mart erm
a r u lb mar rt R S T h a r u lb mar rt R S T h a r u lb mar rt R S T h
Sm art B S a kia Sm art B S a kia Sm art B S a kia
He No He No He No
Sm Sm Sm

0.2 1
Response time (s)

Response time (s)

0.8
0.15
0.6
0.1
0.4
0.05
0.2

0 0
a
Alt Ave tStor
a y nk nitor Plug eter Alt
a a k r g
ve tory Lin nito Plu atc
h
ete
r
bit iLi bit ulb A ightS ulb i Mo art rt W mom
Fit t Bul
b h lb Mo mart rmom i t
Lig rt Bu ate S e F tB L rt B ate Sm ma her
a r u l b a tR Th a r u l b a tR S T
Sm art B Sm ear Sm art B Sm ear kia
H H No
Sm Sm

Fig. 6: Distribution of response time for read and write operations: (a) Read by group type request (Opcode: 0x10), (b) Read
by type request (Opcode: 0x08), (c) Find information request (Opcode: 0x04), (d) Read request (Opcode: 0x0A), (e) Write
request (Opcode: 0x12).

Empirical CDF
1 Empirical CDF
1 6
Cumulative Distribution Function

Fitbit Alta 1
Cumulative Distribution Function

Smart Bulb Avea

0.8 0.8 Fitbit Alta 5
Smart Bulb LightStory
Smart Bulb Avea 0.8
Smart Bulb iLink

Success rate
Smart Bulb LightStory 4
Heart Rate Monitor
Time (s)

0.6 Smart Bulb iLink

Smart Plug 0.6
Nokia Smart Watch
Heart Rate Monitor 0.6
Smart Plug 3
Thermometer
Nokia Smart Watch
0.4 0.4 Thermometer 2 0.4

1 0.2
0.2 0.2
0 0
a a y k r g h r a a y k r g h r
0 0 Alt AvetStor iLin onito t Plu atc mete Alt AvetStor iLin onito t Plu atc mete
0 0.05 0.1 0.15 0.2 0.25 0.3 0 0.05 0.1 0.15 0.2 0.25 0.3 bit lb r W o bit lb r W o
Response Time (s) Response Time (s) Fit t Bulb Light Bu ate MSmamart erm Fit t Bulb Light Bu ate MSmamart erm
m ar Bulb mar rt R ia
S Th
m ar Bulb mar rt R ia
S Th
S art S ea k S art S ea k
H No H No
(a) CDF of response time for (b) CDF of response time for Sm Sm
(a) (b)
overall read requests. overall write requests.
Fig. 8: (a) Time cost for the second phase authentication. (b)
Fig. 7: Response time pattern for read and write requests. Success rate of device fingerprinting.
diverse response time of requests due to the different request added 80% of the devices and their corresponding fingerprints
handle way and device processing power, which is manifested to the whitelist and added the rest of 20% devices and
in Figure 6. Even for the same type of requests from the their fingerprints to the blacklist. Whereafter, we deployed
same device, the response time is also showed to be different the IoT devices to the environment and let them attempt to
due to the varying content of response request. Compared to establish data links with the IoT gateway. The IoT gateway
read requests, the response time of write requests can better sniffed the cross-layer traffic in a real-time way and tried
reflect the device characteristics. Figure 7 shows that CDF of to authenticate the devices. Figure 8(b) shows the accuracy
response time for overall read and write requests. The obvious that we successfully authenticated the devices in the whitelist
different distributions of request response time can be observed and blocked the devices in the blacklist. BF-IoT can achieve
in the figure, which can constitute the unique response time approximately 100% fingerprinting accuracy for all current
sequence of requests used for the fingerprinting of devices. IoT devices, which demonstrates the efficiency of our finger-
C. Fingerprinting performance printing mechanism. Figure 8(a) shows the time cost of our
Conclusively, we combine all the mentioned features in authentication mechanism, which is mostly controlled within
the link and ATT/GATT service layers and use the machine 6 seconds. Furthermore, our authentication is a real network-
learning model proposed in Section IV-D to fingerprint the flow based mechanism which does not request additional cost.
IoT devices we have. The BF-IoT system was running for VI. R ELATED W ORKS
several days and collected enough data to train the model and The security issues are major challenges in IoT networks
generated the fingerprints for the trusted devices. Then we due to its massive deployment. The IoT networks are much

