1. Bluetooth Technology Positioning
Geography
Nomenclature
Wireless Technology
Off-campus
(Open areas)
Cellular
(Kilometers)
PAN
LAN
WAN
802.11b
(10’s-100’s of meters)
On-campus
(Office, School, Airport, Hotel)
Person Space
(office, briefcase, person)
Bluetooth
(meters to 10’s of meters)

2. Bluetooth Wireless Technology
Landline
Cable Replacement
Data/Voice Access Points
Personal Ad-hoc Networks

3. What does Bluetooth Do?
Cable Replacement

4. Application Framework and Support Host Controller Interface
What is Bluetooth? RF
Baseband
Audio
Link Manager
LMP
L2CAP
TCP/IP
HID
RFCOMM
Applications
Data
Control
Application Framework and Support
Host Controller Interface
HCI
Link Manager and L2CAP
Radio & Baseband
Latest Version on
Bluetooth Website:
A hardware description
An application framework

5. What is Bluetooth? A hardware description An application framework
Software RF
Baseband
Audio
Link Manager
LMP
L2CAP
TCP/IP
HID
RFCOMM
Applications
Data
Control
A hardware description
An application framework
Modules

6. Comparison with IEEE 802 protocol model

7. Bluetooth Core Specifications
A: Radio
B: Baseband
C: Link Manager
D: Logical Link Control
E: Service Discovery
F: RFCOMM, IrDA, Telephony, WAP
H: Host Controllers, USB, Serial, UART
I: Compliance: Test modes, Test control interfaces

8. Bluetooth Radio Modules
Complete radio on a module
Designed to meet “Limited Module Compliance” (LMA) requirements
Pre-certified to meet global regulatory requirements
Allows devices assembled with modules to be “self-certified”
USB Interface
Solder-ball connections
External Antennae
Compact
FLASH
Card
25 mm dia
17x33mm
36x43mm

9. Basic Baseband Protocol
One
Slot
Packet
Frame
Master
Slave
625 us
One Slot f k
k+1
One
Slot
Packet
Three Slot Packet
Frame
Master
Slave
625 us
One Slot f k
k+3
One
Slot
Packet
Spread spectrum frequency hopping radio
79 one MHz channels
Hops every packet
Packets are 1, 3, or 5 slots long
Frame consists of two packets
Transmit followed by receive
Nominally hops at 1600 times a second (1 slot packets)

10. Packet Types/Data Rates
0000
0001
0010
0011
NULL
POLL
FHS
DM1 1
0100
0101
0110
0111
HV1
HV2
HV3
DH1 2 DV
1000
1001
1010
1011
1100
DM3
DH3 3
1101
1110
1111
DM5
DH5 4
TYPE
SEGMENT
ACL link
SCO link
AUX1
108.8
172.8
256.0
384.0
286.7
432.6
576.0
477.8
721.0
54.4
86.4
36.3
57.6
symmetric
asymmetric
Data Rates (Kbps)
Packet Types
ACL –Packet like behavior
SCO – Circuit like behavior

11. Bluetooth network topology
Radio designation
Connected radios can be master or slave
Radios are symmetric (same radio can be master or slave)
Piconet
Master can connect to 7 simultaneous or 256 inactive (parked) slaves per piconet
Each piconet has maximum capacity (1 Mbps)
Unique hopping pattern/ID
Scatternet
Piconets can coexist in time and space M S P sb

12. The Piconet All devices in a piconet hop togetherB E
All devices in a piconet hop together
To form a piconet: master gives slaves its clock and device ID
Hopping pattern determined by device ID (48-bit)
Phase in hopping pattern determined by Clock
Non-piconet devices are in standby
Piconet Addressing
Active Member Address (AMA, 3-bits)
Parked Member Address (PMA, 8-bits) or

13. Inter-connected Piconets: Scatternet
Complex scenarios
Printer
Laptop
Mouse
Mobile Phone
Headset
LAN
Access Point
slave
master
master/slave

14. Data Transfer in Piconet
master
slave
Data
Master -> Slave
625 us
Ack
n * 625 us
Poll
Slave -> Master
625 us
Data
625 us
Ack

