1. Bluetooth Technology Who Am I?
Tom Tirrell
BSEE Computer Engineering, UofM Ann Arbor
MSEE Computer Engineering/Communication Theory, Wayne State, Detroit
Applications of computers in industry was my profession
Networking computers is my hobby

2. Bluetooth Technology History
10th Century Danish King Harold Blatand (Bluetooth)
1942 The actress Hedy Lamarr invents spread spectrum frequency hopping
1994 Invention of Bluetooth technology
1998 Bluetooth SIG formed
1999 Bluetooth 1.0 Released
2005 Bluetooth 2.0 with Enhanced Data Rate (EDR)
2009 Bluetooth 3.0 with High Speed (HS)
2009 Bluetooth 4.0 low energy
10th Century Danish King Harold Blatand (anglicized as “Bluetooth) unites warring factions in part of what is now Norway, Sweden and Denmark.
1942 Hedy Lamarr invents the basic technology on which Bluetooth is based to make communications between ships and torpedos immune to jamming. The Navy won’t adopt it until the Cuban Missile crisis in 1962, long after her patent has expired.
1994 Engineers at Ericsson, a Swedish communications company invent the technology later called Bluetooth. It was intended as a wireless replacement for the ubiquitous wired data standard RS232C which used to connect many types of computer peripheral devices, printers and such over short distances. Usually 6 feet or less. It never fully realized that market as the cheaper USB cable replaced RS232c and now most computer peripherals connect via Wi-Fi.
1998 Bluetooth SIG formed initially consisting of the Swedish company Ericsson, Intel, Nokia, Toshiba and IBM. It now has more than 24,000 members and is in 90% of all mobile phones. (per SIG)
1999 Bluetooth 1.0 Released
2005 Bluetooth 2.0 with Enhanced Data Rate (EDR)
2009 Bluetooth 3.0 with High Speed (HS)
2009 Bluetooth 4.0 low energy
Each subsequent release incorporates the compatible technologies of earlier releases.

3. Bluetooth Technology Logo
The logo is a bind rune merging the Old Norse Younger Futhark rune for “Hagall” or “Harald” meaning “Hail” and anglicized to “Harold” …
.. And the rune for Bjarkan, anglicized to “Bluetooth” Harald’s initials.
It is said that the inventor at Ericsson, Jim Dardach, was reading Frans G. Bengtsson’s historical novel “the Long Ships” about Vikings and King Harald Bluetooth.
The implication is that Bluetooth unites disparate devices with a universal communications protocol.

4. Bluetooth Technology Version 1
The initial Bluetooth version 1 had a relatively low data rate of 250Kbps suitable for voice transmission and a range of up to 10 meters.
Modulation is Gaussian Phase shift keying (GFSK), one bit per symbol.
If you look at the image of voice bandwidth, which is about 3KHz, you can see that 250Kbps would allow high quality voice transmission at an 8X sample rate.
The dark area shows the response of a filter in a typical telecommunications channel.
The dotted line shows typical human voice energy.
The “Voice Channel” shows guard bands on either side of the “Voice Bandwidth” filter.
Not many devices are sold to this spec any more.
250 Kbps data transfer rate
10m range
Suitable for voice transmission over cell phones

5. Bluetooth Technology Version 2 + EDR
Bluetooth Version 2 + EDR or Enhanced Data Rate uses a different method of modulation, it still uses GFSK header information (transmitter ID, packet type, packet length) but the data payload is encoded with a higher information content modulated 8 phase differential phase shift keying (8DPSK, 3bits/symbol) modulation to achieve a 3Mbps data rate. It also allows for a pi/4 Rotated differential quaternary phase shift keying (pi/4 DQPSK, 2 bits/symbol) to achieve a 2Mbps data rate.
If you look at the image of audio bandwidth, which goes up to 20 KHz, you can see that 3 Mbps would allow high quality audio transmission at an 10X sample rate.
The “+EDR” is important. Without it, you don’t get the higher data rate.
This still is not a high enough data rate for video.
3 Mbps data transfer rate
10m range
Suitable for high quality audio transmission

