Electronic – Security for Bluetooth 4.0

I have also been playing around with BLE, and decided to go with the Nordic nRF8001 chip because it looked easier to work with and didn’t require expensive IAR tools. nRF8001 is slightly cheaper than the CC2540 part in BLE112, but it is slave-only.

I bought Nordic’s nRF8001 development kit for $99, which includes nRF8001 samples and several nRF8001 boards (one with a trace antenna and one with an SMA connector) with standard 0.1" header for easy interfacing with your microcontroller development board. The documentation assumes that you have the $399 nRFgo development board and want to use the included nRF8200 microcontroller. I didn’t, so instead I wired an nRF8001 board directly to an Arduino.

You speak SPI to nRF8001, but basically with 2 different slave select-like pins. One pin (REQN) is a traditional slave select which is brought low to indicate that the master (you) want to send a message. The other pin (RDYN) is for the slave (nRF8001) to indicate that it received something over RF that it wants to send to the master, or that it is ready to receive a command from master. Master then brings REQN low and starts receiving.

The protocol is very concise and well documented (in the Product Specification PDF provided by Nordic) and I wrote an Arduino sketch to setup the nRF8001 and have it talking to my iPhone 4S in an afternoon. The format is basically one length byte, one command byte, and then optional command-specific arguments.

You will need Nordic’s nRFgo Studio software to create a configuration specifying the services your device will support; it will then include a services.h file containing the setup messages you need to send to nRF8001. I finally managed to emulate a heart rate monitor and display numbers in Nordic’s iOS demo app.

One big benefit of nRF8001 compared to BLE112 is that, apart from the proprietary setup messages generated by nRFgo Studio, you only deal with a well documented serial protocol. No firmware upgrades! It’s very cool that the CC2540 has an on-board 8051 microcontroller, but you’ll either need to pay thousands of dollars for the IAR tools or deal with the limitations and annoyances of BlueGiga’s software stack. A raw CC2540 is cheaper than nRF8001 plus a microcontroller, but BlueGiga’s boards are not cheap.

(There is a UART on the nRF8001 that is brought out on the boards included in the development kit, but it’s only for Bluetooth’s Direct Test Mode and isn’t ordinarily used.)

What you are trying to do is not generally possible.
To achieve this the BLE device needs to be sending packets that you can detect. A BLE device will only be sending packets in some special cases. Those are when it is advertising (sending advertising packets), active scanning (and therefore sending scan request packets), or it is in an active connection.
Contrary to the previous answer though, advertising packets would allow you to get the Bluetooth address without having to make a connection and pair (although I don't think from your question you were interested in addresses).
It is correct though that you could use something like Ubertooth to sniff the any of the packets mentioned above. That would allow you to at least detect that there were some devices near you (even without having to decrypt the packets if the device was part of an encrypted connection).