Experiment: Secure Sensor Data Transmission Using Bluetooth Low Energy

Aim

To implement secure transmission of temperature and humidity data from an IoT sensor using Bluetooth Low Energy (BLE) and demonstrate authenticated and encrypted communication between an ESP32 and a smartphone.

Objectives

To understand the concept of Bluetooth Low Energy (BLE) communication in IoT systems.
To interface a DHT11 temperature and humidity sensor with an ESP32.
To configure the ESP32 as a BLE server.
To transmit real-time sensor data from the ESP32 to a smartphone using BLE.
To understand BLE services and characteristics.
To implement BLE pairing and authentication using a passkey.
To understand how BLE encryption protects transmitted sensor data.
To verify secure sensor-data communication using a smartphone BLE application.

Components Required

Sr. No.	Component	Quantity	Purpose
1	ESP32 Development Board	1	IoT controller and BLE server
2	DHT11 Sensor	1	Measures temperature and humidity
3	USB Cable	1	Programming and power supply
4	Jumper Wires	As required	Electrical connections
5	Smartphone	1	BLE client for receiving sensor data
6	LightBlue® BLE Application	1	Scanning, connecting and monitoring BLE data
7	Arduino IDE	1	ESP32 programming

Smartphone Application

The recommended application for this experiment is **LightBlue® by Punch Through**.

LightBlue is a BLE debugging and development application that is available for both Android and iOS. It can scan for BLE peripherals, connect to them, display their services and characteristics, and read or subscribe to characteristic values.

The application can be installed from:

Android: [LightBlue® on Google Play](https://play.google.com/store/apps/details?hl=en&id=com.punchthrough.lightblueexplorer&utm_source=chatgpt.com)
iPhone/iPad: [LightBlue® on the App Store](https://apps.apple.com/in/app/lightblue/id557428110?platform=vision&utm_source=chatgpt.com)

Theory

Bluetooth Low Energy

Bluetooth Low Energy (BLE) is a wireless communication technology designed for low-power communication between devices. It is widely used in IoT sensors, wearable devices, smart-home devices and other embedded systems.

An ESP32 can operate as a BLE device and communicate with smartphones and other BLE-enabled devices. The Arduino ESP32 framework provides a BLE library for creating BLE servers, services and characteristics.

In this experiment, the ESP32 operates as a BLE GATT server, while the smartphone operates as the BLE client.

The communication structure is:

DHT11 Sensor
     ↓
   ESP32
     ↓
 BLE GATT Server
     ↓
 Secure BLE Connection
     ↓
 Smartphone
     ↓
 LightBlue Application

BLE GATT

BLE devices commonly organize application data using the Generic Attribute Profile (GATT).

The main components used in this experiment are:

Service: A service groups related functionality of a BLE device.

Characteristic: A characteristic contains a particular piece of data that can be read, written or notified.

For this experiment, one BLE service is created containing two characteristics:

Characteristic	Data	Operation
Temperature	Temperature in °C	Read / Notify
Humidity	Relative humidity in %	Read / Notify

The smartphone can connect to the ESP32 and subscribe to notifications so that updated sensor values are received automatically.

BLE Security

BLE provides security mechanisms for authentication, pairing, bonding and encrypted communication.

In this experiment, BLE security is configured using:

Pairing
Bonding
MITM (Man-in-the-Middle) protection
Secure Connections
Passkey authentication

Espressif's ESP32 BLE security documentation supports authentication modes combining bonding, MITM protection and Secure Connections.

Pairing

Pairing is the process by which two Bluetooth devices establish the information required to create a trusted secure relationship.

In this experiment, the smartphone and ESP32 are paired using a passkey.

Example:

ESP32
  ↓
BLE connection request
  ↓
Pairing request
  ↓
Passkey authentication
  ↓
Secure key establishment
  ↓
Encrypted BLE communication

Bonding

Bonding allows the security information established during pairing to be stored so that the devices can recognize each other during future connections.

