Bluetooth

For the Danish king, seeHarald Bluetooth.

Bluetoothis a short-rangewirelesstechnology standard that is used for exchanging data between fixed and mobile devices over short distances and buildingpersonal area networks(PANs). In the most widely used mode, transmission power is limited to 2.5milliwatts,giving it a very short range of up to 10 metres (33 ft). It employsUHFradio wavesin theISM bands,from 2.402GHzto 2.48GHz.It is mainly used as an alternative to wired connections to exchange files between nearby portable devices and connectcell phonesand music players withwireless headphones,wireless speakers,HIFIsystems,car audioand wireless transmission betweenTVsandsoundbars.

Bluetooth

Developed by	Bluetooth Special Interest Group
Introduced	7 May 1998(1998-05-07)
Industry	Personal area networks
Compatible hardware	Personal computers Smartphones Gaming consoles Audio devices Embedded devices Key finders
Physical range	Typically less than 10 m (33 ft), up to 100 m (330 ft). Bluetooth 5.0: 40–400 m (100–1,000 ft)
Website	bluetooth.com

A Bluetoothearbud,an earphone and microphone that communicates with a cellphone using the Bluetooth protocol

Bluetooth is managed by theBluetooth Special Interest Group(SIG), which has more than 35,000 member companies in the areas of telecommunication, computing, networking, and consumer electronics. TheIEEEstandardized Bluetooth asIEEE 802.15.1but no longer maintains the standard. The Bluetooth SIG oversees the development of the specification, manages the qualification program, and protects the trademarks.A manufacturer must meetBluetooth SIG standardsto market it as a Bluetooth device.A network ofpatentsapplies to the technology, which is licensed to individual qualifying devices. As of 2021,4.7 billion Bluetoothintegrated circuitchips are shipped annually.Bluetooth was first demonstrated in space in 2024, an early test envisioned to enhanceIoTcapabilities.

Etymology

The name "Bluetooth" was proposed in 1997 by Jim Kardach ofIntel,one of the founders of the Bluetooth SIG. The name was inspired by a conversation with Sven Mattisson who related Scandinavian history through tales fromFrans G. Bengtsson'sThe Long Ships,a historical novel about Vikings and the 10th-century Danish kingHarald Bluetooth.Upon discovering a picture of therunestone of Harald Bluetoothin the bookA History of the VikingsbyGwyn Jones,Kardach proposed Bluetooth as the codename for the short-range wireless program which is now called Bluetooth.

According to Bluetooth's official website,

Bluetooth was only intended as a placeholder until marketing could come up with something really cool.

Later, when it came time to select a serious name, Bluetooth was to be replaced with either RadioWire or PAN (Personal Area Networking). PAN was the front runner, but an exhaustive search discovered it already had tens of thousands of hits throughout the internet.

A full trademark search on RadioWire couldn't be completed in time for launch, making Bluetooth the only choice. The name caught on fast and before it could be changed, it spread throughout the industry, becoming synonymous with short-range wireless technology.

Bluetooth is theAnglicisedversion of the ScandinavianBlåtand/Blåtann(or inOld Norseblátǫnn). It was theepithetof King Harald Bluetooth, who united the disparate Danish tribes into a single kingdom; Kardach chose the name to imply that Bluetooth similarly unites communication protocols.

The Bluetooth logois abind runemerging theYounger Futharkrunes(ᚼ,Hagall) and(ᛒ,Bjarkan), Harald's initials.

History

Ericsson Bluetooth module PBA 313 01/2S R2A, manufactured in week 22 of 2001

The development of the "short-link" radio technology, later named Bluetooth, was initiated in 1989 by Nils Rydbeck, CTO atEricsson MobileinLund,Sweden. The purpose was to develop wireless headsets, according to two inventions byJohan Ullman,SE 8902098-6,issued 1989-06-12andSE 9202239,issued 1992-07-24.Nils Rydbeck taskedTord Wingrenwith specifying and DutchmanJaap Haartsenand Sven Mattisson with developing.Both were working for Ericsson in Lund.Principal design and development began in 1994 and by 1997 the team had a workable solution.From 1997 Örjan Johansson became the project leader and propelled the technology and standardization.

In 1997, Adalio Sanchez, then head ofIBMThinkPadproduct R&D, approached Nils Rydbeck about collaborating on integrating amobile phoneinto a ThinkPad notebook. The two assigned engineers fromEricssonandIBMstudied the idea. The conclusion was that power consumption on cellphone technology at that time was too high to allow viable integration into a notebook and still achieve adequate battery life. Instead, the two companies agreed to integrate Ericsson's short-link technology on both a ThinkPad notebook and an Ericsson phone to accomplish the goal.

Since neither IBM ThinkPad notebooks nor Ericsson phones were the market share leaders in their respective markets at that time, Adalio Sanchez and Nils Rydbeck agreed to make the short-link technology an open industry standard to permit each player maximum market access. Ericsson contributed the short-link radio technology, and IBM contributed patents around the logical layer. Adalio Sanchez of IBM then recruited Stephen Nachtsheim of Intel to join and then Intel also recruitedToshibaandNokia.In May 1998, the Bluetooth SIG was launched with IBM and Ericsson as the founding signatories and a total of five members: Ericsson, Intel, Nokia, Toshiba, and IBM.

The first Bluetooth device was revealed in 1999. It was a hands-free mobile headset that earned the "Best of show Technology Award" atCOMDEX.The first Bluetooth mobile phone was the unreleased prototype Ericsson T36, though it was the revised Ericsson modelT39that actually made it to store shelves in June 2001. However Ericsson released the R520m in Quarter 1 of 2001,making the R520m the first ever commercially available Bluetooth phone. In parallel, IBM introduced the IBM ThinkPad A30 in October 2001 which was the first notebook with integrated Bluetooth.

Bluetooth's early incorporation into consumer electronics products continued at Vosi Technologies in Costa Mesa, California, initially overseen by founding members Bejan Amini and Tom Davidson. Vosi Technologies had been created by real estate developer Ivano Stegmenga, with United States Patent 608507, for communication between a cellular phone and a vehicle's audio system. At the time, Sony/Ericsson had only a minor market share in the cellular phone market, which was dominated in the US by Nokia and Motorola. Due to ongoing negotiations for an intended licensing agreement with Motorola beginning in the late 1990s, Vosi could not publicly disclose the intention, integration, and initial development of other enabled devices which were to be the first "Smart Home"internet connected devices.

Vosi needed a means for the system to communicate without a wired connection from the vehicle to the other devices in the network. Bluetooth was chosen, sinceWi-Fiwas not yet readily available or supported in the public market. Vosi had begun to develop the Vosi Cello integrated vehicular system and some other internet connected devices, one of which was intended to be a table-top device named the Vosi Symphony, networked with Bluetooth. Through the negotiations withMotorola,Vosi introduced and disclosed its intent to integrate Bluetooth in its devices. In the early 2000s a legal battleensued between Vosi and Motorola, which indefinitely suspended release of the devices. Later, Motorola implemented it in their devices which initiated the significant propagation of Bluetooth in the public market due to its large market share at the time.

In 2012, Jaap Haartsen was nominated by theEuropean Patent Officefor theEuropean Inventor Award.

