Transmission of IPv6 Packets over BLUETOOTH(R) Low Energy

Bluetooth low energy (LE) is a radio technology targeted for devices that operate with coin cell batteries or minimalistic power sources, which means that low power consumption is essential. Bluetooth LE is an especially attractive technology for Internet of Things applications, such as health monitors, environmental sensing, proximity applications and many others. Considering the potential for the exponential growth in the number of sensors and Internet connected devices and things, IPv6 is an ideal protocol due to the large address space it provides. In addition, IPv6 provides tools for stateless address autoconfiguration, which is particularly suitable for sensor network applications and nodes which have very limited processing power or lack a full-fledged operating system. RFC 4944 specifies the transmission of IPv6 over IEEE 802.15.4. The Bluetooth LE link in many respects has similar characteristics to that of IEEE 802.15.4. Many of the mechanisms defined in the RFC 4944 can be applied to the transmission of IPv6 on Bluetooth LE links. This document specifies the details of IPv6 transmission over Bluetooth LE links.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. The terms 6LN, 6LR and 6LBR are defined as in , with an addition that Bluetooth LE central and Bluetooth LE peripheral (see ) can both be either 6LN or 6LBR.

Bluetooth LE is designed for transferring small amounts of data infrequently at modest data rates at a very low cost per bit. Bluetooth Special Interest Group (Bluetooth SIG) has introduced two trademarks, Bluetooth Smart for single-mode devices (a device that only supports Bluetooth LE) and Bluetooth Smart Ready for dual-mode devices (devices that support both Bluetooth and Bluetooth LE). In the rest of the document, the term Bluetooth LE refers to both types of devices. Bluetooth LE was introduced in Bluetooth 4.0 and further enhanced in Bluetooth 4.1 . Bluetooth SIG has also published Internet Protocol Support Profile (IPSP) , which includes Internet Protocol Support Service (IPSS). The IPSP enables discovery of IP-enabled devices and establishment of link-layer connection for transporting IPv6 packets. IPv6 over Bluetooth LE is dependent on both Bluetooth 4.1 and IPSP 1.0 or newer. Devices such as mobile phones, notebooks, tablets and other handheld computing devices which will include Bluetooth 4.1 chipsets will also have the low-energy functionality of Bluetooth. Bluetooth LE will also be included in many different types of accessories that collaborate with mobile devices such as phones, tablets and notebook computers. An example of a use case for a Bluetooth LE accessory is a heart rate monitor that sends data via the mobile phone to a server on the Internet.

The lower layer of the Bluetooth LE stack consists of the Physical (PHY) and the Link Layer (LL). The Physical Layer transmits and receives the actual packets. The Link Layer is responsible for providing medium access, connection establishment, error control and flow control. The upper layer consists of the Logical Link Control and Adaptation Protocol (L2CAP), Attribute Protocol (ATT), Generic Attribute Profile (GATT) and Generic Access Profile (GAP) as shown in . The device internal Host Controller Interface (HCI) separates the lower layers, often implemented in the Bluetooth controller, from higher layers, often implemented in the host stack. GATT and Bluetooth LE profiles together enable the creation of applications in a standardized way without using IP. L2CAP provides multiplexing capability by multiplexing the data channels from the above layers. L2CAP also provides fragmentation and reassembly for large data packets.

Bluetooth LE defines two GAP roles of relevance herein: the Bluetooth LE central role and the Bluetooth LE peripheral role. A device in the central role, which is called central from now on, has traditionally been able to manage multiple simultaneous connections with a number of devices in the peripheral role, called peripherals from now on. A peripheral is commonly connected to a single central, but since Bluetooth 4.1 can also connect to multiple centrals. In this document for IPv6 networking purposes the Bluetooth LE network (i.e. a Bluetooth LE piconet) follows a star topology shown in the , where the router typically implements the Bluetooth LE central role and nodes implement the Bluetooth LE peripheral role. In the future mesh networking may be defined for IPv6 over Bluetooth LE.

