BLE beacon and authorization between phone and a device

[whowhatwhere1234]

Hi guys. I have a question about BLE architecture.

Firstly let me explain my project; Imagine there is a coffee machine that has BLE capabilities. I come near to it with my phone in my pocket and the BLE stack on both machines automatically authorizes my phone as "accepted user" and the machine starts making coffee, without any physical intervention. The important part is that machine does not know if the phone that is near is authorized to use it and so they have to exchange some information.

I have two solutions in mind:

Both devices must act as central & peripheral.

1) Machine advertises beacon forever while scanning. When Smartphone detects the beacon, it activates it's own beacon to send data to the machine. Must be encrypted, and possibly heavy on the battery

or

2) When Smartphone detects the beacon, it establishes connection with machine, exchanges the data and disconnects. (possible the best solution, but it depends on smartphone app implementation)


Is there any other option I'm not seeing? What would be downsides of each approach? Could really use some insight on this.

Thanks!