15. Data Transfer in Scatternet
master
master/slave
slave
Data
Ack
Master -> Slave
Data
Ack
Poll
Slave -> Master
Poll
Data
Ack
Poll
Data
Ack

16. Functional Overview (states)
Standby
Waiting to join a piconet
Inquire
Search for devices. Ask about radios to connect to
Page
Connect to a specific radio. Construct a specific connection.
Connected
Actively on a piconet (master or slave)
Park/Hold
Low Power connected states

17. Inquiry procedure
32 wake-up carriers

18. Mobile = Battery Life Low power consumption* Low Power Architecture
Standby current < 0.3 mA
3 months
Voice mode 8-30 mA
75 hours
Data mode average 5 mA
(0.3-30mA, 20 kbit/s, 25%)
120 hours
Low Power Architecture
Programmable data length (else radio sleeps)
Hold and Park modes 0.6 mA
Devices connected but not participating
Hold retains AMA address, Park releases AMA, gets PMA address
Device can participate within 2 ms
*Estimates calculated with 600 mAh battery and internal amplifier, power will vary with implementation

19. Error Handling Forward-error correction (FEC) ARQ (ACL packets only)
72b
54b
0-2745b
access code
header
payload
Forward-error correction (FEC)
headers are protected with 1/3 rate FEC and HEC
payloads may be FEC protected
1/3 rate: simple bit repetition (SCO packets only)
2/3 rate: (10,15) shortened Hamming code
3/3 rate: no FEC
ARQ (ACL packets only)
16-bit CRC (CRC-CCITT) & 1-bit ACK/NACK
1-bit sequence number

20. Bluetooth Security Features
Fast Frequency Hopping (79 channels)
Low Transmit Power (range <= 10m)
Authentication of remote device
Based on link key (128 Bit)
May be performed in both directions
Encryption of payload data
Stream cipher algorithm ( 128 Bit)
Affects all traffic on a link
Initialization
PIN entry by user

21. Bluetooth Security Model
PIN
PIN
User Input
(Initialization) E2 E2
Authentication
(possibly)
Permanent
Storage
Link Key
Link Key E3 E3
Encryption
Encryption Key
Encryption Key
Temporary
Storage

22. Application Level Security
Builds on-top of link-level security
Creates trusted device groups
Security levels for services
Authorization required
Authentication required
Encryption required
Different or higher security requirements could be added:
Personal authentication
Higher security level
Public key

23. Bluetooth Protocols application group middleware protocol group
transport
protocol
group
baseband
radio

24. middleware & data applications
Transport protocols
audio apps
middleware & data applications
application
group
(a)
(d)
(c)
radio
baseband
link
manager
L2CAP
control
audio
HCI
middleware
protocol
group
transport
protocol
group
a: audio
d: data
c: control
Source: Dr. Chatschik Bisdikian [BT_OVERVIEW_UNIVMARYLAND_03_2001.PPT]

25. Host Controller Interface (HCI)
Provides a common interface between the Bluetooth host and a Bluetooth module
Interfaces in spec 1.0: USB; UART; RS-232

26. Link Manager Protocol (LMP)
LMP manages the radio link between a master and a slave. Functions covered by LMP:
Authentication, pairing, and encryption: basic authentication is handled in the baseband, LMP has to control the exchange of random numbers and signed responses. LMP sets the encryption mode (no encryption, point-to-point, or broadcast), key size, and random speed.
Synchronization: Precise synchronization is of major importance within a Bluetooth network. The clock offset is updated each time a packet is received from the master. Devices can also exchange timing information related to slot boundaries between two adjacent piconets.
Capability negotiation: devices could support different features of the standard, so devices have to agree the usage of, e.g., multi-slot packets, encryption, SCO links, voice encoding, park/sniff/hold mode, HV2/HV3 packets etc.
Quality of service negotiation: Different parameters control the QoS of a Bluetooth device. The poll interval controls the latency and transfer capacity. Depending on the quality of the channel, DM or DH packets may be used (i.e., 2/3 FEC protection or no protection). The number of repetitions for broadcast packets can be controlled.
Power control: A Bluetooth device can measure the received signal strength. Depending on this signal level the device can direct the sender of the measured signal to increase or decrease its transmit power (power control).
Link supervision: LMP has to control the activity of a link, it may set up new SCO links, or it may declare the failure of a link.
State and transmission mode change: Devices might switch the master/slave role, detach themselves from a connection, or change the operating mode.

