RFC 7668
IPv6 over BLUETOOTH(R) Low Energy
RFC 7668: IPv6 over BLUETOOTH® Low Energy 💖
Okay bestie, let's get into it! 🦋 This one is the spec for running IPv6 over Bluetooth Low Energy, and it was published in October 2015.
Authors: J. Nieminen (TeliaSonera), T. Savolainen (Nokia), M. Isomaki (Nokia), B. Patil (AT&T), Z. Shelby (ARM), and C. Gomez (Universitat Politecnica de Catalunya/i2CAT) ✨
Category: Standards Track 🎀 (so this is a real, official Internet standard, not just an idea)
ISSN: 2070-1721 🌸
Obsoletes / Updates: This document doesn't list any obsoleted or updated RFCs in its title block 🙈
The whole thing is about how IPv6 gets carried over Bluetooth LE links using the 6LoWPAN techniques, so the IoT crowd is going to be obsessed. 🔥
Abstract 🫶
Okay so "Bluetooth Smart" is just the brand name for the Bluetooth low energy feature from the Bluetooth spec (the one run by the Bluetooth Special Interest Group). The regular Bluetooth radio is everywhere, like phones, laptops, headsets, you name it. Then there's the low-power version, which is the one that works with sensors, smart meters, appliances, and stuff like that. It's been standardized since Bluetooth 4.0, but you need version 4.1 or newer to do IPv6, which is kind of a big deal. 💅 This document explains how IPv6 gets transported over Bluetooth LE using 6LoWPAN techniques. Iconic. ✨
Status of This Memo 🌈
This is an Internet Standards Track document. 🎀
It's a product of the Internet Engineering Task Force (IETF), so it reflects consensus from the IETF community. It got public review and was approved by the Internet Engineering Steering Group (IESG). If you want more info about Internet Standards, check out Section 2 of RFC 5741. 💜
You can find the current status, any errata, and feedback info at http://www.rfc-editor.org/info/rfc7668. 🦋
Copyright Notice 🍓
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved. 💖
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were on the publication date. Please read these carefully, because they spell out your rights and restrictions for this document. Any Code Components pulled out of this document have to include the Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Simplified BSD License describes. 🫶
Table of Contents 🧚
1. Introduction ...................................................3
1.1. Terminology and Requirements Language .......................3
2. Bluetooth Low Energy ...........................................4
2.1. Bluetooth LE Stack .........................................4
2.2. Roles and Topology for Link Layer ...........................5
2.3. Bluetooth LE Device Addressing .............................6
2.4. Bluetooth LE Packet Sizes and MTU ...........................6
3. Specification of IPv6 over Bluetooth Low Energy .................7
3.1. Protocol Stack .............................................8
3.2. Link Model .................................................8
3.2.1. IPv6 Subnet Model and Internet Connectivity .........9
3.2.2. Stateless Address Autoconfiguration ................10
3.2.3. Neighbor Discovery .................................12
3.2.4. Header Compression .................................13
3.2.4.1. Remote Destination Example ................14
3.2.4.2. Example of Registration of
Multiple Addresses ........................15
3.2.5. Unicast and Multicast Address Mapping ..............16
4. Security Considerations ........................................16
5. References .....................................................17
5.1. Normative References ......................................17
5.2. Informative References ....................................18
Acknowledgements ..................................................20
Contributors ......................................................20
Authors' Addresses ................................................20Part 1 covers the intro through Section 2.1. The rest of the table of contents will come with the later parts! 🎀
1. Introduction ✨
1.1. Terminology and Requirements Language 💅
Bluetooth Smart is the brand name for the Bluetooth low energy feature (we'll call it "Bluetooth LE" from here on) in the Bluetooth spec from the Bluetooth Special Interest Group [BTCorev4.1]. Bluetooth LE is a radio tech built for devices running on tiny power sources, like coin cell batteries or minimal power setups, so keeping power use super low is essential. 🔋 It's especially attractive for Internet of Things stuff like health monitors, environmental sensing, proximity apps, and so many more. 🌸
Okay, so, the number of sensors and internet-connected devices is about to explode 💥, and IPv6 is the ideal protocol for talking to all of them because of its huge address space. IPv6 also has stateless address autoconfiguration tools, which are perfect for sensor networks and for nodes with very limited processing power or no full operating system or user interface. 🧚
This document describes how IPv6 gets transported over Bluetooth LE connections using 6LoWPAN techniques. RFCs 4944 [RFC4944], 6282 [RFC6282], and 6775 [RFC6775] were built for 6LoWPAN and specify how IPv6 gets transmitted over IEEE 802.15.4 [IEEE802.15.4]. Bluetooth LE links are, in a lot of ways, similar to IEEE 802.15.4, so many of the mechanisms defined for IPv6 over IEEE 802.15.4 can be applied to IPv6 over Bluetooth LE links too. This document specifies the details of IPv6 transmission over Bluetooth LE links. 🦋
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 💜
The terms "6LoWPAN Node (6LN)", "6LoWPAN Router (6LR)", and "6LoWPAN Border Router (6LBR)" are defined as in [RFC6775], with one addition: Bluetooth LE central and Bluetooth LE peripheral (see Section 2.2) can both be either a 6LN or a 6LBR. 🎀
