BLE 协议：从端安全请求 Slave Security Request

原文

• The slave device may request security by transmitting a Security Request command to the master. When a master device receives a Security Request command it may encrypt the link, initiate the pairing procedure, or reject the request.

• The slave shall not send the Security Request command if the pairing procedure is in progress, or if the encryption procedure is in progress.

• The Security Request command includes the required security properties. A security property of MITM protection required shall only be set if the slave’s IO capabilities would allow the Passkey Entry association model to be used or out of band authentication data is available.

• The master shall ignore the slave’s Security Request if the master has sent a Pairing Request without receiving a Pairing Response from the slave or if the master has initiated encryption mode setup. If pairing or encryption mode is not supported or cannot be initiated at the time when the slave’s Security Request Command is received, then the master shall respond with a Pairing Failed Command with the reason set to “Pairing Not Supported.”

• After receiving a Security Request, the master shall first check whether it has the required security information to enable encryption; see Section 2.4.4.2. If this information is missing or does not meet the security properties requested by the slave, then the master shall initiate the pairing procedure. If the pairing procedure is successful, the master’s security database is updated with the keys and security properties are distributed during the pairing procedure.

• If the master has the required security information to enable encryption and it meets the security properties request by the slave, it shall perform encryption setup using LTK, see Section 2.4.4.2.

译文

• 从属设备可以通过发送安全请求命令到主机去请求安全配对。当主设备收到安全请求命令时，它可以加密链路信息，初始化配对过程，或者拒绝该请求。

• 从机在处理配对过程中，或者在加密处理过程中的时候不能够发送安全请求命令。

• 安全请求命令包括设备所需要的安全属性。只有当从属的输入输出能力允许密钥输入关联模型使用或者带外身份验证数据可用时才需要设置中间人保护的安全属性。

• 如果主机已经发送了配对请求命令且没有收到从属设备的配对响应消息，或者主机已经启动加密模式设置，主机将忽略从属设备的安全请求。如果在接收到从属设备的安全请求命令时，不支持或不能启动配对或者加密模式，主机将回应一个配对失败的命令，原因是“不支持的配对”。

• 当收到安全请求命令时，主设置首先会检查它是否有需要的安全信息去使能加密；查看 2.4.4.2 章节。如果信息丢失或者不满足从属设备所需要的安全属性，之后主机将启动配对流程。，如果配对过程成功，主机的安全数据将在配对过程中使用密钥和安全属性进行更新

• 如果主机拥有从属设备所需要的安全信息去使能加密并且满足安全属性，它将使用 LTK 执行加密设置，查看2.4.4.2章节。

摘自：Core V4.2 Vol3 Part H: Security Manager Specification 2.4.6