BLE 安全机制详解：配对、绑定、密钥体系与隐私保护

你怎么知道我是队长2026-10-27 15:11

文章目录

  • [1 为什么 BLE 安全是独立的一层](#1 为什么 BLE 安全是独立的一层)
    • [1.1 SMP 在协议栈中的位置](#1.1 SMP 在协议栈中的位置)
    • [1.2 不启用安全机制的风险](#1.2 不启用安全机制的风险)
    • [1.3 学习要点](#1.3 学习要点)
  • [2 配对与绑定的基本概念](#2 配对与绑定的基本概念)
      • [2.1 配对 vs 绑定：生命周期对比](#2.1 配对 vs 绑定：生命周期对比)
  • [3 配对演进史：Legacy vs LE Secure Connections](#3 配对演进史：Legacy vs LE Secure Connections)
    • [3.1 两代配对方案对比](#3.1 两代配对方案对比)
    • [3.2 演进时间轴](#3.2 演进时间轴)
    • [3.3 Legacy Pairing 的核心问题](#3.3 Legacy Pairing 的核心问题)
    • [3.4 LE Secure Connections 的改进](#3.4 LE Secure Connections 的改进)
  • [4 安全模式与安全等级](#4 安全模式与安全等级)
    • [4.1 两种安全模式](#4.1 两种安全模式)
    • [4.2 Security Mode 1 的四个等级](#4.2 Security Mode 1 的四个等级)
    • [4.3 工程选型建议](#4.3 工程选型建议)
  • [5 配对流程三阶段详解](#5 配对流程三阶段详解)
    • [5.1 配对三阶段总览](#5.1 配对三阶段总览)
    • [5.2 阶段 1：Pairing Request/Response 关键字段](#5.2 阶段 1：Pairing Request/Response 关键字段)
    • [5.3 阶段 2：Legacy 与 LE SC 的差异](#5.3 阶段 2：Legacy 与 LE SC 的差异)
    • [5.4 阶段 3：密钥分发](#5.4 阶段 3：密钥分发)
  • [6 四种配对方法详解](#6 四种配对方法详解)
      • [6.1 四种方法对比总览](#6.1 四种方法对比总览)
    • [6.2 Just Works](#6.2 Just Works)
    • [6.3 Passkey Entry](#6.3 Passkey Entry)
    • [6.4 Numeric Comparison（LE SC 专属）](#6.4 Numeric Comparison（LE SC 专属）)
    • [6.5 OOB（Out of Band）](#6.5 OOB（Out of Band）)
  • [7 IO Capability 与配对方法选择矩阵](#7 IO Capability 与配对方法选择矩阵)
    • [7.1 配对方法选择矩阵](#7.1 配对方法选择矩阵)
    • [7.2 选择流程图](#7.2 选择流程图)
  • [8 密钥体系：STK、LTK、IRK、CSRK](#8 密钥体系：STK、LTK、IRK、CSRK)
    • [8.1 四类密钥对比](#8.1 四类密钥对比)
    • [8.2 密钥派生流程图](#8.2 密钥派生流程图)
    • [8.3 密钥用途速查表](#8.3 密钥用途速查表)
  • [9 加密与认证过程](#9 加密与认证过程)
    • [9.1 链路加密流程](#9.1 链路加密流程)
    • [9.2 GATT 权限与安全等级对应](#9.2 GATT 权限与安全等级对应)
    • [9.3 认证状态对 GATT 操作的影响](#9.3 认证状态对 GATT 操作的影响)
  • [10 绑定（Bonding）与密钥存储](#10 绑定（Bonding）与密钥存储)
    • [10.1 绑定完整流程](#10.1 绑定完整流程)
    • [10.2 绑定信息存储示意](#10.2 绑定信息存储示意)
    • [10.3 常见绑定问题排查](#10.3 常见绑定问题排查)
  • [11 地址类型与隐私保护](#11 地址类型与隐私保护)
    • [11.1 四种地址类型对比](#11.1 四种地址类型对比)
    • [11.2 RPA 解析流程图](#11.2 RPA 解析流程图)
    • [11.3 地址选择建议](#11.3 地址选择建议)
  • [12 常见安全配置与排障](#12 常见安全配置与排障)
    • [12.1 常见现象与排查方向](#12.1 常见现象与排查方向)
    • [12.2 抓包重点速查](#12.2 抓包重点速查)
    • [12.3 排障决策树](#12.3 排障决策树)
  • [13 阶段检查点](#13 阶段检查点)
  • [14 动手实验](#14 动手实验)
    • [14.1 推荐实验流程](#14.1 推荐实验流程)
  • [15 面试与工程高频问题](#15 面试与工程高频问题)
  • 阶段总结

1 为什么 BLE 安全是独立的一层

BLE 的安全机制主要由 SMP（Security Manager Protocol） 负责，它位于 L2CAP 之上，负责配对、密钥生成、密钥分发和身份认证。安全不是 GATT 的一个"可选功能"，而是贯穿连接建立、数据读写、通知订阅和绑定重连的独立体系。

1.1 SMP 在协议栈中的位置

#mermaid-svg-rorjoE7btuxPi6pq{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-rorjoE7btuxPi6pq .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-rorjoE7btuxPi6pq .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-rorjoE7btuxPi6pq .error-icon{fill:#552222;}#mermaid-svg-rorjoE7btuxPi6pq .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-rorjoE7btuxPi6pq .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-rorjoE7btuxPi6pq .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-rorjoE7btuxPi6pq .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-rorjoE7btuxPi6pq .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-rorjoE7btuxPi6pq .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-rorjoE7btuxPi6pq .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-rorjoE7btuxPi6pq .marker{fill:#333333;stroke:#333333;}#mermaid-svg-rorjoE7btuxPi6pq .marker.cross{stroke:#333333;}#mermaid-svg-rorjoE7btuxPi6pq svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-rorjoE7btuxPi6pq p{margin:0;}#mermaid-svg-rorjoE7btuxPi6pq .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-rorjoE7btuxPi6pq .cluster-label text{fill:#333;}#mermaid-svg-rorjoE7btuxPi6pq .cluster-label span{color:#333;}#mermaid-svg-rorjoE7btuxPi6pq .cluster-label span p{background-color:transparent;}#mermaid-svg-rorjoE7btuxPi6pq .label text,#mermaid-svg-rorjoE7btuxPi6pq span{fill:#333;color:#333;}#mermaid-svg-rorjoE7btuxPi6pq .node rect,#mermaid-svg-rorjoE7btuxPi6pq .node circle,#mermaid-svg-rorjoE7btuxPi6pq .node ellipse,#mermaid-svg-rorjoE7btuxPi6pq .node polygon,#mermaid-svg-rorjoE7btuxPi6pq .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-rorjoE7btuxPi6pq .rough-node .label text,#mermaid-svg-rorjoE7btuxPi6pq .node .label text,#mermaid-svg-rorjoE7btuxPi6pq .image-shape .label,#mermaid-svg-rorjoE7btuxPi6pq .icon-shape .label{text-anchor:middle;}#mermaid-svg-rorjoE7btuxPi6pq .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-rorjoE7btuxPi6pq .rough-node .label,#mermaid-svg-rorjoE7btuxPi6pq .node .label,#mermaid-svg-rorjoE7btuxPi6pq .image-shape .label,#mermaid-svg-rorjoE7btuxPi6pq .icon-shape .label{text-align:center;}#mermaid-svg-rorjoE7btuxPi6pq .node.clickable{cursor:pointer;}#mermaid-svg-rorjoE7btuxPi6pq .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-rorjoE7btuxPi6pq .arrowheadPath{fill:#333333;}#mermaid-svg-rorjoE7btuxPi6pq .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-rorjoE7btuxPi6pq .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-rorjoE7btuxPi6pq .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-rorjoE7btuxPi6pq .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-rorjoE7btuxPi6pq .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-rorjoE7btuxPi6pq .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-rorjoE7btuxPi6pq .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-rorjoE7btuxPi6pq .cluster text{fill:#333;}#mermaid-svg-rorjoE7btuxPi6pq .cluster span{color:#333;}#mermaid-svg-rorjoE7btuxPi6pq div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-rorjoE7btuxPi6pq .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-rorjoE7btuxPi6pq rect.text{fill:none;stroke-width:0;}#mermaid-svg-rorjoE7btuxPi6pq .icon-shape,#mermaid-svg-rorjoE7btuxPi6pq .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-rorjoE7btuxPi6pq .icon-shape p,#mermaid-svg-rorjoE7btuxPi6pq .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-rorjoE7btuxPi6pq .icon-shape .label rect,#mermaid-svg-rorjoE7btuxPi6pq .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-rorjoE7btuxPi6pq .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-rorjoE7btuxPi6pq .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-rorjoE7btuxPi6pq :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} Controller 层
Host 层
GATT / ATT
SMP

（安全管理者）
L2CAP

（CID=0x0006）
Link Layer

（加密引擎 AES-CCM）
PHY 物理层

关键点 ：SMP 使用固定 L2CAP CID 0x0006，所有配对/SMP 报文都通过该信道收发；加密的 AES-CCM 运算在 Link Layer 完成。

1.2 不启用安全机制的风险

问题 不启用安全机制的后果 安全机制解决方式
数据被窃听 空口数据可被嗅探 链路加密（AES-CCM）
设备被伪装 攻击者可冒充外设 认证配对、密钥验证
用户被追踪 固定 MAC 地址暴露行踪 RPA 可解析私有地址
写入被篡改 关键配置可被恶意修改 签名写入、认证加密
重连被劫持 旧密钥被复用 LTK 绑定与密钥更新

1.3 学习要点

要点 说明
SMP 的位置 位于 L2CAP 之上，使用固定 CID 0x0006
安全目标 加密、认证、授权、隐私
安全触发方式 主动配对、GATT 权限不足触发、应用层请求
安全与 GATT 的关系 GATT Characteristic 的 Permissions 可要求加密/认证

2 配对与绑定的基本概念

概念 含义 是否持久化
Pairing（配对） 双方协商密钥、建立加密链路的过程 否，通常当次连接有效
Bonding（绑定） 配对后保存密钥，供后续重连使用 是，密钥写入安全存储
Encryption（加密） 使用密钥对链路数据加密 连接级
Authentication（认证） 确认对方身份，防中间人 配对方法决定
Authorization（授权） 应用层决定某操作是否允许 应用/权限决定

