Authentication/Authorization using mobile phone

[Andrew]

I have been searching for the best way to authenticate / authorize a mobile phone with a nRF52 device without much luck.

I would like to ensure that only the owner of the nRF52 device can pair with the device using their mobile phone.

Is there a best practice for this use case?

[Andrew]

Okay, your note about non-standard is helpful. Is there a standard approach for only allowing bonding/pairing with a mobile phone which has the proper credentials to do so? This assumes there is no IO capabilities physical access to the device.

If not, then I expect I will need to use Just Works bonding and perform an authentication using a custom characteristic after establishing the bond.

[Einar Thorsrud]

Hi,

There is no standard approached that would work in this case, so you must use a method of your own, as you have outlined. My point about this being non-standard was that I cannot guarantee that it will be a good solution, as it is often easy to overlook potential security issues.