BLUETOOTH LOW ENERGY, BEACONS AND RETAIL TABLE OF CONTENTS

BLUETOOTH LOW ENERGY, BEACONS AND RETAIL Announcements by Apple® and PayPal® have generated a frenzy and massive speculation within the industry about how they will change retail payments. Both certainly have the potential for disruption and new applications, but the reality is more complex. This white paper explains the technology and some of the factors which will shape their use and determine their eventual success. Erik Vlugt VP, Product Marketing Twitter: @ErikVlugt VERIFONE HEADQUARTERS 2099 Gateway Place, Suite 600, San Jose CA 95131 Phone 408.232.7800 • Fax 408.232.7811 • www.verifone.com © 2013 VeriFone. All rights reserved. VeriFone and the VeriFone Logo are either trademarks or registered trademarks of VeriFone in the United States and/or other countries. All other trademarks or brand names are the properties of their respective holders. All features and specifications are subject to change without notice. Reproduction or posting of this document without prior VeriFone approval is prohibited. TABLE OF CONTENTS Bluetooth Low Energy – the Background .............................................................................. 3 Beacons – the Underlying Technology .................................................................................. 4 PayPal Beacon ......................................................................................................................... 7 iOS7 .......................................................................................................................................... 7 Beacon Suppliers and Practical Issues .................................................................................. 8 Indoor Location and Mapping ................................................................................................10 Geofencing ..............................................................................................................................10 Proximity .................................................................................................................................10 Notification ..............................................................................................................................11 Limitations...............................................................................................................................11 Conclusion ..............................................................................................................................12 Page 2 October 23, 2013 BLUETOOTH LOW ENERGY, BEACONS AND RETAIL BLUETOOTH LOW ENERGY – THE BACKGROUND ® The specification for Bluetooth Smart, also known as Bluetooth low energy (BLE), was released in June of 2010. Although bearing the Bluetooth name, it is a completely new specification, designed to enable very low-power devices which can run for months or even years off small batteries such as coin cells. Its ® history dates back to 2001, when Nokia attempted to have it selected as the core technology for the IEEE 802.15.4 initiative for a low-power, short-range radio. The IEEE group chose the proposal that was ® to become ZigBee , but the Nokia effort continued internally, eventually emerging as their Wibree standard. The Bluetooth SIG struggled for several years trying to find a way to reduce the overall power of classic Bluetooth, and failed to reach a compromise that met the conflicting criteria for a truly low-power wireless standard. When Nokia offered the SIG the Wibree standard as a basis for this next generation, low-power solution in 2007, they used it as a starting point for what was to become BLE. It is important to realize that BLE is an entirely new standard. It is effectively a “blank sheet of paper design,” drawing on Nokia’s expertise, low-power radio techniques that had been developed by Nordic Semiconductor for the ANT™+ standard and the input of most of the world’s leading experts in low-power radio and protocols. The standards architects also took advantage of developments in wireless from the previous decade, with the aim of achieving a cost/performance point that would enable a market of hundreds of billions of accessory products. BLE’s connection with Bluetooth is that its design allows it to be implemented as an increment to the existing Bluetooth chips that are in mobile phones, laptops and tablets, sharing the same radio and a modified protocol stack. Although a new generation of chip is required to run BLE, these became available at the same time as a reduction in process geometry, meaning that these “dual-mode” chips are cheaper than the previous generation of single-mode Bluetooth classic chips. Although the chips in phones and tablets support both Bluetooth standards, BLE allows for the design of single-mode chips for use in low cost, battery powered peripheral devices. These are far simpler chips, which are increasingly highly integrated, containing the BLE radio, a processor running the BLE stack, and an additional processor and memory to run an application. All that’s needed to turn these into complete devices is the application code, a battery, a sensor and an enclosure. Page 3 October 23, 2013 Since 2010, dual mode chips have been built into in an increasing number of smartphones, tablets and ® ® laptops. Apple has incorporated them in all products since the iPhone 4s and iPad 3, they are in most ® new Android™ phones and Nokia has included them within all of its Windows phones. Both Apple and ® Google (Android) have released APIs for application developers. This has stimulated a renaissance in ® hardware design, including