Get BLE MAC from random private resolvable address

Question

I'd like to connect an Android device (client) to an External BLE device (server). I've a couple of questions concerning the private random resolvable address mechanism.

• As far as I understood from the BLE core spec, an identity-resolving key can be used to tell, if an address was generated using this key, however it can't be used to resolve the original BLE MAC address of the peer.Is that correct?
• Is there a way to acquire the original BLE MAC address, whilst still using private random resolvable addresses on the server side? Maybe its part of the bonding information?
• Could I solve the problem if only the server uses private random resolvable addresses, but not the client? Would this break the privacy protection, the private random resolvable address mechanism offers?

In the end I'd like a BLE connection, which uses private random resolvable addresses to ensure privacy and still be able to obtain the original BLE MAC of the Client on my Server for internal purpose.

I'd very much appreciate if someone could answer my questions.

Best david

Answer 1

When bonding, zero, one or both devices can send Resolving keys if negotiated so. For each device that sends Resolving key (IRK), the Identity Address is also always sent. This contains the original Bluetooth Device address and can be either public or static random. It's this address that only bonded devices know.

The idea of the privacy feature is to never use the original Bluetooth device address in Link Layer packets but instead a randomly generated one that is changed every x minutes (usually 15). This way, if it advertises regularly, someone can't track it since it disappears after 15 min. However if you have the corresponding IRK then you can determine if the IRK matches or not. If it matches you also know the original Bluetooth Device address since your bond data contains both the IRK and original address. But if you throw away that address then you can't recover the original address, even if you have the IRK.

If only one of two devices uses random resolvable address, then the one with resolvable address can't be tracked by a non-bonded device and the one that does not use a random resolvable address can be tracked.