BLUETOOTH TECHNOLOGY INITIAL RESEARCH

1. BLUETOOTH TECHNOLOGY INITIAL RESEARCH Instructor: Professor Ivan Student: Chang Li7067014 Email:cli023@uottawa.ca

2. Contents Introduction History and Version Bluetooth vs Other wireless technologies Bluetooth Architecture Connection Establishment States Bluetooth Protocol Stack Bluetooth Profile Bluetooth Security Advantages and Disadvantages Question

3. What is Bluetooth? A cable-replacement technology that can be used to connect almost any device to any other device Radio interface enabling electronic devices to communicate wirelessly via short range (10 meters) ad-hoc radio connections a standard for a small , cheap radio chip to be plugged into computers, printers, mobile phones, etc

4. What is Bluetooth? Uses the radio range of 2.45 GHz Theoretical maximum bandwidth is 1 Mb/s Several Bluetooth devices can form an ad hoc network called a “piconet” In a piconet one device acts as a master (sets frequency hopping behavior) and the others as slaves Example: A conference room with many laptops wishing to communicate with each other

5. Class of Bluetooth Bluetooth devices are classified according to three different power classes, as shown in the following table.

6. History Harald Bluetooth : 10th century Danish King, managed to unite Denmark and Norway Bluetooth SIG (Special Interest Group) : Founded in 1998 by : Ericsson, Intel, IBM, Toshiba and Nokia Currently more than 2500 adopter companies Created in order to promote, shape an define the specification and position Bluetooth in the market place Current specification : Bluetooth 4.0

7. Bluetooth Applications Digital Camera Computer Cordless Phone Base Station PDA Cell Phone Inkjet Printer Home Audio System Scanner Automatic synchronization between mobile and stationary devices Connecting mobile users to the internet using bluetooth-enabled wire-bound connection ports Dynamic creation of private networks

8. Version Bluetooth v1.2 Backward compatible with v1.1, faster connection and discovery. Recovered confrontation to radio frequency interference by avoiding the use of crowded frequencies in the hopping sequence. Data transmission speed up to 721 kbit / s. Bluetooth v2.0 Backward compatible with the previous v1.2. Enhanced Data Rate (EDR) for faster data transfer. The nominal rate of EDR is about 3 Mbit / s Bluetooth v2.1 Backward compatible with v1.2. Uses secure simple pairing (SSP) to improve a better pairing experience for Bluetooth devices. Uses sniff sub rating, which reduces the power consumption in low-power mode. Bluetooth v3.0 Backward compatible with v2.1. Bluetooth 3.0 provides theoretical data transfer speeds of up to 24 Mbit / s. For high data rate traffic this version uses the adjacent 802.11 link. Bluetooth v4.0 Backward compatible with v3.0. It includes Classic Bluetooth, Bluetooth high speed and Bluetooth low energy protocols. Bluetooth high speed is based on Wi-Fi, and Classic Bluetooth consists of legacy Bluetooth protocols. Provides faster speed in data transmission than the earlier version. It comes with greatly reduced power consuming, as if it does not require any power at all to function. It provides more security in data transmission than the earlier version.

9. Bluetooth vs Other wireless technologies

10. Bluetooth Architecture Piconet Each piconet has one master and up to 7 simultaneous slaves Master : device that initiates a data exchange. Slave : device that responds to the master Scatternet Linking of multiple piconets through the master or slave devices Bluetooth devices have point-to-multipoint capability to engage in Scatternet communication.

11. Establishing Piconets P S S M SB SB S P M=Master P=Parked S=Slave SB=Standby Whenever there is a connection between two Bluetooth devices, a piconet is formed Always 1 master and up to 7 active slaves Any Bluetooth device can be either a master or a slave Can be a master of one piconet and a slave of another piconet at the same time (scatternet) All devices have the same timing and frequency hopping sequence

12. Scatternets Formed by two or more Piconets Master of one piconet can participate as a slave in another connected piconet No time or frequency synchronization between piconets

13. Link Manager Operation • Devices operate in standby mode by default until they become connected to a piconet • 4 Connection Modes • Active • Hold • Park • Sniff • Modes allow devices to adjust power consumption, performance, and the number/role of participants in a piconet