6. Bluetooth Technology Version 3 +HS/EDR
Version 3 introduces the “High Speed” or HS feature providing theoretical speeds of up to 24 Mbs. Though not over the Bluetooth link itself. Instead, the Bluetooth link is used for establishing the communication channel and the high speed data is carried over a collocated (WiFi) link.
This new feature is referred to as an AMP for Alternative MAC/PHY, where MAC stands for Media Access Control and PHY stands for PHYsical layer. i.e, the link.
The image shows a typical broadcast TV signal with a video bandwidth of 6MHz, transmitting a color signal of 60 frames/s at a resolution of 512 x 512 pixels.
At roughly 8bits/pixel, this would require an uncompressed data rate of 125 Mbps.
1080i HD requires a 50:1 compression ratio to fit into a typical MPEG 20Mbs data stream.
This means that the HS feature is good enough to transmit compressed HD video.
24 Mbps data transfer rate
10m range
Suitable for video data streaming
Requires collocated WiFi link.

7. Bluetooth Technology Version 4 +HS/EDR
This introduces specifications for low energy, low power transmission suitable for sensors that operate remotely for long periods of time using “coin” batteries.
It includes the Classic Bluetooth, Bluetooth HS and Bluetooth low energy protocols.
On the left is a combined gas, light, pressure and humidity sensor from Sensordrome. It uses Bluetooth 4.0 and is user programmable
On the right is a Bluetooth Sensor “beacon” with a 3 axis accelerometer and proximity sensor that can operate up to a year on it’s battery. It is designed to be attached to valuable objects (or people) to track when they are on the move.
Simplified data stack
Enables low energy communication powered by “coin” battery from small sensors.
Incorporates the V3 +HS/EDR spec

8. Bluetooth Technology Versions Version 2.1 or 4.0 are most common
Current active version is 4.2
HS, EDR, Encryption are optional
Most devices currently sold comply with either v2.1 or v4.0
You must carefully examine the specs to see if you are getting HS, EDR or AES Encryption all of which are optional.

9. Bluetooth Technology Classes Class 1: 100 Meter range, 100mW
In addition to the different versions of Bluetooth, there are three classes which define the range of the radio.
The ranges are approximate and affected by dense materials or metal between the transmitter and receiver. It can also be influenced by external antennas attached to either the transmitter or receiver.
Longer range is not necessarily better. You should use a range suitable for the devices that you want to communicate with and not leak unwanted signals to the outside.
Most devices are sold as Class 2 with a typical transmit power of 2.5mW.
Class 1 is typically 100mW similar to WiFi routers in the 2.4GHz band.
Class 3 is typically 1 mW
FCC regulations limit power in this frequency band to 1W. European regulations limit power to 100mW.

10. Applications: Mobil Phones
Bluetooth Technology
Applications: Mobil Phones
On the left is a picture of the information screen on my vehicle.
On the right are some really fancy bluetooth ear pieces.
Both are examples of using Bluetooth to handle phone calls.
Play the video from the Terrain using the VLC media player.
Note that all that is necessary is to confirm that the same number is displayed on both the car screen and the phone screen.
Nothing needs to be entered on either device.
You must be physically close to do this.
Of course, this is terrible security. Even if you can’t see one of the screens, you can just say “Yes” and you will pair with that device.
The Samsung Galaxy S4 uses Bluetooth 4.0 low energy option.
I don’t know what version is in the vehicle but it is Class 2 range.
Use an external microphone/speaker to handle calls from you mobile phone.
Only very short range is required

11. Applications: Remote Speakers (AC Powered)
Bluetooth Technology
Applications: Remote Speakers (AC Powered)
The main difference between this AC powered Bluetooth speaker and the battery powered, is that it is much louder.
No idea what Bluetooth version it is. Has no specs on that.
Only reason I know it is Class 2 is that the manual says it will pair with another Bluetooth device within 30 feet which is approximately 10 meters.
It will play media audio from a paired phone but you can’t answer/hang up the phone.
It has alarm clock/AM/FM radio.
Also has a 3.5mm audio input.
Charger for USB devices.
Optional: Show how to pair with phone and play media audio
Class 2 Bluetooth Radio
Plays Audio from Bluetooth devices
Clock Alarm/Radio

