BLE 协议栈：ATT 安全

BLE 协议栈：ATT 安全

• 前言
• 一、定义
• • [1、ATT 安全概述](#1、ATT 安全概述)
• 二、前提条件
• 三、依赖关系
• • 1、安全机制架构
  • 2、与其他层的关系
• 四、安全模式
• • 1、安全模式概述
  • [2、Mode 1 - 链路层安全模式](#2、Mode 1 - 链路层安全模式)
  • [3、Mode 2 - 应用层安全模式](#3、Mode 2 - 应用层安全模式)
  • 4、安全模式选择流程
• 五、访问权限
• • 1、权限类型
  • 2、权限检查流程
• 六、加密要求
• • 1、加密级别
  • 2、加密状态检查
  • 3、加密密钥大小
  • 4、错误代码
• 七、认证要求
• • 1、认证级别
  • 2、认证方法
  • 3、认证状态
  • 4、认证错误代码
• 八、授权要求
• • 1、授权流程
  • 2、授权状态
• 九、安全操作超时
• • 1、超时参数
  • 2、超时处理
• 十、配对与绑定
• • 1、配对流程
  • 2、绑定数据结构
• 十一、安全参数配置
• • [1、GAP 安全参数](#1、GAP 安全参数)
  • [2、IO 能力](#2、IO 能力)
  • 3、密钥分发
• 十二、安全检查实现
• • 1、检查流程图
  • 2、权限检查表
• 十三、错误处理
• • 1、安全相关错误
  • 2、错误响应示例

前言

ATT 安全机制是保障蓝牙数据传输安全的重要组成部分，通过属性访问权限控制、安全模式管理以及认证和授权验证等多层防护措施，确保敏感数据不会被未授权的设备访问或窃取。理解 ATT 安全机制对于开发安全可靠的蓝牙应用至关重要。

一、定义

1、ATT 安全概述

规范位置：Bluetooth Core Specification v5.2, Vol 3, Part F, Section 5 / Vol 1, Part E

核心职责：

• 属性访问权限控制 ------ 定义哪些客户端可以访问哪些属性；
• 安全模式管理 ------ 管理不同级别的安全要求；
• 认证和授权验证 ------ 验证设备的身份和用户的权限。

---

二、前提条件

在深入理解 ATT 安全之前，建议先掌握以下内容：

• ATT 层概述（参见 01_ATT_Overview.md）；
• ATT PDU 格式（参见 03_ATT_PDUs.md）；
• 安全管理器协议 (SMP) 的基本概念；
• 加密和认证的基础知识。