2.1 配对 vs 绑定：生命周期对比

Peripheral Central 用户 Peripheral Central 用户 #mermaid-svg-CtT1e16qvm2fFlmB{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-CtT1e16qvm2fFlmB .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-CtT1e16qvm2fFlmB .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-CtT1e16qvm2fFlmB .error-icon{fill:#552222;}#mermaid-svg-CtT1e16qvm2fFlmB .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-CtT1e16qvm2fFlmB .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-CtT1e16qvm2fFlmB .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-CtT1e16qvm2fFlmB .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-CtT1e16qvm2fFlmB .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-CtT1e16qvm2fFlmB .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-CtT1e16qvm2fFlmB .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-CtT1e16qvm2fFlmB .marker{fill:#333333;stroke:#333333;}#mermaid-svg-CtT1e16qvm2fFlmB .marker.cross{stroke:#333333;}#mermaid-svg-CtT1e16qvm2fFlmB svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-CtT1e16qvm2fFlmB p{margin:0;}#mermaid-svg-CtT1e16qvm2fFlmB .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-CtT1e16qvm2fFlmB text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-CtT1e16qvm2fFlmB .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-CtT1e16qvm2fFlmB .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-CtT1e16qvm2fFlmB .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-CtT1e16qvm2fFlmB .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-CtT1e16qvm2fFlmB #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-CtT1e16qvm2fFlmB .sequenceNumber{fill:white;}#mermaid-svg-CtT1e16qvm2fFlmB #sequencenumber{fill:#333;}#mermaid-svg-CtT1e16qvm2fFlmB #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-CtT1e16qvm2fFlmB .messageText{fill:#333;stroke:none;}#mermaid-svg-CtT1e16qvm2fFlmB .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-CtT1e16qvm2fFlmB .labelText,#mermaid-svg-CtT1e16qvm2fFlmB .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-CtT1e16qvm2fFlmB .loopText,#mermaid-svg-CtT1e16qvm2fFlmB .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-CtT1e16qvm2fFlmB .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-CtT1e16qvm2fFlmB .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-CtT1e16qvm2fFlmB .noteText,#mermaid-svg-CtT1e16qvm2fFlmB .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-CtT1e16qvm2fFlmB .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-CtT1e16qvm2fFlmB .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-CtT1e16qvm2fFlmB .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-CtT1e16qvm2fFlmB .actorPopupMenu{position:absolute;}#mermaid-svg-CtT1e16qvm2fFlmB .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-CtT1e16qvm2fFlmB .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-CtT1e16qvm2fFlmB .actor-man circle,#mermaid-svg-CtT1e16qvm2fFlmB line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-CtT1e16qvm2fFlmB :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 🔵 配对阶段（Pairing） 🟢 本次连接已加密 🟡 绑定阶段（Bonding） 🔁 断开连接后，下次重连 ✅ 绑定成功，体验提升 Pairing Request 1 Pairing Response 2 执行配对方法（JW/PE/NC/OOB） 3 密钥分发（LTK/IRK/CSRK） 4 保存 LTK/IRK/CSRK 到安全存储 5 保存 LTK/IRK/CSRK 到安全存储 6 使用已保存 LTK 直接加密（无需重新配对） 7

关键理解：配对是"这次连接怎么安全通信"，绑定是"下次连接不用重新配对"。很多产品问题来自"配对了但没绑定"，导致重启后需要重新配对。

3 配对演进史：Legacy vs LE Secure Connections

3.1 两代配对方案对比

世代 BLE 对应 经典蓝牙对应 核心算法 安全性 引入版本
第一代 Legacy Pairing Legacy Pairing（PIN） STK + AES-CCM 可被被动窃听/部分中间人攻击 BLE 4.0/4.1
第二代 LE Secure Connections Secure Connections（BR/EDR 3.0+） ECDH P-256 + LTK 抗被动窃听，支持 Numeric Comparison BLE 4.2+

3.2 演进时间轴

#mermaid-svg-HAKN8D7BhCH5OPWz{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-HAKN8D7BhCH5OPWz .error-icon{fill:#552222;}#mermaid-svg-HAKN8D7BhCH5OPWz .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-HAKN8D7BhCH5OPWz .marker{fill:#333333;stroke:#333333;}#mermaid-svg-HAKN8D7BhCH5OPWz .marker.cross{stroke:#333333;}#mermaid-svg-HAKN8D7BhCH5OPWz svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-HAKN8D7BhCH5OPWz p{margin:0;}#mermaid-svg-HAKN8D7BhCH5OPWz .edge{stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .section--1 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section--1 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section--1 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section--1 path{fill:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section--1 text{fill:#ffffff;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon--1{font-size:40px;color:#ffffff;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge--1{stroke:hsl(240, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth--1{stroke-width:17;}#mermaid-svg-HAKN8D7BhCH5OPWz .section--1 line{stroke:hsl(60, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:#ffffff;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-0 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-0 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-0 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-0 path{fill:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-0 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-0{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-0{stroke:hsl(60, 100%, 73.5294117647%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-0{stroke-width:14;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-0 line{stroke:hsl(240, 100%, 83.5294117647%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-1 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-1 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-1 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-1 path{fill:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-1 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-1{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-1{stroke:hsl(80, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-1{stroke-width:11;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-1 line{stroke:hsl(260, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-2 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-2 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-2 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-2 path{fill:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-2 text{fill:#ffffff;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-2{font-size:40px;color:#ffffff;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-2{stroke:hsl(270, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-2{stroke-width:8;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-2 line{stroke:hsl(90, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:#ffffff;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-3 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-3 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-3 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-3 path{fill:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-3 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-3{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-3{stroke:hsl(300, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-3{stroke-width:5;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-3 line{stroke:hsl(120, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-4 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-4 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-4 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-4 path{fill:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-4 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-4{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-4{stroke:hsl(330, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-4{stroke-width:2;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-4 line{stroke:hsl(150, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-5 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-5 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-5 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-5 path{fill:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-5 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-5{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-5{stroke:hsl(0, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-5{stroke-width:-1;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-5 line{stroke:hsl(180, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-6 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-6 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-6 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-6 path{fill:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-6 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-6{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-6{stroke:hsl(30, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-6{stroke-width:-4;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-6 line{stroke:hsl(210, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-7 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-7 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-7 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-7 path{fill:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-7 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-7{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-7{stroke:hsl(90, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-7{stroke-width:-7;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-7 line{stroke:hsl(270, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-8 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-8 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-8 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-8 path{fill:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-8 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-8{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-8{stroke:hsl(150, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-8{stroke-width:-10;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-8 line{stroke:hsl(330, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-9 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-9 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-9 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-9 path{fill:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-9 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-9{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-9{stroke:hsl(180, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-9{stroke-width:-13;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-9 line{stroke:hsl(0, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-10 rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-10 path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-10 circle,#mermaid-svg-HAKN8D7BhCH5OPWz .section-10 path{fill:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-10 text{fill:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .node-icon-10{font-size:40px;color:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-edge-10{stroke:hsl(210, 100%, 76.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .edge-depth-10{stroke-width:-16;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-10 line{stroke:hsl(30, 100%, 86.2745098039%);stroke-width:3;}#mermaid-svg-HAKN8D7BhCH5OPWz .lineWrapper line{stroke:black;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled circle,#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:lightgray;}#mermaid-svg-HAKN8D7BhCH5OPWz .disabled text{fill:#efefef;}#mermaid-svg-HAKN8D7BhCH5OPWz .section-root rect,#mermaid-svg-HAKN8D7BhCH5OPWz .section-root path,#mermaid-svg-HAKN8D7BhCH5OPWz .section-root circle{fill:hsl(240, 100%, 46.2745098039%);}#mermaid-svg-HAKN8D7BhCH5OPWz .section-root text{fill:#ffffff;}#mermaid-svg-HAKN8D7BhCH5OPWz .icon-container{height:100%;display:flex;justify-content:center;align-items:center;}#mermaid-svg-HAKN8D7BhCH5OPWz .edge{fill:none;}#mermaid-svg-HAKN8D7BhCH5OPWz .eventWrapper{filter:brightness(120%);}#mermaid-svg-HAKN8D7BhCH5OPWz :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 2010 BLE 4.0 Legacy Pairing（TK/STK） 2013 BLE 4.1 Legacy Pairing 优化 2014 BLE 4.2 LE Secure Connections（ECDH P-256） 2016 BLE 5.0 LE SC 全面普及 2024 BLE 6.0 Channel Sounding（测距安全增强） BLE 安全配对演进

3.3 Legacy Pairing 的核心问题

问题 说明
TK 熵低 Just Works 的 TK 为 0，易受中间人攻击
密钥分发依赖加密链路 早期密钥交换保护不足
不支持 Numeric Comparison 只能依赖 Passkey/OOB/Just Works

3.4 LE Secure Connections 的改进

改进点 说明
ECDH P-256 密钥交换 即使空口被窃听也难以推导密钥
Numeric Comparison 双方显示 6 位数字，用户确认，抗 MITM
密钥层次更清晰 LTK 由 ECDH 派生，绑定更安全
支持更多认证组合 结合 IO Capability 选择配对方法

学习建议：先理解 Legacy Pairing 的流程，再对比 LE Secure Connections 的改进，这样面试时能说清楚"为什么 4.2 之后安全性提升"。

4 安全模式与安全等级

4.1 两种安全模式

#mermaid-svg-uKRy8OYiP3S1HkTB{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-uKRy8OYiP3S1HkTB .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-uKRy8OYiP3S1HkTB .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-uKRy8OYiP3S1HkTB .error-icon{fill:#552222;}#mermaid-svg-uKRy8OYiP3S1HkTB .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-uKRy8OYiP3S1HkTB .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-uKRy8OYiP3S1HkTB .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-uKRy8OYiP3S1HkTB .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-uKRy8OYiP3S1HkTB .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-uKRy8OYiP3S1HkTB .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-uKRy8OYiP3S1HkTB .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-uKRy8OYiP3S1HkTB .marker{fill:#333333;stroke:#333333;}#mermaid-svg-uKRy8OYiP3S1HkTB .marker.cross{stroke:#333333;}#mermaid-svg-uKRy8OYiP3S1HkTB svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-uKRy8OYiP3S1HkTB p{margin:0;}#mermaid-svg-uKRy8OYiP3S1HkTB .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-uKRy8OYiP3S1HkTB .cluster-label text{fill:#333;}#mermaid-svg-uKRy8OYiP3S1HkTB .cluster-label span{color:#333;}#mermaid-svg-uKRy8OYiP3S1HkTB .cluster-label span p{background-color:transparent;}#mermaid-svg-uKRy8OYiP3S1HkTB .label text,#mermaid-svg-uKRy8OYiP3S1HkTB span{fill:#333;color:#333;}#mermaid-svg-uKRy8OYiP3S1HkTB .node rect,#mermaid-svg-uKRy8OYiP3S1HkTB .node circle,#mermaid-svg-uKRy8OYiP3S1HkTB .node ellipse,#mermaid-svg-uKRy8OYiP3S1HkTB .node polygon,#mermaid-svg-uKRy8OYiP3S1HkTB .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-uKRy8OYiP3S1HkTB .rough-node .label text,#mermaid-svg-uKRy8OYiP3S1HkTB .node .label text,#mermaid-svg-uKRy8OYiP3S1HkTB .image-shape .label,#mermaid-svg-uKRy8OYiP3S1HkTB .icon-shape .label{text-anchor:middle;}#mermaid-svg-uKRy8OYiP3S1HkTB .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-uKRy8OYiP3S1HkTB .rough-node .label,#mermaid-svg-uKRy8OYiP3S1HkTB .node .label,#mermaid-svg-uKRy8OYiP3S1HkTB .image-shape .label,#mermaid-svg-uKRy8OYiP3S1HkTB .icon-shape .label{text-align:center;}#mermaid-svg-uKRy8OYiP3S1HkTB .node.clickable{cursor:pointer;}#mermaid-svg-uKRy8OYiP3S1HkTB .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-uKRy8OYiP3S1HkTB .arrowheadPath{fill:#333333;}#mermaid-svg-uKRy8OYiP3S1HkTB .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-uKRy8OYiP3S1HkTB .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-uKRy8OYiP3S1HkTB .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-uKRy8OYiP3S1HkTB .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-uKRy8OYiP3S1HkTB .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-uKRy8OYiP3S1HkTB .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-uKRy8OYiP3S1HkTB .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-uKRy8OYiP3S1HkTB .cluster text{fill:#333;}#mermaid-svg-uKRy8OYiP3S1HkTB .cluster span{color:#333;}#mermaid-svg-uKRy8OYiP3S1HkTB div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-uKRy8OYiP3S1HkTB .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-uKRy8OYiP3S1HkTB rect.text{fill:none;stroke-width:0;}#mermaid-svg-uKRy8OYiP3S1HkTB .icon-shape,#mermaid-svg-uKRy8OYiP3S1HkTB .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-uKRy8OYiP3S1HkTB .icon-shape p,#mermaid-svg-uKRy8OYiP3S1HkTB .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-uKRy8OYiP3S1HkTB .icon-shape .label rect,#mermaid-svg-uKRy8OYiP3S1HkTB .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-uKRy8OYiP3S1HkTB .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-uKRy8OYiP3S1HkTB .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-uKRy8OYiP3S1HkTB :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} Security Mode 2（数据签名/授权）
ATT 层数据签名