Espressif distinguishes bonding from encryption: bonding stores long-term keys after successful encryption, while encryption protects the communication link.

BLE Encryption

After successful authentication, the BLE link can be encrypted.

Therefore, the sensor data transmitted over the BLE connection is protected from simple interception of the communication.

The security flow is:

Sensor Data
    ↓
BLE Security / Pairing
    ↓
Authentication
    ↓
Encryption
    ↓
Secure BLE Transmission
    ↓
Smartphone

Pin Connections

DHT11 to ESP32

DHT11 Pin	ESP32 Pin	Description
VCC	3.3V	Power supply
DATA	GPIO 4	Digital sensor data
GND	GND	Ground

Connection Diagram

              +----------------+
              |     DHT11      |
              |                |
              | VCC  DATA  GND |
              +--+----+-----+--+
                 |    |     |
                3.3V GPIO4 GND
                 |    |     |
                 |    |     |
          +------+----+-----+------+
          |          ESP32         |
          |                        |
          |       BLE Server       |
          |          ))))          |
          +------------))----------+
                       ))
                       ))
                Secure BLE Link
                       ))
                       ))
                 +-----------+
                 | Smartphone|
                 |           |
                 | LightBlue |
                 +-----------+

Program

Arduino Program

#include <Arduino.h>
#include <BLEDevice.h>
#include <BLEServer.h>
#include <BLEUtils.h>
#include <BLESecurity.h>
#include <DHT.h>

#define DHTPIN 4
#define DHTTYPE DHT11

#define DEVICE_NAME "ESP32-Secure-Sensor"

#define SERVICE_UUID \
"4fafc201-1fb5-459e-8fcc-c5c9c331914b"

#define TEMP_UUID \
"beb5483e-36e1-4688-b7f5-ea07361b26a8"

#define HUMIDITY_UUID \
"cba1d466-344c-4be3-ab3f-189f80dd7518"

#define BLE_PASSKEY 123456

DHT dht(DHTPIN, DHTTYPE);

BLECharacteristic *temperatureCharacteristic;
BLECharacteristic *humidityCharacteristic;

class SecurityCallbacks : public BLESecurityCallbacks
{
  uint32_t onPassKeyRequest()
  {
    Serial.println("Passkey requested");
    return BLE_PASSKEY;
  }

  void onPassKeyNotify(uint32_t passkey)
  {
    Serial.print("Passkey: ");
    Serial.println(passkey);
  }

  bool onConfirmPIN(uint32_t pin)
  {
    Serial.print("Confirm PIN: ");
    Serial.println(pin);
    return true;
  }

  bool onSecurityRequest()
  {
    Serial.println("Security request received");
    return true;
  }

  void onAuthenticationComplete(esp_ble_auth_cmpl_t desc)
  {
    if (desc.success)
      Serial.println("BLE authentication successful");
    else
      Serial.println("BLE authentication failed");
  }
};

void setup()
{
  Serial.begin(115200);

  dht.begin();

  BLEDevice::init(DEVICE_NAME);

  BLESecurity *security = new BLESecurity();

  security->setCapability(ESP_IO_CAP_OUT);

  security->setAuthenticationMode(
    ESP_LE_AUTH_REQ_SC_MITM_BOND
  );

  BLEDevice::setSecurityCallbacks(
    new SecurityCallbacks()
  );

  BLEServer *server = BLEDevice::createServer();

  BLEService *service =
    server->createService(SERVICE_UUID);

  temperatureCharacteristic =
    service->createCharacteristic(
      TEMP_UUID,
      BLECharacteristic::PROPERTY_READ |
      BLECharacteristic::PROPERTY_NOTIFY
    );

  humidityCharacteristic =
    service->createCharacteristic(
      HUMIDITY_UUID,
      BLECharacteristic::PROPERTY_READ |
      BLECharacteristic::PROPERTY_NOTIFY
    );

  temperatureCharacteristic->setValue("0.0");
  humidityCharacteristic->setValue("0.0");

  service->start();

