Bluetooth

Bluetooth is a proprietary open wireless technology standard for exchanging data over short distances (using short wavelength radio transmissions) from fixed and mobile devices, creating personal area networks (PANs) with high levels of security(SONY VAIO VGN-FZ21E Battery). Created by telecoms vendor Ericsson in 1994, it was originally conceived as a wireless alternative to RS-232 data cables. It can connect several devices, overcoming problems of synchronization. Today Bluetooth is managed by the Bluetooth Special Interest Group(SONY VAIO VGN-FZ21Z Battery).

Name and logo

The word Bluetooth is an anglicised version of the Scandinavian Blåtand/Blåtann, the epithet of the tenth-century king Harald I of Denmark and parts of Norway who united dissonant Danish tribes into a single kingdom(SONY VAIO VGN-FZ21J Battery). The implication is that Bluetooth does the same with communications protocols, uniting them into one universal standard.

The Bluetooth logo is a bind rune merging the Younger Futhark runes (Hagall) and (Bjarkan), Harald's initials(SONY Vaio VGN-FW11 Battery).

Implementation

Bluetooth uses a radio technology called frequency-hopping spread spectrum, which chops up the data being sent and transmits chunks of it on up to 79 bands (1 MHz each) in the range 2402-2480 MHz. This range is in the globally unlicensed Industrial, Scientific and Medical (ISM) 2.4 GHz short-range radio frequency band(SONY Vaio VGN-FW11M Battery).

Originally Gaussian frequency-shift keying (GFSK) modulation was the only modulation scheme available; subsequently, since the introduction of Bluetooth 2.0+EDR, π/4-DQPSK and 8DPSK modulation may also be used between compatible devices(SONY Vaio VGN-FW11S Battery). Devices functioning with GFSK are said to be operating in basic rate (BR) mode where a gross data rate of 1 Mbit/s is possible. The term enhanced data rate (EDR) is used to describe π/4-DPSK and 8DPSK schemes, each giving 2 and 3 Mbit/s respectively. The combination of these (BR and EDR) modes in Bluetooth radio technology is classified as a "BR/EDR radio"(SONY Vaio VGN-FW21E Battery).

Bluetooth is a packet-based protocol with a master-slave structure. One master may communicate with up to 7 slaves in a piconet; all devices share the master's clock. Packet exchange is based on the basic clock, defined by the master, which ticks at 312.5 µs intervals(SONY Vaio VGN-FW21J Battery). Two clock ticks make up a slot of 625 µs; two slots make up a slot pair of 1250 µs. In the simple case of single-slot packets the master transmits in even slots and receives in odd slots; the slave, conversely, receives in even slots and transmits in odd slots(SONY Vaio VGN-FW21L Battery). Packets may be 1, 3 or 5 slots long but in all cases the master transmit will begin in even slots and the slave transmit in odd slots.

Bluetooth provides a secure way to connect and exchange information between devices such as faxes, mobile phones, telephones, laptops, personal computers, printers, Global Positioning System (GPS) receivers, digital cameras, and video game consoles(SONY Vaio VGN-FW21M Battery).

The Bluetooth specifications are developed and licensed by the Bluetooth Special Interest Group (SIG). The Bluetooth SIG consists of more than 13,000 companies in the areas of telecommunication, computing, networking, and consumer electronics(SONY VGP-BPS13Q Battery).

To be marketed as a Bluetooth device, it must be qualified to standards defined by the SIG.

Communication and connection

A master Bluetooth device can communicate with up to seven devices in a piconet. The devices can switch roles, by agreement, and the slave can become the master at any time.

At any given time, data can be transferred between the master and one other device (except for the little-used broadcast mode) (SONY VGP-BPS13B/Q Battery). The master chooses which slave device to address; typically, it switches rapidly from one device to another in a round-robin fashion.

The Bluetooth Core Specification provides for the connection of two or more piconets to form a scatternet, in which certain devices serve as bridges, simultaneously playing the master role in one piconet and the slave role in another(SONY VGN NR11S/S battery).

Many USB Bluetooth adapters or "dongles" are available, some of which also include an IrDA adapter(SONY VGN NR11M/S battery). Older (pre-2003) Bluetooth dongles, however, have limited capabilities, offering only the Bluetooth Enumerator and a less-powerful Bluetooth Radio incarnation. Such devices can link computers with Bluetooth with a distance of 100 meters, but they do not offer much in the way of services that modern adapters do(SONY VGN NR11Z/S battery).

Bluetooth profiles

Main article: Bluetooth profile

To use Bluetooth wireless technology, a device must be able to interpret certain Bluetooth profiles, which are definitions of possible applications and specify general behaviors that Bluetooth enabled devices use to communicate with other Bluetooth devices(SONY VGN NR11Z/T battery). There are a wide range of Bluetooth profiles that describe many different types of applications or use cases for devices.

For the new protocol architecture low energy massive interests obviously hamper the publicating of additional profiles and thus the sales of respective chips. The respective announcements were not accomplished as forecasted(SONY VGP-BPS13A/Q Battery). Insofar in the ninth year after first adoption with the Wibree(R) concepts in 2002 the promises again could not be served by the developing industry and the leading Bluetooth SIG(SONY Vaio PCG-F305 battery).

List of applications

Wireless control of and communication between a mobile phone and a handsfree headset. This was one of the earliest applications to become popular.

Wireless networking between PCs in a confined space and where little bandwidth is required(SONY VGP-BPS21/S Battery).

Wireless communication with PC input and output devices, the most common being the mouse, keyboard and printer.

Transfer of files, contact details, calendar appointments, and reminders between devices with OBEX(SONY VGP-BPS21 Battery).

Replacement of traditional wired serial communications in test equipment, GPS receivers, medical equipment, bar code scanners, and traffic control devices.

For controls where infrared was traditionally used(SONY VGP-BPS21B Battery).

For low bandwidth applications where higher USB bandwidth is not required and cable-free connection desired.

