Protocol Basics: introduction

Bottom-up

BLE in the device can be seen as 3 components:

• Application: Logic, UI, Data Handling
• Host: "Bluetooth things" (GAP, GATT, L2CAP, ATT, SM, HCI)
• Controller: HCI, LL, PHY

A BLE device can be

• a master, initializer
• a slave, advertise ability and accept connection
• or both

Connections

This layer is a PHYsical layer.

• It menages analog communication circuitry
• It transforms analog signal to digital one

Radio

The frequency used is the 2.4GHz, divided into 40 channels from 2.4000 GHz to 2.4835 GHz.

37 Channels are used for data, 3 for advertising.

Frequency hopping spread spectrum is used to minimize interference

(channel = (curr_channel + hop) mod 37)
						

Link Layer

• Advertiser (not active connection)
• Scanner (not active connection)
• Master (active connection)
• Slave (active connection)

It provides a reliable data link using a 24-bit CRC and retrasmits packets if errors are detected.

BLE DEVICE ADDRESS
Is a 48 bit number that uniquely identify a device.

There are two types of device addresses:

• Public device address (fixed, BR/EDR-style)
• Random device address (programmed or dinamically generated)
  • Static Address (static but not registered to IEEE)
  • Non-resolvable private address
  • Resolvable private address

Advertising & Scanning

BLE has only one packet format and two types of packets: advertising and data packets.

Each advertising packet can carry up 31 bytes of payload. They are sent at fixed rate, defined by advertising interval.

Scanning can be passive or active. The difference is on the replay that scanner emit after receiving a advertising packet.

Advertising packet types can be:

• Connectable / non-connectable
• Scannable / non-scannable
• Direct / Undirect

Connections

• Connection interval (from 7.5ms up to 4s)
• Slave latency
• Connection supervision timeout

Host Controller Interface

Logical Link Control and Adaptation Protocol

• implements a protocol multiplexer that permits to communicate from the upper layers and encapsulates the packets into standard BLE packet format
• performs fragmentation and recombination, breaks packet up into chunks that fit into 27-byte maximum payload

It has two main protocol:

• ATT (Attribute protocol)
• SMP (Security Manager protocol)

Attribute protocol

• Error handling
• Server Configuration
• Find Information
• Read Operation
  • Read by type Request/Response (UUID)
  • Read Request/Response (handle)
• Write operation
  • Write a value and get response
  • Write command
  • Signed Write Command
• Queued Write (multiple packet write)
• Server initialization

Security Manager

It is used to

• Exchange keys
• Encrypt connection
• Hide a public BLE

It defines two roles

• Initiator (master)
• Responder (slave)

• Pairing (temporary keys)
• Bonding (permanent keys)
• Encryption re-establishment

Pairing Algorithm

• Negotiate a Short Term Key (STK) generation method:
  • Just Works!
  • Passkey Display
  • Out of band (OOB)
• The connection can use various machanism
  • Encryption (full encryption)
  • Privacy (use a temporary address recognized only by bounded device)
  • Signing (enencrypted but signed packet)

Generic Attribute Profile

The smallest data entity are the attributes. Attribute is an abstract concept for storing data.
Each attribute has some metadata that specific which ATT operation can be executed with some permissions.

Each attribute has an handle associated with it, used to identify the attribute on a particular GATT server.

The maximum length of data is 512 bytes, by the specification. No restriction exists on data types.

Real World Screenshot