A communication method, communication device, and computer-readable storage medium.

Description

1 / 57 A communication method, communication device, and computer-readable storage medium. TECHNICAL FIELD

[001] The modalities of the present application relate to the field of communications technologies and, more specifically, to a communication method and related device. BACKGROUND

[002] Ultra-wideband (UWB) technology is increasingly being used for indoor positioning and other location services, such as access control and asset location. To address the long-range range measurement use case, UWB multi-millisecond (MMS) range measurement was introduced. The main idea behind MMS range measurement is to distribute UWB range measurement frames into multiple fragments, with each fragment transmitted over multiple milliseconds (ms), thus overcoming the emitted energy limit of 37 nanojoules (nJ) per ms. By distributing the range measurement frame across multiple fragments, with each fragment transmitted in one millisecond, the total energy of the range measurement frame can be several times greater, considerably increasing the range measurement range.This means that when block-based mode is used for MMS range measurement, the control frame transmission time would be limited to 1 ms, which also results in very limited available space for the actual control information in the control frame. In order to overcome this limitation, a compressed Physical Layer Service Data Unit (PSDU) format that uses a private address was introduced for control frames.

[003] In the MMS reach measurement session, when an initial compressed PSDU, such as an advertisement poll frame (ADVPOLL) or a poll frame (POLL), is to be transmitted, the initiator generates an RPA_prand pseudorandom number and uses the number Petition 870260056057, dated 10 / 06 / 2026, page 9 / 135 2 / 57 random RPA_prand to generate the private RPA_hash address. The responder verifies the initiator's identity based on the RPA_prand and RPA_hash received from the initiator. If the responder intends to participate in a reach measurement session with the initiator, the responder transmits the response frame bearing the same RPA_hash.

[004] In general, only the ADV-POLL frame and the POLL frame carry the RPA_hash and the RPA_prand, while the remaining frames carry only the RPA_hash of the preceding frame. That is, it is trivial for any device that receives the ADV-POLL frame or the POLL frame to copy the RPA_hash and transmit a response frame carrying the RPA_hash as its private address. In other words, the initiator cannot determine whether the response frame is truly from the authorized responder. SUMMARY

[005] Modalities of this application provide a method of communication and related device, which enable an initiator in an MMS range measurement session to verify that a frame is indeed from an authorized responder.

[006] According to a first aspect, this request provides a method of communication. The method is applied to a first responder, and the method includes: To receive a first frame from an initiator to begin a range measurement process; to generate a first private address based on the first frame and information related to the identity of the first responder; and to transmit a second frame carrying the first private address to the initiator.

[007] For example, information related to the identity of the first responder can uniquely identify the identity of the first responder. A frame to initiate a reach measurement process includes a frame to initiate the initialization and configuration phase or a frame to initiate the measurement cycle phase. Petition 870260056057, dated 10 / 06 / 2026, page 10 / 135 3 / 57

[008] The second frame can be a response frame to the first frame, or the second frame can be a frame transmitted after the response frame to the first frame. For example, the first frame is an ADV-POLL frame, and the second frame is an ad response frame (ADV-RESP). Alternatively, the first frame is a POLL frame, and the second frame is a response frame (RESP). Alternatively, the first frame is a POLL frame, and the second frame is a report frame (RPRT).

[009] For example, generating a first private address based on the first frame and information related to the identity of the first responder includes: verifying the identity of the initiator based on the first frame; and generating the first private address based on information related to the identity of the first responder, when the initiator's identity verification is successful.

[010] It should be noted that information relating to the identity of the first responder is known to the initiator.

[011] According to the aforementioned technical solution, since a responder's private address is generated based on the responder's identity, the initiator is enabled to identify whether the transmitter of the compressed frame is an authorized responder while maintaining the transmitter's privacy. Meanwhile, since there is no need to add new fields to the compressed frame, the size of the compressed frame can be minimized.

[012] In a possible implementation, information related to the identity of the first responder includes any of: a public address of the first responder, MMS reach measurement configuration requested by the first responder, a first random number generated by the first responder, or a unique Identity Resolution Key (IRK) for the initiator and the first responder. Petition 870260056057, dated 10 / 06 / 2026, page 11 / 135 4 / 57

[013] The public address of the first responder may include either an extended in-band address and an out-of-band (OOB) public address.

[014] It is essential for the responder to provide its public address during the session setup phase and / or carry the MMS range measurement configuration in a compressed frame sent to the initiator in order to obtain the range measurement results. Therefore, in the aforementioned technical solution, the first responder uses the public address, or the MMS range measurement configuration as the identity-related information to generate a private address, eliminating the need for additional signaling exchange to notify the initiator of its identity information, which helps reduce signaling overhead in range measurement sessions. Furthermore, compared to static identity-related information, random numbers can be frequently updated, thus taking the first random number as the first responder's identity-related information can help improve communication security.Taking the IRK, which is unique between the initiator and the first responder, as the information related to the first responder's identity can reduce the complexity of generating private addresses.

[015] In one possible implementation, the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; the generation of a first private address based on the first frame and information related to the identity of the first responder comprises: generating the first private address based on the second random number and the information related to the identity of the first responder.

[016] Generating the first private address based on the second random number and information related to the identity of the first responder includes: generating the first private address Petition 870260056057, dated 10 / 06 / 2026, page 12 / 135 5 / 57 based on information related to the identity of the first responder after verifying the identity of the initiator using the second random number and the second private address; and / or generate the first private address using the first random number and the information related to the identity of the first responder combined with a pre-negotiated IRK between the initiator and the first responder as inputs to a suitable hash function, and the suitable hash function is pre-negotiated between the initiator and the first responder. In the first case, the first frame also carries the second private address.

[017] For example, when the information related to the identity of the first responder includes either a public address of the first responder, MMS reach measurement configuration requested by the first responder, and a first random number generated by the first responder, generating a first private address based on the second random number and the information related to the identity of the first responder includes: generating the first private address based on the second random number, the information related to the identity of the first responder, and a first IRK, and the first IRK is pre-negotiated between the initiator and the first responder.

[018] For example, the first IRK may include: a common IRK shared between the initiator and multiple responders, and the multiple responders include the first responder; or an IRK exclusive to the initiator and a first responder.

[019] According to the aforementioned technical solution, the first responder generates a private address based on a random number carried in the compressed frame received from the initiator, which helps to increase the difficulty of attacking a session between an initiator and an authorized responder, because only responders who know the random number can generate a private address that can be verified with Petition 870260056057, dated 10 / 06 / 2026, page 13 / 135 6 / 57 success by the initiator.

[020] In one possible implementation, the second private address is generated based on information related to the identity of a second responder; generating a first private address based on the first frame and information related to the identity of the first responder includes: generating the first private address when it is determined that the second responder and the first responder are the same responder.

[021] According to the aforementioned technical solution, it is possible for the initiator to select a particular responder to participate in the MMS range measurement.

[022] In one possible implementation, transmitting a second frame carrying the first private address to the initiator includes: transmitting the second frame carrying the first private address and the first random number to the initiator.

[023] Alternatively, the first responder generates a new random first number when transmitting the second frame.

[024] According to the aforementioned technical solution, carrying the first random number in the second frame enables the initiator to know the identity of the first responder, which can prevent the risk of static identity information being stolen and improve communication security.

[025] In a possible implementation, the first frame is a reach measurement initialization (RIM) message frame carrying a list associated with responders that are scheduled to participate in MMS reach measurement, and the responders include the first responder; generating a first private address based on information related to a first responder's identity includes: generating the first private address when it is determined that the first responder is scheduled for the first access slot among multiple access slots based on the list.

[026] According to the aforementioned technical solution, Petition 870260056057, dated 10 / 06 / 2026, page 14 / 135 7 / 57 when responders receive the RIM, only the responder scheduled for the first access slot generates and transmits its private address, while the other responders are on hold until they receive the POLL frame.

[027] In a possible implementation, the second frame includes any of: an ADV-RESP frame, a RESP frame, or an RPRT frame.

[028] The first frame includes an ADV-POLL frame or a POLL frame.

[029] According to the aforementioned technical solution, carrying a private address related to the responder's identity in the frame transmitted by the responder to the initiator helps the initiator authenticate the responder's identity.

[030] In one possible implementation, the first frame or the second frame is a protected frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any of: a private address carried by the protected frame, a random number used to generate the private address, or a time period for transmission of the protected frame.

[031] For example, the time period can be an Insider block structure, or an Outside block structure. Specifically, if the time period is an Insider block structure, the time period can indicate a slot, round, and block in which the protected frame is transmitted.

[032] According to the aforementioned technical solution, encrypting part of the content in the second frame based on a Nonce can help improve the security of the information carried in the second frame.

[033] In a possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the protected frame. Petition 870260056057, dated 10 / 06 / 2026, page 15 / 135 8 / 57

[034] According to the aforementioned technical solution, based on the time period for transmission of the protected frame, it is possible to generate the frame counter for the Nonce used to protect or unprotect the frames.

[035] In one possible implementation, the first Nonce also includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[036] For example, block structure indication information includes a 1-bit field, which is set to zero in a compressed frame transmitted outside the block structure and is set to one in a protected compressed frame transmitted within the block structure.

[037] According to the aforementioned technical solution, block structure indication information can ensure that the Nonce used for protected frames transmitted inside and outside the block structure is never reused.

[038] In one possible implementation, the second frame additionally carries a private address of the initiator.

[039] For example, the initiator's private address includes the second private address.

[040] According to the aforementioned technical solution, including both the initiator's private address and the responder's private address in the second frame simplifies identity verification for the responder. For example, if the initiator's private address ported in the second frame does not match the initiator's private address ported in the first frame, the initiator will determine that the responder's identity verification is unsuccessful; otherwise, the initiator will further verify the responder's identity based on the responder's private address. Furthermore, porting the initiator's private address in the second frame makes it easier for the initiator to identify the IRK to be used for address verification. Petition 870260056057, dated 10 / 06 / 2026, page 16 / 135 9 / 57 private from the responder.

[041] In one possible implementation, the method additionally includes: receiving a third frame carrying time offset information from the initiator, and the time offset information indicates a time offset from a transmitted range measurement start frame (SOR).

[042] According to the aforementioned technical solution, when UWB channel coordination is active, it can make the responder aware of the SOR frame time shift.