In Bluetooth LE a central is assumed to be less constrained than a peripheral. Hence, in the primary deployment scenario central and peripheral will act as 6LoWPAN Border Router (6LBR) and a 6LoWPAN Node (6LN), respectively. In Bluetooth LE, direct communication only takes place between a central and a peripheral. Hence, in a Bluetooth LE network using IPv6, a radio hop is equivalent to an IPv6 link and vice versa.

Every Bluetooth LE device is identified by a 48-bit device address. The Bluetooth specification describes the device address of a Bluetooth LE device as:"Devices are identified using a device address. Device addresses may be either a public device address or a random device address." . The public device addresses are based on the IEEE 802-2001 standard . The random device addresses are generated as defined in the Bluetooth specification. These random device addresses have a very small chance of being in conflict, as Bluetooth LE does not support random device address collision avoidance or detection.

Optimal MTU defined for L2CAP fixed channels over Bluetooth LE is 27 bytes including the L2CAP header of four bytes. Default MTU for Bluetooth LE is hence defined to be 27 bytes. Therefore, excluding L2CAP header of four bytes, protocol data unit (PDU) size of 23 bytes is available for upper layers. In order to be able to transmit IPv6 packets of 1280 bytes or larger, link layer fragmentation and reassembly solution is provided by the L2CAP layer. The IPSP defines means for negotiating up a link-layer connection that provides MTU of 1280 bytes or higher for the IPv6 layer . The link-layer MTU is negotiated separately for each direction. Implementations that require single link-layer MTU value SHALL use the smallest of the possibly different MTU values.

Before any IP-layer communications can take place over Bluetooth LE, Bluetooth LE enabled nodes such as 6LNs and 6LBRs have to find each other and establish a suitable link-layer connection. The discovery and Bluetooth LE connection setup procedures are documented by Bluetooth SIG in the IPSP specification . In the rare case of Bluetooth LE random device address conflict, the 6LBR can detect multiple 6LNs with the same Bluetooth LE device address. The 6LBR MUST have at most one connection for a given Bluetooth LE device address at any given moment. This will avoid addressing conflicts within a Bluetooth LE network. The IPSP depends on Bluetooth version 4.1, and hence both Bluetooth version 4.1, or newer, and IPSP version 1.0, or newer, are required for IPv6 communications. Bluetooth LE technology sets strict requirements for low power consumption and thus limits the allowed protocol overhead. 6LoWPAN standards , and provide useful functionality for reducing overhead which can be applied to Bluetooth LE. This functionality comprises of link-local IPv6 addresses and stateless IPv6 address autoconfiguration (see ), Neighbor Discovery (see ) and header compression (see ). A significant difference between IEEE 802.15.4 and Bluetooth LE is that the former supports both star and mesh topology (and requires a routing protocol), whereas Bluetooth LE does not currently support the formation of multihop networks at the link layer.

illustrates IPv6 over Bluetooth LE stack including the Internet Protocol Support Service. UDP and TCP are provided as examples of transport protocols, but the stack can be used by any other upper layer protocol capable of running atop of IPv6. The 6LoWPAN layer runs on top of Bluetooth LE L2CAP layer.

