Bluetooth Technology Positioning Geography Nomenclature Wireless Technology Off-campus (Open areas) Cellular (Kilometers) PAN LAN WAN 802.11b (10’s-100’s of meters) On-campus (Office, School, Airport, Hotel) Person Space (office, briefcase, person) Bluetooth (meters to 10’s of meters)

Bluetooth Wireless Technology Landline Cable Replacement Data/Voice Access Points Personal Ad-hoc Networks

What does Bluetooth Do? Cable Replacement

Application Framework and Support Host Controller Interface What is Bluetooth? RF Baseband Audio Link Manager LMP L2CAP TCP/IP HID RFCOMM Applications Data Control Application Framework and Support Host Controller Interface HCI Link Manager and L2CAP Radio & Baseband Latest Version on Bluetooth Website: www.Bluetooth.com A hardware description An application framework

What is Bluetooth? A hardware description An application framework Software RF Baseband Audio Link Manager LMP L2CAP TCP/IP HID RFCOMM Applications Data Control A hardware description An application framework Modules

Comparison with IEEE 802 protocol model

Bluetooth Core Specifications A: Radio B: Baseband C: Link Manager D: Logical Link Control E: Service Discovery F: RFCOMM, IrDA, Telephony, WAP H: Host Controllers, USB, Serial, UART I: Compliance: Test modes, Test control interfaces

Bluetooth Radio Modules Complete radio on a module Designed to meet “Limited Module Compliance” (LMA) requirements Pre-certified to meet global regulatory requirements Allows devices assembled with modules to be “self-certified” USB Interface Solder-ball connections External Antennae Compact FLASH Card 25 mm dia 17x33mm 36x43mm

Basic Baseband Protocol One Slot Packet Frame Master Slave 625 us One Slot f k k+1 One Slot Packet Three Slot Packet Frame Master Slave 625 us One Slot f k k+3 One Slot Packet Spread spectrum frequency hopping radio 79 one MHz channels Hops every packet Packets are 1, 3, or 5 slots long Frame consists of two packets Transmit followed by receive Nominally hops at 1600 times a second (1 slot packets)

Packet Types/Data Rates 0000 0001 0010 0011 NULL POLL FHS DM1 1 0100 0101 0110 0111 HV1 HV2 HV3 DH1 2 DV 1000 1001 1010 1011 1100 DM3 DH3 3 1101 1110 1111 DM5 DH5 4 TYPE SEGMENT ACL link SCO link AUX1 108.8 172.8 256.0 384.0 286.7 432.6 576.0 477.8 721.0 54.4 86.4 36.3 57.6 symmetric asymmetric Data Rates (Kbps) Packet Types ACL –Packet like behavior SCO – Circuit like behavior

Bluetooth network topology Radio designation Connected radios can be master or slave Radios are symmetric (same radio can be master or slave) Piconet Master can connect to 7 simultaneous or 256 inactive (parked) slaves per piconet Each piconet has maximum capacity (1 Mbps) Unique hopping pattern/ID Scatternet Piconets can coexist in time and space M S P sb

The Piconet All devices in a piconet hop together B E All devices in a piconet hop together To form a piconet: master gives slaves its clock and device ID Hopping pattern determined by device ID (48-bit) Phase in hopping pattern determined by Clock Non-piconet devices are in standby Piconet Addressing Active Member Address (AMA, 3-bits) Parked Member Address (PMA, 8-bits) or

Inter-connected Piconets: Scatternet Complex scenarios Printer Laptop Mouse Mobile Phone Headset LAN Access Point slave master master/slave

Data Transfer in Piconet master slave Data Master -> Slave 625 us Ack n * 625 us Poll Slave -> Master 625 us Data 625 us Ack

Data Transfer in Scatternet master master/slave slave Data Ack Master -> Slave Data Ack Poll Slave -> Master Poll Data Ack Poll Data Ack

Functional Overview (states) Standby Waiting to join a piconet Inquire Search for devices. Ask about radios to connect to Page Connect to a specific radio. Construct a specific connection. Connected Actively on a piconet (master or slave) Park/Hold Low Power connected states

Inquiry procedure 32 wake-up carriers

Mobile = Battery Life Low power consumption* Low Power Architecture Standby current < 0.3 mA 3 months Voice mode 8-30 mA 75 hours Data mode average 5 mA (0.3-30mA, 20 kbit/s, 25%) 120 hours Low Power Architecture Programmable data length (else radio sleeps) Hold and Park modes 0.6 mA Devices connected but not participating Hold retains AMA address, Park releases AMA, gets PMA address Device can participate within 2 ms *Estimates calculated with 600 mAh battery and internal amplifier, power will vary with implementation

Error Handling Forward-error correction (FEC) ARQ (ACL packets only) 72b 54b 0-2745b access code header payload Forward-error correction (FEC) headers are protected with 1/3 rate FEC and HEC payloads may be FEC protected 1/3 rate: simple bit repetition (SCO packets only) 2/3 rate: (10,15) shortened Hamming code 3/3 rate: no FEC ARQ (ACL packets only) 16-bit CRC (CRC-CCITT) & 1-bit ACK/NACK 1-bit sequence number ®

Bluetooth Security Features Fast Frequency Hopping (79 channels) Low Transmit Power (range <= 10m) Authentication of remote device Based on link key (128 Bit) May be performed in both directions Encryption of payload data Stream cipher algorithm ( 128 Bit) Affects all traffic on a link Initialization PIN entry by user

Bluetooth Security Model PIN PIN User Input (Initialization) E2 E2 Authentication (possibly) Permanent Storage Link Key Link Key E3 E3 Encryption Encryption Key Encryption Key Temporary Storage