Sending small advertisements from Bluetooth-enabled advertising hoardings to other, discoverable, Bluetooth devices(SONY VGP-BPS21A/B Battery).

Wireless bridge between two Industrial Ethernet (e.g., PROFINET) networks.

Three seventh-generation game consoles, Nintendo's Wii and Sony's PlayStation 3 and PSP Go, use Bluetooth for their respective wireless controllers(SONY VAIO PCG-5K1L battery).

Dial-up internet access on personal computers or PDAs using a data-capable mobile phone as a wireless modem like Novatel mifi.

Short range transmission of health sensor data from medical devices to mobile phone, set-top box or dedicated telehealth devices(SONY VAIO PCG-6W2L battery).

Allowing a DECT phone to ring and answer calls on behalf of a nearby cell phone

Real-time location systems (RTLS), are used to track and identify the location of objects in real-time using “Nodes” or “tags” attached to, or embedded in the objects tracked, and “Readers” that receive and process the wireless signals from these tags to determine their locations(SONY VAIO PCG-7112L battery).Tracking livestock and detainees. According to a leaked diplomatic cable, King Abdullah of Saudi Arabia suggested "implanting detainees with an electronic chip containing information about them and allowing their movements to be tracked with Bluetooth. This was done with horses and falcons, the King said." (SONY VAIO PCG-8Z1L battery)

Personal security application on mobile phones for theft prevention. The protected item has a Bluetooth marker (e.g. a headset) that is monitored continuously by the security application. If connection is lost (the marker is out of range) then an alarm is raised. The first known implementation of this security application of Bluetooth is BluCop, which is published in December 2010(SONY VAIO PCG-8Z2L battery).

Bluetooth vs. Wi-Fi IEEE 802.11 in networking

Bluetooth and Wi-Fi have many applications: setting up networks, printing, or transferring files.

Wi-Fi is intended for resident equipment and its applications. The category of applications is outlined as WLAN, the wireless local area networks. Wi-Fi is intended as a replacement for cabling for general local area network access in work areas(SONY VAIO PCG-8Y2L battery).

Bluetooth is intended for non-resident equipment and its applications. The category of applications is outlined as the wireless personal area network (WPAN). Bluetooth is a replacement for cabling in a variety of personally carried applications in any ambiance and can also support fixed location applications such as smart energy functionality in the home (thermostats, etc.) (SONY VAIO PCG-8Y1L battery).

Wi-Fi is a wireless version of a traditional Ethernet network, and requires configuration to set up shared resources, transmit files, and to set up audio links (for example, headsets and hands-free devices) (SONY VAIO PCG-7Z2L battery). Wi-Fi uses the same radio frequencies as Bluetooth, but with higher power, resulting in a faster connection and better range from the base station. The nearest equivalents in Bluetooth are the DUN profile, which allows devices to act as modem interfaces, and the PAN profile, which allows for ad-hoc networking(SONY VAIO PCG-7Z1L battery).

Bluetooth devices

Bluetooth exists in many products, such as the iPod Touch, Lego Mindstorms NXT, PlayStation 3, PSP Go, telephones, the Nintendo Wii, and some high definition headsets, modems, and watches(SONY VAIO PCG-7133L battery). The technology is useful when transferring information between two or more devices that are near each other in low-bandwidth situations. Bluetooth is commonly used to transfer sound data with telephones (i.e., with a Bluetooth headset) or byte data with hand-held computers (transferring files) (SONY VAIO PCG-7113L battery).

Bluetooth protocols simplify the discovery and setup of services between devices.[citation needed] Bluetooth devices can advertise all of the services they provide. This makes using services easier because more of the security, network address and permission configuration can be automated than with many other network types(SONY VAIO PCG-6W3L battery).

Computer requirements

A personal computer that does not have embedded Bluetooth can be used with a Bluetooth adapter that will enable the PC to communicate with other Bluetooth devices (such as mobile phones, mice and keyboards) (SONY VAIO PCG-7111L battery). While some desktop computers and most recent laptops come with a built-in Bluetooth radio, others will require an external one in the form of a dongle.

Unlike its predecessor, IrDA, which requires a separate adapter for each device, Bluetooth allows multiple devices to communicate with a computer over a single adapter(SONY VAIO PCG-6W1L battery).

Operating system support

For more details on this topic, see Bluetooth stack.

Apple has supported Bluetooth since Mac OS X v10.2 which was released in 2002.[17]

For Microsoft platforms, Windows XP Service Pack 2 and SP3 releases have native support for Bluetooth 1.1, 2.0 and 2.0+EDR(SONY VAIO PCG-6V1L battery). Previous versions required users to install their Bluetooth adapter's own drivers, which were not directly supported by Microsoft. Microsoft's own Bluetooth dongles (packaged with their Bluetooth computer devices) have no external drivers and thus require at least Windows XP Service Pack 2(SONY VAIO PCG-6S3L battery). Windows Vista RTM/SP1 with the Feature Pack for Wireless or Windows Vista SP2 support Bluetooth 2.1+EDR. Windows 7 supports Bluetooth 2.1+EDR and Extended Inquiry Response (EIR) (SONY VAIO PCG-6S2L battery).

The Windows XP and Windows Vista/Windows 7 Bluetooth stacks support the following Bluetooth profiles natively: PAN, SPP, DUN, HID, HCRP. The Windows XP stack can be replaced by a third party stack which may support more profiles or newer versions of Bluetooth(SONY VAIO PCG-5J2L battery). The Windows Vista/Windows 7 Bluetooth stack supports vendor-supplied additional profiles without requiring the Microsoft stack to be replaced.

Linux has two popular Bluetooth stacks, BlueZ and Affix. The BlueZ stack is included with most Linux kernels and was originally developed by Qualcomm(SONY VAIO PCG-5L1L battery). The Affix stack was developed by Nokia. FreeBSD features Bluetooth support since its 5.0 release. NetBSD features Bluetooth support since its 4.0 release. Its Bluetooth stack has been ported to OpenBSD as well(SONY VAIO PCG-5K2L battery).

