Communication method and related device

Abstract

The invention provides a communication method and related equipment. The method comprises the following steps: a first responder receives a first frame for initiating a ranging process from an initiator; the first responder generates a first private address based on the first frame and information related to the identity of the first responder; and the first response side sends a second frame carrying the first private address to the initiator. The method can be applied to an ultra-wideband multi-millisecond ranging system. According to the present application, an initiator may verify whether a frame is true from an authorized responder in an ultra-wideband multi-millisecond ranging session.

Description

(12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau (43) International Publication Date 19 December 2024 (19.12.2024) lllllllllllllllllllllllllllllll^ (10) International Publication Number WO 2024 / 254833 Al WIPO I PCT (51) International Patent Classification: H04W64 / 00 (2009.01) (21) International Application Number: PCT / CN2023 / 100512 (22) International Filing Date: 15 June 2023 (15.06.2023) (25) Filing Language: English (26) Publication Language: English (71) Applicant: HUAWEI TECHNOLOGIES CO., LTD. [CN / CN]; Huawei Administration Building, Bantian, Long- gang, Shenzhen, Guangdong 518129 (CN). (72) Inventors: CHITRAKAR, Rojan; Huawei Administra­ tion Building, Bantian, Longgang, Shenzhen, Guang­ dong 518129 (CN). HUANG, Lei; Huawei Administra­ tion Building, Bantian, Longgang, Shenzhen, Guangdong 518129 (CN).LI, Yunbo; Huawei Administration Build­ ing, Bantian, Longgang, Shenzhen, Guangdong 518129 (CN). YANG, Xun; Huawei Administration Building, Bantian, Longgang, Shenzhen, Guangdong 518129 (CN). (74) Agent: LONGSUN LEAD IP LTD.; Room 801-1, Floor 8, Building 3, Block2, No. 81, BeiqingRoad, HaidianDistrict, Beijing 100094 (CN). (81) Designated States (unless otherwise indicated, for every kind of national protection available)'. AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CV, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IQ, IR, IS, IT, JM, JO, JP, KE, KG, KH, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, MG, MK, MN, MU, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, WS, ZA, ZM, ZW.(84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, CV, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SC, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, ME, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Published: — with international search report (Art. 21(3)) (54) Title: COMMUNICATION METHOD AND RELATED DEVICE w o 20 24 / 2 54 83 3 A l IIII III III III III III III III III III IN FIG. 2 (57) Abstract: The present application provides a communication method and related device.The method includes: a first responder receives from an initiator a first frame for initiating a ranging process; the first responder generates a first private address based on the first frame and information related to an identity of the first responder; and the first responder transmits a second frame carrying the first private address to the initiator. The method may be applied to ultra-wideband multi-millisecond ranging systems. According to this application, an initiator can verify whether a frame is really from an authorized responder in an ultra-wideband multi-millisecond ranging session. WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 COMMUNICATION METHOD AND RELATED DEVICE TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of communications technologies, and more specifically, to a communication method and related device.BACKGROUND

[0002] Ultra-wideband (UWB) technology is increasingly being used for indoor positioning and other location services such as access control and asset locating. To address the long-range ranging use case, UWB multi-millisecond (MMS) ranging has been introduced. The key idea behind MMS ranging is to distribute the UWB ranging frames into multiple fragments and the fragment being transmitted across multiple milliseconds (ms), thereby overcoming the emitted energy limit of 37 nanojoules (nJ) per ms. By distributing the ranging frame over several fragments, each fragment being transmitted in one millisecond, the total energy of the ranging frame can be several times higher, thereby considerably increasing the ranging range. This means that when the block-based mode is used for MMS ranging, the control frame transmission time would be limited to 1 ms, which also results in very limited available space for the actual control information in the control frame.In order to overcome this limitation, a compressed physical layer service data unit (PSDU) format that uses a private address has been introduced for the control frames.

[0003] In the MMS ranging session, when an initial compressed PSDU such as an advertisement poll (ADV-POLL) frame or a POLL frame, is to be transmitted, the initiator generates a pseudo random number RPA_prand and uses the random number RPA prand to generate the private address RPAhash. The responder verifies the identity of the initiator based on the RPA_prand and RPA_hash received from the initiator. If the responder intends to participate in a ranging session with the initiator, the responder transmits the response frame carrying the same RPA hash.

[0004] In general, only the ADV-POLL frame and the POLL frame carry the RPA_hash and the RPA_prand while the rest of the frames only carry the RPA hash from the preceding frame.That is to say, it is trivial for any device that receives the ADV-POLL frame or the POLL frame to copy the RPA_hash and transmit a response frame carrying the RPA_hash as its private address. In other words, the initiator cannot determine whether the response frame is truly from the authorized responder. 1 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 SUMMARY

[0005] Embodiments of this application provide a communication method and related device, which allow an initiator in an MMS ranging session to verify that a frame is really from an authorized responder.

[0006] According to a first aspect, this application provides a communication method.The method is applied to a first responder, and the method includes:

[0007] receiving, from an initiator, a first frame for initiating a ranging process; generating a first private address based on the first frame and information related to an identity of the first responder; and transmitting a second frame carrying the first private address to the initiator.

[0008] For example, the information related to the identity of the first responder can uniquely identify the identity of the first responder. A frame for initiating a ranging process includes a frame for initiating the initialization and setup phase or a frame for initiating the measurement cycle phase.

[0009] The second frame may be a response frame of the first frame, or the second frame may be a frame transmitted after the response frame of the first frame. For example, the first frame is an ADV-POLL frame, and the second frame is an advertising response (ADV-RESP) frame.Alternatively, the first frame is a POLL frame, and the second frame is a response (RESP) frame. Alternatively, the first frame is a POLL frame, and the second frame is a report (RPRT) frame.

[0010] For example, the generating a first private address based on the first frame and information related to an identity of the first responder includes: verifying the identify of the initiator based on the first frame; and generating the first private address based on the information related to the identity of the first responder, when identity verification of the initiator succeeds.

[0011] It should be noted that the information related to the identity of the first responder is known to the initiator.

[0012] According to the above-mentioned technical solution, since the private address of a responder is generated based on the responder’s identify, the initiator is enabled to identify whether the transmitter of the compressed frame is an authorized responder while maintaining the transmitter's privacy. Meanwhile, since there is no need to add new fields in the compressed frame, the size of the compressed frame can be minimized.

[0013] In a possible implementation, the information related to the identity of the first responder includes any one of: a public address of the first responder, MMS ranging configuration requested by the first responder, a first random number generated by the first responder, or an identity resolving key (IRK) unique to the initiator and the first responder.

[0014] The public address of the first responder may include any one of an in band extended address and an out of band (OOB) public address.

[0015] It is essential for the responder to provide its public address during the session setup phase and / or carry the 2 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 MMS ranging configuration in a compressed frame sent to the initiator in order to obtain the ranging results. Therefore, in the above-mentioned technical solution, the first responder uses the public address, or the MMS ranging configuration as the information related to its identity to generate a private address, eliminating the need for additional signaling exchange to notify the initiator of its identity information, which helps to reduce signaling overhead in ranging sessions. Besides, compared to static identity related information, random numbers can be frequently updated, thus taking the first random number as the information related to the identity of the first responder can help improve communication security.Taking the IRK that is unique between the initiator and the first responder as the information related to the identity of the first responder can reduce the complexity of generating private addresses.

[0016] In a possible implementation, the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generating a first private address based on the first frame and information related to an identity of the first responder includes: generating the first private address based on the second random number and the information related to the identity of the first responder.

[0017] The generating the first private address based on the second random number and the information related to the identity of the first responder includes: generating the first private address based on the information related to the identity of the first responder after verifying the identity of the initiator by using the second random number and the second private address; and / or generating the first private address by using the first random and the information related to the identity of the first responder combined with an IRK pre-negotiated between the initiator and the first responder as inputs to a suitable hash function, and the suitable hash function is pre-negotiated between the initiator and the first responder. In the former case, the first frame also carries the second private address.

[0018] For example, when the information related to the identity of the first responder includes any one of a public address of the first responder, MMS ranging configuration requested by the first responder, and a first random number generated by the first responder, the generating a first private address based on the second random number and the information related to the identity of the first responder includes: generating the first private address based on the second random number, the information related to the identity of the first responder and a first IRK, and the first IRK is pre-negotiated between the initiator and the first responder.

[0019] For example, the first IRK may include: a common IRK shared between the initiator and multiple responders, and the multiple responders include the first responder; or an IRK unique to the initiator and a first responder.

[0020] According to the above-mentioned technical solution, the first responder generates a private address based on a random number carried in the compressed frame received from the initiator, which helps to increase the difficulty of a session between an initiator and an authorized responder being attacked, because only responders that know the random number can 3 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 generate a private address that may be verified successfully by the initiator.

[0021] In a possible implementation, the second private address is generated based on information related to an identity of a second responder, the generating a first private address based on the first frame and information related to an identity of the first responder includes: generating the first private address when it is determined that the second responder and the first responder are the same responder.

[0022] According to the above-mentioned technical solution, it is possible for the initiator to select a particular responder to participate in the MMS ranging.

[0023] In a possible implementation, the transmitting a second frame carrying the first private address to the initiator includes: transmitting the second frame carrying the first private address and the first random number to the initiator.

[0024] Alternatively, the first responder generates a new first random number when transmitting the second frame.

[0025] According to the above-mentioned technical solution, carrying the first random number in the second frame enables the initiator to know the first responder’s identity, which can avoid the risk of static identity information being stolen and improve communication security.

[0026] In a possible implementation, the first frame is a ranging initialization message (RIM) frame carrying a list associated with responders that are scheduled to participate in MMS ranging, and the responders include the first responder; the generating a first private address based on information related to an identity of a first responder includes: generating the first private address when it is determined that the first responder is scheduled to the first access slot among multiple access slots based on the list.

[0027] According to the above-mentioned technical solution, when responders receive the RIM, only the responder scheduled to the first access slot generates and transmits its private address, while the other responders are on standby until they receive the POLL frame.

[0028] In a possible implementation, the second frame includes any one of: an ADV-RESP frame, a RESP frame, or a RPRT frame.

[0029] The first frame includes an ADV-POLL frame or a POLL frame.

[0030] According to the above-mentioned technical solution, carrying a private address related to the responder’s identity in the frame transmitted by the responder to the initiator helps the initiator authenticate the identity of the responder.

[0031] In a possible implementation, the first frame or the second frame is a secured frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame. 4 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0032] For example, the time period may be an Insider block structure, or an Outside block structure. Specifically, if the time period is an Insider block structure, the time period may indicate a slot, round, and block in which the secured frame is transmitted.

[0033] According to the above-mentioned technical solution, encrypting part of content in the second frame based on a Nonce can help improve the security of the information carried in the second frame.

[0034] In a possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the secured frame.

[0035] According to the above-mentioned technical solution, based on the time period for transmission of the secured frame, it is possible to generate the frame counter for the Nonce used to secure or unsecure the frames.

[0036] In a possible implementation, the first Nonce also includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[0037] For example, the block structure indication information includes a 1-bit field, which is set to zero in a compressed frame transmitted outside the block structure and is set to one in a secured compressed frame transmitted inside the block structure.

[0038] According to the above-mentioned technical solution, the block structure indication information can ensure that the Nonce used for secured frames transmitted inside and outside the block structure is never reused.

[0039] In a possible implementation, the second frame further carries a private address of the initiator.

[0040] For example, the private address of the initiator includes the second private address.

