1. 1 Wireless Networks Lecture 39 Bluetooth/Wireless Personal Area Networks (WPAN) Dr. Ghalib A. Shah

2. 2 Outlines  Bluetooth introduction  Technical features  Access technique  Bluetooth topology/scenario  Specifications  Architecture  Core Protocols  Packet format  Link connections

3. 3 Last Lecture  Security primitives in TinySec  Encryption Schemes  Keying mechanism  WMSN ►Architecture ►Applications ►Advantages ►Design Considerations ►Protocols  WSAN ►Motivation ►WSN vs WSAN ►Architecture ►Issues

4. 4 What is Bluetooth?  “Bluetooth wireless technology is ►an open specification for a ►low-cost, low-power, short-range radio technology ►for ad-hoc wireless communication of ►voice and data anywhere in the world.”

5. 5 Ultimate Headset

6. 6 Cordless Computer

7. 7 Bluetooth Application Areas  Data and voice access points ►Real-time voice and data transmissions  Cable replacement ►Eliminates need for numerous cable attachments for connection  Ad hoc networking ►Device with Bluetooth radio can establish connection with another when in range

8. 8 Overview of Bluetooth History  What is Bluetooth? ►Bluetooth is a short-range wireless communications technology.  Why this name? ►It was taken from the 10th century Danish King Harald Blatand who unified Denmark and Norway.  When does it appear? ►1994 – Ericsson study on a wireless technology to link mobile phones & accessories. ►5 companies joined to form the Bluetooth Special Interest Group (SIG) in 1998. ►First specification released in July 1999.

9. 9 Technical features Connection Type Spread Spectrum (Frequency Hopping) & Time Division Duplex (1600 hops/sec) Spectrum 2.4 GHz ISM Open Band (79 MHz of spectrum = 79 channels) ModulationGaussian Frequency Shift Keying Transmission Power1 mw – 100 mw Data Rate1 Mbps Range30 ft Supported Stations8 devices Data Security – Authentication Key 128 bit key Data Security – Encryption Key8-128 bits (configurable) Module size9 x 9 mm

10. 10 Time-Division Duplex Scheme  Channel is divided into consecutive slots (each 625  s)  One packet can be transmitted per slot  Subsequent slots are alternatively used for transmitting and receiving ►Strict alternation of slots between the master and the slaves ►Master can send packets to a slave only in EVEN slots ►Slave can send packets to the master only in the ODD slots

11. 11 Radio Specification  Classes of transmitters ►Class 1: Outputs 100 mW for maximum range Power control mandatory Provides greatest distance ►Class 2: Outputs 2.4 mW at maximum Power control optional ►Class 3: Nominal output is 1 mW Lowest power

12. 12 Typical Bluetooth Scenario  Bluetooth will support wireless point-to-point and point-to-multipoint (broadcast) between devices in a piconet.  Point to Point Link ►Master - slave relationship ►Bluetooth devices can function as masters or slaves  Piconet ►It is the network formed by a Master and one or more slaves (max 7) ►Each piconet is defined by a different hopping channel to which users synchronize to ►Each piconet has max capacity (1 Mbps) ms s s s m

13. 13 Piconet Structure Master Active Slave Parked Slave Standby All devices in piconet hop together. Master’s ID and master’s clock determines frequency hopping sequence & phase. Hopping sequence shared with all devices on piconet Bluetooth devices use time division duplex (TDD) Access technique is TDMA FH-TDD-TDMA

14. 14 Ad-hoc Network – the Scatternet  Inter-piconet communication  Up to 10 piconets in a scatternet  Multiple piconets can operate within same physical space  This is an ad-hoc, peer to peer (P2P) network

15. 15 Bluetooth Standards Documents  Core specifications ► Details of various layers of Bluetooth protocol architecture ► Bluetooth is a layered protocol architecture Core protocols Cable replacement and telephony control protocols Adopted protocols  Profile specifications ► Use of Bluetooth technology to support various applications

16. 16 Profiles  Generic Access Profile  Service Discovery Application Profile  Cordless Telephony Profile  Intercom Profile  Serial Port Profile  Headset Profile  Dial-up Networking Profile  Fax Profile  LAN Access Profile  Generic Object Exchange Profile  Object Push Profile  File Transfer Profile  Synchronization Profile

17. 17 Architecture Core protocols Radio Baseband Link manager protocol (LMP) Logical link control and adaptation protocol (L2CAP) Service discovery protocol (SDP) Cable replacement protocol RFCOMM Telephony control protocol Telephony control specification – binary (TCS BIN) Adopted protocols PPP TCP/UDP/IP OBEX WAE/WAP

18. 18 Core Protocols  Radio: ►defines technical characteristics of BT radios. ►For example licence-free ISM band 2.4 GHz, FHSS at 1600 Hops/sec, 1 MHz channel bandwidth, GMSK modulation, tx power from 100 mw to 1 mw, raw transmission rate of 1 Mbps and so on.  Baseband: ►Defines procedure to communicate with other BT devices like formation of piconets, links in a piconet (ACL or SCO), and access of transmit resources in a piconet etc.  Link Manager protocol (LMP): ►It is transactional protocol between two link management entities used to setup properties of BT link. For example a device may authenticate each other, may learn each others features (SCO/ACL links, size of packet, power consumption mode).  Host Constroller Interface (HCI): ►it is not a protocol rather an interface through which BT devices access the lower layers of BT protocol stack. A device may pass and receive data destined to or coming from another BT device, execute inquiries, request authentication and so on.  Logical Link Control and Adaptation protocol (L2CAP): ►shields the specifics of BT lower layers and provides a packet interface to higher layers.