12. Applications: Computer Speakers (Battery Powered)
Bluetooth Technology
Applications: Computer Speakers
(Battery Powered)
Buttons on top:
LH: Play/Pause
RH: Answer/Hang Up Phone calls
Middle Rocker:
LH: Hold down to decrease volume, tap to go to previous track
RH: Hold down to increase volume, tap to go to next track
Indicator lights:
Solid Red: charging
Red LED off: Charge complete
Blinking Blue: Bluetooth not connected, ready to pair
Solid Blue: Bluetooth connected
Rear connections:
LH: On/off switch
Middle: mini USB charging port
RH: 3.5mm audio input
Won’t pair with phone unless the phone is not paired to vehicle.
Phone can only be paired with one device at a time. This is a good security measure.
Do a demo on how to pair with phone for remotely answering a call.
Go thru a demonstration of how to pair the laptop with the battery powered bluetooth speaker.
Also note that the headset mic will go thru the speakers.
Targus TSA-34BT
Class 2: 10 Meter range
Unknown Version probably 2.1

13. Applications: Bluetooth Transmitter
Bluetooth Technology
Applications: Bluetooth Transmitter
As you can see from the USB flash drive that is sitting next to it, this device is tiny.
Unlike the other devices I have shown which are primarily BlueTooth receivers, this is a Bluetooth transmitter.
EDR means that it can transmit high quality audio signals but the specific lack of the HS option means that it is not suitable for streaming video.
It can be used with any device that doesn’t have bluetooth built into it but does have an audio output.
Show demonstration with the Zen driving both the Targus battery operated speaker and the iHome powered speaker.
In order to pair, start with the transmitter off.
Hold down the power button until the blue and green LEDs flash alternately.
When you let go of the power button, the B/G LEDs will flash together.
Turn on the device you wish to pair with and activate pairing.
Once paired, just the green light on the transmitter will stay on.
To pair with the Targus battery operated speaker, you must unplug the iHome or it will pair with it again.
Version 4.0 w/EDR
Class 2: 10 Meter range
Transmits from RCA or 3.5mm jacks

14. Applications: Home Theater
Bluetooth Technology
Applications: Home Theater
Which brings me to the application that has most made an impression on me.
I replaced the high quality, high fidelity home theater speaker system with a Bluetooth soundbar from Vizio.
In my 20 year old sound system, the heart of the system was a very fine Onkyo amplifier/receiver that received all the audio/video from various components and distributed them to video monitors and 5.1 surround sound speakers.
Here is a view from the front.
Heart of the old system was an Onkyo Amplifier/Receiver.

15. Bluetooth Technology Rear View of Onkyo Amplifier/Receiver.
As you can see it had RCA jack connections for a wide variety of components.
In addition, it had a fairly modern optical connection for digital sound.
But it was a rat’s nest.
Their were no HDMI connections.
Rear View of Onkyo Amplifier/Receiver.

16. Modern Home theater systems use a smart TV as the heart of the system
Modern systems use a smart TV with multiple HDMI ports as the heart of audio and video distribution.
You can see here that my TV has 4 HDMI ports, an optical sound output as well as USB, LAN, coax and RCA connections.
Go thru the before pictures and the after pictures.
Modern Home theater systems use a smart TV as the heart of the system

17. Applications: Home Theater
Bluetooth Technology
Applications: Home Theater
The result is that I now have a modern efficient sound system with speakers that are ¼ the size of the old ones and that doesn’t require wires running all over the floor in my den.
The front speakers connect to each other with wires.
The rear speakers, and woofer connect to each other with wires but front to back is a bluetooth connection.
Video from the Blu-Ray player, Cable box, Roku device feed directly into the Smart TV.
Audio output goes to the sound bar via an optical fiber.
Both the Roku and the Blu-Ray player have wireless WiFi connections to the internet.
This is the equipment that I have left over which anyone is welcome to pick up from my house.
Leftover Equipment