[043] According to a second aspect, this request provides a method of communication. The method is applied to an initiator, and the method includes: Receive a second frame bearing a first private address from a first responder, and the first private address is associated with information related to the first responder's identity; generate a third private address based on the information related to the first responder's identity; and verify the first responder's identity by comparing the third private address with the first private address.

[044] Specifically, whether the second frame is truly from the first authorized responder is determined when the third private address is the same as the first private address.

[045] In a possible implementation, information related to the identity of the first responder includes any of the first responder's public address, MMS reach measurement configuration requested by the first responder, a first random number generated by the first responder, and a unique IRK for the initiator and the first responder.

[046] In a possible implementation, the method additionally includes: transmitting a first frame to initiate a range measurement process, where the first frame carries a Petition 870260056057, dated 10 / 06 / 2026, page 17 / 135 10 / 57 second random number, and the second random number is associated with a second private address of the initiator; and the generation of a third private address based on information related to the identity of the first responder comprises: the generation of a third private address based on information related to the identity of the first responder comprises: generating the third private address based on the second random number and information related to the identity of the first responder.

[047] For example, the third private address is generated using the first random address and the information related to the identity of the first responder combined with a pre-negotiated IRK between the initiator and the first responder as inputs to a suitable hash function. The suitable hash function is pre-negotiated between the initiator and the first responder.

[048] In one possible implementation, the method additionally includes: generating a fourth private address based on information related to the identity of a second responder; and transmitting a frame carrying the fourth private address to the second responder.

[049] In some forms, the first responder and the second responder are the same responder.

[050] Optionally, the method additionally includes: transmitting a frame bearing the fourth private address to the first responder. It should be noted that only the second responder can successfully verify the fourth private address because the fourth private address is generated based on the identity of the second responder.

[051] In a possible implementation, the second frame additionally carries the first random number, generating a third private address based on information related to the identity of the first responder includes: generating the third private address based on the first random number. Petition 870260056057, dated 10 / 06 / 2026, page 18 / 135 11 / 57

[052] In one possible implementation, the method additionally includes: transmitting a first frame to initiate a range measurement process for the first responder, and the first frame is a RIM frame carrying a list associated with responders that are scheduled to participate in the MMS range measurement, and the responders include the first responder.

[053] In a possible implementation, the second frame includes any of: an ADV-RESP frame, a RESP frame, or an RPRT frame.

[054] In one possible implementation, the first frame or the second frame is a protected frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any of: a private address carried by the protected frame, a random number used to generate the private address, or a time period for transmission of the protected frame.

[055] In a possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the protected frame.

[056] In one possible implementation, the first Nonce additionally includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[057] In one possible implementation, the second frame additionally carries a private initiator address; the method additionally includes: verifying the identity of the first responder based on a private initiator address.

[058] In one possible implementation, the method additionally includes: transmitting a third frame carrying time offset information to the first responder, and the time offset information indicates an offset Petition 870260056057, dated 10 / 06 / 2026, page 19 / 135 12 / 57 of the time of a transmitted SOR frame.

[059] For the beneficial effects of the second aspect, reference is made to the first aspect. Details are not described again in this document.

[060] According to a third aspect, this application provides a communication apparatus, including: a receiving unit, configured to receive, from an initiator, a first frame to initiate a range measurement process; a generating unit, configured to generate a first private address based on the first frame and information relating to the identity of the first responder, and the information relating to the identity of the first responder is known to the initiator; and a transmitting unit, configured to transmit a second frame carrying the first private address to the initiator.

[061] In a possible implementation, information related to the identity of the first responder includes any of: a public address of the first responder, MMS reach measurement configuration requested by the first responder, a first random number generated by the first responder, or a unique IRK for the initiator and the first responder.

[062] In one possible implementation, the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generation unit is configured to: generate the first private address based on the second random number and information related to the identity of the first responder.

[063] In one possible implementation, the second private address is generated based on information related to the identity of a second responder, the generation unit is configured to: generate the first private address when it is determined that the second responder and the first responder are the same responder. Petition 870260056057, dated 10 / 06 / 2026, page 20 / 135 13 / 57

[064] In one possible implementation, the transmission unit is configured to: transmit the second frame carrying the first private address and the first random number to the initiator.

[065] In one possible implementation, the first frame is a RIM frame carrying a list associated with responders that are scheduled to participate in an MMS reach measurement, and the responders include the first responder; and the generation unit is configured to: generate the first private address when it is determined that the first responder is scheduled for the first access slot among multiple access slots based on the list.

[066] In a possible implementation, the second frame includes any of: an ADV-RESP frame, a RESP frame, or an RPRT frame.

[067] In one possible implementation, the first frame or the second frame is a protected frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any of: a private address carried by the protected frame, a random number used to generate the private address, or a time period for transmission of the protected frame.

[068] In one possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the protected frame.

[069] In one possible implementation, the first Nonce additionally includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[070] In one possible implementation, the second frame additionally carries a private address of the initiator. Petition 870260056057, dated 10 / 06 / 2026, page 21 / 135 14 / 57

[071] In one possible implementation, the receiving unit is further configured to: receive a third frame carrying time offset information from the initiator, and the time offset information indicates a time offset of a transmitted SOR frame.

[072] According to a fourth aspect, this application provides a communication apparatus comprising: a receiving unit, configured to receive a second frame bearing a first private address of a first responder, wherein the first private address is associated with information relating to the identity of the first responder; a generating unit, configured to generate a third private address based on the information relating to the identity of the first responder; and a verifying unit, configured to verify the identity of the first responder by comparing the third private address with the first private address.

[073] In a possible implementation, information related to the identity of the first responder includes any of: a public address of the first responder, MMS reach measurement configuration requested by the first responder, a first random number generated by the first responder, or a unique IRK for the initiator and the first responder.

[074] In one possible implementation, the communication device also includes a transmission unit configured to: transmit a first frame to initiate a range measurement process, and the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generation unit is configured to: generate the third private address based on the second random number and information related to the identity of the first responder.

[075] In a possible implementation, the generation unit is further configured to: generate a fourth private address with Petition 870260056057, dated 10 / 06 / 2026, page 22 / 135 15 / 57 based on information related to the identity of a second responder; and the transmission unit is further configured to: transmit a frame containing the fourth private address to the second responder.

[076] In one possible implementation, the second frame additionally carries the first random number, the generation unit is configured to: generate the third private address based on the first random number.

[077] In one possible implementation, the transmission unit is further configured to: transmit a first frame to initiate a range measurement process for the first responder, and the first frame is a RIM frame carrying a list associated with responders that are scheduled to participate in the MMS range measurement, and the responders include the first responder.

[078] In a possible implementation, the second frame includes any of: an ADV-RESP frame, a RESP frame, or an RPRT frame.

[079] In one possible implementation, the first frame or the second frame is a secure frame that carries encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for transmission of the secure frame.

[080] In a possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the protected frame.

[081] In one possible implementation, the first Nonce additionally includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure. Petition 870260056057, dated 10 / 06 / 2026, page 23 / 135 16 / 57 block.

[082] In one possible implementation, the second frame also contains a private address of the initiator; the verification unit is further configured to: verify the identity of the first responder based on the private address of the initiator.

[083] In one possible implementation, the transmission unit is further configured to: transmit a third frame carrying time offset information to the first responder, and the time offset information indicates a time offset of a transmitted SOR frame.

[084] According to a fifth aspect, a communication apparatus is provided including a processor and a memory. The processor is connected to the memory. The memory is configured to store instructions, and the processor is configured to execute the instructions. When the processor executes the instructions stored in memory, the processor is enabled to perform the method in any possible implementation of the first aspect or the second aspect.

[085] According to a sixth aspect, this application provides a communication system, which includes communication apparatus in any possible implementation of the third aspect, as well as communication apparatus in any possible implementation of the fourth aspect.

[086] According to a seventh aspect, this request provides a computer-readable storage medium which includes instructions. When the instructions are executed on a processor, the processor is enabled to perform the method in any possible implementation of the first aspect or the second aspect.

[087] According to an eighth aspect, this application provides a computer program product, which includes computer program code. When the computer program code is executed on a computer, the computer is enabled to Petition 870260056057, dated 10 / 06 / 2026, page 24 / 135 17 / 57 implement the method in any possible implementation of the first aspect or the second aspect.

[088] It should be noted that all or part of the above computer program code may be stored in a primary storage medium. The primary storage medium may be packaged together with the processor or separately from the processor.

[089] According to a ninth aspect, this application provides a chip system, which includes a memory and a processor. The memory is configured to store a computer program, and the processor is configured to invoke the computer program from memory and execute the computer program, so that an electronic device in which the chip system is disposed accomplishes the method in any possible implementation of the first aspect or the second aspect. DESCRIPTION OF THE DRAWINGS

[090] FIG. 1 illustrates the transmission of compressed frames in an MMS range measurement session.

[091] FIG. 2 is a schematic flowchart of a communication method according to an embodiment of the present application.

[092] FIG. 3 is a schematic flowchart of another method of communication according to an embodiment of the present application.

[093] FIG. 4 is a schematic diagram of an ADV-POLL frame or a POLL frame.

[094] FIG. 5 is a schematic diagram of an ADV-RESP panel or a RESP panel according to an embodiment of the present application.

[095] FIG. 6 is a schematic diagram of another ADVRESP frame or another RESP frame according to an embodiment of the present application.

[096] FIG. 7 is a schematic diagram of yet another ADV-RESP frame or yet another RESP frame according to an embodiment of the present application.

[097] FIG. 8 is a schematic diagram of a SOR frame. Petition 870260056057, dated 10 / 06 / 2026, page 25 / 135 18 / 57

[098] FIG. 9 is a schematic diagram of a shielded compressed frame according to an embodiment of the present application.

[099] FIG. 10 is a schematic diagram of a Nonce according to an embodiment of the present application.

[100] FIG. 11 is a schematic diagram of a method for constructing a Nonce according to an embodiment of the present application.

[101] FIG. 12 is a schematic flowchart of yet another method of communication according to an embodiment of the present application.

[102] FIG. 13 is a schematic flowchart of yet another method of communication according to an embodiment of the present application.