Mobile phone requirements

A Bluetooth-enabled mobile phone is able to pair with many devices. To ensure the broadest support of feature functionality together with legacy device support, the Open Mobile Terminal Platform (OMTP) forum has published a recommendations paper, entitled "Bluetooth Local Connectivity"(SONY VAIO PCG-5J1L battery).

Specifications and features

The Bluetooth specification was developed in 1994 by Jaap Haartsen and Sven Mattisson, who were working for Ericsson in Lund, Sweden. The specification is based on frequency-hopping spread spectrum technology(SONY VAIO PCG-5G3L battery).

The specifications were formalized by the Bluetooth Special Interest Group (SIG). The SIG was formally announced on May 20, 1998. Today it has a membership of over 13,000 companies worldwide. It was established by Ericsson, IBM, Intel, Toshiba and Nokia, and later joined by many other companies(SONY VAIO PCG-5G2L battery).

Bluetooth v1.0 and v1.0B

Versions 1.0 and 1.0B had many problems, and manufacturers had difficulty making their products interoperable. Versions 1.0 and 1.0B also included mandatory Bluetooth hardware device address (BD_ADDR) transmission in the Connecting process (rendering anonymity impossible at the protocol level) (SONY VGP-BPS13B/S Battery), which was a major setback for certain services planned for use in Bluetooth environments.

Bluetooth v1.1

Ratified as IEEE Standard 802.15.1-2002

Many errors found in the 1.0B specifications were fixed.

Added support for non-encrypted channels.

Received Signal Strength Indicator (RSSI) (SONY VGP-BPS13S Battery).

Bluetooth v1.2

This version is backward compatible with 1.1 and the major enhancements include the following:

Faster Connection and Discovery

Adaptive frequency-hopping spread spectrum (AFH), which improves resistance to radio frequency interference by avoiding the use of crowded frequencies in the hopping sequence(SONY VGP-BPS13AS Battery).

Higher transmission speeds in practice, up to 721 kbit/s, than in 1.1.

Extended Synchronous Connections (eSCO), which improve voice quality of audio links by allowing retransmissions of corrupted packets, and may optionally increase audio latency to provide better support for concurrent data transfer(SONY VGP-BPS13A/S Battery).

Host Controller Interface (HCI) support for three-wire UART.

Ratified as IEEE Standard 802.15.1-2005

Introduced Flow Control and Retransmission Modes for L2CAP.

Bluetooth v2.0 + EDR

This version of the Bluetooth Core Specification was released in 2004 and is backward compatible with the previous version 1.2. The main difference is the introduction of an Enhanced Data Rate (EDR) for faster data transfer(Sony VAIO VGN-FZ15G Battery). The nominal rate of EDR is about 3 Mbit/s, although the practical data transfer rate is 2.1 Mbit/s.[24] EDR uses a combination of GFSK and Phase Shift Keying modulation (PSK) with two variants, π/4-DQPSK and 8DPSK. EDR can provide a lower power consumption through a reduced duty cycle(Sony VAIO VGN-FZ15T Battery).

The specification is published as "Bluetooth v2.0 + EDR" which implies that EDR is an optional feature. Aside from EDR, there are other minor improvements to the 2.0 specification, and products may claim compliance to "Bluetooth v2.0" without supporting the higher data rate. At least one commercial device states "Bluetooth v2.0 without EDR" on its data sheet(SONY VGP-BPS13/B Battery).

Bluetooth v2.1 + EDR

Bluetooth Core Specification Version 2.1 + EDR is fully backward compatible with 1.2, and was adopted by the Bluetooth SIG on July 26, 2007(Dell N3010 Battery).

The headline feature of 2.1 is secure simple pairing (SSP): this improves the pairing experience for Bluetooth devices, while increasing the use and strength of security. See the section on Pairing below for more details(Dell INSPIRON 1764 battery).

2.1 allows various other improvements, including "Extended inquiry response" (EIR), which provides more information during the inquiry procedure to allow better filtering of devices before connection; sniff subrating, which reduces the power consumption in low-power mode(Dell INSPIRON 1564 battery)

Bluetooth v3.0 + HS

Version 3.0 + HS of the Bluetooth Core Specification was adopted by the Bluetooth SIG on April 21, 2009. Bluetooth 3.0+HS supports theoretical data transfer speeds of up to 24 Mbit/s, though not over the Bluetooth link itself(Dell INSPIRON 1464 battery). Instead, the Bluetooth link is used for negotiation and establishment, and the high data rate traffic is carried over a colocated 802.11 link. Its main new feature is AMP (Alternate MAC/PHY), the addition of 802.11 as a high speed transport. Two technologies had been anticipated for AMP: 802.11 and UWB, but UWB is missing from the specification(Dell INSPIRON 1520 battery).

The High-Speed part of the specification is not mandatory, and hence only devices sporting the "+HS" will actually support the Bluetooth over Wifi high-speed data transfer(Dell INSPIRON 1420 battery). A Bluetooth 3.0 device without the HS suffix will not support High Speed, and needs to only support Unicast Connectionless Data (UCD), as shown in the Bluetooth 3.0+HS specification, Vol0, section 4.1 Specification Naming Conventions(Dell INSPIRON E1505 battery).

Alternate MAC/PHY

Enables the use of alternative MAC and PHYs for transporting Bluetooth profile data. The Bluetooth radio is still used for device discovery, initial connection and profile configuration, however when large quantities of data need to be sent(Dell INSPIRON 1525 battery), the high speed alternate MAC PHY 802.11 (typically associated with Wi-Fi) will be used to transport the data. This means that the proven low power connection models of Bluetooth are used when the system is idle, and the faster radio is used when large quantities of data need to be sent(SONY VGP-BPS13B/B Battery).

Unicast connectionless data

Permits service data to be sent without establishing an explicit L2CAP channel. It is intended for use by applications that require low latency between user action and reconnection/transmission of data. This is only appropriate for small amounts of data(SONY VGP-BPS13 Battery).