[0041] According to the above-mentioned technical solution, the inclusion of both the initiator’s private address and responder’s private address in the second frame simplifies the identity verification for the responder.For example, if the initiator’s private address carried in the second frame does not match the initiator’s private address carried in the first frame, the initiator will determine the identity verification of the responder is unsuccessful, otherwise the initiator will further verify the identity of responder based on the responder’s private address. Besides, carrying the initiator’s private address in the second frame makes it easier for the initiator to identify the IRK to be used to verify the responder’s private address.

[0042] In a possible implementation, the method further includes: receiving a third frame carrying time-offset information from the initiator, and the time-offset information indicates a time offset of a start of ranging (SOR) frame transmitted.

[0043] According to the above-mentioned technical solution, when UWB channel coordination is active, it can make the responder aware of the time offset of the SOR frame.

[0044] According to a second aspect, this application provides a communication method. The method is applied to an 5 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 initiator, and the method includes:

[0045] receiving a second frame carrying a first private address from a first responder, and the first private address is associated with information related to an identity of the first responder; generating a third private address based on the information related to the identity of the first responder; and verifying the identity of the first responder by comparing the third private address with the first private address.

[0046] Specifically, whether the second frame is truly from the authorized first responder is determined when the third private address is the same as the first private address.

[0047] In a possible implementation, the infomation related to the identity of the first responder includes any one of a public address of the first responder, MMS ranging configuration requested by the first responder, a first random number generated by the first responder, and an IRK unique to the initiator and the first responder.

[0048] In a possible implementation, the method further includes: transmitting a first frame for initiating a ranging process, where the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generating a third private address based on the infomation related to the identity of the first responder includes: generating the third private address based on the second random number and the information related to the identity of the first responder.

[0049] For example, the third private address is generated by using the first random and the infomation related to the identity of the first responder combined with an IRK pre-negotiated between the initiator and the first responder as inputs to a suitable hash function. The suitable hash function is pre-negotiated between the initiator and the first responder.

[0050] In a possible implementation, the method further includes: generating a fourth private address based on infomation related to an identity of a second responder; and transmitting a frame carrying the fourth private address to the second responder.

[0051] In some embodiments, the first responder and the second responder are the same responder.

[0052] Optionally, the method further includes: transmitting a frame carrying the fourth private address to the first responder.It should be noted that, only the second responder can verify the fourth private address successfully due to the fourth private address is generated based on the second responder’s identity.

[0053] In a possible implementation, the second frame further carries the first random number, the generating a third private address based on the information related to the identify of the first responder includes: generating the third private address based on the first random number.

[0054] In a possible implementation, the method further includes: transmitting a first frame for initiating a ranging process to the first responder, and the first frame is a RIM frame carrying a list associated with responders that are scheduled 6 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 to participate in MMS ranging, and the responders include the first responder.

[0055] In a possible implementation, the second frame includes any one of: an ADV-RESP frame, a RESP frame, or a RPRT frame.

[0056] In a possible implementation, the first frame or the second frame is a secured frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame.

[0057] In a possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the secured frame.

[0058] In a possible implementation, the first Nonce further includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[0059] In a possible implementation, the second frame further carries an initiator’s private address; the method further includes: verifying the identity of the first responder based on a private address of the initiator.

[0060] In a possible implementation, the method further includes: transmitting a third frame carrying time-offset information to the first responder, and the time-offset information indicates a time offset of a SOR frame transmitted.

[0061] For the beneficial effects of the second aspect, reference is made to the first aspect. Details are not described herein again.

[0062] According to a third aspect, this application provides a communication apparatus, including: a receiving unit, configured to receive, from an initiator, a first frame for initiating a ranging process; a generating unit, configured to generate a first private address based on the first frame and information related to an identity of the first responder, and the information related to the identity of the first responder is known to the initiator; and a transmitting unit, configured to transmit a second frame carrying the first private address to the initiator.

[0063] In a possible implementation, the information related to the identity of the first responder includes any one of: a public address of the first responder, MMS ranging configuration requested by the first responder, a first random number generated by the first responder, or an IRK unique to the initiator and the first responder.

[0064] In a possible implementation, the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generating unit is configured to: generate the first private address based on the second random number and the information related to the identity of the first responder.

[0065] In a possible implementation, the second private address is generated based on information related to an identity of a second responder, the generating unit is configured to: generate the first private address when it is determined that the 7 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 second responder and the first responder are the same responder.

[0066] In a possible implementation, the transmitting unit is configured to: transmit the second frame carrying the first private address and the first random number to the initiator.

[0067] In a possible implementation, the first frame is a RIM frame carrying a list associated with responders that are scheduled to participate in an MMS ranging, and the responders include the first responder; and the generating unit is configured to: generate the first private address when it is determined that the first responder is scheduled to the first access slot among multiple access slots based on the list.

[0068] In a possible implementation, the second frame includes any one of: an ADV-RESP frame, a RESP frame, or a RPRT frame.

[0069] In a possible implementation, the first frame or the second frame is a secured frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame.

[0070] In a possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the secured frame.

[0071] In a possible implementation, the first Nonce further includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[0072] In a possible implementation, the second frame further carries a private address of the initiator.

[0073] In a possible implementation, the receiving unit is further configured to: receive a third frame carrying time­ offset information from the initiator, and the time-offset information indicates a time offset of a SOR frame transmitted.

[0074] According to a fourth aspect, this application provides a communication apparatus including: a receiving unit, configured to receive a second frame carrying a first private address from a first responder, where the first private address is associated with information related to an identity of the first responder; a generating unit, con figured to generate a third private address based on the information related to the identity of the first responder; and a verifying unit, configured to verily the identity of the first responder by comparing the third private address with the first private address.

[0075] In a possible implementation, the information related to the identity of the first responder includes any one of: a public address of the first responder, MMS ranging configuration requested by the first responder, a first random number generated by the first responder, or an IRK unique to the initiator and the first responder.

[0076] In a possible implementation, the communication apparatus further includes a transmitting unit configured to: transmit a first frame for initiating a ranging process, and the first frame carries a second random number, and the second 8 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 random number is associated with a second private address of the initiator; and the generating unit is configured to: generate the third private address based on the second random number and the information related to the identity of the first responder.

[0077] In a possible implementation, the generating unit is further configured to: generate a fourth private address based on information related to an identity of a second responder; and the transmitting unit is further configured to: transmit a frame carrying the fourth private address to the second responder.

[0078] In a possible implementation, the second frame further carries the first random number, the generating unit is configured to: generate the third private address based on the first random number.

[0079] In a possible implementation, the transmitting unit is further configured to: transmit a first frame for initiating a ranging process to the first responder, and the first frame is a RIM frame carrying a list associated with responders that are scheduled to participate in MMS ranging, and the responders include the first responder.

[0080] In a possible implementation, the second frame includes any one of: an ADV-RESP frame, a RESP frame, or a RPRT frame.

[0081] In a possible implementation, the first frame or the second frame is a secured frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame.

[0082] In a possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the secured frame.

[0083] In a possible implementation, the first Nonce further includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[0084] In a possible implementation, the second frame further carries a private address of the initiator; the verifying unit is further configured to: verify the identity of the first responder based on the private address of the initiator.

[0085] In a possible implementation, the transmitting unit is further configured to: transmit a third frame carrying time­ offset information to the first responder, and the time-offset information indicates a time offset of a SOR frame transmitted.

[0086] According to a fifth aspect, a communication apparatus including a processor and a memory is provided. The processor is connected to the memory. The memory is configured to store instructions, and the processor is configured to execute the instructions. When the processor executes the instructions stored in the memory, the processor is enabled to perform the method in any possible implementation of the first aspect or the second aspect.

[0087] According to a sixth aspect, this application provides a communication system, which includes communication apparatus in any possible implementation of the third aspect, as well as communication apparatus in any possible 9 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 implementation of the fourth aspect.

[0088] According to a seventh aspect, this application provides a computer readable storage medium, which includes instructions. When the instructions run on a processor, the processor is enabled to perform the method in any possible implementation of the first aspect or the second aspect.

[0089] According to an eighth aspect, this application provides a computer program product, which includes computer program code. When the computer program code runs on a computer, the computer is enabled to perform the method in any possible implementation of the first aspect or the second aspect.

[0090] It should be noted that all or a part of the above computer program code can be stored in on a first storage medium. The first storage medium can be packaged together with the processor or separately with the processor.

[0091] According to a ninth aspect, this application provides a chip system, which includes a memory and a processor. The memory is configured to store a computer program, and the processor is configured to invoke the computer program from the memory and run the computer program, so that an electronic device on which the chip system is disposed performs the method in any possible implementation of the first aspect or the second aspect. DESCRIPTION OF DRAWINGS

[0092] FIG. 1 illustrates transmission of compressed frames in an MMS ranging session.

[0093] FIG. 2 is a schematic flowchart of a communication method according to an embodiment of the present application.

[0094] FIG.3 is a schematic flowchart of another communication method according to an embodiment of the present application.

[0095] FIG. 4 is a schematic diagram of an ADV-POLL frame or a POLL frame.

[0096] FIG. 5 is a schematic diagram of an ADV-RESP frame or a RESP frame according to an embodiment of the present application.

[0097] FIG. 6 is a schematic diagram of another ADV-RESP frame or another RESP frame according to an embodiment of the present application.

[0098] FIG. 7 is a schematic diagram of still another ADV-RESP frame or still another RESP frame according to an embodiment of the present application.

[0099] FIG. 8 is a schematic diagram of a SOR frame.

[0100] FIG. 9 is a schematic diagram of a secured compressed frame according to an embodiment of the present 10 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 application.

[0101] FIG. 10 is a schematic diagram of a Nonce according to an embodiment of the present application.

[0102] FIG.11 is a schematic diagram of a method for constructing a Nonce according to an embodiment of the present application.

[0103] FIG. 12 is a schematic flowchart of still another communication method according to an embodiment of the present application.

[0104] FIG. 13 is a schematic flowchart of yet another communication method according to an embodiment of the present application.

[0105] FIG. 14 is a schematic flowchart of yet another communication method according to an embodiment of the present application.

[0106] FIG. 15 is a schematic flowchart of yet another communication method according to an embodiment of the present application.

[0107] FIG. 16 is a schematic diagram of a RIM frame according to an embodiment of the present application.

[0108] FIG. 17 is a schematic flowchart of yet another communication method with selective MMS ranging according to an embodiment of the present application.

[0109] FIG.18 is a schematic block diagram of a communication apparatus according to an embodiment of the present application.

[0110] FIG. 19 is a schematic block diagram of another communication apparatus according to an embodiment of the present application.

[0111] FIG. 20 is a schematic block diagram of still another communication apparatus according to an embodiment of the present application. DESCRIPTION OF EMBODIMENTS

[0112] For ease of understanding, the following illustrates an MMS ranging session.

[0113] As shown in FIG. 1. an MMS ranging session may include an initialization and setup phase followed by one or more range measurement cycles. During the initialization and setup phase, the frames are transmitted in an initialization channel, while during the measurement cycles, the frames are transmitted in a ranging channel.While it is possible to use the same channel as both the initialization channel and the ranging channel, it is more likely that one or more well-known channels will be used as the initialization channel. 11 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0114] In the initialization and setup phase, initiators and responders may negotiate ranging configuration. An initiator transmits ADV-POLL frames opportunistically at times and intervals to its discretion while responder(s) may opportunistically listen for incoming ADV-POLL frames and respond with an ADV-RESP frame if the responder intends to participate in a ranging session with the initiator. Once the initiator has received an ADV-RESP frame, it transmits a SOR frame that provides the time offset at which the first range-measurement cycle will start.