---

三、依赖关系

1、安全机制架构

ATT 安全机制涉及协议栈的多个层级，各层协同工作以提供端到端的安全保障：
#mermaid-svg-d6zLFPV2o4XireaY{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-d6zLFPV2o4XireaY .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-d6zLFPV2o4XireaY .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-d6zLFPV2o4XireaY .error-icon{fill:#552222;}#mermaid-svg-d6zLFPV2o4XireaY .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-d6zLFPV2o4XireaY .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-d6zLFPV2o4XireaY .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-d6zLFPV2o4XireaY .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-d6zLFPV2o4XireaY .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-d6zLFPV2o4XireaY .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-d6zLFPV2o4XireaY .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-d6zLFPV2o4XireaY .marker{fill:#333333;stroke:#333333;}#mermaid-svg-d6zLFPV2o4XireaY .marker.cross{stroke:#333333;}#mermaid-svg-d6zLFPV2o4XireaY svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-d6zLFPV2o4XireaY p{margin:0;}#mermaid-svg-d6zLFPV2o4XireaY .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-d6zLFPV2o4XireaY .cluster-label text{fill:#333;}#mermaid-svg-d6zLFPV2o4XireaY .cluster-label span{color:#333;}#mermaid-svg-d6zLFPV2o4XireaY .cluster-label span p{background-color:transparent;}#mermaid-svg-d6zLFPV2o4XireaY .label text,#mermaid-svg-d6zLFPV2o4XireaY span{fill:#333;color:#333;}#mermaid-svg-d6zLFPV2o4XireaY .node rect,#mermaid-svg-d6zLFPV2o4XireaY .node circle,#mermaid-svg-d6zLFPV2o4XireaY .node ellipse,#mermaid-svg-d6zLFPV2o4XireaY .node polygon,#mermaid-svg-d6zLFPV2o4XireaY .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-d6zLFPV2o4XireaY .rough-node .label text,#mermaid-svg-d6zLFPV2o4XireaY .node .label text,#mermaid-svg-d6zLFPV2o4XireaY .image-shape .label,#mermaid-svg-d6zLFPV2o4XireaY .icon-shape .label{text-anchor:middle;}#mermaid-svg-d6zLFPV2o4XireaY .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-d6zLFPV2o4XireaY .rough-node .label,#mermaid-svg-d6zLFPV2o4XireaY .node .label,#mermaid-svg-d6zLFPV2o4XireaY .image-shape .label,#mermaid-svg-d6zLFPV2o4XireaY .icon-shape .label{text-align:center;}#mermaid-svg-d6zLFPV2o4XireaY .node.clickable{cursor:pointer;}#mermaid-svg-d6zLFPV2o4XireaY .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-d6zLFPV2o4XireaY .arrowheadPath{fill:#333333;}#mermaid-svg-d6zLFPV2o4XireaY .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-d6zLFPV2o4XireaY .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-d6zLFPV2o4XireaY .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-d6zLFPV2o4XireaY .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-d6zLFPV2o4XireaY .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-d6zLFPV2o4XireaY .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-d6zLFPV2o4XireaY .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-d6zLFPV2o4XireaY .cluster text{fill:#333;}#mermaid-svg-d6zLFPV2o4XireaY .cluster span{color:#333;}#mermaid-svg-d6zLFPV2o4XireaY div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-d6zLFPV2o4XireaY .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-d6zLFPV2o4XireaY rect.text{fill:none;stroke-width:0;}#mermaid-svg-d6zLFPV2o4XireaY .icon-shape,#mermaid-svg-d6zLFPV2o4XireaY .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-d6zLFPV2o4XireaY .icon-shape p,#mermaid-svg-d6zLFPV2o4XireaY .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-d6zLFPV2o4XireaY .icon-shape .label rect,#mermaid-svg-d6zLFPV2o4XireaY .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-d6zLFPV2o4XireaY .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-d6zLFPV2o4XireaY .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-d6zLFPV2o4XireaY :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} ATT 安全
安全模式
访问权限
认证/授权
Mode 1 - 无安全
Mode 2 - 应用层安全
Mode 3 - 链路层安全
Readable
Writable
Encrypt Required
Authentication Required
配对绑定
链接加密

2、与其他层的关系

┌─────────────────────────────────────────────────────────────┐
│  ATT 安全与其他协议层的关系                                 │
│                                                             │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  应用层/GATT                                        │   │
│  │  - 定义属性权限                                    │   │
│  └─────────────────────────────────────────────────────┘   │
│                         ↓                                  │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  ATT 层                                            │   │
│  │  - 权限检查                                        │   │
│  │  - 安全模式管理                                    │   │
│  └─────────────────────────────────────────────────────┘   │
│                         ↓                                  │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  L2CAP 层                                          │   │
│  │  - 加密状态传递                                    │   │
│  └─────────────────────────────────────────────────────┘   │
│                         ↓                                  │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  链路层                                            │   │
│  │  - 链路加密                                        │   │
│  └─────────────────────────────────────────────────────┘   │
│                         ↓                                  │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  SMP                                                │   │
│  │  - 配对流程                                        │   │
│  │  - 密钥分发                                        │   │
│  └─────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────┘

---

四、安全模式

1、安全模式概述

ATT 协议定义了三种不同的安全模式，以满足不同应用场景的安全需求：

模式	级别	说明
Mode 1	Level 1-4	链路层安全模式
Mode 2	Level 1-2	应用层安全模式
Mode 3	-	BR/EDR 链路层安全

2、Mode 1 - 链路层安全模式

级别	要求	说明
Level 1	No Security	无安全要求
Level 2	Unauthenticated Pairing	未认证配对
Level 3	Authenticated Pairing	认证配对
Level 4	Authenticated LE Secure Connections	认证 + 安全连接

