How to prevent cloning in Ibeacons and avoid conflicts among beacons? - ios

Question

I am trying to develop one app with using a lot of beacons like say in any muti floor shopping mall. In this situation how can I control these
Suppose someone clones a beacon and starts advertsing the signal with same UUID, major, and minor, how to prevent that and what are the other security measures that can be taken?
How to avoid mutiple notifications, suppose somewhere conflicted by two beacons any area is common to more than one beacons, how to control that in app?

Answer 1

The iBeacon standard does not provide any built-in ways to prevent cloning. Apple restricts iOS devices from seeing iBeacons except for ones where the ProximityUUID is known, suggesting this may have been a rudimentary security attempt. But since other operating systems (Android, OSX Mavericks, Linux) allow reading identifiers of all iBeacons, this restriction seems rather silly. It is possible to read identifiers using a tool like Android iBeacon Locate and deploy your own iBeacon with the same identifiers.
Four common approaches to address this:
Do nothing. This is appropriate for most use cases where cloned beacons will cause minor consequences or for low profile deployments where the risk of someone doing this is minimal.
Rotate the iBeacon identifiers. You can do this manually by replacing beacons or manually changing their identifiers periodically. This does not eliminate the problem, but it limits the risk and impact on time.
Use an automated rotating identifier combined with an automated system for validating/converting it to a trusted identifier.
Abandon the iBeacon standard and use a proprietary beacon technology using encryption. This should be considered a last resort, because this choice makes it impossible to use widely available open source and commercial tools for working with iBeacons, and locks you into a single vendor.
Before you choose any option other than the first, be sure you carefully evaluate the risk and consequences of cloning, and be sure any countermeasure you take is really worth the downsides.
The multiple notification problem described in the question is generally not an issue in the absence of intentional cloning. Simply design the ProximityUUID/major/minor numbers of your beacons to be unique for each event you wish to give to users and make your app respond appropriately.

Answer 2

For beacon clone:
customize your beacon firmware and encrypt major/minor with a random key. If beacon and app both can access to cloud, maybe exchange random key via cloud to encrypt/decrypt the major/minor id. If no cloud is involved, beacon and app need to deal with a random key generating algorithm, ex use time as a seed.
(Encrypt with a forever fixed key is useless because clone or replay beacon advertising data still can cheat app)
Rotate UUID with a predefined table-based list. This just reduces the risk with a periodically changing UUID but not really fix the security issue. And the UUID list has a limited size because all UUIDs in list may need to pre-register in App, ex iOS, to let iOS take it as a recognized region and then pass data to your App.
For Multi-notification:
Usually, this should be handled by App.
When enter a region or beacon trigger callback, app should check if it is a duplicated region by uuid-major-minor info. App should also check if it is related notification/info has been sent to user or not to avoid user be bothered by duplicated notification.