[103] FIG. 14 is a schematic flowchart of yet another method of communication according to an embodiment of the present application.

[104] FIG. 15 is a schematic flowchart of yet another method of communication according to an embodiment of the present application.

[105] FIG. 16 is a schematic diagram of a RIM frame according to an embodiment of the present application.

[106] FIG. 17 is a schematic flowchart of yet another method of communication with selective MMS range measurement according to an embodiment of the present application.

[107] FIG. 18 is a schematic block diagram of a communication device according to an embodiment of the present application.

[108] FIG. 19 is a schematic block diagram of another communication device according to an embodiment of this application.

[109] FIG. 20 is a schematic block diagram of yet another communication device according to an embodiment of Petition 870260056057, dated 10 / 06 / 2026, p. 26 / 135 19 / 57 present request. DESCRIPTION OF THE MODALITIES

[110] For ease of understanding, the following illustrates an MMS range measurement session.

[111] As shown in FIG. 1, an MMS range measurement session may include an initialization and configuration phase followed by one or more distance measurement cycles. During the initialization and configuration phase, frames are transmitted on an initialization channel, while during the measurement cycles, frames are transmitted on a range measurement channel. Although it is possible to use the same channel as both the initialization channel and the range measurement channel, it is more likely that one or more well-known channels will be used as the initialization channel.

[112] In the initialization and configuration phase, initiators and responders can negotiate range measurement configuration. An initiator opportunistically transmits ADV-POLL frames at times and intervals at its discretion, while responder(s) can opportunistically listen for received ADV-POLL frames and respond with an ADV-RESP frame if the responder intends to participate in a range measurement session with the initiator. Once the initiator has received an ADV-RESP frame, it transmits an SOR frame that provides the time offset at which the first distance measurement cycle will begin.

[113] A measurement cycle comprises a range measurement control phase, a range measurement phase, and an optional measurement reporting phase. A range measurement control phase begins at the start of a distance measurement cycle. An initiator starts the range measurement control phase by transmitting a POLL frame to a responder at the start of the first range measurement slot of a range measurement round. A responder that successfully receives the POLL frame transmits a RESP frame back to the initiator. The frames Petition 870260056057, dated 10 / 06 / 2026, page 27 / 135 20 / 57 POLL and RESP allow the initiator and responder to achieve time and frequency synchronization. An initiator can also include other control information in the POLL frame for the responder. In the range measurement phase, the initiator and responder can exchange zero or more UWB range measurement sequence fragments (RSFs) and optionally one or more UWB range measurement integrity fragments (RIFs). RSFs are used to perform range measurement while RIFs are used to check the integrity of the range measurement measurements. After the initiator or responder completes receiving all UWB fragments for the range measurement phase, the reporting phase begins, in which the initiator and / or responder generate a range measurement report and transmit the RPRT frame carrying the measurement report to the peer device.

[114] MMS range measurement comes in two types: 1) UWB-only MMS range measurement, in which the control frames as well as the range measurement fragments are transmitted using UWB; and 2) Narrowband-assisted MMS range measurement (NBA-UWB), in which the range measurement fragments are transmitted using UWB, while the control signals are transmitted using narrowband.

[115] Frame transmission in MMS range measurement sessions is based on a block-based time structure. As shown in FIG. 1, frames are transmitted outside a block structure during the initialization and configuration phase, and frames are transmitted within a block structure during measurement cycles. In the block-based time structure, each range measurement block consists of an integer number of range measurement rounds, where a range measurement round is a period of duration sufficient to complete an entire distance measurement cycle involving the set of devices with the capability to Petition 870260056057, dated 10 / 06 / 2026, page 28 / 135 21 / 57 Enhanced Range Measurement (ERDEVs) participating in range measurement exchange. Here, when a frame is said to be transmitted or received Within the block structure, this means that both the initiator and the responder are aware of the block-based time structure and are in sync. However, if one or both are not aware of the block-based time, the frame is said to be transmitted or received Outside the block structure. Each range measurement round is further subdivided into an integer number of range measurement slots where a range measurement slot is a time period of sufficient duration for the transmission of at least one range measurement frame (RFRAME). Block-based mode uses a structured timeline where the range measurement block structure is periodic by default.

[116] The following describes the technical solutions in this application with reference to the attached drawings.

[117] FIG. 2 illustrates a flowchart of one embodiment of a communication method. The method can be applied to an MMS range measurement process. An initiator can be a device that starts a UWB exchange by transmitting an exchange message. A responder can be a device that responds to the message received from the initiator and participates in the UWB exchange.

[118] S110: The initiator transmits a first frame to a first responder.

[119] The first frame carries a second random number and a second private address of the initiator, where the second private address is associated with the second random number. For example, the second private address is generated using a hash function on the second random number combined with a second IRK, and the second IRK is pre-negotiated between the initiator and the first responder.

[120] In some possible implementations, the first frame is used to initiate a range measurement process. By Petition 870260056057, dated 10 / 06 / 2026, page 29 / 135 22 / 57 For example, the first frame could be an ADV-POLL frame, a POLL frame, and a RIM frame. The RIM frame can be considered a variation of the POLL frame.

[121] S120: The first responder generates a first private address based on the first frame and information related to the identity of the first responder.

[122] Information relating to the identity of the first responder is known to the initiator. For example, information relating to the identity of the first responder is pre-negotiated between the initiator and the first responder, or information relating to the identity of the first responder is the first responder informs the initiator. For the former situation, information relating to the identity of the first responder includes either a public address of the first responder and a unique IRK for the initiator and the first responder (e.g., IRK-RI). For the latter situation, information relating to the identity of the first responder includes either an MMS range measurement configuration requested by the first responder and a first random number generated by the first responder.

[123] For example, the public address of the first responder includes an extended in-band address or an OOB public address.

[124] For example, the extended in-band address may include an extended 8-octet medium access control (MAC) address. The OOB public address may include a 6-octet Bluetooth MAC address. In some embodiments, the first responder's public address may also include other communication addresses that uniquely identify the first responder.

[125] For example, the requested MMS range measurement configuration of the first responder may include at least one of the following: UWB physical layer (PHY) configuration, UWB MAC configuration, narrowband (NB) PHY configuration, Petition 870260056057, dated 10 / 06 / 2026, page 30 / 135 23 / 57 and MAC NB configuration.

[126] Optionally, the first responder generates a first private address based on the first frame and information related to the first responder's identity includes: the first responder generates the first private address based on the second random number and information related to the first responder's identity.

[127] In some embodiments, the first responder generates the first private address based on the second random number and the information related to the identity of the first responder includes: the first responder generates the first private address using the first random number and the information related to the identity of the first responder combined with a first IRK pre-negotiated between the initiator and the first responder as inputs to a suitable hash function; or the first responder generates the first private address using the first random number and the information related to the identity of the first responder as inputs to a suitable hash function. The suitable hash function was pre-negotiated between the initiator and the first responder.

[128] For example, the first private address can be generated using an equation like this: Hash = AH(IRK, random number), where Hash represents the first private address, AH() represents a hash function, IRK can be the first IRK or the unique IRK for the initiator and the first responder, and random number can be the second random number or the first random number.

[129] For example, the first IRK includes: a common IRK shared between the initiator and multiple responders, and the various responders include the first responder; or an IRK exclusive to the initiator and a first responder.

[130] Optionally, the second IRK and the first IRK are the same, or the second IRK and the first IRK are in pairs. Petition 870260056057, dated 10 / 06 / 2026, page 31 / 135 24 / 57

[131] In other modes, the first responder generates the first private address based on the second random number and the information related to the identity of the first responder includes: the first responder generates the first private address based on the information related to the identity of the first responder after verifying the identity of the initiator using the second random number and the second private address.

[132] For example, the first responder verifies the initiator's identity using the second random number and the second private address, including: the first responder verifies the initiator's identity using the second IRK, the second random number, and the second private address. Specifically, the first responder generates a local private address from the second random number using the first IRK. The first responder will determine that the initiator's identity verification is successful if the local private address matches the second private address ported in the first frame, otherwise the first responder will discard the first frame.

[133] S130: The first responder transmits a second frame carrying the first private address to the initiator.

[134] For example, the second frame may be one of an ADV-RESP frame and a RESP frame, and an RPRT frame.

[135] In some possible implementations, if the first private address is generated based on the first random number, the second frame will carry the first private address and the first random number.

[136] In some possible implementations, the second frame also carries the second private address.

[137] S140: The initiator verifies the identity of the first responder based on the first private address.

[138] For example, the initiator verifies the identity of the first responder using information related to the identity of the first responder and the first IRK, which is Petition 870260056057, dated 10 / 06 / 2026, page 32 / 135 25 / 57 pre-negotiated between the initiator and the first responder. Specifically, the initiator generates a local private address (e.g., a third private address) of the specific random number using the first IRK and the identity-related information of the first responder. The initiator will determine that the identity verification of the first responder is successful if the local private address matches the first private address ported in the second frame; otherwise, the initiator will discard the second frame.

[139] For example, the specific random number may include the first random number or the second random number. The specific random number includes the first random number when the first private address is generated based on the first random number. The specific random number includes the second random number when the first private address is generated based on the second random number.

[140] In some possible implementations, the initiator generates the second private address based on information related to the identity of a second responder. The first responder generates a local private address based on information related to the identity of the second responder. If the first responder is able to successfully verify the second private address, then the first responder determines that the second responder is the same as the first responder and generates the first private address.

[141] In some possible implementations, the initiator generates a fourth private address based on information related to the identity of a second responder and transmits frames carrying the fourth private address to the second responder and the first responder. It should be noted that only the second responder can successfully verify the fourth private address because the fourth private address is generated based on the identity of the second responder. Petition 870260056057, dated 10 / 06 / 2026, page 33 / 135 26 / 57

[142] Optionally, the first frame or the second frame is a secure frame that carries encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for transmission of the secure frame.

[143] For example, the first responder generates the first Nonce based on the ID field and private address field of the second frame as well as a slot, round and block in which the second frame is transmitted.

[144] Optionally, the first Nonce includes frame counter information, and the frame counter information indicates the slot, round and block in which the second frame is transmitted.

[145] Optionally, the first Nonce also includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[146] It should be noted that the first frame and the second frame are compressed frames in the present application. The compressed frame is either a compressed PSDU or an IEEE Standard 802.15.4 frame using the compressed Header Information Element (Header IE) format.