18. Applications: Piconets
Bluetooth Technology
Applications: Piconets
These bluetooth smart sensors from Blue Maestro, a UK company in London and Weybridge, can be used to monitor temperature inside or out and are environmentally sealed so they can be buried in flower beds or float in a pool.
Can be monitored via an app on an Android or iPhone and optional Wi-Fi equipment can extend the range of the piconet.
Runs on 2 AA batteries for up to a year.
Floating temperature sensors
50 Meter range, Class ??
Bluetooth Smart (i.e. Version 4.2)

19. Bluetooth Technology Comparison with WiFi
Wi-Fi is faster and longer range
Wi-Fi has better security
Bluetooth is simpler to connect
Although both Bluetooth and Wi-Fi (IEEE b/g/n/c) use the unlicensed (but not un-regulated) 2.4 GHz ISM band they use different modulation techniques and power levels.
Wi-Fi was always intended as a point centric communication technology revolving around routers and hotspots while Bluetooth can pass control around the piconet.
Even though the HS option allows for data transfer in the same range as Wi-Fi, I wasn’t able to find any devices that supported this option.
Neither Microsoft not Google have enabled this option in their software development kits and there is some talk on the discussion boards that ISPs don’t want to enable on this new high speed traffic for free.
Bluetooth frequency hops at 1.6KHz making packets very small and large data transmission inefficient.
Notice that the 2.45 GHz frequency for microwave ovens is right in the middle of the Bluetooth frequency range. It only takes a small amount of 1200 Watt leakage from an oven to disturb a 2.5 mW Bluetooth signal.
I had this happen to the iHome device which was place only about 3 feet away from the microwave.
USB 3.0 cables will also cause interference with BT because the up to 5GHz data transfer rate will radiate noise into the 2.4GHz spectrum. So don’t expect good BT operation when you are downloading data from your 5TB, USB3 external hard drive.

20. Wireless Router Security
Wireless Modes
network standards
protocol
Release[6]
Freq. (GHz)
Bandwidth (MHz)
Data rate per stream (Mbit/s)[7]
Allowable MIMO streams
Modulation
Approximate indoor range[citation needed]
Approximate outdoor range[citation needed]
(m)
(ft) —
Jun 1997
2.4 20
1, 2 1
DSSS, FHSS 66
100
330 a
Sep 1999 5
6, 9, 12, 18, 24, 36, 48, 54
OFDM 35
115
120
390
3.7[A]
5,000
16,000[A] b
5.5, 11
DSSS
140
460 g
Jun 2003
OFDM, DSSS 38
125 n
Oct 2009
2.4/5
7.2, 14.4, 21.7, 28.9, 43.3, 57.8, 65, 72.2[B] 4 70
230
250
820[8] 40
15, 30, 45, 60, 90, 120, 135, 150[B]
820[8
Here is the current list of wireless modes supported by the IEEE standard.
Effective data rate will be cut approximately in ½ when adding encryption.
802.11b rates will be reduced from the max of 11Mb/s to 5.5 an 1 in the presence of noise.
802.llb/g devices will reduce the max data rate of 54Mb/s to b rates if there is an b device on the network.
802.11n devices can achieve up to 600Mb/s but only if each end of the transmission has 4 antennas. This isn’t common.
MIMO means multiple inputs/multiple outputs. The router will have up to 4 separate antennas.
DSSS refers to Direct Sequence Spread Spectrum adds pseudo random noise to the carrier to confuse interception.
Basic modulation is Phase Shift Keyed (PSK)
FHSS refers to Frequency Hopping Spread Spectrum switches the carrier among several channels pseudo randomly.
Basic modulation is Code Division Multiple Access (CDMA).
Both of these spread spectrum techniques help defeat narrowband noise and interception.
OFDM refers to Orthogonal Frequency Division Multiplexing a way of combating noise in the communication channel.
Each a has 52 sub-channels whose basic modulation can be either Quadrature Amplitude Modulation or PSK.
These techniques are used because the 2.4GHz band is subject to interference from microwave ovens, cordless telephones and bluetooth devices.