The concept of IPv6 link (layer 3) and the physical link (combination of PHY and MAC) needs to be clear and the relationship has to be well understood in order to specify the addressing scheme for transmitting IPv6 packets over the Bluetooth LE link. RFC 4861 defines a link as "a communication facility or medium over which nodes can communicate at the link layer, i.e., the layer immediately below IPv6." In the case of Bluetooth LE, 6LoWPAN layer is adapted to support transmission of IPv6 packets over Bluetooth LE. The IPSP defines all steps required for setting up the Bluetooth LE connection over which 6LoWPAN can function , including handling the link-layer fragmentation required on Bluetooth LE, as described in . While Bluetooth LE protocols, such as L2CAP, utilize little-endian byte orderering, IPv6 packets MUST be transmitted in big endian order (network byte order). This specification requires IPv6 header compression format specified in RFC 6282 to be used . It is assumed that the IPv6 payload length can be inferred from the L2CAP header length and the IID value inferred from the link-layer address with help of Neighbor Cache, if elided from compressed packet header. Bluetooth LE connections used to build a star topology are point-to-point in nature, as Bluetooth broadcast features are not used for IPv6 over Bluetooth LE. 6LN-to-6LN communications, e.g. using link-local addresses, need to be bridged by the 6LBR. The 6LBR ensures address collisions do not occur (see ). After the peripheral and central have connected at the Bluetooth LE level, the link can be considered up and IPv6 address configuration and transmission can begin.

At network interface initialization, both 6LN and 6LBR SHALL generate and assign to the Bluetooth LE network interface IPv6 link-local addresses based on the 48-bit Bluetooth device addresses (see ) that were used for establishing underlying Bluetooth LE connection. A 64-bit Interface Identifier (IID) is formed from 48-bit Bluetooth device address by inserting two octets, with hexadecimal values of 0xFF and 0xFE in the middle of the 48-bit Bluetooth device address as shown in . In the Figure letter 'b' represents a bit from Bluetooth device address.

The IID is then appended with prefix fe80::/64, as described in RFC 4291 and as depicted in . The same link-local address SHALL be used for the lifetime of the Bluetooth LE L2CAP channel. (After Bluetooth LE logical link has been established, it is referenced with a Connection Handle in HCI. Thus possibly changing device addresses do not impact data flows within existing L2CAP channel. Hence there is no need to change IPv6 link-local addresses even if devices change their random device addresses during L2CAP channel lifetime).

A 6LN MUST join the all-nodes multicast address. There is no need for 6LN to join the solicited-node multicast address, since 6LBR will know device addresses and hence link-local addresses of all connected 6LNs. The 6LBR will ensure no two devices with the same Bluetooth LE device address are connected at the same time. Effectively duplicate address detection for link-local addresses is performed by the 6LBR's software responsible of discovery of IP-enabled Bluetooth LE nodes and of starting Bluetooth LE connection establishment procedures. This approach increases complexity of 6LBR, but reduces power consumption on both 6LN and 6LBR at link establishment phase by reducing number of mandatory packet transmissions. After link-local address configuration, 6LN sends Router Solicitation messages as described in [RFC4861] Section 6.3.7. For non-link-local addresses a 64-bit IID MAY be formed by utilizing the 48-bit Bluetooth device address. Alternatively, a randomly generated IID (see ) can be used instead, for example, as discussed in . The non-link-local addresses 6LN generates must be registered with 6LBR as described in . Only if the Bluetooth device address is known to be a public address the "Universal/Local" bit can be set to 1 . The tool for a 6LBR to obtain an IPv6 prefix for numbering the Bluetooth LE network is out of scope of this document, but can be, for example, accomplished via DHCPv6 Prefix Delegation or by using Unique Local IPv6 Unicast Addresses (ULA) . Due to the link model of the Bluetooth LE (see ) the 6LBR MUST set the "on-link" flag (L) to zero in the Prefix Information Option . This will cause 6LNs to always send packets to the 6LBR, including the case when the destination is another 6LN using the same prefix.

'Neighbor Discovery Optimization for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs)' describes the neighbor discovery approach as adapted for use in several 6LoWPAN topologies, including the mesh topology. Bluetooth LE does not support mesh networks and hence only those aspects that apply to a star topology are considered. The following aspects of the Neighbor Discovery optimizations are applicable to Bluetooth LE 6LNs: 1. A Bluetooth LE 6LN SHOULD NOT register its IID for link-local address. A Bluetooth LE 6LN MUST register its IIDs for non-link-local addresses with the 6LBR by sending a Neighbor Solicitation (NS) message with the Address Registration Option (ARO) and process the Neighbor Advertisement (NA) accordingly. The NS with the ARO option MUST be sent irrespective of the method used to generate the IID. If the 6LN registers multiple IIDs per IPv6 prefix available on a link, the 6LBR will not be able to fully elide IID on downlink packets (6LBR has to send IID bits inline). 2. For sending Router Solicitations and processing Router Advertisements the Bluetooth LE 6LNs MUST, respectively, follow Sections 5.3 and 5.4 of the .

Header compression as defined in RFC 6282 , which specifies the compression format for IPv6 datagrams on top of IEEE 802.15.4, is REQUIRED in this document as the basis for IPv6 header compression on top of Bluetooth LE. All headers MUST be compressed according to RFC 6282 encoding formats. The Bluetooth LE's star topology structure and ARO can be exploited in order to provide a mechanism for IID compression. The following text describes the principles of IPv6 address compression on top of Bluetooth LE. The ARO option requires use of EUI-64 identifier . In the case of Bluetooth LE, the field SHALL be filled with the 48-bit device address used by the Bluetooth LE node converted into 64-bit Modified EUI-64 format . To enable efficient header compression, the 6LBR MUST include 6LoWPAN Context Option (6CO) for all prefixes the 6LBR advertises in Router Advertisements for use in stateless address autoconfiguration. When a 6LN is sending a packet to or through a 6LBR, it MUST fully elide the source address if it is a link-local address or a non-link-local address 6LN has registered with ARO to the 6LBR for the indicated prefix. That is, if SAC=0 and SAM=11 the 6LN MUST be using the link-local IPv6 address derived from Bluetooth LE device address, and if SAC=1 and SAM=11 the 6LN MUST have registered the source IPv6 address with the prefix related to compression context identified with Context Identifier Extension. The destination IPv6 address MUST be fully elided if the destination address is the same address to which the 6LN has succesfully registered its source IPv6 address with ARO (set DAC=0, DAM=11). The destination IPv6 address MUST be fully or partially elided if context has been set up for the destination address. For example, DAC=0 and DAM=01 when destination prefix is link-local, and DAC=1 and DAM=01 with Context Identifier Extension if compression context has been configured for the used destination prefix. When a 6LBR is transmitting packets to 6LN, it MUST fully elide the source IID if the source IPv6 address is the one 6LN has used to register its address with ARO (set SAC=0, SAM=11), and it MUST elide the source prefix or address if a compression context related to the IPv6 source address has been set up. The 6LBR also MUST elide the destination IPv6 address registered by the 6LN with ARO and thus 6LN can determine it based on indication of link-local prefix (DAC=0) or indication of other prefix (DAC=1 with Context Identifier Extension).

When a 6LN transmits an IPv6 packet to a remote destination using global Unicast IPv6 addresses, if a context is defined for the 6LN's global IPv6 address, the 6LN has to indicate this context in the corresponding source fields of the compressed IPv6 header as per Section 3.1 of RFC 6282 , and has to elide the full IPv6 source address previously registered with ARO. For this, the 6LN MUST use the following settings in the IPv6 compressed header: CID=1, SAC=1, SAM=11. In this case, the 6LBR can infer the elided IPv6 source address since 1) the 6LBR has previously assigned the prefix to the 6LNs; and 2) the 6LBR maintains a Neighbor Cache that relates the Device Address and the IID the device has registered with ARO. If a context is defined for the IPv6 destination address, the 6LN has to also indicate this context in the corresponding destination fields of the compressed IPv6 header, and elide the prefix of or the full destination IPv6 address. For this, the 6LN MUST set the DAM field of the compressed IPv6 header as DAM=01 (if the context covers a 64-bit prefix) or as DAM=11 (if the context covers a full, 128-bit address). CID and DAC MUST be set to CID=1 and DAC=1. Note that when a context is defined for the IPv6 destination address, the 6LBR can infer the elided destination prefix by using the context. When a 6LBR receives an IPv6 packet sent by a remote node outside the Bluetooth LE network, and the destination of the packet is a 6LN, if a context is defined for the prefix of the 6LN's global IPv6 address, the 6LBR has to indicate this context in the corresponding destination fields of the compressed IPv6 header. The 6LBR has to elide the IPv6 destination address of the packet before forwarding it, if the IPv6 destination address is inferable by the 6LN. For this, the 6LBR will set the DAM field of the IPv6 compressed header as DAM=11. CID and DAC needs to be set to CID=1 and DAC=1. If a context is defined for the IPv6 source address, the 6LBR needs to indicate this context in the source fields of the compressed IPv6 header, and elide that prefix as well. For this, the 6LBR needs to set the SAM field of the IPv6 compressed header as SAM=01 (if the context covers a 64-bit prefix) or SAM=11 (if the context covers a full, 128-bit address). CID and SAC are to be set to CID=1 and SAC=1.

The Bluetooth LE link layer does not support multicast. Hence traffic is always unicast between two Bluetooth LE nodes. Even in the case where a 6LBR is attached to multiple 6LNs, the 6LBR cannot do a multicast to all the connected 6LNs. If the 6LBR needs to send a multicast packet to all its 6LNs, it has to replicate the packet and unicast it on each link. However, this may not be energy-efficient and particular care must be taken if the master is battery-powered. In the opposite direction, a 6LN always has to send packets to or through 6LBR. Hence, when a 6LN needs to transmit an IPv6 multicast packet, the 6LN will unicast the corresponding Bluetooth LE packet to the 6LBR. The 6LBR will then forward the multicast packet to other 6LNs. To avoid excess of unwanted multicast traffic being sent to 6LNs, the 6LBR SHOULD implement MLD Snooping feature .

In a typical scenario, the Bluetooth LE network is connected to the Internet as shown in the .

]]> In some scenarios, the Bluetooth LE network may transiently or permanently be an isolated network as shown in the .

]]> It is also possible to have point-to-point connection between two 6LNs, one of which being central and another being peripheral. Similarly, it is possible to have point-to-point connections between two 6LBRs, one of which being central and another being peripheral. At this point in time mesh networking with Bluetooth LE is not specified.

There are no IANA considerations related to this document.

The transmission of IPv6 over Bluetooth LE links has similar requirements and concerns for security as for IEEE 802.15.4. Bluetooth LE Link Layer security considerations are covered by the IPSP . Bluetooth LE Link Layer supports encryption and authentication by using the Counter with CBC-MAC (CCM) mechanism and a 128-bit AES block cipher. Upper layer security mechanisms may exploit this functionality when it is available. (Note: CCM does not consume bytes from the maximum per-packet L2CAP data size, since the link layer data unit has a specific field for them when they are used.) Key management in Bluetooth LE is provided by the Security Manager Protocol (SMP), as defined in [BTCorev4.1]. The IPv6 link-local address configuration described in strictly binds the privacy level of IPv6 link-local address to the privacy level device has selected for the Bluetooth LE. This means that a device using Bluetooth privacy features will retain the same level of privacy with generated IPv6 link-local addresses. Respectively, device not using privacy at Bluetooth level will not have privacy at IPv6 link-local address either. For non-link local addresses implementations have a choice to support .

Kanji Kerai, Jari Mutikainen, David Canfeng-Chen and Minjun Xi from Nokia have contributed significantly to this document.

The Bluetooth, Bluetooth Smart and Bluetooth Smart Ready marks are registred trademarks owned by Bluetooth SIG, Inc. Samita Chakrabarti, Erik Nordmark, Marcel De Kogel, Dave Thaler, and Brian Haberman have provided valuable feedback for this draft. Authors would like to give special acknowledgements for Krishna Shingala, Frank Berntsen, and Bluetooth SIG's Internet Working Group for providing significant feedback and improvement proposals for this document.