Security via training 05

10 posts / 0 new
Last post
ao
Offline
Last seen:6天前1周
Joined:2016-06-02 20:58
Security via training 05

Hi,

我目前经历训练05 security and have followed the steps and been able to connect to the device.
However, after testing for a little bit I was no longer able to connect with LightBlue. I get the error: The peripheral disconnected while being interrogated.
然后,我用不同的手机测试连接,并能够正确连接和使用设备。
进一步调查我尝试使用在Xcode上开发的我自己的iPhone应用程序连接到设备,并且能够连接到设备,但是随时会立即断开未知错误。我试过上传不同的项目,我仍然无法与手机连接我正在测试。

Could anyone point me in the direction to fix this or learn more about using the security ?

设备:
MT_dialog
Offline
Last seen:2个月2周前
Staff
Joined:2015-06-08 11:34
Hi ao,

Hi ao,

The reason of the disconnections is probably the security, after you are pair with a device and you disconnect if you try to pair again the device is going to reject the connection since its paired. Try to unbond the device from the phone and try to connect again, also you can catch the disconnection callback and check the reason of the disconnection. Regarding the fact that you get disconnected immidiatelly, is the application that you are testing your phone implements security ? the peripheral will make a security request but it is masters responsibility to start the pairing procedure, if the peripheral makes such a request and the central doesn't reply the peripheral will automatically disconnect. You can have a look at the Smart Tag project that implements security and handles the keys that are retrived by the pairing procedure.

Thanks MT_dialog

Horace Hsieh
Offline
Last seen:2 years 7 months ago
Joined:2016-05-05 16:34
Hi MT,

Hi MT,

我有类似的问题作为AO,在尝试使用训练05中打开安全性之后,如果我关闭安全性,将重新连接。

The disconnect reason is 0x16 (CO_ERROR_CO_TERM_BY_LOCAL_HOST), which does it exactly mean?

完全是,我记得在第一次,它是以某种方式成功绑定和工作的,在重置DA14580开发套件后,它被断开。
and after I forgot the bonded device from my phone (that was running with iOS 9.3.2), it still failed to be connected with security on.

Any clues?

ao
Offline
Last seen:6天前1周
Joined:2016-06-02 20:58
Horace,

Horace,
When I forgot the device from my phone, I was able to rebond with the DA14580. In order to work with the chip I am constantly having to forget the device each time I reprogram it.

Horace Hsieh
Offline
Last seen:2 years 7 months ago
Joined:2016-05-05 16:34
Hi Ao,

Hi Ao,

是的,我有着你的情况,你现在想要彻底解决它。

MT_dialog
Offline
Last seen:2个月2周前
Staff
Joined:2015-06-08 11:34
Hi Horach,

Hi Horach,

您获取co_error_co_term_by_local_host的消息是因为设备是默认拒绝连接的。如果您已启用设备中的安全性,并且设备没有绑定数据,则它将接受配对请求和与该设备的联系。如果断开连接,则重新连接过程是不同的。要与绑定设备重新连接,中央应发送加密请求。加密请求的处理程序将从中央检查安全数据,如果数据不匹配,则设备将拒绝连接。您的手机记得连接的绑定数据,但如果您的循环或重新编程580所有绑定数据将丢失,并且加密请求用于重新连接时,580将拒绝它。

You can catch the pairing and the encryption events in the handler functions in the user_callback_config.h file (the default_app_on_pairing_request() function should be invoked on the pairing request message and at the default_app_on_ecryption_req_ind() function should be invoked in the encryption request message in case of a disconnection and sequential reconnetion). You can test this by using the template example as is with a small modification in the user_config.h file change the .security_request_scenario with the DEF_SEC_REQ_ON_CONNECT in order to request security for connecting, this will enable you with a just works security connection.

Thanks MT_dialog

Horace Hsieh
Offline
Last seen:2 years 7 months ago
Joined:2016-05-05 16:34
Dear MT,

Dear MT,

非常感谢您的回复。

这是我在user_config.h的适应

@@ -47,9 +47,15 @ const static sleep_state_t app_default_sleep_mode = arch_sleep_off;
static const struct security_configuration user_security_configuration = {
.oob = gap_oob_auth_data_not_present,
.key_size = KEY_LEN,
+#if 1
.iocap = GAP_IO_CAP_NO_INPUT_NO_OUTPUT,
.auth = gap_auth_req_no_mitm_bond,
- .sec_req = gap_no_sec,
+ .sec_req = gap_sec1_noauth_pair_enc,
+#else.
+ .iocap = GAP_IO_CAP_KB_ONLY,
+ .auth = GAP_AUTH_REQ_MITM_BOND,
+ .sec_req = GAP_SEC1_AUTH_PAIR_ENC,
+#结束
.ikey_dist = GAP_KDIST_SIGNKEY,
.rkey_dist = GAP_KDIST_ENCKEY,
.tk={
@@ -215,7 +221,7 @@ static const struct default_handlers_configuration user_default_hnd_conf= {

//配置默认处理程序的安全开始操作
//if the security is enabled (CFG_APP_SECURITY)
- .security_request_scenario=DEF_SEC_REQ_NEVER
+ .security_request_scenario=DEF_SEC_REQ_ON_CONNECT
};

#endif // _USER_CONFIG_H_

As you guided, I caught both default_app_on_pairing_request() and default_app_on_ecryption_req_ind() functions,
但它只调用default_app_on_encryption_req_ind()。
I think it's because the peripheral has been paired with the phone before, isn't?

void default_app_on_encrypt_req_ind(uint8_t connection_idx,struct gapc_encrypt_req_ind const * param)
==>
if(app_easy_security_validate_encrypt_req_against_env(connection_idx,param))
==>
BOOL APP_EASY_SECURY_VALIDATE_ENCRYPT_REQ_AGAINST_ENV(UINT8_T CONNECTION_IDX,STRUCT GAPC_ENCRYPT_REQ_IND CONST * PARAM)
{
if(((app_sec_env[connection_idx].auth & GAP_AUTH_BOND) != 0)
...
return (true);
else
return (false); --> go false.
}

connection_idx equals 0, and app_sec_env[0] is filled with zero

Does it mean I have to save the bonding information in permanent store
as descripted in page 18 at training_05 material for multiple device bonding?

So, later, it can be checked in encrypt_req_ind, correct?

Horace Hsieh
Offline
Last seen:2 years 7 months ago
Joined:2016-05-05 16:34
嗨对话支持,

嗨对话支持,

Could you please help to answer #7? Thank you!

MT_dialog
Offline
Last seen:2个月2周前
Staff
Joined:2015-06-08 11:34
嗨霍勒斯,

嗨霍勒斯,

As i ve allready indicated, if the peripheral is allready bonded it will trigger only the encryption request function in order to check if the keys that the central has for a connection are valid. After the pairing is completed the app_sec_env of the specified connection (connection_idx) should not be zero, but should have the keys that are defined during the pairing procedure. If the device loses power the keys are not retained (app_sec_env will be set to zero) since they are stored in RAM space and yes you should store them in a flash and customize the application in order to check the flash for keys.

Thanks MT_dialog

Horace Hsieh
Offline
Last seen:2 years 7 months ago
Joined:2016-05-05 16:34
Hi MT, OK, got it and thanks!

Hi MT,

OK, got it and thanks!

Topic locked