  BLEAdvertising *advertising =
    BLEDevice::getAdvertising();

  advertising->addServiceUUID(SERVICE_UUID);
  advertising->setScanResponse(true);

  BLEDevice::startAdvertising();

  Serial.println();
  Serial.println("Secure BLE Sensor Started");
  Serial.println("Device Name: ESP32-Secure-Sensor");
  Serial.println("Passkey: 123456");
  Serial.println("Waiting for BLE connection...");
}

void loop()
{
  float temperature = dht.readTemperature();
  float humidity = dht.readHumidity();

  if (isnan(temperature) || isnan(humidity))
  {
    Serial.println("DHT11 reading failed");
    delay(2000);
    return;
  }

  char temperatureValue[10];
  char humidityValue[10];

  dtostrf(temperature, 1, 2, temperatureValue);
  dtostrf(humidity, 1, 2, humidityValue);

  temperatureCharacteristic->setValue(
    temperatureValue
  );

  humidityCharacteristic->setValue(
    humidityValue
  );

  temperatureCharacteristic->notify();
  humidityCharacteristic->notify();

  Serial.print("Temperature: ");
  Serial.print(temperature);
  Serial.println(" °C");

  Serial.print("Humidity: ");
  Serial.print(humidity);
  Serial.println(" %");

  Serial.println("Sensor data sent using secure BLE");

  delay(2000);
}

Code Explanation

Code	Explanation
`#include <BLEDevice.h>`	Provides the main BLE device functionality.
`#include <BLEServer.h>`	Provides functionality for creating a BLE server.
`#include <BLESecurity.h>`	Provides BLE pairing and security configuration.
`#include <DHT.h>`	Provides functions for interfacing with the DHT11 sensor.
`DHTPIN 4`	Defines GPIO 4 as the DHT11 data pin.
`DEVICE_NAME`	Defines the name advertised by the ESP32.
`SERVICE_UUID`	Uniquely identifies the BLE sensor service.
`TEMP_UUID`	Identifies the temperature characteristic.
`HUMIDITY_UUID`	Identifies the humidity characteristic.
`BLE_PASSKEY 123456`	Defines the passkey used for BLE authentication.
`dht.begin()`	Initializes the DHT11 sensor.
`BLEDevice::init()`	Initializes BLE and assigns the device name.
`setPassKey()`	Configures the BLE passkey.
`setCapability()`	Defines the input/output capability used during authentication.
`setAuthenticationMode(true, true, true)`	Enables bonding, MITM protection and Secure Connections.
`createServer()`	Creates the ESP32 BLE server.
`createService()`	Creates the BLE sensor service.
`createCharacteristic()`	Creates temperature and humidity characteristics.
`PROPERTY_READ`	Allows the smartphone to read the sensor value.
`PROPERTY_NOTIFY`	Allows the ESP32 to send updated sensor values to the smartphone.
`service->start()`	Starts the BLE service.
`startAdvertising()`	Makes the ESP32 discoverable by BLE clients.
`dht.readTemperature()`	Reads temperature from the DHT11.
`dht.readHumidity()`	Reads humidity from the DHT11.
`setValue()`	Updates the BLE characteristic value.
`notify()`	Sends the updated value to subscribed BLE clients.

Security Configuration

The following security settings are used in the experiment:

Security Feature	Purpose
Passkey	Provides authentication during pairing.
MITM Protection	Provides protection against certain man-in-the-middle attacks during authenticated pairing.
Secure Connections	Uses the BLE Secure Connections pairing mechanism.
Bonding	Allows security information to be retained for future connections.
Encryption	Protects data transmitted over the established BLE link.

Espressif documents BLE security configurations including bonding, MITM protection and Secure Connections, and provides dedicated BLE security examples.

Smartphone Setup

Step 1: Install LightBlue

Install LightBlue® by Punch Through on the smartphone.