3、Mode 2 - 应用层安全模式

级别	要求	说明
Level 1	No Security	无安全要求
Level 2	Authenticated Pairing	认证配对

4、安全模式选择流程

#mermaid-svg-oOLjlsBsBjXZQMN2{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-oOLjlsBsBjXZQMN2 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-oOLjlsBsBjXZQMN2 .error-icon{fill:#552222;}#mermaid-svg-oOLjlsBsBjXZQMN2 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-oOLjlsBsBjXZQMN2 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-oOLjlsBsBjXZQMN2 .marker.cross{stroke:#333333;}#mermaid-svg-oOLjlsBsBjXZQMN2 svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-oOLjlsBsBjXZQMN2 p{margin:0;}#mermaid-svg-oOLjlsBsBjXZQMN2 .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-oOLjlsBsBjXZQMN2 .cluster-label text{fill:#333;}#mermaid-svg-oOLjlsBsBjXZQMN2 .cluster-label span{color:#333;}#mermaid-svg-oOLjlsBsBjXZQMN2 .cluster-label span p{background-color:transparent;}#mermaid-svg-oOLjlsBsBjXZQMN2 .label text,#mermaid-svg-oOLjlsBsBjXZQMN2 span{fill:#333;color:#333;}#mermaid-svg-oOLjlsBsBjXZQMN2 .node rect,#mermaid-svg-oOLjlsBsBjXZQMN2 .node circle,#mermaid-svg-oOLjlsBsBjXZQMN2 .node ellipse,#mermaid-svg-oOLjlsBsBjXZQMN2 .node polygon,#mermaid-svg-oOLjlsBsBjXZQMN2 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-oOLjlsBsBjXZQMN2 .rough-node .label text,#mermaid-svg-oOLjlsBsBjXZQMN2 .node .label text,#mermaid-svg-oOLjlsBsBjXZQMN2 .image-shape .label,#mermaid-svg-oOLjlsBsBjXZQMN2 .icon-shape .label{text-anchor:middle;}#mermaid-svg-oOLjlsBsBjXZQMN2 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-oOLjlsBsBjXZQMN2 .rough-node .label,#mermaid-svg-oOLjlsBsBjXZQMN2 .node .label,#mermaid-svg-oOLjlsBsBjXZQMN2 .image-shape .label,#mermaid-svg-oOLjlsBsBjXZQMN2 .icon-shape .label{text-align:center;}#mermaid-svg-oOLjlsBsBjXZQMN2 .node.clickable{cursor:pointer;}#mermaid-svg-oOLjlsBsBjXZQMN2 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-oOLjlsBsBjXZQMN2 .arrowheadPath{fill:#333333;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-oOLjlsBsBjXZQMN2 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-oOLjlsBsBjXZQMN2 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-oOLjlsBsBjXZQMN2 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-oOLjlsBsBjXZQMN2 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-oOLjlsBsBjXZQMN2 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-oOLjlsBsBjXZQMN2 .cluster text{fill:#333;}#mermaid-svg-oOLjlsBsBjXZQMN2 .cluster span{color:#333;}#mermaid-svg-oOLjlsBsBjXZQMN2 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-oOLjlsBsBjXZQMN2 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-oOLjlsBsBjXZQMN2 rect.text{fill:none;stroke-width:0;}#mermaid-svg-oOLjlsBsBjXZQMN2 .icon-shape,#mermaid-svg-oOLjlsBsBjXZQMN2 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-oOLjlsBsBjXZQMN2 .icon-shape p,#mermaid-svg-oOLjlsBsBjXZQMN2 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-oOLjlsBsBjXZQMN2 .icon-shape .label rect,#mermaid-svg-oOLjlsBsBjXZQMN2 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-oOLjlsBsBjXZQMN2 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-oOLjlsBsBjXZQMN2 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-oOLjlsBsBjXZQMN2 :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 只读
只写
读写
否
是
否
是
否
是
否
是
否
是
ATT 操作请求
属性权限
加密要求?
加密要求?
加密+认证要求?
允许访问
链路已加密?
已认证?
触发加密
触发认证

---

五、访问权限

1、权限类型

每个属性都可以定义多个访问权限，用于控制客户端对该属性的访问能力：

权限类型	说明	缩写
Readable	可读取	R
Writable	可写入	W
Readable + Authentication	需认证后读取	R + Auth
Writable + Authentication	需认证后写入	W + Auth
Readable + Authorization	需授权后读取	R + Authz
Writable + Authorization	需授权后写入	W + Authz
Readable + Encryption	需加密后读取	R + Enc
Writable + Encryption	需加密后写入	W + Enc