Implementation

Bluetooth operates at frequencies between 2.402 and 2.480GHz, or 2.400 and 2.4835GHz, includingguard bands2MHz wide at the bottom end and 3.5MHz wide at the top.This is in the globally unlicensed (but not unregulated) industrial, scientific and medical (ISM) 2.4GHz short-range radio frequency band. Bluetooth uses a radio technology calledfrequency-hopping spread spectrum.Bluetooth divides transmitted data into packets, and transmits each packet on one of 79 designated Bluetooth channels. Each channel has a bandwidth of 1MHz. It usually performs 1600hops per second, withadaptive frequency-hopping(AFH) enabled.Bluetooth Low Energyuses 2MHz spacing, which accommodates 40 channels.

Originally,Gaussian frequency-shift keying(GFSK) modulation was the only modulation scheme available. Since the introduction of Bluetooth 2.0+EDR, π/4-DQPSK(differential quadrature phase-shift keying) and 8-DPSK modulation may also be used between compatible devices. Devices functioning with GFSK are said to be operating in basic rate (BR) mode, where an instantaneousbit rateof 1Mbit/sis possible. The termEnhanced Data Rate(EDR) is used to describe π/4-DPSK (EDR2) and 8-DPSK (EDR3) schemes, transferring 2 and 3Mbit/s respectively.

In 2019, Apple published an extension called HDR which supports data rates of 4 (HDR4) and 8 (HDR8) Mbit/s using π/4-DQPSKmodulation on 4 MHz channels with forward error correction (FEC).

Bluetooth is apacket-based protocolwith amaster/slave architecture.One master may communicate with up to seven slaves in apiconet.All devices within a given piconet use the clock provided by the master as the base for packet exchange. The master clock ticks with a period of 312.5μs,two clock ticks then make up a slot of 625μs, and two slots make up a slot pair of 1250μs. In the simple case of single-slot packets, the master transmits in even slots and receives in odd slots. The slave, conversely, receives in even slots and transmits in odd slots. Packets may be 1, 3, or 5 slots long, but in all cases, the master's transmission begins in even slots and the slave's in odd slots.

The above excludes Bluetooth Low Energy, introduced in the 4.0 specification,whichuses the same spectrum but somewhat differently.

Communication and connection

A master BR/EDR Bluetooth device can communicate with a maximum of seven devices in a piconet (an ad hoc computer network using Bluetooth technology), though not all devices reach this maximum. The devices can switch roles, by agreement, and the slave can become the master (for example, a headset initiating a connection to a phone necessarily begins as master—as an initiator of the connection—but may subsequently operate as the slave).

The Bluetooth Core Specification provides for the connection of two or more piconets to form ascatternet,in which certain devices simultaneously play the master/leader role in one piconet and the slave role in another.

At any given time, data can be transferred between the master and one other device (except for the little-used broadcast mode). The master chooses which slave device to address; typically, it switches rapidly from one device to another in around-robinfashion. Since it is the master that chooses which slave to address, whereas a slave is (in theory) supposed to listen in each receive slot, being a master is a lighter burden than being a slave. Being a master of seven slaves is possible; being a slave of more than one master is possible. The specification is vague as to required behavior in scatternets.

Uses

Bluetooth is a standard wire-replacement communications protocol primarily designed for low power consumption, with a short range based on low-costtransceivermicrochipsin each device.Because the devices use a radio (broadcast) communications system, they do not have to be in visual line of sight of each other; however, aquasi opticalwireless path must be viable.

Bluetooth classes and power use

Bluetooth device power by class

Class	Maximum permitted power
	mW	dBm
1	10–100	+10–+20
1.5*	2.5–10	+4–+10
2	1–2.5	0–+4
3	0.01–1	−20–0
* Class1.5 included in Class1 for BR/EDR
Source: Bluetooth Core Specification revision5.3, Volume6, PartA, §3, and Volume2, PartA, §3,Bluetooth SIG

Historically, the Bluetooth range was defined by the radio class, with a lower class (and higher output power) having larger range.The actual range of a given link depends on several qualities of both communicating devices and theair and obstacles in between.The primary attributes affecting range are the data rate, protocol (Bluetooth Classic or Bluetooth Low Energy), transmission power, and receiver sensitivity, and the relative orientations and gains of both antennas.

The effective range varies depending on propagation conditions, material coverage, production sample variations, antenna configurations and battery conditions. Most Bluetooth applications are for indoor conditions, where attenuation of walls and signal fading due to signal reflections make the range far lower than specified line-of-sight ranges of the Bluetooth products.

Most Bluetooth applications are battery-powered Class 2 devices, with little difference in range whether the other end of the link is a Class 1 or Class 2 device as the lower-powered device tends to set the range limit. In some cases the effective range of the data link can be extended when a Class 2 device is connecting to a Class 1 transceiver with both higher sensitivity and transmission power than a typical Class 2 device.In general, however, Class 1 devices have sensitivities similar to those of Class 2 devices. Connecting two Class 1 devices with both high sensitivity and high power can allow ranges far in excess of the typical 100 m, depending on the throughput required by the application. Some such devices allow open field ranges of up to 1 km and beyond between two similar devices without exceeding legal emission limits.

Bluetooth profile

Main article:List of Bluetooth profiles

To use Bluetooth wireless technology, a device must be able to interpret certain Bluetooth profiles. For example,

• TheHeadset Profile (HSP)connects headphones and earbuds to a cell phone or laptop.
• TheHealth Device Profile (HDP)can connect a cell phone to a digital thermometer or heart rate detector.
• TheVideo Distribution Profile (VDP)sends a video stream from a video camera to a TV screen or a recording device.

Profiles are definitions of possible applications and specify general behaviors that Bluetooth-enabled devices use to communicate with other Bluetooth devices. These profiles include settings to parameterize and to control the communication from the start. Adherence to profiles saves the time for transmitting the parameters anew before the bi-directional link becomes effective. There are a wide range of Bluetooth profiles that describe many different types of applications or use cases for devices.

List of applications

A typical Bluetooth mobile phoneheadsetfrom the early 2000s

A handheld, waterproof JBLBluetooth speakerwith a rechargeable battery, made in the late 2010s

• Wireless control and communication between a mobile phone and ahandsfreeheadset.This was one of the earliest applications to become popular.
• Wireless control of audio and communication functions between a mobile phone and a Bluetooth compatible car stereo system (and sometimesbetween the SIM card and the car phone).
• Wireless communication between a smartphone and asmart lockfor unlocking doors.
• Wireless control of and communication with iOS and Android device phones, tablets and portablewireless speakers.
• WirelessBluetooth headsetandintercom.Idiomatically, a headset is sometimes called "a Bluetooth".
• Wireless streaming of audio toheadphoneswith or without communication capabilities.
• Wireless streaming of data collected by Bluetooth-enabled fitness devices to phone or PC.
• Wireless networking between PCs in a confined space and where little bandwidth is required.
• Wireless communication with PC input and output devices, the most common being themouse,keyboardandprinter.
• Transfer of files, contact details, calendar appointments, and reminders between devices with OBEXand sharing directoriesvia FTP.
• Triggering the camera shutter of asmartphoneusing a Bluetooth controlledselfie stick.
• Replacement of previous wiredRS-232serial communications in test equipment,GPS receivers,medical equipment, bar code scanners, and traffic control devices.
• For controls whereinfraredwas often used.
• For low bandwidth applications where higherUSBbandwidth is not required and cable-free connection desired.
• Sending small advertisements from Bluetooth-enabled advertising hoardings to other, discoverable, Bluetooth devices.
• Wireless bridge between two Industrial Ethernet (e.g.,PROFINET) networks.
• Game consoles have been using Bluetooth as a wireless communications protocol for peripherals since theseventh generation,includingNintendo'sWiiandSony'sPlayStation 3which use Bluetooth for their respective controllers.
• Dial-up internet access on personal computers or PDAs using a data-capable mobile phone as a wireless modem.
• Short-range transmission of health sensor data from medical devices to mobile phone,set-top boxor dedicatedtelehealthdevices.
• Allowing aDECTphone to ring and answer calls on behalf of a nearby mobile phone.
• Real-time location systems(RTLS) are used to track and identify the location of objects in real time using "Nodes" or "tags" attached to, or embedded in, the objects tracked, and "Readers" that receive and process the wireless signals from these tags to determine their locations.
• Personal security application on mobile phones for prevention of theft or loss of items. The protected item has a Bluetooth marker (e.g., a tag) that is in constant communication with the phone. If the connection is broken (the marker is out of range of the phone) then an alarm is raised. This can also be used as aman overboardalarm.
• Calgary,Alberta,Canada's Roads Traffic division uses data collected from travelers' Bluetooth devices to predict travel times and road congestion for motorists.
• Wireless transmission of audio (a more reliable alternative toFM transmitters)
• Live video streaming to the visual cortical implant device by Nabeel Fattah in Newcastle university 2017.
• Connection ofmotion controllersto a PC when using VR headsets
• Wireless connection betweenTVsandsoundbars.