For Android:

[Download LightBlue from Google Play](https://play.google.com/store/apps/details?hl=en&id=com.punchthrough.lightblueexplorer&utm_source=chatgpt.com)

For iPhone/iPad:

[Download LightBlue from the App Store](https://apps.apple.com/in/app/lightblue/id557428110?platform=vision&utm_source=chatgpt.com)

The same application is available on both platforms.

Step 2: Upload the Program

1. Connect the ESP32 to the computer using the USB cable. 2. Open Arduino IDE. 3. Select the appropriate ESP32 board. 4. Select the correct COM port. 5. Upload the program. 6. Open the Serial Monitor at 115200 baud.

The Serial Monitor should display:

Secure BLE Sensor Started
Device Name: ESP32-Secure-Sensor
Passkey: 123456
Waiting for BLE connection...

Step 3: Start LightBlue

1. Enable Bluetooth on the smartphone. 2. Open the LightBlue application. 3. Allow the required Bluetooth permissions. 4. Start scanning for nearby BLE devices. 5. Locate:

ESP32-Secure-Sensor

6. Select the device and tap Connect.

LightBlue supports BLE scanning, connection, service/characteristic inspection, reading, writing and notifications.

Step 4: Pair the Device

When the ESP32 requests secure pairing, the smartphone will display the BLE pairing/passkey interaction.

Enter or confirm:

After successful authentication, the BLE connection becomes secured.

Espressif's BLE documentation demonstrates pairing between an ESP32 BLE server and a mobile phone using LightBlue, including passkey-based pairing.

Step 5: View Sensor Data

After connecting, LightBlue displays the BLE service and its characteristics.

The structure will be similar to:

ESP32-Secure-Sensor

↓↓ Scroll to bottom

beb5483e-36e1-4688-b7f5-ea07361b26a8 (This is Temperature)

cba1d466-344c-4be3-ab3f-189f80dd7518 (This is Humidity)

You can change the name of the above services and set them to Temperature and Humidity respectively for easy access.

The exact appearance of the LightBlue interface may vary between Android and iOS versions.

Step 6: Enable Notifications

The temperature and humidity characteristics support notifications.

Enable notifications for the characteristics in LightBlue.

The ESP32 will then periodically send updated sensor readings.

Example:

Temperature: 27.40 °C
Humidity: 61.00 %

Temperature: 27.50 °C
Humidity: 61.00 %

Temperature: 27.50 °C
Humidity: 62.00 %

Data Flow

The complete data flow of the experiment is:

             DHT11 Sensor
                  ↓
          Temperature / Humidity
                  ↓
                ESP32
                  ↓
            BLE GATT Server
                  ↓
       BLE Pairing & Authentication
                  ↓
          Encrypted BLE Link
                  ↓
             Smartphone
                  ↓
           LightBlue Application
                  ↓
       Temperature / Humidity Data

Procedure

Connect the DHT11 sensor to the ESP32 according to the given pin connections.
Install the DHT sensor library in Arduino IDE if required.
Install the ESP32 board package in Arduino IDE.
Install the LightBlue BLE application on an Android or iOS smartphone.
Enter the BLE program into Arduino IDE.
Connect the ESP32 to the computer.
Select the correct ESP32 board and COM port.
Upload the program.
Open the Serial Monitor at 115200 baud.
Verify that the ESP32 starts BLE advertising.
Open LightBlue on the smartphone.
Scan for nearby BLE devices.
Select `ESP32-Secure-Sensor`.
Establish the BLE connection.
Complete the passkey authentication using `123456`.
Verify that the BLE connection is authenticated and secured.
Open the sensor service in LightBlue.
Locate the temperature and humidity characteristics.
Enable notifications for the characteristics.
Observe the temperature and humidity values received from the ESP32.
Compare the displayed values with the DHT11 readings shown in the Serial Monitor.
Record the observed values.