2、权限检查流程

#mermaid-svg-aahlQW9iCKKYaWa4{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-aahlQW9iCKKYaWa4 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-aahlQW9iCKKYaWa4 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-aahlQW9iCKKYaWa4 .error-icon{fill:#552222;}#mermaid-svg-aahlQW9iCKKYaWa4 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-aahlQW9iCKKYaWa4 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-aahlQW9iCKKYaWa4 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-aahlQW9iCKKYaWa4 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-aahlQW9iCKKYaWa4 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-aahlQW9iCKKYaWa4 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-aahlQW9iCKKYaWa4 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-aahlQW9iCKKYaWa4 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-aahlQW9iCKKYaWa4 .marker.cross{stroke:#333333;}#mermaid-svg-aahlQW9iCKKYaWa4 svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-aahlQW9iCKKYaWa4 p{margin:0;}#mermaid-svg-aahlQW9iCKKYaWa4 .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-aahlQW9iCKKYaWa4 .cluster-label text{fill:#333;}#mermaid-svg-aahlQW9iCKKYaWa4 .cluster-label span{color:#333;}#mermaid-svg-aahlQW9iCKKYaWa4 .cluster-label span p{background-color:transparent;}#mermaid-svg-aahlQW9iCKKYaWa4 .label text,#mermaid-svg-aahlQW9iCKKYaWa4 span{fill:#333;color:#333;}#mermaid-svg-aahlQW9iCKKYaWa4 .node rect,#mermaid-svg-aahlQW9iCKKYaWa4 .node circle,#mermaid-svg-aahlQW9iCKKYaWa4 .node ellipse,#mermaid-svg-aahlQW9iCKKYaWa4 .node polygon,#mermaid-svg-aahlQW9iCKKYaWa4 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-aahlQW9iCKKYaWa4 .rough-node .label text,#mermaid-svg-aahlQW9iCKKYaWa4 .node .label text,#mermaid-svg-aahlQW9iCKKYaWa4 .image-shape .label,#mermaid-svg-aahlQW9iCKKYaWa4 .icon-shape .label{text-anchor:middle;}#mermaid-svg-aahlQW9iCKKYaWa4 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-aahlQW9iCKKYaWa4 .rough-node .label,#mermaid-svg-aahlQW9iCKKYaWa4 .node .label,#mermaid-svg-aahlQW9iCKKYaWa4 .image-shape .label,#mermaid-svg-aahlQW9iCKKYaWa4 .icon-shape .label{text-align:center;}#mermaid-svg-aahlQW9iCKKYaWa4 .node.clickable{cursor:pointer;}#mermaid-svg-aahlQW9iCKKYaWa4 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-aahlQW9iCKKYaWa4 .arrowheadPath{fill:#333333;}#mermaid-svg-aahlQW9iCKKYaWa4 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-aahlQW9iCKKYaWa4 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-aahlQW9iCKKYaWa4 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-aahlQW9iCKKYaWa4 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-aahlQW9iCKKYaWa4 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-aahlQW9iCKKYaWa4 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-aahlQW9iCKKYaWa4 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-aahlQW9iCKKYaWa4 .cluster text{fill:#333;}#mermaid-svg-aahlQW9iCKKYaWa4 .cluster span{color:#333;}#mermaid-svg-aahlQW9iCKKYaWa4 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-aahlQW9iCKKYaWa4 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-aahlQW9iCKKYaWa4 rect.text{fill:none;stroke-width:0;}#mermaid-svg-aahlQW9iCKKYaWa4 .icon-shape,#mermaid-svg-aahlQW9iCKKYaWa4 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-aahlQW9iCKKYaWa4 .icon-shape p,#mermaid-svg-aahlQW9iCKKYaWa4 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-aahlQW9iCKKYaWa4 .icon-shape .label rect,#mermaid-svg-aahlQW9iCKKYaWa4 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-aahlQW9iCKKYaWa4 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-aahlQW9iCKKYaWa4 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-aahlQW9iCKKYaWa4 :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} Read
Write
是
否
是
否
否
否
是
是
否
否
否
否
是
是
否
否
是
是
是
是
否
否
是
是
收到 ATT 操作
操作类型
检查读权限
检查写权限
需要加密?
需要加密?
链路已加密?
需要认证?
链路已加密?
需要认证?
触发加密或返回错误
已认证?
已认证?
需要授权?
需要授权?
触发认证或返回错误
已授权?
已授权?
触发授权或返回错误
权限检查通过
返回错误 0x0F

---

六、加密要求

1、加密级别

级别	说明	最小密钥长度
Level 1	No Encryption	无
Level 2	Encryption Required	7 字节 (56 位)
Level 3	Encryption Required + MITM	16 字节 (128 位)

2、加密状态检查

属性权限	需要的加密状态
None	无要求
Encryption Required	链路已加密
Authentication Required	已认证配对
Authorization Required	已授权