The acronyms "DAC", "DAM", "SAC", "SAM", and "CID" are used in this document as defined in [RFC6282]. Here's what they stand for: 🍓
- Destination Address Compression (DAC)
- Destination Address Mode (DAM)
- Source Address Compression (SAC)
- Source Address Mode (SAM)
- Context Identifier (CID)
2. Bluetooth Low Energy 🌈
Bluetooth LE is designed for sending small amounts of data now and then at modest data rates, with very little energy spent per bit. 🔋✨ The Bluetooth SIG has two trademarks: "Bluetooth Smart" for single-mode devices (devices that only do Bluetooth LE), and "Bluetooth Smart Ready" for dual-mode devices (devices that do both Bluetooth and Bluetooth LE). Heads up, Bluetooth and Bluetooth LE are different radio techs that don't interoperate. 🙈 In the rest of this document, "Bluetooth LE" is used no matter whether the device is single-mode or dual-mode. 💅
Bluetooth LE came in with Bluetooth 4.0, got upgraded in Bluetooth 4.1 [BTCorev4.1], and has kept evolving in later versions. The Bluetooth SIG also published the Internet Protocol Support Profile (IPSP) [IPSP], which includes the Internet Protocol Support Service (IPSS). IPSP is what lets IP-enabled devices find each other and set up a link-layer connection for carrying IPv6 packets. IPv6 over Bluetooth LE depends on both Bluetooth 4.1 and IPSP 1.0 or newer to get the capabilities it needs. 🫶
Phones, notebooks, tablets, smartwatches, and other handheld devices with chipsets that do Bluetooth 4.1 or later also have the low energy functionality. Bluetooth LE is expected to show up in tons of accessories that work with those devices too. 🌸 For example, a heart rate monitor could send its data through a phone or smartwatch to a server on the Internet, or it could send data straight to the device. 💖
2.1. Bluetooth LE Stack 🦋
The lower layer of the Bluetooth LE stack has the Physical Layer (PHY), the Link Layer (LL), and a test interface called the Direct Test Mode (DTM). The PHY sends and receives the actual packets. The LL handles medium access, connection setup, error control, and flow control. The DTM is only for testing. 🧪 The upper layer has the Logical Link Control and Adaptation Protocol (L2CAP), the Attribute Protocol (ATT), the Security Manager (SM), the Generic Attribute Profile (GATT), and the Generic Access Profile (GAP), as shown in Figure 1. The Host Controller Interface (HCI) splits the lower layers, which usually live in the Bluetooth controller, from the higher layers, which usually live in the host stack. 🎀 GATT and the Bluetooth LE profiles together let you build applications in a standardized way without using IP. L2CAP multiplexes data channels from the layers above it, and it also does fragmentation and reassembly for big data packets. 👑 The Security Manager defines the protocol and mechanisms for pairing, key distribution, and a security toolbox for the Bluetooth LE device. 🔐
+-------------------------------------------------+
| Applications |
+---------------------------------------+---------+
| Generic Attribute Profile | Generic |
+--------------------+------------------+ Access |
| Attribute Protocol | Security Manager | Profile |
+--------------------+------------------+---------+
| Logical Link Control and Adaptation Protocol |
- - -+-----------------------+-------------------------+- - - HCI
| Link Layer | Direct Test Mode |
+-------------------------------------------------+
| Physical Layer |
+-------------------------------------------------+
Figure 1: Bluetooth LE Protocol StackAs Section 3.1 shows, IPv6 over Bluetooth LE requires an adapted 6LoWPAN layer that runs on top of Bluetooth LE L2CAP. 🧚✨
Part 1 of 5 done! More coming up next, bestie 🌈💖
2.2. Roles and Topology for Link Layer ✨
Okay so Bluetooth LE has two GAP roles that matter here: the Bluetooth LE central role and the Bluetooth LE peripheral role 💖. A device in the central role (called "central" from now on) has traditionally been able to juggle multiple simultaneous connections with a bunch of devices in the peripheral role (called "peripherals" from now on) 🧚. A peripheral is usually connected to just one central, but since Bluetooth 4.1 it can also connect to multiple centrals at the same time 👑. For IPv6 networking purposes in this document, the Bluetooth LE network (aka a Bluetooth LE piconet) follows a star topology, as shown in Figure 2 🌸. A router usually plays the central role and everyone else plays the peripheral role. Mesh networking and/or parallel connectivity to multiple centrals at once may be defined for IPv6 over Bluetooth LE in the future 🔮.
Peripheral --. .-- Peripheral
\ /
Peripheral ---- Central ---- Peripheral
/ \
Peripheral --' '-- Peripheral
Figure 2: Bluetooth LE Star TopologyIn Bluetooth LE, direct wireless communication only happens between a central and a peripheral 🫶. So the Bluetooth LE star is basically a hub-and-spokes link model, no cap 💅. Still, two peripherals can talk to each other by going through the central, using IP routing functionality per this specification 🦋.
2.3. Bluetooth LE Device Addressing
Every Bluetooth LE device is identified by a 48-bit device address 🔐. The Bluetooth spec [BTCorev4.1] describes it like this: "Devices are identified using a device address. Device addresses may be either a public device address or a random device address". Public device addresses are based on the IEEE 802 standard [IEEE802]. Random device addresses and the Bluetooth LE privacy feature are described in the Bluetooth Generic Access Profile, in Sections 10.8 and 10.7 of [BTCorev4.1] respectively 📖. There are two types of random device addresses: static and private. Private addresses split again into two sub-types, resolvable or non-resolvable, which are explained in depth in the referenced Bluetooth spec.
