On the Performance and Security of Bluetooth Channel Sounding

초록

Bluetooth Channel Sounding (CS), introduced in Bluetooth 6.0, enables sub-meter distance estimation by combining phase-based ranging (PBR) and round-trip time (RTT) measurements. This paper presents a comparative evaluation of four commercial CS platforms across six dimensions: antenna orientation, distance, environment, CS mode, configuration parameters, and mobility. In addition, we propose an enhanced Early Detect/Late Commit (ED/LC) attack that bypasses the Normalized Attack Detector Metric (NADM) defined in the specification by maintaining zero phase deviation during the detection-latency window. Experimental results show that NADM detects a baseline attacker with an Equal Error Rate (EER) below 11%, but its EER rises to 43-49% against the proposed attack, indicating detection performance close to random guessing. Our results show that BLE CS deployments require not only deployment-aware device selection but also stronger security mechanisms.

키워드