How to initiate BLE pairing manually

[ealtan]

Hello,

I'm running nRF Connect SDK v1.9.0 on two nRF52840-DK devices, one Peripheral other Central.  

My application requires to initiate pairing, i.e. send pair request, programmatically.

For testing, I created a Peripheral device with a Service and two Characteristics.  

Via nRF Connect Desktop tool and nRF 52840 dongle, I can connect to that device, when connection establishes, it stays in "unencrypted link"  status.  

Then via Desktop tool, I click on "Pair" on the device settings configuration and it does pair with my Peripheral and gets into "encrypted link" mode. 

I want to accomplish same thing with my other nRF52840-DK device  which is in Central role.

Is there a way to initiate pair request manually ?   I couldn't see an API call for that.

All comments/hints are greatly appreciated.

E.

[Phil]

I have exactly the same issue.
I'm running nRF Connect SDK v3.3.0 on two nRF54L15-DK boards, one Peripheral and one Central.
When the Central is scanning and receives advertising from the peripheral, a button can be pressed on the Central to initiate a connection.The devices connect Ok in an unencrypted link.

I want the devices to pair and bond, or at least start the pairing process, automatically when the connection is established. 
I assumed that when the Central gets a connected complete callback it could programatically initiate the pairing process by sending a pairing request.  However, I can't find any documentation on how to do this.

Is it only possible to automatically start the pairing process from the peripheral?  
Does the peripheral have to send a security request in order to trigger the Central to send a pairing request?

We want to use pairing process "Just Works", so there in no operator involvement during the pairing process.  Our central and peripheral devices are simple and only have a button and LED, no display or keyboard.  However we want the link encrypted and the devices to be bonded.

[Vidar Berg]

Hi,

You can initiate the pairing process from the central by calling bt_conn_set_security() like in the central_uart sample here: https://github.com/nrfconnect/sdk-nrf/blob/5aa13555aa18356ea4b47766d16aa3dfbd80b978/samples/bluetooth/central_bas/src/main.c#L152. It is also important to change the security requirement on your characteristics if you want to require the link to be encrypted before any data exchange (https://academy.nordicsemi.com/courses/bluetooth-low-energy-fundamentals/lessons/lesson-5-bluetooth-le-security-fundamentals/topic/blefund-lesson-5-exercise-1/).  

[Phil]

Vidar,

Thanks for your reply.  I'll try setting the security level in the Central by calling bt_conn_set_security() to trigger the pairing process.

Is that example for SDK v3.3.0?

I found in the code for the peripheral I could not call bt_conn_set_security() from the connected() call-back.  I mean I could call it but it didn't do anything.  I had to use a kwork and call it from the kwork handler.  I presume this is because the connected() call-back is running in the BT stack, so is effectively running in an ISR.

I found that calling bt_conn_set_security() in the peripheral as soon as it connected caused pairing to start as soon as my phone connects (using nRF Connect app).   A Pairing Request window pops up on my phone.  However, it pops up twice.  It does pair and bond Ok.  This is without the phone trying to read/write any attributes.  It connects, pairs and does device discovery only.  Function bt_conn_set_security() is definitely called only once. Could the reason the pairing request pops up twice in the nRF Connect app be something to do with the phone (Android on Samsung Galaxy)?

[Vidar Berg]

When in the GAP Peripheral role, calling bt_conn_set_security() sends a security request, it will not initiate pairing like a central would. A security request sent immediately after connection is likely to be ignored by the central because it will overlap with other important events. If you want to send a security request, it is generally good practice to wait a few seconds to see whether the central initiates pairing or encryption first. Only send the request if it does not.

The linked sample is from the SDK.

[Phil]

Thanks for your reply.

I have it working where the peripheral calls bt_conn_set_security() when the central connects to it.
The Central and Peripheral both pair and bond..... most of the time.

However, occassionally the pairing fails with an error code "Failed to set security level".  The peripheral has bond information stored in NV memory, but the Central doesn't.

I'll try it with the Central setting the security level on connection.

It starts to make sense once you see things running. Thanks for your help.

[Vidar Berg]

Thanks for the update. Default behaviour is that the peripheral will reject a pairing request from an already bonded peer device. You can change this by enabling the CONFIG_SMP_ALLOW_OVERWRITE setting, but as indicated in the help text, it has some security implications that should be considered.