1.“Air Key Theft”: Real Scenarios of Replay Attacks on Smart Locks
A user installed aBLE (Bluetooth) smart lock at home, which supports unlocking via a mobile Bluetooth key. However, due to a replay attack vulnerability, it faced an intrusion without physical contact:
Signal Sniffing: The attacker carries a low-cost Bluetooth sniffing device (such as theNordic nRF52840 module) and waits at the user’s door to capture Bluetooth communication packets between the phone and the lock when the user unlocks the door—these packets contain complete unlocking instructions, and the lock does not implement encryption or replay protection;
Command Replay: The attacker does not need to crack the packet content but can directly resend the captured unlocking instructions using tools. Since the lock uses static key pairing and lacks a“command uniqueness verification” mechanism, it mistakenly considers the replayed old instructions as legitimate authorization, allowing the door to be successfully unlocked within 3 minutes;
Covert Intrusion: The entire attack process has no audible or visible alarms, and the user can only discover anomalies when reviewing the unlocking records later. More dangerously, this vulnerability affects multiple mainstream brand devices, allowing attackers to hold onto“copied unlocking instructions” for long-term illegal intrusions;
Chain Risks: After the intrusion, the attacker can obtain the user’s daily routine (inferred from unlocking times) and even use the lock as a springboard to attempt to access the homeWiFi, attacking other smart devices (such as cameras and smart speakers).
The core issue of this vulnerability is that the lock does not adhere to the basic security requirements of“communication security and anti-replay,” while the EN18031 standard’s SCM (Secure Communication Mechanism) clause is specifically designed to close such vulnerabilities.
2.EN18031 Standard: The “Triple Shield” Against Replay Attacks
EN18031-1, as a mandatory radio equipment safety standard in the EU effective from August 1, 2025, has a core SCM security communication mechanism that addresses the replay attack problem from three dimensions: “communication encryption, command verification, and anti-relay design”:
1. Communication Encryption: Rendering Captured Data Useless for Attackers
EN18031 SCM-3 explicitly requires that Bluetooth communication for smart locks must enable strong encryption protection:
Mandatory use ofBLE 5.0 and above versions of LE Secure Connections protocol, replacing easily cracked static key pairing;
Communication data is protected by the AES-CCM encryption algorithm, with keys dynamically negotiated and generated by the ECDH (Elliptic Curve Diffie-Hellman) protocol—each pairing generates a new key, making it impossible for attackers to decrypt or reuse commands even if they capture packets;
Plaintext transmission of unlocking instructions, device identifiers, and other sensitive data is prohibited, blocking the premise of“capture and use” attacks from the source.
2. Command Verification: Rejecting Execution of “Repeated Commands”
In response to the core logic of replay attacks,EN18031 SCM-4 establishes a mandatory anti-replay mechanism:
Each unlocking command must be accompanied by“a unique serial number + timestamp,” with the lock maintaining a local cache of valid commands;
Upon receiving a command, the lock first verifies whether the serial number already exists and whether the timestamp is within a valid window (usually≤30 seconds). If either condition is not met, the command is discarded, effectively preventing the replay of old commands;
Using a“nonce” mechanism, a unique random value is generated for each communication, bound to the command during transmission, ensuring that commands cannot be copied or reused.
3. Anti-Relay Design: Limiting Unlocking to “Real Close Distances”
EN18031 also requires strengthening protection by combining physical scenarios to prevent attackers from remotely relaying signals to carry out attacks:
Mandatory integration of distance detection technologies (such asUWB ultra-wideband, RSSI signal strength verification), allowing unlocking commands to be executed only when the phone/Bluetooth key is within ≤1 meter of the lock;
Close-range unlocking must be accompanied by secondary verification (such as touching the lock panel or entering a simple password) to prevent attackers from remotely relaying unlocking signals through signal amplifiers.
3.Industry Impact of EN18031 and User Safety Guidelines
1. Industry Level: Mandatory Compliance Forces Security Upgrades
EN18031 has become the “entry red line” for smart locks exported to the EU. Products that do not pass certification will face sales bans, recalls, and may incur fines of up to 4% of annual revenue. This requirement forces manufacturers to abandon the design philosophy of “light security, heavy functionality”:
Eliminating static keys, weak encryption, and other low-cost solutions, fully adopting encryption protocols and anti-replay mechanisms that comply with standards;
Establishing a firmware security update system to promptly fix known vulnerabilities and avoid long-term exposure risks for older devices.
2. User Level: Practical Advice to Avoid Replay Attacks
When purchasing, prioritize looking for“anti-replay”: choose products clearly marked as “EN18031-1 certified,” “supporting LE Secure Connections protocol,” and “having anti-replay/anti-relay functions,” avoiding low-priced old models without security certification;
Timely firmware updates: Regularly check for lock firmware updates via the mobileAPP, especially when manufacturers release announcements for “replay attack vulnerability fixes,” and upgrade immediately to close potential risk channels;
Be vigilant for abnormal scenarios: If you notice the lock unlocking without reason or see unfamiliar timestamps in the unlocking records, immediately reset the lock, re-pair the Bluetooth key, and contact the manufacturer for inspection if necessary to check for attacks;
Do not enable remote Bluetooth unlocking unless necessary: Try to use physical keys or the “close-range + secondary verification” unlocking method to reduce the attack surface exposed by Bluetooth communication.
From the “3-minute cracking” crisis of “air key theft” to the triple protection of the EN18031 standard, the security evolution of smart locks is essentially a process of “mandatory standards ensuring a safety baseline.” The core value of EN18031 lies in transforming key protections such as “anti-replay and strong encryption” from “optional features for high-end products” into “mandatory requirements for all products,” allowing users to enjoy the convenience of smart technology without worrying about the security risks of “locks being easily cracked.”
For inquiries, scan to add the official WeChat
Phone｜18188898539