（CSRK 签名写入）
Security Mode 1（链路级）
Level 1: No Security
Level 2: Unauthenticated
Level 3: Authenticated
Level 4: LE SC + Auth

模式 含义 典型场景
Security Mode 1 链路级安全，按等级要求加密/认证 绝大多数 BLE 产品
Security Mode 2 数据签名/授权，基于 ATT 权限 特定签名写入场景

4.2 Security Mode 1 的四个等级

Level 名称 加密 MITM 防护 典型用途
1 No Security ❌ ❌ 公开信标、无需安全
2 Unauthenticated Pairing ✅ ❌ 低功耗 IoT，接受 Just Works
3 Authenticated Pairing ✅ ✅ 消费电子，需要 Passkey/NC
4 LE Secure Connections + Authenticated ✅ ✅ 金融、医疗、车钥匙等高安全

4.3 工程选型建议

产品类型 推荐安全等级 推荐配对方法
iBeacon/公开传感器 Level 1 不配对
普通手环/温湿度计 Level 2 Just Works
智能门锁/健康设备 Level 3 Passkey Entry / Numeric Comparison
支付配件/医疗设备 Level 4 LE SC + Numeric Comparison/OOB

5 配对流程三阶段详解

5.1 配对三阶段总览

#mermaid-svg-Qkk3ZVyt9JNzhsAH{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .error-icon{fill:#552222;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .marker{fill:#333333;stroke:#333333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .marker.cross{stroke:#333333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-Qkk3ZVyt9JNzhsAH p{margin:0;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .cluster-label text{fill:#333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .cluster-label span{color:#333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .cluster-label span p{background-color:transparent;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .label text,#mermaid-svg-Qkk3ZVyt9JNzhsAH span{fill:#333;color:#333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .node rect,#mermaid-svg-Qkk3ZVyt9JNzhsAH .node circle,#mermaid-svg-Qkk3ZVyt9JNzhsAH .node ellipse,#mermaid-svg-Qkk3ZVyt9JNzhsAH .node polygon,#mermaid-svg-Qkk3ZVyt9JNzhsAH .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .rough-node .label text,#mermaid-svg-Qkk3ZVyt9JNzhsAH .node .label text,#mermaid-svg-Qkk3ZVyt9JNzhsAH .image-shape .label,#mermaid-svg-Qkk3ZVyt9JNzhsAH .icon-shape .label{text-anchor:middle;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .rough-node .label,#mermaid-svg-Qkk3ZVyt9JNzhsAH .node .label,#mermaid-svg-Qkk3ZVyt9JNzhsAH .image-shape .label,#mermaid-svg-Qkk3ZVyt9JNzhsAH .icon-shape .label{text-align:center;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .node.clickable{cursor:pointer;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .arrowheadPath{fill:#333333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-Qkk3ZVyt9JNzhsAH .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Qkk3ZVyt9JNzhsAH .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-Qkk3ZVyt9JNzhsAH .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .cluster text{fill:#333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .cluster span{color:#333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-Qkk3ZVyt9JNzhsAH rect.text{fill:none;stroke-width:0;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .icon-shape,#mermaid-svg-Qkk3ZVyt9JNzhsAH .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .icon-shape p,#mermaid-svg-Qkk3ZVyt9JNzhsAH .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .icon-shape .label rect,#mermaid-svg-Qkk3ZVyt9JNzhsAH .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Qkk3ZVyt9JNzhsAH .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-Qkk3ZVyt9JNzhsAH .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-Qkk3ZVyt9JNzhsAH :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 阶段 1

配对特征交换
阶段 2

密钥生成与身份确认
阶段 3

密钥分发
Pairing Request

Pairing Response
Pairing Confirm

Pairing Random

（或 Public Key）
Encryption Information

Identity Information

Signing Information

阶段 名称 主要动作 关键 PDU
阶段 1 配对特征交换 交换 IO Capability、AuthReq、最大密钥长度 Pairing Request / Pairing Response
阶段 2 密钥生成与身份确认 生成 TK/STK 或 ECDH 共享密钥，执行确认 Pairing Confirm / Pairing Random / Public Key
阶段 3 密钥分发 分发 LTK、IRK、CSRK 等 Encryption Information / Identity Information / Signing Information

5.2 阶段 1：Pairing Request/Response 关键字段

字段 含义 工程注意点
IO Capability 设备输入输出能力 决定配对方法
OOB Data Flag 是否有带外数据 NFC/二维码配对时使用
AuthReq 认证要求 是否要求 MITM、绑定、LE SC
Maximum Encryption Key Size 最大密钥长度 通常 16 字节
Initiator/Responder Key Distribution 需要分发哪些密钥 决定绑定后能做什么

5.3 阶段 2：Legacy 与 LE SC 的差异

Peripheral Central Peripheral Central #mermaid-svg-1K9Inb2v0LGP8F3g{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-1K9Inb2v0LGP8F3g .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-1K9Inb2v0LGP8F3g .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-1K9Inb2v0LGP8F3g .error-icon{fill:#552222;}#mermaid-svg-1K9Inb2v0LGP8F3g .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-1K9Inb2v0LGP8F3g .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-1K9Inb2v0LGP8F3g .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-1K9Inb2v0LGP8F3g .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-1K9Inb2v0LGP8F3g .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-1K9Inb2v0LGP8F3g .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-1K9Inb2v0LGP8F3g .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-1K9Inb2v0LGP8F3g .marker{fill:#333333;stroke:#333333;}#mermaid-svg-1K9Inb2v0LGP8F3g .marker.cross{stroke:#333333;}#mermaid-svg-1K9Inb2v0LGP8F3g svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-1K9Inb2v0LGP8F3g p{margin:0;}#mermaid-svg-1K9Inb2v0LGP8F3g .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-1K9Inb2v0LGP8F3g text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-1K9Inb2v0LGP8F3g .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-1K9Inb2v0LGP8F3g .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-1K9Inb2v0LGP8F3g .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-1K9Inb2v0LGP8F3g .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-1K9Inb2v0LGP8F3g #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-1K9Inb2v0LGP8F3g .sequenceNumber{fill:white;}#mermaid-svg-1K9Inb2v0LGP8F3g #sequencenumber{fill:#333;}#mermaid-svg-1K9Inb2v0LGP8F3g #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-1K9Inb2v0LGP8F3g .messageText{fill:#333;stroke:none;}#mermaid-svg-1K9Inb2v0LGP8F3g .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-1K9Inb2v0LGP8F3g .labelText,#mermaid-svg-1K9Inb2v0LGP8F3g .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-1K9Inb2v0LGP8F3g .loopText,#mermaid-svg-1K9Inb2v0LGP8F3g .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-1K9Inb2v0LGP8F3g .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-1K9Inb2v0LGP8F3g .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-1K9Inb2v0LGP8F3g .noteText,#mermaid-svg-1K9Inb2v0LGP8F3g .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-1K9Inb2v0LGP8F3g .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-1K9Inb2v0LGP8F3g .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-1K9Inb2v0LGP8F3g .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-1K9Inb2v0LGP8F3g .actorPopupMenu{position:absolute;}#mermaid-svg-1K9Inb2v0LGP8F3g .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-1K9Inb2v0LGP8F3g .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-1K9Inb2v0LGP8F3g .actor-man circle,#mermaid-svg-1K9Inb2v0LGP8F3g line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-1K9Inb2v0LGP8F3g :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} Legacy Pairing（4.0/4.1） 双方验证 Confirm，派生 STK LE Secure Connections（4.2+） 双方各自计算 ECDH 共享密钥 DhKey 验证后派生 LTK Pairing Confirm (Mconfirm) 1 Pairing Confirm (Sconfirm) 2 Pairing Random (Mrand) 3 Pairing Random (Srand) 4 Public Key (P-256) 5 Public Key (P-256) 6 Pairing Confirm 7 Pairing Confirm 8 Pairing Random 9 Pairing Random 10

项目 Legacy Pairing LE Secure Connections
密钥交换 TK → STK ECDH P-256 → LTK
确认方式 Confirm/Random Public Key + Confirm/Random
抗窃听 较弱 强
Numeric Comparison 不支持 支持

5.4 阶段 3：密钥分发

分发密钥 用途 是否绑定必需
LTK 链路加密 是
EDIV/Rand Legacy 加密恢复 Legacy 绑定需要
IRK 解析 RPA 使用隐私地址时需要
CSRK 数据签名 签名写入/无加密认证时需要

6 四种配对方法详解

6.1 四种方法对比总览

配对方法 输入/显示要求 MITM 防护 LE SC 专属 典型场景
Just Works 无要求 ❌ ❌ 手环、传感器
Passkey Entry 一方显示/一方输入 ✅ ❌ 门锁、键盘
Numeric Comparison 双方显示+确认 ✅ ✅ 耳机、车机
OOB 外部信道（NFC/二维码） ✅ ❌ 触碰配对