Once a static address is initialized, it does not change until the device is power cycled ⚡. The static address can be initialized to a new value after each power cycle, but that is not mandatory. The recommended time interval before randomizing a new private address is 15 minutes, as determined by timer T_GAP(private_addr_int) in Table 17.1 of the Bluetooth Generic Access Profile [BTCorev4.1] ⏰. Which device address types get used is implementation and deployment specific 🛠️.
In random addresses, the first 46 bits are randomized, and the last 2 bits indicate the random address type 🎲. Bluetooth LE does not support avoidance or detection of device address collisions, which is a little messy 🙈. Still, these 48-bit random device addresses have a very small probability of being in conflict within a typical deployment, so it's not the end of the world ✨.
2.4. Bluetooth LE Packet Sizes and MTU
The optimal MTU defined for L2CAP fixed channels over Bluetooth LE is 27 octets, including the 4-octet L2CAP header 📦. So the default MTU for Bluetooth LE is 27 octets. Excluding that 4-octet L2CAP header, a protocol data unit (PDU) size of 23 octets is available for upper layers 🍓.
Now, to transmit IPv6 packets of 1280 octets or larger, a link-layer fragmentation and reassembly solution is provided by the L2CAP layer 🧩. The IPSP defines means for negotiating up a link-layer connection that provides an MTU of 1280 octets or higher for the IPv6 layer [IPSP] 🔥. The link-layer MTU is negotiated separately for each direction. Implementations that require an equal link-layer MTU for the two directions SHALL use the smallest of the possibly different MTU values 💜.
3. Specification of IPv6 over Bluetooth Low Energy
Bluetooth LE technology sets strict requirements for low power consumption, so it limits how much protocol overhead is allowed 🔋. 6LoWPAN standards [RFC6775] [RFC6282] provide useful functionality for reducing overhead, and that functionality is applied to Bluetooth LE 🌈. It includes link-local IPv6 addresses and stateless IPv6 address autoconfiguration (see Section 3.2.2), Neighbor Discovery (see Section 3.2.3), and header compression (see Section 3.2.4). Fragmentation features from the 6LoWPAN standards are not used, since Bluetooth LE has its own link-layer fragmentation support (see Section 2.4) 🙅.
Here's the big difference: IEEE 802.15.4 supports both star and mesh topologies (and requires a routing protocol), whereas Bluetooth LE does not currently support forming multihop networks at the link layer 🕸️. Still, inter-peripheral communication through the central is enabled by using IP routing functionality per this specification 🦋.
In Bluetooth LE, a central node is assumed to be less resource constrained than a peripheral node 💪. So in the primary deployment scenario, the central and peripheral act as a 6LoWPAN Border Router (6LBR) and a 6LoWPAN Node (6LN), respectively 🎀.
Before any IP-layer communication can happen over Bluetooth LE, nodes enabled by Bluetooth LE, such as 6LNs and 6LBRs, have to find each other and set up a suitable link-layer connection 🔍. The discovery and Bluetooth LE connection setup procedures are documented by the Bluetooth SIG in the IPSP specification [IPSP] 📚.
In the rare case of a Bluetooth LE random device address conflict, a 6LBR can detect multiple 6LNs with the same Bluetooth LE device address, as well as a 6LN with the same Bluetooth LE address as the 6LBR 😱. The 6LBR MUST ignore 6LNs with the same device address the 6LBR has, and the 6LBR MUST have at most one connection for a given Bluetooth LE device address at any given moment. This will avoid addressing conflicts within a Bluetooth LE network 🫶.
3.1. Protocol Stack
Figure 3 shows how the IPv6 stack works in parallel to the GATT stack on top of the Bluetooth LE L2CAP layer 🧁. The GATT stack is needed here for discovering nodes that support the Internet Protocol Support Service. UDP and TCP are given as examples of transport protocols, but the stack can be used by any other upper-layer protocol that can run on top of IPv6 💅.
+---------+ +----------------------------+
| IPSS | | UDP/TCP/other |
+---------+ +----------------------------+
| GATT | | IPv6 |
+---------+ +----------------------------+
| ATT | | 6LoWPAN for Bluetooth LE |
+---------+--+----------------------------+
| Bluetooth LE L2CAP |
- - +-----------------------------------------+- - - HCI
| Bluetooth LE Link Layer |
+-----------------------------------------+
| Bluetooth LE Physical |
+-----------------------------------------+
Figure 3: IPv6 and IPSS on the Bluetooth LE Stack3.2. Link Model
The distinct concepts of the IPv6 link (layer 3) and the physical link (the combination of PHY and Media Access Control (MAC)) need to be clear 🧠. Their relationship has to be well understood in order to specify the addressing scheme for transmitting IPv6 packets over the Bluetooth LE link 🔗. RFC 4861 [RFC4861] defines a link as "a communication facility or medium over which nodes can communicate at the link layer, i.e., the layer immediately below IP" 🌷.
For Bluetooth LE, the 6LoWPAN layer is adapted to support transmission of IPv6 packets over Bluetooth LE ✨. The IPSP defines all the steps required for setting up the Bluetooth LE connection that 6LoWPAN runs over [IPSP], including handling the link-layer fragmentation required on Bluetooth LE, as described in Section 2.4 🛠️. Even though MTUs larger than 1280 octets can be supported, a 1280-octet MTU is RECOMMENDED, so that the need for Path MTU discovery procedures is avoided 🙌.