14. Active Mode Limited to 7 Active slaves for each master Three bit address (AM_ADDR) given to each active slave Unit actively participates on channel Can receive communications in any given frame Active slaves are polled by master for transmissions Unit operates on high-power

15. Hold Mode • Frees slave to • Attend another Piconet • Perform scanning, paging, or inquiry operations • Move into low-power sleep • Unit keeps active member address • Unit does not support ACL packets on the channel but may support SCO packets • Master and slave agree on a one time hold duration after which the slave revives and synchronizes with channel traffic • Unit operates on low-power

16. Sniff Mode Very similar to hold mode Slave is freed for reoccurring fixed time intervals Master can only communicate during arranged “sniff” time slots

17. Park Mode • Parked unit gives up active member address and is assigned • 8 bit Parked member address (PM_ADDR) – allows master to unpark slave • 8 bit Access request address (AR_ADDR) – allows slave to ask master to unpark it • Unit stays synchronized to channel • Operates in very low-power sleep

18. Park Mode (cont.) Provides the ability to connect more than 7 devices to a master (8 bit PM_ADDR allows 255 parked devices) Active and Parked slaves can be switched in and out to allow many connections to a single piconet

19. Inquiry and Page Slave Master (1) ID packet (Broadcast) Inquiry Standby Inquiry Standby scan (2) FHS packet Inquiry response Page (3) Paging ID packet Page scan Master (4) ID packet response Slave response (5) FHS packet (6) ID packet Connection Connection (7) ID packet This is the connection process from standby

20. Physical links Between master and slave(s), different types of links can be established. Two link types have been defined: Synchronous Connection-Oriented (SCO) link Asynchronous Connection-Less (ACL) link

21. Synchronous Connection Oriented (SCO) Intended for use with time-bounded information such as audio or video Provides a circuit-switched connection where data is regularly exchanged Retransmission is not necessary, since data is real-time Up to 3 SCO links per piconet

22. Asynchronous Connection-Less (ACL) Designed for data traffic Packet switched connection where data is exchanged sporadically as and when data is available from higher up the stack Data integrity is checked through error checking and retransmission One ACL link between a master and a slave

23. Frequency-Hopping Spread Spectrum (FHSS) In order to mitigate interference, Bluetooth implements frequency hopping 1600 hops per second through 79MHz channels Spreads Bluetooth traffic over the entire ISM band All slaves in piconet follow the master for frequency hop sequence Such type of frequency hopping technique is called Adaptive Frequency Hopping (AFH).

24. Frequency-Hopping Spread Spectrum(FHSS) This adaptive hopping technique helps in the coexistance of other non-hoping static ISM devices with the Bluetooth devices. A good protection from the interference can be obtained with a fast hop rate. The other advantage is that the packets are short length. So whenever there is blocking or interference in the frequency, the packets can be resent in any other frequency provided by the frequency scheme of the master.

25. Bluetooth Protocol Stack WAE vCard/vCal WAP OBEX AT- Commands SDP TCS BIN UDP TCP IP PPP RFCOMM Audio L2CAP Host Controller Interface (HCI) LMP Baseband Bluetooth Radio Cable Replacement Protocol Bluetooth Core Protocol Adopted Protocol Telephony Protocol

26. Bluetooth Protocol Stack Bluetooth Radio : specifics details of the air interface, including frequency, frequency hopping, modulation scheme, and transmission power. Baseband: concerned with connection establishment within a piconet, addressing, packet format, timing and power control. Link manager protocol (LMP): establishes the link setup between Bluetooth devices and manages ongoing links, including security aspects (e.g. authentication and encryption), and control and negotiation of baseband packet size

27. Bluetooth Protocol Stack Logical link control and adaptation protocol (L2CAP): adapts upper layer protocols to the baseband layer. Provides both connectionless and connection-oriented services. Service discovery protocol (SDP): handles device information, services, and queries for service characteristics between two or more Bluetooth devices. Host Controller Interface (HCI):provides an interface method for accessing the Bluetooth hardware capabilities. It contains a command interface, which acts between the Baseband controller and link manager

28. Bluetooth Profile On the basis of the nature of the Bluetooth application, the Bluetooth Special Interest Group(SIG) has number of models profile for the usage of bluetooth technology in a device. In the other words, it is a wireless specification for the device that communicates using bluetooth technology. To provide the services based on the bluetooth technology a device must incorporate the terms of bluetooth profiles for the desired services.