Devices

A modern BluetoothUSBdongle

Bluetooth exists in numerous products such as telephones,speakers,tablets, media players, robotics systems, laptops, and game console equipment as well as some high definitionheadsets,modems,hearing aidsand even watches.Bluetooth is useful when transferring information between two or more devices that are near each other in low-bandwidth situations. Bluetooth is commonly used to transfer sound data with telephones (i.e., with a Bluetooth headset) or byte data with hand-held computers (transferring files).

Bluetooth protocols simplify the discovery and setup of services between devices.Bluetooth devices can advertise all of the services they provide.This makes using services easier, because more of the security,network addressand permission configuration can be automated than with many other network types.

Computer requirements

An early BluetoothUSBdongle

An early internal notebook Bluetooth card (14×36×4mm)

A personal computer that does not have embedded Bluetooth can use a Bluetooth adapter that enables the PC to communicate with Bluetooth devices. While somedesktop computersand most recent laptops come with a built-in Bluetooth radio, others require an external adapter, typically in the form of a small USB "dongle".

Unlike its predecessor,IrDA,which requires a separate adapter for each device, Bluetooth lets multiple devices communicate with a computer over a single adapter.

Operating system implementation

Further information:Bluetooth stack

ForMicrosoftplatforms,Windows XP Service Pack 2and SP3 releases work natively with Bluetooth v1.1, v2.0 and v2.0+EDR.Previous versions required users to install their Bluetooth adapter's own drivers, which were not directly supported by Microsoft.Microsoft's own Bluetooth dongles (packaged with their Bluetooth computer devices) have no external drivers and thus require at least Windows XP Service Pack 2. Windows Vista RTM/SP1 with the Feature Pack for Wireless or Windows Vista SP2 work with Bluetooth v2.1+EDR.Windows 7 works with Bluetooth v2.1+EDR and Extended Inquiry Response (EIR). The Windows XP and Windows Vista/Windows 7 Bluetooth stacks support the following Bluetooth profiles natively: PAN, SPP,DUN,HID, HCRP. The Windows XP stack can be replaced by a third party stack that supports more profiles or newer Bluetooth versions. The Windows Vista/Windows 7 Bluetooth stack supports vendor-supplied additional profiles without requiring that the Microsoft stack be replaced.Windows 8 and later support Bluetooth Low Energy (BLE). It is generally recommended to install the latest vendor driver and its associated stack to be able to use the Bluetooth device at its fullest extent.

Appleproducts have worked with Bluetooth sinceMac OSX v10.2,which was released in 2002.

Linuxhas two popularBluetooth stacks,BlueZ and Fluoride. The BlueZ stack is included with most Linux kernels and was originally developed byQualcomm.Fluoride, earlier known as Bluedroid is included in Android OS and was originally developed byBroadcom. There is also Affix stack, developed byNokia.It was once popular, but has not been updated since 2005.

FreeBSDhas included Bluetooth since its v5.0 release, implemented throughnetgraph.

NetBSDhas included Bluetooth since its v4.0 release.Its Bluetooth stack was ported toOpenBSDas well, however OpenBSD later removed it as unmaintained.

DragonFly BSDhas had NetBSD's Bluetooth implementation since 1.11 (2008).Anetgraph-based implementation fromFreeBSDhas also been available in the tree, possibly disabled until 2014-11-15, and may require more work.

Specifications and features

Bluetooth versions

Version		Adoption Year	Radio frequency	Maximumrate		Max Range
Major	Minor			Classic	Low Energy
1	1.0	1999	2.4 GHz	732.2 Kb/s	N/A	10 m
	1.1	2001		732.2 Kb/s	N/A	10 m
	1.2	2003		1 Mb/s	N/A	10 m
2	2.0	2004		2.1 Mb/s	N/A	10 m
	2.1	2007		2.1 Mb/s	N/A	10 m
3	3.0	2009		24 Mb/s	N/A	10 m
4	4.0	2009		3 Mb/s	1 Mb/s	60 m
	4.1	2013		3 Mb/s	1 Mb/s	60 m
	4.2	2014		3 Mb/s	1 Mb/s	60 m
5	5.0	2016		50 Mb/s	2 Mb/s	240 m
	5.1	2019		50 Mb/s	2 Mb/s	240 m
	5.2	2020		50 Mb/s	2 Mb/s	240 m
	5.3	2021		50 Mb/s	2 Mb/s	240 m
	5.4	2023		50 Mb/s	2 Mb/s	240 m
6	6.0	2024		?	3 Mb/s	300 m

The specifications were formalized by theBluetooth Special Interest Group(SIG) and formally announced on 20 May 1998.In 2014 it had a membership of over 30,000 companies worldwide.It was established byEricsson,IBM,Intel,NokiaandToshiba,and later joined by many other companies.

All versions of the Bluetooth standards arebackward-compatiblewith all earlier versions.

The Bluetooth Core Specification Working Group (CSWG) produces mainly four kinds of specifications:

• The Bluetooth Core Specification – typically released every few years
• Core Specification Addendum (CSA)
• Core Specification Supplements (CSS) – can be released more frequently than Addenda
• Errata – available with a Bluetooth SIG account:Errata login)

Bluetooth 1.0 and 1.0B

• Products were not interoperable.
• Anonymity was not possible, preventing certain services from using Bluetooth environments.

Bluetooth 1.1

• Ratified asIEEE Standard 802.15.1–2002
• Many errors found in the v1.0B specifications were fixed.
• Added possibility of non-encrypted channels.
• Received signal strength indicator(RSSI)

Bluetooth 1.2

Major enhancements include:

• Faster connection and discovery
• Adaptivefrequency-hopping spread spectrum(AFH),which improves resistance toradio frequency interferenceby avoiding the use of crowded frequencies in the hopping sequence
• Higher transmission speeds in practice than in v1.1, up to 721 kbit/s
• Extended Synchronous Connections (eSCO), which improve voice quality of audio links by allowing retransmissions of corrupted packets, and may optionally increase audio latency to provide better concurrent data transfer
• Host Controller Interface(HCI) operation with three-wireUART
• Ratified asIEEE Standard 802.15.1–2005
• Introduced flow control and retransmission modes forL2CAP

Bluetooth 2.0 + EDR

This version of the Bluetooth Core Specification was released before 2005. The main difference is the introduction of an Enhanced Data Rate (EDR) for fasterdata transfer.The data rate of EDR is 3Mbit/s, although the maximum data transfer rate (allowing for inter-packet time and acknowledgements) is 2.1Mbit/s.EDR uses a combination ofGFSKandphase-shift keyingmodulation (PSK) with two variants, π/4-DQPSKand 8-DPSK.EDR can provide a lower power consumption through a reducedduty cycle.