261
vulnerable to spoofing attacks. A malicious device can forge VIII. ACKNOWLEDGEMENT
the MAC or other network identities of a trusted device to This research was supported in part by the Army Research
either compromise IoT device or injects false or tampered Office (ARO) through the grant W911NF-16-1-0224.
information into the network. So the technique to identify IoT
devices based on network identifiers such as MAC address R EFERENCES
is impractical. Some researchers investigated the transmission [1] “IDC Forecasts Worldwide Spending on the Internet of Things to Reach
characteristics as a unique identification for wireless devices. $772 Billion in 2018.” https://www.idc.com/getdoc.jsp?containerId=
prUS43295217, Dec 7, 2017.
Radio frequency identification (RFID) is one of the earliest use [2] “Gartner Says a Typical Family Home Could Contain More Than
cases of using wireless transmission characteristics to finger- 500 Smart Devices by 2022.” https://www.gartner.com/newsroom/id/
print devices. [26] exploits the fact that an RFID tag presents a 2839717, Sep 8, 2014.
[3] R. H. Weber, “Internet of things–new security and privacy challenges,”
unique frequency response for different frequencies. Physical Computer law & security review, vol. 26, no. 1, pp. 23–30, 2010.
properties of these tags can be used to do fingerprinting [4] E. Fernandes, A. Rahmati, J. Jung, and A. Prakash, “Security impli-
with minimum power response. But it requires sophisticated cations of permission models in smart-home application frameworks,”
IEEE Security & Privacy, vol. 15, no. 2, pp. 24–30, 2017.
hardware and massive digital signal processing which can not [5] “IEEE Standard for Information technology– Local and metropolitan
be done by commodity devices. [10] uses the link layer data area networks– Specific requirements– Part 15.4: Wireless Medium
transmission characteristic to fingerprint for WiFi devices. This Access Control (MAC) and Physical Layer (PHY) Specifications for
Low Rate Wireless Personal Area Networks (WPANs),” tech. rep., 2006.
approach statistically analyzes the usual packet transmission [6] “Bluetooth technology.” http://www.bluetooth.com.
characteristics of different devices. But these WiFi-related [7] C. Gomez, J. Oller, and J. Paradells, “Overview and evaluation of
approaches do not target on BLE transmission characteristics bluetooth low energy: An emerging low-power wireless technology,”
Sensors, vol. 12, no. 9, pp. 11734–11753, 2012.
and may not be applicable for BLE device fingerprinting. [8] S. Raza, A. Slabbert, T. Voigt, and K. Landernäs, “Security consider-
Hardware-based fingerprinting mechanisms is also investi- ations for the WirelessHART protocol,” in Emerging Technologies &
gated in IoT networks. Physical unclonable function [27] can Factory Automation ( ETFA), pp. 1–8, IEEE, 2009.
[9] M. Ryan, “Bluetooth: With low energy comes low security,” in USENIX
be used to uniquely identify a device. The time skew induced Workshop on Offensive Technologies, 2013.
by chip characteristics is another approach to identify different [10] J. Franklin, D. McCoy, P. Tabriz, V. Neagoe, J. V. Randwyk, and
types of devices. BlueID [28] uses internal clock skew to D. Sicker, “Passive Data Link Layer 802.11 Wireless Device Driver
Fingerprinting,” in USENIX Security Symposium, pp. 16–89, 2006.
classify devices Since the internal clock of each device is [11] J. Cache, “Fingerprinting 802.11 implementations via statistical analysis
hard to forge, devices can not spoof this identity. Actually, of the duration field,” Uninformed. org, vol. 5, 2006.
these approaches mostly cost massive time to fingerprint the [12] T. Kohno, A. Broido, and K. C. Claffy, “Remote physical device