29. Bluetooth Profile Dial-up Networking Profile (DNP) LAN Access Profile (LAP) FAX Profile Object Push Profile (OPP) File Transfer Profile (FTP) Synchronization Profile (SYNC) Headset Profile (HSP) Hands Free Profile (HFP) Human Interface Device Profile (HID) Basic Imaging Profile (BIP) Hardcopy Cable Replacement Profile (HCRP) Basic Printing Profile (BPP) Personal Area Network Profile (PAN) Advanced Audio Distribution Profile (A2DP) Audio/Video Remote Control Profile (AVRCP) General Access Profile (GAP) Service Discovery Application Profile (SDAP) Serial Port Profile (SPP) Generic Object Exchange Profile (GOEP)

30. Inquiry and Page Slave Master (1) ID packet (Broadcast) Inquiry Standby Inquiry Standby scan (2) FHS packet Inquiry response Page (3) Paging ID packet Page scan Master (4) ID packet response Slave response (5) FHS packet (6) ID packet Connection Connection (7) ID packet

31. Bluetooth Security There are three modes of security for Bluetooth access between two devices. non-secure service level enforced security link level enforced security Device security level Trusted untrusted Service security level Authorization and Authentication Authentication only Open to all devices

32. Bluetooth Security The following are the three basic security services specified in the Bluetooth standard: Authentication verifying the identity of communicating devices. User authentication is not provided natively by Bluetooth. Confidentiality preventing information compromise caused by eavesdropping by ensuring that only authorized devices can access and view data. Authorization allowing the control of resources by ensuring that a device is authorized to use a service before permitting it to do so.

33. Bluetooth Security Bluebugging: Bluebugging attacking is targeted for privacy issues that are specific to cell phones and Bluetooth headsets. In order to succeed, bluebugging needs skilled hackers with knowledge of Bluetooth privacy protection and protocols. The hacker gains the access to a cellular phone’s commands and persisted information. A number of functions are performed by the hacker while in control of the cell phone. Bluejacking:A least damaging Bluetooth privacy issues. It could cause great annoyance to users. Bluejacking allows other user of mobile phones for sending business cards to other people’s phones anonymously. Usually, bluejacking is a prank. It may be able to transmit Trojan viruses. Bluesnarfing:Bluesnarfing are attacks which are more serious issues of privacy than bluejacking. It describes the unauthorized access to the utilization of information on a Bluetooth device, which includes cell phones, computer systems and PDAs. The information includes the text messages, calendar schedules, address books, emails, pictures and also videos. The best privacy protection against bluesnarfing is setting Bluetooth device to “non-discoverable”.

34. Advantages Eliminates wires Facilitates Data and Voice Communication Offers formation of Ad hoc networks Free of charge Easy to use Low power consumes battery less Stationary and mobile environments

35. Disadvantages Relatively short range less secure Interference with other devices Mediocre Data rates Bluetooth internet connection gets slow somtimes

36. Question1 How many devices can communicate concurrently? Answer: Bluetooth device playing the role of the “master” can communicate with up to 7 devices playing the role of the “slave”. This network of “group of up to 8 devices” (1 master + 7 slaves) is called a piconet. A piconet is an ad-hoc computer network of devices using Bluetooth technology protocols to allow one master device to interconnect with up to seven active slave devices (because a three-bit MAC address is used). Up to 255 further slave devices can be inactive, or parked, which the master device can bring into active status at any time.

37. Question2 In the part of differences between ACL and SCO？ Answer: Slide 21 & 22

38. Question3 In the part of Bluetooth security, which kind of attack would send out messages to other devices?why? Answer: Bluejacking.Bluejacking allows other user of mobile phones for sending business cards to other people’s phones anonymously. Usually, bluejacking is a prank. It may be able to transmit Trojan viruses. Explain:Slide 33

39. Thank you!