21. Wireless Router Security
2.4 GHz Channels
Spread Spectrum modulation causes the radio energy to spread across several channels.
Due to the high frequency, short distance, this is usually not a problem
You can select a set of non-overlapping channels when you have several routers
The most common is channels 1, 6 and 11 as shown here.
In North America, only channels 1-11 are used

22. Shannon Hartley Theorem
Technical Notes
Shannon Hartley Theorem
C = B log (base 2) * (1+S/N)
C = channel capacity in bits/sec
B = bandwidth in Hertz
S = signal power in Watts
N = average noise power in Watts
S/N = signal to noise ratio
More noise, lower channel capacity
More bandwidth, higher channel capacity

23. Technical Notes Spread Spectrum
Spread spectrum transmission uses all the channels in a bandwidth but each only for a short amount of time.
To an unauthorized listener, it looks like a small increase in background noise.
Authorized users must have a method to synchronized transmitters and receivers. Either a prearranged sequence of channels or a key within the signal identifying the transmitter and the packet.
Transmit across all channels in the Bandwidth
Each channel is used only a short time
Looks like a small increase in background noise

24. Adaptive Frequency Hopping
Technical Notes
Adaptive Frequency Hopping
Adaptive Frequency Hopping (AFH) identifies bad channels and removes them from the channel hopping list.
This works well with static interference such as Wi-Fi but poorly against other frequency hopping transmissions such as other bluetooth networks.
Here we see a video camera, blue band, and a Wi-Fi device, green band, transmitting on overlapping channels in the 2.4 GHz band.
With AFH, the Wi-Fi moves its channels in the interfering band to lower channels and the camera moves its channels higher.

25. Technical Notes Filter Design
Filter design uses operational amplifiers with inductive, resistive and capacitive elements to either pass certain bandwidths or block them are de-modulate down to original audio or video signals.
Using combinations of resistors, inductors and capacitors to design pass-band and pass-block filters