[0115] A measurement cycle comprises a ranging control phase, a ranging phase, and an optional measurement report phase.A ranging control phase starts at the beginning of a range-measurement cycle. An initiator starts the ranging control phase by transmitting a POLL frame to a responder at the beginning of the first ranging slot of a ranging round. A responder that receives the POLL frame successfully transmits a RESP frame back to the initiator. The POLL and RESP frames allow the initiator and responder to achieve time and frequency synchronization. An initiator may also include other control information in the POLL frame for the responder. In the ranging phase, the initiator and responder may exchange zero or more UWB ranging sequence fragments (RSF) and optionally one or more UWB ranging integrity fragments (RIF). The RSFs are used to perform ranging measurements while the RIFs are used to check the integrity of the ranging measurements.After the initiator or the responder, completes the reception of all UWB fragments for the ranging phase, the report phase starts in which the initiator and / or the responder generate a ranging measurement report, and transmit the RPRT frame carries the measurement report to the peer device.

[0116] MMS ranging comes in two flavors: 1) UWB only MMS ranging, in which the control frames as well as the ranging fragments are transmitted using UWB; and 2) narrowband assisted UWB (NBA-UWB) MMS ranging, in which the ranging fragments are transmitted using UWB while the control signals are transmitted using narrow band.

[0117] The transmission of frames in MMS ranging sessions is based on the block-based time structure. As shown in FIG.l, the frames are transmitted outside a block structure during the initialization and setup phase, and the frames are transmitted inside a block structure during the measurement cycles.In the block-based time structure, each ranging block consists of a whole number of ranging rounds, where a ranging round is a period of sufficient duration to complete one entire range-measurement cycle involving the set of enhanced ranging capable devices (ERDEVs) participating in the ranging exchange. Here, when a frame is said to be transmitted or received Inside block structure, it means that both the initiator and the responder are aware of the block-based time structure and are in sync. However, if either one or both is not aware of the block-based time the frame is said to be transmitted or received Outside block structure. Each ranging round is further subdivided into an integer number of ranging slots where a ranging slot is a time period of sufficient duration for the transmission of at least one ranging frame (RFRAME). The block-based mode uses a structured timeline where the ranging block structure is periodic by default.12 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0118] The following describes the technical solutions in this application with reference to the accompanying drawings.

[0119] FIG. 2 illustrates a flowchart of an embodiment a communication method. The method may be applied to an MMS ranging process. An initiator may be a device that initiates a UWB exchange by transmitting a message of the exchange. A responder may be a device that responds to the message received from the initiator and participates in the UWB exchange.

[0120] SI 10: The initiator transmits a first frame to a first responder.

[0121] The first frame carries a second random number and a second private address of the initiator, where the second private address is associated with the second random number.For example, the second private address is generated by using a hash function over the second random number combined with a second IRK, and the second IRK is pre-negotiated between the initiator and the first responder.

[0122] In some possible implementations, the first frame is used to initiate a ranging process. For example, the first frame may be one of an ADV-POLL frame, a POLL frame, and a RIM frame. The RIM frame can be regarded as a variation of the POLL frame.

[0123] S120: The first responder generates a first private address based on the first frame and information related to an identity of the first responder.

[0124] The information related to the identity of the first responder is known to the initiator. For example, the information related to the identity of the first responder is pre-negotiated between the initiator and the first responder, or the information related to the identity of the first responder is the first responder informs the initiator.For the former situation, the information related to the identity of the first responder includes any one of a public address of the first responder and an IRK unique to the initiator and the first responder (e.g., IRK-RI). For the latter situation, the information related to the identity of the first responder includes any one of MMS ranging configuration requested by the first responder and a first random number generated by the first responder.

[0125] For example, the first responder’s public address includes an in band extended address or an OOB public address.

[0126] For example, the in band extended address may include 8 octets extended media access control (MAC) address. The OOB public address may include 6 octets Bluetooth MAC address. In some embodiments, the first responder’s public address may also include other communication addresses that uniquely identify the first responder.

[0127] For example, the first responder’s requested MMS ranging configuration may include at least one of the following: UWB physical layer (PHY) configuration, UWB MAC configuration, narrowband (NB) PHY configuration, and NB MAC configuration.

[0128] Optionally, the first responder generates a first private address based on the first frame and information related to an identity of the first responder includes: the first responder generates the first private address based on the second random 13 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 number and the information related to the identity of the first responder.

[0129] In some embodiments, the first responder generates the first private address based on the second random number and the information related to the identity of the first responder includes: the first responder generates the first private address by using the first random and the information related to the identity of the first responder combined with a first IRK pre­ negotiated between the initiator and the first responder as inputs to a suitable hash function; or the first responder generates the first private address by using the first random and the information related to the identity of the first responder as inputs to a suitable hash function. The suitable hash function was pre-negotiated between the initiator and the first responder.

[0130] For example, the first private address may be generated by using an equation as follow: Hash = AH (IRK, random number), and the Hash represents the first private address.AH() represents a hash function, IRK can be the first IRK or the IRK unique to the initiator and the first responder, and random number can be the second random number or the first random number.

[0131] For example, the first IRK includes: a common IRK shared between the initiator and multiple responders, and the multiple responders include the first responder; or an IRK unique to the initiator and a first responder.

[0132] Optionally, the second IRK and the first IRK are the same, or the second IRK and the first IRK are pairwise.

[0133] In other embodiments, the first responder generates the first private address based on the second random number and the information related to the identity of the first responder includes: the first responder generates the first private address based on the information related to the identity of the first responder after verified the identity of the initiator by using the second random number and the second private address.

[0134] For example, the first responder verifies the identity of the initiator by using the second random number and the second private address, includes: the first responder verifies the identity of the initiator by using the second IRK, the second random number, and the second private address. Specifically, the first responder generates a local private address of the second random number using the first IRK. The first responder will determine the identity verification of the initiator is successful if the local private address matches the second private address carried in the first frame, otherwise the first responder will discard the first frame.

[0135] S130: The first responder transmits a second frame carrying the first private address to the initiator.

[0136] For example, the second frame may be one of an ADV-RESP frame and a RESP frame, and a RPRT frame.

[0137] In some possible implementations, if the first private address is generated based on the first random number, the second frame will carry the first private address and the first random number.

[0138] In some possible implementations, the second frame also carries the second private address.

[0139] S140: The initiator verifies the identity of the first responder based on the first private address. 14 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0140] For example, the initiator verifies the identity of the first responder by using the information related to the identity of the first responder and the first IRK, which is pre-negotiated between the initiator and the first responder. Specifically, the initiator generates a local private address (e.g., a third private address) of the specific random number by using the first IRK and the information related to the identity of the first responder.The initiator will determine the identity verification of the first responder is successful if the local private address matches the first private address carried in the second frame, otherwise the initiator will discard the second frame.

[0141] For example, the specific random number may include the first random number or the second random number. The specific random number includes the first random number when the first private address is generated based on the first random number. The specific random number includes the second random number when the first private address is generated based on the second random number.

[0142] In some possible implementations, the initiator generates the second private address based on information related to an identity of a second responder. The first responder generates a local private address based on the information related to an identity of the second responder.If the first responder is able to verify the second private address successfully, then the first responder determines that the second responder is the same as the first responder and generates the first private address.

[0143] In some possible implementations, the initiator generates a fourth private address based on information related to an identity of a second responder and transmits frames carrying the fourth private address to the second responder and the first responder. It should be noted that only the second responder can verify the fourth private address successfully due to the fourth private address is generated based on the second responder’s identity.

[0144] Optionally, the first frame or the second frame is a secured frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame.

[0145] For example, the first responder generates the first Nonce based on the ID field and private address field of the second frame as wel I as a slot, round, and block in which the second frame is transmitted.

[0146] Optionally, the first Nonce includes frame counter information, and the frame counter information indicates the slot, round, and block in which the second frame is transmitted.

[0147] Optionally, the first Nonce also includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[0148] It should be noted that the first frame and the second frame are compressed frames in the present application. 15 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 The compressed frame is either a compressed PSDU or an IEEE Standard 802.15.4 frame using the compressed header information element (Header IE) format.

[0149] In some possible implementations, a controller assumes the role of the initiator while the controlee is assigned the role of the first responder, however it is also possible that the controlee may be assigned the role of the initiator while the controller assumes the role of the first responder. It should be noted that the controller is a device used to control the UWB session and define the session parameters, and the controlee is a device that utilizes the session parameters received from the controller to participate in the UWB session.

[0150] The communication method provided in embodiments of the present application in a one-to-one MMS ranging session is described below in detail with reference to FIG. 3 to FIG. 12. The embodiments shown in FIG. 3 to FIG. 12 are illustrated with a controller as an initiator and a controlee as a responder as examples.

[0151] FIG. 3 illustrates a schematic flowchart of a communication method in one-to-one MMS ranging according to an embodiment of the present application. The method shown in FIG.3 includes a session setup phase and steps S210 to S270.

[0152] An MMS ranging session begins with a controller and a controlee performing a session setup during which the long-term session parameters such as UWB channel number, preamble codes, block structure, and so on are negotiated. Specifically, at least one IRK will also be provided by the controller to the controlee to resolve or create the private addresses during the session setup.Besides, for NBA-UWB MMS ranging, parameters related to narrow bands such as the NB channel number and the number of MMS fragments may also be negotiated during the session setup. Additionally, the initiator and responder roles may also be assigned during the session setup.

[0153] For example, at least one IRK may include at least one of the first IRK and the second IRK in the above embodiment.

[0154] Understandably, the long-term parameters are not expected to change during an MMS ranging session.

[0155] In contrast, the parameters related to a measurement cycle such as round / slot durations, number of MMS fragments, report modes, etc. may be considered as short-term parameters and may be modified during an MMS ranging session.

[0156] The session setup may be performed out-of-band, for example using Bluetooth or Wi-Fi radio, or may also be performed in-band, for example using NB or UWB radio.

[0157] Once the session has been set up, step S210 is performed.

[0158] S210: An initiator transmits an ADV-POLL frame.

[0159] For example, the initiator transmits the ADV-POLL frames opportunistically at times and intervals to its discretion while responder(s) may opportunistically listen for incoming ADV-POLL frames. An ADV-POLL frame may carry a pseudo random number RPA_prand-I-l and its private address RPA_hash-I-l, and the RPA_hash-I-l can be regarded as an 16 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 example of the second private address in the above embodiment.

[0160] For example, the RPA_hash-I-l may be computed and truncated to 24 bits by using Equation 1:

[0161] RPA_hash-I-l = AES-128-ECB(key=IRK, data=(0x000...

[13] \\RPA_prand-I-l[3])) %2*24. Equation 1

[0162] AES-128-ECB is a hash function, which can also be replaced by other hash functions, [n] indicates that its preceding parameter is n octets.

[0163] The IRK may be a common IRK pre-negotiated, for example, IRK-B, between the initiator and the responder.

[0164] A schematic diagram of an ADV-POLL frame is illustrated in FIG. 4. As shown in FIG. 4, an ADV-POLL frame is composed of: a 1-octet message ID field, a 3-octets private address field that carries the Initiator RPA hash (e.g., RPAhash- 1-1), a 3-octets field that carries the Initiator RPA_prand (e.g., RPA_prand-I-l), a one octet MessageControl field that determines the format of the MessageContent field, a variable length MessageContent field whose format depends on the content of the MessageContent field, and a 2-octets cyclic redundancy check (CRC) field. The Initiator RPA_hash may also be termed as initiator’s RPA hash or initiator’s private address. The Initiator RPA_prand may also be termed as initiator’s RPA_prand or initiator’s random number.