3、加密密钥大小

密钥大小	适用场景
7 字节 (56 位)	LE Legacy 配对
16 字节 (128 位)	LE Secure Connections

4、错误代码

错误代码	名称	说明
0x0F	Insufficient Encryption	加密不足
0x0C	Insufficient Encryption Key Size	加密密钥长度不足

---

七、认证要求

1、认证级别

级别	说明	MITM 保护
No Authentication	无认证	否
Unauthenticated	未认证配对	否
Authenticated	认证配对	是

2、认证方法

方法	配对模式	说明
Just Works	LE Legacy / Secure	无认证
Passkey Entry	LE Legacy / Secure	6 位数字码
OOB	LE Legacy / Secure	带外认证数据
Numeric Comparison	LE Secure Only	6 位数字比较

3、认证状态

状态	说明
Unauthenticated	未认证配对
Authenticated	认证配对 (MITM 保护)

4、认证错误代码

错误代码	名称	说明
0x05	Insufficient Authentication	认证不足
0x08	Insufficient Authorization	授权不足

---

八、授权要求

1、授权流程

User Server Client User Server Client #mermaid-svg-j2zwojbj2nOWEK73{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-j2zwojbj2nOWEK73 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-j2zwojbj2nOWEK73 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-j2zwojbj2nOWEK73 .error-icon{fill:#552222;}#mermaid-svg-j2zwojbj2nOWEK73 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-j2zwojbj2nOWEK73 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-j2zwojbj2nOWEK73 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-j2zwojbj2nOWEK73 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-j2zwojbj2nOWEK73 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-j2zwojbj2nOWEK73 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-j2zwojbj2nOWEK73 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-j2zwojbj2nOWEK73 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-j2zwojbj2nOWEK73 .marker.cross{stroke:#333333;}#mermaid-svg-j2zwojbj2nOWEK73 svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-j2zwojbj2nOWEK73 p{margin:0;}#mermaid-svg-j2zwojbj2nOWEK73 .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-j2zwojbj2nOWEK73 text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-j2zwojbj2nOWEK73 .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-j2zwojbj2nOWEK73 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-j2zwojbj2nOWEK73 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-j2zwojbj2nOWEK73 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-j2zwojbj2nOWEK73 #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-j2zwojbj2nOWEK73 .sequenceNumber{fill:white;}#mermaid-svg-j2zwojbj2nOWEK73 #sequencenumber{fill:#333;}#mermaid-svg-j2zwojbj2nOWEK73 #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-j2zwojbj2nOWEK73 .messageText{fill:#333;stroke:none;}#mermaid-svg-j2zwojbj2nOWEK73 .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-j2zwojbj2nOWEK73 .labelText,#mermaid-svg-j2zwojbj2nOWEK73 .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-j2zwojbj2nOWEK73 .loopText,#mermaid-svg-j2zwojbj2nOWEK73 .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-j2zwojbj2nOWEK73 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-j2zwojbj2nOWEK73 .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-j2zwojbj2nOWEK73 .noteText,#mermaid-svg-j2zwojbj2nOWEK73 .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-j2zwojbj2nOWEK73 .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-j2zwojbj2nOWEK73 .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-j2zwojbj2nOWEK73 .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-j2zwojbj2nOWEK73 .actorPopupMenu{position:absolute;}#mermaid-svg-j2zwojbj2nOWEK73 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-j2zwojbj2nOWEK73 .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-j2zwojbj2nOWEK73 .actor-man circle,#mermaid-svg-j2zwojbj2nOWEK73 line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-j2zwojbj2nOWEK73 :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 检查认证状态 alt 授权通过 授权拒绝 alt 已认证 未认证 ATT 操作 (需要授权) 授权请求 授权响应 执行操作 Error Response (0x08: Insufficient Authorization) Error Response (0x05: Insufficient Authentication)

2、授权状态

状态	说明
Not Authorized	未授权
Authorized	已授权

---

九、安全操作超时

1、超时参数

参数	值	说明
ATT_Timeout	30 秒	ATT 操作默认超时
Authentication Timeout	30 秒	认证操作超时
Indication Timeout	30 秒	指示确认超时