Enhanced Power Control

Updates the power control feature to remove the open loop power control, and also to clarify ambiguities in power control introduced by the new modulation schemes added for EDR. Enhanced power control removes the ambiguities by specifying the behaviour that is expected(HP PAVILION DV6000 battery). The feature also adds closed loop power control, meaning RSSI filtering can start as the response is received. Additionally, a "go straight to maximum power" request has been introduced. This is expected to deal with the headset link loss issue typically observed when a user puts their phone into a pocket on the opposite side to the headset(SONY VAIO VGN-FZ31B Battery).

Bluetooth v4.0

On June 12, 2007, Nokia and Bluetooth SIG had announced that Wibree will be a part of the Bluetooth specification, as an ultra-low power Bluetooth technology(SONY VAIO VGN-FZ31M Battery).

On December 17, 2009, the Bluetooth SIG adopted Bluetooth low energy technology as the hallmark feature of the version 4.0. The provisional names Wibree and Bluetooth ULP (Ultra Low Power) are abandoned(SONY VAIO VGN-FZ31J Battery).

On April 21, 2010, the Bluetooth SIG completed the Bluetooth Core Specification version 4.0, which includes Classic Bluetooth, Bluetooth high speed and Bluetooth low energy protocols. Bluetooth high speed is based on Wi-Fi, and Classic Bluetooth consists of legacy Bluetooth protocols(SONY VAIO VGN-FZ31E Battery).

Bluetooth low energy

Main article: Bluetooth low energy

Bluetooth low energy is an alternative to the Bluetooth standard that was introduced in Bluetooth v4.0, and is aimed at very low power applications running off a coin cell. It allows two types of implementation, dual-mode and single-mode(Sony Vaio VGN-FZ31S battery). In a dual-mode implementation, Bluetooth low energy functionality is integrated into an existing Classic Bluetooth controller. The resulting architecture shares much of Classic Bluetooth’s existing radio and functionality resulting in a negligible cost increase compared to Classic Bluetooth. Additionally(SONY VAIO VGN-FZ31z Battery), manufacturers can use current Classic Bluetooth (Bluetooth v2.1 + EDR or Bluetooth v3.0 + HS) chips with the new low energy stack, enhancing the development of Classic Bluetooth enabled devices with new capabilities(SONY VAIO VGN-FZ38M Battery).

Cost-reduced single-mode chips, which will enable highly integrated and compact devices, will feature a lightweight Link Layer providing ultra-low power idle mode operation, simple device discovery(SONY VAIO VGN-FZ210CE Battery), and reliable point-to-multipoint data transfer with advanced power-save and secure encrypted connections at the lowest possible cost. The Link Layer in these controllers will enable Internet connected sensors to schedule Bluetooth low energy traffic between Bluetooth transmissions(SONY VAIO VGN-FZ160 Battery).

Currently (2010-12) the definition of respective application profiles still are not fulfilled work-items of the standardisation bodies(SONY VAIO VGN-FZ21 Battery).

Future

Broadcast channel

Enables Bluetooth information points. This will drive the adoption of Bluetooth into mobile phones, and enable advertising models based on users pulling information from the information points, and not based on the object push model that is used in a limited way today(SONY VAIO VGN-FZ410 Battery).

Topology management

Enables the automatic configuration of the piconet topologies especially in scatternet situations that are becoming more common today. This should all be invisible to users of the technology, while also making the technology "just work." (SONY VAIO VGN-FZ21m Battery)

QoS improvements

Enable audio and video data to be transmitted at a higher quality, especially when best effort traffic is being transmitted in the same piconet(SONY VAIO VGN-FZ18m Battery).

UWB for AMP

Main article: ultra-wideband

The high speed (AMP) feature of Bluetooth v3.0 is based on 802.11, but the AMP mechanism was designed to be usable with other radios as well. It was originally intended for UWB, but the WiMedia Alliance, the body responsible for the flavor of UWB intended for Bluetooth, announced in March 2009 that it was disbanding(SONY VAIO VGN-FZ11m Battery).

On March 16, 2009, the WiMedia Alliance announced it was entering into technology transfer agreements for the WiMedia Ultra-wideband (UWB) specifications. WiMedia has transferred all current and future specifications, including work on future high speed and power optimized implementations(SONY VAIO VGN-FZ11z Battery), to the Bluetooth Special Interest Group (SIG), Wireless USB Promoter Group and the USB Implementers Forum. After the successful completion of the technology transfer, marketing and related administrative items, the WiMedia Alliance will cease operations(SONY VAIO VGN-FZ11l Battery).

In October 2009 the Bluetooth Special Interest Group suspended development of UWB as part of the alternative MAC/PHY, Bluetooth v3.0 + HS solution. A small, but significant, number of former WiMedia members had not and would not sign up to the necessary agreements for the IP transfer. The Bluetooth SIG is now in the process of evaluating other options for its longer term roadmap(SONY VAIO VGN-FZ140E Battery).

Technical information

Bluetooth protocol stack

Main articles: Bluetooth stack and Bluetooth protocols

"Bluetooth is defined as a layer protocol architecture consisting of core protocols, cable replacement protocols, telephony control protocols, and adopted protocols." Mandatory protocols for all Bluetooth stacks are: LMP, L2CAP and SDP. Additionally, these protocols are almost universally supported: HCI and RFCOMM(SONY VAIO VGN-FZ260E Battery).

LMP (Link Management Protocol)

Used for control of the radio link between two devices. Implemented on the controller.

[edit]L2CAP (Logical Link Control & Adaptation Protocol)

Used to multiplex multiple logical connections between two devices using different higher level protocols. Provides segmentation and reassembly of on-air packets(SONY VAIO VGN-FZ150E Battery).

In Basic mode, L2CAP provides packets with a payload configurable up to 64kB, with 672 bytes as the default MTU, and 48 bytes as the minimum mandatory supported MTU.

In Retransmission & Flow Control modes, L2CAP can be configured for reliable or isochronous data per channel by performing retransmissions and CRC checks(SONY VAIO VGN-FZ190 Battery).