27. Link Layer Control & Adaptation (L2CAP)
A simple data link protocol over baseband (connection-oriented & connectionless):
Protocol Multiplexing
Goal: Pass packets used by a particular network protocol to the appropriate handler
Segmentation and Reassembly (SAR)
Goal: Hinde data link packets lengths from network-layer protocols
Quality of Service
Goal: Negotiate and enforce Qos contracts (per connection)

28. L2CAP Connection

29. Middleware protocols RFCOMM transport protocols PPP IP TCP UDP IrMC
audio apps
networking
apps
IrDA
apps
telephony apps
application
group
OBEX
control
audio
RFCOMM
PPP IP
TCP
UDP
SDP
telephony
based on AT
commands
IrMC
TCS-BIN
(b)
(a)
middleware
protocol
group
transport
protocol
group
transport protocols
a: adopted protocol
b: Bluetooth specific protocol
Source: Dr. Chatschik Bisdikian

30. Service Discovery Protocol (SDP)
Establish L2CAP connection to remote device
Query for services
search for specific class of service, or
browse for services
Retrieve attributes that detail how to connect to the service
Establish a separate (non-SDP) connection to use the service

31. SDP Transaction

32. RFCOMM
- Emulates a serial-port to support a large base of legacy (serial-port-based) applications
Allows multiple “ports” over a single physical channel between two devices
Based on GSM TS 07.10
Design considerations:
framing: assemble bit stream into bytes and subsequently, into packets
transport: in-sequence, reliable delivery of serial stream
control signals: RTS, CTS, DTR

33. RFCOMM application example: AP Access
Why use PPP ?
Security
Authentication
Access control
Efficiency
header and data compression
Auto-configuration
Lower barrier for deployment

34. RF Comm Applications
Applications looking for virtual serial ports not supported
Legacy TAPI/Unimodem applications see peer devices as NULL Modems
Applications enumerate Modem/Serial Devices through Unimodem
TAPI = Telephony API
Unimodem = Universal Modem Driver, a TAPI service provider

35. RF Comm Applications
Winsock allows for dynamic discovery and communication
Talk to the device, not to the conduit (“My Laserjet” versus “LPT2” or “COM23”)
Once bonded device is in range the application can find and use it
Allows for multiple remote connection to same service
Not necessary to manage multiple virtual COMx ports

36. Telephony Control Protocol (TCS)
Call control (setup & release)
Group management for gateway serving multiple devices

37. OBEX Applications Examples Server Client Photos
Vcards (not “in the box”)
Simple databases
Server
Registration
New Obex Commands and types
Application can register as handler for custom commands
Client
Discovery
Navigate directory structure (enumerate objects)
Push Pull objects

38. OBEX Full OBEX 1.2 implementation: COM API
Put
Get
SetPath
Definable transactions
COM API
Extensible to other media and transports

39. Application group middleware protocols transport protocols
Bluetooth adaptation
common services
platform APIs
profile
applications
new/future
(a)
(b)
application
group
middleware
protocol
group
transport
protocol
group
middleware protocols
transport protocols
a: legacy application
b: Bluetooth specific application
Source: Dr. Chatschik Bisdikian

40. Interoperability & Profiles
Represents default solution for a usage model
Vertical slice through the protocol stack
Basis for interoperability and logo requirements
Each Bluetooth device supports one or more profiles
Profiles
Protocols
Applications

41. Bluetooth Profile Specifications
K:1 Generic Access
K:2 Service Discovery
K:3 Cordless Telephony
K:4 Intercom
K:5 Serial Port
K:6 Headset
K:7 Dial Up Networking
K:8 Fax
K:9 LAN Access
K:10 Generic Object Exchange
K:11 Object Push
K:12 File Transfer
K:13 Synchronization

42. Bluetooth products Bluetooth Module Ericsson Cell Phone
Ericsson Headset R520m, T39m
Wireless access to Internet and corporate networks
Wireless connection to ThinkPad
Non-directional; phone can be in your briefcase
Wirelessly update your phone’s address book from your system
Insulates you from rapid changes in cellular networks