26. Bluetooth Protocol Stack
Technical Notes
Bluetooth Protocol Stack
Bluetooth protocol stack
Main articles: Bluetooth stack and Bluetooth protocols
Bluetooth Protocol Stack
Bluetooth is defined as a layer protocol architecture consisting of core protocols, cable replacement protocols, telephony control protocols, and adopted protocols.[73] Mandatory protocols for all Bluetooth stacks are: LMP, L2CAP and SDP. In addition, devices that communicate with Bluetooth almost universally can use these protocols: HCI and RFCOMM.
LMP
The Link Management Protocol (LMP) is used for set-up and control of the radio link between two devices. Implemented on the controller.
L2CAP
The Logical Link Control and Adaptation Protocol (L2CAP) Used to multiplex multiple logical connections between two devices using different higher level protocols. Provides segmentation and reassembly of on-air packets.
In Basic mode, L2CAP provides packets with a payload configurable up to 64 kB, with 672 bytes as the default MTU, and 48 bytes as the minimum mandatory supported MTU.
In Retransmission and Flow Control modes, L2CAP can be configured either for isochronous data or reliable data per channel by performing retransmissions and CRC checks.
Bluetooth Core Specification Addendum 1 adds two additional L2CAP modes to the core specification. These modes effectively deprecate original Retransmission and Flow Control modes:
Enhanced Retransmission Mode (ERTM): This mode is an improved version of the original retransmission mode. This mode provides a reliable L2CAP channel.
Streaming Mode (SM): This is a very simple mode, with no retransmission or flow control. This mode provides an unreliable L2CAP channel.
Reliability in any of these modes is optionally and/or additionally guaranteed by the lower layer Bluetooth BDR/EDR air interface by configuring the number of retransmissions and flush timeout (time after which the radio flushes packets). In-order sequencing is guaranteed by the lower layer.
Only L2CAP channels configured in ERTM or SM may be operated over AMP logical links.
SDP
The Service Discovery Protocol (SDP) allows a device to discover services offered by other devices, and their associated parameters. For example, when you use a mobile phone with a Bluetooth headset, the phone uses SDP to determine which Bluetooth profiles the headset can use (Headset Profile, Hands Free Profile, Advanced Audio Distribution Profile (A2DP) etc.) and the protocol multiplexer settings needed for the phone to connect to the headset using each of them. Each service is identified by a Universally Unique Identifier (UUID), with official services (Bluetooth profiles) assigned a short form UUID (16 bits rather than the full 128).
RFCOMM
Radio Frequency Communications (RFCOMM) is a cable replacement protocol used to generate a virtual serial data stream. RFCOMM provides for binary data transport and emulates EIA-232 (formerly RS-232) control signals over the Bluetooth baseband layer, i.e. it is a serial port emulation.
RFCOMM provides a simple reliable data stream to the user, similar to TCP. It is used directly by many telephony related profiles as a carrier for AT commands, as well as being a transport layer for OBEX over Bluetooth.
Many Bluetooth applications use RFCOMM because of its widespread support and publicly available API on most operating systems. Additionally, applications that used a serial port to communicate can be quickly ported to use RFCOMM.
BNEP
The Bluetooth Network Encapsulation Protocol (BNEP) is used for transferring another protocol stack's data via an L2CAP channel. Its main purpose is the transmission of IP packets in the Personal Area Networking Profile. BNEP performs a similar function to SNAP in Wireless LAN.
AVCTP
The Audio/Video Control Transport Protocol (AVCTP) is used by the remote control profile to transfer AV/C commands over an L2CAP channel. The music control buttons on a stereo headset use this protocol to control the music player.
AVDTP
The Audio/Video Distribution Transport Protocol (AVDTP) is used by the advanced audio distribution profile to stream music to stereo headsets over an L2CAP channel. Intended for video distribution profile in the bluetooth transmission.
TCS
The Telephony Control Protocol – Binary (TCS BIN) is the bit-oriented protocol that defines the call control signaling for the establishment of voice and data calls between Bluetooth devices. Additionally, "TCS BIN defines mobility management procedures for handling groups of Bluetooth TCS devices."
TCS-BIN is only used by the cordless telephony profile, which failed to attract implementers. As such it is only of historical interest.
Adopted protocols
Adopted protocols are defined by other standards-making organizations and incorporated into Bluetooth’s protocol stack, allowing Bluetooth to code protocols only when necessary. The adopted protocols include:
Point-to-Point Protocol (PPP): Internet standard protocol for transporting IP datagrams over a point-to-point link.
TCP/IP/UDP: Foundation Protocols for TCP/IP protocol suite
Object Exchange Protocol (OBEX): Session-layer protocol for the exchange of objects, providing a model for object and operation representation
Wireless Application Environment/Wireless Application Protocol (WAE/WAP): WAE specifies an application framework for wireless devices and WAP is an open standard to provide mobile users access to telephony and information services.[73]
Baseband error correction
Depending on packet type, individual packets may be protected by error correction, either 1/3 rate forward error correction (FEC) or 2/3 rate. In addition, packets with CRC will be retransmitted until acknowledged by automatic repeat request (ARQ).
Setting up connections
Any Bluetooth device in discoverable mode transmits the following information on demand:
Device name
Device class
List of services
Technical information (for example: device features, manufacturer, Bluetooth specification used, clock offset)
Any device may perform an inquiry to find other devices to connect to, and any device can be configured to respond to such inquiries. However, if the device trying to connect knows the address of the device, it always responds to direct connection requests and transmits the information shown in the list above if requested. Use of a device's services may require pairing or acceptance by its owner, but the connection itself can be initiated by any device and held until it goes out of range. Some devices can be connected to only one device at a time, and connecting to them prevents them from connecting to other devices and appearing in inquiries until they disconnect from the other device.
Every device has a unique 48-bit address. However, these addresses are generally not shown in inquiries. Instead, friendly Bluetooth names are used, which can be set by the user. This name appears when another user scans for devices and in lists of paired devices.
Most cellular phones have the Bluetooth name set to the manufacturer and model of the phone by default. Most cellular phones and laptops show only the Bluetooth names and special programs are required to get additional information about remote devices. This can be confusing as, for example, there could be several cellular phones in range named T610 (see Bluejacking).
Pairing and bonding
Motivation
Many services offered over Bluetooth can expose private data or let a connecting party control the Bluetooth device. Security reasons make it necessary to recognize specific devices, and thus enable control over which devices can connect to a given Bluetooth device. At the same time, it is useful for Bluetooth devices to be able to establish a connection without user intervention (for example, as soon as in range).
