Brush Up On Bluetooth update from June 2004

Ready to sink your teeth into Bluetooth? The wireless personal area networking (PAN) technology is now widely available in cell phones, PDAs, access points, telephone headsets, mice, keyboards, printers and even digital pens.

Bluetooth adoption thus far has been slow, but that may soon change. Microsoft's Windows XP Service Pack 2, which ships later this year, will include support for Bluetooth, and Bluetooth is available on a selected distribution basis in Windows XP SP1. In addition, one-third of new U.S. mobile phones this year will come with Bluetooth capabilities, according to Allied Business Intelligence, a market forecaster.

Until recently, one of the main strikes against Bluetooth was that it was difficult to use, particularly if you were trying to get several Bluetooth devices to work together. But now you can configure these devices in less than five minutes, thanks to better configuration wizards and Windows XP's Bluetooth support.

Bluetooth connections are automatic and almost instantaneous--faster than pulling and connecting a cable. With a typical range of about 10 meters, Bluetooth can eliminate cables between personal devices. You can connect your notebook computer or PDA, for example, to your cell phone and use it as a modem.

Why not use Wi-Fi/802.11 wireless technology instead? Bluetooth is actually intended for cable replacement, though it can be configured to emulate a LAN. Unlike Wi-Fi, Bluetooth includes service discovery and usage profiles. These let devices automatically make the right service--such as a printer offering a printing service to a phone--available once connected. Plus, Bluetooth operates at lower power levels than 802.11, with many devices transmitting at just 1 or 10 milliwatts, and is aimed at ad hoc connectivity. The Bluetooth specification is controlled by the Bluetooth Special Interest Group and is a standard, IEEE 802.15.1.

How It Works

Bluetooth connections are based on piconets. A piconet includes a master device and up to seven slave devices. An additional 254 devices can be in a parked state waiting to join the piconet. The user's device initiating the communications is the master. It controls the clock for synchronization and the frequency-hopping sequence. Bluetooth uses spread-spectrum radio in the 2.4-GHz band (as do 802.11b and 802.11g) based on frequency hopping.

Distinguishing and isolating one piconet (my notebook-to-cell phone connection, for example) from another (say, your cell phone-to-headset connection) is the frequency-hopping sequence. The master polls the slaves for information, and manages resources by assigning communications time slots in a time-division structure. Connection speeds can be as high as 721 Kbps in one direction and 57.6 Kbps the other way in an asymmetrical configuration, or 432.6 Kbps in each direction in a symmetrical configuration. A piconet also can support three full-duplex voice channels at 64 Kbps. These speeds are fine for modem connections, voice communications, synchronizing PDAs, and retrieving low- and medium-resolution digital images, but not fast enough for peripherals, such as digital video cameras.

Another challenge with Bluetooth is that two devices can communicate with each other only if they support the same Bluetooth profile. A profile is a set of capabilities that use the Bluetooth protocol layers (see diagram, "Key Bluetooth Protocols," page 86), and provide a well-defined service--SPP (serial port profile), dial-up networking, headset, hands-free, LAN access, fax profile, file transfer and synchronization. So if your cell phone supports only the hands-free profile and your headset supports only the headset profile, the two devices won't work together with Bluetooth.

The SPP profile emulates an RS-232 serial-port connection, including control wires, so that any application that uses a serial cable can use Bluetooth instead. The latest version of the Bluetooth spec is 1.2, which was completed last November. It supports adaptive frequency hopping to alleviate interference and offers faster connection times, better voice quality and extended support for scatternets (when a device participates in two piconets). The new version is also backward-compatible with version 1.1.

Bluetooth is easy to use if you configure it correctly. But if you don't, it can be maddeningly difficult. "How to Use Bluetooth," at right, lists the tasks required for setup.

Don't forget to read the vendor's instructions. Many Bluetooth products come with management utilities and wizards that walk you through these steps. Depending on the task, there may even be third-party wizards that handle the entire configuration. For example, AT&T Wireless' Communication Manager utility configures laptops for sending and receiving packet data over Bluetooth using Bluetooth-based AT&T Wireless phones. And Bluetooth support in Windows XP will help your configuration with a user interface that's consistent across vendor products.

Any technically capable user can handle the configuration, but it may frustrate nontechnical ones. If you support users with specific Bluetooth devices, preconfigure their devices for them, provide precise instructions or recommend simple installation wizards you've checked out.

Once Bluetooth is configured, establishing a connection typically is automatic. Most devices can require that a connection request be confirmed on the target device; you can disable this, though the trade-off is less security.