crowd-funded projects on sites like Kickstarter , where the majority of shortrange wireless projects now use BLE. BLE is already present in hundreds of millions of devices. That number is projected to increase by 1 billion additional devices each year for the next few years as smartphone and tablet penetration increases. BEACONS – THE UNDERLYING TECHNOLOGY Since Bluetooth’s launch, various companies have looked at the possibility of using Bluetooth for advertising – pushing information to phones when the phone comes within range of a fixed transmitter. Although several companies exist within this area, it is an awkward experience that leverages classic Bluetooth technology and it is poorly supported across phones. A major drawback is that classic Bluetooth cannot broadcast messages to unfamiliar phones – instead it needs to identify the presence of each individual phone and then send a targeted message. To prevent multiple messages appearing, the transmitter needs to keep a log of which phones it has previously sent messages to, incurring a considerable level of complexity and cost. BLE changes this by including a range of broadcast advertising modes. These are fundamental to the technology and used for the discovery and pairing process, essentially creating a much better user experience when pairing & connecting. However, they can also be used for general, unacknowledged advertisements that can be detected by any phone with its Bluetooth receiver turned on. It is this which makes low cost Beacons possible. PERIPHERALS AND CENTRALS The BLE standard defines two types of devices – a Peripheral device, which is assumed to be a lowpower device that exposes state or information, and a Central device. The Central is usually either a powered device, or one with significantly greater processing capability and a rechargeable battery, e.g. a phone or tablet. Unlike classic Bluetooth, the Peripheral and Central are very asymmetric in their resource needs, with the standard being designed to minimize the complexity, power requirements and costs of the Peripheral. In most cases, a Peripheral device spends the majority of its life asleep, only waking when it needs to send data. Page 4 October 23, 2013 SCANNERS AND ADVERTISERS Advertising is the first thing that BLE devices do when they’re turned on. A peripheral uses advertising packets to broadcast information that any other BLE device within range can hear. To listen to these, Central devices implement a Scanner mode, in which they listen for these advertisements. Both devices move from an idle state to that of either an advertiser or a scanner. The BLE standard divides the 2.4GHz spectrum into thirty-nine 2.0 MHz wide channels. Thirty-six of these are reserved for data, only used by devices that have paired with each other. The remaining three channels are used for advertisements. These three channels were specifically chosen to avoid the main ® channels used by Wi-Fi access points, to minimize interference. When a peripheral wants to broadcast, it starts an advertising event, where the same packet of information is transmitted sequentially on each of the three advertising channels. Devices operating as scanners will detect one of these, and pass the information it contains to the higher level protocol stack and application. ADVERTISING PACKETS This is where we get to the value of the specification, at least as far as location and advertising is concerned. Although the primary aim of advertising packets within the specification is to allow for the discovery of devices and make a secure connection, they also permit small amounts of data to be transmitted for any other device to hear. There are four different types of advertising packets defined, of which three are of interest. These are: • Non-connectable Advertising, where a device transmits a string of data, but will not respond to any request and cannot make a connection. This is the most common mode for beacons and can be • implemented using only a transmitter, with no receiver. Discoverable Advertising is similar, but a scanning device can request more information. This option allows a second packet of data to be sent to an application without the need to make a connection. Discoverable advertising provides the ability to request more data. Although potentially useful, most beacons would send information in a non-connectable advertisement packet directing a central device to access further information from a secondary source, such as a website accessible • via a cellular or Wi-Fi link. Discoverable advertising cannot be used to initiate a connection. • make a connection, which may be short term or permanent. General Advertising, where, in addition to the options above, a scanner can request that the beacon There is a fourth mode, known as Directed Advertising, which is used to quickly re-establish a previously negotiated connection. This is not relevant to beacons, and is not currently supported in iOS7. Page 5 October 23, 2013 Advertising packets consist of a header and a maximum of 27 bytes of advertising data. This can contain multiple items, each grouped as a triplet of an identifying byte defining the data format, the length of the contents, and the content. Defined formats include the signal strength, a local name, the Bluetooth service, configuration flags and manufacturer specific information. iBEACONS Initially, one of the driving use cases for the development of BLE was proximity, which used a signal strength measurement to determine when two devices move out of range of each other. Supported by Nokia, this evolved into the Proximity profile. However, it is targeted at devices that have established