Bluetooth LE protocols, such as L2CAP, use little-endian byte ordering, but IPv6 packets MUST be transmitted in big-endian order (network byte order) 🔄.
Per this specification, the IPv6 header compression format specified in RFC 6282 [RFC6282] MUST be used 🗜️. The IPv6 payload length can be derived from the L2CAP header length. The possibly elided IPv6 address can be reconstructed from the link-layer address (used at the time of Bluetooth LE connection establishment), the HCI Connection Handle during the connection, compression context if any, and address registration information (see Section 3.2.3) 🧩.
Bluetooth LE connections used to build a star topology are point-to-point in nature, since Bluetooth broadcast features are not used for IPv6 over Bluetooth LE (except for discovery of nodes supporting IPSS) 📡. After the peripheral and central have connected at the Bluetooth LE level, the link can be considered up, and IPv6 address configuration and transmission can begin 🦋.
3.2.1. IPv6 Subnet Model and Internet Connectivity 🦋
okay so in the Bluetooth LE piconet model (see Section 2.2), every peripheral gets its own separate link to the central, and the central acts as an IPv6 router instead of a link-layer switch 🧚. As [RFC4903] explains, regular IPv6 usage expects a subnet to span a single link at the link layer. But IPv6 over Bluetooth LE is made for constrained nodes and Internet of Things vibes 🌸, so building a separate subnet on every peripheral-central link and routing between all of them seems way too extra 😭. In the Bluetooth LE case, treating the whole bunch of point-to-point links between a central and its connected peripherals as one multilink subnet, instead of a pile of separate subnets, is worth it. The benefits outweigh the multilink model's drawbacks as described in [RFC4903] 💅.
So the multilink model is the one we picked, as Figure 4 shows 👑. Because of this, link-local multicast communications can only happen inside a single Bluetooth LE connection, which means 6LN-to-6LN communication using link-local addresses is not possible 💀. 6LNs connected to the same 6LBR have to talk to each other through the shared prefix on the subnet. The 6LBR makes sure address collisions do not happen (see Section 3.2.3) and forwards packets from one 6LN to another 🫶.
In a typical scenario, the Bluetooth LE network is connected to the Internet as shown in the Figure 4 ✨. The Bluetooth LE star is deployed as one subnet using one /64 IPv6 prefix, with each spoke being its own link. The 6LBR acts as the router and forwards packets between the 6LNs and to and from the Internet 🌈.
/
.---------------. /
/ 6LN \ /
/ \ \ /
| \ | /
| 6LN ----------- 6LBR ----- | Internet
| <--Link--> / | \
\ / / \
\ 6LN / \
'---------------' \
\
<------ Subnet -----><-- IPv6 connection -->
to Internet
Figure 4: Bluetooth LE Network Connected to the InternetIn some scenarios, the Bluetooth LE network might be isolated, either for a little while or for good, as Figure 5 shows 🙈. In this case, the whole star is a single subnet with multiple links, and the 6LBR sits at the central, routing packets between the 6LNs. In the simplest case, the isolated network has one 6LBR and one 6LN 🍓.
.-------------------.
/ \
/ 6LN 6LN \
/ \ / \
| \ / |
| 6LN --- 6LBR --- 6LN |
| / \ |
\ / \ /
\ 6LN 6LN /
\ /
'-------------------'
<--------- Subnet ---------->
Figure 5: Isolated Bluetooth LE Network3.2.2. Stateless Address Autoconfiguration 🎀
At network interface initialization, both the 6LN and the 6LBR SHALL generate IPv6 link-local addresses [RFC4862] and assign them to the Bluetooth LE network interface 💖. These are based on the 48-bit Bluetooth device addresses (see Section 2.3) that were used to set up the underlying Bluetooth LE connection. A 6LN and a 6LBR are RECOMMENDED to use private Bluetooth device addresses 🧚. A 6LN SHOULD pick a different Bluetooth device address for every Bluetooth LE connection with a 6LBR, and a 6LBR SHOULD periodically change its random Bluetooth device address 🔥.
Following the guidance of [RFC7136], a 64-bit Interface Identifier (IID) is formed from the 48-bit Bluetooth device address by inserting two octets with hexadecimal values of 0xFF and 0xFE in the middle, as Figure 6 shows 🦋. In the figure, the letter 'b' stands for a bit from the Bluetooth device address, copied over as is with no changes to any bit. This means no bit in the IID tells you whether the underlying Bluetooth device address is public or random 👀.
|0 1|1 3|3 4|4 6|
|0 5|6 1|2 7|8 3|
+----------------+----------------+----------------+----------------+
|bbbbbbbbbbbbbbbb|bbbbbbbb11111111|11111110bbbbbbbb|bbbbbbbbbbbbbbbb|
+----------------+----------------+----------------+----------------+
Figure 6: Formation of IID from Bluetooth Device AddressThe IID then gets the prefix fe80::/64 attached, as described in RFC 4291 [RFC4291] and as Figure 7 shows 💜. The same link-local address SHALL be used for the whole lifetime of the Bluetooth LE L2CAP channel. (Once a Bluetooth LE logical link is up, HCI refers to it with a Connection Handle. So even if device addresses change, the data flows inside existing L2CAP channels are fine. That means there's no need to change IPv6 link-local addresses, even if devices swap their random device addresses during the L2CAP channel's lifetime 🫶.)
