RE: Security of data passing in BLE communication

Vidar Berg — Tue, 10 Sep 2019 11:38:43 GMT

Hello,

The security capabilities are set in peer manager init (pm_init) using the defines (SEC_PARAM_BOND,..) shown in my previous reply.

RE: Security of data passing in BLE communication

Kova — Tue, 10 Sep 2019 04:48:37 GMT

Hello Vidar Berg.
Sorry for the late reply.
I do not know where GATT Central security settings are configured.
If you do not mind, please teach me.

RE: Security of data passing in BLE communication

Vidar Berg — Thu, 05 Sep 2019 11:47:17 GMT

Hi,

The security levels should be applied to the characteristics you have on the GATT server. The security level of the link and the characteristics will then determine whether the client gets read/write access. It's not uncommon to have some characteristics set with "open" while having others with a security level that requires bonding.

So if we use the ble_app_hrs project as an example:

    // Here the sec level for the Heart Rate Service can be changed/increased.
    hrs_init.hrm_cccd_wr_sec = SEC_OPEN;
    hrs_init.bsl_rd_sec      = SEC_OPEN;

Here write access to the CCCD is set to open, so any connected client can enable notifications for this characteristic. And let's say we want to require just works bonding or pairing before notifications can be enabled. Then we need to changes it to this:

    // Here the sec level for the Heart Rate Service can be changed/increased.
    hrs_init.hrm_cccd_wr_sec = SEC_JUST_WORKS;
    hrs_init.bsl_rd_sec      = SEC_OPEN;

Also note that the security level achieved through bonding will depend on the security capabilities of both the GAP central and GAP peripheral. Most of the examples are not set up to support MITM protection since it requires some kind of input or output (keyboard, display, etc) to the user.

Security parameters used for the bonding in the ble_app_hrs example:

#define SEC_PARAM_BOND                      1                                       /**< Perform bonding. */
#define SEC_PARAM_MITM                      0                                       /**< Man In The Middle protection not required. */
#define SEC_PARAM_LESC                      1                                       /**< LE Secure Connections enabled. */
#define SEC_PARAM_KEYPRESS                  0                                       /**< Keypress notifications not enabled. */
#define SEC_PARAM_IO_CAPABILITIES           BLE_GAP_IO_CAPS_NONE                    /**< No I/O capabilities. */
#define SEC_PARAM_OOB                       0                                       /**< Out Of Band data not available. */
#define SEC_PARAM_MIN_KEY_SIZE              7                                       /**< Minimum encryption key size. */
#define SEC_PARAM_MAX_KEY_SIZE              16                                      /**< Maximum encryption key size. */