2、超时处理

#mermaid-svg-pyLEVZ7FnCWQpEvi{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-pyLEVZ7FnCWQpEvi .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-pyLEVZ7FnCWQpEvi .error-icon{fill:#552222;}#mermaid-svg-pyLEVZ7FnCWQpEvi .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-pyLEVZ7FnCWQpEvi .marker{fill:#333333;stroke:#333333;}#mermaid-svg-pyLEVZ7FnCWQpEvi .marker.cross{stroke:#333333;}#mermaid-svg-pyLEVZ7FnCWQpEvi svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-pyLEVZ7FnCWQpEvi p{margin:0;}#mermaid-svg-pyLEVZ7FnCWQpEvi .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-pyLEVZ7FnCWQpEvi .cluster-label text{fill:#333;}#mermaid-svg-pyLEVZ7FnCWQpEvi .cluster-label span{color:#333;}#mermaid-svg-pyLEVZ7FnCWQpEvi .cluster-label span p{background-color:transparent;}#mermaid-svg-pyLEVZ7FnCWQpEvi .label text,#mermaid-svg-pyLEVZ7FnCWQpEvi span{fill:#333;color:#333;}#mermaid-svg-pyLEVZ7FnCWQpEvi .node rect,#mermaid-svg-pyLEVZ7FnCWQpEvi .node circle,#mermaid-svg-pyLEVZ7FnCWQpEvi .node ellipse,#mermaid-svg-pyLEVZ7FnCWQpEvi .node polygon,#mermaid-svg-pyLEVZ7FnCWQpEvi .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-pyLEVZ7FnCWQpEvi .rough-node .label text,#mermaid-svg-pyLEVZ7FnCWQpEvi .node .label text,#mermaid-svg-pyLEVZ7FnCWQpEvi .image-shape .label,#mermaid-svg-pyLEVZ7FnCWQpEvi .icon-shape .label{text-anchor:middle;}#mermaid-svg-pyLEVZ7FnCWQpEvi .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-pyLEVZ7FnCWQpEvi .rough-node .label,#mermaid-svg-pyLEVZ7FnCWQpEvi .node .label,#mermaid-svg-pyLEVZ7FnCWQpEvi .image-shape .label,#mermaid-svg-pyLEVZ7FnCWQpEvi .icon-shape .label{text-align:center;}#mermaid-svg-pyLEVZ7FnCWQpEvi .node.clickable{cursor:pointer;}#mermaid-svg-pyLEVZ7FnCWQpEvi .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-pyLEVZ7FnCWQpEvi .arrowheadPath{fill:#333333;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-pyLEVZ7FnCWQpEvi .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-pyLEVZ7FnCWQpEvi .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-pyLEVZ7FnCWQpEvi .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-pyLEVZ7FnCWQpEvi .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-pyLEVZ7FnCWQpEvi .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-pyLEVZ7FnCWQpEvi .cluster text{fill:#333;}#mermaid-svg-pyLEVZ7FnCWQpEvi .cluster span{color:#333;}#mermaid-svg-pyLEVZ7FnCWQpEvi div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-pyLEVZ7FnCWQpEvi .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-pyLEVZ7FnCWQpEvi rect.text{fill:none;stroke-width:0;}#mermaid-svg-pyLEVZ7FnCWQpEvi .icon-shape,#mermaid-svg-pyLEVZ7FnCWQpEvi .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-pyLEVZ7FnCWQpEvi .icon-shape p,#mermaid-svg-pyLEVZ7FnCWQpEvi .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-pyLEVZ7FnCWQpEvi .icon-shape .label rect,#mermaid-svg-pyLEVZ7FnCWQpEvi .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-pyLEVZ7FnCWQpEvi .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-pyLEVZ7FnCWQpEvi .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-pyLEVZ7FnCWQpEvi :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 是
否
否
是
开始 ATT 操作
启动 Timer
操作完成?
停止 Timer
超时?
返回超时错误
终止链路或重试