10 bits 54 bits 64 bits
+----------+-----------------+----------------------+
|1111111010| zeros | Interface Identifier |
+----------+-----------------+----------------------+
Figure 7: IPv6 Link-Local Address in Bluetooth LEA 6LN MUST join the all-nodes multicast address 🌸. A 6LN doesn't need to join the solicited-node multicast address, since the 6LBR already knows the device addresses, and therefore the link-local addresses, of all the connected 6LNs 🙌. The 6LBR makes sure no two devices with the same Bluetooth LE device address are connected at once. Duplicate link-local address detection is handled by the process on the 6LBR that finds IP-enabled Bluetooth LE nodes and starts Bluetooth LE connection setup. This makes the 6LBR a bit more complex, but it cuts power use on both the 6LN and the 6LBR during link setup, because there are fewer mandatory packet transmissions 🔋.
After link-local address configuration, the 6LN sends Router Solicitation messages as described in [RFC4861], Section 6.3.7 📨.
For non-link-local addresses, 6LNs SHOULD NOT be configured to embed the Bluetooth device address in the IID by default 🙅♀️. Alternatives such as Cryptographically Generated Addresses (CGAs) [RFC3972], privacy extensions [RFC4941], Hash-Based Addresses (HBAs) [RFC5535], DHCPv6 [RFC3315], or static, semantically opaque addresses [RFC7217] SHOULD be used by default 💅. In situations where the Bluetooth device address is known to be a private device address and/or the header compression benefits of embedding the device address in the IID are needed to support deployment constraints, 6LNs MAY form a 64-bit IID by using the 48-bit Bluetooth device address ✨. The non-link-local addresses a 6LN generates MUST be registered with the 6LBR as described in Section 3.2.3 🧚.
Getting an IPv6 prefix for numbering the Bluetooth LE network is out of scope for this document 🌈. The 6LBR can get one, for example, through DHCPv6 Prefix Delegation [RFC3633] or by using Unique Local IPv6 Unicast Addresses (ULAs) [RFC4193] 🍓. Because of the Bluetooth LE link model (see Section 3.2.1), the 6LBR MUST set the "on-link" flag (L) to zero in the Prefix Information Option in Neighbor Discovery messages [RFC4861] (see Section 3.2.3) 🙈. This makes 6LNs always send packets to the 6LBR, including when the destination is another 6LN using the same prefix 🔁.
3.2.3. Neighbor Discovery 💜
'Neighbor Discovery Optimization for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs)' [RFC6775] describes the neighbor discovery approach as adapted for several 6LoWPAN topologies, including the mesh topology 🕸️. Bluetooth LE doesn't support mesh networks, so only the parts that apply to a star topology get considered here ⭐.
These parts of the Neighbor Discovery optimizations [RFC6775] apply to Bluetooth LE 6LNs 👑:
- A Bluetooth LE 6LN MUST NOT register its link-local address 🙅♀️. A Bluetooth LE 6LN MUST register its non-link-local addresses with the 6LBR by sending a Neighbor Solicitation (NS) message with the Address Registration Option (ARO), and then process the Neighbor Advertisement (NA) accordingly. The NS with the ARO option MUST be sent no matter which method was used to generate the IID 💅. If the 6LN registers multiple addresses that are not based on the Bluetooth device address for the same compression context, the header compression efficiency will drop (see Section 3.2.4) 📉.
- For sending Router Solicitations and processing Router Advertisements, the Bluetooth LE 6LNs MUST follow Sections 5.3 and 5.4 of [RFC6775], respectively 🎀.
3.2.4. Header Compression ✨
Okay bestie, so header compression is the star of this section 🌟. The format is the one from [RFC6282], which handles IPv6 datagrams on top of IEEE 802.15.4, and it is REQUIRED as the basis for IPv6 header compression over Bluetooth LE 💖. Every header MUST be compressed using the encoding formats in [RFC6282] 🎀. No skipping, no vibes-based compression 💅.
Bluetooth LE's star topology and ARO can be used together for address compression 🦋. Here's the gist of how IPv6 address compression works on top of Bluetooth LE 🧚.
The ARO option needs a 64-bit Extended Unique Identifier (EUI-64) from [RFC6775] 🌸. For Bluetooth LE, that field SHALL be filled with the 48-bit device address of the node, converted into the 64-bit Modified EUI-64 format from [RFC4291] 🫶.
To make compression actually work, when the 6LBR sends a Router Advertisement, it MUST include a 6LoWPAN Context Option (6CO) from [RFC6775] for every address prefix it advertises in a Prefix Information Option (PIO) from [RFC4861], for use in stateless address autoconfiguration 🌈.
When a 6LN sends a packet to a 6LBR, it MUST fully elide the source address if that address is link-local 🙈. For other packets to or through a 6LBR with a non-link-local source address that the 6LN has registered with ARO to the 6LBR for the indicated prefix, the source address MUST be fully elided if it's the latest address the 6LN has registered for that prefix 💀. If the source is non-link-local and NOT the latest registered one, then the 64 bits of the IID SHALL be fully carried in-line (SAM=01) 😭. Or, if the first 48 bits of the IID match the latest registered address, then the last 16 bits of the IID SHALL be carried in-line (SAM=10) ✨.