To resolve this conflict, Bluetooth uses a process called bonding, and a bond is generated through a process called pairing. The pairing process is triggered either by a specific request from a user to generate a bond (for example, the user explicitly requests to "Add a Bluetooth device"), or it is triggered automatically when connecting to a service where (for the first time) the identity of a device is required for security purposes. These two cases are referred to as dedicated bonding and general bonding respectively.
Pairing often involves some level of user interaction. This user interaction confirms the identity of the devices. When pairing successfully completes, a bond forms between the two devices, enabling those two devices to connect to each other in the future without repeating the pairing process to confirm device identities. When desired, the user can remove the bonding relationship.
Implementation
During pairing, the two devices establish a relationship by creating a shared secret known as a link key. If both device store the same link key, they are said to be paired or bonded. A device that wants to communicate only with a bonded device can cryptographically authenticate the identity of the other device, ensuring it is the same device it previously paired with. Once a link key is generated, an authenticated Asynchronous Connection-Less (ACL) link between the devices may be encrypted to protect data exchanged data against eavesdropping. Users can delete link keys from either device, which removes the bond between the devices—so it is possible for one device to have a stored link key for a device it is no longer paired with.
Bluetooth services generally require either encryption or authentication, and as such require pairing before they let a remote device connect. Some services, such as the Object Push Profile, elect not to explicitly require authentication or encryption so that pairing does not interfere with the user experience associated with the service use-cases.
Pairing mechanisms
Pairing mechanisms changed significantly with the introduction of Secure Simple Pairing in Bluetooth v2.1. The following summarizes the pairing mechanisms:
Legacy pairing: This is the only method available in Bluetooth v2.0 and before. Each device must enter a PIN code; pairing is only successful if both devices enter the same PIN code. Any 16-byte UTF-8 string may be used as a PIN code; however, not all devices may be capable of entering all possible PIN codes.
Limited input devices: The obvious example of this class of device is a Bluetooth Hands-free headset, which generally have few inputs. These devices usually have a fixed PIN, for example "0000" or "1234", that are hard-coded into the device.
Numeric input devices: Mobile phones are classic examples of these devices. They allow a user to enter a numeric value up to 16 digits in length.
Alpha-numeric input devices: PCs and smartphones are examples of these devices. They allow a user to enter full UTF-8 text as a PIN code. If pairing with a less capable device the user must be aware of the input limitations on the other device, there is no mechanism available for a capable device to determine how it should limit the available input a user may use.
Secure Simple Pairing (SSP): This is required by Bluetooth v2.1, although a Bluetooth v2.1 device may only use legacy pairing to interoperate with a v2.0 or earlier device. Secure Simple Pairing uses a form of public key cryptography, and some types can help protect against man in the middle, or MITM attacks. SSP has the following characteristics:
Just works: As the name implies, this method just works, with no user interaction. However, a device may prompt the user to confirm the pairing process. This method is typically used by headsets with very limited IO capabilities, and is more secure than the fixed PIN mechanism this limited set of devices uses for legacy pairing. This method provides no man-in-the-middle (MITM) protection.
Numeric comparison: If both devices have a display, and at least one can accept a binary yes/no user input, they may use Numeric Comparison. This method displays a 6-digit numeric code on each device. The user should compare the numbers to ensure they are identical. If the comparison succeeds, the user(s) should confirm pairing on the device(s) that can accept an input. This method provides MITM protection, assuming the user confirms on both devices and actually performs the comparison properly.
Passkey Entry: This method may be used between a device with a display and a device with numeric keypad entry (such as a keyboard), or two devices with numeric keypad entry. In the first case, the display is used to show a 6-digit numeric code to the user, who then enters the code on the keypad. In the second case, the user of each device enters the same 6-digit number. Both of these cases provide MITM protection.
Out of band (OOB): This method uses an external means of communication, such as Near Field Communication (NFC) to exchange some information used in the pairing process. Pairing is completed using the Bluetooth radio, but requires information from the OOB mechanism. This provides only the level of MITM protection that is present in the OOB mechanism.
SSP is considered simple for the following reasons:
In most cases, it does not require a user to generate a passkey.
For use-cases not requiring MITM protection, user interaction can be eliminated.
For numeric comparison, MITM protection can be achieved with a simple equality comparison by the user.
Using OOB with NFC enables pairing when devices simply get close, rather than requiring a lengthy discovery process.
Security concerns
Prior to Bluetooth v2.1, encryption is not required and can be turned off at any time. Moreover, the encryption key is only good for approximately 23.5 hours; using a single encryption key longer than this time allows simple XOR attacks to retrieve the encryption key.
Turning off encryption is required for several normal operations, so it is problematic to detect if encryption is disabled for a valid reason or for a security attack.
Bluetooth v2.1 addresses this in the following ways:
Encryption is required for all non-SDP (Service Discovery Protocol) connections
A new Encryption Pause and Resume feature is used for all normal operations that require that encryption be disabled. This enables easy identification of normal operation from security attacks.
The encryption key must be refreshed before it expires.
Link keys may be stored on the device file system, not on the Bluetooth chip itself. Many Bluetooth chip manufacturers let link keys be stored on the device—however, if the device is removable, this means that the link key moves with the device.
Air interface
The protocol operates in the license-free ISM band at 2.402–2.480 GHz.[74] To avoid interfering with other protocols that use the 2.45 GHz band, the Bluetooth protocol divides the band into 79 channels (each 1 MHz wide) and changes channels, generally 1600 times per second. Implementations with versions 1.1 and 1.2 reach speeds of 723.1 kbit/s. Version 2.0 implementations feature Bluetooth Enhanced Data Rate (EDR) and reach 2.1 Mbit/s; this comes with a concomitant higher power consumption. In some cases, the higher data rate is expected to offset this increased drain.
Mandatory protocols for all Bluetooth stacks are: LMP, L2CAP and SDP.