6.2 Just Works

Peripheral Central Peripheral Central #mermaid-svg-ueC4YkzgP45OUUHB{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-ueC4YkzgP45OUUHB .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-ueC4YkzgP45OUUHB .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-ueC4YkzgP45OUUHB .error-icon{fill:#552222;}#mermaid-svg-ueC4YkzgP45OUUHB .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-ueC4YkzgP45OUUHB .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-ueC4YkzgP45OUUHB .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-ueC4YkzgP45OUUHB .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-ueC4YkzgP45OUUHB .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-ueC4YkzgP45OUUHB .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-ueC4YkzgP45OUUHB .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-ueC4YkzgP45OUUHB .marker{fill:#333333;stroke:#333333;}#mermaid-svg-ueC4YkzgP45OUUHB .marker.cross{stroke:#333333;}#mermaid-svg-ueC4YkzgP45OUUHB svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-ueC4YkzgP45OUUHB p{margin:0;}#mermaid-svg-ueC4YkzgP45OUUHB .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-ueC4YkzgP45OUUHB text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-ueC4YkzgP45OUUHB .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-ueC4YkzgP45OUUHB .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-ueC4YkzgP45OUUHB .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-ueC4YkzgP45OUUHB .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-ueC4YkzgP45OUUHB #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-ueC4YkzgP45OUUHB .sequenceNumber{fill:white;}#mermaid-svg-ueC4YkzgP45OUUHB #sequencenumber{fill:#333;}#mermaid-svg-ueC4YkzgP45OUUHB #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-ueC4YkzgP45OUUHB .messageText{fill:#333;stroke:none;}#mermaid-svg-ueC4YkzgP45OUUHB .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-ueC4YkzgP45OUUHB .labelText,#mermaid-svg-ueC4YkzgP45OUUHB .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-ueC4YkzgP45OUUHB .loopText,#mermaid-svg-ueC4YkzgP45OUUHB .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-ueC4YkzgP45OUUHB .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-ueC4YkzgP45OUUHB .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-ueC4YkzgP45OUUHB .noteText,#mermaid-svg-ueC4YkzgP45OUUHB .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-ueC4YkzgP45OUUHB .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-ueC4YkzgP45OUUHB .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-ueC4YkzgP45OUUHB .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-ueC4YkzgP45OUUHB .actorPopupMenu{position:absolute;}#mermaid-svg-ueC4YkzgP45OUUHB .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-ueC4YkzgP45OUUHB .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-ueC4YkzgP45OUUHB .actor-man circle,#mermaid-svg-ueC4YkzgP45OUUHB line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-ueC4YkzgP45OUUHB :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 双方无需用户交互，直接确认 ✅ 链路加密 ❌ 无 MITM 防护 Pairing Request (NoInputNoOutput) Pairing Response (NoInputNoOutput) 密钥交换 密钥交换

项目 说明
适用 双方都没有显示/输入能力，或一方 NoInputNoOutput
安全性 提供加密，但不抗 MITM
典型场景 手环、传感器、低成本 IoT
风险 攻击者可伪装任一端完成配对

6.3 Passkey Entry

门锁（显示） 手机（键盘） 用户 门锁（显示） 手机（键盘） 用户 #mermaid-svg-7ImqviwFSsbUWdqC{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-7ImqviwFSsbUWdqC .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-7ImqviwFSsbUWdqC .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-7ImqviwFSsbUWdqC .error-icon{fill:#552222;}#mermaid-svg-7ImqviwFSsbUWdqC .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-7ImqviwFSsbUWdqC .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-7ImqviwFSsbUWdqC .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-7ImqviwFSsbUWdqC .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-7ImqviwFSsbUWdqC .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-7ImqviwFSsbUWdqC .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-7ImqviwFSsbUWdqC .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-7ImqviwFSsbUWdqC .marker{fill:#333333;stroke:#333333;}#mermaid-svg-7ImqviwFSsbUWdqC .marker.cross{stroke:#333333;}#mermaid-svg-7ImqviwFSsbUWdqC svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-7ImqviwFSsbUWdqC p{margin:0;}#mermaid-svg-7ImqviwFSsbUWdqC .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-7ImqviwFSsbUWdqC text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-7ImqviwFSsbUWdqC .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-7ImqviwFSsbUWdqC .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-7ImqviwFSsbUWdqC .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-7ImqviwFSsbUWdqC .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-7ImqviwFSsbUWdqC #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-7ImqviwFSsbUWdqC .sequenceNumber{fill:white;}#mermaid-svg-7ImqviwFSsbUWdqC #sequencenumber{fill:#333;}#mermaid-svg-7ImqviwFSsbUWdqC #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-7ImqviwFSsbUWdqC .messageText{fill:#333;stroke:none;}#mermaid-svg-7ImqviwFSsbUWdqC .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-7ImqviwFSsbUWdqC .labelText,#mermaid-svg-7ImqviwFSsbUWdqC .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-7ImqviwFSsbUWdqC .loopText,#mermaid-svg-7ImqviwFSsbUWdqC .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-7ImqviwFSsbUWdqC .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-7ImqviwFSsbUWdqC .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-7ImqviwFSsbUWdqC .noteText,#mermaid-svg-7ImqviwFSsbUWdqC .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-7ImqviwFSsbUWdqC .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-7ImqviwFSsbUWdqC .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-7ImqviwFSsbUWdqC .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-7ImqviwFSsbUWdqC .actorPopupMenu{position:absolute;}#mermaid-svg-7ImqviwFSsbUWdqC .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-7ImqviwFSsbUWdqC .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-7ImqviwFSsbUWdqC .actor-man circle,#mermaid-svg-7ImqviwFSsbUWdqC line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-7ImqviwFSsbUWdqC :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 双方验证 Passkey 一致 → 派生密钥 显示 6 位 Passkey（如 123456） 输入 Passkey Pairing Confirm Pairing Confirm Pairing Random Pairing Random

项目 说明
适用 一方可显示 6 位数字，另一方有键盘输入
安全性 提供 MITM 防护
典型场景 手机与门锁、键盘与主机

6.4 Numeric Comparison（LE SC 专属）

耳机（DisplayYesNo） 手机（DisplayYesNo） 用户 耳机（DisplayYesNo） 手机（DisplayYesNo） 用户 #mermaid-svg-68wlaVPBgbEhDU2p{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-68wlaVPBgbEhDU2p .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-68wlaVPBgbEhDU2p .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-68wlaVPBgbEhDU2p .error-icon{fill:#552222;}#mermaid-svg-68wlaVPBgbEhDU2p .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-68wlaVPBgbEhDU2p .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-68wlaVPBgbEhDU2p .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-68wlaVPBgbEhDU2p .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-68wlaVPBgbEhDU2p .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-68wlaVPBgbEhDU2p .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-68wlaVPBgbEhDU2p .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-68wlaVPBgbEhDU2p .marker{fill:#333333;stroke:#333333;}#mermaid-svg-68wlaVPBgbEhDU2p .marker.cross{stroke:#333333;}#mermaid-svg-68wlaVPBgbEhDU2p svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-68wlaVPBgbEhDU2p p{margin:0;}#mermaid-svg-68wlaVPBgbEhDU2p .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-68wlaVPBgbEhDU2p text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-68wlaVPBgbEhDU2p .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-68wlaVPBgbEhDU2p .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-68wlaVPBgbEhDU2p .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-68wlaVPBgbEhDU2p .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-68wlaVPBgbEhDU2p #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-68wlaVPBgbEhDU2p .sequenceNumber{fill:white;}#mermaid-svg-68wlaVPBgbEhDU2p #sequencenumber{fill:#333;}#mermaid-svg-68wlaVPBgbEhDU2p #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-68wlaVPBgbEhDU2p .messageText{fill:#333;stroke:none;}#mermaid-svg-68wlaVPBgbEhDU2p .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-68wlaVPBgbEhDU2p .labelText,#mermaid-svg-68wlaVPBgbEhDU2p .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-68wlaVPBgbEhDU2p .loopText,#mermaid-svg-68wlaVPBgbEhDU2p .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-68wlaVPBgbEhDU2p .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-68wlaVPBgbEhDU2p .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-68wlaVPBgbEhDU2p .noteText,#mermaid-svg-68wlaVPBgbEhDU2p .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-68wlaVPBgbEhDU2p .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-68wlaVPBgbEhDU2p .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-68wlaVPBgbEhDU2p .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-68wlaVPBgbEhDU2p .actorPopupMenu{position:absolute;}#mermaid-svg-68wlaVPBgbEhDU2p .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-68wlaVPBgbEhDU2p .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-68wlaVPBgbEhDU2p .actor-man circle,#mermaid-svg-68wlaVPBgbEhDU2p line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-68wlaVPBgbEhDU2p :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 双方各自计算 6 位数字 ✅ 认证完成，抗 MITM Public Key (ECDH) Public Key (ECDH) 显示数字（如 654321） 显示数字（如 654321） 点击"确认"按钮 点击"确认"按钮

项目 说明
适用 双方都有显示和确认能力（DisplayYesNo）
前提 LE Secure Connections
安全性 抗 MITM，用户体验较好
典型场景 手机与耳机、手机与车机

6.5 OOB（Out of Band）

设备 手机 NFC 标签 设备 手机 NFC 标签 #mermaid-svg-FhOZhxh6WRWkwZ1l{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-FhOZhxh6WRWkwZ1l .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-FhOZhxh6WRWkwZ1l .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-FhOZhxh6WRWkwZ1l .error-icon{fill:#552222;}#mermaid-svg-FhOZhxh6WRWkwZ1l .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-FhOZhxh6WRWkwZ1l .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-FhOZhxh6WRWkwZ1l .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-FhOZhxh6WRWkwZ1l .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-FhOZhxh6WRWkwZ1l .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-FhOZhxh6WRWkwZ1l .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-FhOZhxh6WRWkwZ1l .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-FhOZhxh6WRWkwZ1l .marker{fill:#333333;stroke:#333333;}#mermaid-svg-FhOZhxh6WRWkwZ1l .marker.cross{stroke:#333333;}#mermaid-svg-FhOZhxh6WRWkwZ1l svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-FhOZhxh6WRWkwZ1l p{margin:0;}#mermaid-svg-FhOZhxh6WRWkwZ1l .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-FhOZhxh6WRWkwZ1l text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-FhOZhxh6WRWkwZ1l .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-FhOZhxh6WRWkwZ1l .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-FhOZhxh6WRWkwZ1l .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-FhOZhxh6WRWkwZ1l .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-FhOZhxh6WRWkwZ1l #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-FhOZhxh6WRWkwZ1l .sequenceNumber{fill:white;}#mermaid-svg-FhOZhxh6WRWkwZ1l #sequencenumber{fill:#333;}#mermaid-svg-FhOZhxh6WRWkwZ1l #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-FhOZhxh6WRWkwZ1l .messageText{fill:#333;stroke:none;}#mermaid-svg-FhOZhxh6WRWkwZ1l .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-FhOZhxh6WRWkwZ1l .labelText,#mermaid-svg-FhOZhxh6WRWkwZ1l .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-FhOZhxh6WRWkwZ1l .loopText,#mermaid-svg-FhOZhxh6WRWkwZ1l .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-FhOZhxh6WRWkwZ1l .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-FhOZhxh6WRWkwZ1l .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-FhOZhxh6WRWkwZ1l .noteText,#mermaid-svg-FhOZhxh6WRWkwZ1l .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-FhOZhxh6WRWkwZ1l .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-FhOZhxh6WRWkwZ1l .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-FhOZhxh6WRWkwZ1l .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-FhOZhxh6WRWkwZ1l .actorPopupMenu{position:absolute;}#mermaid-svg-FhOZhxh6WRWkwZ1l .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-FhOZhxh6WRWkwZ1l .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-FhOZhxh6WRWkwZ1l .actor-man circle,#mermaid-svg-FhOZhxh6WRWkwZ1l line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-FhOZhxh6WRWkwZ1l :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 通过 NFC/二维码交换 OOB 数据 使用 OOB 数据完成认证 OOB 数据（含密钥信息） Pairing Request (OOB Flag=1) Pairing Response (OOB Flag=1)