So, the rules by setting: if SAC=0 and SAM=11, the 6LN MUST be using the link-local IPv6 address derived from its Bluetooth LE device address 👑. If SAC=1 and SAM=11, the 6LN MUST have registered the source IPv6 address with the prefix tied to the compression context, and the 6LN MUST be referring to the latest registered address for that context 🔥.
An IPv6 address MUST be considered registered only after the 6LBR has sent a Neighbor Advertisement with an ARO whose status field is set to success 💜. And the destination IPv6 address MUST be fully elided if it's the 6LBR's link-local address based on the 6LBR's Bluetooth device address (DAC=0, DAM=11) 🦋.
The destination IPv6 address MUST be fully or partially elided if context has been set up for it. For example, DAC=0 and DAM=01 when the destination prefix is link-local, and DAC=1 and DAM=01 if a compression context has been configured for the destination prefix used 🌸.
When a 6LBR transmits packets to a 6LN, it MUST fully elide the source IID if the source IPv6 address is the link-local address based on the 6LBR's Bluetooth device address (SAC=0, SAM=11) 🎀. It MUST elide the source prefix or address if a compression context related to the IPv6 source address has been set up 🧚. The 6LBR also MUST fully elide the destination IPv6 address if it's the link-local address based on the 6LN's Bluetooth device address (DAC=0, DAM=11), or if the destination address is the latest one the 6LN registered with ARO for the indicated context (DAC=1, DAM=11) 💅. If the destination is a non-link-local address and NOT the latest registered, then the 6LN MUST either include the IID part fully in-line (DAM=01) or, if the first 48 bits of the IID match the latest registered address, elide those 48 bits (DAM=10) 🫶.
3.2.4.1. Remote Destination Example 🌍
When a 6LN transmits an IPv6 packet to a remote destination using global Unicast IPv6 addresses, and a context is defined for the 6LN's global IPv6 address, the 6LN has to indicate that context in the corresponding source fields of the compressed IPv6 header, as per Section 3.1 of [RFC6282] 💖. It also has to elide the full IPv6 source address previously registered with ARO, if it's using the latest registered address. Otherwise, part or all of the IID may have to be sent in-line 😭. For this, the 6LN MUST use these settings in the compressed IPv6 header: SAC=1 and SAM=11 🔥. The CID may be set to 0 or 1, depending on which context is used 🌸.
Here's the cool part 😎: the 6LBR can infer the elided IPv6 source address because 1) the 6LBR has previously assigned the prefix to the 6LNs, and 2) the 6LBR maintains a Neighbor Cache that relates the device address and the IID the device registered with ARO 🧠.
If a context is defined for the IPv6 destination address, the 6LN also has to indicate that context in the corresponding destination fields of the compressed header, and elide the prefix or the full destination address 🎀. For this, the 6LN MUST set DAM to DAM=01 (if the context covers a 64-bit prefix) or DAM=11 (if the context covers a full 128-bit address) 💅. DAC MUST be set to 1 🦋. Note that when a context is defined for the destination address, the 6LBR can infer the elided destination prefix by using that context 🌈.
When a 6LBR receives an IPv6 packet from a remote node outside the Bluetooth LE network, and the destination is a 6LN, and a context is defined for the prefix of the 6LN's global IPv6 address, the 6LBR has to indicate that context in the corresponding destination fields of the compressed header 🧚. The 6LBR has to elide the IPv6 destination address before forwarding it, if the 6LN can infer it 🫶. For this, the 6LBR will set DAM to DAM=11 (if the address is the latest one the 6LN registered) 💜. DAC needs to be set to 1 ✨. If a context is defined for the IPv6 source address, the 6LBR needs to indicate that context in the source fields of the compressed header and elide that prefix as well 🌸. For this, the 6LBR needs to set SAM to SAM=01 (if the context covers a 64-bit prefix) or SAM=11 (if the context covers a full 128-bit address) 🎀. SAC is to be set to 1 👑.
3.2.4.2. Example of Registration of Multiple Addresses 🍓
As we covered above, a 6LN can register multiple non-link-local addresses that map to the same compression context 💖. Out of all the addresses it registered, only the latest one can be fully elided (SAM=11, DAM=11) 🔥. The IIDs of the previously registered addresses have to be sent fully in-line (SAM=01, DAM=01) or, in the best case, partially elided (SAM=10, DAM=10) 😭. Here's an example 🧚:
- The 6LN registers the first address 2001:db8::1111:2222:3333:4444 to a 6LBR 🌸. At this point, the address can be fully elided using SAC=1/SAM=11 or DAC=1/DAM=11 ✨.
- The 6LN registers the second address 2001:db8::1111:2222:3333:5555 to the 6LBR 🦋. Since the second address is now the latest registered, it can be fully elided using SAC=1/SAM=11 or DAC=1/DAM=11 💅. The first address can now be partially elided using SAC=1/SAM=10 or DAC=1/DAM=10, because the first 112 bits are the same between the first and second registered addresses 🫶.
- Expiration of the registration time for the first or the second address has no impact on compression 🙈. So even if the most recently registered address expires, the first address can only be partially elided (SAC=1/SAM=10, DAC=1/DAM=10) 😭. The 6LN can register a new address, or re-register an expired one, to be able to fully elide an address again 👑.