Bluetooth Core Specification Addendum 1 adds two additional L2CAP modes to the core specification. These modes effectively deprecate original Retransmission and Flow Control modes(SONY VAIO VGN-FZ460E Battery):

Enhanced Retransmission Mode (ERTM): This mode is an improved version of the original retransmission mode. This mode provides a reliable L2CAP channel.

Streaming Mode (SM): This is a very simple mode, with no retransmission or flow control. This mode provides an unreliable L2CAP channel(SONY VAIO VGN-FZ280E Battery).

Reliability in any of these modes is optionally and/or additionally guaranteed by the lower layer Bluetooth BDR/EDR air interface by configuring the number of retransmissions and flush timeout (time after which the radio will flush packets). In-order sequencing is guaranteed by the lower layer(SONY VAIO VGN-FZ440N Battery).

Only L2CAP channels configured in ERTM or SM may be operated over AMP logical links.

SDP (Service Discovery Protocol)

Service Discovery Protocol (SDP) allows a device to discover services supported by other devices, and their associated parameters. For example, when connecting a mobile phone to a Bluetooth headset, SDP will be used for determining which Bluetooth profiles are supported by the headset (Headset Profile, Hands Free Profile(SONY VAIO VGN-FZ32 Battery), Advanced Audio Distribution Profile (A2DP) etc.) and the protocol multiplexer settings needed to connect to each of them. Each service is identified by a Universally Unique Identifier (UUID), with official services (Bluetooth profiles) assigned a short form UUID (16 bits rather than the full 128) (sony vgp-bpl9 battery)

[edit]HCI (Host/Controller Interface)

Standardised communication between the host stack (e.g., a PC or mobile phone OS) and the controller (the Bluetooth IC). This standard allows the host stack or controller IC to be swapped with minimal adaptation(SONY vgp-bps9 battery).

There are several HCI transport layer standards, each using a different hardware interface to transfer the same command, event and data packets. The most commonly used are USB (in PCs) and UART (in mobile phones and PDAs) (SONY VAIO VGN-FZ11S Battery).

In Bluetooth devices with simple functionality (e.g., headsets) the host stack and controller can be implemented on the same microprocessor. In this case the HCI is optional, although often implemented as an internal software interface(SONY VAIO VGN-FZ Battery).

RFCOMM (Serial Port Emulation)

Radio frequency communications (RFCOMM) is a cable replacement protocol used to create a virtual serial data stream. RFCOMM provides for binary data transport and emulates EIA-232 (formerly RS-232) control signals over the Bluetooth baseband layer(SONY VGP-BPS8 battery).

RFCOMM provides a simple reliable data stream to the user, similar to TCP. It is used directly by many telephony related profiles as a carrier for AT commands, as well as being a transport layer for OBEX over Bluetooth(Sony VAIO PCG-5K1L battery).

Many Bluetooth applications use RFCOMM because of its widespread support and publicly available API on most operating systems. Additionally, applications that used a serial port to communicate can be quickly ported to use RFCOMM(Sony VAIO PCG-6W2L battery).

BNEP (Bluetooth Network Encapsulation Protocol)

BNEP is used for transferring another protocol stack's data via an L2CAP channel. It's main purpose is the transmission of IP packets in the Personal Area Networking Profile. BNEP performs a similar function to SNAP in Wireless LAN(Sony VAIO PCG-7112L battery).

AVCTP (Audio/Video Control Transport Protocol)

Used by the remote control profile to transfer AV/C commands over an L2CAP channel. The music control buttons on a stereo headset use this protocol to control the music player(Sony VAIO PCG-8Z1L battery).

AVDTP (Audio/Video Distribution Transport Protocol)

Used by the advanced audio distribution profile to stream music to stereo headsets over an L2CAP channel. Intended to be used by video distribution profile(Sony VAIO PCG-8Z2L battery).

Telephony control protocol

Telephony control protocol-binary (TCS BIN) is the bit-oriented protocol that defines the call control signaling for the establishment of voice and data calls between Bluetooth devices. Additionally, "TCS BIN defines mobility management procedures for handling groups of Bluetooth TCS devices." (Sony VAIO PCG-8Y2L battery)

TCS-BIN is only used by the cordless telephony profile, which failed to attract implementers. As such it is only of historical interest(Sony VAIO PCG-8Y1L battery).

Adopted protocols

Adopted protocols are defined by other standards-making organizations and incorporated into Bluetooth’s protocol stack, allowing Bluetooth to create protocols only when necessary. The adopted protocols include(Sony VAIO PCG-7Z2L battery):

Point-to-Point Protocol (PPP)

Internet standard protocol for transporting IP datagrams over a point-to-point link.

TCP/IP/UDP

Foundation Protocols for TCP/IP protocol suite

Object Exchange Protocol (OBEX)

Session-layer protocol for the exchange of objects, providing a model for object and operation representation(Sony VAIO PCG-7Z1L battery)

Wireless Application Environment/Wireless Application Protocol (WAE/WAP)

WAE specifies an application framework for wireless devices and WAP is an open standard to provide mobile users access to telephony and information services(Sony VAIO PCG-7133L battery).

Baseband Error Correction

Three types of error correction are implemented in Bluetooth systems,

1/3 rate forward error correction (FEC)

2/3 rate FEC

Automatic repeat-request (ARQ) (Sony VAIO PCG-7113L battery)

Setting up connections

Any Bluetooth device in discoverable mode will transmit the following information on demand:

Device name

Device class

List of services

Technical information (for example: device features, manufacturer, Bluetooth specification used, clock offset)

Any device may perform an inquiry to find other devices to connect to, and any device can be configured to respond to such inquiries. However, if the device trying to connect knows the address of the device, it always responds to direct connection requests and transmits the information shown in the list above if requested(Sony VAIO PCG-6W3L battery). Use of a device's services may require pairing or acceptance by its owner, but the connection itself can be initiated by any device and held until it goes out of range. Some devices can be connected to only one device at a time, and connecting to them prevents them from connecting to other devices and appearing in inquiries until they disconnect from the other device(Sony VAIO PCG-7111L battery).