Application Level Security Builds on-top of link-level security Creates trusted device groups Security levels for services Authorization required Authentication required Encryption required Different or higher security requirements could be added: Personal authentication Higher security level Public key

Bluetooth Protocols application group middleware protocol group transport protocol group baseband radio

middleware & data applications Transport protocols audio apps middleware & data applications application group (a) (d) (c) radio baseband link manager L2CAP control audio HCI middleware protocol group transport protocol group a: audio d: data c: control Source: Dr. Chatschik Bisdikian [BT_OVERVIEW_UNIVMARYLAND_03_2001.PPT]

Host Controller Interface (HCI) Provides a common interface between the Bluetooth host and a Bluetooth module Interfaces in spec 1.0: USB; UART; RS-232

Link Manager Protocol (LMP) LMP manages the radio link between a master and a slave. Functions covered by LMP: Authentication, pairing, and encryption: basic authentication is handled in the baseband, LMP has to control the exchange of random numbers and signed responses. LMP sets the encryption mode (no encryption, point-to-point, or broadcast), key size, and random speed. Synchronization: Precise synchronization is of major importance within a Bluetooth network. The clock offset is updated each time a packet is received from the master. Devices can also exchange timing information related to slot boundaries between two adjacent piconets. Capability negotiation: devices could support different features of the standard, so devices have to agree the usage of, e.g., multi-slot packets, encryption, SCO links, voice encoding, park/sniff/hold mode, HV2/HV3 packets etc. Quality of service negotiation: Different parameters control the QoS of a Bluetooth device. The poll interval controls the latency and transfer capacity. Depending on the quality of the channel, DM or DH packets may be used (i.e., 2/3 FEC protection or no protection). The number of repetitions for broadcast packets can be controlled. Power control: A Bluetooth device can measure the received signal strength. Depending on this signal level the device can direct the sender of the measured signal to increase or decrease its transmit power (power control). Link supervision: LMP has to control the activity of a link, it may set up new SCO links, or it may declare the failure of a link. State and transmission mode change: Devices might switch the master/slave role, detach themselves from a connection, or change the operating mode.

Link Layer Control & Adaptation (L2CAP) A simple data link protocol over baseband (connection-oriented & connectionless): Protocol Multiplexing Goal: Pass packets used by a particular network protocol to the appropriate handler Segmentation and Reassembly (SAR) Goal: Hinde data link packets lengths from network-layer protocols Quality of Service Goal: Negotiate and enforce Qos contracts (per connection)

L2CAP Connection

Middleware protocols RFCOMM transport protocols PPP IP TCP UDP IrMC audio apps networking apps IrDA apps telephony apps application group OBEX control audio RFCOMM PPP IP TCP UDP SDP telephony based on AT commands IrMC TCS-BIN (b) (a) middleware protocol group transport protocol group transport protocols a: adopted protocol b: Bluetooth specific protocol Source: Dr. Chatschik Bisdikian

Service Discovery Protocol (SDP) Establish L2CAP connection to remote device Query for services search for specific class of service, or browse for services Retrieve attributes that detail how to connect to the service Establish a separate (non-SDP) connection to use the service

SDP Transaction

RFCOMM - Emulates a serial-port to support a large base of legacy (serial-port-based) applications Allows multiple “ports” over a single physical channel between two devices Based on GSM TS 07.10 Design considerations: framing: assemble bit stream into bytes and subsequently, into packets transport: in-sequence, reliable delivery of serial stream control signals: RTS, CTS, DTR

RFCOMM application example: AP Access Why use PPP ? Security Authentication Access control Efficiency header and data compression Auto-configuration Lower barrier for deployment

RF Comm Applications Applications looking for virtual serial ports not supported Legacy TAPI/Unimodem applications see peer devices as NULL Modems Applications enumerate Modem/Serial Devices through Unimodem TAPI = Telephony API Unimodem = Universal Modem Driver, a TAPI service provider

RF Comm Applications Winsock allows for dynamic discovery and communication Talk to the device, not to the conduit (“My Laserjet” versus “LPT2” or “COM23”) Once bonded device is in range the application can find and use it Allows for multiple remote connection to same service Not necessary to manage multiple virtual COMx ports

Telephony Control Protocol (TCS) Call control (setup & release) Group management for gateway serving multiple devices

OBEX Applications Examples Server Client Photos Vcards (not “in the box”) Simple databases Server Registration New Obex Commands and types Application can register as handler for custom commands Client Discovery Navigate directory structure (enumerate objects) Push Pull objects

OBEX Full OBEX 1.2 implementation: COM API Put Get SetPath Definable transactions COM API Extensible to other media and transports

Application group middleware protocols transport protocols Bluetooth adaptation common services platform APIs profile applications new/future (a) (b) application group middleware protocol group transport protocol group middleware protocols transport protocols a: legacy application b: Bluetooth specific application Source: Dr. Chatschik Bisdikian

Interoperability & Profiles Represents default solution for a usage model Vertical slice through the protocol stack Basis for interoperability and logo requirements Each Bluetooth device supports one or more profiles Profiles Protocols Applications

Bluetooth Profile Specifications K:1 Generic Access K:2 Service Discovery K:3 Cordless Telephony K:4 Intercom K:5 Serial Port K:6 Headset K:7 Dial Up Networking K:8 Fax K:9 LAN Access K:10 Generic Object Exchange K:11 Object Push K:12 File Transfer K:13 Synchronization

Bluetooth products Bluetooth Module Ericsson Cell Phone Ericsson Headset R520m, T39m Wireless access to Internet and corporate networks Wireless connection to ThinkPad Non-directional; phone can be in your briefcase Wirelessly update your phone’s address book from your system Insulates you from rapid changes in cellular networks