3.2.5. Unicast and Multicast Address Mapping 📡
The Bluetooth LE Link Layer does NOT support multicast, so traffic is always unicast between two Bluetooth LE nodes 🙅♀️. Even when a 6LBR is attached to multiple 6LNs, it cannot multicast to all of them at once 💀. If the 6LBR needs to send a multicast packet to all its 6LNs, it has to replicate the packet and unicast it on each link 🥺. This may not be energy efficient, so particular care must be taken if the central is battery powered 🔋. To conserve power, the 6LBR MUST keep track of multicast listeners at Bluetooth LE link-level granularity (not subnet granularity), and it MUST NOT forward multicast packets to 6LNs that haven't registered as listeners for the multicast groups those packets belong to 🌟.
In the opposite direction, a 6LN always has to send packets to or through the 6LBR 🦋. So when a 6LN needs to transmit an IPv6 multicast packet, the 6LN will unicast the corresponding Bluetooth LE packet to the 6LBR 💖.
4. Security Considerations 🔐
Okay, security time, and it's serious 😭🔐. The transmission of IPv6 over Bluetooth LE links and IPv6 over IEEE 802.15.4 have similar requirements and concerns for security 🧠. Security considerations for the Bluetooth LE Link Layer are covered by the IPSP [IPSP] 💜.
Bluetooth LE Link Layer supports encryption and authentication using the Counter with CBC-MAC (CCM) mechanism [RFC3610] and a 128-bit AES block cipher 🔥. Upper-layer security mechanisms may exploit this functionality when it's available 🎀. (Note: CCM does not consume octets from the maximum per-packet L2CAP data size, since the link-layer data unit has a specific field for them when they're used 🙈.)
Key management in Bluetooth LE is provided by the Security Manager Protocol (SMP), as defined in [BTCorev4.1] 🗝️.
The Direct Test Mode offers two setup alternatives: with and without accessible HCI 🧪. In designs with accessible HCI, the so-called upper tester communicates through the HCI (which may be supported by Universal Asynchronous Receiver Transmitter (UART), Universal Serial Bus (USB), and Secure Digital transports) with the Physical and Link Layers of the Bluetooth LE device under test 🔌. In designs without accessible HCI, the upper tester communicates with the device under test through a two-wire UART interface 😬. The Bluetooth specification [BTCorev4.1] does NOT provide security mechanisms for communication between the upper tester and the device under test in either case 🚨. Nevertheless, an attacker needs to physically connect a device (via one of the wired HCI types) to the device under test to interact with it 🔒.
The IPv6 link-local address configuration described in Section 3.2.2 only reveals information about the 6LN to the 6LBR that the 6LBR already knows from the link-layer connection 👀. This means a device using Bluetooth privacy features reveals the same information in its IPv6 link-local addresses as in its device addresses 🙃. Likewise, a device NOT using privacy at the Bluetooth level won't have privacy at the IPv6 link-local address either 😬. For non-link-local addresses, implementations are recommended NOT to embed the Bluetooth device address in the IID by default, and instead to support, for example, [RFC3315], [RFC3972], [RFC4941], [RFC5535], or [RFC7217] 🛡️💅.
⚠️ A malicious 6LN may attempt a denial-of-service attack on the Bluetooth LE network, for example by flooding packets 🌊😱. This sort of attack is mitigated by the fact that link-local multicast is not bridged between Bluetooth LE links, and by the 6LBR being able to rate-limit packets sent by each 6LN by making smart use of the Bluetooth LE L2CAP credit-based flow-control mechanism 🛑💜.
5. References 📚
5.1. Normative References
okay bestie, these are the must-read sources the spec leans on 📚✨ you can't skip these, they're the foundation
[BTCorev4.1]
Bluetooth Special Interest Group, "Bluetooth Core
Specification Version 4.1", December 2013,
<https://www.bluetooth.org/en-us/specification/adopted-
specifications>.
[IPSP] Bluetooth Special Interest Group, "Bluetooth Internet
Protocol Support Profile Specification Version 1.0.0",
December 2014, <https://www.bluetooth.org/en-
us/specification/adopted-specifications>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing
Architecture", RFC 4291, DOI 10.17487/RFC4291, February
2006, <http://www.rfc-editor.org/info/rfc4291>.
[RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman,
"Neighbor Discovery for IP version 6 (IPv6)", RFC 4861,
DOI 10.17487/RFC4861, September 2007,
<http://www.rfc-editor.org/info/rfc4861>.
[RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless
Address Autoconfiguration", RFC 4862,
DOI 10.17487/RFC4862, September 2007,
<http://www.rfc-editor.org/info/rfc4862>.
[RFC6282] Hui, J., Ed. and P. Thubert, "Compression Format for IPv6
Datagrams over IEEE 802.15.4-Based Networks", RFC 6282,
DOI 10.17487/RFC6282, September 2011,
<http://www.rfc-editor.org/info/rfc6282>.
[RFC6775] Shelby, Z., Ed., Chakrabarti, S., Nordmark, E., and C.
Bormann, "Neighbor Discovery Optimization for IPv6 over
Low-Power Wireless Personal Area Networks (6LoWPANs)",
RFC 6775, DOI 10.17487/RFC6775, November 2012,
<http://www.rfc-editor.org/info/rfc6775>.
[RFC7136] Carpenter, B. and S. Jiang, "Significance of IPv6
Interface Identifiers", RFC 7136, DOI 10.17487/RFC7136,
February 2014, <http://www.rfc-editor.org/info/rfc7136>.5.2. Informative References
these ones are the extra reading 🧠 super useful for context, not strictly required to build the thing, but iykyk they make everything click 🦋
[IEEE802] IEEE, "IEEE Standard for Local and Metropolitan Area
Networks: Overview and Architecture", IEEE 802,
DOI 10.1109/ieeestd.2002.93395,
<http://ieeexplore.ieee.org/servlet/opac?punumber=7732>.
