Bluetooth Renato Lo Cigno www.dit.unitn.it/locigno/teaching
...Copyright Quest opera è protetta dalla licenza Creative Commons NoDerivs- NonCommercial. Per vedere una copia di questa licenza, consultare: http://creativecommons.org/licenses/nd-nc/1.0/ oppure inviare una lettera a: Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. This work is licensed under the Creative Commons NoDerivs- NonCommercial License. To view a copy of this license, visit: http://creativecommons.org/licenses/nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Thanks: Prof. Mario Gerla, UCLA, for providing most of the material Bluetooth 2
802.11 Do you know it Bluetooth (802.15.1) Master/Slave architecture Optimized for low bandwidth, real time communications ZigBee (802.15.4) Meshed architecture Low power consumption All use the same ISM bands Technologies Bluetooth 3
Bluetooth Specifications Applications SDP IP RFCOMM Data HCI L2CAP Audio Link Manager Baseband RF Single chip with RS-232, USB, or PC card interface A hardware/software/protocol description An application framework Bluetooth 4
Bluetooth Radio Specification Applications SDP IP RFCOMM Data Control L2CAP Audio Link Manager Baseband RF Bluetooth 5
Design considerations power Noise, interference Data signal x(t) spectrum Recovered data signal cost Goal high bandwidth conserve battery power cost < $10 Bluetooth 6
EM Spectrum AM radio S/W radio TV FM radio LF MF HF VHF UHF SHF EHF TV cellular ISM band 902 928 Mhz 2.4 2.4835 Ghz 5.725 5.785 Ghz 30kHz 300kHz 3MHz 30MHz 300MHz 3GHz 30GHz 300GHz 10km 1km 100m 10m 1m 10cm 1cm 100mm ν λ ν infrared visible 1 MHz 1 khz 1 GHz 1 THz 1 PHz 1 EHz UV X rays Gamma rays Propagation characteristics are different in each frequency band Bluetooth 7
Unlicensed Radio Spectrum λ 33cm 12cm 5cm 26 Mhz 83.5 Mhz 125 Mhz 902 Mhz 928 Mhz 2.4 Ghz 2.4835 Ghz 5.725 Ghz 5.785 Ghz cordless phones baby monitors Wireless LANs 802.11 Bluetooth Microwave oven 802.11a HyperLan Bluetooth 8
Bluetooth radio link 1Mhz... 12 3 79 83.5 Mhz frequency hopping spread spectrum 2.402 GHz + k MHz, k=0,, 78 1,600 hops per second Starting BT1.2 (802.15.1-2005) Advanced FH enables interferenceavoidance, suppressing the use of interfered channels GFSK modulation 1 Mb/s symbol rate transmit power 0 dbm (1mW 1m ) 4 dbm (2.5mw 10m) 20 dbm (100 mw 100m) with power control Bluetooth 9
Bluetooth AFH Operation AFH only applied when devices are connected Paging and Inquiry modes use all channels, but are only present when devices are searching for others Master Bluetooth device using an adapted channel hopping sequence initiates connections using all 79 channels then updates the channel hopping sequence using the AFH channel map The AFH channel map is determined by master measurements and responses from slave devices The adapted channel hopping sequence consists of the initial 79 channel hop sequence reduced by the master s AFH channel map AFH channel map indicated which RF channels shall be used and which shall be unused Number of channels used must be > 20 Bluetooth 10
Baseband Applications IP SDP RFCOMM Data L2CAP Audio Link Manager Baseband RF Control Bluetooth 11
Bluetooth Physical link Point to point link master - slave relationship radios can function as masters or slaves m s Piconet m Master can connect to 7 slaves Each piconet has max capacity =1 Mbps s s s hopping pattern is determined by the master Bluetooth 12
Connection Setup Inquiry - scan protocol to learn about the clock offset and device address of other nodes in proximity Bluetooth 13
Inquiry on time axis Slave1 f1 f2 Master Inquiry hopping sequence Slave2 Bluetooth 14
Piconet formation Page - scan protocol to establish links with nodes in proximity Master Active Slave Parked Slave Standby Bluetooth 15
Bluetooth device address (BD_ADDR) 48 bit IEEE MAC address Active Member address (AM_ADDR) 3 bits active slave address all zero broadcast address Parked Member address (PM_ADDR) 8 bit parked slave address Addressing Bluetooth 16
FH/TDD f1 f2 f3 f4 Piconet channel f5 f6 m s1 s2 625 µsec 1600 hops/sec Bluetooth 17