a connection, generating an alert when the link budget falls below a preset level. Despite having an associated use case of location and positioning, efforts within the Bluetooth SIG to adopt a profile for this application lost momentum. This has given a number of companies the opportunity to define their own proprietary profiles. In July, these were largely made irrelevant when Apple announced its iBeacon ® specification as part of iOS7, effectively discrediting any previous attempt to define a beacon profile. Apple iBeacon defines four data elements or identifiers residing within the advertising packets of compliant iBeacons. They are: • A Proximity ID, which is a unique 128bit string that identifies the beacon. This may be unique to an iBeacon, but is more likely to relate to a store, or even chain of stores. Continuing that • example, within a store, individual iBeacons can be distinguished by: • including department or even aisle. Identifiers, a number of identifiers that could define a number of relevant location parameters The Transmitted Signal Strength. This is a Bluetooth defined advertising element, which can be interpreted in conjunction with the signal strength to determine the approximate distance to the beacon. The iBeacon specification classifies these into one of three categories - close, intermediate or far away. ® One of the best ways to think about an iBeacon packet is as a wireless QR code. The advantage of an iBeacon packet, as we will see below, is that it can initiate an application response on an iOS7 phone, without any user intervention. An iBeacon transmits these packets on a regular basis, typically once per second. There is no reason why it can’t transmit different packets of advertising data at different times, or alternate the content. More complex applications may emerge as we start seeing actual implementations. Page 6 October 23, 2013 PAYPAL BEACON PayPal announced their PayPal Beacon shortly after Apple’s iBeacon announcement. It is a far more sophisticated system than the one described by Apple. iBeacon only requires simple transmitters, although the needs of installation and device management probably mean they will be more complex. In contrast, the PayPal Beacon requires a connection with the smartphone, which is then authenticated by a remote PayPal server. From the limited amount of released information, the process appears to be: 1. The PayPal Beacon advertises its presence, presumably using General Advertising packets. A phone running the PayPal application then makes a secure connection to the PayPal Beacon and identifies itself. 2. The PayPal Beacon also includes a Wi-Fi connection, which passes the phone details to a PayPal server. This starts a secure end-to-end authentication with the phone. User data is encrypted and passed back to the phone. This is used to check the user in to the store. 3. Once checked in, details of the authorized PayPal user are then passed to POS systems within the store. 4. When the user goes to pay, they further “authenticate” themselves using: a. A 4-digit randomly generated passcode that is sent to the phone and entered into the payment device by the user b. A QR code that is displayed on the phone, which can be scanned c. A picture the customer presents to the clerk who compares it with a stored profile picture It is not clear whether PayPal intends to open up the protocol and apps to general application developers. This may be unlikely as the system is 100 present focused on financial transactions at this time. However, they are currently asking application developers to submit ideas. iOS7 By itself, iBeacon is not particularly interesting. It is a very simple use of the BLE standard and many companies have already announced similar beacons. What will provide the real impact, are the features of iOS7. In iOS7, Apple added a feature that permits a phone to scan and detect advertisements from iBeacons in the background, passing up information and starting an application only when they are found. This has a profound effect on the user experience. Once the app is loaded on the phone, it can remain dormant until an appropriate iBeacon is discovered. iBeacon advertisements can be filtered and directed to specific apps, or used to initiate actions within PassBook. All of this takes place with no user intervention and minimal impact on battery life. It opens up the opportunity for “silent” apps that harvest user data and Page 7 October 23, 2013 send it to a server for value-added analysis. However, although iOS7 enables background applications, most application developers are likely to encourage users to interact with the apps, as they see the app as their brand. This suggests there may be a divergence between shopping apps residing on the phone and data-centric applications, which rely on real time server analysis. Apple devices supporting BLE and iOS7 can themselves act as iBeacons. It remains to be seen what applications may leverage this, but it is more likely in the social apps area. BEACON SUPPLIERS AND PRACTICAL ISSUES The concept of using BLE beacons to transmit coordinates or advertising messages is not new. It has been publicized since the early days of the standard as a major potential application. As a result, a number of companies have already grown up supplying this form of beacon, notably Estimote, Roximity, and indoo.rs. DEVICE MANAGEMENT Introducing iBeacons into a retail environment poses two practical challenges: • • How to install them, i.e. entering a unique set of information into each beacon? And How to maintain them, particularly in terms of software updates Both of these require a method of