[147] In some possible implementations, a controller assumes the role of the initiator while the controlled is assigned the role of the first responder, however it is also possible that the controlled may be assigned the role of the initiator while the controller assumes the role of the first responder. It should be noted that the controller is a device used to control the UWB session and set the session parameters, and the controlled is a device that uses the session parameters received from the controller to participate in the UWB session.

[148] The method of communication provided in modalities of Petition 870260056057, dated 10 / 06 / 2026, p. 34 / 135 27 / 57 The present application in a one-to-one MMS range measurement session is described below in detail with reference to FIGS. 3 to 12. The embodiments shown in FIGS. 3 to 12 are illustrated with a controller as an initiator and a controlled as a responder as examples.

[149] FIG. 3 illustrates a schematic flowchart of a one-to-one MMS range measurement communication method according to an embodiment of the present application. The method presented in FIG. 3 includes a session setup phase and steps S210 to S270.

[150] An MMS range measurement session begins with a controller and a controlled party performing a session setup during which long-term session parameters such as UWB channel number, preamble codes, block structure, and so on are negotiated. Specifically, at least one IRK will also be provided by the controller to the controlled party to resolve or create private addresses during session setup. In addition, for NBA-UWB MMS range measurement, narrowband-related parameters such as NB channel number and MMS fragment number can also be negotiated during session setup. Additionally, the initiator and responder roles can also be assigned during session setup.

[151] For example, at least one IRK may include at least one of the first IRK and the second IRK in the above mode.

[152] Understandably, long-term parameters are not expected to change during an MMS range measurement session.

[153] In contrast, parameters related to a measurement cycle such as round / slot durations, number of MMS fragments, reporting modes, etc. can be considered as short-term parameters and can be modified during an MMS range measurement session.

[154] Session configuration can be performed outside of Petition 870260056057, dated 10 / 06 / 2026, page 35 / 135 28 / 57 band, for example using Bluetooth radio or Wi-Fi, or it can also be done in band, for example using NB or UWB radio.

[155] Once the session has been set up, step S210 is performed.

[156] S210: An initiator transmits an ADV-POLL frame.

[157] For example, the initiator transmits ADV-POLL frames opportunistically at times and intervals at its discretion while responder(s) may opportunistically listen for received ADV-POLL frames. An ADV-POLL frame may carry a pseudorandom number RPA_prand-I-1 and its private address RPA_hash-I-1, and RPA_hash-I-1 may be considered as an example of the second private address in the above modality.

[158] For example, RPA_hash-I-1 can be computed and truncated to 24 bits using Equation 1:

[159] RPA_hash-I-1 = AES-128-ECB(key=IRK, data=(0xGGG...

[13] \\ RPA_prand-I-1[3])) % 2Λ24. Equation 1

[160] AES-128-ECB is a hash function, which can also be replaced by other hash functions. [n] indicates that its preceding parameter is n octets.

[161] The IRK can be a common pre-negotiated IRK, for example, IRK-B, between the initiator and the responder.

[162] A schematic diagram of an ADV-POLL frame is illustrated in FIG. 4. As shown in FIG. 4, an ADVPOLL frame consists of: a 1-octet message ID field, a 3-octet private address field carrying the Initiator's RPA_hash (e.g., RPA_hash-I-1), a 3-octet field carrying the Initiator's RPA_prand (e.g., RPA_prand-I-1), a 1-octet MessageControl field that determines the format of the MessageContent field, a variable-length MessageContent field whose format depends on the content of the MessageContent field, and a 2-octet cyclic redundancy check (CRC) field. The Initiator's RPA_hash may also be Petition 870260056057, dated 10 / 06 / 2026, page 36 / 135 29 / 57 is referred to as the initiator's RPA_hash or the initiator's private address. The initiator's RPA_prand may also be referred to as the initiator's RPA_prand or the initiator's random number.

[163] After receiving the ADV-POLL frame, the responder generates a local hash of RPA_prand-I-1 using the pre-negotiated IRK, such as IRK-B above. For example, the responder generates the local hash of RPA_prand-I-1 using IRK-B as input to Equation 1. Furthermore, if the local hash does not match the RPA_hash-I-1 carried in the ADV-POLL frame, the responder will discard the ADV-POLL frame; otherwise, the responder will determine that the initiator's identity verification was successful and then transmit an ADV-RESP frame to the initiator if the responder intends to participate in a reach measurement session with the initiator, as illustrated in step S220.

[164] S220: The responder transmits an ADV-RESP frame to the initiator.

[165] Specifically, the ADV-RESP frame carries a private address that can identify the responder, namely RPA_hash-R1, which is generated using information related to the responder's identity. RPA_hash-R-1 can be considered as an example of the first private address in the above modality.

[166] Once the initiator has received the ADVRESP frame, the initiator verifies the responder's identity based on the RPA_hash-R-1.

[167] In one embodiment, the information relating to the responder's identity may include the responder's public address. Responder MAC address, such as an 8-octet extended 802.15 MAC address, then RPA_hash-R-1 can be computed and truncated to 24 bits using Equation 2: RPA_hash-R-1 = AES-128-ECB(key=IRK, data=(0x000...[5] || Responder MAC Address [8] || RPA_prand-I-1]) % 2'24. Equation 2

[168] Furthermore, once the initiator has received the Petition 870260056057, dated 10 / 06 / 2026, page 37 / 135 In frame 30 / 57 ADV-RESP, the initiator generates a local hash for the responder using the responder's public address (e.g., an 8-octet extended 802.15 MAC address) combined with the RPA_prand-I-1 ported into ADV-POLL and using the IRK as inputs to Equation 2.

[169] In another embodiment, the information relating to the responder's identity may include MMS range measurement configuration requested by the responder, such as the various NB and UWB configuration requested by the responder in the ADVRESP frame, then RPA_hash-R-1 may be computed and truncated to 24 bits using the following Equation 3: RPA_hash-R-1 = AES-128-ECB(key=IRK, data=(0x00[1] || Config PHY UWB || Config MAC UWB || Config PHY NB || Config MAC NB || RPA_prand-I-1]) % 2Λ24. Equation 3

[170] Here, Config PHY UWB, Config MAC UWB, Config PHY NB, and Config MAC NB refer to the various configuration parameters carried over to the MessageContent field of the ADV-RESP frame.

[171] It should be noted that, as long as there is at least 1 bit difference in the configuration requested by different responders, the responder's private address will be unique and can be used to identify the responder in subsequent frames.

[172] Furthermore, once the initiator has received the ADV-RESP frame, the initiator generates a local hash for the responder using the configuration parameters ported in the MessageContent field of the ADV-RESP frame combined with RPA_prand-I-1 and using the IRK as inputs to Equation 3 above.

[173] In yet another embodiment, information relating to the responder's identity may include the responder's public address. Responder's OOB MAC address, such as a 6-octet Bluetooth MAC address, then RPA_hash-R-1 can be computed and truncated to 24 bits using Equation 4: Petition 870260056057, dated 10 / 06 / 2026, page 38 / 135 31 / 57 RPA_hash-R-1 = AES-128-ECB(key=IRK, data=(0x000...[7] ||, 6-octet Bluetooth MAC address [6] || RPA_prand-I-1]) % 2Λ24. Equation 4

[174] Furthermore, once the initiator has received the ADV-RESP frame, the initiator generates a local hash for the responder using the responder's public address (e.g., 6-octet Bluetooth MAC address) combined with RPA_prand-I-1 and using the IRK as inputs to Equation 4.

[175] In some possible implementations, the initiator would keep a record of the public address of the responder(s) during session setup.

[176] In yet another embodiment, the information relating to the responder's identity may include an IRK (e.g. IRKRI) of the IRK pairs (e.g. IRK-RI & IRK-IR) unique to the initiator and the first responder and used for frames transmitted by the responder to the initiator, then RPA_hashR-1 may be computed and truncated to 24 bits using Equation 5: RPA_hash-R-1 = AES-128-ECB(key=IRK-RI, data=(0xGG0...

[13] || RPA_prand-I-1 initiator]) % 2Λ24. Equation 5

[177] Furthermore, once the initiator has received the ADV-RESP frame, the initiator generates a local hash for the responder using IRK-RI combined with RPA_prand-I-1 as inputs to Equation 5.

[178] A schematic diagram of an ADV-RESP frame bearing the responder's private address (e.g., RPA_hash-R-1) generated by any of Equations 2 to 5 above is illustrated in FIG. 5. 5, an ADV-RESP frame is composed of: a 1-octet message ID field, a 3-octet field bearing the responder's private address (e.g., RPA_hash-R-1), a 1-octet MessageControl field that determines the format of the MessageContent field, a variable-length MessageContent field whose format depends on the content of the MessageContent field, and a Petition 870260056057, dated 10 / 06 / 2026, page 39 / 135 32 / 57 CRC field of 2 octets.

[179] In some embodiments, the ADV-RESP frame also carries the private address obtained from the ADV-POLL, which is the RPA_hash of the Initiator. A schematic diagram of an ADV-RESP frame carrying the private address of the responder and the private address of the initiator is illustrated in FIG. 6.

[180] Including both the Initiator's RPA_hash and the Responder's RPA_hash in the ADV-RESP frame makes it easier to identify the associated IRK and simplifies identity verification from the initiator to the responder. Specifically, if the Initiator's RPA_hash carried in the ADV-RESP frame does not match the Initiator's RPA_hash carried in the ADV-POLL frame, the initiator will determine that the responder's identity verification is unsuccessful; otherwise, the initiator will further verify the responder's identity based on the Responder's RPA_hash. The Responder's RPA_hash may also be referred to as the responder's RPA_hash or the responder's private address.

[181] In some modes, the information relating to the responder's identity may include the random number (e.g. RPA_prand-R-1) generated by the responder, so RPA_hashR-1 can be computed and truncated to 24 bits using Equation 6: RPA_hash-R-1 = AES-128-ECB(key=IRK, data=(0x000...

[13] || RPA_prand-R-1])) % 2Λ24. Equation 6

[182] For example, the responder generates its own RPA_prand-R-1 pseudorandom number using any suitable pseudorandom generator function.

