Bluetooth mesh networking

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
Bluetooth mesh networking
Developed byBluetooth SIG
IntroducedJuly 13, 2017 (2017-07-13)
IndustryLighting, IoT
Physical range100-1000 meters (depending on mesh relaying configuration)

Bluetooth mesh networking, conceived in 2015,[1] adopted on July 13, 2017 (2017-07-13)[2] is a protocol based upon Bluetooth Low Energy that allows for many-to-many communication over Bluetooth radio.

It has been defined in Mesh Profile Specification[3] and Mesh Model Specification.[4]


Communication is carried in the messages that may be up to 384 bytes long, when using Segmentation and Reassembly (SAR) mechanism, but most of the messages fit in one segment, that is 11 bytes. Each message starts with an opcode, which may be a single byte (for special messages), 2 bytes (for standard messages), or 3 bytes (for vendor-specific messages).

Every message has a source and a destination address, determining which devices process messages. Devices publish messages to destinations which can be single things / groups of things / everything.

Each message has a sequence number that protects the network against replay attacks.

Each message is encrypted and authenticated. Two keys are used to secure messages: (1) network keys – allocated to a single mesh network, (2) application keys – specific for a given application functionality, e.g. turning the light on vs reconfiguring the light.

Messages have a time to live (TTL). Each time message is received and retransmitted, TTL is decremented which limits the number of "hops", eliminating endless loops.

Bluetooth Mesh is a flood network. It's based on the nodes relaying the messages: every relay node that receives a network packet that authenticates against a known network key that is not in message cache, that has a TTL ≥ 2 can be retransmitted with TTL = TTL - 1. Message cache used to prevent relaying messages recently seen.

Bluetooth Mesh has a layered architecture, with multiple layers as below.

Layer Functionality
Model Layer It defines a standard way to exchange application specific messages. For example, a Light Lightness Model defines an interoperable way to control lightness. There are mandatory models, called Foundation Models, defining states and messages needed to manage a mesh network.
Access Layer It defines mechanism to ensure that data is transmitted and received in the right context of a model and its associated application keys.
Upper Transport Layer It defines authenticated encryption of access layer packets using an application (or device specific key). It also defines some control messages to manage Friendship or to notify the behavior of node using Heartbeat messages.
Lower Transport Layer This layer defines a reliable (through a Block Acknowledgement) Segmented transmission upper layer packets, when a complete upper layer packet can't be carried in a single network layer packet. It also defines a mechanism to reassemble segments on the receiver.
Network Layer This layer defines how transport packets are addressed over network to one or more nodes. It defines relay functionality for forwarding messages by a relay node to extended the range. It handles the network layer authenticated encryption using network key.
Bearer Layer It defines how the network packets are exchanged between nodes. Mesh Profile Specification defines BLE advert bearer and BLE GATT bearer. Mesh Profile defines Proxy Protocol, through which mesh packets can be exchanged via other bearers like TCP/IP.

Theoretical limits[edit]

It's yet to be determined what are the practical limits of Bluetooth Mesh technology. There are some limits that are built into the specification, though:

Limit for a network Value Remarks
Maximum number of nodes 32 767 The limit is 32768 addresses and while a node may occupy more than one address, practical limit is most likely lower
Maximum number of groups 16 384

Number of virtual groups is 2128.

Maximum number of scenes 65 535
Maximum number of subnets 4 096
Maximum TTL 126

Mesh models[edit]

As of version 1.0 of Bluetooth Mesh specification, the following standard models and model groups have been defined:

Foundation models[edit]

Foundation models have been defined in the core specification. Two of them are mandatory for all mesh nodes.

  • Configuration Server (mandatory)
  • Configuration Client
  • Health Server (mandatory)
  • Health Client

Generic models[edit]

  • Generic OnOff Server, used to represent devices that do not fit any of the model descriptions defined but support the generic properties of On/Off
  • Generic Level Server, keeping the state of an element in a 16-bit signed integer
  • Generic Default Transition Time Server, used to represent a default transition time for a variety of devices
  • Generic Power OnOff Server & Generic Power OnOff Setup Server, used to represent devices that do not fit any of the model descriptions but support the generic properties of On/Off
  • Generic Power Level Server & Generic Power Level Setup Server, including a Generic Power Actual state, a Generic Power Last state, a Generic Power Default state and a Generic Power Range state
  • Generic Battery Server, representing a set of four values representing the state of a battery
  • Generic Location Server & Generic Location Setup Server, representing location information of an element, either global (Lat/Lon) or local
  • Generic User/Admin/Manufacturer/Client Property Server, representing any value to be stored by an element
  • Generic OnOff Client & Generic Level Client
  • Generic Default Transition Time Client
  • Generic Power OnOff Client & Generic Power Level Client
  • Generic Battery Client
  • Generic Location Client
  • Generic Property Client


  • Sensor Server & Sensor Setup Server, representing a sensor device. Sensor device may be configured to return a measured value periodically or on request; measurement period (cadence) may be configured to be fixed or to change, so that more important value range is being reported faster.
  • Sensor Client

