Authentication before connection

[YSquare]

I am using nRF51 with Softdevice S110 to do a BLE peripheral, I want to have pin-code authentication before central device (or android phone) can connect to the peripheral to read/write characteristics.

I realize the SDK of nRF has very limited published examples in BLE security. If you can put more examples, this can help more people. Thanks. From example, ble_app_gls, authentication is done after connection, only in paring and bonding phases.

I also tried to use sd_ble_opt_set(), however, the authentication only happens after connection.

[RK]

You can't. Bluetooth doesn't support that type of authentication before connection, only afterwards. However what's the problem? If no characteristics can be read before bonding, you don't have an issue.

You can whitelist by MAC address to allow/disallow device connection by address, if you know the addresses you want, but that's it, that's all you can do.

[YSquare]

Thanks. It is also acceptable to allow/disallow central device to connect if it is not bonded before.

[RK]

Well that's just whitelisting again and the peer manager (Nordic's library code) supports making a whitelist for bonded peripherals.

However how's that actually going to work in practice? If you can't connect unless you're bonded and you can't bond before you connect, then there's no way to get a peripheral bonded so you can connect to it the first time.

[YSquare]

For the first time (whitelist is empty), the peripheral should allow connection & paring if the central passes the authentication.

[RK]

so there you go - it's easy. If there are no bonds you let anyone connect - the first guy who connects and bonds is then 'the connection'. If you have a bond then you use the functions to whitelist the address and only that guy will connect.