Multi slot packets FH/TDD f1 f4 f5 f6 m s1 s2 625 µsec Data rate depends on type of packet Bluetooth 18
Physical Link Types Synchronous Connection Oriented (SCO) Link slot reservation at fixed intervals Asynchronous Connection-less (ACL) Link Polling access method m SCO ACL ACL SCO ACL ACL SCO ACL ACL s1 s2 Bluetooth 19
Packet Types Control packets Data/voice packets ID* Null Poll FHS DM1 Voice HV1 HV2 HV3 DV DM1 DM3 DM5 data DH1 DH3 DH5 Bluetooth 20
Packet Format 72 bits 54 bits 0-2744 bits Access code Header Payload Voice header Data CRC No CRC No retries FEC (optional) ARQ FEC (optional) 625 µs master slave Bluetooth 21
Access Code Purpose 72 bits Access code Header Types Payload Synchronization DC offset compensation Identification Signaling Channel Access Code (CAC) Device Access Code (DAC) Inquiry Access Code (IAC) X Bluetooth 22
Access code Purpose Addressing (3) Packet type (4) Flow control (1) 1-bit ARQ (1) Sequencing (1) HEC (8) total 54 bits Header 18 bits Encode with 1/3 FEC to get 54 bits Payload Packet Header Max 7 active slaves Broadcast packets are not ACKed For filtering retransmitted packets s m 16 packet types (some unused) Verify header integrity s s Bluetooth 23
Voice Packets (HV1, HV2, HV3) 72 bits 54 bits 240 bits Access Header code 30 bytes = 366 bits Payload HV1 10 bytes + 1/3 FEC HV2 20 bytes + 2/3 FEC HV3 30 bytes 3.75ms (HV3) 2.5ms (HV2) 1.25ms (HV1) Bluetooth 24
Data rate calculation: DM1 and DH1 625 µs 72 bits 54 bits 240 bits Access code Header 30 bytes = 366 bits Payload Dir Size Freq Rate 17 1600/2 108.8 DM1 1 17 2 2/3 FEC 17 108.8 27 172.8 DH1 1 27 2 27 172.8 625 µs 1 2 Bluetooth 25
Data rate calculation: DM3 and DH3 1875 µs 72 bits 54 bits 1500 bits = 1626 bits Access code Header 187 bytes Payload Dir Size Freq Rate 121 1600/4 387.2 DM3 2 121 2 2/3 FEC 17 54.4 183 585.6 DH3 2 183 2 27 86.4 1875 µs 1 2 3 4 Bluetooth 26
Data rate calculation: DM5 and DH5 3125 µs 72 bits 54 bits Access Code Header 2744 bits 343 bytes = 2870 bits Payload Dir Size Freq Rate 224 1600/6 477.8 DM5 2 224 2 2/3 FEC 17 36.3 339 723.2 DH5 2 339 2 27 57.6 3125 µs 625 µs 1 2 3 4 5 6 Bluetooth 27
Data Packet Types DM1 Symmetric Asymmetric 108.8 108.8 108.8 DM3 258.1 387.2 54.4 2/3 FEC DM5 286.7 477.8 36.3 Symmetric Asymmetric No FEC DH1 172.8 172.8 172.8 DH3 390.4 585.6 86.4 DH5 433.9 723.2 57.6 Bluetooth 28
Inter piconet communication Cordless headset mouse Cordless headset Cell phone Cell phone Cell phone Cordless headset Bluetooth 29
Scatternet Bluetooth 30
Scatternet, scenario 2 How to schedule presence in two piconets? Forwarding delay? Missed traffic? Bluetooth 31
Baseband: Summary Device 1 Device 2 LMP L2CAP Data link L2CAP LMP Baseband Physical Baseband TDD, frequency hopping physical layer Device inquiry and paging Two types of links SCO and ACL links Multiple packet types (multiple data rates with and without FEC) Bluetooth 32
Link Manager Protocol Applications IP SDP RFCOMM Data L2CAP Audio Link Manager Control LMP Setup and management of Baseband connections Baseband RF Piconet Management Link Configuration Security Bluetooth 33
Attach and detach slaves Master-slave switch Establishing SCO links Piconet Management Handling of low power modes ( Sniff, Hold, Park) m Paging s s s Master req response Slave Bluetooth 34
Low power mode (hold) Hold offset Slave Master Hold duration Bluetooth 35
Low power mode (Sniff) Sniff offset Sniff duration Slave Sniff period Master Traffic reduced to periodic sniff slots Bluetooth 36
Low power mode (Park) Slave Beacon instant Master Beacon interval Power saving + keep more than 7 slaves in a piconet Give up active member address, yet maintain synchronization Communication via broadcast LMP messages Bluetooth 37
Connection establishment & Security Goals Authenticated access Only accept connections from trusted devices Privacy of communication prevent eavesdropping Paging Constraints Processing and memory limitations $10 headsets, joysticks Cannot rely on PKI Simple user experience Master LMP_host_conn_req LMP Accepted Security procedure LMP_setup_complete Slave LMP_setup_complete Bluetooth 38
