Peripheral MAC change

[adriand]

Hello,

if we want protect our (central) device against tracking and still allow it to connect with specific Peripheral we can use whitelist with IRK (and?) mac address (is mac still mandatory on the list with IRK?). My question - what if we want to protect peripheral and change its mac periodically, could we also use whitelists somehow to connect to the peripheral that has changed its mac but Central doesn't know that?

Let's assume we can store some IRK (or other keys) on both side before any previous operations (no bonding, etc.)

Thanks!

[Petter Myhre]

If you want to protect your central device against tracking, but still be recognizable by trusted devices you can use the random private resolvable address type. Keep in mind that as long as the device is not sending out scan requests and connection requests it is difficult to track it, because it will only be scanning.

The peripheral needs the IRK to resolve the address. It can put the IRK (only) into a whitelist if it wants to filter away scan requests and/or connection requests from other centrals.

If the peripheral uses the random private resolvable address type the central needs the IRK to resolve the address. It can put the IRK into a whitelist if it wants to filter away advertisments from other peripherals.

Typically the IRK is distributed when you bond, but with SoftDevice S130 v3.0.0 and later you can set the IRK to use with sd_ble_gap_privacy_set().

[adriand]

Sorry I'm answering so late, however thank you for your answer. Possibility of setting my own IRK keys without previous bonding is probably what I'm looking for. I was a little bit confused finding different answers about that. For eg. according to this post devzone.nordicsemi.com/.../ I try to set IRK with sd_ble_opt_set() with S130 v2.0.0, but I couldn't do that. So, to sum up, to accomplish my task I should set the same IRKs on both central and peripheral, use Resolvable Addresses for both of them, put IRKs into peripheral's advertising whitelist as well as into central connection scan parameters whitelist, am I right?

Thanks!

[Petter Myhre]

That should work. If you get into trouble implementing it, I think you should add a new question and explain what you have done. Link to this if it is relevant.

[adriand]

Great, I will. So just to be sure: there is no option to manage IRK-based connection with own pre-programmed IRKs using s130 v2.0.0 SDK11 (nRF51) without bonding, right?

[Petter Myhre]

I haven't tried it myself, but it seems to be possible with S130 v2.0.0. Isn't that what Hung is also saying in the question you linked to? Use sd_ble_opt_set() with BLE_GAP_OPT_PRIVACY and supply the IRK in ble_gap_opt_privacy_t.