The specification is published asBluetooth v2.0 + EDR,which implies that EDR is an optional feature. Aside from EDR, the v2.0 specification contains other minor improvements, and products may claim compliance to "Bluetooth v2.0" without supporting the higher data rate. At least one commercial device states "Bluetooth v2.0 without EDR" on its data sheet.

Bluetooth 2.1 + EDR

Bluetooth Core Specification version 2.1 + EDR was adopted by the Bluetooth SIG on 26 July 2007.

The headline feature of v2.1 issecure simple pairing(SSP): this improves the pairing experience for Bluetooth devices, while increasing the use and strength of security.

Version 2.1 allows various other improvements, includingextended inquiry response(EIR), which provides more information during the inquiry procedure to allow better filtering of devices before connection; and sniff subrating, which reduces the power consumption in low-power mode.

Bluetooth 3.0 + HS

Version 3.0 + HS of the Bluetooth Core Specificationwas adopted by the Bluetooth SIG on 21 April 2009. Bluetooth v3.0 + HS provides theoretical data transfer speeds of up to 24 Mbit/s, though not over the Bluetooth link itself. Instead, the Bluetooth link is used for negotiation and establishment, and the high data rate traffic is carried over a colocated802.11link.

The main new feature isAMP(Alternative MAC/PHY), the addition of802.11as a high-speed transport. The high-speed part of the specification is not mandatory, and hence only devices that display the "+HS" logo actually support Bluetooth over 802.11 high-speed data transfer. A Bluetooth v3.0 device without the "+HS" suffix is only required to support features introduced in Core Specification version 3.0or earlier Core Specification Addendum 1.

L2CAPEnhanced modes

Enhanced Retransmission Mode (ERTM) implements reliable L2CAP channel, while Streaming Mode (SM) implements unreliable channel with no retransmission or flow control. Introduced in Core Specification Addendum 1.

Alternative MAC/PHY

Enables the use of alternativeMACandPHYsfor transporting Bluetooth profile data. The Bluetooth radio is still used for device discovery, initial connection and profile configuration. However, when large quantities of data must be sent, the high-speed alternative MAC PHY 802.11 (typically associated with Wi-Fi) transports the data. This means that Bluetooth uses proven low power connection models when the system is idle, and the faster radio when it must send large quantities of data. AMP links require enhanced L2CAP modes.

Unicast Connectionless Data

Permits sending service data without establishing an explicit L2CAP channel. It is intended for use by applications that require low latency between user action and reconnection/transmission of data. This is only appropriate for small amounts of data.

Enhanced Power Control

Updates the power control feature to remove the open loop power control, and also to clarify ambiguities in power control introduced by the new modulation schemes added for EDR. Enhanced power control removes the ambiguities by specifying the behavior that is expected. The feature also adds closed loop power control, meaning RSSI filtering can start as the response is received. Additionally, a "go straight to maximum power" request has been introduced. This is expected to deal with the headset link loss issue typically observed when a user puts their phone into a pocket on the opposite side to the headset.

Ultra-wideband

The high-speed (AMP) feature of Bluetooth v3.0 was originally intended forUWB,but the WiMedia Alliance, the body responsible for the flavor of UWB intended for Bluetooth, announced in March 2009 that it was disbanding, and ultimately UWB was omitted from the Core v3.0 specification.

On 16 March 2009, theWiMedia Allianceannounced it was entering into technology transfer agreements for the WiMediaUltra-wideband(UWB) specifications. WiMedia has transferred all current and future specifications, including work on future high-speed and power-optimized implementations, to the Bluetooth Special Interest Group (SIG),Wireless USBPromoter Group and theUSB Implementers Forum.After successful completion of the technology transfer, marketing, and related administrative items, the WiMedia Alliance ceased operations.

In October 2009, theBluetooth Special Interest Groupsuspended development of UWB as part of the alternative MAC/PHY, Bluetooth v3.0 + HS solution. A small, but significant, number of formerWiMediamembers had not and would not sign up to the necessary agreements for theIPtransfer. As of 2009, the Bluetooth SIG was in the process of evaluating other options for its longer-term roadmap.

Bluetooth 4.0

Main article:Bluetooth Low Energy

The Bluetooth SIG completed the Bluetooth Core Specification version 4.0 (called Bluetooth Smart) and has been adopted as of 30 June 2010.It includesClassic Bluetooth,Bluetooth high speedandBluetooth Low Energy(BLE) protocols. Bluetooth high speed is based on Wi-Fi, and Classic Bluetooth consists of legacy Bluetooth protocols.

Bluetooth Low Energy,previously known as Wibree,is a subset of Bluetooth v4.0 with an entirely new protocol stack for rapid build-up of simple links. As an alternative to the Bluetooth standard protocols that were introduced in Bluetooth v1.0 to v3.0, it is aimed at very low power applications powered by acoin cell.Chip designs allow for two types of implementation, dual-mode, single-mode and enhanced past versions.The provisional namesWibreeandBluetooth ULP(Ultra Low Power) were abandoned and the BLE name was used for a while. In late 2011, new logos "Bluetooth Smart Ready" for hosts and "Bluetooth Smart" for sensors were introduced as the general-public face of BLE.

Compared toClassic Bluetooth,Bluetooth Low Energy is intended to provide considerably reduced power consumption and cost while maintaining asimilar communication range.In terms of lengthening the battery life of Bluetooth devices,BLErepresents a significant progression.

• In a single-mode implementation, only the low energy protocol stack is implemented.Dialog Semiconductor,STMicroelectronics,AMICCOM,CSR,Nordic SemiconductorandTexas Instrumentshave released single mode Bluetooth Low Energy solutions.
• In a dual-mode implementation, Bluetooth Smart functionality is integrated into an existing Classic Bluetooth controller. As of March 2011,the following semiconductor companies have announced the availability of chips meeting the standard:Qualcomm Atheros,CSR,BroadcomandTexas Instruments.The compliant architecture shares all of Classic Bluetooth's existing radio and functionality resulting in a negligible cost increase compared to Classic Bluetooth.

Cost-reduced single-mode chips, which enable highly integrated and compact devices, feature a lightweight Link Layer providing ultra-low power idle mode operation, simple device discovery, and reliable point-to-multipoint data transfer with advanced power-save and secure encrypted connections at the lowest possible cost.

General improvements in version 4.0 include the changes necessary to facilitate BLE modes, as well the Generic Attribute Profile (GATT) and Security Manager (SM) services withAESEncryption.

Core Specification Addendum 2 was unveiled in December 2011; it contains improvements to the audio Host Controller Interface and to the High Speed (802.11) Protocol Adaptation Layer.

Core Specification Addendum 3 revision 2 has an adoption date of 24 July 2012.

Core Specification Addendum 4 has an adoption date of 12 February 2013.