[183] ​​In one embodiment, the responder generates the RPA_prand-R-1 when the responder has successfully verified the identity of the initiator.

[184] In another mode, the responder generates the RPA_prand-R1 each time the ADV-RESR and RESP frames are transmitted. Petition 870260056057, dated 10 / 06 / 2026, page 40 / 135 33 / 57

[185] In addition, the ADV-RESP frame also needs to carry the responder's random number if the RPA_hash-R-1 is generated using Equation 6, so that the initiator can verify the responder's identity. The schematic diagram of an ADV-RESP frame carrying the responder's private address and the responder's random number is illustrated in FIG. 7. Optionally, the frame shown in FIG. 7 may or may not carry the initiator's private address obtained from the ADV-POLL.

[186] It should be noted that the different formats of the ADV-RESP or RESP frames can be differentiated using different IDs for the frames, for example, 0x02 for the format shown in FIG. 5, 0x32 for the format shown in FIG. 6 and 0x42 for the format shown in FIG. 7 etc.

[187] It should be noted that the IRK used in Equations 2 to 4 and Equation 6 may be the first IRK in the previous form. For example, the IRK used in Equations 2 to 4 and Equation 6 may be a common IRK (e.g., IRK-B), or the IRK used in Equations 2 to 4 and Equation 6 may be one of the paired IRKs (e.g., IRKRI). Furthermore, Equations 2 to 6 may be considered as some specific examples of Hash = AH (IRK, random number).

[188] Furthermore, if the local hash for the responder does not match the RPA_hash-R-1 carried in the ADV-RESP frame, the initiator will discard the ADV-RESP frame; otherwise, the initiator will determine that the responder's identity verification was successful and then transmit an SOR frame to the responder, as illustrated in step S230.

[189] S230: The initiator transmits an SOR frame to the responder.

[190] Specifically, the SOR frame provides the time offset at which the first distance measurement cycle will begin. The SOR frame carries the same RPA_hash-I-1 contained in the ADV-POLL frame.

[191] A schematic diagram of a SOR frame is illustrated Petition 870260056057, dated 10 / 06 / 2026, page 41 / 135 34 / 57 in FIG. 8. As shown in FIG. 8, a SOR frame is composed of: a 1-octet message ID field, a 3-octet private address field that carries the Initiator's RPA_hash (e.g., RPA_hash-I-1), a 1-octet MessageControl field that determines the format of the MessageContent field, a variable-length MessageContent field whose format depends on the content of the MessageContent field, and a 2-octet CRC field. The SOR frame carries a time offset that indicates the time at which the measurement phase of the MMS range measurement will begin.

[192] S240: The initiator transmits a POLL frame to the responder.

[193] At the time indicated by the time offset in the SOR frame, the initiator transmits a POLL frame to the responder at the beginning of the first range measurement slot of a range measurement round.

[194] For example, the POLL frame shares the same format illustrated in FIG. 4 and carries a pseudo-random number RPA_prandI-2 and its private address, RPA_hash-I-2, which is generated using RPA_prand-I-2 and the IRK as inputs to Equation 1.

[195] Upon receiving the POLL frame, the responder verifies the initiator's identity based on the private address carried in the POLL frame. Reference is made to the verification method based on the ADV-POLL frame in S210 for the specific verification method. Details are not described again in this document.

[196] The responder will transmit a RESP frame to the initiator, as illustrated in step S250, when the initiator identity verification is successful.

[197] S250: The responder transmits a RESP frame to the initiator.

[198] Specifically, the RESP frame carries the responder's private address, such as RPA_hash-R-2. Reference is made to the detailed description in S220 for the method of generating the responder's private addresses, the RESP frame format, and the method of Petition 870260056057, dated 10 / 06 / 2026, page 42 / 135 35 / 57 verify the responder's identity based on the RESP frame by the initiator. The method is the same except that the pseudorandom number carried in the POLL frame (e.g., RPA_prandI-2) is used to generate the Responder's RPA_hash. In short, when generating RPA_hash-R-2 using an equation mentioned above, RPA_prand-I-1 in the related equation is replaced by RPA_prand-I-2. Details are not described again in this document.

[199] When the responder's identity verification is successful, the initiator starts the range measurement phase in which the initiator and responder exchange zero or more RSFs and optionally one or more RIFs.

[200] After the initiator or responder completes receiving all UWB fragments for the range measurement phase, the initiator and / or responder generate a range measurement report, and transmit the RPRT frame carrying the measurement report to the peer device as illustrated in steps S260 and S270.

[201] S260: The responder transmits an RPPT frame to the initiator.

[202] For example, the RPRT frame in this step shares the same format illustrated in FIG. 8 and carries a private address, RPA_hash-R-2, which is generated in step S250.

[203] S270: The initiator transmits an RPPT frame to the responder.

[204] For example, the RPRT frame in this step shares the same format illustrated in FIG. 8 and carries a private address, RPA_hash-I-2, which is generated in step S240.

[205] Considering the sensitive nature of some information carried in the above frames, a protected compressed frame is provided in the embodiment of this application to improve information security.

[206] It should be noted that the compressed frame protected in Petition 870260056057, dated 10 / 06 / 2026, page 43 / 135 36 / 57 This request is a compressed frame that is protected using a cryptographic operation such as authentication or encryption.

[207] FIG. 9 illustrates a schematic diagram of a shielded compressed panel. As shown in FIG. 9, the fields of a shielded compressed panel are as follows: 1. The ID field indicates the identity of the protected version of the compressed frame; for example, ID spaces 0x60 to 0x6F can be reserved for protected versions of compressed frames, where 0x60 represents the protected ADV-RESP frame, 0x61 represents the protected version of the SOR frame, and 0x65 and 0x66 represent the protected version of the RPRT frame transmitted by the initiator and responder, respectively. The RPRT frame can also be referred to as the REPORT frame.

[208] 2. A 3-octet private address field that carries the RPA_hash.

[209] 3. An optional 3-octet field that carries the RPA_prand. The field may be present only in certain frames (e.g., ADV-POLL or POLL) and absent in other compressed PSDUs (e.g., ADV-RESP, RESP, SOR, REPORT).

[210] 4. A 1-octet MessageControl field that determines the format of the MessageContent field.

[211] 5. A variable-length MessageContent field whose format depends on the content of the MessageContent field. All or part of the MessageContent field will be encrypted if a security level for encryption is chosen. If only part of the MessageContent field is encrypted, the subfields to be encrypted (also known as the private payload field) will be placed at the end of the MessageContent field while the subfields that are not encrypted (also known as the open payload field) are placed at the beginning of the MessageContent field.

[212] 6. A variable-length message integrity check (MIC) field replaces the CRC field. The Petition 870260056057, dated 10 / 06 / 2026, page 44 / 135 37 / 57 The MIC length depends on the security level. For example, the MIC length can be 0 octets, 4 octets, and 8 octets. When the MIC length is 0 octets, the frame is not protected and the field is used for the 2-octet CRC.

[213] In some possible implementations, all or part of the content in the MessageContent field can be encrypted by an authenticated encryption operation with associated data (AEAD) based on a Nonce.

[214] It should be noted that when security is enabled, one or more different IRK secret keys can be exchanged between the initiator and responder(s) used for the AEAD operation.

[215] The Nonce used for the AEAD transformation or inverse transformation of a protected compressed frame is illustrated in FIG. 10. This Nonce format can be used for compressed frames transmitted outside the block or inside the block structure. As shown in FIG. 10, the fields of a Nonce are as follows: 1. The RPA_hash field is defined for the RPA_hash field of the compressed frame to be protected or unprotected.

[216] 2. The RPA_prand field is set to the RPA_prand field of the compressed frame to be protected, if such a field exists, otherwise it is set to the RPA_prand that is used to generate the RPA_hash field of the compressed frame to be protected or unprotected.

[217] 3. The ID field is set to the ID field of the compressed frame to be protected or unprotected.

[218] 4. If a block structure exists and is known by both the transmitting and receiving devices (for example, within the block structure in FIG. 1), the Frame Counter field includes the Slot Index field, Round Index field, and Block Index field, which are defined as the indices of the slot, round, and block in which the frame is transmitted or received, respectively. If a block structure does not exist Petition 870260056057, dated 10 / 06 / 2026, page 45 / 135 38 / 57 and is either unknown by at least one of the transmitting or receiving devices (e.g., outside the block structure in FIG. 1), the Frame Counter field is reserved and set to 0. The information carried in the Frame Counter field can be considered as an example of frame counter information.

[219] 5. A 1-bit field called the Block Structure Indicator indicates whether the protected frame is transmitted inside or outside a block structure. For example, the Block Structure Indicator field is set to zero in a protected compressed frame transmitted outside the block structure and is set to one in a protected compressed frame transmitted inside the block structure. The information carried in the Block Structure Indicator field can be considered as an example of block structure indication information.

[220] 6. The Security Level field is an unsigned integer that must be set to the security level value negotiated during session setup.

[221] Furthermore, FIG. 11 illustrates how the Nonce is constructed for safety operation related to a protected compressed frame transmitted within the block structure according to an embodiment of the present application.

[222] Once a device is synchronized with the block structure, it knows the slot / round / block index where the compressed frame is transmitted or received, and it can construct the Frame Counter field of the Nonce; otherwise, the Frame Counter field is set to 0. For the example illustrated in FIG. 11, for an RPRT frame transmitted by the responder in slot m of round 1 of block 1, the Slot Index field, the Round Index field, and the Block Index field of the Frame Counter field of the Nonce are set separately to m, 1, and 1, corresponding to slot m, round 1, and block 1; while the Block Structure Indicator is set to one. The field Petition 870260056057, dated 10 / 06 / 2026, page 46 / 135 39 / 57 The RPA_hash and ID fields of the Nonce are copied from the RPA_hash and ID fields of the REPORT frame. However, since the RPA_prand field does not exist in the REPORT frame, the Nonce's RPA_prand field is set to the RPA_prand used to generate the RPA_hash field, for example, the RPA_prand carried over in the preceding POLL frame transmitted by the initiator. The Nonce Security Level is set to the appropriate security level, for example, the security level negotiated during session setup.

