Not sure if this is at all the right place for this question. But I have been puzzled the past couple days about bluetooth low energy security.

My situation:

I am looking at what it might take to secure unpaired BLE connections.

In some cases, and essentially this main use case, a mobile device (Android) may want to connect to several different peripherals randomly at different times throughout the day. By 'randomly' I mean I am walking by one if I have a dozen scattered around my apartment and I personally don't know exactly which one without physically checking.

The process of physically accepting a pair request seems unnecessary and quite time consuming. I don't what to walk in the room the first time and have to manually pair each device, that would be insane if I had 100+ devices. Note that these devices don't necessarily have to be connected at the same time, but could. Also note that I understand this isn't generally the main use case of the typical peripheral to mobile communication considering the max connected devices at one time is 7.

These peripheral devices have no I/O thus the Numeric Comparison, Passkey Entry, and Out of Band connection methods don't seem to be the ones that I'm looking for. It seems that Just Works should work, however there doesn't seem to be security support for it. Anyone with a sniffer would be able to read all communication.

It seems I may be asking too much of Bluetooth LE and will have to figure out another means--maybe in the application layer?

I am by no means a security expert so go easy :-)

Thoughts?

Thanks

I have been puzzled the past couple days about bluetooth low energy security.

My situation:

I am looking at what it might take to secure unpaired BLE connections.

In some cases, and essentially this main use case, a mobile device (Android) may want to connect to several different peripherals randomly at different times throughout the day. By 'randomly' I mean I am walking by one if I have a dozen scattered around my apartment and I personally don't know exactly which one without physically checking.

The process of physically accepting a pair request seems unnecessary and quite time consuming. I don't what to walk in the room the first time and have to manually pair each device, that would be insane if I had 100+ devices. Note that these devices don't necessarily have to be connected at the same time, but could. Also note that I understand this isn't generally the main use case of the typical peripheral to mobile communication considering the max connected devices at one time is 7.

These peripheral devices have no I/O thus the Numeric Comparison, Passkey Entry, and Out of Band connection methods don't seem to be the ones that I'm looking for. It seems that Just Works should work, however there doesn't seem to be security support for it. Anyone with a sniffer would be able to read all communication.

It seems I may be asking too much of Bluetooth LE and will have to figure out another means--maybe in the application layer?