Bluetooth 4.1

The Bluetooth SIG announced formal adoption of the Bluetooth v4.1 specification on 4 December 2013. This specification is an incremental software update to Bluetooth Specification v4.0, and not a hardware update. The update incorporates Bluetooth Core Specification Addenda (CSA 1, 2, 3 & 4) and adds new features that improve consumer usability. These include increased co-existence support for LTE, bulk data exchange rates—and aid developer innovation by allowing devices to support multiple roles simultaneously.

New features of this specification include:

• Mobile wireless service coexistence signaling
• Train nudging and generalized interlaced scanning
• Low Duty Cycle Directed Advertising
• L2CAP connection-oriented and dedicated channels with credit-based flow control
• Dual Mode and Topology
• LE Link Layer Topology
• 802.11n PAL
• Audio architecture updates for Wide Band Speech
• Fast data advertising interval
• Limited discovery time

Some features were already available in a Core Specification Addendum (CSA) before the release of v4.1.

Bluetooth 4.2

Released on 2 December 2014,it introduces features for theInternet of things.

The major areas of improvement are:

• Bluetooth Low Energy Secure Connection with Data Packet Length Extension to improve thecryptographic protocol
• Link Layer Privacy with Extended Scanner Filter Policies to improvedata security
• Internet Protocol Support Profile (IPSP)version 6ready for Bluetoothsmart devicesto support the Internet of things andhome automation

Older Bluetooth hardware may receive 4.2 features such as Data Packet Length Extension and improved privacy via firmware updates.

Bluetooth 5

The Bluetooth SIG released Bluetooth 5 on 6 December 2016.Its new features are mainly focused on newInternet of Thingstechnology. Sony was the first to announce Bluetooth 5.0 support with itsXperia XZ Premiumin Feb 2017 during the Mobile World Congress 2017.The SamsungGalaxy S8launched with Bluetooth 5 support in April 2017. In September 2017, theiPhone 8,8 Plus andiPhone Xlaunched with Bluetooth 5 support as well.Applealso integrated Bluetooth 5 in its newHomePodoffering released on 9 February 2018.Marketing drops the point number; so that it is just "Bluetooth 5" (unlike Bluetooth 4.0);the change is for the sake of "Simplifying our marketing, communicating user benefits more effectively and making it easier to signal significant technology updates to the market."

Bluetooth 5 provides, forBLE,options that can double the data rate (2Mbit/s burst) at the expense of range, or provide up to four times the range at the expense of data rate. The increase in transmissions could be important for Internet of Things devices, where many nodes connect throughout a whole house. Bluetooth 5 increases capacity of connectionless services such as location-relevant navigationof low-energy Bluetooth connections.

The major areas of improvement are:

• Slot Availability Mask (SAM)
• 2 Mbit/s PHY forLE
• LE Long Range
• High Duty Cycle Non-Connectable Advertising
• LE Advertising Extensions
• LE Channel Selection Algorithm #2

Features added in CSA5 – integrated in v5.0:

• Higher Output Power

The following features were removed in this version of the specification:

• Park State

Bluetooth 5.1

The Bluetooth SIG presented Bluetooth 5.1 on 21 January 2019.

The major areas of improvement are:

• Angle of arrival(AoA) and Angle of Departure (AoD) which are used for locating and tracking of devices
• Advertising Channel Index
• GATT caching
• Minor Enhancements batch 1:
  • HCI support for debug keys in LE Secure Connections
  • Sleep clock accuracy update mechanism
  • ADI field in scan response data
  • Interaction betweenQoSand Flow Specification
  • Block Host channel classification for secondary advertising
  • Allow the SID to appear in scan response reports
  • Specify the behavior when rules are violated
• Periodic Advertising Sync Transfer

Features added in Core Specification Addendum (CSA) 6 – integrated in v5.1:

• Models
• Mesh-based modelhierarchy

The following features were removed in this version of the specification:

• Unit keys

Bluetooth 5.2

On 31 December 2019, the Bluetooth SIG published the Bluetooth Core Specification version 5.2. The new specification adds new features:

• Enhanced Attribute Protocol (EATT), an improved version of the Attribute Protocol (ATT)
• LE Power Control
• LE Isochronous Channels
• LE Audiothat is built on top of the new 5.2 features. BT LE Audio was announced in January 2020 atCESby theBluetooth SIG.Compared to regular Bluetooth Audio, Bluetooth Low Energy Audio makes lower battery consumption possible and creates a standardized way of transmitting audio over BT LE. Bluetooth LE Audio also allows one-to-many and many-to-one transmission, allowing multiple receivers from one source or one receiver for multiple sources, known as Auracast.It uses a newLC3 codec.BLE Audio will also add support for hearing aids.On 12 July 2022, the Bluetooth SIG announced the completion of Bluetooth LE Audio. The standard has a lower minimum latency claim of 20–30 ms vs Bluetooth Classic audio of 100–200 ms.AtIFAin August 2023 Samsung announced support forAuracastthrough a software update for theirGalaxy Buds2 Proand two of their TVs.In October users started getting updates for the earbuds.

Bluetooth 5.3

The Bluetooth SIG published the Bluetooth Core Specification version 5.3 on 13 July 2021. The feature enhancements of Bluetooth 5.3 are:

• Connection Subrating
• Periodic Advertisement Interval
• Channel Classification Enhancement
• Encryption key size control enhancements

The following features were removed in this version of the specification:

• Alternate MAC and PHY (AMP) Extension

Bluetooth 5.4

The Bluetooth SIG released the Bluetooth Core Specification version 5.4 on 7 February 2023. This new version adds the following features:

• Periodic Advertising with Responses (PAwR)
• Encrypted Advertising Data
• LEGATTSecurity Levels Characteristic
• Advertising Coding Selection

Bluetooth 6.0

The Bluetooth SIG released the Bluetooth Core Specification version 6.0 on 27 August 2024.This version adds the following features:

• Bluetooth Channel Sounding
• Decision-based advertising filtering
• Monitoring advertisers
• ISOALenhancement
• LL extended feature set
• Frame space update

Technical information

Architecture

Software

Seeking to extend the compatibility of Bluetooth devices, the devices that adhere to the standard use an interface called HCI (Host Controller Interface) between the host and the controller.

High-level protocols such as the SDP (Protocol used to find other Bluetooth devices within the communication range, also responsible for detecting the function of devices in range), RFCOMM (Protocol used to emulate serial port connections) and TCS (Telephony control protocol) interact with the baseband controller through the L2CAP (Logical Link Control and Adaptation Protocol). The L2CAP protocol is responsible for the segmentation and reassembly of the packets.

Hardware

The hardware that makes up the Bluetooth device is made up of, logically, two parts; which may or may not be physically separate. A radio device, responsible for modulating and transmitting the signal; and a digital controller. The digital controller is likely a CPU, one of whose functions is to run a Link Controller; and interfaces with the host device; but some functions may be delegated to hardware. The Link Controller is responsible for the processing of the baseband and the management of ARQ and physical layer FEC protocols. In addition, it handles the transfer functions (both asynchronous and synchronous), audio coding (e.g.SBC (codec)) and data encryption. The CPU of the device is responsible for attending the instructions related to Bluetooth of the host device, in order to simplify its operation. To do this, the CPU runs software called Link Manager that has the function of communicating with other devices through the LMP protocol.

A Bluetooth device is ashort-rangewirelessdevice. Bluetooth devices arefabricatedonRF CMOSintegrated circuit(RF circuit) chips.