sending information to program or update the iBeacon. This can be done manually, by plugging it into a commissioning tool – typically a laptop, or wirelessly using some form of Over the Air (OTA) upgrade. Whatever the method, from the simplicity of a peer-2-peer connection between beacon and commissioning tool, to a wider device management infrastructure, it needs to be done securely. There is currently no standardized way of doing this. It will be one way in which iBeacon manufacturers differentiate their offering. However, for a large store, which might have hundreds or thousands of iBeacons, it is a very serious consideration. It will have an impact on the price of the beacons and the overall cost of ownership. The actual technology portion of a BLE iBeacon is low. The management capability cost is likely to be significantly higher. PayPal Beacon appears to have addressed this by incorporating a Wi-Fi backhaul for authentication, which can also be used for updating and device management. Page 8 October 23, 2013 PLACEMENT AND INTERFERENCE BLE is designed to coexist with other transmitters in the 2.4GHz band, most notably Wi-Fi. iBeacons only use the three advertising channels, which have been chosen specifically to avoid the standard Wi-Fi channels. The transmissions are very short and robust to interference. However, careless installation next to Wi-Fi access points will likely result in problems. If iBeacons are positioned on metal shelves, or if the iBeacons are placed behind metal stands, there will be a level of attenuation, which may result in inaccurate triangulation within apps that use them for location. This is largely an education issue for installers and retailers, but needs to be addressed. An additional challenge is posed for beacons that transmit a specific location and that need to be installed at a predetermined, fixed location to allow a mapping application to triangulate with them. SECURITY Advertisements from BLE Beacons are not secure. By their nature they are open and can be read by any device. As all of the data in the iBeacon is readable and is repeated in each consecutive transmission, it is possible for hackers to capture and replay it, emulating the beacon either using their phone, or by programming a small, low cost beacon placed elsewhere in the store. Sending incorrect or spurious information is a lower risk. Unless it has meaning for the phone, it should be discarded by the application. There will almost certainly be cases where this happens. Whether it will be destructive or a short term nuisance is yet to be determined. PayPal has taken a more robust approach, where the Beacon is purely the start of a complex security negotiation. This is not likely to be hacked, nor is it likely that it would be disrupted by copies of beacons. APPLICATIONS OF iBEACONS The big question is, “What will iBeacons do for retail?” There are some obvious applications, which are detailed below, along with some less obvious ones. All of them have the potential to change the way in which consumers and retailers interact with each other. Beacons will certainly have an impact on loyalty schemes, which now have the potential for microsegmentation. Once retailers can access the information from customers’ apps, it takes us into a world that is no longer restricted to knowing what someone buys, but one in which retailers can see how they buy. Many of the application areas are similar, relying on the ability to detect the distance from a beacon. iOS7 provides features that can use this information in a number of different ways, hence applications can be divided into some distinct, albeit closely related areas. Page 9 October 23, 2013 INDOOR LOCATION AND MAPPING The simplest application is indoor mapping. Here beacons provide location information, which a user app can utilize to guide them through a store or indoor public space. Nokia is taking a conventional approach, using advertisements that transmit standard location information (lat, long and elevation). This works well with their existing Nokia Maps applications, effectively adding an indoor element to an existing API. Because this data is constant and fits an established industry, it can easily be used by developers to generate other applications. As well as indoor guidance, it allows an app to save a breadcrumb trail of the user’s path, which can be uploaded and analyzed, either to understand the user’s decision-making process, or to validate the efficiency of the store layout. Apple’s recent purchase of indoor mapping company WiFiSLAM, along with their internal mapping solution, suggests they also have an eye on iBeacons for location. By using multiple beacons, applications can triangulate to determine position more precisely. Although technically feasible, the greater the accuracy, the more processing power is required, and the greater the impact on battery life. GEOFENCING Geofencing is a special form of location, where devices use beacons to limit or check the area in which a user is moving. Within iOS7 there is a geofencing function, where an application can instruct the device to check whether it remains within a defined range of a beacon or set of beacons and then alert an application if it moves outside that range. The advantage inferred by this is that the ranging function operates in the background, consuming very little power until it detects that the geofencing parameters have moved out of the defined range, at which point it alerts the application. The specific use of this functionality is unclear but it could include route planning and monitoring throughout a retail establishment. PROXIMITY Unlike the Bluetooth SIG and