[Paper Review] Dead on Arrival: An Empirical Study of The Bluetooth 5.1 Positioning System

Marco Cominelli, Paul Patras+1 more|Edinburgh Research Explorer (University of Edinburgh)|Sep 2, 2019

Indoor and Outdoor Localization Technologies17 references19 citations

TL;DR

This paper empirically evaluates Bluetooth 5.1's Angle of Arrival (AoA) positioning system using a software-defined radio testbed, demonstrating that while sub-meter accuracy is achievable, angular detection is limited to a narrow sector and centimeter-level precision remains unattainable. The study further reveals a critical security flaw allowing attackers to manipulate AoA measurements via packet phase tampering, and proposes simple countermeasures such as non-deterministic antenna switching patterns to ensure measurement integrity.

ABSTRACT

The recently released Bluetooth 5.1 specification introduces fine-grained positioning capabilities in this wireless technology, which is deemed essential to context-/location-based Internet of Things (IoT) applications. In this paper, we evaluate experimentally, for the first time, the accuracy of a positioning system based on the Angle of Arrival (AoA) mechanism adopted by the Bluetooth standard. We first scrutinize the fidelity of angular detection and then assess the feasibility of using angle information from multiple fixed receivers to determine the position of a device. Our results reveal that angular detection is limited to a restricted range. On the other hand, even in a simple deployment with only two antennas per receiver, the AoA-based positioning technique can achieve sub-meter accuracy; yet attaining localization within a few centimeters remains a difficult endeavor. We then demonstrate that a malicious device may be able to easily alter the truthfulness of the measured AoA, by tampering with the packet structure. To counter this protocol weakness, we propose simple remedies that are missing in the standard, but which can be adopted with little effort by manufacturers, to secure the Bluetooth 5.1 positioning system.

Motivation & Objective

• To evaluate the real-world accuracy and feasibility of Bluetooth 5.1's AoA-based indoor localization in practical deployments.
• To investigate the limitations of angular detection fidelity in AoA-based positioning under real-world conditions.
• To assess the vulnerability of the AoA mechanism to spoofing attacks through packet structure manipulation.
• To propose practical, lightweight countermeasures that manufacturers can implement to secure AoA measurements.

Proposed method

• The study uses a software-defined radio (SDR) testbed to implement and evaluate BLE 5.1's AoA mechanism with a two-antenna receiver setup.
• Angular measurements are computed by comparing phase differences between signals received at two antennas, using a single-pole double-throw (SPDT) switch to alternate reception.
• Position estimation is performed by triangulating angular measurements from multiple fixed receivers in a 2D plane.
• A controlled attack is conducted by modifying the phase of the Channel Training Symbol (CTS) in the BLE packet after the switch time, enabling arbitrary angle manipulation.
• A countermeasure is proposed by keeping the secondary antenna active during the next packet reception, thus detecting inconsistencies in phase behavior.
• The switching pattern is randomized to prevent attackers from predicting and crafting malicious signals.

Experimental results

Research questions

• RQ1 What is the actual angular detection accuracy of Bluetooth 5.1's AoA mechanism in real-world indoor environments?
• RQ2 To what extent can AoA-based positioning achieve sub-meter and centimeter-level accuracy in practical deployments?
• RQ3 Can an attacker manipulate the AoA measurement by altering the BLE packet structure without detection?
• RQ4 What simple, deployable countermeasures can prevent such spoofing attacks in commercial implementations?

Key findings

• The AoA mechanism is limited to a restricted angular sector centered on the receiver, significantly constraining its usable range.
• Positioning accuracy achieves sub-meter error (below 85 cm for 95% of positions), but only 15% of estimates are within 10 cm of the true location.
• An attacker can manipulate the detected angle by artificially modifying the phase of the CTE after the antenna switch time, enabling arbitrary angle spoofing.
• The attack is feasible with minimal hardware—requiring only a single SPDT switch—and can be executed in real time, as demonstrated by a 60° angular shift over time.
• A simple countermeasure involving non-deterministic, hidden antenna switching patterns can detect such spoofing attempts by revealing inconsistent phase behavior.
• The proposed countermeasures are lightweight and can be implemented by manufacturers with minimal changes to existing hardware and software.