[0165] Upon receiving the ADV-POLL frame, the responder generates a local hash of the RPA_prand-I-l by using the pre-negotiated IRK, such as the above IRK-B.For example, the responder generates the local hash of the RPA_prand-I-l by using the IRK-B as input to Equation 1. Furthermore, if the local hash does not match the RPA_hash-I-l carried in the ADV­ POLL frame, the responder will discard the ADV-POLL frame; otherwise, the responder will determine the identity verification of the initiator is successful, and then the responder will transmit an ADV-RESP frame to the initiator if the responder intends to participate in a ranging session with the initiator as illustrated in step S220.

[0166] S220: The responder transmits an ADV-RESP frame to the initiator.

[0167] Specifically, the ADV-RESP frame carries a private address that can identify the responder, i.e., RPA_hash-R-l, which is generated by using information related to the responder’s identity. The RPA_hash-R-l can be regarded as an example of the first private address in the above embodiment.

[0168] Once the initiator has received the ADV-RESP frame, the initiator verifies the identity of the responder based on the RPA_hash-R-l.

[0169] In one embodiment, the information related to the responder’s identity may include the responder’s public address Responder MAC Address, such as 8 octets extended 802.15 MAC address, then RPA_hash-R-l may be computed and truncated to 24 bits by using Equation 2:

[0170] RPA_hash-R-l = AES-128-ECB(key=IRK, data=(0x000...[5] || Responder MAC Address [8] || RPA_prand-I- 1]) % 2^24. Equation 2 17 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0171] Furthermore, once the initiator has received the ADV-RESP frame, the initiator generates a local hash for the responder using the responders’ public address (e.g., 8 octets extended 802.15 MAC address) combined with the RPA_prand- 1-1 carried in the ADV-POLL and using the IRK as inputs to Equation 2.

[0172] In another embodiment, the information related to the responder’s identity may include MMS ranging configuration requested by the responder, such as the various NB and UWB configuration requested by the responder in the ADV-RESP frame, then RPA_hash-R-l may be computed and truncated to 24 bits by the using the following Equation 3:

[0173] RPA_hash-R-l = AES-128-ECB(key=IRK, data=(0x00[l] 11 UWB PHY Config 11 UWB MAC Config 11 NB PHY Config \\ NB MAC Config \\ RPA _prand-I-l]) % 2*24. Equations

[0174] Here, UWB PHY Config. UWB MAC Config. NB PHY Config, and NB MAC Config refer to the various configuration parameters carried in the MessageContent field of the ADV-RESP frame.

[0175] It should be noted that as long as there is at least 1-bit difference in the configuration requested by different responders, the responder’s private address will be unique and can be used to identify the responder in subsequent frames.

[0176] Furthermore, once the initiator has received the ADV-RESP frame, the initiator generates a local hash for the responder using the configuration parameters carried in the MessageContent field of the ADV-RESP frame combined with the RPA_prand-I-l and using the IRK as inputs to above Equation 3.

[0177] In still another embodiment, the information related to the responder’s identity may include the responder’s public address Responder OOB MAC Address, such as 6 octets Bluetooth MAC address, then RPA_hash-R-l may be computed and truncated to 24 bits by using Equation 4'.

[0178] RPA_hash-R-l = AES-128-ECB(key=IRK, data=(0x000...[7] ||, 6 octets Bluetooth MAC address [6] || RPA_prand-I-l]) % 2'24. Equation 4

[0179] Furthermore, once the initiator has received the ADV-RESP frame, the initiator generates a local hash for the responder using the responders’ public address (e.g., 6 octets Bluetooth MAC address) combined with the RPA_prand-I-l and using the IRK as inputs to Equation 4.

[0180] In some possible implementations, the initiator would maintain a record of the public address of the responder(s) during the session setup.

[0181] In yet another embodiment, the information related to the responder’s identity may include one IRK (e.g. IRK- RI) of the pairwise IRK (e.g. IRK-RI & IRK-IR) unique to the initiator and the first responder and used for frames transmitted by the responder to the initiator, then RPA_hash-R-1 may be computed and truncated to 24 bits by using Equation 5:

[0182] RPA_hash-R-l = AES-128-ECB(key=IRK-RI, data=(0x000...

[13] || Initiator RPA_prand-I-l]) % 2'24. Equation 5 18 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0183] Furthermore, once the initiator has received the ADV-RESP frame, the initiator generates a local hash for the responder using the IRK-RI combined with the RPA_prand-I-l as inputs to Equation 5.

[0184] A schematic diagram of an ADV-RESP frame carrying the responder’s private address (e.g., RPA_hash-R-l) generated by any one of the above Equations 2 to 5 is illustrated in FIG. 5. As shown in FIG.5, an ADV-RESP frame is composed of: a 1-octet message ID field, a 3-octets field that carries the responder’s private address (e.g., RPA_hash-R-l), a one octet MessageControl field that determines the format of the MessageContent field, a variable length MessageContent field whose format depends on the content of the MessageContent field, and a 2-octets CRC field.

[0185] In some embodiments, the ADV-RESP frame also carries the private address obtained from the ADV-POLL, which is Initiator RPA_hash. A schematic diagram of an ADV-RESP frame carrying the responder’s private address and the initiator’s private address is illustrated in FIG. 6.

[0186] The inclusion of both the Initiator RPA_hash and the Responder RPA_hash in the ADV-RESP frame makes it easier to identify the associated IRK and simplifies the identity verification of the initiator to the responder.Specifically, if the Initiator RPA_hash carried in the ADV-RESP frame does not match the Initiator RPA_hash carried in the ADV-POLL frame, the initiator will determine the identity verification of the responder is unsuccessful, otherwise the initiator will further verify the identity of the responder based on the Responder RPA_hash. The Responder RPA_hash may also be termed as responder’s RPA hash or responder’s private address.

[0187] In some embodiments, the information related to the responder’s identity may include the random number (e.g. RPA_prand-R-l) generated by the responder, then RPA_hash-R-l may be computed and truncated to 24 bits by using Equation 6:

[0188] RPA_hash-R-l = AES-128-ECB(key=IRK, data=(0x000...

[13] || RPA_prand-R-l])) % 2''24. Equation 6

[0189] For example, the responder generates its own pseudo random number RPA_prand-R-l using any suitable pseudo random generator function.

[0190] In one embodiment, the responder generates the RPA_prand-R-l tvhen the responder has successfully verified the identity of the initiator.

[0191] In another embodiment, the responder generates the RPA_prand-R-l every time the ADV-RESR and RESP frames are transmitted.

[0192] Besides, the ADV-RESP frame also needs to carry the responder’s random number if the RPA_hash-R-l is generated by using Equation 6. so that the initiator can verify the identity of the responder. The schematic diagram of an ADV- RESP frame carrying the responder’s private address and responder’s random number is illustrated in FIG. 7. Optionally, the frame shown in FIG. 7 may cany the initiator’s private address obtained from the ADV-POLL or not. 19 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0193] It should be noted that the different formats of the ADV-RESP or RESP frames may be differentiated by using different IDs for the frames, e.g., 0x02 for the format shown in FIG.5, 0x32 for the format shown in FIG. 6 and 0x42 for the format shown in FIG. 7 etc.

[0194] It should be noted that the IRK used in Equations 2 to 4 and Equation 6 may be the first IRK in the foregoing embodiment. For example, the IRK used in Equations 2 to 4 and Equation 6 may be a common IRK (e.g., IRK-B), or the IRK used in Equations 2 to 4 and Equation 6 may be one of the pairwise IRK (e.g., IRK-RI). Besides, Equations 2 to 6 can be regarded as some specific examples of Hash = AH (IRK, random number).

[0195] Furthermore, if the local hash for the responder does not match the RPA_hash-R-l carried in the ADV-RESP frame, the initiator will discard the ADV-RESP frame; otherwise, the initiator will determine the identity verification of the responder is successful, and then the initiator will transmit a SOR frame to the responder as illustrated in step S230.

[0196] S230: The initiator transmits a SOR frame to the responder.

[0197] Specifically, the SOR frame provides the time offset at which the first range-measurement cycle will start. The SOR frame carries the same RPA_hash-I-l contained in the ADV-POLL frame.

[0198] A schematic diagram of a SOR frame is illustrated in FIG. 8. As shown in FIG. 8, an SOR frame is composed of: a 1-octet message ID field, a 3-octets private address field that carries the Initiator RPA_hash (e.g., RPA_hash-I-l), a 1-octet MessageControl field that determines the format of the MessageContent field, a variable length MessageContent field whose format depends on the content of the MessageContent field, and a 2-octets CRC field. The SOR frame carries a time offset that indicates the time at which the measurement phase of the MMS ranging will start.

[0199] S240: The initiator transmits a POLL frame to the responder.

[0200] At the time indicated by the time offset in the SOR frame, the initiator transmits a POLL frame to the responder at the beginning of the first ranging slot of a ranging round.

[0201] For example, the POLL frame shares the same format illustrated in FIG.4 and carries a pseudo random number RPA_prand-I-2 and its private address, RPA_hash-I-2 that is generated using RPA_prand-I-2 and the IRK as inputs to Equation 1.

[0202] Upon receiving the POLL frame, the responder verifies the identity of the initiator based on the private address earned in the POLL frame. Reference is made to the verification method based on the ADV-POLL frame in S210 for specific verification method. Details are not described herein again.

[0203] The responder will transmit a RESP frame to the initiator, as illustrated in step S250, when the identity verification of the initiator is successful.

[0204] S250: The responder transmits a RESP frame to the initiator.20 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0205] Specifically, the RESP frame carries the responder’s private address, such as RPA_hash-R-2. Reference is made to the detailed description in S220 for the method of generating the responder’s private addresses, the format of the RESP frame, and the method of verifying the responder’s identity based on the RESP frame by the initiator. The method is the same except that the pseudo random number carried in the POLL frame (e.g., RPA_prand-I-2) is used to generate the Responder RPA_hash. In short, when generating RPA_hash-R-2 using an aforementioned equation, the RPA_prand-I-l in the related equation is replaced with RPA_prand-I-2. Details are not described herein again.

[0206] When the identity verification of the responder is successful, the initiator initiates the ranging phase in which the initiator and responder exchange zero or more RSF and optionally one or more RIF.

[0207] After the initiator or the responder completes the reception of all UWB fragments for the ranging phase, the initiator and / or the responder generate a ranging measurement report, and transmit the RPRT frame that carries the measurement report to the peer device as iilustrated in step S260 and S270.

[0208] S260: The responder transmits a RPPT frame to the initiator.

[0209] For exampie, the RPRT frame in this step shares the same format illustrated in FIG.8 and carries a private address, RPA_hash-R-2 that is generated in step S250.

[0210] S270: The initiator transmits a RPPT frame to the responder.

[0211] For example, the RPRT frame in this step shares the same format illustrated in FIG.8 and carries a private address, RPA_hash-I-2 that is generated in step S240.

[0212] Considering the sensitive nature of some information carried in the above frames, a secured compressed frame is provided in the embodiment of the present application to improve the security of information.

[0213] It should be noted that the secured compressed frame in the present application is a compressed frame that is secured using a cryptographic operation such as authentication or encryption.