Bluetooth protocol stack

Main article:List of Bluetooth protocols

Bluetooth protocol stack

Bluetooth is defined as a layer protocol architecture consisting of core protocols, cable replacement protocols, telephony control protocols, and adopted protocols.Mandatory protocols for all Bluetooth stacks are LMP, L2CAP and SDP. In addition, devices that communicate with Bluetooth almost universally can use these protocols:HCIand RFCOMM.

Link Manager

The Link Manager (LM) is the system that manages establishing the connection between devices. It is responsible for the establishment, authentication and configuration of the link. The Link Manager locates other managers and communicates with them via the management protocol of the LMP link. To perform its function as a service provider, the LM uses the services included in the Link Controller (LC). The Link Manager Protocol basically consists of several PDUs (Protocol Data Units) that are sent from one device to another. The following is a list of supported services:

• Transmission and reception of data.
• Name request
• Request of the link addresses.
• Establishment of the connection.
• Authentication.
• Negotiation of link mode and connection establishment.

Host Controller Interface

The Host Controller Interface provides a command interface between the controller and the host.

Logical Link Control and Adaptation Protocol

TheLogical Link Control and Adaptation Protocol(L2CAP) is used to multiplex multiple logical connections between two devices using different higher level protocols. Provides segmentation and reassembly of on-air packets.

InBasicmode, L2CAP provides packets with a payload configurable up to 64 kB, with 672 bytes as the defaultMTU,and 48 bytes as the minimum mandatory supported MTU.

InRetransmission and Flow Controlmodes, L2CAP can be configured either for isochronous data or reliable data per channel by performing retransmissions and CRC checks.

Bluetooth Core Specification Addendum 1 adds two additional L2CAP modes to the core specification. These modes effectively deprecate original Retransmission and Flow Control modes:

Enhanced Retransmission Mode (ERTM)

This mode is an improved version of the original retransmission mode. This mode provides a reliable L2CAP channel.

Streaming Mode (SM)

This is a very simple mode, with no retransmission or flow control. This mode provides an unreliable L2CAP channel.

Reliability in any of these modes is optionally and/or additionally guaranteed by the lower layer Bluetooth BDR/EDR air interface by configuring the number of retransmissions and flush timeout (time after which the radio flushes packets). In-order sequencing is guaranteed by the lower layer.

Only L2CAP channels configured in ERTM or SM may be operated over AMP logical links.

Service Discovery Protocol

TheService Discovery Protocol(SDP) allows a device to discover services offered by other devices, and their associated parameters. For example, when you use a mobile phone with a Bluetooth headset, the phone uses SDP to determine whichBluetooth profilesthe headset can use (Headset Profile, Hands Free Profile (HFP),Advanced Audio Distribution Profile (A2DP)etc.) and the protocol multiplexer settings needed for the phone to connect to the headset using each of them. Each service is identified by aUniversally unique identifier(UUID), with official services (Bluetooth profiles) assigned a short form UUID (16 bits rather than the full 128).

Radio Frequency Communications

Radio Frequency Communications(RFCOMM) is a cable replacement protocol used for generating a virtual serial data stream. RFCOMM provides for binary data transport and emulatesEIA-232(formerly RS-232) control signals over the Bluetooth baseband layer, i.e., it is a serial port emulation.

RFCOMM provides a simple, reliable, data stream to the user, similar to TCP. It is used directly by many telephony related profiles as a carrier for AT commands, as well as being a transport layer for OBEX over Bluetooth.

Many Bluetooth applications use RFCOMM because of its widespread support and publicly available API on most operating systems. Additionally, applications that used a serial port to communicate can be quickly ported to use RFCOMM.

Bluetooth Network Encapsulation Protocol

TheBluetooth Network Encapsulation Protocol(BNEP) is used for transferring another protocol stack's data via an L2CAP channel. Its main purpose is the transmission of IP packets in the Personal Area Networking Profile. BNEP performs a similar function toSNAPin Wireless LAN.

Audio/Video Control Transport Protocol

TheAudio/Video Control Transport Protocol(AVCTP) is used by the remote control profile to transfer AV/C commands over an L2CAP channel. The music control buttons on a stereo headset use this protocol to control the music player.

Audio/Video Distribution Transport Protocol

TheAudio/Video Distribution Transport Protocol(AVDTP) is used by the advanced audio distribution (A2DP) profile to stream music to stereo headsets over anL2CAPchannel intended for video distribution profile in the Bluetooth transmission.

Telephony Control Protocol

TheTelephony Control Protocol– Binary(TCS BIN) is the bit-oriented protocol that defines the call control signaling for the establishment of voice and data calls between Bluetooth devices. Additionally, "TCS BIN defines mobility management procedures for handling groups of Bluetooth TCS devices."

TCS-BIN is only used by the cordless telephony profile, which failed to attract implementers. As such it is only of historical interest.

Adopted protocols

Adopted protocols are defined by other standards-making organizations and incorporated into Bluetooth's protocol stack, allowing Bluetooth to code protocols only when necessary. The adopted protocols include:

Point-to-Point Protocol(PPP)

Internet standard protocol for transportingIP datagramsover a point-to-point link.

TCP/IP/UDP

Foundation Protocols for TCP/IP protocol suite

Object Exchange Protocol(OBEX)

Session-layer protocol for the exchange of objects, providing a model for object and operation representation

Wireless Application Environment/Wireless Application Protocol(WAE/WAP)

WAE specifies an application framework for wireless devices and WAP is an open standard to provide mobile users access to telephony and information services.

Baseband error correction

Depending on packet type, individual packets may be protected byerror correction,either 1/3 rateforward error correction(FEC) or 2/3 rate. In addition, packets with CRC will be retransmitted until acknowledged byautomatic repeat request(ARQ).

Setting up connections

Any Bluetooth device indiscoverable modetransmits the following information on demand:

• Device name
• Device class
• List of services
• Technical information (for example: device features, manufacturer, Bluetooth specification used, clock offset)

Any device may perform an inquiry to find other devices to connect to, and any device can be configured to respond to such inquiries. However, if the device trying to connect knows the address of the device, it always responds to direct connection requests and transmits the information shown in the list above if requested. Use of a device's services may require pairing or acceptance by its owner, but the connection itself can be initiated by any device and held until it goes out of range. Some devices can be connected to only one device at a time, and connecting to them prevents them from connecting to other devices and appearing in inquiries until they disconnect from the other device.

Every device has aunique 48-bit address.However, these addresses are generally not shown in inquiries. Instead, friendly Bluetooth names are used, which can be set by the user. This name appears when another user scans for devices and in lists of paired devices.

Most cellular phones have the Bluetooth name set to the manufacturer and model of the phone by default. Most cellular phones and laptops show only the Bluetooth names and special programs are required to get additional information about remote devices. This can be confusing as, for example, there could be several cellular phones in range namedT610(seeBluejacking).

Pairing and bonding

Motivation

Many services offered over Bluetooth can expose private data or let a connecting party control the Bluetooth device. Security reasons make it necessary to recognize specific devices, and thus enable control over which devices can connect to a given Bluetooth device. At the same time, it is useful for Bluetooth devices to be able to establish a connection without user intervention (for example, as soon as in range).

To resolve this conflict, Bluetooth uses a process calledbonding,and a bond is generated through a process calledpairing.The pairing process is triggered either by a specific request from a user to generate a bond (for example, the user explicitly requests to "Add a Bluetooth device" ), or it is triggered automatically when connecting to a service where (for the first time) the identity of a device is required for security purposes. These two cases are referred to as dedicated bonding and general bonding respectively.