Every device has a unique 48-bit address. However, these addresses are generally not shown in inquiries. Instead, friendly Bluetooth names are used, which can be set by the user. This name appears when another user scans for devices and in lists of paired devices(Sony VAIO PCG-6W1L battery).

Most phones have the Bluetooth name set to the manufacturer and model of the phone by default. Most phones and laptops show only the Bluetooth names and special programs are required to get additional information about remote devices. This can be confusing as, for example, there could be several phones in range named T610 (see Bluejacking) (Sony VAIO PCG-6V1L battery).

Pairing

Motivation

Many of the services offered over Bluetooth can expose private data or allow the connecting party to control the Bluetooth device. For security reasons it is therefore necessary to control which devices are allowed to connect to a given Bluetooth device. At the same time, it is useful for Bluetooth devices to automatically establish a connection without user intervention as soon as they are in range(Sony VAIO PCG-6S3L battery).

To resolve this conflict, Bluetooth uses a process called pairing, which is generally manually started by a device user—making that device's Bluetooth link visible to other devices. Two devices need to be paired to communicate with each other(Sony VAIO PCG-6S2L battery); the pairing process is typically triggered automatically the first time a device receives a connection request from a device with which it is not yet paired. Once a pairing has been established it is remembered by the devices, which can then connect to each without user intervention. When desired, the pairing relationship can later be removed by the user(Sony VAIO PCG-5L1L battery).

Implementation

During the pairing process, the two devices involved establish a relationship by creating a shared secret known as a link key. If a link key is stored by both devices they are said to be paired or bonded(Sony VAIO PCG-5K2L battery). A device that wants to communicate only with a bonded device can cryptographically authenticate the identity of the other device, and so be sure that it is the same device it previously paired with. Once a link key has been generated, an authenticated ACL link between the devices may be encrypted so that the data that they exchange over the airwaves is protected against eavesdropping(Sony VAIO PCG-5J2L battery).

Link keys can be deleted at any time by either device. If done by either device this will implicitly remove the bonding between the devices; so it is possible for one of the devices to have a link key stored but not be aware that it is no longer bonded to the device associated with the given link key(Sony VAIO PCG-5J1L battery).

Bluetooth services generally require either encryption or authentication, and as such require pairing before they allow a remote device to use the given service. Some services, such as the Object Push Profile, elect not to explicitly require authentication or encryption so that pairing does not interfere with the user experience associated with the service use-cases(Sony VAIO PCG-5G3L battery).

Pairing mechanisms

Pairing mechanisms have changed significantly with the introduction of Secure Simple Pairing in Bluetooth v2.1. The following summarizes the pairing mechanisms(Sony VAIO PCG-5G2L battery):

Legacy pairing: This is the only method available in Bluetooth v2.0 and before. Each device must enter a PIN code; pairing is only successful if both devices enter the same PIN code. Any 16-byte UTF-8 string may be used as a PIN code, however not all devices may be capable of entering all possible PIN codes(Sony VGP-BPS21A/B battery).

Limited input devices: The obvious example of this class of device is a Bluetooth Hands-free headset, which generally have few inputs. These devices usually have a fixed PIN, for example "0000" or "1234", that are hard-coded into the device(Sony VGP-BPS21/S battery).

Numeric input devices: Mobile phones are classic examples of these devices. They allow a user to enter a numeric value up to 16 digits in length.

Alpha-numeric input devices: PCs and smartphones are examples of these devices(Sony VGP-BPS21B battery). They allow a user to enter full UTF-8 text as a PIN code. If pairing with a less capable device the user needs to be aware of the input limitations on the other device, there is no mechanism available for a capable device to determine how it should limit the available input a user may use(Sony VGP-BPS21 battery).

Secure Simple Pairing (SSP): This is required by Bluetooth v2.1. A Bluetooth v2.1 device may only use legacy pairing to interoperate with a v2.0 or earlier device. Secure Simple Pairing uses a form of public key cryptography, and has the following modes of operation:

Just works: As implied by the name, this method just works(Sony VGP-BPS13A/S battery). No user interaction is required; however, a device may prompt the user to confirm the pairing process. This method is typically used by headsets with very limited IO capabilities, and is more secure than the fixed PIN mechanism which is typically used for legacy pairing by this set of limited devices. This method provides no man in the middle (MITM) protection(Sony VGP-BPS13B/S battery).

Numeric comparison: If both devices have a display and at least one can accept a binary Yes/No user input, they may use Numeric Comparison. This method displays a 6-digit numeric code on each device(Sony VGP-BPS13S battery). The user should compare the numbers to ensure they are identical. If the comparison succeeds, the user(s) should confirm pairing on the device(s) that can accept an input. This method provides MITM protection, assuming the user confirms on both devices and actually performs the comparison properly(Sony VGP-BPS13AS battery).

Passkey Entry: This method may be used between a device with a display and a device with numeric keypad entry (such as a keyboard), or two devices with numeric keypad entry(Sony PCGA-BP2EA battery). In the first case, the display is used to show a 6-digit numeric code to the user, who then enters the code on the keypad. In the second case, the user of each device enters the same 6-digit number. Both cases provide MITM protection(Sony VGP-BPS13/B battery).

Out of band (OOB): This method uses an external means of communication, such as Near Field Communication (NFC) to exchange some information used in the pairing process. Pairing is completed using the Bluetooth radio, but requires information from the OOB mechanism. This provides only the level of MITM protection that is present in the OOB mechanism(Sony VGP-BPS13/S battery).

SSP is considered simple for the following reasons:

In most cases, it does not require a user to generate a passkey.

For use-cases not requiring MITM protection, user interaction has been eliminated.

For numeric comparison, MITM protection can be achieved with a simple equality comparison by the user(Sony VGP-BPS13A/B battery).

