Interview with Damon Barnes, Bluetooth SIG Channel Sounding: "Centimeter-precise positioning and secure access control for IoT devices"

Bluetooth 6 introduces channel sounding, a precise and secure distance-measuring technology, that significantly enhances device interaction. Damon Barnes, Director of Technical Marketing at the Bluetooth SIG, highlights in an interview with our sisterbrand ELEKTRONIKPRAXIS how this advancement impacts IoT and embedded applications. This development enables more accurate, secure, and efficient device-to-device positioning, an essential feature for emerging IoT solutions, from indoor navigation to proximity-based services.

With Bluetooth specification 6.0, the Bluetooth Special Interest Group (SIG) is introducing a new core feature to the wireless connectivity standard, which should be of particular interest to IoT applications: Channel Sounding should enable developers to measure distances in the centimeter range while meeting the highest security requirements.

This innovation centers on phase-based ranging (PBR) and round-trip time (RTT) technologies, which not only deliver high-precision measurements but also enhance security by countering cyber threats. In this interview with ELEKTRONIKPRAXIS, Damon Barnes, Director of Technical Marketing at the Bluetooth SIG, outlines how channel sounding enhances device interactions in practical settings. He also addresses the challenges involved in integrating these advancements into existing infrastructures, emphasizing both the opportunities and technical complexities that Bluetooth 6’s channel sounding brings to IoT and embedded systems.

Mr. Barnes, how does Bluetooth Channel Sounding fit into the overall trends in IoT and smart device development, especially in terms of accuracy and security?

The performance of smart IoT devices has increased continuously. Bluetooth Channel Sounding is an example of this trend. For more than a decade, developers have been using Bluetooth RSSI to estimate the distance between two devices so that Bluetooth devices can better recognize each other and thus work more intelligently, responsively and intuitively.

Channel Sounding now offers centimeter-accurate measurements over considerable distances. This meets the requirements of most applications. Key examples include more secure digital keys and Bluetooth locks as well as Bluetooth-based industrial HMI solutions to increase personnel safety.

Channel Sounding is introducing two new distance estimation methods into the Bluetooth specification: phase-based ranging (PBR) and round-trip time (RTT). Can you briefly explain these two methods?

Damon Barnes, Bluetooth SIG: With Bluetooth Channel Sounding, devices such as IoT devices can find each other with significantly higher accuracy than with the classic RSSI (Received Signal Strength Indicator). This relative indicator for the received field strength of an incoming signal is more susceptible to interference from external factors.

Imagine searching for your lost keys in a cluttered room. In the past, using the Bluetooth signal strength indicator RSSI was like using a flashlight with a very weak beam. You could only vaguely see the area where your keys might be located. It was difficult or impossible to determine the exact position.

Bluetooth now uses two proven distance measurement methods, phase-based ranging (PBR) and round trip time (RTT), for precise and reliable distance measurement between two devices with Bluetooth functionality. This is called Bluetooth Channel Sounding.

With PBR, an initiator device sends a signal to a reflector device, which sends it back. This process is repeated over several frequencies. The exact distance between the two devices is then calculated using the phase difference between the transmitted and received signals of the frequencies.

In addition, Bluetooth Channel Sounding uses a secondary distance measurement that also provides IT protection and cyber security. Round-Trip-Time (RTT) is a defense against sophisticated Man-in-the-Middle (MITM) relay attacks. With RTT, a Bluetooth-enabled initiator device sends cryptographically encrypted packets to a reflector device, which sends these packets back. The distance between the devices is then calculated based on the time it took for the packets to travel back and forth.

For which applications and in which scenarios would you prefer phase-based ranging (PBR) to round trip time (RTT) or vice versa?

The use of PBR and RTT in Bluetooth channel sounding is not an either-or decision. The two methods complement each other. Phase-based ranging (PBR) is used for precise distance measurement between two devices, while the main purpose of round-trip time (RTT) is attack-proof distance measurement. Data and information transmission via Bluetooth is thus secured against criminal eavesdropping and cyber data attacks, threats and leaks.

Which specific applications in the areas of IoT, industrial automation or embedded systems will benefit from the higher accuracy of distance detection through Bluetooth Channel Sounding?

Bluetooth RSSI already enabled developers to equip a so-called "Find My Device" with distance awareness. With PBR and RTT, the distance measurement between two Bluetooth products is no longer based on an approximate accuracy that deviates from the actual distance, but on an exact location. This enables companies and organizations to develop compelling location solutions, including the current "Find My" network functions for end users. These search for car keys, for example. Companies benefit from asset tracking systems, for example, which are already used in many commercial and industrial contexts.