项目 说明
适用 通过 NFC、二维码等外部信道交换配对信息
安全性 取决于 OOB 信道安全性
典型场景 NFC 触碰配对、二维码配网
注意 OOB 数据泄露会直接降低安全性

7 IO Capability 与配对方法选择矩阵

7.1 配对方法选择矩阵

Central IO ↓ / Peripheral IO → DisplayOnly DisplayYesNo KeyboardOnly NoInputNoOutput KeyboardDisplay
DisplayOnly JW JW PE JW PE
DisplayYesNo JW NC(SC)/JW(Legacy) PE JW NC(SC)/PE(Legacy)
KeyboardOnly PE PE PE JW PE
NoInputNoOutput JW JW JW JW JW
KeyboardDisplay PE NC(SC)/PE(Legacy) PE JW NC(SC)/PE(Legacy)

JW = Just Works，PE = Passkey Entry，NC = Numeric Comparison，SC = Secure Connections。

7.2 选择流程图

#mermaid-svg-U4qLByT0ND1ehK27{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-U4qLByT0ND1ehK27 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-U4qLByT0ND1ehK27 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-U4qLByT0ND1ehK27 .error-icon{fill:#552222;}#mermaid-svg-U4qLByT0ND1ehK27 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-U4qLByT0ND1ehK27 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-U4qLByT0ND1ehK27 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-U4qLByT0ND1ehK27 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-U4qLByT0ND1ehK27 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-U4qLByT0ND1ehK27 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-U4qLByT0ND1ehK27 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-U4qLByT0ND1ehK27 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-U4qLByT0ND1ehK27 .marker.cross{stroke:#333333;}#mermaid-svg-U4qLByT0ND1ehK27 svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-U4qLByT0ND1ehK27 p{margin:0;}#mermaid-svg-U4qLByT0ND1ehK27 .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-U4qLByT0ND1ehK27 .cluster-label text{fill:#333;}#mermaid-svg-U4qLByT0ND1ehK27 .cluster-label span{color:#333;}#mermaid-svg-U4qLByT0ND1ehK27 .cluster-label span p{background-color:transparent;}#mermaid-svg-U4qLByT0ND1ehK27 .label text,#mermaid-svg-U4qLByT0ND1ehK27 span{fill:#333;color:#333;}#mermaid-svg-U4qLByT0ND1ehK27 .node rect,#mermaid-svg-U4qLByT0ND1ehK27 .node circle,#mermaid-svg-U4qLByT0ND1ehK27 .node ellipse,#mermaid-svg-U4qLByT0ND1ehK27 .node polygon,#mermaid-svg-U4qLByT0ND1ehK27 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-U4qLByT0ND1ehK27 .rough-node .label text,#mermaid-svg-U4qLByT0ND1ehK27 .node .label text,#mermaid-svg-U4qLByT0ND1ehK27 .image-shape .label,#mermaid-svg-U4qLByT0ND1ehK27 .icon-shape .label{text-anchor:middle;}#mermaid-svg-U4qLByT0ND1ehK27 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-U4qLByT0ND1ehK27 .rough-node .label,#mermaid-svg-U4qLByT0ND1ehK27 .node .label,#mermaid-svg-U4qLByT0ND1ehK27 .image-shape .label,#mermaid-svg-U4qLByT0ND1ehK27 .icon-shape .label{text-align:center;}#mermaid-svg-U4qLByT0ND1ehK27 .node.clickable{cursor:pointer;}#mermaid-svg-U4qLByT0ND1ehK27 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-U4qLByT0ND1ehK27 .arrowheadPath{fill:#333333;}#mermaid-svg-U4qLByT0ND1ehK27 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-U4qLByT0ND1ehK27 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-U4qLByT0ND1ehK27 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-U4qLByT0ND1ehK27 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-U4qLByT0ND1ehK27 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-U4qLByT0ND1ehK27 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-U4qLByT0ND1ehK27 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-U4qLByT0ND1ehK27 .cluster text{fill:#333;}#mermaid-svg-U4qLByT0ND1ehK27 .cluster span{color:#333;}#mermaid-svg-U4qLByT0ND1ehK27 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-U4qLByT0ND1ehK27 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-U4qLByT0ND1ehK27 rect.text{fill:none;stroke-width:0;}#mermaid-svg-U4qLByT0ND1ehK27 .icon-shape,#mermaid-svg-U4qLByT0ND1ehK27 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-U4qLByT0ND1ehK27 .icon-shape p,#mermaid-svg-U4qLByT0ND1ehK27 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-U4qLByT0ND1ehK27 .icon-shape .label rect,#mermaid-svg-U4qLByT0ND1ehK27 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-U4qLByT0ND1ehK27 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-U4qLByT0ND1ehK27 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-U4qLByT0ND1ehK27 :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 是
是
否
否
是
否
双方 IO Capability 是什么？
双方都有

DisplayYesNo？
支持 LE SC？
✅ Numeric Comparison

（最优，抗 MITM）
⚪ Just Works / Passkey Entry
一方能显示

一方能输入？
✅ Passkey Entry

（抗 MITM）
⚠️ Just Works

（无 MITM 防护）

工程记忆法：只要双方都有"显示+确认"能力且支持 LE SC，优先 Numeric Comparison；一方能显示、一方能输入，用 Passkey Entry；双方都无输入输出，只能 Just Works。

8 密钥体系：STK、LTK、IRK、CSRK

8.1 四类密钥对比

密钥 全称 用途 生命周期 是否可绑定存储
STK Short Term Key Legacy Pairing 的临时会话加密 当次连接 否
LTK Long Term Key 连接加密 绑定后长期有效 是
IRK Identity Resolving Key 解析 RPA 到真实身份 绑定后长期有效 是
CSRK Connection Signature Resolving Key 数据签名，验证来源 绑定后长期有效 是

8.2 密钥派生流程图

#mermaid-svg-8qGCKTYOsJoDnt2t{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-8qGCKTYOsJoDnt2t .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-8qGCKTYOsJoDnt2t .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-8qGCKTYOsJoDnt2t .error-icon{fill:#552222;}#mermaid-svg-8qGCKTYOsJoDnt2t .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-8qGCKTYOsJoDnt2t .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-8qGCKTYOsJoDnt2t .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-8qGCKTYOsJoDnt2t .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-8qGCKTYOsJoDnt2t .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-8qGCKTYOsJoDnt2t .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-8qGCKTYOsJoDnt2t .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-8qGCKTYOsJoDnt2t .marker{fill:#333333;stroke:#333333;}#mermaid-svg-8qGCKTYOsJoDnt2t .marker.cross{stroke:#333333;}#mermaid-svg-8qGCKTYOsJoDnt2t svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-8qGCKTYOsJoDnt2t p{margin:0;}#mermaid-svg-8qGCKTYOsJoDnt2t .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-8qGCKTYOsJoDnt2t .cluster-label text{fill:#333;}#mermaid-svg-8qGCKTYOsJoDnt2t .cluster-label span{color:#333;}#mermaid-svg-8qGCKTYOsJoDnt2t .cluster-label span p{background-color:transparent;}#mermaid-svg-8qGCKTYOsJoDnt2t .label text,#mermaid-svg-8qGCKTYOsJoDnt2t span{fill:#333;color:#333;}#mermaid-svg-8qGCKTYOsJoDnt2t .node rect,#mermaid-svg-8qGCKTYOsJoDnt2t .node circle,#mermaid-svg-8qGCKTYOsJoDnt2t .node ellipse,#mermaid-svg-8qGCKTYOsJoDnt2t .node polygon,#mermaid-svg-8qGCKTYOsJoDnt2t .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-8qGCKTYOsJoDnt2t .rough-node .label text,#mermaid-svg-8qGCKTYOsJoDnt2t .node .label text,#mermaid-svg-8qGCKTYOsJoDnt2t .image-shape .label,#mermaid-svg-8qGCKTYOsJoDnt2t .icon-shape .label{text-anchor:middle;}#mermaid-svg-8qGCKTYOsJoDnt2t .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-8qGCKTYOsJoDnt2t .rough-node .label,#mermaid-svg-8qGCKTYOsJoDnt2t .node .label,#mermaid-svg-8qGCKTYOsJoDnt2t .image-shape .label,#mermaid-svg-8qGCKTYOsJoDnt2t .icon-shape .label{text-align:center;}#mermaid-svg-8qGCKTYOsJoDnt2t .node.clickable{cursor:pointer;}#mermaid-svg-8qGCKTYOsJoDnt2t .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-8qGCKTYOsJoDnt2t .arrowheadPath{fill:#333333;}#mermaid-svg-8qGCKTYOsJoDnt2t .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-8qGCKTYOsJoDnt2t .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-8qGCKTYOsJoDnt2t .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-8qGCKTYOsJoDnt2t .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-8qGCKTYOsJoDnt2t .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-8qGCKTYOsJoDnt2t .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-8qGCKTYOsJoDnt2t .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-8qGCKTYOsJoDnt2t .cluster text{fill:#333;}#mermaid-svg-8qGCKTYOsJoDnt2t .cluster span{color:#333;}#mermaid-svg-8qGCKTYOsJoDnt2t div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-8qGCKTYOsJoDnt2t .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-8qGCKTYOsJoDnt2t rect.text{fill:none;stroke-width:0;}#mermaid-svg-8qGCKTYOsJoDnt2t .icon-shape,#mermaid-svg-8qGCKTYOsJoDnt2t .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-8qGCKTYOsJoDnt2t .icon-shape p,#mermaid-svg-8qGCKTYOsJoDnt2t .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-8qGCKTYOsJoDnt2t .icon-shape .label rect,#mermaid-svg-8qGCKTYOsJoDnt2t .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-8qGCKTYOsJoDnt2t .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-8qGCKTYOsJoDnt2t .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-8qGCKTYOsJoDnt2t :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 绑定后分发的密钥
LE Secure Connections 密钥派生
Legacy Pairing 密钥派生
TK

（配对临时密钥）
STK

（短期会话密钥）
派生 LTK 加密链路
ECDH P-256

公私钥对
DHKey

（共享密钥）
LTK

（长期密钥）
IRK

解析 RPA
CSRK

数据签名

8.3 密钥用途速查表

想做什么 用哪个密钥
加密链路 LTK（或 Legacy 的 STK）
解析对方 RPA 地址 IRK
验证签名写入/无加密认证 CSRK
Legacy 重连恢复加密 LTK + EDIV + Rand