[0214] FIG. 9 illustrates a schematic diagram of a secured compressed frame. As shown in FIG. 9, the fields of a secured compressed frame are as follows:

[0215] f. The ID field indicates the identity of the secured version of the compressed frame, for example, ID space 0x60 to 0x6F may be reserved for secured versions of compressed frames and 0x60 represents the secured ADV-RESP frame, 0x61 represent the secured version of the SOR frame, 0x65 and 0x66 represent the secured version of the RPRT frame transmitted by the initiator and responder respectively. The RPRT frame may also be termed as REPORT frame.

[0216] 2. A 3-octets private address field that carries the RPA hash.

[0217] 3. An optional 3-octets field that carries the RPA_prand. The field may be only present in certain frames (e.g., ADV-POLL or POLL) and absent in other compressed PSDUs (e.g., ADV-RESP, RESP, SOR, REPORT). 21 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0218] 4. A 1 -octet MessageControl field that determines the format of the MessageContent field.

[0219] 5. A variable length MessageContent field whose format depends on the content of the MessageContent field. All or part of the MessageContent field will be encrypted if a security level for encryption is chosen. If only a part of the MessageContent field is encrypted, the sub-fields to be encrypted (also known as the private payload field) will be placed at the end of the MessageContent field while the sub-fields that are not encrypted (also known as the open payload field) are placed at the beginning of the MessageContent field.

[0220] 6. A variable length message integrity check (MIC) field replaces the CRC field. The length of the MIC depends on the security level.For example, the length of the MIC may be one of 0 octet, 4 octets, and 8 octets. When the length of the MIC is 0 octets, the frame is not secured and the field is used for the 2-octet CRC.

[0221] In some possible implementations, all or part of the content in the MessageContent field can be encrypted by authenticated encryption with associated data (AEAD) operation based on a Nonce.

[0222] It should be noted that when security is enabled, one or more secret keys different from the IRK may be exchanged between the initiator and responder(s) used for the AEAD operation.

[0223] The Nonce used for the AEAD transformation or inverse transformation of a secured compressed frame is illustrated in FIG. 10. This Nonce format may be used for compressed frame transmitted outside the block or inside the block structure. As shown in FIG. 10, the fields of a Nonce are as follows:

[0224] 1. The RPA_hash field is set to the RPA_hash field of the compressed frame to be secured or unsecured.

[0225] 2.The RPA prand field is set to the RPA prand field of the compressed frame to be secured, if such a field exists, else it is set as the RPA_prand that is used to generate the RPA_hash field of the compressed frame to be secured or unsecured.

[0226] 3. The ID field is set to the ID field of the compressed frame to be secured or unsecured.

[0227] 4. If a block structure exists and is known to both the transmitting and the receiving device (e.g., Inside block structure in FIG. 1), the Frame Counter field includes the Slot Index field, Round Index field and the Block Index field which are set as the indices of the slot, round and block in which the frame is transmitted or received respectively. If a block structure does not exist and or is not known to at least one of the transmitting or the receiving device (e.g., Outside block structure in FIG. 1), the Frame Counter field is reserved and set to 0.The information carried in the Frame Counter field can be regarded as an example of frame counter information.

[0228] 5. A 1 -bit field called Block Structure Indicator indicates whether the secured frame is transmitted inside or outside a block structure. For example, the Block Structure Indicator field is set to zero in a secured compressed frame transmitted outside the block structure and is set to one in a secured compressed frame transmitted inside the block structure. 22 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 The information carried in the Block Structure Indicator field can be regarded as an example of block structure indication information.

[0229] 6. The Security Level field is an unsigned integer that shall be set to the value of the security level negotiated during session setup.

[0230] Besides, FIG.11 illustrates how the Nonce is constructed for the security operation related to a secured compressed frame transmitted inside the block structure according to an embodiment of the present application.

[0231] Once a device is synchronized to the block structure, it knows the slot / round / block index where the compressed frame is transmitted or received, and it can construct the Frame Counter field of the Nonce, else the Frame Counter field is set as 0. For the example illustrated in FIG. 11, for a RPRT frame transmitted by the responder in the slot m of the round 1 of the block 1, the Slot Index field, the Round Index field and the Block Index field of the Frame Counter field of the Nonce are separately set as m, 1 and 1 corresponding to slot m, round 1 and block 1; while the Block Structure Indicator is set as one. The RPA hash field and the e ID field of the Nonce are copied over from the RPA hash field and the ID field of the REPORT frame.However, since the RPA_prand field does not exist in the REPORT frame, the RPA_prand field of the Nonce is set as the RPA—prand used to generate the RPA hash field, for example, the RPA_prand carried in the preceding POLL frame transmitted by the initiator. The Nonce Security Level is set to the appropriate security level, for example, the security level negotiated during session setup.

[0232] Similarly, for a frame transmitted outside the block structure, for example, an SOR frame, the Frame Counter field of the Nonce is all set to 0; while the Block Structure Indicator is set as zero. The RPA hash field and the Message ID field of the Nonce are copied over from the RPA_hash field and the ID field of the SOR frame. Since the RPA_prand field does not exist in the SOR frame, the RPAprand field of the Nonce is set as the RPA prand used to generate the RPA hash field, i.e., the RPA_prand carried in the preceding ADV-POLL frame transmitted by the initiator.The Nonce Security Level is set to the appropriate security level, for example, the security level negotiated during session setup.

[0233] For example, to secure or unsecure the compressed frames, the procedures given in 9.3.5 (AEAD transformation data representation) or 9.3.6 (AEAD inverse transformation data representation) in the 802.15.4-2020 specification are reused, except that for the compressed frames the MAC header (MHR) is replaced by the ID field, the RPA_hash field, the RPA_prand field (if present) and the MessageControl field.

[0234] While in most secured compressed frames, the whole MessageControl field is considered the Private Payload field and will be encrypted if any security level with encryption is negotiated, however for the secured RPRT compressed frames (SECURE-RPRT), only selected fields of the MessageControl field may be considered to be the Private Payload field and will be encrypted if any security level with encryption is negotiated.This is summarized in the Table 1: 23 WO 2024 / 254833 PCT / CN2023 / 100512 Table 1 Frame type Private Payload field Open Payload field SECURE-RPRT (from initiator) TumAroundTime All other fields in the MessageContent field SECURE-RPRT (from responder) Any of the following fields if present, and in this order: ReplyTime NbaChannelMap UWB PHY Config UWB MAC Config NB PHY Config All other fields in the MessageContent field All other secured compressed PSDUs MessageContent Empty

[0235] In the above embodiment, the security of communication during MMS ranging can be further improved by encrypting the compressed frame. 5 10 15 20

[0236] In some possible implementations, UWB channel coordination may be active and prior to transmitting the SOR frame, the initiator scans the initialization channels in NB and the default UWB channels for acquisition packets (APs) from other initiators.In order to perform the acquisition scan, upon receiving the ADV-RESP frame from the responder, instead of immediately transmitting the SOR frame, the initiator transmits to the responder an advertising confirmation (ADV-CONF) frame that carries a time offset indicating the transmission time of the SOR, as shown in step S230’ in FIG. 12 and the initiator performs the acquisition scan for the APs. Based on the information gathered from the APs, the initiator can adapt the configuration parameters for the MMS ranging in the SOR frame.

[0237] The communication method provided in the embodiments of the present application can also be applied in one- to-many MMS ranging sessions. FIG. 13 to FIG. 15 illustrate schematic flowcharts of a communication method in one-to-many MMS ranging according to an embodiment of the present application.

[0238] As shown in FIG.13, similar to the one-to-one MMS ranging, a one-to-many MMS ranging session begins with a controller and the two controlees performing session setups during which the long-term session parameters such as the UWB channel number, preamble codes, block structures are negotiated. When privacy is enabled, at least one IRK will also be provided by the controller to each of the controlees to resolve the private addresses carried in the frames transmitted by the initiator and also to generate the private addresses to be included in the frames transmitted by the responders, thereby protecting the privacy of the devices.

[0239] Once the session has been set up, step S310 is performed.

[0240] S310: An initiator transmits ADV-POLL frames.

[0241] For example, the initiator transmits the ADV-POLL frames opportunistically at times and intervals to its 24 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 discretion while the responders may opportunistically listen for incoming ADV-POLL frames.

[0242] Specifically, for the method of generating initiator’s private addresses carried in ADV-POLL frames and the format of ADV-POLL frame, reference is made to the foregoing embodiments. Details are not described herein again.

[0243] When the initiator expects more than one responder to participate in the MMS ranging, the initiator allocates a fixed duration for the responders to contend the medium and transmit their respective ADV-RESP frames.

[0244] Upon receiving the ADV-POLL frame, Responder 1 or Responder 2 verifies the identity of the initiator. For the method of verifying the identity of the initiator, reference is made to the foregoing embodiments. Details are not described herein again.

[0245] When the identity verification of the initiator is successful, Responder 1 and Responder 2 will transmit an ADV- RESP frame to the initiator if they intend to participate in a ranging session with the initiator as illustrated in step S320. Specifically, S320 includes S321 and S322.

[0246] S321: Responder 1 transmits an AVD-RESP carrying its private address, RPA_hash-Rl-l to the initiator.

[0247] S322: Responder 2 transmits an AVD-RESP carrying its private address, RPA_hash-R2-l to the initiator.

[0248] For method of generating the private address, refer to the foregoing embodiments. Details are not described herein again.

[0249] S330: The initiator transmits a SOR frame to Responder 1 and Responder 2.

[0250] The initiator generates local hashes by the method in the foregoing embodiment. If at least one of the local hashes matches either one of RPA_hash-Rl-l or RPA_hash-R2-l. the initiator transmits the SOR frame that provides the time offset at which the first range-measurement cycle will start. The SOR frame carries the same RPA_hash-I-l contained in the ADV-POLL frame.

[0251] S340: The initiator transmits a RIM frame to Responder 1 and Responder 2.

[0252] At the time indicated by the time offset in the SOR frame, the initiator transmits a RIM frame to the responders at the beginning of the first ranging slot of a ranging round.

[0253] A schematic diagram of a RIM frame is illustrated in FIG. 16. Aside from providing time and frequency synchronization to the responders, another important purpose of the RIM frame is to provide the schedule of the access slots for the MMS ranging to the responders. As shown in FIG. 16, the MessageControl field of the RIM frame carries a list of the responders that are scheduled to participate in the MMS ranging. The Responder RPA_hash used in the ADV-RESP frame from responder n, for example. RPA_hash-Rn-\ (n =1, 2, etc.) is used as the responders’ private address and the sequence in which the Responder RPA_hash appears in the MessageContent field of the RIM frame decides the sequence of the responders’ access slots for the MMS ranging.Besides, the RIM frame may also carry the initiator’s second pseudo random number, RPA_prand- 25 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 J-2 in the Initiator RPA_prand field, and its private address, the RPA_hash-f-2 in the Initiator RPA_hash field, allowing the responders to verify the initiator’s identity.

[0254] For example, Responder 1 is scheduled to the first access slot (access slot 0) and Responder 2 is scheduled to the second access slot (access slot 1). Then steps S350 to S380 and S350’ to S380’ will be performed.

[0255] S350: Responder 1 transmits a RESP carrying its private address, RPA_hash-Rl-2 to the initiator.

