android蓝牙不安全的RFCOMM连接是如何工作的

时间:2022-02-12 18:55:02

My understanding (which may very well be wrong) of Bluetooth is that in order to communicate, two Bluetooth devices must be part of a piconet. To create a piconet the two devices perform pairing and choose a common radio channel to communicate on.

我对蓝牙的理解(可能非常错误)是,为了进行通信,两个蓝牙设备必须是微微网的一部分。为了创建微微网,两个设备执行配对并选择公共无线电信道进行通信。

Android provides a way for two devices to communicate by using an insecure RFCOMM connection which does not require pairing.

Android为两台设备提供了一种使用不安全的RFCOMM连接进行通信的方法,该连接不需要配对。

Given that no common channel is agreed upon by the two devices, how are they able to exchange packets?

鉴于这两个设备没有商定共同的信道,它们如何能够交换数据包?

2 个解决方案

#1


0  

To quote the official Android BT specs:

引用官方Android BT规格:

Remember there is a difference between being paired and being connected. To be paired means that two devices are aware of each other's existence, have a shared link-key that can be used for authentication, and are capable of establishing an encrypted connection with each other. To be connected means that the devices currently share an RFCOMM channel and are able to transmit data with each other. The current Android Bluetooth API's require devices to be paired before an RFCOMM connection can be established. (Pairing is automatically performed when you initiate an encrypted connection with the Bluetooth APIs.)

请记住,配对和连接之间存在差异。配对意味着两个设备知道彼此的存在,具有可用于认证的共享链接密钥,并且能够彼此建立加密连接。要连接意味着设备当前共享RFCOMM信道并且能够彼此传输数据。当前的Android蓝牙API需要在建立RFCOMM连接之前配对设备。 (当您使用蓝牙API启动加密连接时,将自动执行配对。)

For RFCOMM under the hood, you should look in to the specifications of RFCOMM

对于引擎盖下的RFCOMM,您应该查看RFCOMM的规格

#2


0  

The practical answer of Android insecure versus secure connections, is that the pairing (which is mandatory for Bluetooth v2.1 +) can be "unauthenticated" versus "authenticated". Basically, automatic pairing procedures create "unauthenticated" pairings, while user interactive pairing procedures create "authenticated" pairings. The Bluetooth connection is exactly the same for either. This is just a simple flag reflecting the type of pairing that occurred. Usually embedded devices, without keypads or displays, will have to use the "Just Works" automatic pairing method, and will generate an "unauthenticated" pairing.

Android不安全与安全连接的实际答案是,配对(蓝牙v2.1 +必须配对)可以是“未经身份验证”而非“经过身份验证”。基本上,自动配对过程创建“未经认证”的配对,而用户交互配对过程创建“认证”配对。两者的蓝牙连接完全相同。这只是一个简单的标志,反映了发生的配对类型。通常,没有键盘或显示器的嵌入式设备将必须使用“Just Works”自动配对方法,并将生成“未经身份验证”的配对。

Since Bluetooth v2.1, all connections must pair (except for legacy connections still supported), and the pairing scheme used is determined by the advertised IO capabilities of the two devices. There is a lookup table to determine: Just Works, Numeric Comparison, or Passkey Entry (different than legacy pin code).

从蓝牙v2.1开始,所有连接必须配对(除了仍然支持的传统连接),并且使用的配对方案由两个设备的通告IO功能决定。有一个查找表来确定:Just Works,Numeric Comparison或Passkey Entry(与传统的pin代码不同)。

PDF: Bluetooth Org Secure Simple Pairing (new pairing schemes) User Interface

PDF:蓝牙组织安全简单配对(新配对方案)用户界面

#1


0  

To quote the official Android BT specs:

引用官方Android BT规格:

Remember there is a difference between being paired and being connected. To be paired means that two devices are aware of each other's existence, have a shared link-key that can be used for authentication, and are capable of establishing an encrypted connection with each other. To be connected means that the devices currently share an RFCOMM channel and are able to transmit data with each other. The current Android Bluetooth API's require devices to be paired before an RFCOMM connection can be established. (Pairing is automatically performed when you initiate an encrypted connection with the Bluetooth APIs.)

请记住,配对和连接之间存在差异。配对意味着两个设备知道彼此的存在,具有可用于认证的共享链接密钥,并且能够彼此建立加密连接。要连接意味着设备当前共享RFCOMM信道并且能够彼此传输数据。当前的Android蓝牙API需要在建立RFCOMM连接之前配对设备。 (当您使用蓝牙API启动加密连接时,将自动执行配对。)

For RFCOMM under the hood, you should look in to the specifications of RFCOMM

对于引擎盖下的RFCOMM,您应该查看RFCOMM的规格

#2


0  

The practical answer of Android insecure versus secure connections, is that the pairing (which is mandatory for Bluetooth v2.1 +) can be "unauthenticated" versus "authenticated". Basically, automatic pairing procedures create "unauthenticated" pairings, while user interactive pairing procedures create "authenticated" pairings. The Bluetooth connection is exactly the same for either. This is just a simple flag reflecting the type of pairing that occurred. Usually embedded devices, without keypads or displays, will have to use the "Just Works" automatic pairing method, and will generate an "unauthenticated" pairing.

Android不安全与安全连接的实际答案是,配对(蓝牙v2.1 +必须配对)可以是“未经身份验证”而非“经过身份验证”。基本上,自动配对过程创建“未经认证”的配对,而用户交互配对过程创建“认证”配对。两者的蓝牙连接完全相同。这只是一个简单的标志,反映了发生的配对类型。通常,没有键盘或显示器的嵌入式设备将必须使用“Just Works”自动配对方法,并将生成“未经身份验证”的配对。

Since Bluetooth v2.1, all connections must pair (except for legacy connections still supported), and the pairing scheme used is determined by the advertised IO capabilities of the two devices. There is a lookup table to determine: Just Works, Numeric Comparison, or Passkey Entry (different than legacy pin code).

从蓝牙v2.1开始,所有连接必须配对(除了仍然支持的传统连接),并且使用的配对方案由两个设备的通告IO功能决定。有一个查找表来确定:Just Works,Numeric Comparison或Passkey Entry(与传统的pin代码不同)。

PDF: Bluetooth Org Secure Simple Pairing (new pairing schemes) User Interface

PDF:蓝牙组织安全简单配对(新配对方案)用户界面