How to prevent unauthorized users from connecting to Arduino BLE device?

user_1266109 0
Viewed 1332

I was looking at this BLE demo for Arduino:

https://github.com/dzindra/BLE-iOS-demo/blob/master/esp32blinky/esp32blinky.ino

I noticed that there is no "Authentication / Authorization" or explicit "Connection code".

The code consists of creating services and characteristics, and advertising them. At best you can see the following callbacks which are triggered when a client connects:

class MyServerCallbacks: public BLEServerCallbacks {
    void onConnect(BLEServer* pServer) {
      Serial.println("Connected");
    };

    void onDisconnect(BLEServer* pServer) {
      Serial.println("Disconnected");
    }
};

I was wondering what approach people follow for ensuring that users can connect to an Arduino's BLE only if they are the owner (for example, pressing a button to "trigger" connection mode) etc...

On deeper searching I found : https://github.com/nkolban/esp32-snippets/blob/master/cpp_utils/tests/BLETests/Arduino/security/BLE_server/BLE_server_passkey/BLE_server_passkey.ino

This other example shows how an ESP32 acting as a client would authenticate into a server:

https://github.com/nkolban/esp32-snippets/blob/master/cpp_utils/tests/BLETests/Arduino/security/BLE_client/BLE_client_passkey/BLE_client_passkey.ino

Both seem to be good examples for how two ESP32's could act as a client / server and authenticate each other. But then how would I get my iPhone to authenticate ? I use the following iPhone example for simply connecting without authentication.

Things seem a bit "hacky", and was wondering if there is an authoritative answer on how to connect to an Arduino BLE with authentication ?

EDIT: Basically, I wan't to prevent random people from just connecting to my BLE Device. I do not need anything more than that (I don't need encryption). I just want to prevent random people from connecting to my device, and breaking my smartphones connection with my BLE Device.

bluetooth-lowenergy swift5 arduino swift ios
1 Answers

It seems no matter what mechanism you use to verify a valid connection the problem remains that if your BLE device is actually using advertising packets to deliver data, then when someone trys to connect, until you disconnect an unauthorised connection the advertising packet transmission is interrupted. I use a small window of opportunity to write a correct value to a register otherwise resetting the connection.

user_165934960
Related