Pairing often involves some level of user interaction. This user interaction confirms the identity of the devices. When pairing completes, a bond forms between the two devices, enabling those two devices to connect in the future without repeating the pairing process to confirm device identities. When desired, the user can remove the bonding relationship.

Implementation

During pairing, the two devices establish a relationship by creating ashared secretknown as alink key.If both devices store the same link key, they are said to bepairedorbonded.A device that wants to communicate only with a bonded device cancryptographicallyauthenticatethe identity of the other device, ensuring it is the same device it previously paired with. Once a link key is generated, an authenticatedACLlink between the devices may beencryptedto protect exchanged data againsteavesdropping.Users can delete link keys from either device, which removes the bond between the devices—so it is possible for one device to have a stored link key for a device it is no longer paired with.

Bluetooth services generally require either encryption or authentication and as such require pairing before they let a remote device connect. Some services, such as the Object Push Profile, elect not to explicitly require authentication or encryption so that pairing does not interfere with the user experience associated with the service use-cases.

Pairing mechanisms

Pairing mechanisms changed significantly with the introduction of Secure Simple Pairing in Bluetooth v2.1. The following summarizes the pairing mechanisms:

• Legacy pairing:This is the only method available in Bluetooth v2.0 and before. Each device must enter aPIN code;pairing is only successful if both devices enter the same PIN code. Any 16-byte UTF-8 string may be used as a PIN code; however, not all devices may be capable of entering all possible PIN codes.
  • Limited input devices:The obvious example of this class of device is a Bluetooth Hands-free headset, which generally have few inputs. These devices usually have afixed PIN,for example "0000" or "1234", that are hard-coded into the device.
  • Numeric input devices:Mobile phones are classic examples of these devices. They allow a user to enter a numeric value up to 16 digits in length.
  • Alpha-numeric input devices:PCs and smartphones are examples of these devices. They allow a user to enter full UTF-8 text as a PIN code. If pairing with a less capable device the user must be aware of the input limitations on the other device; there is no mechanism available for a capable device to determine how it should limit the available input a user may use.
• Secure Simple Pairing(SSP): This is required by Bluetooth v2.1, although a Bluetooth v2.1 device may only use legacy pairing to interoperate with a v2.0 or earlier device. Secure Simple Pairing uses a form ofpublic-key cryptography,and some types can help protect againstman in the middle,or MITM attacks. SSP has the following authentication mechanisms:
  • Just works:As the name implies, this method just works, with no user interaction. However, a device may prompt the user to confirm the pairing process. This method is typically used by headsets with minimal IO capabilities, and is more secure than the fixed PIN mechanism this limited set of devices uses for legacy pairing. This method provides no man-in-the-middle (MITM) protection.
  • Numeric comparison:If both devices have a display, and at least one can accept a binary yes/no user input, they may use Numeric Comparison. This method displays a 6-digit numeric code on each device. The user should compare the numbers to ensure they are identical. If the comparison succeeds, the user(s) should confirm pairing on the device(s) that can accept an input. This method provides MITM protection, assuming the user confirms on both devices and actually performs the comparison properly.
  • Passkey Entry:This method may be used between a device with a display and a device with numeric keypad entry (such as a keyboard), or two devices with numeric keypad entry. In the first case, the display presents a 6-digit numeric code to the user, who then enters the code on the keypad. In the second case, the user of each device enters the same 6-digit number. Both of these cases provide MITM protection.
  • Out of band(OOB): This method uses an external means of communication, such asnear-field communication(NFC) to exchange some information used in the pairing process. Pairing is completed using the Bluetooth radio, but requires information from the OOB mechanism. This provides only the level of MITM protection that is present in the OOB mechanism.

SSP is considered simple for the following reasons:

• In most cases, it does not require a user to generate a passkey.
• For use cases not requiring MITM protection, user interaction can be eliminated.
• Fornumeric comparison,MITM protection can be achieved with a simple equality comparison by the user.
• Using OOB with NFC enables pairing when devices simply get close, rather than requiring a lengthy discovery process.

Security concerns

Prior to Bluetooth v2.1, encryption is not required and can be turned off at any time. Moreover, the encryption key is only good for approximately 23.5 hours; using a single encryption key longer than this time allows simpleXOR attacksto retrieve the encryption key.

• Turning off encryption is required for several normal operations, so it is problematic to detect if encryption is disabled for a valid reason or a security attack.

Bluetooth v2.1 addresses this in the following ways:

• Encryption is required for all non-SDP (Service Discovery Protocol) connections
• A new Encryption Pause and Resume feature is used for all normal operations that require that encryption be disabled. This enables easy identification of normal operation from security attacks.
• The encryption key must be refreshed before it expires.

Link keys may be stored on the device file system, not on the Bluetooth chip itself. Many Bluetooth chip manufacturers let link keys be stored on the device—however, if the device is removable, this means that the link key moves with the device.

Security

Overview

See also:Mobile security § Attacks based on communication networks

Bluetooth implementsconfidentiality,authenticationandkeyderivation with custom algorithms based on theSAFER+block cipher.Bluetooth key generation is generally based on a Bluetooth PIN, which must be entered into both devices. This procedure might be modified if one of the devices has a fixed PIN (e.g., for headsets or similar devices with a restricted user interface). During pairing, an initialization key or master key is generated, using the E22 algorithm. TheE0stream cipher is used for encrypting packets, granting confidentiality, and is based on a shared cryptographic secret, namely a previously generated link key or master key. Those keys, used for subsequent encryption of data sent via the air interface, rely on the Bluetooth PIN, which has been entered into one or both devices.

An overview of Bluetooth vulnerabilities exploits was published in 2007 by Andreas Becker.

In September 2008, theNational Institute of Standards and Technology(NIST) published a Guide to Bluetooth Security as a reference for organizations. It describes Bluetooth security capabilities and how to secure Bluetooth technologies effectively. While Bluetooth has its benefits, it is susceptible to denial-of-service attacks, eavesdropping, man-in-the-middle attacks, message modification, and resource misappropriation. Users and organizations must evaluate their acceptable level of risk and incorporate security into the lifecycle of Bluetooth devices. To help mitigate risks, included in the NIST document are security checklists with guidelines and recommendations for creating and maintaining secure Bluetooth piconets, headsets, and smart card readers.

Bluetooth v2.1 – finalized in 2007 with consumer devices first appearing in 2009 – makes significant changes to Bluetooth's security, including pairing. See thepairing mechanismssection for more about these changes.

Bluejacking

Main article:Bluejacking

Bluejacking is the sending of either a picture or a message from one user to an unsuspecting user through Bluetooth wireless technology. Common applications include short messages, e.g., "You've just been bluejacked!"Bluejacking does not involve the removal or alteration of any data from the device.

Some form ofDoSis also possible, even in modern devices, by sending unsolicited pairing requests in rapid succession; this becomes disruptive because most systems display a full screen notification for every connection request, interrupting every other activity, especially on less powerful devices.

