Different bonding configuration with different devices

[Federico]

Hi,

We're developing a system composed of one device with an nRF running as central, other device with an nRF running as peripheral and desktop and mobile applications running on Windows 10 and iOS respectively. All devices connect to the peripheral nRF. We found that it would be desirable to bond with said device on most connections, except for the Windows side. However, the Windows API does not provide that much control over the BLE stack and we haven't been able to find a way to set the bonding bit to 0.

I can think of a few ways of solving this (bonding with some devices and not with others):

1. Is there any way to configure the bonding bit selectively on the peripheral nRF depending on who is connecting?
2. Is there any way to prevent Windows 10 from bonding, even if the peripheral nRF bonding bit is set to true?
3. Is there any way to force the central nRF and iOS devices to bond, even if the peripheral nRF bonding bit is set to false?

Thanks

Federico

[Kenneth]

1. In principle it should be possible to dynamically adjust the bonding bit, however how would you know that it was a Windows 10 peer that connected? I do not see how you would be able to control this, if you were, you could also control the bonding bit.

2. Windows 10 will connect and establish the highest common supported security level/mode, which make sense I think.

3. That would violate the BLE spec.

Can you elaborate why you don't want Windows 10 to bond?

[Federico]

I was thinking it might be technically feasible to connect and write to an open characteristic requesting to clear or set the bonding bit, before attempting to pair. It doesn't seem like a good solution though.

Regarding your question, we expect some of the windows devices to connect to a lot of peripheral devices, and never connect again. So it seems rather pointless to store the bonding information. Also, we're not sure whether we can programmatically delete bonded BLE devices in windows, which brings a whole lot of other problems (like LTK lost on the peripheral). So not bonding at all could solve that.

[Kenneth]

I understand the use case now, however I don't see a good solution here no. You may consider not bonding at all, and instead encrypt all data in the application (instead of relying on encryption on link layer), this could somewhat do what you want.

Kenneth