central device will not raise security level with new periphral if no power reset on central side

[LongQi]

The central device has the below settings

static void auth_passkey_entry(struct bt_conn *conn)
{
	char addr[BT_ADDR_LE_STR_LEN];

	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));

	// Check for passkey entry event
	unsigned int passkey = STATIC_PASSKEY;
	LOG_DBG("Passkey entered %s: %06u", addr, passkey);

	// Set passkey using bt_conn_auth_passkey_entry()
	bt_conn_auth_passkey_entry(conn, passkey);
}

static void auth_cancel(struct bt_conn *conn)
{
	char addr[BT_ADDR_LE_STR_LEN];

	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));

	LOG_INF("Pairing cancelled: %s", addr);
}

static void pairing_complete(struct bt_conn *conn, bool bonded)
{
	char addr[BT_ADDR_LE_STR_LEN];

	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));

	LOG_INF("Pairing completed: %s, bonded: %d", addr, bonded);
}

static void pairing_failed(struct bt_conn *conn, enum bt_security_err reason)
{
	char addr[BT_ADDR_LE_STR_LEN];

	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));

	LOG_ERR("Pairing failed conn: %s, reason %d", addr, reason);
}

static struct bt_conn_auth_cb conn_auth_callbacks = {
	.passkey_entry = auth_passkey_entry,
	.cancel        = auth_cancel,
};

static struct bt_conn_auth_info_cb conn_auth_info_callbacks = {
	.pairing_complete = pairing_complete,
	.pairing_failed   = pairing_failed
};

One central device A and two peripheral devices B and C,  B and C have the exact same firmware. A can establish the connection with B or C. 

but I have to power reset A in order to change the connection between A-B and A-C otherwise auth_passkey_entry on A will not be triggered and security level will always be the lowest.

I tried to do power reset B and C but the situation still remain the same. 

Is there any flag or bonding info I need to clear on the central side before establish a new connection ?

[Simonr]

Hi

I think the way to do this would be to not pair or delete the paired devices at a certain point. You can't not set a number for max paired devices, as that would require a lot of Flash memory.  If you're dependent on the security pairing gives you I'd recommend deleting the pairing info when the maximum is reached.

Best regards,

SImon

[LongQi]

I think pair is still needed but just not saving the pair information to flash. Could you recommend how to config this? will CONFIG_BT_MAX_PAIRED=0 works?

[Simonr]

That's not possible I'm afraid, setting this config to 0 means your device won't support pairing. You will need to erase the pairing information upon disconnection if that is a way out.

Best regards,

Simon

[LongQi]

I'm confused. Why saving the pair info or not will affect the pairing process? are you sure about this? So I can not pair without saving the config to flash? keep erasing is not the solution, it'll damage the flash very soon because the robots will come to charging station very often.

[Simonr]

Connections can be done without storing specific info in either of the flash, but if they are going to pair over BLE, some pairing information will be stored on both ends. 

You can read more on the pairing process in the Bluetooth Low Energy Devacademy course here. 

"The pairing process requires the devices to repeat the process every time they want to encrypt the link again. In addition to “pairing”, the term “bonding” is used when the peers store the encryption key so they can re-encrypt the link in future connections with the same peer. During bonding, they can also exchange and store identity keys so they can recognize each other for future connections through the random resolvable private address."

Best regards,

Simon

[LongQi]

My understanding of pairing from the course is that:

Pairing: The process of generating, distributing, and authenticating keys for encryption purposes.
Bonding: The process of pairing followed by distribution of keys used to encrypt the link in future reconnections.

but let's not struggling the concept of these two words. Our product still needs static passkey entry but not store the encryption keys to flash. How to do that?