There are two kinds of security levels: authentication and authorization.

1. Authentication: It verifies who is at the other end of the link. In Bluetooth this is achieved by the authentication procedure based on the stored link key or by the pairing procedure. To meet different requirements on availability of services without user intervention, authentication is performed after determining what the security level of the requested service is. Thus, authentication cannot be performed when the ACL link is established.

The authentication is performed when a connection request to a service is submitted. The following procedure is used (Refer fig.1)

1.The connect request to L2CAP is sent.

2.L2CAP requests access from the security manager.

3.The security manager enquires the service database.

4.The security manager enquires the device database.

5.If necessary, the security manager enforces the authentication and encryption procedure.

6.The security manager grants access, and L2CAP continues to set up the connection.

Authentication can be performed in both directions: client authenticates server and vice versa.

2. Authorization: When one device is allowed to access the other, the concept of trust comes into existence. Trusted devices are allowed access to services. While, on the contrary, untrusted devices may require authorization based on user interaction before access to services is granted.

There are two kinds of device trust levels:

(a) Trusted device: A device with a fixed relationship (paired) that has trusted and unrestricted access to all services.

(b) Untrusted device: This device has been previously authenticated, a link key is stored, but the device is not marked as trusted in the device database.

An unknown device is also an untrusted device. No security information is available for this device.

For services, the requirement for authorization, authentication, and encryption are set independently (although some restrictions apply). The access requirements define three security levels, i.e

(a) Services that require authorization and authentication — automatic access is only granted to trusted devices. Other devices need a manual authorization.

(b) Services that require authentication only — authorization is not necessary.

(c) Services open to all devices — authentication is not required, no access approval is required before service access is granted.