[223] Similarly, for a frame transmitted outside the block structure, for example, an SOR frame, the Nonce Frame Counter field is set to 0; while the Block Structure Indicator is set to zero. The Nonce RPA_hash field and Message ID field are copied from the RPA_hash field and the ID field of the SOR frame. Since the RPA_prand field does not exist in the SOR frame, the Nonce RPA_prand field is set to the RPA_prand used to generate the RPA_hash field, i.e., the RPA_prand carried in the preceding ADV-POLL frame transmitted by the initiator. The Nonce Security Level is set to the appropriate security level, for example, the security level negotiated during session setup.

[224] For example, to protect or unprotect compressed frames, the procedures given in 9.3.5 (AEAD transformation data representation) or 9.3.6 (AEAD inverse transformation data representation) in the 802.15.4-2020 specification are reused, except that for compressed frames the MAC header (MHR) is replaced by the ID field, the RPA_hash field, the RPA_prand field (if present), and the MessageControl field.

[225] While in most protected compressed frames, the entire MessageControl field is considered the Private Payload Field and will be encrypted if any security level with encryption is negotiated, however for protected RPRT compressed frames (SECURE-RPRT), only selected fields of the MessageControl field can be considered to be Petition 870260056057, dated 10 / 06 / 2026, page 47 / 135 40 / 57 is the Private Payload Field and will be encrypted if any level of security with encryption is negotiated. This is summarized in Table 1: Table 1 Frame Type Private Payload Field Open Payload Field SECURE-RPRT (from initiator) TurnAroundTime All other fields in the MessageContent Field SECURE-RPRT (from responder) Any of the following fields, if present, and in this order: ReplyTime NbaChannelMap Config UWB PHY Config UWB MAC Config NB PHY All other fields in the MessageContent Field All other protected compressed PSDUs Empty MessageContent

[226] In the above mode, the security of communication during MMS range measurement can be further improved by encrypting the compressed frame.

[227] In some possible implementations, UWB channel coordination may be active and before transmitting the SOR frame, the initiator scans the initialization channels in NB and the standard UWB channels for acquisition packets (APs) from other initiators. In order to perform the acquisition scan, upon receiving the ADV-RESP frame from the responder, instead of immediately transmitting the SOR frame, the initiator transmits to the responder an advertisement confirmation frame (ADV-CONF) that carries a time offset indicating the SOR transmission time, as shown in step S230' in FIG. 12, and the initiator performs the acquisition scan for the APs. Based on the information gathered from the APs, Petition 870260056057, dated 10 / 06 / 2026, page 48 / 135 41 / 57 The initiator can adapt the configuration parameters for MMS range measurement on the SOR frame.

[228] The communication method provided in the embodiments of the present application can also be applied in one-to-many MMS range measurement sessions. FIGS. 13 to 15 illustrate schematic flowcharts of a communication method in one-to-many MMS range measurement according to an embodiment of the present application.

[229] As shown in FIG. 13, similar to one-to-one MMS range measurement, a one-to-many MMS range measurement session begins with a controller and the two controlled devices performing session configurations during which long-term session parameters such as UWB channel number, preamble codes, and block structures are negotiated. When privacy is enabled, at least one IRK will also be provided by the controller to each of the controlled devices to resolve the private addresses carried in the frames transmitted by the initiator and also to generate the private addresses to be included in the frames transmitted by the responders, thus protecting the privacy of the devices.

[230] Once the session has been set up, step S310 is performed.

[231] S310: An initiator transmits ADV-POLL frames.

[232] For example, the initiator transmits ADV-POLL frames opportunistically at times and intervals at its discretion while responders can opportunistically listen for received ADV-POLL frames.

[233] Specifically, for the method of generating private addresses of the initiator carried in ADV-POLL frames and the format of the ADV-POLL frame, reference is made to the previous methods. Details are not described again in this document.

[234] When the initiator expects more than one responder to participate in the MMS reach measurement, the initiator allocates a Petition 870260056057, dated 10 / 06 / 2026, page 49 / 135 42 / 57 fixed duration for respondents to compete for the medium and transmit their respective ADV-RESP segments.

[235] Upon receiving the ADV-POLL frame, Responder 1 or Responder 2 verifies the initiator's identity. For the method of verifying the initiator's identity, reference is made to the previous methods. Details are not described again in this document.

[236] When the initiator identity verification is successful, Responder 1 and Responder 2 will transmit an ADV-RESP frame to the initiator if they intend to participate in a range measurement session with the initiator as illustrated in step S320. Specifically, S320 includes S321 and S322.

[237] S321: Responder 1 transmits an AVD-RESP carrying its private address, RPA_hash-R1-1 to the initiator.

[238] S322: Responder 2 transmits an AVD-RESP carrying its private address, RPA_hash-R2-1 to the initiator.

[239] For the method of generating the private address, see the previous methods. Details are not described again in this document.

[240] S330: The initiator transmits a SOR frame to Responder 1 and Responder 2.

[241] The initiator generates local hashes using the method described above. If at least one of the local hashes matches either RPA_hash-R1-1 or RPA_hash-R2-1, the initiator transmits the SOR frame which provides the time offset at which the first distance measurement cycle will begin. The SOR frame carries the same RPA_hash-I-1 contained in the ADV-POLL frame.

[242] S340: The initiator transmits a RIM frame to Responder 1 and Responder 2.

[243] At the time indicated by the time offset in the SOR frame, the initiator transmits a RIM frame to the responders at the start of the first range measurement slot of a range measurement round. Petition 870260056057, dated 10 / 06 / 2026, p. 50 / 135 43 / 57

[244] A schematic diagram of a RIM frame is illustrated in FIG. 16. In addition to providing time and frequency synchronization for responders, another important purpose of the RIM frame is to provide scheduling of access slots for MMS range measurement for responders. As shown in FIG. 16, the MessageControl field of the RIM frame carries a list of responders that are scheduled to participate in MMS range measurement. The Responder RPA_hash used in the ADV-RESP frame of responder n, for example, RPA_hash-Rn-1 (n=1, 2, etc.) is used as the private address of the responders and the sequence in which the Responder RPA_hash appears in the MessageContent field of the RIM frame determines the sequence of responder access slots for MMS range measurement.In addition, the RIM frame can also carry the initiator's second pseudo-random number, RPA_prand-I-2 in the RPA_prand field of the Initiator, and its private address, RPA_hash-I-2 in the RPA_hash field of the Initiator, allowing responders to verify the initiator's identity.

[245] For example, Responder 1 is scheduled for the first access slot (access slot 0) and Responder 2 is scheduled for the second access slot (access slot 1). Then steps S350 to S380 and S350' to S380' will be performed.

[246] S350: Responder 1 transmits a RESP carrying its private address, RPA_hash-R1-2 to the initiator.

[247] Upon receiving the RIM frame, each responder receiving the RIM frame generates a local hash of the Initiator's RPA_prand (e.g., RPA_prand-I-2) based on the IRK, and if the local hash matches the RPA_hash-I-2 carried in the Initiator's RPA_hash field of the RIM frame, the responder will have verified the initiator's identity.

[248] A responder that successfully receives the RIM frame and is scheduled for the first access slot (access slot 0), generates its own private address as described above, but Petition 870260056057, dated 10 / 06 / 2026, page 51 / 135 44 / 57 using the RPA_prand-I-2 carried in the RIM frame and transmits a RESP frame carrying the private address back to the initiator. As mentioned above, the responder can be Responder 1.

[249] It should be noted that the RIM and RESP frames allow the initiator and responder to achieve time and frequency synchronization. An initiator may also include other control information in the RIM frame for the responder.

[250] When Responder 1's identity verification based on RESP is successful, the initiator starts the range measurement phase in which the initiator and responder exchange zero or more RSF and optionally one or more RIF.

[251] After the initiator or responder completes receiving all UWB fragments for the range measurement phase, the initiator and / or responder generate a range measurement report, and send the RPRT frame carrying the measurement report to the peer device, each carrying the appropriate private address, as illustrated in steps S370 and S380.

[252] Subsequently, as illustrated in step S340', the initiator transmits a POLL frame to Responder 2 at the start of the first range measurement slot of the second access slot (access slot 1).

[253] The remaining steps in FIG. 13 are similar to the previous steps and modalities. Details are not described again in this document.

[254] In some possible implementations, the format of the ADV-RESP (or RESP) frame in FIG. 13 may be as shown in one of FIGS. 5 to 7, and the specific format of the ADV-RESP (or RESP) frame may be determined by the parameters that are used to generate the ADV-RESP (or RESP) frame. For example, the format of the ADV-RESP (or RESP) frame in FIG. 13 may be as shown in FIG. 5 or FIG. 6 if the private address carried in an ADV-RESP (or RESP) frame is generated using any of Equations 2 to 5. Alternatively, the format of the ADV-RESP frame Petition 870260056057, dated 10 / 06 / 2026, page 52 / 135 45 / 57 (or RESP) in FIG. 13 can be as shown in FIG. 7 if the private address ported in an ADV-RESP (or RESP) frame is generated using Equation 6.

[255] The one-to-many MMS range measurement session shown in FIG. 14 is similar to that in FIG. 13. The difference is that UWB channel coordination may be active and, before transmitting the SOR frame, the initiator scans the initialization channels in NB and the standard UWB channels for acquisition packets (APs) from other initiators. In order to perform the acquisition scan, upon receiving the ADV-RESP frame from the responder, instead of immediately transmitting an SOR frame, the initiator transmits to the responders an ADV-CONF frame that carries a time offset indicating the SOR transmission time, as shown in step S330' in FIG. 14, and the initiator performs the acquisition scan for the APs. Based on the information gathered from the APs, the initiator can adapt the configuration parameters for MMS range measurement on the SOR frame.

[256] In some possible implementations, the format of the ADV-RESP (or RESP) frame in FIG. 14 may be as shown in FIGS. 5 to 7, and the specific format of the ADV-RESP (or RESP) frame may be determined by the parameters that are used to generate the ADV-RESP (or RESP) frame. For example, the format of the ADV-RESP (or RESP) frame in FIG. 14 may be as shown in FIG. 5 or FIG. 6 if the private address carried in an ADV-RESP (or RESP) frame is generated using any of Equations 2 to 5. Alternatively, the format of the ADV-RESP (or RESP) frame in FIG. 14 may be as shown in FIG. 7 if the private address carried in an ADV-RESP (or RESP) frame is generated using Equation 6.

