1st connection is bonded authenticated encrypted link, but 2nd connection becomes not bonded unencrypted link

[snowuyl]

I use nRF Connect to connect to nRF52832 device. 1st connection is bonded authenticated encrypted link, but 2nd connection becomes not bonded unencrypted link. Why 1st and 2nd connection are different?

The following is log message of nRF52832 device.

00> <info> app: POWER_ON.
00> <debug> nrf_ble_gatt: Requesting to update ATT MTU to 185 bytes on connection 0x0.
00> <info> app: BLE_GAP_EVT_CONNECTED (1st connection)
00> <debug> app: state=1
00> <debug> nrf_ble_gatt: ATT MTU updated to 185 bytes on connection 0x0 (response).
00> <debug> app: _securityRequestHandler
00> <info> app: BLE_GAP_EVT_SEC_PARAMS_REQUEST
00> <info> app: PM_EVT_CONN_SEC_SUCCEEDED
00> <info> app: Connection secured: role: 1, conn_handle: 0x0, procedure: 1.
00> <debug> nrf_ble_gatt: Requesting to update ATT MTU to 185 bytes on connection 0x0.
00> <info> app: PM_EVT_BONDED_PEER_CONNECTED
00> <info> app: BLE_GAP_EVT_CONNECTED (2nd connection)
00> <debug> app: state=1
00> <debug> nrf_ble_gatt: ATT MTU updated to 185 bytes on connection 0x0 (response).

[snowuyl]

Thanks for your reply! I have another question that is how can I modify nRF52832 firmware to reject unencrypted link connecting?

[Einar Thorsrud]

Hi,

It depends a bit on what you mean. Do you want to only allow already bonded peers to connect? If so, advertising with whitelisting is what you want, and in that case you add the bonded peer(s) to the whitelist, an ignore connections from any non-whitelisted device. This is commonly done, and you can see an example of this in the ANCS example that you are using (search for "whitelist").

If you on the other hand want to allow any device to connect, but disconnect if the link is not encrypted there is no standard way to do this. You could achieve it by for instance starting a timer when you get the BLE_GAP_EVT_CONNECTED event, and stop the timer if you get the PM_EVT_CONN_SEC_SUCCEEDED event. If not, and the timer runs out, disconnect.

In any case though, you can configure security restrictions on each characteristic to prevent a peer from accessing them without having the right level of security (for instance minimum just works legacy pairing, or minimum LESC with authentication), etc.

[snowuyl]

I am using nRF Connect v3.0.1. And I check "Enable LE Secure Connection" and "Performing bonding". And then I click But when I click "Pair ...". But nRF Connect doesn't show window for me to enter paskey and still shows "Not bonded, Unencrypted link". Do I need to check other options? 

The following is log messages of nRF52832 device with ble_app_ancs_c example.

00> BLE_ADV_EVT_WHITELIST_REQUEST
00> BLE_ADV_EVT_FAST
00> Hello World!..

[snowuyl]

[Einar Thorsrud]

Did you initiate pairing here? I do not see that from the log? And did you do the fixes to your firmware that I described in my previous post, ensuring that your main loop is not blocked? With that this should work and does on my end.