The Technology

The Bluetooth Specification defines a short (around 10 meters) or optionally a medium-range (around 100 meters) radio link that is capable of voice or data transmission up to a maximum capacity of 720 Kbps per channel. RF operation is in the unlicensed ISM band at 2.4 to 2.48 GHz and uses a spread spectrum, frequency-hopping, full-duplex signal at up to 1,600 hops per second. The signal hops among 79 frequencies at 1 MHz intervals to give a high degree of interference immunity. RF output is specified as 0 dBm (1 mW) in the 10-meter-range version and +30 to +20 dBm (100 mW) in the longer-range version. When producing the radio specification, a high emphasis was put on making a design enabling single-chip implementation in complementary metal oxide semiconductor (CMOS) circuits, thereby reducing cost, power consumption, and the chip size required for implementation in mobile devices.

Voice

Up to three simultaneous synchronous voice channels are used, or a channel that simultaneously supports asynchronous data and synchronous voice. Each voice channel supports a 64 Kbps synchronous (voice) channel in each direction.

Data

The asynchronous data channel can support maximal 723.2 Kbps asymmetric (and still up to 57.6 Kbps in the return direction) or 433.9 Kbps symmetric.

• A master can share an asynchronous channel with up to seven simultaneously active slaves in a piconet.

• By swapping active and parked slaves out respectively in the piconet, 255 slaves can be virtually connected using the PM_ADDR. A device can participate again within 2 milliseconds.

• To park even more slaves, the BD_ADDR can be used. There is no limitation to the number of slaves that can be parked.

Slaves can participate in different piconets and a master of one piconet can be the slave in another. This is known as a scatternet. Up to 10 piconets within range can form a scatternet with few collisions.

Network Topology

Bluetooth units that come within range of each other can set up ad hoc point-to-point and/or point-to-multipoint connections. Units can dynamically be added or disconnected to the network. Two or more Bluetooth units that share a channel form a piconet. Several piconets can be established and linked together in ad hoc scatternets to enable communication and data exchange in flexible configurations. If several other piconets are within range, they each work independently and each have access to full bandwidth. Each piconet is established by a different frequency-hopping channel. All users participating on the same piconet are synchronized to this channel. Unlike IR devices, Bluetooth units are not limited to LOS communication.

To regulate traffic on the channel, one of the participating units becomes a master of the piconet, whereas all other units become slaves. With the current Bluetooth Specification, up to seven slaves can actively communicate with one master. However, there can be almost an unlimited number of units virtually attached to a master, enabling communication to start instantly.

Security

Because radio signals can be easily intercepted, Bluetooth devices have built-in security to prevent eavesdropping or falsifying the origin of messages (spoofing). The main security features include the following:

• Challenge-response routine  For authentication, which prevents spoofing and unwanted access to critical data and functions.

• Stream cipher  For encryption, which prevents eavesdropping and maintains link privacy.

• Session key generation  Session keys can be changed at any time during a connection.

Three entities are used in the security algorithms:

• Bluetooth device address (BD_ADDR) (48 bits)  A public entity that is unique for each device. The address can be obtained through the inquiry procedure.

• Private user key (128 bits)  A secret entity. The private key is derived during initialization and is never disclosed.

• Random number (128 bits)  Different for each new transaction. The random number is derived from a pseudorandom process in the Bluetooth unit.

In addition to these link-level functions, frequency hopping and the limited transmission range also help to prevent eavesdropping.

Hardware Architecture

The Bluetooth hardware consists of an analog radio part and a digital part — the Host Controller. The Host Controller has a hardware digital signal processing part called the Link Controller, a central processing unit (CPU) core, and interfaces to the host environment.

The Link Controller consists of hardware that performs baseband processing and PHY protocols such as the Automatic Repeat Request (ARQ) protocol and FEC coding. The function of the Link Controller includes asynchronous transfers, synchronous transfers, audio coding, and encryption.

The CPU core enables the Bluetooth module to handle inquiries and filter page requests without involving the host device. The Host Controller can be programmed to answer certain page messages and authenticate remote links.

The Link Manager software runs on the CPU core. The Link Manager discovers other Link Managers and communicates with them via the Link Manager Protocol (LMP) to perform its service provider role and to use the services of the underlying Link Controller.

Software Architecture

In order to make different hardware implementations compatible, Bluetooth devices use the Host Controller Interface (HCI) as a common interface between the Bluetooth host (for example, a portable PC) and the Bluetooth core.

Higher-level protocols like the Service Discovery Protocol (SDP), Radio Frequency Communications (RFCOMM)^[10] (emulating a serial port connection), and the Telephony Control Protocol are interfaced to baseband services via the Logical Link Control and Adaptation Protocol (L2CAP). L2CAP takes care of segmentation and reassembly (SAR) to enable larger data packets to be carried over a Bluetooth baseband connection.

The SDP enables applications to find out about available services and their characteristics when devices are moved or switched off.

Competing Technologies

There is no single WPAN competitor covering the entire concept of the Bluetooth wireless technology, but in certain market segments, other technologies exist. For cable replacement, the IR standard IrDA has been around for some years and is quite well known and widespread. IrDA is faster than the Bluetooth wireless technology, but is limited to point-to-point connections and above all it requires a clear LOS. In the past, IrDA has had problems with incompatible standard implementations — a lesson that the Bluetooth SIG has had to learn.

Licensing Technologies

Ericsson initially developed Bluetooth wireless technology. Now they license the Bluetooth chip solutions through packages of intellectual property, which comprises hardware and software in the form of the Bluetooth Core Product, the Bluetooth Host Stack, and the Bluetooth Radio. Thus, Ericsson is able to deliver total Bluetooth solutions to promote faster product time to market. Bluetooth intellectual property from Ericsson that can be used in products is aimed at three prime customer groups:

• High-volume silicon manufacturers/vendors

• Other equipment manufacturers (OEMs) that are able to develop and implement their own solutions for Bluetooth devices

• OEMs that require total Bluetooth solutions to match their product demands

Samples of baseband application-specific integrated circuits (ASICs) are currently available from Philips Semiconductors. Samples of RF modules are currently available from Ericsson Microelectronics. Volume production was planned for 2002.

^[10]RFCOMM is a serial line emulation protocol to emulate RS-232 control and data signals over Bluetooth™ link. Legacy applications can seamlessly communicate wirelessly over RFCOMM layer. RFCOMM is a simple transport protocol that provides emulation of RS232 serial ports over the L2CAP protocol. The protocol is based on the ETSI standard transmission 07.10. Only a subset of the transmission 07.10 standard is used and an RFCOMM — specific extension is added in the form of a mandatory credit based flow control scheme. The RFCOMM protocol supports up to 60 simultaneous connections between two base transceiver devices. The number of connections that can be used simultaneously in a base transceiver device is implementation specific. For the purposes of RFCOMM, a complete communication path involves two applications running on different devices (the communication endpoints) with a communication segment between them.