Observations and Output

Serial Monitor

The Serial Monitor displays information similar to:

Secure BLE Sensor Started
Device Name: ESP32-Secure-Sensor
Passkey: 123456
Waiting for BLE connection...

Temperature: 27.40 °C
Humidity: 61.00 %
Sensor data sent using secure BLE

Temperature: 27.50 °C
Humidity: 61.00 %
Sensor data sent using secure BLE

Smartphone

The LightBlue application should show:

Parameter	Example Observation
BLE Device	ESP32-Secure-Sensor
BLE Service	Sensor Service
Temperature	27.40 °C
Humidity	61.00 %
Authentication	Successful
Communication	Secure BLE

The actual temperature and humidity values will depend on the environmental conditions.

Result

The DHT11 sensor was successfully interfaced with the ESP32, and temperature and humidity data were transmitted to a smartphone using Bluetooth Low Energy. BLE pairing and security mechanisms were configured to authenticate the smartphone and establish a protected communication link. The sensor values were successfully observed using the LightBlue BLE application.

Security Considerations

The BLE passkey used in this experiment is intended for educational demonstration.
A fixed passkey such as `123456` should not be used in a real security-sensitive product.
Production IoT systems should use appropriate device-specific credentials and security policies.
Secure Connections and MITM protection improve the security of BLE pairing, but the overall security of an IoT product also depends on its firmware, credential management and application design.
The experiment demonstrates BLE link security; it should not be interpreted as complete end-to-end IoT security.
The LightBlue application is being used as a BLE debugging/client tool rather than as a custom end-user IoT application.

Viva Questions

Q1. What is BLE?

BLE stands for Bluetooth Low Energy. It is a wireless communication technology designed for low-power communication between devices.

Q2. Why is BLE suitable for IoT applications?

BLE provides short-range wireless communication with relatively low power consumption, making it suitable for sensors and other IoT devices.

Q3. What is GATT?

GATT stands for Generic Attribute Profile. It defines how BLE devices organize and exchange application data using services and characteristics.

Q4. What is a BLE service?

A service is a collection of related BLE characteristics that represents a particular function of the device.

Q5. What is a BLE characteristic?

A characteristic represents a specific piece of data or functionality and can support operations such as read, write and notify.

Q6. What is pairing?

Pairing is the process of establishing security information between two Bluetooth devices so that a secure relationship can be created.

Q7. What is BLE encryption?

BLE encryption protects data exchanged over an established secure BLE connection.

Q8. What is a passkey used for?

A passkey is used as part of the authentication process during BLE pairing.

Q9. What is MITM protection?

MITM stands for Man-in-the-Middle. MITM protection helps prevent an attacker from impersonating one of the devices during the authentication process.

Q10. What is bonding?

Bonding is the process of storing security information after pairing so that the devices can establish trusted connections again later.

Q11. Why is LightBlue used in this experiment?

LightBlue provides a convenient BLE client interface for discovering the ESP32, connecting to it, inspecting services and characteristics, and receiving notifications.

Q12. Can the same application be used on Android and iOS?

Yes. LightBlue is available for both Android and iOS.

Q13. What is the role of the ESP32 in this experiment?

The ESP32 reads the DHT11 sensor and acts as a BLE GATT server that provides the sensor data to the smartphone.

Q14. What is the difference between `READ` and `NOTIFY` in BLE?

`READ` allows the client to request the current value. `NOTIFY` allows the server to send updated values automatically when the client subscribes to notifications.

Q15. How is this experiment different from HTTPS-based cloud communication?

HTTPS protects communication between an IoT device and a web/cloud server over a network. This experiment demonstrates secure short-range BLE communication directly between an ESP32 and a smartphone.

Conclusion

This experiment demonstrates how Bluetooth Low Energy can be used for secure IoT sensor-data transmission. The ESP32 reads temperature and humidity from the DHT11 sensor and exposes the readings through BLE characteristics. The smartphone connects using the LightBlue application, performs secure pairing, and receives the sensor data through an authenticated and encrypted BLE connection.