fingerprinting,” IEEE Tran. on Dependable and Secure Computing,
devices. This constraint prevents these techniques to be used in vol. 2, no. 2, pp. 93–108, 2005.
cases where fingerprinting is needed in a timely manner such [13] V. Brik, S. Banerjee, M. Gruteser, and S. Oh, “Wireless device identi-
as authenticating with a new device. In our work, we aim fication with radiometric signatures,” in ACM MOBICOM, 2008.
[14] S. V. Radhakrishnan, A. S. Uluagac, and R. Beyah, “GTID: A technique
at using cross-layer feature based fingerprinting scheme that for physical device and device type fingerprinting,” IEEE Tran. on
attains higher accuracy while requiring significantly smaller Dependable and Secure Computing, vol. 12, no. 5, pp. 519–532, 2015.
dataset obtained in a relatively small amount of time. [15] N. Borisov, I. Goldberg, and D. Wagner, “Intercepting mobile commu-
nications: the insecurity of 802.11,” in ACM MobiCom, 2001.
[16] S. Xiao, W. Gong, and D. Towsley, “Secure wireless communication
VII. C ONCLUSION with dynamic secrets,” in IEEE INFOCOM, 2010.
[17] J. Zhang, Z. Wang, Z. Yang, and Q. Zhang, “Proximity based IoT device
authentication,” in IEEE INFOCOM, 2017.
This paper proposes BF-IoT, a novel defense framework [18] E. Ronen and A. Shamir, “Extended functionality attacks on iot devices:
against spoofing attacks in IoT networks. Unlike the conven- The case of smart lights,” in Security and Privacy (EuroS&P), 2016
tional device ID based security framework, BF-IoT augments IEEE European Symposium on, pp. 3–12, IEEE, 2016.
[19] “How to Hack Bluetooth .” https://null-byte.wonderhowto.com/how-to/
the authentication and device identification using unclonable hacks-mr-robot-hack-bluetooth-0163586/.
transmission characteristics. It identifies IoT devices using [20] “Spoofing a Bluetooth device.” https://haxf4rall.com/2016/05/11/
their observable cross-layer transmission characteristics. The spoofing-a-bluetooth-device/.
[21] J. Dunning, “Breaking Bluetooth By Being Bored,” in DefCon, 2010.
devices are screened in a twofold manner when connecting a [22] A. Liaw, M. Wiener, et al., “Classification and regression by random-
secured application. Before establishing a connection, BF-IoT Forest,” R news, vol. 2, no. 3, pp. 18–22, 2002.
observes link layer transmission signatures and checks them [23] Y. Meidan, M. Bohadana, A. Shabtai, J. D. Guarnizo, M. Ochoa, N. O.
Tippenhauer, and Y. Elovici, “ProfilIoT: a machine learning approach
with a global blacklist database for possible spoofing attacks. for IoT device identification based on network traffic analysis,” in ACM
During data connection, BF-IoT monitors service layer data Symposium on Applied Computing, 2017.
transmissions to find anomalies and intrusive behaviors. To [24] “Ubertooth.” http://ubertooth.sourceforge.net/.
[25] “Ubertooth source code.” https://github.com/greatscottgadgets/ubertooth.
evaluate the performance, we gathered data from some BLE [26] S. C. G. Periaswamy, D. R. Thompson, and J. Di, “Fingerprinting RFID
based IoT devices in multiple network layers and trained the tags,” IEEE Transactions on Dependable and Secure Computing, vol. 8,
multi-class classifier. The experiments show that BF-IoT is no. 6, pp. 938–943, 2011.
[27] S.-Y. Park, S. Lim, D. Jeong, J. Lee, J.-S. Yang, and H. Lee, “Pufsec:
able to fingerprint each device uniquely and detect identity Device fingerprint-based security architecture for internet of things,” in
spoofing. In the future, we plan to extend our framework to INFOCOM, pp. 1–9, IEEE, 2017.
fingerprint devices in any of 6LoWPAN standards such as [28] J. Huang, W. Albazrqaoe, and G. Xing, “BlueId: A practical system for
bluetooth device identification,” in IEEE INFOCOM, 2014.
ZigBee, WiFi, and conventional Bluetooth.

262