The advantages of channel sounding are obvious: developers use it to ensure that a lock only opens when the authorized device is within a defined close range. This significantly reduces the risk of unauthorized access through man-in-the-middle (MITM) relay attacks on digital access solutions and keys. End customers can find their Bluetooth-enabled devices—such as hearing aids, keys or headphones—more quickly. Precise localization gives customers greater user convenience and a better device experience. Bluetooth Channel Sounding therefore offers significant added value.

In addition to Find My and Digital Key solutions, Bluetooth Channel Sounding has the potential to support many other systems on networked IoT devices. For example, Bluetooth Human Interface Devices (HID) such as computer mice, keyboards or game controllers can now automatically switch between active and inactive states depending on how far away they are from a Bluetooth-connected smartphone or tablet. This offers completely new, user-friendly and simplified interactions in our networked world of work and leisure with embedded systems, hybrid workstations and seamless Bluetooth connectivity of keyboards or when gaming.

For Bluetooth Human-Machine Interface (HMI) solutions in industrial environments, Channel Sounding increases the safety of personnel by only allowing the use of certain equipment from a safe distance. Similarly, Bluetooth device networks, such as for wireless lighting control, can use this new standard to self-optimize their configuration to improve system performance or save energy. These are just a few of the countless application scenarios.

How do multipath reflections affect the accuracy of distance estimation in conventional Bluetooth implementations? How are these effects mitigated by channel probing?

Challenging RF environments, including multipath, interference and back-pocket scenarios, typically affect the accuracy of distance measurement, regardless of the wireless technology used. For example, Wi-Fi, UWB and even GPS exhibit some performance degradation in challenging RF environments.

Adaptive Frequency Hopping (AFH) enables Bluetooth transmission, including Bluetooth Channel Sounding, to work reliably in difficult RF environments. This is because Bluetooth includes standardized functions and techniques for overcoming interference and for finding and using the clearest transmission path in the presence of various interferences such as multipath reflections.

For example, Bluetooth uses the frequency hopping spread spectrum (FHSS) method as AFH. Bluetooth divides the frequency band into smaller channels and quickly hops back and forth between these channels when transmitting packets. AFH can also adapt the hopping sequence. Channels that are noisy and busy are dynamically tracked and avoided when sending packets.

Bluetooth Channel Sounding can support devices with multiple antennas. More antennas provide alternative path options for interference mitigation. This helps to identify the shortest, most stable and secure path for exchanging communication signals even when multipath reflections are present. The use of multiple antennas also helps to maintain the accuracy of distance measurements in difficult RF environments with Bluetooth Channel Sounding.

What challenges can arise when integrating Bluetooth Channel Sounding into existing Bluetooth Low Energy (BLE) devices, especially in terms of power consumption, hardware functions or security implementation?

Bluetooth Channel Sounding has a completely new protocol stack, including a physical layer (PHY). This means that end devices may require an upgrade of the Bluetooth LE integrated circuit (IC) to support Bluetooth Channel Sounding. The power consumption is not significantly increased by Bluetooth Channel Sounding.

How does Bluetooth Channel Sounding improve security for applications such as digital keys and asset tracking?

The use of the second measurement method RTT provides an additional layer of security. The verification of PBR measurements increases IT protection against complex man-in-the-middle relay attacks. Security experts consider breaking through both protection methods undetected with a threat to be very complex. App engineers, developers and IT security architects who rely on this combined approach increase company and asset protection and improve the user experience (UX) at the same time. Security, process optimization and simpler workflows now go hand in hand with Bluetooth Channel Sounding.

How does the integration of cryptographically encrypted packets in RTT increase the security of Bluetooth Channel Sounding?

The integration of encrypted packets into round-trip time increases the security of Bluetooth channel probing by protecting the time data exchanged between devices from potential attacks and making it much more difficult for an attacker to compromise the RTT packet exchange between two Bluetooth devices. Scrambling encrypts the packets with a cryptographic key so that the data is unintelligible to anyone without the correct decryption key. This process prevents attackers from intercepting, delaying or manipulating the data packets to compromise the distance measurement between the devices—a common criminal technique in relay attacks.

Cryptographic encryption ensures that only the intended Bluetooth devices can decrypt and accurately use the time information. This preserves the integrity of the distance measurements and makes the Bluetooth connection much more secure. This applies in particular to sensitive data transfers with application scenarios such as digital keys and access control.

The Bluetooth core specification 6.0, which includes channel sounding, was introduced in September this year. When can we expect the first major implementations?

The first products such as chips, modules and stacks from Rohde & Schwarz or Nordic Semiconductor are expected to be launched on the market this year. The new Channel Sounding standard should then be available for Bluetooth-enabled end products such as cell phones, tags and trailers from 2025.

(sg)

This interview was first published on our sisterbrand www.ELEKTRONIKPRAXIS.de (German language)