注意：LTK 用于加密，IRK 用于隐私地址解析，CSRK 用于签名数据。三者用途不同，不能混用。

9 加密与认证过程

9.1 链路加密流程

Link Layer Peripheral Central Link Layer Peripheral Central #mermaid-svg-gK4u5KThg4Oo63ap{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-gK4u5KThg4Oo63ap .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-gK4u5KThg4Oo63ap .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-gK4u5KThg4Oo63ap .error-icon{fill:#552222;}#mermaid-svg-gK4u5KThg4Oo63ap .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-gK4u5KThg4Oo63ap .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-gK4u5KThg4Oo63ap .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-gK4u5KThg4Oo63ap .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-gK4u5KThg4Oo63ap .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-gK4u5KThg4Oo63ap .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-gK4u5KThg4Oo63ap .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-gK4u5KThg4Oo63ap .marker{fill:#333333;stroke:#333333;}#mermaid-svg-gK4u5KThg4Oo63ap .marker.cross{stroke:#333333;}#mermaid-svg-gK4u5KThg4Oo63ap svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-gK4u5KThg4Oo63ap p{margin:0;}#mermaid-svg-gK4u5KThg4Oo63ap .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-gK4u5KThg4Oo63ap text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-gK4u5KThg4Oo63ap .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-gK4u5KThg4Oo63ap .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-gK4u5KThg4Oo63ap .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-gK4u5KThg4Oo63ap .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-gK4u5KThg4Oo63ap #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-gK4u5KThg4Oo63ap .sequenceNumber{fill:white;}#mermaid-svg-gK4u5KThg4Oo63ap #sequencenumber{fill:#333;}#mermaid-svg-gK4u5KThg4Oo63ap #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-gK4u5KThg4Oo63ap .messageText{fill:#333;stroke:none;}#mermaid-svg-gK4u5KThg4Oo63ap .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-gK4u5KThg4Oo63ap .labelText,#mermaid-svg-gK4u5KThg4Oo63ap .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-gK4u5KThg4Oo63ap .loopText,#mermaid-svg-gK4u5KThg4Oo63ap .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-gK4u5KThg4Oo63ap .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-gK4u5KThg4Oo63ap .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-gK4u5KThg4Oo63ap .noteText,#mermaid-svg-gK4u5KThg4Oo63ap .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-gK4u5KThg4Oo63ap .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-gK4u5KThg4Oo63ap .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-gK4u5KThg4Oo63ap .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-gK4u5KThg4Oo63ap .actorPopupMenu{position:absolute;}#mermaid-svg-gK4u5KThg4Oo63ap .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-gK4u5KThg4Oo63ap .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-gK4u5KThg4Oo63ap .actor-man circle,#mermaid-svg-gK4u5KThg4Oo63ap line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-gK4u5KThg4Oo63ap :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 双方使用 LTK 派生会话密钥 AES-CCM 加密引擎开始工作 LL_ENC_REQ（请求加密） 1 LL_ENC_RSP 2 LL_START_ENC_REQ 3 LL_START_ENC_RSP 4 🔒 加密数据 5 🔒 加密数据 6

9.2 GATT 权限与安全等级对应

GATT 权限 要求
Read/Write 可能需要加密
Read Authenticated / Write Authenticated 需要 MITM 认证
Notify/Indicate 通常需要加密链路
Signed Write 使用 CSRK 签名，不要求加密链路

9.3 认证状态对 GATT 操作的影响

#mermaid-svg-YyUnJvBhuQjEem62{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-YyUnJvBhuQjEem62 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-YyUnJvBhuQjEem62 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-YyUnJvBhuQjEem62 .error-icon{fill:#552222;}#mermaid-svg-YyUnJvBhuQjEem62 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-YyUnJvBhuQjEem62 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-YyUnJvBhuQjEem62 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-YyUnJvBhuQjEem62 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-YyUnJvBhuQjEem62 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-YyUnJvBhuQjEem62 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-YyUnJvBhuQjEem62 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-YyUnJvBhuQjEem62 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-YyUnJvBhuQjEem62 .marker.cross{stroke:#333333;}#mermaid-svg-YyUnJvBhuQjEem62 svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-YyUnJvBhuQjEem62 p{margin:0;}#mermaid-svg-YyUnJvBhuQjEem62 .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-YyUnJvBhuQjEem62 .cluster-label text{fill:#333;}#mermaid-svg-YyUnJvBhuQjEem62 .cluster-label span{color:#333;}#mermaid-svg-YyUnJvBhuQjEem62 .cluster-label span p{background-color:transparent;}#mermaid-svg-YyUnJvBhuQjEem62 .label text,#mermaid-svg-YyUnJvBhuQjEem62 span{fill:#333;color:#333;}#mermaid-svg-YyUnJvBhuQjEem62 .node rect,#mermaid-svg-YyUnJvBhuQjEem62 .node circle,#mermaid-svg-YyUnJvBhuQjEem62 .node ellipse,#mermaid-svg-YyUnJvBhuQjEem62 .node polygon,#mermaid-svg-YyUnJvBhuQjEem62 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-YyUnJvBhuQjEem62 .rough-node .label text,#mermaid-svg-YyUnJvBhuQjEem62 .node .label text,#mermaid-svg-YyUnJvBhuQjEem62 .image-shape .label,#mermaid-svg-YyUnJvBhuQjEem62 .icon-shape .label{text-anchor:middle;}#mermaid-svg-YyUnJvBhuQjEem62 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-YyUnJvBhuQjEem62 .rough-node .label,#mermaid-svg-YyUnJvBhuQjEem62 .node .label,#mermaid-svg-YyUnJvBhuQjEem62 .image-shape .label,#mermaid-svg-YyUnJvBhuQjEem62 .icon-shape .label{text-align:center;}#mermaid-svg-YyUnJvBhuQjEem62 .node.clickable{cursor:pointer;}#mermaid-svg-YyUnJvBhuQjEem62 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-YyUnJvBhuQjEem62 .arrowheadPath{fill:#333333;}#mermaid-svg-YyUnJvBhuQjEem62 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-YyUnJvBhuQjEem62 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-YyUnJvBhuQjEem62 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-YyUnJvBhuQjEem62 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-YyUnJvBhuQjEem62 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-YyUnJvBhuQjEem62 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-YyUnJvBhuQjEem62 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-YyUnJvBhuQjEem62 .cluster text{fill:#333;}#mermaid-svg-YyUnJvBhuQjEem62 .cluster span{color:#333;}#mermaid-svg-YyUnJvBhuQjEem62 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-YyUnJvBhuQjEem62 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-YyUnJvBhuQjEem62 rect.text{fill:none;stroke-width:0;}#mermaid-svg-YyUnJvBhuQjEem62 .icon-shape,#mermaid-svg-YyUnJvBhuQjEem62 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-YyUnJvBhuQjEem62 .icon-shape p,#mermaid-svg-YyUnJvBhuQjEem62 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-YyUnJvBhuQjEem62 .icon-shape .label rect,#mermaid-svg-YyUnJvBhuQjEem62 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-YyUnJvBhuQjEem62 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-YyUnJvBhuQjEem62 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-YyUnJvBhuQjEem62 :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 否
是
否
是
否
是
客户端发起 GATT 操作
链路是否加密？
❌ 返回 Insufficient Encryption
是否要求认证？
✅ 操作成功
是否 MITM 认证？
❌ 返回 Insufficient Authentication

10 绑定（Bonding）与密钥存储

10.1 绑定完整流程

步骤 动作 工程注意点
1 配对时设置 Bonding Flag AuthReq 中设置 Bonding
2 阶段 3 分发密钥 LTK/IRK/CSRK
3 双方保存密钥 写入安全存储/Flash
4 重连时解析身份 使用 IRK 解析 RPA
5 使用 LTK 加密 无需重新配对

10.2 绑定信息存储示意

#mermaid-svg-Cd24P8AND4ilYK4j{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-Cd24P8AND4ilYK4j .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-Cd24P8AND4ilYK4j .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-Cd24P8AND4ilYK4j .error-icon{fill:#552222;}#mermaid-svg-Cd24P8AND4ilYK4j .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-Cd24P8AND4ilYK4j .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-Cd24P8AND4ilYK4j .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-Cd24P8AND4ilYK4j .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-Cd24P8AND4ilYK4j .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-Cd24P8AND4ilYK4j .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-Cd24P8AND4ilYK4j .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-Cd24P8AND4ilYK4j .marker{fill:#333333;stroke:#333333;}#mermaid-svg-Cd24P8AND4ilYK4j .marker.cross{stroke:#333333;}#mermaid-svg-Cd24P8AND4ilYK4j svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-Cd24P8AND4ilYK4j p{margin:0;}#mermaid-svg-Cd24P8AND4ilYK4j .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-Cd24P8AND4ilYK4j .cluster-label text{fill:#333;}#mermaid-svg-Cd24P8AND4ilYK4j .cluster-label span{color:#333;}#mermaid-svg-Cd24P8AND4ilYK4j .cluster-label span p{background-color:transparent;}#mermaid-svg-Cd24P8AND4ilYK4j .label text,#mermaid-svg-Cd24P8AND4ilYK4j span{fill:#333;color:#333;}#mermaid-svg-Cd24P8AND4ilYK4j .node rect,#mermaid-svg-Cd24P8AND4ilYK4j .node circle,#mermaid-svg-Cd24P8AND4ilYK4j .node ellipse,#mermaid-svg-Cd24P8AND4ilYK4j .node polygon,#mermaid-svg-Cd24P8AND4ilYK4j .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-Cd24P8AND4ilYK4j .rough-node .label text,#mermaid-svg-Cd24P8AND4ilYK4j .node .label text,#mermaid-svg-Cd24P8AND4ilYK4j .image-shape .label,#mermaid-svg-Cd24P8AND4ilYK4j .icon-shape .label{text-anchor:middle;}#mermaid-svg-Cd24P8AND4ilYK4j .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-Cd24P8AND4ilYK4j .rough-node .label,#mermaid-svg-Cd24P8AND4ilYK4j .node .label,#mermaid-svg-Cd24P8AND4ilYK4j .image-shape .label,#mermaid-svg-Cd24P8AND4ilYK4j .icon-shape .label{text-align:center;}#mermaid-svg-Cd24P8AND4ilYK4j .node.clickable{cursor:pointer;}#mermaid-svg-Cd24P8AND4ilYK4j .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-Cd24P8AND4ilYK4j .arrowheadPath{fill:#333333;}#mermaid-svg-Cd24P8AND4ilYK4j .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-Cd24P8AND4ilYK4j .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-Cd24P8AND4ilYK4j .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Cd24P8AND4ilYK4j .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-Cd24P8AND4ilYK4j .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Cd24P8AND4ilYK4j .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-Cd24P8AND4ilYK4j .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-Cd24P8AND4ilYK4j .cluster text{fill:#333;}#mermaid-svg-Cd24P8AND4ilYK4j .cluster span{color:#333;}#mermaid-svg-Cd24P8AND4ilYK4j div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-Cd24P8AND4ilYK4j .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-Cd24P8AND4ilYK4j rect.text{fill:none;stroke-width:0;}#mermaid-svg-Cd24P8AND4ilYK4j .icon-shape,#mermaid-svg-Cd24P8AND4ilYK4j .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Cd24P8AND4ilYK4j .icon-shape p,#mermaid-svg-Cd24P8AND4ilYK4j .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-Cd24P8AND4ilYK4j .icon-shape .label rect,#mermaid-svg-Cd24P8AND4ilYK4j .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Cd24P8AND4ilYK4j .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-Cd24P8AND4ilYK4j .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-Cd24P8AND4ilYK4j :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} Peripheral（设备）
Central（手机）
LTK 加密
IRK 解析 RPA
绑定数据库