Time and scenes[edit]

  • Time Server & Time Setup Server, allowing for time synchronization in mesh network
  • Scene Server & Scene Setup Server, allowing for up to 65535 scenes to be configured and recalled when needed.
  • Scheduler Server & Scheduler Setup Server
  • Time Client, Scene Client & Scheduler Client


  • Light Lightness Server & Light Lightness Setup Server, representing a dimmable light source
  • Light CTL Server, Light CTL Temperature Server & Light CTL Setup Server, representing a CCT or "tunable white" light source
  • Light HSL Server, Light HSL Hue Server, Light HSL Saturation Server & Light HSL Setup Server, representing a light source based on Hue, Saturation, Lightness color representation
  • Light xyL Server & Light xyL Setup Server, representing a light source based on modified CIE xyY color space.
  • Light LC (Lightness Control) Server & Light LC Setup Server, representing a light control device, able to control Light Lightness model using an occupancy sensor and ambient light sensor. It may be used for light control scenarios like Auto-On, Auto-Off and/or Daylight Harvesting.
  • Light Lightness Client, Light CTL Client, Light HSL Client, Light xyL Client & Light LC Client


Provisioning is a process of installing the device into a network. It is a mandatory step to build a Bluetooth Mesh network.

In the provisioning process, a provisioner securely distributes a network key and a unique address space for a device. Provisioning protocol uses P256 Elliptic Curve Diffie-Hellman Key Exchange to create a temporary key to encrypt network key and other information. This provides security from a passive eavesdropper. It also provides various authentication mechanisms to protect network information, from an active eavesdropper who uses Man-In-The-Middle attack, during provisioning process.

A key unique to a device known as "Device Key" is derived from elliptic curve shared secret on provisioner and device during the provisioning process. This device key is used by the provisioner to encrypt messages for that specific device.

Security of provisioning process has been analyzed in a paper presented during IEEE CNS 2018 conference.[5]

The provisioning can be performed using a Bluetooth GATT connection or advertising using the specific bearer.[3]

Terminology used in Bluetooth mesh networking specification[edit]

  • Destination: The address to which a message is sent.
  • Element: An addressable entity within a device.
  • Model: Standardized operation of typical user scenarios.
  • Node: A provisioned device.
  • Provisioner: A node that can add a device to a mesh network.
  • Relay: A node able to retransmit messages.
  • Source: The address from which a message is sent.


Qualified Bluetooth mesh implementations
Name Submitter Qualification date QDID Type
Bluetooth Stack for Embedded Systems - MESH profile[6] Silvair, Inc. July 18, 2017 98880 Profile Subsystem
Qualcomm Bluetooth Mesh[7] Qualcomm Technologies International, Ltd. July 18, 2017 98856 Profile Subsystem
Silvair Mesh Models[8] Silvair, Inc. July 26, 2017 99282 Profile Subsystem
Wireless Gecko Mesh Profile[9] Silicon Laboratories September 21, 2017 101318 Profile Subsystem
CYW-MESH 1.0[10] Cypress Semiconductor Corporation October 3, 2017 101726 Component (Tested)
Qualcomm Bluetooth Mesh Model[11] Qualcomm Technologies International, Ltd. October 20, 2017 102243 Profile Subsystem
EtherMind Bluetooth Protocol Stack, 5.0 (Single Mode) + Mesh[12] Mindtree Limited January 24, 2018 106544 Component (Tested)
Telink SIG Mesh SDK[13] Telink Semiconductor February 1, 2018 106546 Profile Subsystem
TOSHIBA Bluetooth_stack_mesh-1[14] Toshiba Corporation February 13, 2018 104143 Component (Tested)
AMICCOM Mesh Profile[15] AMICCOM Electronics Corporation March 14, 2018 109370 Profile Subsystem
Amiccom Bluetooth Mesh Model[16] AMICCOM Electronics Corporation March 30, 2018 110168 Profile Subsystem
Airoha SIG mesh[17] Airoha Technology Corp. April 2, 2018 110202 Profile Subsystem
Marvell Mesh stack v1.0[18] Marvell Technology Group April 27, 2018 110569 Component (Tested)
nRF5 SDK for Mesh [19] Nordic Semiconductor May 2, 2018 111537 Profile Subsystem
Realtek Bluetooth 5 Mesh Solution[20] Realsil Microelectronics Inc July 27, 2018 115668 Profile Subsystem
STSW-BNRG-Mesh[21] STMicroelectronics August 2, 2018 116029 Profile Subsystem
RDA BT Host 5.0[22] RDA Microelectronics, Inc. September 13, 2018 115860 Profile Subsystem
JYMC-MESH-1[23] Shanghai Frequen Microelectronics Co., Ltd. October 10, 2018 119229 End Product
RW-BLE-MESH[24] CEVA, Inc. October 31, 2018 119268 Component (Tested)
ARM Ltd Cordio Mesh[25] ARM Ltd December 11, 2018 116593 Profile Subsystem
Samsung SLSI Bluetooth Mesh[26] Samsung Electronics Co., Ltd. December 21, 2018 122442 Profile Subsystem
Bluelet Host Stack V12[27] Barrot Technology Limited December 25, 2018 123056 Component (Tested)
ESP BLE Mesh v0.6[28] Espressif Systems (Shanghai) Pte. Ltd. January 14, 2019 124137 Profile Subsystem
BK3435 BLE Core Spec 5.0 with MESH[29] Beken Corp March 12, 2019 127926 End Product
Actions Mesh Profile Subsystem[30] Actions (Zhuhai) Technology Co., Limited March 21, 2019 127646 Profile Subsystem
  • Official Linux Bluetooth protocol stack BlueZ supports Mesh Profile, from release version 5.47[31], by providing meshctl tool to configure mesh devices.
  • Apache Mynewt NimBLE supports Bluetooth mesh from release version 1.2.0[32]


