Summary
Proposes a way to authenticate Bluetooth LE broadcast audio so that receivers can tell a genuine broadcast from an impostor.
Key findings
- Section II (BIS security) and section III explain that encrypted broadcast authentication uses a key derived from the shared Broadcast_Code. An attacker who knows that code can defeat this protection, impersonate broadcasts or disrupt reception; the paper also distinguishes unencrypted broadcasts.
- Presents BACON, a mechanism designed to work within the Bluetooth core specification, which authenticates both the audio streams and the control information sent to all receivers in range.
- Uses lightweight symmetric cryptography so that it fits on resource-constrained devices.
- Sections VI and VII describe a proof of concept on two development boards transmitting dummy audio; the effect on practical audio applications remains future work.
- Section VI (PDF pages 6–7, Figures 7–8) reports tests of ten runs of 1,000 BIG events, using a Wi-Fi access point to create interference. Authentication added processing time and receiver power consumption. The additional authentication packets reduced packet reception compared with the stream without BACON; increasing retransmissions narrowed that reception gap but also increased power use. These are development-board measurements, not hearing-device battery-life tests.
- The threat model in section III concerns adversaries who know the shared code; it does not establish a measured rate of attacks in operating venues.
Limits
Read from the archived full author-hosted conference paper (https://www.carloalbertoboano.com/documents/gasteiger24bacon.pdf), which contains no funding statement. A proposed mechanism, not part of the Bluetooth specification; the proof of concept uses dummy audio, with no field data on attacks against real venues.
Read the original
doi.org/10.1109/MILCOM61039.2024.10774045
Cited in
- How much do crowds, phones and Wi-Fi reduce reliability?Open
- Open or protected: when should a venue broadcast need a code?Open
- Can venue broadcasts be spoofed, hijacked or jammed, and what protects them?Partly answered
Cite this source
Gasteiger T, Perazzo P, Schuß M, Boano CA, Basic F, Dini G, Römer K. BACON: improving broadcast audio authentication. IEEE MILCOM 2024 (Graz University of Technology; University of Pisa). 28 October 2024. https://doi.org/10.1109/MILCOM61039.2024.10774045 (accessed 13 October 2026).
Every finding here cites its source, and who funded each source is labelled. This site does not recommend products. Found an error or a missing study? Suggest a correction.