---

十、配对与绑定

1、配对流程

Server Client Server Client #mermaid-svg-z1FKpBxSaGIxAjo8{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-z1FKpBxSaGIxAjo8 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-z1FKpBxSaGIxAjo8 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-z1FKpBxSaGIxAjo8 .error-icon{fill:#552222;}#mermaid-svg-z1FKpBxSaGIxAjo8 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-z1FKpBxSaGIxAjo8 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-z1FKpBxSaGIxAjo8 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-z1FKpBxSaGIxAjo8 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-z1FKpBxSaGIxAjo8 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-z1FKpBxSaGIxAjo8 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-z1FKpBxSaGIxAjo8 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-z1FKpBxSaGIxAjo8 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-z1FKpBxSaGIxAjo8 .marker.cross{stroke:#333333;}#mermaid-svg-z1FKpBxSaGIxAjo8 svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-z1FKpBxSaGIxAjo8 p{margin:0;}#mermaid-svg-z1FKpBxSaGIxAjo8 .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-z1FKpBxSaGIxAjo8 text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-z1FKpBxSaGIxAjo8 .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-z1FKpBxSaGIxAjo8 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-z1FKpBxSaGIxAjo8 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-z1FKpBxSaGIxAjo8 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-z1FKpBxSaGIxAjo8 #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-z1FKpBxSaGIxAjo8 .sequenceNumber{fill:white;}#mermaid-svg-z1FKpBxSaGIxAjo8 #sequencenumber{fill:#333;}#mermaid-svg-z1FKpBxSaGIxAjo8 #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-z1FKpBxSaGIxAjo8 .messageText{fill:#333;stroke:none;}#mermaid-svg-z1FKpBxSaGIxAjo8 .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-z1FKpBxSaGIxAjo8 .labelText,#mermaid-svg-z1FKpBxSaGIxAjo8 .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-z1FKpBxSaGIxAjo8 .loopText,#mermaid-svg-z1FKpBxSaGIxAjo8 .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-z1FKpBxSaGIxAjo8 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-z1FKpBxSaGIxAjo8 .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-z1FKpBxSaGIxAjo8 .noteText,#mermaid-svg-z1FKpBxSaGIxAjo8 .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-z1FKpBxSaGIxAjo8 .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-z1FKpBxSaGIxAjo8 .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-z1FKpBxSaGIxAjo8 .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-z1FKpBxSaGIxAjo8 .actorPopupMenu{position:absolute;}#mermaid-svg-z1FKpBxSaGIxAjo8 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-z1FKpBxSaGIxAjo8 .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-z1FKpBxSaGIxAjo8 .actor-man circle,#mermaid-svg-z1FKpBxSaGIxAjo8 line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-z1FKpBxSaGIxAjo8 :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 1. 配对特性交换 2. 密钥生成 计算 DHKey alt Legacy Pairing Secure Connections 3. 绑定 (可选) alt 绑定 4. 加密启用 Pairing Request Pairing Response STK (Short Term Key) ECDH 公共密钥 ECDH 公共密钥 LTK + IRK + CSRK LTK + IRK + CSRK 启用加密 加密完成

2、绑定数据结构

数据项	说明
LTK	长期密钥 (Link Key)
EDIV	EDIV (LE)
RAND	随机数 (LE)
IRK	身份解析密钥
BD_ADDR	蓝牙设备地址
CSRK	连接签名解析密钥

---

十一、安全参数配置

1、GAP 安全参数

参数	值	说明
Bonding	true/false	是否绑定
MITM Protection	true/false	MITM 保护要求
IO Capability	See Below	IO 能力
Max Key Size	7-16	最大密钥大小
Initial Key Distribution	See Below	密钥分发设置

2、IO 能力

IO Capability	说明
DisplayOnly	仅显示
DisplayYesNo	显示 + 是/否按钮
KeyboardOnly	仅键盘
NoInputNoOutput	无输入无输出
KeyboardDisplay	键盘 + 显示