Bluetooth has gotten a bad rap lately because of attacks like "Bluesnarfing," which let data be stolen from Bluetooth devices. Actually, Bluetooth's authentication and encryption are quite good. But they depend on correct configuration and a solid usage policy. As with Wi-Fi, default configurations aren't necessarily secure.

Here are some Bluetooth security tips:

1. Implement a Bluetooth security policy.

2. Don't use Bluetooth for sensitive communications. Even with proper configuration, a sophisticated and determined attacker can apply brute force to eavesdrop or gain access to your devices.

3. Pair your devices in a physically secure location. If an attacker eavesdrops on the pairing process, he or she can obtain sufficient information to attack your devices.

4. Use strong PINs. Part of the pairing process involves supplying an ID number. This PIN, along with other values, is used to derive the encryption key. A strong PIN should be alphanumeric, at least eight characters and not easy to guess.

5. Once your devices are paired, make them invisible (nondiscoverable). This makes it much more difficult for anybody to pair with your devices.

6. Require connection confirmations, which makes Bluetooth connections less automatic but more secure.

7. Turn off Bluetooth when you're not using it.

8. Delete pairing for any devices that are lost or stolen. With a stolen device, an attacker can gain access to your other Bluetooth devices with which the stolen device has a pairing relationship.

We tested some new Bluetooth devices, representative of a typical Bluetooth implementation. Nokia sent us a 6230 cell phone (Bluetooth- and EDGE-capable at three time slots), a Bluetooth headset (HDW-2) and a digital pen (SU-1B). On our Windows XP notebook computer, we used a Bluetooth PC Card from Anycom (CC3011). We also used an iPAQ (3970) with integrated Bluetooth.

In all cases, we paired devices and established connections in several minutes. The Bluetooth connection between the notebook computer and Nokia 6230 phone was the most useful--using the phone as a modem is convenient. The Anycom configuration wizard automatically created a dial-up networking icon. (With PAN profile support in Windows XP SP2, you could do this via an NDIS interface.) Clicking on the icon produces an IP data session in about eight seconds, which includes both the Bluetooth connection (about three seconds) and the EDGE (Enhanced Data Rates for GSM Evolution) connection (about five seconds) over AT&T Wireless' EDGE network. Throughput rates based on an FTP test were a respectable 90 Kbps or greater. The throughput was based not on Bluetooth, but on EDGE capabilities: Bluetooth could support connections to phones for next-generation networks such as 1xEV-DO and UMTS at speeds of up to 500 Kbps.

We also found Bluetooth useful for transferring photos and video clips from the phone to the computer. But we could not use the Bluetooth connection to synchronize between Microsoft Outlook and the phone's organizer, probably because of the older Bluetooth card and wizard software in our notebook.

The Bluetooth headset eliminated the cumbersome wire that comes with normal cell phone headsets, though it did give us one more device to keep charged. With the digital pen, we took notes, transferred them to the cell phone over Bluetooth and then sent them as multimedia messages. In addition, we ActiveSync'd over Bluetooth to our PDA, and even browsed the Web and downloaded e-mail on our PDA, which can use the ActiveSync session for IP communications and the notebook computer for an Internet gateway. This let us stay connected even while we were upstairs from the notebook host, as long as we were directly above the host downstairs. Finally, we used the phone as a modem for the PDA to browse the Web, exchange e-mail and communicate by instant messaging.

Out of the Blue

Bluetooth is a capable, well-designed wireless technology, but it doesn't address high-bandwidth PAN needs, such as transferring high-resolution video images, music files and video data, nor synchronizing large personal databases. That's where the new ultrawideband radio technology threatens Bluetooth. Unlike conventional radio modulation, UWB uses short radio pulses that provide low, constant power over a wide frequency range. But while UWB could replace Bluetooth, Bluetooth should become well-entrenched over the next several years and complement emerging technologies like UWB.

Peter Rysavy is president of Rysavy Research (www.rysavy.com), a consulting firm specializing in wireless networking.

How To Use Bluetooth

1. Make sure Bluetooth is on. For some devices, such as cell phones, Bluetooth is off by default; for other devices, such as headsets, it is on by default.

2. Make your device visible (discoverable). Bluetooth devices search for each other through a frequency-scanning process.

3. Establish a trust relationship between two devices by pairing, or bonding, them.

Pairing is achieved by entering an ID number on the initiating device, then re-entering it on the target device to prove that the same user "owns" both. For some devices, like headsets, where you can't enter a number, this temporary ID number is preset and documented on a card that comes with the product. Once a set of devices is paired, you don't have to repeat the process, though you can break the bond later if you wish.

4. Configure the appropriate service profile. Pairing simply indicates which devices can communicate with each other. The final step is to designate the appropriate profile; in most cases, this is automatic.