CC2640R2F: Prevent connection for unauthorized devices

Hi Harald,

I would recommend using a passkey and bonding in your application if you aren't already. Which version of the SDK are you using?

Hy Jessica,
this sounds exactly like what I am looking for, unfortunately don't know how to realize this.
I am using simplelink_cc2640r2_sdk_2_30_00_28 on a CC2640R2F, start project was simple_peripheral_oad_offchip
Any help appreciated.
Harald

Hi Harald,

That example should already include the code for passcodes depending on how much you have changed. Based on your above code, I recommend adding the following code:

uint8_t bonding = TRUE;
uint8_t scMode = GAPBOND_SECURE_CONNECTION_ALLOW;

GAPBondMgr_SetParameter(GAPBOND_BONDING_ENABLED, sizeof(uint8_t), &bonding);
GAPBondMgr_SetParameter(GAPBOND_SECURE_CONNECTION, sizeof(uint8_t), &scMode);

Hy Jessica,

thanks a lot for your response, unfortunately that's still not it. Have you ever tried to connect to a device with these settings? I use two different tools: Android nRF Connect and BLED112 USB dongle on PC (Python). Both simply connect to my device and are able to read and write all characteristics.

There is one thing that helps me: I changed access of my characteristics to GATT_PERMIT_AUTHEN_READ and GATT_PERMIT_AUTHEN_WRITE. Now I can connect and discover, but not read nor write the characteristics that I have marked as "AUTHEN".

I would have expected the central device (my BLED112 or nRF Connect) to enter a passkey, but this does not happen so far.

So apparently it is not possible to prevent from connecting or ask for the passkey during connect in the first place?

regards

Harald

Hi Harald,

In order to narrow down why this isn't working, can you try testing this with an app like BLE Scanner and let me know if it requests a passkey?

Hi Jessica,

my name is Markus. I'm Harald's collegue and will continue with this topic. I'm using ble_sdk_2_02_01_18  on a CC2640.

I started from skratch with the SimplePeripheral project. I configured the gap bond manager with these settings:

  // Setup the GAP Bond Manager
  {
    uint32_t passkey = 123457; // passkey "000000"
    uint8_t pairMode = GAPBOND_PAIRING_MODE_WAIT_FOR_REQ;
    uint8_t mitm = TRUE;
    uint8_t ioCap = GAPBOND_IO_CAP_DISPLAY_ONLY;
    uint8_t bonding = TRUE;
    uint8_t scMode = GAPBOND_SECURE_CONNECTION_ALLOW;
    uint8_t OOBEnabled = FALSE;

    GAPBondMgr_SetParameter(GAPBOND_DEFAULT_PASSCODE, sizeof(uint32_t),
                            &passkey);
    GAPBondMgr_SetParameter(GAPBOND_PAIRING_MODE, sizeof(uint8_t), &pairMode);
    GAPBondMgr_SetParameter(GAPBOND_MITM_PROTECTION, sizeof(uint8_t), &mitm);
    GAPBondMgr_SetParameter(GAPBOND_IO_CAPABILITIES, sizeof(uint8_t), &ioCap);
    GAPBondMgr_SetParameter(GAPBOND_BONDING_ENABLED, sizeof(uint8_t), &bonding);
    GAPBondMgr_SetParameter(GAPBOND_SECURE_CONNECTION, sizeof(uint8_t), &scMode);
    GAPBondMgr_SetParameter(GAPBOND_LOCAL_OOB_SC_ENABLED,  sizeof(uint8_t), &OOBEnabled);
  }

After that I modified simple_gatt_profile.c : 

// Characteristic Value 2
{
{ ATT_BT_UUID_SIZE, simpleProfilechar2UUID },
GATT_PERMIT_AUTHEN_READ,
0,
&simpleProfileChar2
},

and

// Characteristic Value 3
{
{ ATT_BT_UUID_SIZE, simpleProfilechar3UUID },
GATT_PERMIT_AUTHEN_WRITE,
0,
&simpleProfileChar3
},

When I use BLE Scanner and want to read Characteristic Value 2 for instance it prompts for a password. When I enter 123456 the value is read correctly - so far so good.

However when I use our BLE112 PC dongle, I can read the value from Charactersitic 2 as soon is I start to encrypt the connection (without being asked to provide a pairing code).

This doesn't give us the feeling of a secured device of course...

Best regards,

Markus

Hi Markus & Harald,

Can you please provide a sniffer log of the BLE112 PC dongle session and also send a log of the simple_peripheral session you've made?

Basically, what i think is happening is that the IO Cap on the BLE112 dongle is set differently and eventually triggers a Just Works pairing method where the connection ends up being encrypted but un-authenticated.

You can reference this section on what pairing method is used based on initiator/responder/IOCap/MITM etc.
dev.ti.com/.../gapbondmngr.html

That said, can you please give more clarity, are you trying to pair a BLE112 Dongle with a phone as well or something else?