Wi-Fi and Bluetooth Low Energy for IoT

Two familiar radios

Wi-Fi and Bluetooth are in almost every phone and laptop, which makes them easy choices for IoT: no extra gateway is needed if a phone or access point is nearby. They work very differently, though, and suit different devices.

Wi-Fi for IoT

Wi-Fi (IEEE 802.11) gives a device an IP address on your network, so it can reach the cloud directly. It handles cameras, displays and anything with plenty of data. Its weakness is power: joining a network and keeping the radio on drain batteries quickly. Newer features help. Wi-Fi 6 (802.11ax) adds Target Wake Time (TWT), letting a device agree when it will next wake so it can sleep longer. Wi-Fi HaLow (802.11ah) uses sub-GHz spectrum for longer range and lower power, though it needs compatible access points. See Wi-Fi basics for the fundamentals.

Many cheap Wi-Fi devices only support 2.4 GHz and WPA2-Personal, and are set up through a temporary access point or a phone app. Common problems are shared passwords across all devices, no support for enterprise authentication and devices sitting on the same network as laptops.

Bluetooth Low Energy

Bluetooth Low Energy (BLE) was introduced with Bluetooth 4.0 and designed for tiny, infrequent transfers. A peripheral (a sensor or wearable) advertises its presence; a central (a phone or gateway) scans, connects and exchanges data. Data is organised in the Generic Attribute Profile (GATT) as services and characteristics that can be read, written or set to send notifications. Bluetooth 5 added longer range and higher speed options. BLE beacons simply broadcast an identifier for location and proximity uses.

Use LE Secure Connections, which uses elliptic-curve Diffie-Hellman key exchange, rather than older "legacy pairing", which is easier to break.

Securing Wi-Fi and BLE devices

• Put Wi-Fi IoT devices on a separate SSID and VLAN with firewall rules, not on the staff network.
• Use WPA3 where devices support it; otherwise WPA2 with a long, unique passphrase. Consider per-device keys if your access points support them.
• For BLE, require authenticated pairing for anything that controls locks, health or payments; never rely on Just Works for sensitive functions.
• Protect GATT characteristics so writing requires an encrypted, authenticated link.
• Remember BLE advertisements can be used to track people; good devices use random, rotating addresses.
• Add application-layer encryption (TLS to the cloud) on top of both.

Tip: when testing your own BLE devices, a phone app that lists GATT services quickly shows whether sensitive characteristics can be read without pairing. Only test devices you own or are authorised to assess.