Using OOB with NFC will enable pairing when devices simply get close, rather than requiring a lengthy discovery process(Sony VGP-BPS13B/B battery).

Security Concerns

Prior to Bluetooth v2.1, encryption is not required and can be turned off at any time. Moreover, the encryption key is only good for approximately 23.5 hours; using a single encryption key longer than this time allows simple XOR attacks to retrieve the encryption key(Sony VGN-FZ11E battery).

Turning off encryption is required for several normal operations, so it is problematic to detect if encryption is disabled for a valid reason or for a security attack.

Bluetooth v2.1 addresses this in the following ways(Sony VGN-FZ430E battery):

Encryption is required for all non-SDP (Service Discovery Protocol) connections

A new Encryption Pause and Resume feature is used for all normal operations requiring encryption to be disabled. This enables easy identification of normal operation from security attacks(Sony VGN-FZ32 battery).

The encryption key is required to be refreshed before it expires.

Link keys may be stored on the device file system, not on the Bluetooth chip itself. Many Bluetooth chip manufacturers allow link keys to be stored on the device; however, if the device is removable this means that the link key will move with the device(Sony VGN-FZ440N battery).

Air interface

The protocol operates in the license-free ISM band at 2.402-2.480 GHz.[40] To avoid interfering with other protocols that use the 2.45 GHz band, the Bluetooth protocol divides the band into 79 channels (each 1 MHz wide) and changes channels up to 1600 times per second(Sony VGN-FZ38 battery). Implementations with versions 1.1 and 1.2 reach speeds of 723.1 kbit/s. Version 2.0 implementations feature Bluetooth Enhanced Data Rate (EDR) and reach 2.1 Mbit/s. Technically, version 2.0 devices have a higher power consumption, but the three times faster rate reduces the transmission times, effectively reducing power consumption to half that of 1.x devices (assuming equal traffic load) (Sony VGN-FZ37 battery).

Security

Overview

Bluetooth implements confidentiality, authentication and key derivation with custom algorithms based on the SAFER+ block cipher. Bluetooth key generation is generally based on a Bluetooth PIN, which must be entered into both devices(Sony VGN-FZ35 battery). This procedure might be modified if one of the devices has a fixed PIN (e.g., for headsets or similar devices with a restricted user interface). During pairing, an initialization key or master key is generated, using the E22 algorithm(Sony Vaio VGN-FZ21J battery). The E0 stream cipher is used for encrypting packets, granting confidentiality and is based on a shared cryptographic secret, namely a previously generated link key or master key. Those keys, used for subsequent encryption of data sent via the air interface, rely on the Bluetooth PIN, which has been entered into one or both devices(Sony VGN-FZ140E battery).

An overview of Bluetooth vulnerabilities exploits was published in 2007 by Andreas Becker.

In September 2008, the National Institute of Standards and Technology (NIST) published a Guide to Bluetooth Security that will serve as reference to organizations on the security capabilities of Bluetooth and steps for securing Bluetooth technologies effectively(Sony Vaio VGN-FZ31J battery ). While Bluetooth has its benefits, it is susceptible to denial of service attacks, eavesdropping, man-in-the-middle attacks, message modification, and resource misappropriation(Sony VGN-FZ145E battery). Users/organizations must evaluate their acceptable level of risk and incorporate security into the lifecycle of Bluetooth devices. To help mitigate risks, included in the NIST document are security checklists with guidelines and recommendations for creating and maintaining secure Bluetooth piconets, headsets, and smart card readers(Sony Vaio VGN-FZ31B battery).

Bluetooth v2.1 - finalized in 2007 with consumer devices first appearing in 2009 - makes significant changes to Bluetooth's security, including pairing. See the #Pairing mechanisms section for more about these changes(Sony VGN-FZ18L battery).

Bluejacking

Main article: Bluejacking

Bluejacking is the sending of either a picture or a message from one user to an unsuspecting user through Bluetooth wireless technology. Common applications include short messages (e.g., "You’ve just been bluejacked!") (Sony VGN-FW11M battery). Bluejacking does not involve the removal or alteration of any data from the device. Bluejacking can also involve taking control of a mobile wirelessly and phoning a premium rate line, owned by the bluejacker(Sony VGN-FW11 battery).

History of security concerns

Early

In 2001, Jakobsson and Wetzel from Bell Laboratories discovered flaws in the Bluetooth pairing protocol and also pointed to vulnerabilities in the encryption scheme. In 2003, Ben and Adam Laurie from A.L. Digital Ltd. discovered that serious flaws in some poor implementations of Bluetooth security may lead to disclosure of personal data(Sony Vaio VGN-FZ18S battery). In a subsequent experiment, Martin Herfurt from the trifinite.group was able to do a field-trial at the CeBIT fairgrounds, showing the importance of the problem to the world. A new attack called BlueBug was used for this experiment. In 2004 the first purported virus using Bluetooth to spread itself among mobile phones appeared on the Symbian OS(Sony Vaio VGN-FZ210CE battery). The virus was first described by Kaspersky Lab and requires users to confirm the installation of unknown software before it can propagate. The virus was written as a proof-of-concept by a group of virus writers known as "29A" and sent to anti-virus groups. Thus, it should be regarded as a potential (but not real) security threat to Bluetooth technology or Symbian OS since the virus has never spread outside of this system(Sony VGN-FZ230E battery). In August 2004, a world-record-setting experiment (see also Bluetooth sniping) showed that the range of Class 2 Bluetooth radios could be extended to 1.78 km (1.08 mile) with directional antennas and signal amplifiers. This poses a potential security threat because it enables attackers to access vulnerable Bluetooth devices from a distance beyond expectation(Sony Vaio VGN-FZ21S battery). The attacker must also be able to receive information from the victim to set up a connection. No attack can be made against a Bluetooth device unless the attacker knows its Bluetooth address and which channels to transmit on(Sony Vaio VGN-FZ21E battery ).

