ThingsBoard is an open-source IoT platform used for device management, telemetry collection, data processing, and IoT application workflows. In a ThingsBoard deployment that integrates Bluetooth Low Energy (BLE) devices through a gateway or custom integration, BLE communication can provide an additional device-control interface.
Bluetooth Low Energy Generic Attribute Profile (GATT) defines services, characteristics, and operations through which a BLE client can interact with a BLE peripheral. Operations such as characteristic reads, writes, notifications, and service discovery can therefore become security-sensitive when they control IoT-device functions.
An unauthorized GATT command-access scenario occurs when a BLE client that has not been sufficiently authenticated or authorized attempts to access protected GATT characteristics or perform operations that should be restricted to an approved device or gateway.
In this use case, a controlled ThingsBoard IoT deployment is created on Ubuntu Linux inside an isolated VirtualBox laboratory. A BLE-capable laboratory device or simulated BLE peripheral represents the IoT endpoint, while a controlled gateway integration connects the BLE device with ThingsBoard.
The security architecture introduces device identity validation before protected GATT operations are accepted. After the BLE device identity is validated, a second authorization layer determines whether the identified device is permitted to perform the requested GATT operation. The authorization policy distinguishes permitted operations, such as approved characteristic reads, from restricted operations, such as protected characteristic writes.
Kali Linux is used as the controlled security-testing platform to generate authorized BLE/GATT test requests against the laboratory BLE endpoint. The testing is restricted to the isolated laboratory and does not target third-party Bluetooth devices.
The gateway/integration records the identity of the BLE device, requested GATT operation, target service and characteristic, authorization decision, and resulting action. Wazuh monitors the Ubuntu environment and security events, while OpenSearch provides centralized investigation and correlation.
The complete security workflow is: BLE Client → BLE Device/GATT Service → Device Identity Validation → GATT Operation Identification → Authorization Policy Evaluation → Allow / Deny → ThingsBoard Gateway Integration → Security Event Logging → Wazuh Monitoring → OpenSearch Investigation → Validation.
ThingsBoard provides the IoT device-management and application layer, while the BLE gateway/integration provides communication between the IoT platform and the BLE device. The BLE endpoint exposes GATT services and characteristics. Some characteristics may represent sensor information, device configuration, or control functions.
If GATT operations are accepted based only on the fact that a BLE client can reach the BLE service, an unauthorized device may attempt to read protected information or write to a control characteristic.
The security problem is therefore:
The proposed security architecture separates two security decisions: device identity validation determines whether the connecting BLE device is an approved laboratory device, and GATT operation authorization determines whether that identified device is permitted to perform the requested operation.
The controlled attack attempts to perform GATT operations from a BLE client that does not satisfy the laboratory device-identity and operation-authorization policy. The attack is performed against a synthetic BLE IoT endpoint associated with the ThingsBoard deployment. Controlled testing includes unauthorized attempts to access protected characteristics and perform restricted write operations. The objective is to determine whether the BLE integration verifies the requesting device identity and evaluates the requested GATT operation before allowing the operation to affect the IoT device.
Device identity validation establishes whether a BLE device participating in the laboratory ThingsBoard deployment is an approved device.
The identity decision can be based on the controlled device identity associated with the BLE integration, such as the approved BLE address or another authenticated device identity mechanism supported by the selected BLE implementation. Identity validation alone is not sufficient. A valid device may still be restricted from performing sensitive operations. Therefore, the second security layer evaluates the requested GATT operation and target characteristic. For example, a device may be allowed to read a telemetry characteristic while being denied permission to write to a protected configuration or control characteristic.
The secure processing flow is:
The BLE integration validates the identity of the requesting laboratory device against the approved device-identity policy.
Prevent unidentified or unauthorized BLE devices from accessing protected IoT operations.
Approved laboratory BLE devices are maintained in a controlled identity registry.
Establish an explicit trust boundary for BLE devices participating in the ThingsBoard deployment.
The security layer identifies the GATT service associated with the requested operation.
Prevent unauthorized devices from accessing protected GATT services.
Authorization is applied to individual GATT characteristics rather than treating the entire BLE service as equally trusted.
Restrict access to sensitive IoT characteristics.
The authorization layer distinguishes between GATT operations such as read and write.
Prevent a device that is permitted to read information from automatically receiving permission to modify IoT-device state.
Sensitive write characteristics require an explicit authorization decision before the write is executed.
Prevent unauthorized GATT commands from modifying protected IoT-device functions.
Each approved BLE device is associated with a defined set of permitted GATT operations.
Apply least-privilege authorization to BLE device interactions.
Requests that fail identity or operation authorization are rejected before reaching the protected device-control function.
Prevent unauthorized GATT commands from reaching the IoT device.
Identity failures and denied GATT operations are recorded with relevant request information.
Provide traceable evidence of unauthorized BLE activity.
Wazuh monitors the laboratory environment and security events generated by the BLE integration.
Detect repeated unauthorized GATT access attempts.
OpenSearch provides centralized analysis of BLE authorization events and associated IoT activity.
Correlate device identity failures, denied operations, and ThingsBoard activity.
ThingsBoard provides the IoT device-management and application environment for the laboratory deployment.
The BLE gateway provides the communication boundary between the BLE devices and the ThingsBoard IoT platform.
A controlled BLE peripheral represents the laboratory IoT device.
Kali Linux is used as the controlled security-testing platform for authorized BLE testing.
BlueZ provides the Linux Bluetooth protocol stack and command-line tools used for laboratory BLE interaction.
BlueZ command-line tools are used to perform controlled Bluetooth discovery and connection testing.
A controlled authorization module is implemented at the BLE gateway/integration layer.
Wazuh monitors the Ubuntu environment and relevant BLE authorization activity.
OpenSearch provides centralized investigation of BLE and ThingsBoard security events.
Ubuntu provides the controlled ThingsBoard and BLE gateway environment.
VirtualBox provides the isolated cybersecurity laboratory.
Research Breakthrough Possible @S-Logix