27. Technical Notes Pairing In “Discoverable” mode transmits Device Name
Device Class
List of Services
Specifications (features, mfg., BT version, clock offset.
Pairing may be w/o user interaction where the xmitter and receiver exchange unique keys. Usually this means that only one device can be paired at a time. User interaction to press a button, punch in a code or merely acknowledge that both devices display the same code can allow multiple devices to be paired. There are lots of diff. pairing methods.
Setting up connections
Any Bluetooth device in discoverable mode transmits the following information on demand:
Device name
Device class
List of services
Technical information (for example: device features, manufacturer, Bluetooth specification used, clock offset)
Any device may perform an inquiry to find other devices to connect to, and any device can be configured to respond to such inquiries. However, if the device trying to connect knows the address of the device, it always responds to direct connection requests and transmits the information shown in the list above if requested. Use of a device's services may require pairing or acceptance by its owner, but the connection itself can be initiated by any device and held until it goes out of range. Some devices can be connected to only one device at a time, and connecting to them prevents them from connecting to other devices and appearing in inquiries until they disconnect from the other device.
Every device has a unique 48-bit address. However, these addresses are generally not shown in inquiries. Instead, friendly Bluetooth names are used, which can be set by the user. This name appears when another user scans for devices and in lists of paired devices.
Most cellular phones have the Bluetooth name set to the manufacturer and model of the phone by default. Most cellular phones and laptops show only the Bluetooth names and special programs are required to get additional information about remote devices. This can be confusing as, for example, there could be several cellular phones in range named T610 (see Bluejacking).