Analysis and Implementation of Anonymous Short-Range Communication for Android Clients

252 / BBB

2026-09-24

David Maier

15:45

Many mobile applications, such as contactless payment systems, rely on Near Field Commu-
nication (NFC) for intuitive interactions with a terminal. While NFC offers good usability,
its limited throughput becomes a bottleneck for applications that need to transfer larger
amounts of data, motivating its combination with a short-range wireless protocol offering
higher data rates. In privacy-sensitive contexts, users may not trust the terminal itself and
require that no metadata identifies them or links their interactions to each other. Modern
wireless protocols provide privacy features such as address randomization, but these mainly
protect against third-party observers.
To address these challenges, this thesis first surveys the short-range wireless communication
protocols natively supported on Android with regard to their built-in privacy features.
Building on this, it analyzes a prototype that combines NFC with Bluetooth Low Energy (BLE)
using NFC for key agreement and switching to BLE for the data exchange. The prototype
consists of an Android smartphone application and a terminal based on a Raspberry Pi. By
analyzing the metadata exchanged during connections and measuring the transfer speed,
the thesis assesses the practical viability of this architecture.
The analysis shows that the smartphones use a new Resolvable Private Address for every
BLE connection and randomize the NFC-A UID for every tap. However, fields such as the
clock accuracy, the initial connection interval and the exposed GATT services distinguished
between the two device models. Furthermore, the Bluetooth device name can reveal the
model and even the user’s name. Bonding to the server via BLE exchanges the Identity
Resolving Key that resolves all addresses of one user and therefore must be avoided. The NFC
connection’s ATS parameters leak metadata that could distinguish between the two device
models. Other metadata leakage could be mitigated by restricting the terminal to NFC-A.
Each connection had a fixed overhead of about 1.3 s, dominated by BLE service discovery.
The first connection after the app start took longer than subsequent connections. The data
exchange was faster when large bursts of data were sent and reached up to 43 KiB/s