2005

In January 2005, a mobile malware worm known as Lasco.A began targeting mobile phones using Symbian OS (Series 60 platform) using Bluetooth enabled devices to replicate itself and spread to other devices(Sony VGN-FZ18 battery). The worm is self-installing and begins once the mobile user approves the transfer of the file (velasco.sis ) from another device. Once installed, the worm begins looking for other Bluetooth enabled devices to infect. Additionally, the worm infects other(Sony VGN-FZ190E battery) .SIS files on the device, allowing replication to another device through use of removable media (Secure Digital, Compact Flash, etc.). The worm can render the mobile device unstable(Sony VGN-FZ190 battery).

In April 2005, Cambridge University security researchers published results of their actual implementation of passive attacks against the PIN-based pairing between commercial Bluetooth devices, confirming the attacks to be practicably fast and the Bluetooth symmetric key establishment method to be vulnerable(Sony VGP-BPS9/B battery). To rectify this vulnerability, they carried out an implementation which showed that stronger, asymmetric key establishment is feasible for certain classes of devices, such as mobile phones(Sony VGN-FZ15G battery).

In June 2005, Yaniv Shaked and Avishai Wool published a paper describing both passive and active methods for obtaining the PIN for a Bluetooth link. The passive attack allows a suitably equipped attacker to eavesdrop on communications and spoof, if the attacker was present at the time of initial pairing(Sony VGN-FZ11L battery). The active method makes use of a specially constructed message that must be inserted at a specific point in the protocol, to make the master and slave repeat the pairing process. After that, the first method can be used to crack the PIN(Sony Vaio VGN-FZ31S battery). This attack's major weakness is that it requires the user of the devices under attack to re-enter the PIN during the attack when the device prompts them to. Also, this active attack probably requires custom hardware, since most commercially available Bluetooth devices are not capable of the timing necessary(Sony Vaio VGN-FZ38M battery).

In August 2005, police in Cambridgeshire, England, issued warnings about thieves using Bluetooth enabled phones to track other devices left in cars. Police are advising users to ensure that any mobile networking connections are de-activated if laptops and other devices are left in this way(Sony VGN-FZ19VN battery).

2006

In April 2006, researchers from Secure Network and F-Secure published a report that warns of the large number of devices left in a visible state, and issued statistics on the spread of various Bluetooth services and the ease of spread of an eventual Bluetooth worm(Sony Vaio VGN-FZ31Z battery).

2007

In October 2007, at the Luxemburgish Hack.lu Security Conference, Kevin Finistere and Thierry Zoller demonstrated and released a remote root shell via Bluetooth on Mac OS X v10.3.9 and v10.4. They also demonstrated the first Bluetooth PIN and Linkkeys cracker, which is based on the research of Wool and Shaked(Sony Vaio VGN-FZ31M battery).

Health concerns

Main article: Wireless electronic devices and health

Bluetooth uses the microwave radio frequency spectrum in the 2.402 GHz to 2.480 GHz range. Maximum power output from a Bluetooth radio is 100 mW, 2.5 mW, and 1 mW for Class 1, Class 2, and Class 3 devices respectively, which puts Class 1 at roughly the same level as mobile phones, and the other two classes much lower(Sony VGN-FZ11M battery). Accordingly, Class 2 and Class 3 Bluetooth devices are considered less of a potential hazard than mobile phones, and Class 1 may be comparable to that of mobile phones : the maximum for a Class 1 is 100 mW for Bluetooth but 250 mW for UMTS W-CDMA, 1 W for GSM1800/1900 and 2 W for GSM850/900 for instance(Sony VGN-FZ11Z battery).

Bluetooth Innovation World Cup marketing initiative

The Bluetooth Innovation World Cup is an international competition encouraging the development of new innovations and ideas for applications leveraging the Bluetooth low energy wireless technology in sports, fitness and health care products.The Bluetooth Innovation World Cup is a marketing initiative of the Bluetooth Special Interest Group (SIG) (Sony VGN-FZ220E battery).

The aim of the competition is to stimulate new markets, creating new fields of applications and establishing Bluetooth low energy technology as the wireless data transfer standard for low energy applications is ordinary business in the competition of wireless standards. The initiative will go on for three years, having started 1 June 2009.

Bluetooth Innovation World Cup 2009(Sony VGN-SZ55 battery)

The first international Bluetooth Innovation World Cup 2009 drew more than 250 international entries illustrating the abundance of opportunities for product development with the new Bluetooth low energy wireless technology(Sony VGN-SZ56 battery).

The Bluetooth Innovation World Cup 2009 was sponsored by Nokia, Freescale Semiconductor, Texas Instruments, Nordic Semiconductor, STMicroelectronics and Brunel(Sony VGN-FZ29VN battery).

Bluetooth Innovator of the Year 2009

On February 8, 2010, the Bluetooth SIG has awarded Edward Sazonov, Physical Activity Innovations LLC, the title of Bluetooth Innovator of the Year for 2009. Sazonov received this recognition at the official award ceremony held in-line with the Wearable Technologies Show at ispo 2010, the world’s largest trade show for sporting goods(Sony VGN-FZ290 battery). The award includes a cash prize of €5,000 and a Bluetooth Qualification Program voucher (QDID) valued at up to US$ 10,000. Sazonov’s winning idea, The Fit Companion, is a small, unobtrusive sensor that when clipped-on to a user’s clothing or integrated in to a shoe, provides feedback about their physical activity(Sony VGP-BPL7 battery). The data, transmitted via Bluetooth low energy technology, can help individuals to lose weight and achieve optimal physical activity. Intended for use in both training and daily activities like walking or performing chores, this simple, measuring device may offer a solution for reducing obesity(Sony VGP-BPL12 battery).

Bluetooth Innovation World Cup 2010

The Bluetooth Special Interest Group (SIG) announced the start of the second Bluetooth Innovation World Cup (IWC) on 1 June 2010. The 2010 Bluetooth Innovation World Cup has a focus on applications for the sports & fitness, health care and home information and control markets. The competition will close for registrations on September 15, 2010(Sony VGP-BPS15 battery).