The 7 Things I Know About Cyber Security After 25 Years | April 2024
05 ble intro
1. Introduction to Bluetooth® low energy
A brief insight into the ultra low power technology at the core of the nRF51 series
October 2012Vinayak Kariappa Chettimada
2. 2Introduction to Bluetooth low energy
Bluetooth: essentials
Standard for Personal Area Network based on Ericsson research
Short range, low-power
Frequency hopping spread spectrum (FHSS)
2.4 GHz ISM band
Bluetooth Special Interest Group formed in 1998
16000+ SIG member companies
Billions of products shipped
Nordic Semiconductor is one 9 SIG Board members
3. 4Introduction to Bluetooth low energy
Bluetooth: terminology
Term Introduced Means
BR 1.1 (2002) Basic Rate (1 Mbit/s)
EDR 2.0 (2004) Enhanced Data Rate (2 and 3 Mbit/s)
HS 3.0 (2009) High Speed (Alternate MAC/PHY)
LE 4.0 (2010) Low Energy (1 Mbit/s ultra low power)
Bluetooth Smart 4.0 Single-mode, LE-only radio
Bluetooth Smart Ready 4.0 Dual-mode, BR/EDR and LE dual radio
nRF51 Series
4. 5Introduction to Bluetooth low energy
Bluetooth: configurations
BR/EDR/HS 1.1, 2.0, 3.0
Link Manager
BR/EDR PHY
L2CAP
SPP
RFCOMM
BR/EDR 4.0 Dual Mode (+LE)
L2CAP
GATT
ATTSMP
GAPSPP
RFCOMM
Link LayerLink Manager
BR/EDR + LE PHY
LE 4.0 Single Mode
GA
P
GATT
ATTSMP
L2CAP
GAP
Link Layer
LE PHY
5. 6Introduction to Bluetooth low energy
Bluetooth LE: key features
Following goals and rules of ULP wireless pioneered by Nordic
PHY compatible with all 4.0 Bluetooth devices
Ultra Low Power
Small packets
Short RX and TX windows
Race to idle
Turn radio on as seldom as possible
Turn radio off as soon as possible
Coin-cell battery 1+ year
Low memory footprint
Fast connection in 6 ms and teardown
Simple stateless operation, data in form of parameter-value
6. 7Introduction to Bluetooth low energy
Bluetooth LE: architecture
Host
GAPGATT
ATT SMP
L2CAP
Controller
Host Controller Interface (HCI)
Link Layer (LL)
Physical Layer (PHY)
…
Profiles
HIDoverGATT
Proximity
Battery
Thermometer
HeartRate
BloodPressure
Speed&Cadence
7. 8Introduction to Bluetooth low energy
2.4 GHz free ISM band
1 Mbit/s signalling rate
GFSK modulation
Up to 4 dBm maximum transmit power
40 RF channels
3 advertising channels reserved for:
Discover
Connect
Broadcast
37 data channels
PHY Overview
…
ControllerHostProfiles
GAPGATT
ATT SMP
L2CAP
Host Controller Interface (HCI)
Link Layer (LL)
Physical Layer (PHY)
HIDoverGATT
Proximity
Battery
Thermometer
HeartRate
BloodPressure
Speed&Cadence
8. 9Introduction to Bluetooth low energy
Advertising: connectable and non-connectable
Scanning: active or passive
Slave: connection role
Master: connection role
31 bytes advertising payload size
27 bytes maximum payload size per packet
AES-128 built-in encryption
CCM
Counter with
Cipher Block Chaining
Message Authentication Code
Link Layer Overview
…
ControllerHostProfiles
GAPGATT
ATT SMP
L2CAP
Host Controller Interface (HCI)
Link Layer (LL)
Physical Layer (PHY)
HIDoverGATT
Proximity
Battery
Thermometer
HeartRate
BloodPressure
Speed&Cadence
9. Scanning on
channel 37
0 ms
S
25 ms 50 ms 100 ms75 ms 125 ms 150 ms
Scanning on
channel 38
Scanning on
channel 39
Advertising on 37, 38 and 39
0 ms 20 ms 40 ms 60 ms 80 ms 100 ms 120 ms 140 ms
A
10PRESENTATION TITLE
Scanner scan interval = 50 ms
Scanner scan window = 25 ms
Link Layer Overview: Advertising and Scanning
Advertiser advertising interval = 20 ms
10. 11PRESENTATION TITLE
Link Layer Overview: Topology
Master
Advertiser
SlaveConnection
Request
Scanner
BR/EDR
BR/EDR
Slave
Scanner
Slave
Slave
Advertiser
11. 12PRESENTATION TITLE
Selectable Connection Interval: 7.5 ms to 4 s
Radio
Idle
Radio Idle
Radio Idle
Radio
Idle
Link Layer Overview: Connection
T
X
T
X
Slave
connection interval
T
X
T
X
Master
R
X
R
X
R
X
R
X
connection interval connection interval
T
X
T
X
R
X
R
X
T
X
T
X
R
X
R
X
...
...
