QN908x BLE application fails to pair and bond with BLE version 4.0

[kishansaralaya]

Hello ,
Taken the FreeRTOS "wireless_example\Hid_device" example from the SDK example.
Configure the pairing parameters to 

.securityModeAndLevel = gSecurityMode_1_Level_2_c,
.maxEncryptionKeySize = mcEncryptionKeySize_c,
.localIoCapabilities = gIoNone_c,//gIoDisplayOnly_c,  and keeping the other fields as it is in the source\app_config.c file.

And configured gAppUsePairing_d, gAppUseBonding_d and gAppUseNvm_d variable to  1  in file app_preinclude.h, 
 The BLE Central Device with BLE stack version 4.0 is able to connect but fails to pair and bond. Which mean BLE 4.0 Central device is not able to communicate with Hid_device application loaded in QN908x. This example application works fine in a system which is loaded with BLE 4.2v

And configured gAppUsePairing_d, gAppUseBonding_d and gAppUseNvm_d variable to  0, 
 The BLE Central Device with BLE stack version 4.0 is able to connect and communicate with application attributes.  But when I tested this application on Windows 10 loaded Laptop (which is configured with BLE v4.2 ) - PC is able to connect and pair but right after this BLE connection gets disconnected and windows OS shows "Driver error" in front of the BLE friendly name "NXP_BLE_HID" in Settings page.

So would like to know what configuration needs to be followed in order to make the  BLE application work in both Legacy and current version. And we would like to have gSecurityMode_1_Level_2_c security level ( Unauthenticated and Encryption .

Note: Development setup  in my side had SDK v2.2.1 and MCUXpresso IDE v11.1.0 [Build 3209]

[kishansaralaya]

It looks like the Central device does not store/save the Bonding information, due to this failure authentication is getting failed. In non - QN908x controller we saw there is option to skip the bonding check which is not there in the QN908x controller. So let me know if there is any such option available or else we can make this thread as resolved.

Regards and Thanks,

   Kishan

[mario_castaneda]

Hi Kishan,

As I am understanding the QN9080 is the central device, isn't it? How are you checking that the device is not saving the bonding information? Is the slave address private or public?

Please look at the temperature collector example, the bonding and pairing are enabled.

Regards,

Mario

[kishansaralaya]

Hi Mario,

No, As I mentioned in my first message bonding is failing on Central device which is running with BLE 4.0. 
QN908x is going to be acting as Peripheral device and the pairing parameters are as mentioned in the first message.

Regards,

 kishan  

[mario_castaneda]

Hi Kishan,

I am not sure of the Central configuration. however, be sure that your services are not defined as Secure connections.

Mario

Regards,

Mario

[mario_castaneda]

Hi Kishan,

I hope you are doing great.

Do you know the reason for the disconnection? You could look at it in the structure connection event in the API BleApp_ConnectionCallback.

Did you change the security services of your device?

Remember, if the QN9080 requires authentication or encryption for one of the devices it could reject the connection.

Regards,

Mario

[kishansaralaya]

Hi Mario,

 Am doing good, thank you.

As you suggested I checked the disconnection reason, it looks like Authentication request (event gConnEvtAuthenticationRejected_c) is getting rejected by the BLE Central (BLE Stack v4.0). 

Did you change the security services of your device?
- I modified all the HID services defined in the HID_Device example to gSecurityMode_1_Level_2_c. 

Remember, if the QN9080 requires authentication or encryption for one of the devices it could reject the connection.

 - Sorry am not fully comprehend the above statement. In this example HID_Device pairing process is defined as Unauthenticated_Encrypted (gSecurityMode_1_Level_2_c) Connection. 
 
Is there any specific reason or way to know why the Bonding is failing. Does the Central device needs to have any specific IO capabilities to support Bonding.  

[mario_castaneda]

Hi Kishan,

Is there any specific reason or way to know why the Bonding is failing. Does the Central device need to have any specific IO capabilities to support Bonding? 

It is possible to have bonding and pairing without capabilities. But you are not protected from the MITM.

/* SMP Data */
gapPairingParameters_t gPairingParameters = {
    .withBonding = (bool_t)gAppUseBonding_d,
    .securityModeAndLevel = gSecurityMode_1_Level_2_c,
    .maxEncryptionKeySize = mcEncryptionKeySize_c,
    .localIoCapabilities = gIoNone_c, //gIoDisplayOnly_c,
    .oobAvailable = FALSE,
    .centralKeys = gIrk_c,
    .peripheralKeys = (gapSmpKeyFlags_t) (gLtk_c|gIrk_c),
    .leSecureConnectionSupported = TRUE, //FALSE,
    .useKeypressNotifications = FALSE,
};


static const gapServiceSecurityRequirements_t serviceSecurity[] = {
  {
    .requirements = {
        .securityModeLevel = gSecurityMode_1_Level_2_c,
        .authorization = FALSE,
        .minimumEncryptionKeySize = gDefaultEncryptionKeySize_d
    },
.
.‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Regards,

Mario

[kishansaralaya]

Hi Mario, 

As for my knowledge if the Central BLE device has predefined memory space to save the bonded device information it should support the bonding.  

When the bonding is enabled the MITM attack can happen only at the pairing process, after this connection takes place with the central device by using the stored encryption key. So this way its better than Just connect without bonding/pairing.

Regards and Thanks,

   Kishan

[mario_castaneda]

Hi Kishan,

Both devices save the bonding information in the predefined memory space.

Yes, the MITM could happen, that is the reason for the Authentication feature that will protect with the MITM.

Regards,

Mario