Peer IRK

Local LTK

Peer LTK

Peer CSRK
绑定数据库

Peer IRK

Local LTK

Peer LTK

Peer CSRK

10.3 常见绑定问题排查

问题 原因 解决
重启后需要重新配对 未保存 LTK 检查 Bonding Flag 和存储
手机删除了配对，设备仍保存 绑定信息不同步 提供删除绑定接口
重连加密失败 LTK/EDIV/Rand 不匹配 清除绑定重新配对
RPA 无法解析 未分发/保存 IRK 检查 Identity Information

11 地址类型与隐私保护

11.1 四种地址类型对比

地址类型 说明 隐私性 典型用途
Public 全球唯一 MAC 地址 ❌ 可被追踪 固定设备
Static Random 每次上电随机生成，当次不变 ⚠️ 当次会话可追踪 无需隐私的设备
Resolvable Private (RPA) 定期变化，持有 IRK 可解析 ✅ 防追踪 手机、手环、门锁
Non-Resolvable Private 完全随机，无法关联 ✅ 完全匿名 匿名广播

11.2 RPA 解析流程图

Central 外设（已绑定 IRK） Central 外设（已绑定 IRK） #mermaid-svg-EeMAgGWX7VNZdhT1{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-EeMAgGWX7VNZdhT1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-EeMAgGWX7VNZdhT1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-EeMAgGWX7VNZdhT1 .error-icon{fill:#552222;}#mermaid-svg-EeMAgGWX7VNZdhT1 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-EeMAgGWX7VNZdhT1 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-EeMAgGWX7VNZdhT1 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-EeMAgGWX7VNZdhT1 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-EeMAgGWX7VNZdhT1 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-EeMAgGWX7VNZdhT1 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-EeMAgGWX7VNZdhT1 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-EeMAgGWX7VNZdhT1 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-EeMAgGWX7VNZdhT1 .marker.cross{stroke:#333333;}#mermaid-svg-EeMAgGWX7VNZdhT1 svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-EeMAgGWX7VNZdhT1 p{margin:0;}#mermaid-svg-EeMAgGWX7VNZdhT1 .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-EeMAgGWX7VNZdhT1 text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-EeMAgGWX7VNZdhT1 .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-EeMAgGWX7VNZdhT1 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-EeMAgGWX7VNZdhT1 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-EeMAgGWX7VNZdhT1 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-EeMAgGWX7VNZdhT1 #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-EeMAgGWX7VNZdhT1 .sequenceNumber{fill:white;}#mermaid-svg-EeMAgGWX7VNZdhT1 #sequencenumber{fill:#333;}#mermaid-svg-EeMAgGWX7VNZdhT1 #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-EeMAgGWX7VNZdhT1 .messageText{fill:#333;stroke:none;}#mermaid-svg-EeMAgGWX7VNZdhT1 .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-EeMAgGWX7VNZdhT1 .labelText,#mermaid-svg-EeMAgGWX7VNZdhT1 .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-EeMAgGWX7VNZdhT1 .loopText,#mermaid-svg-EeMAgGWX7VNZdhT1 .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-EeMAgGWX7VNZdhT1 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-EeMAgGWX7VNZdhT1 .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-EeMAgGWX7VNZdhT1 .noteText,#mermaid-svg-EeMAgGWX7VNZdhT1 .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-EeMAgGWX7VNZdhT1 .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-EeMAgGWX7VNZdhT1 .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-EeMAgGWX7VNZdhT1 .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-EeMAgGWX7VNZdhT1 .actorPopupMenu{position:absolute;}#mermaid-svg-EeMAgGWX7VNZdhT1 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-EeMAgGWX7VNZdhT1 .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-EeMAgGWX7VNZdhT1 .actor-man circle,#mermaid-svg-EeMAgGWX7VNZdhT1 line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-EeMAgGWX7VNZdhT1 :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 用 IRK + prand 生成 RPA alt 解析成功 解析失败 广播/连接（使用 RPA） 1 用已绑定 IRK 尝试解析 RPA 2 识别为已绑定设备 3 直接使用已保存 LTK 加密 4 视为新设备 5 触发重新配对 6

11.3 地址选择建议

#mermaid-svg-CejMVF36Bk9xexrV{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-CejMVF36Bk9xexrV .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-CejMVF36Bk9xexrV .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-CejMVF36Bk9xexrV .error-icon{fill:#552222;}#mermaid-svg-CejMVF36Bk9xexrV .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-CejMVF36Bk9xexrV .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-CejMVF36Bk9xexrV .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-CejMVF36Bk9xexrV .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-CejMVF36Bk9xexrV .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-CejMVF36Bk9xexrV .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-CejMVF36Bk9xexrV .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-CejMVF36Bk9xexrV .marker{fill:#333333;stroke:#333333;}#mermaid-svg-CejMVF36Bk9xexrV .marker.cross{stroke:#333333;}#mermaid-svg-CejMVF36Bk9xexrV svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-CejMVF36Bk9xexrV p{margin:0;}#mermaid-svg-CejMVF36Bk9xexrV .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-CejMVF36Bk9xexrV .cluster-label text{fill:#333;}#mermaid-svg-CejMVF36Bk9xexrV .cluster-label span{color:#333;}#mermaid-svg-CejMVF36Bk9xexrV .cluster-label span p{background-color:transparent;}#mermaid-svg-CejMVF36Bk9xexrV .label text,#mermaid-svg-CejMVF36Bk9xexrV span{fill:#333;color:#333;}#mermaid-svg-CejMVF36Bk9xexrV .node rect,#mermaid-svg-CejMVF36Bk9xexrV .node circle,#mermaid-svg-CejMVF36Bk9xexrV .node ellipse,#mermaid-svg-CejMVF36Bk9xexrV .node polygon,#mermaid-svg-CejMVF36Bk9xexrV .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-CejMVF36Bk9xexrV .rough-node .label text,#mermaid-svg-CejMVF36Bk9xexrV .node .label text,#mermaid-svg-CejMVF36Bk9xexrV .image-shape .label,#mermaid-svg-CejMVF36Bk9xexrV .icon-shape .label{text-anchor:middle;}#mermaid-svg-CejMVF36Bk9xexrV .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-CejMVF36Bk9xexrV .rough-node .label,#mermaid-svg-CejMVF36Bk9xexrV .node .label,#mermaid-svg-CejMVF36Bk9xexrV .image-shape .label,#mermaid-svg-CejMVF36Bk9xexrV .icon-shape .label{text-align:center;}#mermaid-svg-CejMVF36Bk9xexrV .node.clickable{cursor:pointer;}#mermaid-svg-CejMVF36Bk9xexrV .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-CejMVF36Bk9xexrV .arrowheadPath{fill:#333333;}#mermaid-svg-CejMVF36Bk9xexrV .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-CejMVF36Bk9xexrV .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-CejMVF36Bk9xexrV .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-CejMVF36Bk9xexrV .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-CejMVF36Bk9xexrV .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-CejMVF36Bk9xexrV .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-CejMVF36Bk9xexrV .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-CejMVF36Bk9xexrV .cluster text{fill:#333;}#mermaid-svg-CejMVF36Bk9xexrV .cluster span{color:#333;}#mermaid-svg-CejMVF36Bk9xexrV div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-CejMVF36Bk9xexrV .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-CejMVF36Bk9xexrV rect.text{fill:none;stroke-width:0;}#mermaid-svg-CejMVF36Bk9xexrV .icon-shape,#mermaid-svg-CejMVF36Bk9xexrV .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-CejMVF36Bk9xexrV .icon-shape p,#mermaid-svg-CejMVF36Bk9xexrV .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-CejMVF36Bk9xexrV .icon-shape .label rect,#mermaid-svg-CejMVF36Bk9xexrV .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-CejMVF36Bk9xexrV .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-CejMVF36Bk9xexrV .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-CejMVF36Bk9xexrV :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 否
是
是
否
产品是否需要防追踪？
Public 或 Static Random
是否需要被已绑定设备识别？
✅ RPA

（需分发 IRK）
✅ Non-Resolvable Private

工程建议：需要防追踪的产品应使用 RPA，并在绑定阶段分发 IRK；否则固定地址会暴露用户行踪。

12 常见安全配置与排障

12.1 常见现象与排查方向

现象 可能原因 排查方向
配对失败 IO Capability 不匹配 检查配对方法矩阵
配对成功但无 MITM 使用了 Just Works 检查 AuthReq 和 IO 能力
读写返回权限不足 GATT 权限要求认证 检查加密/认证状态
重连不加密 未绑定或 LTK 丢失 检查绑定存储
手机显示"配对失败" 密钥分发不完整 抓 SMP 包看阶段 3
RPA 频繁变化导致重连慢 未保存 IRK 检查 Identity Information
旧设备兼容性问题 Legacy/SC 协商差异 抓包看 Pairing Request/Response

12.2 抓包重点速查

PDU 看什么
Pairing Request/Response IO Capability、AuthReq、密钥分发字段
Pairing Confirm/Random 配对方法、确认流程
Public Key 是否使用 LE SC
Encryption Information LTK 分发
Identity Information IRK 分发
Signing Information CSRK 分发