3、密钥分发

标志位	说明
Bonding_Flags0	LTK 分发
Bonding_Flags1	IRK 分发
Bonding_Flags2	CSRK 分发

---

十二、安全检查实现

1、检查流程图

#mermaid-svg-Razam4m4VpBRbMEA{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-Razam4m4VpBRbMEA .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-Razam4m4VpBRbMEA .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-Razam4m4VpBRbMEA .error-icon{fill:#552222;}#mermaid-svg-Razam4m4VpBRbMEA .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-Razam4m4VpBRbMEA .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-Razam4m4VpBRbMEA .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-Razam4m4VpBRbMEA .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-Razam4m4VpBRbMEA .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-Razam4m4VpBRbMEA .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-Razam4m4VpBRbMEA .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-Razam4m4VpBRbMEA .marker{fill:#333333;stroke:#333333;}#mermaid-svg-Razam4m4VpBRbMEA .marker.cross{stroke:#333333;}#mermaid-svg-Razam4m4VpBRbMEA svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-Razam4m4VpBRbMEA p{margin:0;}#mermaid-svg-Razam4m4VpBRbMEA .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-Razam4m4VpBRbMEA .cluster-label text{fill:#333;}#mermaid-svg-Razam4m4VpBRbMEA .cluster-label span{color:#333;}#mermaid-svg-Razam4m4VpBRbMEA .cluster-label span p{background-color:transparent;}#mermaid-svg-Razam4m4VpBRbMEA .label text,#mermaid-svg-Razam4m4VpBRbMEA span{fill:#333;color:#333;}#mermaid-svg-Razam4m4VpBRbMEA .node rect,#mermaid-svg-Razam4m4VpBRbMEA .node circle,#mermaid-svg-Razam4m4VpBRbMEA .node ellipse,#mermaid-svg-Razam4m4VpBRbMEA .node polygon,#mermaid-svg-Razam4m4VpBRbMEA .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-Razam4m4VpBRbMEA .rough-node .label text,#mermaid-svg-Razam4m4VpBRbMEA .node .label text,#mermaid-svg-Razam4m4VpBRbMEA .image-shape .label,#mermaid-svg-Razam4m4VpBRbMEA .icon-shape .label{text-anchor:middle;}#mermaid-svg-Razam4m4VpBRbMEA .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-Razam4m4VpBRbMEA .rough-node .label,#mermaid-svg-Razam4m4VpBRbMEA .node .label,#mermaid-svg-Razam4m4VpBRbMEA .image-shape .label,#mermaid-svg-Razam4m4VpBRbMEA .icon-shape .label{text-align:center;}#mermaid-svg-Razam4m4VpBRbMEA .node.clickable{cursor:pointer;}#mermaid-svg-Razam4m4VpBRbMEA .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-Razam4m4VpBRbMEA .arrowheadPath{fill:#333333;}#mermaid-svg-Razam4m4VpBRbMEA .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-Razam4m4VpBRbMEA .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-Razam4m4VpBRbMEA .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Razam4m4VpBRbMEA .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-Razam4m4VpBRbMEA .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Razam4m4VpBRbMEA .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-Razam4m4VpBRbMEA .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-Razam4m4VpBRbMEA .cluster text{fill:#333;}#mermaid-svg-Razam4m4VpBRbMEA .cluster span{color:#333;}#mermaid-svg-Razam4m4VpBRbMEA div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-Razam4m4VpBRbMEA .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-Razam4m4VpBRbMEA rect.text{fill:none;stroke-width:0;}#mermaid-svg-Razam4m4VpBRbMEA .icon-shape,#mermaid-svg-Razam4m4VpBRbMEA .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Razam4m4VpBRbMEA .icon-shape p,#mermaid-svg-Razam4m4VpBRbMEA .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-Razam4m4VpBRbMEA .icon-shape .label rect,#mermaid-svg-Razam4m4VpBRbMEA .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Razam4m4VpBRbMEA .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-Razam4m4VpBRbMEA .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-Razam4m4VpBRbMEA :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} Read
Write
需要加密
需要加密
否
否
是
是
是
否
否
是
是
否
否
是
无需加密
无需加密
ATT Request
操作类型
R 属性定义
W 属性定义
链路已加密?
链路已加密?
返回 0x0F
需要认证?
已认证?
需要授权?
返回 0x05
已授权?
返回 0x08
执行操作
错误
成功

2、权限检查表

权限标志	检查顺序	错误代码
Encryption Required	1. 加密状态	0x0F
Authentication Required	2. 认证状态	0x05
Authorization Required	3. 授权状态	0x08

---

十三、错误处理

1、安全相关错误

错误代码	名称	触发条件
0x05	Insufficient Authentication	需要认证但未认证
0x08	Insufficient Authorization	需要授权但未授权
0x0F	Insufficient Encryption	需要加密但链路未加密
0x0C	Insufficient Encryption Key Size	加密密钥长度不足

2、错误响应示例

┌─────────────────────────────────────────────────────────────┐
│  Error Response (Insufficient Authentication)               │
│  ┌──────────────────────────────────────────────────────┐   │
│  │  Opcode = 0x01                                       │   │
│  └──────────────────────────────────────────────────────┘   │
│  ┌──────────────────────────────────────────────────────┐   │
│  │  Request Opcode In Error = 0x0A (Read Request)      │   │
│  └──────────────────────────────────────────────────────┘   │
│  ┌──────────────────────────────────────────────────────┐   │
│  │  Attribute Handle In Error = 0x0003                 │   │
│  └──────────────────────────────────────────────────────┘   │
│  ┌──────────────────────────────────────────────────────┐   │
│  │  Error Code = 0x05 (Insufficient Authentication)   │   │
│  └──────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────┘