12. 15Introduction to Bluetooth low energy
Attribute Protocol
Mandatory and used for all data transfers in BLE
Fast, simple, independent of connection logic
Client – Server architecture
Server stores data
Client requests data
Server initiates Notifications and Indications
Supports for fine-grained security
ATT Overview
…
ControllerHostProfiles
GAPGATT
ATT SMP
L2CAP
Host Controller Interface (HCI)
Link Layer (LL)
Physical Layer (PHY)
HIDoverGATT
Proximity
Battery
Thermometer
HeartRate
BloodPressure
Speed&Cadence
13. 16Introduction to Bluetooth low energy
ATT Transaction
Client
ATT Request PDU
ATT Response PDU
ATT HVN/HVI PDU(on update)
Server
Attr.
Attr.
Attr.
Attr.
Handle UUID Permissions Value
Attribute
Handle – Index in the ATT Table, used in ATT transaction PDU
UUID – Universal Unique Identifier
Permissions – Read, Write, Authenticated, Encrypted etc.
Value – data read/written by Client
14. 18Introduction to Bluetooth low energy
Generic Attribute Profile
Mandatory for all BLE profiles
Procedures for attribute discovery and access
Models the ATT Table layout
16-bit (SIG Assigned) and 128-bit (Proprietary) UUIDs
Hierarchial classification of Attributes
Services
Characteristics
Descriptors
GATT Overview
…
ControllerHostProfiles
GAPGATT
ATT SMP
L2CAP
Host Controller Interface (HCI)
Link Layer (LL)
Physical Layer (PHY)
HIDoverGATT
Proximity
Battery
Thermometer
HeartRate
BloodPressure
Speed&Cadence
15. 19Introduction to Bluetooth low energy
GATT Overview
Handle UUID Value
0x0005 CHAR HSL
0x0006 HSL FINGER
0x0002 CHAR HRM
0x0003 HRM 80bpm
0x0001 SERVICE HRSService
Permissions
READ
READ
READ
READ/NOTIF
READ
0x0004 DESC NOTIFYREAD
Characteristic
Characteristic
Descriptor
Attribute
16. 21Introduction to Bluetooth low energy
Generic Access Profile
Common to BR/EDR and BLE
Mandatory for all BLE profiles
Procedures to discover, and connect to devices
Roles
Peripheral (Slave)
Central (Master)
Broadcaster (Advertiser)
Observer (Scanner)
Security
Creating bonds with peer devices
Attribute access security requirements
Privacy and address control
Advertising data format
GAP Overview
…
ControllerHostProfiles
GAPGATT
ATT SMP
L2CAP
Host Controller Interface (HCI)
Link Layer (LL)
Physical Layer (PHY)
HIDoverGATT
Proximity
Battery
Thermometer
HeartRate
BloodPressure
Speed&Cadence
17. 22Introduction to Bluetooth low energy
Vertical slice across protocol stack
Selects required features from the stack
Describes a particular use case
Requires a particular set of GATT services
Defines
Roles
Procedures
Security
Key to inter-operability
Profiles overview
GAPGATT
ATT SMP
L2CAP
Profile
Services
…
ControllerHostProfiles
GAPGATT
ATT SMP
L2CAP
Host Controller Interface (HCI)
Link Layer (LL)
Physical Layer (PHY)
HIDoverGATT
Proximity
Battery
Thermometer
HeartRate
BloodPressure
Speed&Cadence
18. 23Introduction to Bluetooth low energy
Profiles overview: Examples and roles
HID over GATT: Wireless Human
Interface Devices
Host (PC, tablet, phone)
Device (keyboard, mouse, trackpad, …)
Heart Rate: Both sport and medical Heart Rate
transmission
Collector (PC, tablet, phone)
Sensor (Heart Rate belt or similar)
Proximity / Find Me: Locate devices and detect
presence
Monitor (PC, tablet, phone)
Reporter (keyfob, phone)
19. 24Introduction to Bluetooth low energy
All Bluetooth products must be qualified
End Product Listing is the goal
Requires an EP-QDL (Qualified Design
Listing)
Nordic can help!
We will provide an EP-QDL for nRF51
No qualification fees
Only RF-PHY retesting required
Qualification
20. 25Introduction to Bluetooth low energy
Qualification
RF-PHY
(Component)
Link Layer
(Component)
Host
(Component)
nRF51
(EP-QDL)
nRF51 Profiles
(Subsystem)
Internal Nordic Qualifications
(Not intended to be used by customers)
Publicly Available Qualifications
(Intended to be used by customers)
nRF51 End Product
(EPL)
End product
(Listed by the product manufacturer)
Subset
21. 26Introduction to Bluetooth low energy
Annex: Operating System support today
Microsoft Windows:
Windows XP, Vista and 7: 1.1 – 2.1 BR/EDR only
Additional full replacements commonly shipped by OEMs
Windows 8: 4.0 BR/EDR and low energy natively supported
Apple
Mac OS X (10.6 and above): 4.0 BR/EDR and low energy
iOS (5 and above): 4.0 BR/EDR and low energy
GNU/Linux:
Vanilla BlueZ (~4.93 and above): 4.0 BR/EDR and low energy
Android: BR/EDR only as of 4.1 (Jelly Bean)
Several vendors offer patched versions with 4.0 LE support
22. Thank you for your attention
Questions
October 2012Vinayak Kariappa Chettimada