Nokia’s take on proximity, most beacon suppliers, including Apple, have a simpler view, which is to detect when a central device comes within range of a beacon. This provides the most straightforward customer engagement application, which is “Welcome to the store” or “Welcome to the electronics department.” Page 10 October 23, 2013 Writing an app to display a message on a phone is trivial and of very limited use. But the underlying alert can trigger far more subtle interactions. This is the starting point of the PayPal beacon system, where the user is signed into the store. While PayPal take a secure approach, with back-end authentication, it’s easy to see other applications emerging which interact with data preloaded into a phone app, or accessed via an alternative data link to download web or server based information. As the transmit power of beacons can be turned down to enable a very low range, this can be very selective – down to a specific area within a specific department. As more Beacons are deployed, many with very limited range, the order in which they are detected provides an accurate breadcrumb trail of how a consumer has progressed around a store. For supermarkets, it gives information on how they have walked through the store, providing valuable information on aisle usage. For department or clothing stores, it indicates how long users have stayed in each section and how often they may have returned to the same point. A hole in this argument is that the store only knows the routes of the user if they can access the beacon data recorded on the phone, as the beacons themselves have no way of locating the phone. This implies that the user has downloaded an application on their phone, which uploads their beacon trail to a server, which runs analytics to make value decisions in real time. This real-time consumer data is the crown jewel of beacon technology and will probably be fiercely fought over, as stores and third party applications vie for the users’ attention and ownership of their data. Whoever manages to own it will be in possession of data that will tell them not what consumers buy, but how they buy. NOTIFICATION So far, the applications of BLE only need simple transmit only beacons. Once beacons are connected to a network to provide device management, they can potentially transmit alternative data in their advertising packets to push messages or offers to previously identified users. While this is possible, it requires a degree of real-time feedback and needs to be treated with care. As explained above, messages from beacons can easily be picked up and replicated by others, so it is difficult to send an offer to a subgroup of customers within the store. Individual promotions can be sent over an alternative network – either Wi-Fi or cellular, but that complicates the applications and back-end delivery mechanism LIMITATIONS Much of the enthusiasm for beacons has been fueled by the fact that Apple has attempted to own the initiative. The real innovation, as stated above, is not the beacon, but the background routines in iOS7 that allow Apple devices to interact with beacons with minimal power consumption. Page 11 October 23, 2013 Android devices can support the same applications, but currently all of the scanning is performed by the Android application. This takes considerably more power and is likely to be less convenient for consumers. In time they will probably provide the same functionality, but in the short-to-medium term it means that most innovation will happen around iPhones. Nokia will add a BLE stack upgrade for their most recent phones, but have no timescale to provide a user API. This is a third party stack and not a native Microsoft solution. It is being introduced as an interim solution to prevent Nokia falling even further behind the market leaders in terms of BLE applications. Presumably any of their beacon applications will remain proprietary until Microsoft releases its own Windows Mobile solution. CONCLUSION Beacons and beacon applications are about to emerge in retail. How much of its success will be hype and how much disruption it causes remains to be seen. What is apparent is that the Apple effect, coupled with some innovative app developers and the availability of beacons from many companies provides all of the ingredients for major innovation. Retailers should keep a careful eye on this innovation as it can drive the opportunity for increased customer engagement. BLE should be perceived as an exciting new enabling technology that has the ability to affect many aspects of the retail customer experience. The applications for BLE will include payments but BLE by itself it should not be viewed as a direct alternative to existing cards, NFC, EMV, or other mobile wallet schemes. BLE can be the enabler for a number of new ways to interact and pay in the store but it is unlikely to instantly replace any existing technology. Instead, it is likely to be positioned as a complementary technology to add GPS-style and “check-in” functionality to new and existing payment schemes. With regard to payment, BLE makes store check-in and intelligent interaction much easier to implement. The fundamental challenge with regard to the consumer authentication is not natively addressed by BLE, which is why PayPal added the PIN and barcode authentication. Apple will likely look to Touch ID™ as a technology to authenticate users as well. As the enabler of commerce, VeriFone is happy to discuss BLE and related technologies with you to help determine the best solution for your specific environment. Please contact your VeriFone representative for more information. Page 12 October 23, 2013