  1. ^ "Get ready for Bluetooth mesh! | Bluetooth Technology Website". Retrieved 2017-07-06.
  2. ^ "Low Energy: Mesh | Bluetooth Technology Website". Retrieved 2017-07-18.
  3. ^ a b "Mesh Profile Bluetooth® Specification" (PDF download). Bluetooth Technology Website. 2017-07-13. Retrieved 2017-07-18.
  4. ^ "Mesh Model Bluetooth® Specification" (PDF download). Bluetooth Technology Website. 2017-07-13. Retrieved 2017-07-18.
  5. ^ Adomnicai, A.; Fournier, J. J. A.; Masson, L. (2018-05-30). "Hardware Security Threats Against Bluetooth Mesh Networks". 2018 IEEE Conference on Communications and Network Security (CNS): 1–9. doi:10.1109/CNS.2018.8433184. ISBN 978-1-5386-4586-4.
  6. ^ "QD ID 98880 | Launch Studio - Listing Details". Retrieved 2017-11-15.
  7. ^ "QD ID 98856 | Launch Studio - Listing Details". Retrieved 2017-11-15.
  8. ^ "QD ID 99282 | Launch Studio - Listing Details". Retrieved 2017-11-15.
  9. ^ "QD ID 101318 | Launch Studio - Listing Details". Retrieved 2017-11-15.
  10. ^ "QD ID 101726 | Launch Studio - Listing Details". Retrieved 2017-11-15.
  11. ^ "QD ID 102243 | Launch Studio - Listing Details". Retrieved 2017-11-15.
  12. ^ "QD ID 106544 | Launch Studio - Listing Details". Retrieved 2018-03-05.
  13. ^ "QD ID 106546 | Launch Studio - Listing Details". Retrieved 2018-03-05.
  14. ^ "QD ID 104143 | Launch Studio - Listing Details". Retrieved 2018-03-05.
  15. ^ "QD ID 109370 | Launch Studio - Listing Details". Retrieved 2018-04-05.
  16. ^ "QD ID 110168 | Launch Studio - Listing Details". Retrieved 2018-04-05.
  17. ^ "QD ID 110202 | Launch Studio - Listing Details". Retrieved 2018-04-05.
  18. ^ "QD ID 110569 | Launch Studio - Listing Details". Retrieved 2018-05-03.
  19. ^ Systems, eZ. "nRF5 SDK for Mesh / Bluetooth Low Energy / Products / Home - Ultra Low Power Wireless Solutions from NORDIC SEMICONDUCTOR". Retrieved 2018-05-03.
  20. ^ "QD ID 115668 | Launch Studio - Listing Details". Retrieved 2018-09-15.
  21. ^ "QD ID 116029 | Launch Studio - Listing Details". Retrieved 2018-09-15.
  22. ^ "QD ID 115860 | Launch Studio - Listing Details". Retrieved 2018-09-15.
  23. ^ "QD ID 119229 | Launch Studio - Listing Details". Retrieved 2018-11-07.
  24. ^ "QD ID 119268 | Launch Studio - Listing Details". Retrieved 2018-11-07.
  25. ^ "QD ID 116593 | Launch Studio - Listing Details". Retrieved 2018-12-21.
  26. ^ "QD ID 122442 | Launch Studio - Listing Details". Retrieved 2018-12-21.
  27. ^ "QD ID 123056 | Launch Studio - Listing Details". Retrieved 2018-12-21.
  28. ^ "QD ID 124137 | Launch Studio - Listing Details". Retrieved 2019-01-24.
  29. ^ "QD ID 127926 | Launch Studio - Listing Details". Retrieved 2019-04-14.
  30. ^ "QD ID 127646 | Launch Studio - Listing Details". Retrieved 2019-04-14.
  31. ^ "BlueZ » Blog Archive » Release of BlueZ 5.47". Retrieved 2017-10-27.
  32. ^ "RN-1.2.0 - Apache Mynewt - Apache Software Foundation". Retrieved 2018-07-02.