[IEEE802.15.4]
IEEE, "IEEE Standard for Local and metropolitan area
networks--Part 15.4: Low-Rate Wireless Personal Area
Networks (LR-WPANs)", IEEE 802.15.4,
DOI 10.1109/ieeestd.2011.6012487,
<http://ieeexplore.ieee.org/servlet/
opac?punumber=6012485>.
[RFC3315] Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins,
C., and M. Carney, "Dynamic Host Configuration Protocol
for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July
2003, <http://www.rfc-editor.org/info/rfc3315>.
[RFC3610] Whiting, D., Housley, R., and N. Ferguson, "Counter with
CBC-MAC (CCM)", RFC 3610, DOI 10.17487/RFC3610, September
2003, <http://www.rfc-editor.org/info/rfc3610>.
[RFC3633] Troan, O. and R. Droms, "IPv6 Prefix Options for Dynamic
Host Configuration Protocol (DHCP) version 6", RFC 3633,
DOI 10.17487/RFC3633, December 2003,
<http://www.rfc-editor.org/info/rfc3633>.
[RFC3972] Aura, T., "Cryptographically Generated Addresses (CGA)",
RFC 3972, DOI 10.17487/RFC3972, March 2005,
<http://www.rfc-editor.org/info/rfc3972>.
[RFC4193] Hinden, R. and B. Haberman, "Unique Local IPv6 Unicast
Addresses", RFC 4193, DOI 10.17487/RFC4193, October 2005,
<http://www.rfc-editor.org/info/rfc4193>.
[RFC4903] Thaler, D., "Multi-Link Subnet Issues", RFC 4903,
DOI 10.17487/RFC4903, June 2007,
<http://www.rfc-editor.org/info/rfc4903>.
[RFC4941] Narten, T., Draves, R., and S. Krishnan, "Privacy
Extensions for Stateless Address Autoconfiguration in
IPv6", RFC 4941, DOI 10.17487/RFC4941, September 2007,
<http://www.rfc-editor.org/info/rfc4941>.
[RFC4944] Montenegro, G., Kushalnagar, N., Hui, J., and D. Culler,
"Transmission of IPv6 Packets over IEEE 802.15.4
Networks", RFC 4944, DOI 10.17487/RFC4944, September 2007,
<http://www.rfc-editor.org/info/rfc4944>.
[RFC5535] Bagnulo, M., "Hash-Based Addresses (HBA)", RFC 5535,
DOI 10.17487/RFC5535, June 2009,
<http://www.rfc-editor.org/info/rfc5535>.
[RFC7217] Gont, F., "A Method for Generating Semantically Opaque
Interface Identifiers with IPv6 Stateless Address
Autoconfiguration (SLAAC)", RFC 7217,
DOI 10.17487/RFC7217, April 2014,
<http://www.rfc-editor.org/info/rfc7217>.Acknowledgements ✨
the people who made this happen 🫶
The Bluetooth, Bluetooth Smart, and Bluetooth Smart Ready marks are registered trademarks owned by Bluetooth SIG, Inc.
Carsten Bormann, Samita Chakrabarti, Niclas Comstedt, Alissa Cooper, Elwyn Davies, Brian Haberman, Marcel De Kogel, Jouni Korhonen, Chris Lonvick, Erik Nordmark, Erik Rivard, Dave Thaler, Pascal Thubert, Xavi Vilajosana, and Victor Zhodzishsky provided valuable feedback for this document. 💜
The authors would like to give special acknowledgements to Krishna Shingala, Frank Berntsen, and Bluetooth SIG's Internet Working Group for providing significant feedback and improvement proposals for this document. 🌸
Carles Gomez has been supported in part by the Spanish Government Ministerio de Economia y Competitividad through project TEC2012-32531, and FEDER. 🇪🇸
Johanna Nieminen worked on this RFC in 2011-2012 while at Nokia and would like to thank Nokia for supporting the project. 🙌
Contributors 🎀
Kanji Kerai, Jari Mutikainen, David Canfeng-Chen, and Minjun Xi from Nokia contributed significantly to this document. 💅
Authors' Addresses 🦋
the squad behind the spec, with their contact deets 📮
Johanna Nieminen
TeliaSonera
Email: johannamaria.nieminen@gmail.com
Teemu Savolainen
Nokia
Visiokatu 3
Tampere 33720
Finland
Email: teemu.savolainen@nokia.com
Markus Isomaki
Nokia
Karaportti 2-4
Espoo 02610
Finland
Email: markus.isomaki@nokia.com
Basavaraj Patil
AT&T
1410 East Renner Road
Richardson, TX 75082
United States
Email: basavaraj.patil@att.com
Zach Shelby
ARM
150 Rose Orchard Way
San Jose, CA 95134
United States
Email: zach.shelby@arm.com
Carles Gomez
Universitat Politecnica de Catalunya/i2CAT
C/Esteve Terradas, 7
Castelldefels 08860
Spain
Email: carlesgo@entel.upc.eduthat's a wrap on the whole RFC, bestie!! 🌈👑 go forth and implement it 💖
📦 where this page comes from
- ietf: rfc7668 2015-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms