Bluetooth OOB Handover via NFC without User Confirmation (or: how does Android Beam work)

Question

I'm trying to realize an Android-Beam-like behaviour between an Android Smartphone and a Linux Host. The Android Smartphone (Galaxy Note 3, Android 4.4.2) touches an NFC Dongle connected to the Linux Host and exchanges Bluetooth carrier data via NFC so it then can connect to a Bluetooth Dongle, also connected to the Linux host.

Now the problem is, that the Android Smartphone always asks the User (me) if I really want to pair with the Bluetooth Dongle. In Android Beam between two Android mobiles, this user confirmation doesn't show up, the user only has to click the content (i.e. the picture) to send it (and this is the behaviour I'm trying to get to). I'm using the "nfctool" to sniff the incoming Handshake Request message by the Android mobile (see http://pastebin.com/Dr0D0nqn ). According to the "Bluetooth Secure Simple Pairing Using NFC" document by the NFC Forum (see http://members.nfc-forum.org/resources/AppDocs/NFCForum_AD_BTSSP_1_0.pdf page 19) this Handshake Request should contain a Simple Pairing Hash and a Simple Pairing Randomizer, which are both missing in the Handshake Request by Android.

So my questions are:

• First of all, is Android Beam using Secure Simple Pairing with OOB at all, or another mechanism? Why is the Android Beam between two Android devices working without confirmation of the pairing?
• If it is using SSP, why are the SSP Hash and Randomizer missing in the HR message? Could this be the reason, why my pairing needs user confirmation?
• If Android is using another mechanism, how do the HR messages roughly look like? Do they use a special type name (other than "application/vnd.bluetooth.ep.oob") or anything else in their Handshake Request, which circumvents the user confirmation of the BT pairing?
• Are there any technical documentations (I couldn't find any so far) of Android Beam available? The NFC guide on android developers ( http://developer.android.com/guide/topics/connectivity/nfc/nfc.html ) isn't of much help concerning Android Beam.

Any help is much appreciated :)

Answer 1

I finally found the solution for this problem, and answers to most of my questions:

• Yes, Android is using SSP, but Hash and Randimizer are not mandatory, so it's no must that they are included in the NDEF HR/HS messages.
• Android is using HR messages with type name "application/vnd.bluetooth.ep.oob", this is correct.
• It seems to be sufficient for SSP, if one device confirms the pairing process. So the solution for my problem is, to set the IO capabilities of the Linux Host to "DisplayYesNo" and then autoconfirm the authorization request. This way the Linux host fakes User input and the Android mobile wont ask the User for his confirmation anymore. A quick (and a bit dirty) way to realize this is to change BlueZs "simple-agent" script to confirm every authorization request.