12.3 排障决策树

#mermaid-svg-Fu7gIzVCWOCZW69T{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-Fu7gIzVCWOCZW69T .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-Fu7gIzVCWOCZW69T .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-Fu7gIzVCWOCZW69T .error-icon{fill:#552222;}#mermaid-svg-Fu7gIzVCWOCZW69T .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-Fu7gIzVCWOCZW69T .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-Fu7gIzVCWOCZW69T .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-Fu7gIzVCWOCZW69T .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-Fu7gIzVCWOCZW69T .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-Fu7gIzVCWOCZW69T .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-Fu7gIzVCWOCZW69T .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-Fu7gIzVCWOCZW69T .marker{fill:#333333;stroke:#333333;}#mermaid-svg-Fu7gIzVCWOCZW69T .marker.cross{stroke:#333333;}#mermaid-svg-Fu7gIzVCWOCZW69T svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-Fu7gIzVCWOCZW69T p{margin:0;}#mermaid-svg-Fu7gIzVCWOCZW69T .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-Fu7gIzVCWOCZW69T .cluster-label text{fill:#333;}#mermaid-svg-Fu7gIzVCWOCZW69T .cluster-label span{color:#333;}#mermaid-svg-Fu7gIzVCWOCZW69T .cluster-label span p{background-color:transparent;}#mermaid-svg-Fu7gIzVCWOCZW69T .label text,#mermaid-svg-Fu7gIzVCWOCZW69T span{fill:#333;color:#333;}#mermaid-svg-Fu7gIzVCWOCZW69T .node rect,#mermaid-svg-Fu7gIzVCWOCZW69T .node circle,#mermaid-svg-Fu7gIzVCWOCZW69T .node ellipse,#mermaid-svg-Fu7gIzVCWOCZW69T .node polygon,#mermaid-svg-Fu7gIzVCWOCZW69T .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-Fu7gIzVCWOCZW69T .rough-node .label text,#mermaid-svg-Fu7gIzVCWOCZW69T .node .label text,#mermaid-svg-Fu7gIzVCWOCZW69T .image-shape .label,#mermaid-svg-Fu7gIzVCWOCZW69T .icon-shape .label{text-anchor:middle;}#mermaid-svg-Fu7gIzVCWOCZW69T .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-Fu7gIzVCWOCZW69T .rough-node .label,#mermaid-svg-Fu7gIzVCWOCZW69T .node .label,#mermaid-svg-Fu7gIzVCWOCZW69T .image-shape .label,#mermaid-svg-Fu7gIzVCWOCZW69T .icon-shape .label{text-align:center;}#mermaid-svg-Fu7gIzVCWOCZW69T .node.clickable{cursor:pointer;}#mermaid-svg-Fu7gIzVCWOCZW69T .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-Fu7gIzVCWOCZW69T .arrowheadPath{fill:#333333;}#mermaid-svg-Fu7gIzVCWOCZW69T .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-Fu7gIzVCWOCZW69T .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-Fu7gIzVCWOCZW69T .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Fu7gIzVCWOCZW69T .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-Fu7gIzVCWOCZW69T .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Fu7gIzVCWOCZW69T .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-Fu7gIzVCWOCZW69T .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-Fu7gIzVCWOCZW69T .cluster text{fill:#333;}#mermaid-svg-Fu7gIzVCWOCZW69T .cluster span{color:#333;}#mermaid-svg-Fu7gIzVCWOCZW69T div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-Fu7gIzVCWOCZW69T .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-Fu7gIzVCWOCZW69T rect.text{fill:none;stroke-width:0;}#mermaid-svg-Fu7gIzVCWOCZW69T .icon-shape,#mermaid-svg-Fu7gIzVCWOCZW69T .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-Fu7gIzVCWOCZW69T .icon-shape p,#mermaid-svg-Fu7gIzVCWOCZW69T .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-Fu7gIzVCWOCZW69T .icon-shape .label rect,#mermaid-svg-Fu7gIzVCWOCZW69T .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-Fu7gIzVCWOCZW69T .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-Fu7gIzVCWOCZW69T .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-Fu7gIzVCWOCZW69T :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 否
是
否
是
否
是
否
是
BLE 安全问题
配对是否成功？
检查 IO Capability

和配对方法矩阵
是否加密？
检查 LTK 分发

和 Bonding Flag
是否认证（MITM）？
检查 AuthReq

和配对方法
重连是否正常？
检查绑定存储

和 IRK 解析
✅ 安全配置基本正常

13 阶段检查点

  • 能解释配对与绑定的区别，并说明绑定需要保存哪些密钥。
  • 能根据双方 IO Capability 查表确定配对方法。
  • 能说清 Legacy Pairing 与 LE Secure Connections 的安全差异。
  • 能列出 STK、LTK、IRK、CSRK 的用途和生命周期。
  • 能解释 RPA 的工作原理，以及 IRK 在其中的作用。
  • 能为一个具体产品选择安全等级、配对方法和地址类型。
  • 能用 Wireshark 抓 SMP 包，识别配对三阶段和密钥分发。
  • 能排查"配对成功但重连不加密""读写权限不足"等常见问题。

14 动手实验

实验 工具 预期收获
实现 Just Works 配对并抓包 开发板 + Wireshark + BLE Sniffer 看到 Pairing Request/Response、Confirm/Random
实现 Passkey Entry 配对 开发板 + 手机 理解 Passkey 在协议中的传递和验证
实现 Numeric Comparison 支持 LE SC 的开发板 + 手机 观察 Public Key 和数字确认流程
对比绑定前后重连行为 开发板 + 手机 理解 LTK 保存与加密重连
观察 RPA 地址变化 nRF Connect 理解隐私地址和 IRK 解析
配置 GATT 认证权限 开发板 验证未认证时读写被拒绝
删除绑定并重新配对 手机 + 开发板 排查绑定信息不同步问题

14.1 推荐实验流程

#mermaid-svg-RQAnT2ggPDkketRy{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-RQAnT2ggPDkketRy .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-RQAnT2ggPDkketRy .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-RQAnT2ggPDkketRy .error-icon{fill:#552222;}#mermaid-svg-RQAnT2ggPDkketRy .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-RQAnT2ggPDkketRy .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-RQAnT2ggPDkketRy .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-RQAnT2ggPDkketRy .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-RQAnT2ggPDkketRy .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-RQAnT2ggPDkketRy .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-RQAnT2ggPDkketRy .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-RQAnT2ggPDkketRy .marker{fill:#333333;stroke:#333333;}#mermaid-svg-RQAnT2ggPDkketRy .marker.cross{stroke:#333333;}#mermaid-svg-RQAnT2ggPDkketRy svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-RQAnT2ggPDkketRy p{margin:0;}#mermaid-svg-RQAnT2ggPDkketRy .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-RQAnT2ggPDkketRy .cluster-label text{fill:#333;}#mermaid-svg-RQAnT2ggPDkketRy .cluster-label span{color:#333;}#mermaid-svg-RQAnT2ggPDkketRy .cluster-label span p{background-color:transparent;}#mermaid-svg-RQAnT2ggPDkketRy .label text,#mermaid-svg-RQAnT2ggPDkketRy span{fill:#333;color:#333;}#mermaid-svg-RQAnT2ggPDkketRy .node rect,#mermaid-svg-RQAnT2ggPDkketRy .node circle,#mermaid-svg-RQAnT2ggPDkketRy .node ellipse,#mermaid-svg-RQAnT2ggPDkketRy .node polygon,#mermaid-svg-RQAnT2ggPDkketRy .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-RQAnT2ggPDkketRy .rough-node .label text,#mermaid-svg-RQAnT2ggPDkketRy .node .label text,#mermaid-svg-RQAnT2ggPDkketRy .image-shape .label,#mermaid-svg-RQAnT2ggPDkketRy .icon-shape .label{text-anchor:middle;}#mermaid-svg-RQAnT2ggPDkketRy .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-RQAnT2ggPDkketRy .rough-node .label,#mermaid-svg-RQAnT2ggPDkketRy .node .label,#mermaid-svg-RQAnT2ggPDkketRy .image-shape .label,#mermaid-svg-RQAnT2ggPDkketRy .icon-shape .label{text-align:center;}#mermaid-svg-RQAnT2ggPDkketRy .node.clickable{cursor:pointer;}#mermaid-svg-RQAnT2ggPDkketRy .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-RQAnT2ggPDkketRy .arrowheadPath{fill:#333333;}#mermaid-svg-RQAnT2ggPDkketRy .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-RQAnT2ggPDkketRy .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-RQAnT2ggPDkketRy .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-RQAnT2ggPDkketRy .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-RQAnT2ggPDkketRy .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-RQAnT2ggPDkketRy .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-RQAnT2ggPDkketRy .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-RQAnT2ggPDkketRy .cluster text{fill:#333;}#mermaid-svg-RQAnT2ggPDkketRy .cluster span{color:#333;}#mermaid-svg-RQAnT2ggPDkketRy div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-RQAnT2ggPDkketRy .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-RQAnT2ggPDkketRy rect.text{fill:none;stroke-width:0;}#mermaid-svg-RQAnT2ggPDkketRy .icon-shape,#mermaid-svg-RQAnT2ggPDkketRy .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-RQAnT2ggPDkketRy .icon-shape p,#mermaid-svg-RQAnT2ggPDkketRy .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-RQAnT2ggPDkketRy .icon-shape .label rect,#mermaid-svg-RQAnT2ggPDkketRy .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-RQAnT2ggPDkketRy .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-RQAnT2ggPDkketRy .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-RQAnT2ggPDkketRy :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} 实验 1

Just Works 抓包
实验 2

Passkey Entry
实验 3

Numeric Comparison
实验 4

绑定前后对比
实验 5

RPA 观察
实验 6

GATT 权限验证
实验 7

删除绑定排障

15 面试与工程高频问题

问题 回答要点
BLE 配对和绑定有什么区别？ 配对建立密钥，绑定保存密钥供重连
Just Works 为什么不安全？ 无 MITM 防护，TK 为 0
LE SC 为什么更安全？ ECDH P-256，抗窃听，支持 Numeric Comparison
LTK、IRK、CSRK 分别做什么？ 加密、解析 RPA、数据签名
RPA 如何防追踪？ 地址定期变化，只有持有 IRK 的对端能解析
如何选择配对方法？ 查 IO Capability 矩阵，优先 NC/PE，最后 JW
配对成功但读写失败？ 检查 GATT 权限和链路认证状态
重连不加密怎么办？ 检查绑定存储、LTK 分发和加密请求

阶段总结

BLE 安全机制的核心：配对建立密钥、绑定保存密钥、加密保护链路、认证防中间人、隐私地址防追踪。

工程上最容易出问题的地方不是协议本身，而是：

  1. 配对方法选择（IO Capability 不匹配导致降级为 Just Works）
  2. 绑定信息存储（未保存 LTK/IRK 导致重连需要重新配对）
  3. GATT 权限配置（加密/认证状态不满足导致读写失败）
  4. RPA/IRK 配套（未分发 IRK 导致隐私地址无法解析）

建议：用 Wireshark 抓一次完整配对包，把 Pairing Request/Response、Confirm/Random、密钥分发三个阶段对应起来，这一阶段就算真正入门了。

相关推荐
K成长日志4 天前
BLE Host层L2CAP -- 配置参数选项
物联网·网络协议·嵌入式·蓝牙·iot·ble·bluetooth
你怎么知道我是队长5 天前
BLE 协议栈深入：从物理层到应用层的系统性拆解
bluetooth
你怎么知道我是队长15 天前
经典蓝牙 - 中间人攻击（MIMT） - Method Confusion Attack（2021）
bluetooth
你怎么知道我是队长18 天前
经典蓝牙 - 安全机制 - Numeric Comparison和justwork的差异是什么？
bluetooth
你怎么知道我是队长1 个月前
经典蓝牙（BR/EDR）核心流程详解：设备发现、连接建立、配对绑定与服务发现
bluetooth
rls_v2 个月前
jieli：I2S外设是如何工作的?
bluetooth
rls_v2 个月前
什么是蓝牙的信令测试
bluetooth
rls_v2 个月前
AC696X-双模蓝牙功耗与时隙分析
bluetooth
rls_v2 个月前
经典蓝牙音量同步机制
bluetooth
热门推荐
01如何新建文件夹？ 电脑新建文件夹的4种方法02国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）03历年考研数学一、数学二、数学三真题试卷及答案PDF04GitHub 镜像站点05几个好用的ip纯净度检测网站06昇腾910B系列芯片完全指南：四款型号对比、服务器选型与大模型部署实战07苹果iPA游戏软件资源下载网站08CVE-2026-91403 高危漏洞预警：Java JSSE 信任链被攻破 全场景修复方案与Linux系统级彻底清理实操09蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接10Windows 10/11 如何退出微软账户并改用本地账户登录（含找不到选项的解决方法）