History of security concerns

2001–2004

In 2001, Jakobsson and Wetzel fromBell Laboratoriesdiscovered flaws in the Bluetooth pairing protocol and also pointed to vulnerabilities in the encryption scheme.In 2003, Ben and Adam Laurie from A.L. Digital Ltd. discovered that serious flaws in some poor implementations of Bluetooth security may lead to disclosure of personal data.In a subsequent experiment, Martin Herfurt from the trifinite.group was able to do a field-trial at theCeBITfairgrounds, showing the importance of the problem to the world. A new attack calledBlueBugwas used for this experiment.In 2004 the first purportedvirususing Bluetooth to spread itself among mobile phones appeared on theSymbian OS. The virus was first described byKaspersky Laband requires users to confirm the installation of unknown software before it can propagate. The virus was written as a proof-of-concept by a group of virus writers known as "29A" and sent to anti-virus groups. Thus, it should be regarded as a potential (but not real) security threat to Bluetooth technology orSymbian OSsince the virus has never spread outside of this system. In August 2004, a world-record-setting experiment (see alsoBluetooth sniping) showed that the range of Class 2 Bluetooth radios could be extended to 1.78 km (1.11 mi) with directional antennas and signal amplifiers. This poses a potential security threat because it enables attackers to access vulnerable Bluetooth devices from a distance beyond expectation. The attacker must also be able to receive information from the victim to set up a connection. No attack can be made against a Bluetooth device unless the attacker knows its Bluetooth address and which channels to transmit on, although these can be deduced within a few minutes if the device is in use.

2005

In January 2005, a mobilemalwareworm known as Lasco surfaced. The worm began targeting mobile phones usingSymbian OS(Series 60 platform) using Bluetooth enabled devices to replicate itself and spread to other devices. The worm is self-installing and begins once the mobile user approves the transfer of the file (Velasco.sis) from another device. Once installed, the worm begins looking for other Bluetooth enabled devices to infect. Additionally, the worm infects other.SISfiles on the device, allowing replication to another device through the use of removable media (Secure Digital,CompactFlash,etc.). The worm can render the mobile device unstable.

In April 2005,University of Cambridgesecurity researchers published results of their actual implementation of passive attacks against thePIN-basedpairing between commercial Bluetooth devices. They confirmed that attacks are practicably fast, and the Bluetooth symmetric key establishment method is vulnerable. To rectify this vulnerability, they designed an implementation that showed that stronger, asymmetric key establishment is feasible for certain classes of devices, such as mobile phones.

In June 2005, Yaniv Shakedand Avishai Woolpublished a paper describing both passive and active methods for obtaining the PIN for a Bluetooth link. The passive attack allows a suitably equipped attacker to eavesdrop on communications and spoof if the attacker was present at the time of initial pairing. The active method makes use of a specially constructed message that must be inserted at a specific point in the protocol, to make the master and slave repeat the pairing process. After that, the first method can be used to crack the PIN. This attack's major weakness is that it requires the user of the devices under attack to re-enter the PIN during the attack when the device prompts them to. Also, this active attack probably requires custom hardware, since most commercially available Bluetooth devices are not capable of the timing necessary.

In August 2005, police inCambridgeshire,England, issued warnings about thieves using Bluetooth enabled phones to track other devices left in cars. Police are advising users to ensure that any mobile networking connections are de-activated if laptops and other devices are left in this way.

2006

In April 2006, researchers fromSecure NetworkandF-Securepublished a report that warns of the large number of devices left in a visible state, and issued statistics on the spread of various Bluetooth services and the ease of spread of an eventual Bluetooth worm.

In October 2006, at the Luxembourgish Hack.lu Security Conference, Kevin Finistere and Thierry Zoller demonstrated and released a remote root shell via Bluetooth on Mac OS X v10.3.9 and v10.4. They also demonstrated the first Bluetooth PIN and Linkkeys cracker, which is based on the research of Wool and Shaked.

2017

In April 2017, security researchers at Armis discovered multiple exploits in the Bluetooth software in various platforms, includingMicrosoft Windows,Linux,AppleiOS,and GoogleAndroid.These vulnerabilities are collectively called "BlueBorne".The exploits allow an attacker to connect to devices or systems without authentication and can give them" virtually full control over the device ". Armis contacted Google, Microsoft, Apple, Samsung and Linux developers allowing them to patch their software before the coordinated announcement of the vulnerabilities on 12 September 2017.

2018

In July 2018, Lior Neumann andEli Biham,researchers at the Technion – Israel Institute of Technology identified a security vulnerability in the latest Bluetooth pairing procedures: Secure Simple Pairing and LE Secure Connections.

Also, in October 2018, Karim Lounis, a network security researcher at Queen's University, identified a security vulnerability, called CDV (Connection Dumping Vulnerability), on various Bluetooth devices that allows an attacker to tear down an existing Bluetooth connection and cause the deauthentication and disconnection of the involved devices. The researcher demonstrated the attack on various devices of different categories and from different manufacturers.

2019

In August 2019, security researchers at theSingapore University of Technology and Design,Helmholtz Center for Information Security, andUniversity of Oxforddiscovered a vulnerability, called KNOB (Key Negotiation of Bluetooth) in the key negotiation that would "brute force the negotiated encryption keys, decrypt the eavesdropped ciphertext, and inject valid encrypted messages (in real-time)". Google released anAndroidsecurity patch on 5 August 2019, which removed this vulnerability.

2023

In November 2023, researchers fromEurecomrevealed a new class of attacks known as BLUFFS (Bluetooth Low Energy Forward and Future Secrecy Attacks). These 6 new attacks expand on and work in conjunction with the previously known KNOB and BIAS (Bluetooth Impersonation AttackS) attacks. While the previous KNOB and BIAS attacks allowed an attacker to decrypt and spoof Bluetooth packets within a session, BLUFFS extends this capability to all sessions generated by a device (including past, present, and future). All devices running Bluetooth versions 4.2 up to and including 5.4 are affected.

Health concerns

Main article:Wireless device radiation and health

Bluetooth uses theradio frequencyspectrum in the 2.402GHz to 2.480GHz range,which isnon-ionizing radiation,of similar bandwidth to that used by wireless and mobile phones. No specific harm has been demonstrated, even though wireless transmission has been included byIARCin the possiblecarcinogenlist. Maximum power output from a Bluetooth radio is 100mWfor Class1, 2.5mW for Class2, and 1mW for Class3 devices. Even the maximum power output of Class1 is a lower level than the lowest-powered mobile phones.UMTSandW-CDMAoutput 250mW,GSM1800/1900outputs 1000mW, andGSM850/900outputs 2000mW.

Award programs

The Bluetooth Innovation World Cup, a marketing initiative of the Bluetooth Special Interest Group (SIG), was an international competition that encouraged the development of innovations for applications leveraging Bluetooth technology in sports, fitness and health care products. The competition aimed to stimulate new markets.

The Bluetooth Innovation World Cup morphed into the Bluetooth Breakthrough Awards in 2013. Bluetooth SIG subsequently launched the Imagine Blue Award in 2016 at Bluetooth World.The Bluetooth Breakthrough Awards program highlights the most innovative products and applications available today, prototypes coming soon, and student-led projects in the making.

See also

• ANT+
• Bluetooth stack– building blocks that make up the various implementations of the Bluetooth protocol
• List of Bluetooth profiles– features used within the Bluetooth stack
• Bluesniping
• BlueSoleil– proprietary Bluetooth driver
• Bluetooth Low Energy beacons(AltBeacon,iBeacon,Eddystone)
• Bluetooth mesh networking
• Continua Health Alliance
• DASH7
• Audio headset
• Wi-Fi hotspot
• Java APIs for Bluetooth
• Key finder
• Li-Fi
• List of Bluetooth protocols
• MyriaNed
• Near-field communication
• NearLink
• RuBee– secure wireless protocol alternative
• Tethering
• Thread (network protocol)
• Wi-Fi HaLow
• Zigbee– low-power lightweight wireless protocol in theISM bandbased onIEEE 802.15.4

External links

• Official website
• SpecificationsatBluetooth SIG