Authentication Authentication is based on link key (128 bit shared secret between two devices) How can link keys be distributed securely? challenge Verifier response accepted Claimant Link key Link key Bluetooth 39
Pairing (key distribution) Pairing is a process of establishing a trusted secret channel between two devices (construction of initialization key K init ) K init is then used to distribute unit keys or combination keys PIN + Claimant address Verifier Random number challenge Claimant PIN + Claimant address Random number response Random number Kinit accepted Kinit Bluetooth 40
Link Manager Protocol Summary Device 1 Device 2 LMP L2CAP Data link L2CAP LMP Baseband Physical Baseband Piconet management Link configuration Low power modes QoS Packet type selection Security: authentication and encryption Bluetooth 41
L2CAP Applications IP SDP RFCOMM Logical Link Control and Adaptation Protocol Data L2CAP Audio Link Manager Baseband RF L2CAP provides Protocol multiplexing Segmentation and Re-assembly Quality of service negotiation Bluetooth 42
Why baseband isn t sufficient IP RFCOMM IP RFCOMM MTU Multiplexing demultiplexing Baseband reliable*, flow controlled in-sequence, asynchronous link Baseband packet size is very small (17min, 339 max) No protocol-id field in the baseband header Bluetooth 43
Need a multiprotocol encapsulation layer IP RFCOMM IP RFCOMM unreliable, no integrity reliable*, in-order, flow controlled, ACL link Desired features Protocol multiplexing Segmentation and re-assembly Quality of service What about Reliability? Connection oriented or connectionless? integrity checks? Bluetooth 44
min MTU = 48 672 default Segmentation and reassembly Length Payload Baseband packets CRC CRC CRC start of L2CAP continuation of L2CAP continuation of L2CAP cannot cope with re-ordering or loss mixing of multiple L2CAP fragments not allowed If the start of L2CAP packet is not acked, the rest should be discarded Bluetooth 45
Bluetooth Service Discovery Protocol Applications SDP IP RFCOMM Data L2CAP Audio Link Manager Baseband RF Bluetooth 46
Example usage of SDP Establish L2CAP connection to remote device Query for services search for specific class of service, or browse for services Retrieve attributes that detail how to connect to the service Establish a separate (non-sdp) connection to use the service Bluetooth 47
Serial Port Emulation using RFCOMM Applications SDP IP RFCOMM Data L2CAP Audio Link Manager Baseband RF Serial Port emulation on top of a packet oriented link Similar to HDLC For supporting legacy apps Bluetooth 48
Serial line emulation over packet based MAC RFCOMM L2CAP RFCOMM L2CAP Design considerations framing: assemble bit stream into bytes and, subsequently, into packets transport: in-sequence, reliable delivery of serial stream control signals: RTS, CTS, DTR Bluetooth 49
IP over Bluetooth V 1.0 Applications SDP IP RFCOMM Data L2CAP Audio Link Manager Baseband RF GOALS Internet access using cell phones Connect PDA devices & laptop computers to the Internet via LAN access points Bluetooth 50
Bluetooth Current Market Outlook Bluetooth 51
Biggest challenges facing Bluetooth Interoperability Always a challenge for any new technology Hyped up expectations Out of the box ease of use Cost target $5 well below that Critical mass one billion devices sold by Nov.2006 RF in silicon Conflicting interests business and engineering Bluetooth 52
Value to carriers: Synchronization and Push More bits over the air Utilization of unused capacity during non-busy periods Higher barrier for switching service providers Bluetooth 53
Value to carriers: Cell phone as an IP gateway Will Pilot and cell phone eventually merge? More bits over the air Enhanced user experience Palmpilot has a better UI than a cell phone Growth into other vertical markets Bluetooth 54
Value to carriers: Call handoff Threat or opportunity? Cordless base More attractive calling plans Alleviate system load during peak periods Serve more users with fewer resources Bluetooth 55