19. 19 Bluetooth protocols  Service Discovery Protocol (SDP) ►Defines a service record format Information about services provided by attributes Attributes composed of an ID (name) and a value IDs may be universally unique identifiers (UUIDs) ►Defines an inquiry/response protocol for discovering services Searching for and browsing services

20. 20 Bluetooth protocols  RFCOMM (based on GSM TS07.10) ►emulates a serial-port to support a large base of legacy (serial- port-based) applications ►allows multiple “ports” over a single physical channel between two devices  Telephony Control Protocol Spec (TCS) ►call control (setup & release) ►group management for gateway serving multiple devices  Legacy protocol reuse ►reuse existing protocols, e.g., IrDA’s OBEX, or WAP for interacting with applications on phones

21. 21 Baseband  Addressing ►Bluetooth device address (BD_ADDR) –48 bit IEEE MAC address ►Active Member address (AM_ADDR) –3 bits active slave address –all zero broadcast address ►Parked Member address (PM_ADDR) –8 bit parked slave address  This MAC address is split into three parts ►The Non-significant Address Part (NAP) –Used for encryption seed ►The Upper Address part (UAP) –Used for error correction seed initialization & FH sequence generation ►The Lower Address Part (LAP) –Used for FH sequence generation

22. 22 Packet Structure Voice No CRC Data CRC header ARQ FEC (optional) 72 bits54 bits 0 - 2744 bits Access Code Header Payload

23. 23 Types of Access Codes  Channel access code (CAC) – identifies a piconet  Device access code (DAC) – used for paging and subsequent responses  Inquiry access code (IAC) – used for inquiry purposes

24. 24 Inquiry Procedure  Potential master identifies devices in range that wish to participate ► Transmits ID packet with inquiry access code (IAC) ► Occurs in Inquiry state  Device receives inquiry ► Enter Inquiry Response state ► Returns FHS packet with address and timing information ► Moves to page scan state

25. 25 Page Procedure  Master uses devices address to calculate a page frequency-hopping sequence  Master pages with ID packet and device access code (DAC) of specific slave  Slave responds with DAC ID packet  Master responds with its FHS packet  Slave confirms receipt with DAC ID  Slaves moves to Connection state

26. 26 Channel Establishment  Seven sub- states ►Inquiry ►Inquiry scan ►Inquiry response ►Page ►Page scan ►Master response ►Slave response

27. 27 Link Manager Protocol

28. 28 Link Manager Protocol  The Link Manager carries out link setup, authentication & link configuration.  Channel Control ►All the work related to the channel control is managed by the master The master uses polling process for this ►The master is the first device which starts the connection This roles can change (master-slave role switch)

29. 29 Connection State  Active Mode ►Device participates actively on the transmission channel. The master regularly sends a packet to the slaves (polling) to enable the slaves to be able to send a packet to the master and re-synchronise themselves  Sniff Mode ►This is a low consumption mode. A Bluetooth module in the Sniff mode stays synchronised in the piconet. It listens to the piconet at regular intervals (Tsniff) for a short instant on specified slots for its message.  Hold Mode ►The module remains synchronised. This is lower consumption mode than the Sniff mode. Only the counter on the Bluetooth chip in hold mode is active. At the end of the Hold period, the Bluetooth module returns to the active mode.  Park Mode ►A Bluetooth module in this mode is no longer an active member of the piconet. However, it remains synchronised with the master and can listen to a broadcast channel (Beacon Channel).

30. 30  Service provided to the higher layer: ►L2CAP provides connection-oriented and connectionless data services to upper layer protocols ►Protocol multiplexing and demultiplexing capabilities ►Segmentation & reassembly of large packets ►L2CAP permits higher level protocols and applications to transmit and receive L2CAP data packets up to 64 kilobytes in length. L2CAP

31. 31 Links between Master and Slave  Synchronous connection oriented (SCO) ►Allocates fixed bandwidth between point-to-point connection of master and slave ►Master maintains link using reserved slots ►Master can support three simultaneous links ►Bandwidth reservation/QoS ►No retransmissions required or done in this mode  Asynchronous connectionless (ACL) ►Point-to-multipoint link between master and all slaves ►Only single ACL link can exist ►1, 3 or 5 slot packets are defined

32. 32

33. 33 Flow Specification Parameters  QoS parameter in L2CAP defines traffic flow specification indicating the performance level that the sender will attempt to achieve ► Service type ► Token rate (bytes/second) ► Token bucket size (bytes) ► Peak bandwidth (bytes/second) ► Latency (microseconds) ► Delay variation (microseconds)

34. 34 Summary  Bluetooth introduction  Technical features  Access technique  Bluetooth topology/scenario  Specifications  Architecture  Core Protocols  Packet format  Link connections  Next Lecture ►High Speed WPAN