[257] The one-to-many MMS range measurement session shown in FIG. 15 is also similar to that in FIG. 13. The difference is that the responders generate their own addresses. Petition 870260056057, dated 10 / 06 / 2026, page 53 / 135 46 / 57 private paired IRK-based networks. In some of the aforementioned modes, it was assumed that the IRK exchanged between the initiator and all responders was common to all responders, i.e., only a single IRK was maintained on the network for the purpose of identification resolution. However, it is also possible that a common IRK (IRK-B) is shared between all initiators and responders on the same network only for the broadcast frame (e.g., RIM) and a paired IRK (IRK-IRn & IRK-RIn, n = responder index) is exchanged between the initiator and each responder for unicast frames in each direction (i.e., one IRK (IRK-IRn, n = responder index) for initiator-to-responder frames and one IRK (IRK-RIn, n = responder index) for responder-to-initiator frames). IRKs are used in subsequent frames as indirect means of identifying frame transmitters.

[258] For example, for unicast frames (i.e., frames intended for a single responder, e.g., ADV-POLL frame, POLL frame, REPORT frame) to be transmitted to Responder n, the initiator generates a unique pseudorandom number for the responder (RPA_prand-In) and uses the initiator's paired IRK for the responder (IRK-IRn, n = responder index) to generate the initiator's RPA_hash (RPA_hash-In) using Equation 1 and includes RPA_hash-In and RPA_prand-In in the initial unicast frames for responder n. When Responder n receives the initial unicast frame transmitted by the initiator's ADV-POLL (or POLL) frame, Responder n generates a local hash of the initiator's RPA_prand carried in the ADV-POLL (or POLL) frame and of IRK-IRn as inputs to Equation 1. If the local hash matches the initiator's RPA_hash carried in the ADV-POLL (or POLL) frame, the responder has verified the initiator's identity.

[259] Similarly, for broadcast frames (i.e., frames intended for multiple responders, for example, POLL for one-to-many range measurement, i.e., RIM frame), the Petition 870260056057, dated 10 / 06 / 2026, page 54 / 135 47 / 57 The initiator generates a unique pseudorandom number (RPA_prandB-I) and uses the common broadcast IRK (IRK-B) to generate the Initiator's RPA_hash (RPA_hash-BI) using Equation 1 and includes RPA_hashB-I and RPA_prand-BI in the broadcast frame. When a responder receives the initial broadcast frame (e.g., RIM frame) transmitted by the initiator, the responder generates a local hash of the Initiator's RPA_prand carried in the frame and the IRKB as inputs to Equation 1. If the local hash matches the Initiator's RPA_hash carried in the frame, the responder has verified the initiator's identity.

[260] Similarly, in its response frames, Responder n includes its RPA_hash generated using Equation 5 as the only address field in its frames (e.g., ADV-RESP or RESP); the responder uses its unique pairwise IRK (IRK-RIn) and the initiator's RPA_prand (e.g., RPA_prand-In) in the previous initial frame to generate its RPA_hash (RPA_hash-Rn). For example, Responder 1 generates its own private address based on IRK-RI1 and Responder 2 generates its own private address based on IRK-RI2 using Equation 5. Correspondingly, the initiator verifies the identity of Responder 1 based on IRK-RI1 and the identity of Responder 2 based on IRK-RI2. Based on the IRK used, the initiator is able to implicitly identify the responder (e.g., by mapping the IRK to the initiator's public address record of the responder).Another difference is that since pairwise IRK is used to generate the private address (e.g., Initiator's RPA_hash) in ADV-POLL and POLL frames, only the target responder (the responder that possesses the correct IRK) is able to correctly verify the private address and therefore only the target responder will respond to the ADV-POLL or POLL frame with the ADV-RESP or RESP frame respectively. Correspondingly, SOR frames are also intended for one responder at a time. This allows the initiator to selectively choose the responder(s) to respond to. Petition 870260056057, dated 10 / 06 / 2026, p. 55 / 135 48 / 57 participate in MMS reach measurement.

[261] For example, the format of the ADV-RESP (or RESP) frame in FIG. 15 may be as shown in FIG. 5 to FIG. 7, and the specific format of the ADV-RESP (or RESP) frame may be determined by the parameters that are used to generate the ADV-RESP (or RESP) frame. For example, the format of the ADV-RESP (or RESP) frame in FIG. 15 may be as shown in FIG. 5 or FIG. 6 if the private address carried in an ADV-RESP (or RESP) frame is generated using any of Equations 2 to 5. Alternatively, the format of the ADV-RESP (or RESP) frame in FIG. 15 may be as shown in FIG. 7 if the private address carried in an ADV-RESP (or RESP) frame is generated using Equation 6.

[262] In the examples above using a common IRK as shown in FIG. 3, and FIG. 12 to FIG. 14, the initiator's ADV-POLL and POLL frames were not directed to any particular responder, and any responder possessing the common IRK could check the initiator's private address and respond to the ADV-POLL and POLL frames. However, sometimes it is possible that the initiator may want to select a particular responder to participate in the MMS range measurement. Such an example is shown in FIG. 17. The initiator can achieve this by including the target responder's identity (e.g., the extended 8-octet 802.15 MAC address) and the compressed PSDU ID (e.g., ADV-POLL) in the initiator's RPA_hash computation for responder n (e.g., RPA_hash_I-Rn, n = 1, 2, ...) and truncated to 24 bits using Equation 7: RPA_hash = AES-128-ECB(key=IRK, data=(0x000...[4] || ID || 8-octet extended 802.15 MAC address of responder n [8] || RPA_prand-I]) % 2Λ24. Equation 7

[263] For example, in a first ADV-POLL, the initiator includes the extended 802.15 MAC address of Responder 1 in the computation of the Initiator's RPA_hash (RPA_hash-I-R1-1) included in the ADV-POLL frame. Even though both Responder 1 and Petition 870260056057, dated 10 / 06 / 2026, page 56 / 135 49 / 57 Responder 2 receives the ADV-POLL frame, but only Responder 1 is able to verify the initiator's private address (RPA_hash-IR1-1), and therefore only Responder 1 responds with the ADV-RESP frame.

[264] Similarly, Responder n can also use the same Equation 7 to generate its private address (RPA_hash-Rn) to be used in the ADV-RESP and RESP frames. Although the same equation is used, the inclusion of the ID field (e.g., ADV-RESP) ensures that the private addresses generated by the initiator and the responders are different and the initiator can verify that the responder is in possession of a valid IRK. For example, Responder 1 generates its private address using Equation 7 and transmits the ADV-RESP frame to the initiator, who then responds with an SOR frame to invite Responder 1 to participate in the one-to-one MMS range measurement. Subsequently, the initiator transmits another ADV-POLL intended for Responder 2, and if it receives an ADV-RESP from Responder 2, it invites Responder 2 to join Responder 1 for a one-to-many MMS range measurement by transmitting an SOR frame to it.Here it is assumed that Responder 1 continues the MMS range measurement session in the subsequent round / block. The initiator RIM frame assigns Responder 1 and Responder 2 to the first and second access slots of the one-to-many MMS range measurement respectively, including their private addresses in the RIM frame as described earlier in FIG. 16.

[265] It should be noted that the RPRT frame in the previous modes can also carry a private initiator address and a private responder address.

[266] It should also be noted that, for the method of generating the responder's private address, for the method of verifying the responder's identity, and for other related content in the one-to-many MMS reach measurement session, reference is made to the previous methods. Details are not described. Petition 870260056057, dated 10 / 06 / 2026, p. 57 / 135 50 / 57 in this document again.

[267] The present application provides a communication method enabling the initiator to determine whether the response frame is truly from the authorized responder. Especially in one-to-many MMS range measurement, the communication method enables the initiator to identify different responders without revealing responder identities. In addition, the security of the compressed frame is taken into consideration.

[268] Combined with the prior method embodiment, the present application further provides related devices, and the devices may be located in a controller or a controlled entity. The related devices may perform the steps of the prior method embodiment.

[269] FIG. 18 is a schematic block diagram of a 2000 communication apparatus according to an embodiment of this application. The 2000 communication apparatus can perform the steps performed by the responder in the previous embodiments. As shown in FIG. 18, the 2000 communication apparatus includes: a receiving unit 2010, configured to receive from an initiator, a first frame to initiate a range measurement process; a generating unit 2020, configured to generate a first private address based on the first frame and on information related to the identity of the first responder, and the information related to the identity of the first responder is known to the initiator; and a transmitting unit 2030, configured to transmit a second frame carrying the first private address to the initiator.

[270] In a possible implementation, information relating to the identity of the first responder includes any of: a public address of the first responder, MMS reach measurement configuration requested by the first responder, a first random number generated by the first responder, or a unique IRK for the initiator and the first responder. Petition 870260056057, dated 10 / 06 / 2026, page 58 / 135 51 / 57

[271] In one possible implementation, the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the 2020 generation unit is configured to: generate the first private address based on the second random number and information related to the identity of the first responder.

[272] In one possible implementation, the second private address is generated based on information related to the identity of a second responder, the 2020 generation unit is configured to: generate the first private address when it is determined that the second responder and the first responder are the same responder.

[273] In one possible implementation, the 2030 transmission unit is configured to: transmit the second frame carrying the first private address and the first random number to the initiator.

[274] In a possible implementation, the first frame is a RIM frame that holds a list associated with respondents who are scheduled to participate in an MMS reach measurement, and the respondents include the first responder; and the 2020 generation unit is configured to: generate the first private address when it is determined that the first responder is scheduled for the first access slot among multiple access slots based on the list.

[275] In one possible implementation, the second frame includes any one of: an ADV-RESP frame, a RESP frame, or an RPRT frame.

[276] In one possible implementation, the first frame or the second frame is a secure frame that carries encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the address Petition 870260056057, dated 10 / 06 / 2026, page 59 / 135 52 / 57 private or a period of time for transmission of the secure frame.

[277] In one possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the protected frame.

[278] In one possible implementation, the first Nonce additionally includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[279] In one possible implementation, the second frame additionally carries a private address of the initiator.

[280] In one possible implementation, the receiving unit 2010 is further configured to: receive a third frame carrying time offset information from the initiator, and the time offset information indicates a time offset of a transmitted SOR frame.

[281] FIG. 19 is a schematic block diagram of a 2100 communication apparatus according to an embodiment of this application. The 2100 communication apparatus can perform the steps performed by the initiator in the previous embodiments. As shown in FIG. 19, the 2100 communication apparatus includes: a receiving unit 2110, configured to receive a second frame bearing a first private address of a first responder, and the first private address is associated with information relating to the identity of the first responder; a generating unit 2120, configured to generate a third private address based on the information relating to the identity of the first responder; and a verifying unit 2130, configured to verify the identity of the first responder by comparing the third private address with the first private address.

[282] In a possible implementation, the related information Petition 870260056057, dated 10 / 06 / 2026, page 60 / 135 53 / 57 to the identity of the first responder includes any of: a public address of the first responder, MMS reach measurement configuration requested by the first responder, a first random number generated by the first responder, or a unique IRK for the initiator and the first responder.

[283] In one possible implementation, the communication device also includes a transmission unit configured to: transmit a first frame to initiate a range measurement process, and the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the 2120 generation unit is configured to: generate the third private address based on the second random number and information related to the identity of the first responder.

[284] In one possible implementation, the 2120 generation unit is further configured to: generate a fourth private address based on information related to the identity of a second responder; and the transmission unit is further configured to: transmit a frame containing the fourth private address to the second responder.

[285] In one possible implementation, the second frame additionally carries the first random number, the generation unit 2120 is configured to: generate the third private address based on the first random number.

[286] In one possible implementation, the transmission unit is further configured to: transmit a first frame to initiate a range measurement process for the first responder, and the first frame is a RIM frame carrying a list associated with responders that are scheduled to participate in the MMS range measurement, and the responders include the first responder.

[287] In a possible implementation, the second frame includes any of: an ADV-RESP frame, a RESP frame, or a frame Petition 870260056057, dated 10 / 06 / 2026, page 61 / 135 54 / 57 RPRT.

[288] In one possible implementation, the first frame or the second frame is a secure frame that carries encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for transmission of the secure frame.

[289] In one possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the protected frame.

[290] In one possible implementation, the first Nonce additionally includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[291] In one possible implementation, the second frame also contains a private address of the initiator; the verification unit 2130 is further configured to: verify the identity of the first responder based on the private address of the initiator.

[292] In one possible implementation, the transmission unit is further configured to: transmit a third frame carrying time offset information to the first responder, and the time offset information indicates a time offset of a transmitted SOR frame.

[293] As shown in FIG. 20, a communication device 2200 may include a processor 2210, a transceiver 2220, and a memory 2230. The transceiver 2220 may be configured to receive a query. The memory 2230 may be configured to store code, instructions, and the like executed by the processor 2210.

[294] In addition, the 2230 memory can be configured Petition 870260056057, dated 10 / 06 / 2026, page 62 / 135 55 / 57 additionally to store data corresponding to the generation and / or verification of private addresses, such as IRKs pre-negotiated between the initiator and the responder.

[295] The 2230 memory may include random memory, flash memory, read-only memory, programmable read-only memory, non-volatile memory, a register, or the like. The 2210 processor may be a central processing unit (CPU).

[296] For other functions and operations of the 2200 communication apparatus, see method modalities processes in FIG. 2, FIG. 3, FIG. 12 to FIG. 15, and FIG. 17, which are not described again here to avoid repetition.

[297] One embodiment of the present application additionally provides a communication system. The communication system includes communication apparatus 2000 and communication apparatus 2100, or the communication system includes communication apparatus 2200.

[298] One embodiment of the present application further provides a computer storage medium, and the computer storage medium may store a program instruction for carrying out the steps in the foregoing methods.

[299] Optionally, the storage medium can be specifically 2230 memory.

[300] One embodiment of the present application additionally provides a computer program product. The computer program product includes computer program code. When the computer program code is executed on a computer, the computer is enabled to perform the steps in the preceding methods.

[301] Optionally, all or part of the computer program code may be stored in a primary storage medium. The primary storage medium may be packaged together with the processor or separately with the Petition 870260056057, dated 10 / 06 / 2026, page 63 / 135 56 / 57 processor.

[302] One embodiment of the present application further provides a chip system, wherein the chip system includes an input / output interface, at least one processor, at least one memory, and a bus. The at least one memory is configured to store instructions, and the at least one processor is configured to invoke the instructions from the at least one memory to perform operations in the methods of the preceding embodiments.

[303] In the modalities of this application, at least one means one or more, and a plurality of means two or more. The term and / or describes an association relationship between associated objects and represents which three relationships can exist. For example, A and / or B can represent the following three cases: only A exists, both A and B exist, and only B exists, where A and B can be singular or plural. The character / generally indicates an or relationship between the associated objects. At least one of the following and an expression similar to this refer to any combination of these items, including any combination of one item or a plurality of items. For example, at least one of a, b, ec can indicate: a, b, c, aeb, aec, bec, or a, b, ec, where a, b, ec can be singular or plural.

[304] A person of ordinary skill in the art can understand that all or some of the processes of the methods in the embodiments can be implemented by a computer program instructing related hardware. The program can be stored on a computer-readable storage medium. When the program is executed, the processes of the methods in the embodiments are performed. The aforementioned storage medium may include: a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[305] In the various forms provided in this application, Petition 870260056057, dated 10 / 06 / 2026, page 64 / 135 57 / 57 It should be understood that the disclosed system, apparatus, and method may be implemented in other ways. For example, the described apparatus embodiment is merely exemplary. For example, the unit division is merely a logical function division and may be another division in the actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted or not realized. Furthermore, the mutual couplings or direct couplings or communication connections shown or discussed may be implemented using some interfaces. Indirect couplings or communication connections between the apparatuses or units may be implemented in electronic, mechanical, or other forms.

[306] The units described as separate parts may or may not be physically separate, and the parts displayed as units may or may not be physical units, may be located in one position, or may be distributed across a plurality of network units. Some or all of the modules may be selected according to the actual needs to achieve the objectives of the modal solutions.

[307] Furthermore, functional units in the embodiments of the present invention may be integrated into a processing unit, or each of the units may exist physically on its own, or two or more units are integrated into one unit.

[308] The foregoing are merely exemplary embodiments of the present invention. A person skilled in the art may make various modifications and variations to the present invention without departing from the scope of the present invention. Petition 870260056057, dated 10 / 06 / 2026, page 65 / 135

Claims

1 / 4 CLAIMS 1. A communication method, applied to a first responder, CHARACTERIZED in that it comprises: receiving, from an initiator, a first frame to initiate a range measurement process; generating (S120) a first private address based on the first frame and information related to the identity of the first responder; and transmitting (S130) a second frame carrying the first private address to the initiator.

2. A communication method according to claim 1, characterized in that the information relating to the identity of the first responder comprises any one of: a public address of the first responder, a multi-millisecond (MMS) range measurement configuration requested by the first responder, a first random number generated by the first responder, or an Identity Resolution Key (IRK) unique to the initiator and the first responder.

3. Communication method, according to claim 2, CHARACTERIZED in that the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generation (S120) of a first private address based on the first frame and information related to the identity of the first responder comprises: generating the first private address based on the second random number and information related to the identity of the first responder.

4. Communication method, according to claim 3, CHARACTERIZED by the fact that the second private address is generated based on information related to the identity of a second responder, the generation (S120) of a first private address based on the first frame and information related to Petition 870260056057, dated 10 / 06 / 2026, page 66 / 135 2 / 4 an identity of the first responder comprises: generating the first private address when it is determined that the second responder and the first responder are the same responder.

5. Communication method, according to any one of claims 2 to 4, CHARACTERIZED in that transmitting (S130) a second frame bearing the first private address to the initiator comprises: transmitting the second frame bearing the first private address and the first random number to the initiator.

6. Communication method, according to any one of claims 1 to 5, CHARACTERIZED in that the first frame is a reach measurement initialization (RIM) message frame carrying a list associated with responders that are scheduled to participate in an MMS reach measurement, wherein the responders comprise the first responder; and the generation (S120) of a first private address based on information related to a first responder's identity comprises: generating the first private address when it is determined that the first responder is scheduled for the first access slot among multiple access slots based on the list.

7. A communication method, according to any one of claims 1 to 6, CHARACTERIZED in that the second frame comprises any one of: an advertisement response frame (ADV-RESP), a response frame (RESP), or a report frame (RPRT).

8. A method of communication, according to any one of claims 1 to 7, CHARACTERIZED in that the first frame or the second frame is a shielded frame carrying encrypted information, wherein the encrypted information is obtained based on a first Nonce, and the first Nonce is associated with any one of: a private address carried by the shielded frame, a random number used to generate the private address, or a time period for transmission of the shielded frame.

9. Communication method according to claim 8, characterized in that the first nonce comprises frame counter information, wherein the frame counter information indicates the time period for the transmission of the protected frame.

10. A communication method according to claim 8 or 9, CHARACTERIZED in that the first Nonce additionally comprises block structure indication information, wherein the block structure indication information indicates whether the second frame is transmitted within or outside a block structure.

11. A method of communication, according to any one of claims 1 to 10, CHARACTERIZED in that the second frame additionally carries a private address of the initiator.

12. A communication method, according to any one of claims 1 to 11, CHARACTERIZED in that the method further comprises: receiving a third frame carrying time offset information from the initiator, wherein the time offset information indicates a time offset from a transmitted range measurement start frame (SOR).

13. A method of communication, according to any one of claims 2 to 5, CHARACTERIZED in that the IRK is a common IRK between the initiator and the first responder, or the IRK is a paired IRK unique to the initiator and the first responder.

14. Communication apparatus, CHARACTERIZED in that it comprises a processor and a memory, and the processor is connected to the memory; wherein the memory is configured to store instructions, and the processor is configured to execute the instructions; and when the processor executes the instructions stored in memory, the processor is enabled to perform the method as defined in any one of claims 1 to 13.

15. Computer-readable storage medium, CHARACTERIZED in that the computer-readable storage medium stores instructions, and when the instructions are run on a processor, the processor is enabled to perform the method as defined in any one of claims 1 to 13. Petition 870260056057, dated 10 / 06 / 2026, pp. 69 / 135

Images