[0256] Upon receiving the RIM frame, each responder receiving the RIM frame generates a local hash of the Initiator RPA_prand (e.g., RPA_prand-l-2) based on the IRK and if the local hash matches the RPA_hash-I-2 carried in the Initiator RPA hash field of the RIM frame, the responder will have verified the identity of the initiator.

[0257] A responder that receives the RIM frame successfully and that is scheduled to the first access slot (access slot 0), generates its own private address as described above but using the RPA_prand-I-2 carried in the RIM frame and transmits a RESP frame carrying the private address back to the initiator. As mentioned above, the responder may be Responder 1.

[0258] It should be noted that the RIM and RESP frames allow the initiator and responder to achieve time and frequency synchronization. An initiator may also include other control information in the RIM frame for the responder.

[0259] When the identity verification of the Responder 1 based on RESP is successful, the initiator initiates the ranging phase in which the initiator and responder exchange zero or more RSF and optionally one or more RIF.

[0260] After the initiator or the responder, completes the reception of all UWB fragments for the ranging phase, the initiator and / or the responder generate a ranging measurement report, and send the RPRT frame that carries the measurement report to the peer device, each carrying the appropriate private address, as illustrated in step S370 and S380.

[0261] Subsequently, as illustrated in step S340’, the initiator transmits a POLL frame to Responder 2 at the beginning of the first ranging slot of the second access slot (access slot 1).

[0262] The remaining steps in FIG. 13 are similar to the foregoing steps and the foregoing embodiments. Details are not described herein again.

[0263] In some possible implementations, the format of the ADV-RESP (or RESP) frame in FIG. 13 may be as shown in one of FIG. 5 to FIG. 7, and the specific format of the ADV-RESP (or RESP) frame can be determined by the parameters that are used to generate the ADV-RESP (or RESP) frame.For example, the format of the ADV-RESP (or RESP) frame in FIG. 13 may be as shown in FIG. 5 or FIG. 6 if the private address earned in an ADV-RESP (or RESP) frame is generated by using any one of Equations 2 to 5. Alternatively, the format of the ADV-RESP (or RESP) frame in FIG. 13 may be as shown in FIG. 7 if the private address earned in an ADV-RESP (or RESP) frame is generated by using Equation 6.

[0264] The one-to-many MMS ranging session shown in FIG. 14 is similar to that in FIG. 13. The difference is that UWB channel coordination may be active and prior to transmitting the SOR frame, the initiator scans the initialization channels 26 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 in NB and the default UWB channels for acquisition packets (APs) from other initiators.In order to perform the acquisition scan, upon receiving the ADV-RESP frame from the responder, instead of immediately transmitting a SOR frame, the initiator transmits to responders an ADV-CONF frame that carries a time offset indicating the transmission time of the SOR, as shown in step S330’ in FIG. 14 and the initiator performs the acquisition scan for the APs. Based on the information gathered from the APs, the initiator can adapt the configuration parameters for the MMS ranging in the SOR frame.

[0265] In some possible implementations, the format of the ADV-RESP (or RESP) frame in FIG. 14 may be as shown in FIG. 5 to FIG. 7, and the specific format of the ADV-RESP (or RESP) frame can be determined by the parameters that are used to generate the ADV-RESP (or RESP) frame. For example, the format of the ADV-RESP (or RESP) frame in FIG. 14 may be as shown in FIG. 5 or FIG.6 if the private address carried in an ADV-RESP (or RESP) frame is generated by using any one oi Equations 2 to 5. Alternatively, the format of the ADV-RESP (or RESP) frame in FIG. 14 may be as shown in FIG. 7 if the private address carried in an ADV-RESP (or RESP) frame is generated by using Equation 6.

[0266] The one-to-many MMS ranging session shown in FIG. 15 is also similar to that in FIG. 13. The difference is that the responders generate their own private addresses based on the pairwise IRK. In some of the aforementioned embodiments, it was assumed that the IRK exchanged between the initiator and all responders was common to all the responders, i.e., only a single IRK was maintained in the network for the purpose of identifying resolution. However, it is also possible that a common IRK (IRK-B) is shared between all initiators and responders in the same network only for the broadcast frame (e.g., RIM) and a pairwise IRK (IRK-IRn & IRK-RIn, n = responder index) is exchanged between the initiator and each responder for unicast frames in each direction (i.e.. one IRK (IRK-IRn, n = responder index) for initiator to responder frames and one IRK (IRK- RIn, n = responder index) for responder to initiator frames). The IRKs are used in subsequent frames as indirect means of identifying the transmitters of frames.

[0267] For example, for unicast frames (i.e., frames meant for a single responder, e.g., ADV-POLL frame, POLL frame, REPORT frame) to be transmitted to Responder n, the initiator generates a unique pseudo random number for the responder (RPA_prand-I-n) and uses the initiator’s pairwise IRK for the responder (IRK-IRn, n = responder index) to generate the Initiator RPA hash (RPA hash-I-n) by using Equation 1 and includes RPA_hash-I-n and RPA_prand-I-n in the initial unicast frames for Responder n.When Responder n receives the initial unicast frame transmitted by the initiator’s ADV-POLL(or POLL) frame, the Responder n generates a local hash of the Initiator RPA prand carried in the ADV-POLL (or POLL) frame and the IRK- IRn as inputs to Equation 1. If the local hash matches the Initiator RPA_hash carried in the ADV-POLL (or POLL) frame, the responder will have verified the identity of the initiator.

[0268] Similarly, for broadcast frames (i.e., frames meant for multiple responders, e.g., POLL for one-to-many ranging, i.e., RIM frame), the initiator generates a unique pseudo random number (RPA_prand-B-I) and uses the common broadcast 27 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 IRK (IRK-B) to generate the Initiator RPA_hash (RPA Jiash-B-T) by using Equation / and includes RPA _hash-B-J and RPA_prand-B-I) in the broadcast frame. When a responder receives the initial broadcast frame (e.g., RIM frame) transmitted by the initiator, the responder generates a local hash of the Initiator RPA_prand carried in the frame and the IRK-B as inputs to Equation 1. If the local hash matches the Initiator RPAhash carried in the frame, the responder will have verified the identity of the initiator.

[0269] Similarly, in its response frames, the Responder n includes its RPA hash generated by using Equation 5 as the only address field in its frames (e.g., ADV-RESP or RESP); responder uses its unique pairwise IRK (IRK-RIn) and Initiator RPA—prand (e.g., RPA_prand-I-n) in the preceding initial frame to generate it’s RPA hash (RPA hash-R-n). For example, Responder 1 generates its own private address based on IRK-RI1 and Responder 2 generates its own private address based on IRK-RI2 using Equation 5. Correspondingly, the initiator verifies the identity of Responder 1 based on IRK-RI1 and the identity of Responder 2 based on IRK-RI2.Based on the IRK used, the initiator is able to implicitly identify the responder (for example, by mapping the IRK to the initiator’s record of the responder’s public address). Another difference is that since pairwise IRK is used to generate the private address (e.g., Initiator RPA_hash) in the ADV-POLL and POLL frames, only the target responder (the responder that possess the correct IRK) is able to correctly verify the private address and hence only the targeted responder will respond to the ADV-POLL or POLL frame, with the ADV-RESP or RESP frame respectively. Correspondingly, the SOR frames are also targeted at one responder at a time. This allows the initiator to selectively choose the responder(s) to participate in the MMS ranging.

[0270] For example, the format of the ADV-RESP (or RESP) frame in FIG. 15 may be as shown in FIG. 5 to FIG.7, and the specific format of the ADV-RESP (or RESP) frame can be determined by the parameters that are used to generate the ADV-RESP (or RESP) frame. For example, the format of the ADV-RESP (or RESP) frame in FIG. 15 may be as shown in FIG. 5 or FIG. 6 if the private address carried in an ADV-RESP (or RESP) frame is generated by using any one of Equations 2 to 5. Alternatively, the format of the ADV-RESP (or RESP) frame in FIG. 15 may be as shown in FIG. 7 if the private address earned in an ADV-RESP (or RESP) frame is generated by using Equation 6.

[0271] In the above examples using a common IRK as shown in FIG. 3, and FIG. 12 to FIG. 14, the initiator’s ADV­ POLL and POLL frames were not directed at any particular responder and any responder that possessed the common IRK can verify the initiator’s private address and respond to the ADV-POLL and POLL frames.However, at times it is possible that the initiator may want to select a particular responder to participate in the MMS ranging. Such an example is shown in FIG. 17. The initiator can achieve this by including the target responder’s identity (e.g., the 8-octets extended 802.15 MAC address) and the ID of the compressed PSDU (e.g., ADV-POLL) in the computation of the Initiator RPA_hash for responder n (e.g., RPA_hash_I-Rn, n = 1,2, ...) and truncated to 24 bits by using Equation 7: 28 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0272] RPA_hash = AES-128-ECB(key=TRK, data=(0x000...[4] || ID || 8-octet.s extended 802.15 MAC address of responder n [8] \\ RPA prund-I / fA 2'24. Equation 7

[0273] For example, in a first ADV-POLL, the initiator includes Responder l’s extended 802.15 MAC address in the computation of the Initiator RPA hash (RP4 hash-f-R. / - C included in the ADV-POLL frame.Even though both Responder 1 and Responder 2 receive the ADV-POLL frame, only Responder 1 is able to verify the initiator’s private address (RPA_hash-I- Rl-1) and thereby, only Responder 1 responds with the ADV-RESP frame.

[0274] Similarly, the Responder n can also use the same Equation 7 to generate its private address (RPA_hash-Rn) to be used in the ADV-RESP and RESP frames. Although the same equation is used, the inclusion of the ID field (e.g., ADV- RESP) ensures that the private addresses generated by the initiator and the responders are different and the initiator can verify that the responder is in possession of a valid IRK. For example, the Responder 1 generates its private address using Equation 7 and transmits the ADV-RESP frame to the initiator, which then responds with a SOR frame to invite Responder 1 to participate in the one-to-one MMS ranging.Subsequently the initiator transmits another ADV-POLL targeted at Responder 2 and if it receives an ADV-RESP from the Responder 2, invites Responder 2 to joint Responder 1 for a one-to-many MMS ranging by transmitting a SOR frame to it. Here it is assumed that Responder 1 continues the MMS ranging session in the subsequent round / block. The RIM frame from the initiator assigns Responder 1 and Responder 2 to the first and second access slots of the one-to-many MMS ranging respectively by including their private addresses in the RIM frame as described earlier in FIG. 16.

[0275] It should be noted that the RPRT frame in foregoing embodiments may also cany an initiator’s private address and a responder’s private address.

[0276] It should be also noted that, for the method of generating the responder’s private address, for the method of verifying the responder’s identity, and for other related content in one-to-many MMS ranging session, reference is made to the foregoing embodiments.Details are not described herein again.

[0277] The present application provides a communication method allowing the initiator to determine whether the response frame is truly from the authorized responder. Especially, in one-to-many MMS ranging, the communication method enables the initiator to identify different responders without revealing the identities of responders. In addition, security of the compressed frame is taken into account.

[0278] Combined with the foregoing method embodiment, the present application further provides related devices, and the devices may be located in a controller or a controlee. The related devices may perform the steps of the foregoing method embodiment.

[0279] FIG. 18 is a schematic block diagram of a communication apparatus 2000 according to an embodiment of this application. The communication apparatus 2000 can perform the steps executed by the responder in foregoing embodiments. 29 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 As shown in FIG.18, the communication apparatus 2000 includes: a receiving unit 2010, configured to receive from an initiator, a first frame for initiating a ranging process; a generating unit 2020, configured to generate a first private address based on the first frame and information related to an identity of the first responder, and the information related to the identity of the first responder is known to the initiator; and a transmitting unit 2030, configured to transmit a second frame carrying the first private address to the initiator.

[0280] In a possible implementation, the information related to the identity of the first responder includes any one of: a public address of the first responder, MMS ranging configuration requested by the first responder, a first random number generated by the first responder, or an IRK unique to the initiator and the first responder.

[0281] In a possible implementation, the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generating unit 2020 is configured to: generate the first private address based on the second random number and the information related to the identity of the first responder.

[0282] In a possible implementation, the second private address is generated based on information related to an identity of a second responder, the generating unit 2020 is configured to: generate the first private address when it is determined that the second responder and the first responder are the same responder.

[0283] In a possible implementation, the transmitting unit 2030 is configured to: transmit the second frame carrying the first private address and the first random number to the initiator.

[0284] In a possible implementation, the first frame is a RIM frame carrying a list associated with responders that are scheduled to participate in an MMS ranging, and the responders include the first responder; and the generating unit 2020 is configured to: generate the first private address when it is determined that the first responder is scheduled to the first access slot among multiple access slots based on the list.

[0285] In a possible implementation, the second frame includes any one of: an ADV-RESP frame, a RESP frame, or a RPRT frame.

[0286] In a possible implementation, the first frame or the second frame is a secured frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame.

[0287] In a possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the secured frame.

[0288] In a possible implementation, the first Nonce further includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure. 30 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0289] In a possible implementation, the second frame further carries a private address of the initiator.

[0290] In a possible implementation, the receiving unit 2010 is further configured to: receive a third frame carrying time-offset information from the initiator, and the time-offset information indicates a time offset of a SOR frame transmitted.

[0291] FIG. 19 is a schematic block diagram of a communication apparatus 2100 according to an embodiment of this application.The communication apparatus 2100 can perform the steps executed by the initiator in foregoing embodiments. As shown in FIG. 19, the communication apparatus 2100 includes: a receiving unit 2110, configured to receive a second frame carrying a first private address from a first responder, and the first private address is associated with information related to an identity of the first responder; a generating unit 2120, configured to generate a third private address based on the information related to the identity of the first responder; and a verifying unit 2130, configured to verify the identity of the first responder by comparing the third private address with the first private address.

[0292] In a possible implementation, the information related to the identity of the first responder includes any one of: a public address of the first responder, MMS ranging configuration requested by the first responder, a first random number generated by the first responder, or an IRK unique to the initiator and the first responder.

[0293] In a possible implementation, the communication apparatus further includes a transmitting unit configured to: transmit a first frame for initiating a ranging process, and the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generating unit 2120 is configured to: generate the third private address based on the second random number and the information related to the identity of the first responder.

[0294] In a possible implementation, the generating unit 2120 is further configured to: generate a fourth private address based on information related to an identity of a second responder; and the transmitting unit is further configured to: transmit a frame carrying the fourth private address to the second responder.

[0295] In a possible implementation, the second frame further carries the first random number, the generating unit 2120 is configured to: generate the third private address based on the first random number.

[0296] In a possible implementation, the transmitting unit is further configured to: transmit a first frame for initiating a ranging process to the first responder, and the first frame is a RIM frame carrying a list associated with responders that are scheduled to participate in MMS ranging, and the responders include the first responder.

[0297] In a possible implementation, the second frame includes any one of: an ADV-RESP frame, a RESP frame, or a RPRT frame.

[0298] In a possible implementation, the first frame or the second frame is a secured frame carrying encrypted information, and the encrypted information is obtained based on a first Nonce; and the first Nonce is associated with any one 31 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame.

[0299] In a possible implementation, the first Nonce includes frame counter information, and the frame counter information indicates the time period for the transmission of the secured frame.

[0300] In a possible implementation, the first Nonce further includes block structure indication information, and the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure.

[0301] In a possible implementation, the second frame further carries a private address of the initiator; the verifying unit 2130 is further configured to: verify the identity of the first responder based on the private address of the initiator.

[0302] In a possible implementation, the transmitting unit is further configured to: transmit a third frame carrying time­ offset information to the first responder, and the time-offset information indicates a time offset of a SOR frame transmitted.

[0303] As shown in FIG. 20, a communication apparatus 2200 may include a processor 2210, a transceiver 2220, and a memory 2230. The transceiver 2220 may be configured to receive a query. The memory 2230 may be configured to store code, instructions, and the like executed by the processor 2210.

[0304] Besides, the memory 2230 may be further configured to store data corresponding to generating and / or verifying private addresses, such as IRKs pre-negotiated between the initiator and the responder.

[0305] The memory 2230 may include a random memory, a flash memory, a read-only memory, a programmable read­ only memory, a non-volatile memory, a register, or the like. The processor 2210 may be a central processing unit (CPU).

[0306] For other functions and operations of the communication apparatus 2200, refer to processes of the method embodiments in FIG. 2, FIG. 3, FIG. 12 to FIG. 15, and FIG. 17, which are not described again herein to avoid repetition.

[0307] An embodiment of the present application further provides a communication system. The communication system includes communication apparatus 2000 and communication apparatus 2100, or the communication system includes communication apparatus 2200.

[0308] An embodiment of the present application further provides a computer storage medium, and the computer storage medium may store a program instruction for performing the steps in the foregoing methods.

[0309] Optionally, the storage medium may be specifically the memory 2230.

[0310] An embodiment of the present application further provides a computer program product. The computer program product includes computer program code. When the computer program code runs on a computer, the computer is enabled to perform the steps in the foregoing methods.

[0311] Optionally, all or a part of computer program code can be stored in on a first storage medium. The first storage medium can be packaged together with the processor or separately with the processor. 32 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30

[0312] An embodiment of the present application further provides a chip system, where the chip system includes an input / output interface, at least one processor, at least one memory, and a bus. The at least one memory is configured to store instructions, and the at least one processor is configured to invoke the instructions of the at least one memory to perform operations in the methods in the foregoing embodiments.

[0313] In the embodiments of the present application, “at least one” means one or more, and “a plurality of’ means two or more. The term “and / or” describes an association relationship between associated objects and represents that three relationships may exist. For example, A and / or B may represent the following three cases: only A exists, both A and B exist, and only B exists, where A and B may be singular or plural. The character “ / ” generally indicates an “or” relationship between the associated objects. “At least one of the following” and a similar expression thereof refer to any combination of these items, including any combination of one item or a plurality of items. For example, at least one of a, b, and c may indicate: a, b, c. a and b, a and c, b and c, or a, b, and c, where a, b, and c may be singular or plural.

[0314] A person of ordinary skill in the art may understand that all or some of the processes of the methods in the embodiments may be implemented by a computer program instructing related hardware. The program may be stored in a computer-readable storage medium. When the program runs, the processes of the methods in the embodiments are performed. The foregoing storage medium may include: a magnetic disk, an optical disc, a read-only memory (ROM), or a random-access memory (RAM).

[0315] In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described apparatus embodiment is merely exemplary. For example, the unit division is merely logical function division and may be other division in actual implementation.For example, a plurality of units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections may be implemented by using some interfaces. The indirect couplings or communication connections between the apparatuses or units may be implemented in electronic, mechanical, or other forms.

[0316] The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

[0317] In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each of the units may exist alone physically, or two or more units are integrated into one unit.

[0318] The foregoing are merely exemplary embodiments of the present invention. A person skilled in the art may make various modifications and variations to the present invention without departing from and scope of the present invention. 33 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 CLAIMS What is claimed is: 1. A communication method, applied to a first responder, comprising: receiving, from an initiator, a first frame for initiating a ranging process; generating a first private address based on the first frame and information related to an identity of the first responder; and transmitting a second frame carrying the first private address to the initiator. 2.The communication method according to claim 1, wherein the information related to the identity of the first responder comprises any one of: a public address of the first responder, multi-millisecond (MMS) ranging configuration requested by the first responder, a first random number generated by the first responder, or an identity resolving key (IRK) unique to the initiator and the first responder. 3. The communication method according to claim 2, wherein the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generating a first private address based on the first frame and information related to an identity of the first responder comprises: generating the first private address based on the second random number and the information related to the identity of the first responder. 4.The communication method according to claim 3, wherein the second private address is generated based on information related to an identity of a second responder, the generating a first private address based on the first frame and information related to an identity of the first responder comprises: generating the first private address when it is determined that the second responder and the first responder are the same responder. 5. The communication method according to any one of claims 2 to 4, wherein the transmitting a second frame carrying the first private address to the initiator comprises: transmitting the second frame carrying the first private address and the first random number to the initiator. 6.The communication method according to any one of claims 1 to 5, wherein the first frame is a ranging initialization message (RIM) frame carrying a list associated with responders that are scheduled to participate in an MMS ranging, wherein the responders comprise the first responder; and the generating a first private address by using information related to an identity of a first responder comprises: 34 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 generating the first private address when it is determined that the first responder is scheduled to the first access slot among multiple access slots based on the list. 7. The communication method according to any one of claims 1 to 6, wherein the second frame comprises any one of: an advertising response (ADV-RESP) frame, a response (RESP) frame, or a report (RPRT) frame. 8.The communication method according to any one of claims 1 to 7, wherein the first frame or the second frame is a secured frame carrying encrypted information, wherein the encrypted information is obtained based on a first Nonce, and the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame. 9. The communication method according to claim 8, wherein the first Nonce comprises frame counter information, wherein the frame counter information indicates the time period for the transmission of the secured frame. 10. The communication method according to claim 8 or 9, wherein the first Nonce further comprises block structure indication information, wherein the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure. 11.The communication method according to any one of claims 1 to 10, wherein the second frame further carries a private address of the initiator. 12. The communication method according to any one of claims 1 to 11, wherein the method further comprises: receiving a third frame carrying time-offset information from the initiator, wherein the time-offset information indicates a time offset of a start of ranging (SOR) frame transmitted. 13. A communication method, applied to an initiator, comprising: receiving a second frame carrying a first private address from a first responder, wherein the first private address is associated with information related to an identity of the first responder; generating a third private address based on the information related to the identity of the first responder; and verifying the identity of the first responder by comparing the third private address with the first private address. 14.The communication method according to claim 13, wherein the information related to the identity of the first responder comprises any one of: a public address of the first responder, multi-millisecond (MMS) ranging configuration requested by the first responder, a first random number generated by the first responder, or an identity resolving key (TRK) unique to the initiator and the first responder. 15.The communication method according to claim 14, wherein the method further comprises: transmitting a first frame for initiating a ranging process, wherein the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and 35 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 the generating a third private address based on the information related to the identity of the first responder comprises: generating the third private address based on the second random number and the information related to the identity of the first responder. 16. The communication method according to claim 15, wherein the method further comprises: generating a fourth private address based on information related to an identity of a second responder; and transmitting a frame carrying the fourth private address to the second responder. 17.The communication method according to any one of claims 14 to 16, wherein the second frame further carries the first random number, the generating a third private address based on the information related to the identity of the first responder comprises: generating the third private address based on the first random number. 18. The communication method according to any one of claims 13 to 17, wherein the method further comprises: transmitting a first frame for initiating a ranging process to the first responder, wherein the first frame is a ranging initialization message (RIM) frame carrying a list associated with responders that are scheduled to participate in MMS ranging, wherein the responders comprise the first responder. 19. The communication method according to any one of claims 13 to 18, wherein the second frame comprises any one of: an advertising response (ADV-RESP) frame, a response (RESP) frame, or a report (RPRT) frame. 20.The communication method according to any one of claims 13 to 19, wherein the first frame or the second frame is a secured frame carrying encrypted information, wherein the encrypted information is obtained based on a first Nonce; wherein the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame. 21. The communication method according to claim 20, wherein the first Nonce comprises frame counter information, wherein the frame counter information indicates the time period for the transmission of the secured frame. 22. The communication method according to claim 20 or 21, wherein the first Nonce further comprises block structure indication information, wherein the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure. 23.The communication method according to any one of claims 13 to 22, wherein the second frame further carries a private address of the initiator; the method further comprises: verifying the identity of the first responder based on the private address of the initiator. 24. The communication method according to any one of claims 13 to 23, wherein the method further comprises: transmitting a third frame carrying time-offset information to the first responder, wherein the time-offset information 36 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 indicates a time offset of a start of ranging (SOR) frame transmitted. 25.A communication apparatus, comprising: a receiving unit, configured to receive, from an initiator, a first frame for initiating a ranging process; a generating unit, configured to generate a first private address based on the first frame and information related to an identity of the first responder; and a transmitting unit, configured to transmit a second frame carrying the first private address to the initiator. 26. The communication apparatus according to claim 25, wherein the information related to the identity of the first responder comprises any one of: a public address of the first responder, multi-millisecond (MMS) ranging configuration requested by the first responder, a first random number generated by the first responder, or an identity resolving key (IRK) unique to the initiator and the first responder. 27.The communication apparatus according to claim 26, wherein the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generating unit is configured to: generate the first private address based on the second random number and the information related to the identity of the first responder. 28. The communication apparatus according to claim 27, wherein the second private address is generated based on information related to an identity of a second responder, the generating unit is configured to: generate the first private address when it is determined that the second responder and the first responder are the same responder. 29. The communication apparatus according to any one of claims 26 to 28, wherein the transmitting unit is configured to: transmit the second frame carrying the first private address and the first random number to the initiator. 30.The communication apparatus according to any one of claims 25 to 29, wherein the first frame is a ranging initialization message (RIM) frame carrying a list associated with responders that are scheduled to participate in an MMS ranging, wherein the responders comprise the first responder; and the generating unit is configured to: generate the first private address when it is determined that the first responder is scheduled to the first access slot among multiple access slots based on the list. 31. The communication apparatus according to any one of claims 25 to 30, wherein the second frame comprises any one of: an advertising response (ADV-RESP) frame, a response (RESP) frame, or a report (RPRT) frame. 32.The communication apparatus according to any one of claims 25 to 31, wherein the first frame or the second frame is a secured frame carrying encrypted information, wherein the encrypted information is obtained based on a first Nonce; wherein the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate 37 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 the private address, or a time period for transmission of the secured frame. 33. The communication apparatus according to claim 32, wherein the first Nonce comprises frame counter information, wherein the frame counter information indicates the time period for the transmission of the secured frame. 34.The communication apparatus according to claim 32 or 33, wherein the first Nonce further comprises block structure indication information, wherein the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure. 35. The communication apparatus according to any one of claims 25 to 34, wherein the second frame further carries a private address of the initiator. 36. The communication apparatus according to any one of claims 25 to 35, wherein the receiving unit is further configured to: receive a third frame carrying time-offset information from the initiator, wherein the time-offset information indicates a time offset of a start of ranging (SOR) frame transmitted. 37.A communication apparatus, comprising: a receiving unit, configured to receive a second frame carrying a first private address from a first responder, wherein the first private address is associated with information related to an identity of the first responder; a generating unit, configured to generate a third private address based on the information related to the identity of the first responder; and a verifying unit, configured to verify the identity of the first responder by comparing the third private address with the first private address. 38. The communication apparatus according to claim 37, wherein the information related to the identity of the first responder comprises any one of: a public address of the first responder, multi-millisecond (MMS) ranging configuration requested by the first responder, a first random number generated by the first responder, or an identity resolving key (IRK) unique to the initiator and the first responder. 39.The communication apparatus according to claim 38, wherein the communication apparatus further comprises a transmitting unit configured to: transmit a first frame for initiating a ranging process, wherein the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; and the generating unit is configured to: generate the third private address based on the second random number and the information related to the identity of the first responder. 38 WO 2024 / 254833 PCT / CN2023 / 100512 5 10 15 20 25 30 40. The communication apparatus according to claim 39, wherein the generating unit is further configured to: generate a fourth private address based on information related to an identity of a second responder; and the transmitting unit is further configured to: transmit a frame carrying the fourth private address to the second responder. 41.The communication apparatus according to any one of claims 38 to 40, wherein the second frame further carries the first random number, the generating unit is configured to: generate the third private address based on the first random number. 42. The communication apparatus according to any one of claims 37 to 41, wherein the transmitting unit is further configured to: transmit a first frame for initiating a ranging process to the first responder, wherein the first frame is a ranging initialization message (RIM) frame carrying a list associated with responders that are scheduled to participate in MMS ranging, wherein the responders comprise the first responder. 43. The communication apparatus according to any one of claims 37 to 42, wherein the second frame comprises any one of: an advertising response (ADV-RESP) frame, a response (RESP) frame, and a report (RPRT) frame. 44.The communication apparatus according to any one of claims 37 to 43, wherein the first frame or the second frame is a secured frame carrying encrypted information, wherein the encrypted information is obtained based on a first Nonce; wherein the first Nonce is associated with any one of: a private address carried by the secured frame, a random number used to generate the private address, or a time period for transmission of the secured frame. 45. The communication apparatus according to claim 44, wherein the first Nonce comprises frame counter information, wherein the frame counter information indicates the time period for the transmission of the secured frame. 46. The communication apparatus according to claim 44 or 45, wherein the first Nonce further comprises block structure indication information, wherein the block structure indication information indicates whether the second frame is transmitted inside or outside a block structure. 47.The communication apparatus according to any one of claims 37 to 46, wherein the second frame further carries a private address of the initiator; the verifying unit is further configured to: verify the identity of the first responder based on the private address of the initiator. 48. The communication apparatus according to any one of claims 37 to 47, wherein the transmitting unit is further configured to: transmit a third frame carrying time-offset information to the first responder, wherein the time-offset information indicates a time offset of a start of ranging (SOR) frame transmitted. 39 WO 2024 / 254833 PCT / CN2023 / 100512 49.A communication apparatus, comprising a processor and a memory, and the processor is connected to the memory; wherein the memory is configured to store instructions, and the processor is configured to execute the instructions; and when the processor executes the instructions stored in the memory, the processor is enabled to perform the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 24. 5 50. A communication system, comprising the communication apparatus according to any one of claims 25 to 36, and the communication apparatus according to any one of claims 37 to 48. 51 . A computer-readable storage medium, wherein the computer-readable storage medium stores instructions, and when the instructions run on a processor, the processor is enabled to perform the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 24. 10 52.A computer program product, comprising computer program code, and when the computer program code runs on a computer, the computer is enabled to perform the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 24. 40 WO 2024 / 254833 PCT / CN2023 / 100512 FI G .l 1 / 11 WO 2024 / 254833 PCT / CN2023 / 100512 FIG. 2 FIG.3 2 / 11 WO 2024 / 254833 PCT / CN2023 / 100512 ADV-POLL / POLL Octets :1 3 3 1 variale 2 ID Initiator RPAhash Initiator RPAprand Message Control Message Content CRC FIG. 4 ADV-RESP / RESP Octets :1 3 1 variale 2 ID Responder RPA_hash Message Control Message Content CRC FIG. 5 ADV-RESP / RESP Octets :1 3 3 1 variale 2 ID Initiator RPA_hash Responder RPA_hash Message Control Message Content CRC FIG. 6 ADV-RESP / RESP Octets :1 0 or 3 3 3 1 variale 2 ID Initiator RPAhash Responder RPAhash Responder RPA_prand Message Control Message Content CRC FIG. 7 SOR / RPRT Octets :1 3 1 variale 2 ID RPAhash Message Control Message Content CRC FIG.8 3 / 11 WO 2024 / 254833 PCT / CN2023 / 100512 Secured compressed frame Octets: 1 3 0 or 3 1 variale 0 / 4 / 8 ID RPAhash RPAprand Message Control Message Content MIC FIG. 9 Nonce Octets:3 3 1 BitsO-7 Bits :8-22 Bits :23-38 Bit:39 40-42 43-47 RPAhash RPA_prand ID Frame Counter (39 bits) Block Structure Indicator Secuirty Level ReservedSlot Index Round Index Block Index FIG. 10 Time FIG.ll 4 / 11 WO 2024 / 254833 PCT / CN2023 / 100512 Controller Controlee Initiator Session Setup (IRK) Responder (------ S210, ADV-POLL(RPA_hash-I-l, RPA_prand-I-l Initialization and Setup - -S220, ADV-RESP(RPA_hash-R-l)- ■S230', ADV-CONF (RPA_hash-I-l > ■S230, SOR(RPA hash-I-l> ■S240, POLL(RPA_hash-I-2, RPA_prand-I-2> ’ "\Time offset J to SOR )Time offset J to POLL ■S250, RESP(RPA_hash-R-2> Measurement cycle -Ranging frame- Ranging frame- 8260, RPRT(RPA_hash-R-2> ■S270, RPRT(RPA_hash-I-2)- FIG.12 5 / 11 WO 2024 / 254833 PCT / CN2023 / 100512 Controller Controlee 1 Controlee 2 Session Setup (IRK) Session Setup (IRK) Initiator Responder 1 Initialization and Setup Measurement cycle Responder 2 ATAX TDAb 7 b TDAb 1 DDA nrnnrl IDOD 1U, AU V -.rU.LJ_<(Kr A IiaSIl-1-1, ΚΓΛ pidllU-ll) ◄-----(S320) S321, ADV-RESP(RPA_hash-Rl-l)------m CO - / TCOD ΤΛΛ7 CD7DD A bnrb DO _E.g., contention based access W r\UV -lAllDl (1<1 zY nasn_l<^- ¢770 CGD / DDA bnr-b 1 11- I) \ Time / offset□jju, ouiaiG i\_nasn-i- Q^D^^D^A / B / A 0 DDA i-vi-oiirl T AY_____ Λ Time ,J offsetoj4U, IvI1VI(KI A_nasn-1-Z, ΙΉ A_pldllCl-lZ)^^"^^"^ ·*----------S350, RESP(RPA-hash-----------------------------------------) Access Slot 0 “Access Slot 1 Rjlilgliig fl dlikv Ranging frame ◄----------S370, RPRT(RPA_hash-Rl-2)---------------------- S3 80, RPRT(RPA_hash-I-2)-----------► QQ / ΙΠ1 DOT T / DDA bneb TA DDA ,-0-00 / )oJ4u , i ull(M A_nasn-ia, κι A_franci- _________________________QQQCAI A CDDdr-L DO bdu RJ) oj , clone (i. <i a_nasn-kz-z) ranging frame -- βί7λ· dddt dda boob do oyj u , ki k1 lkvl ζ\._ι1αβπ-1νζ-ζ^^" coqa1 bnrb tbjou, κι κ i (ki a_nasn-i-j) fig. 13 6 11 wo 2024 254833 pct cn2023 100512 controller controlee 1 2 session setup (irk) initiator responder initialization and measurement^ cycle ------ s310, adv-poll(rpa_hash-i-l, rpa_prand-i-l)—► ◄-------- (s320) s321, adv-resp(rpa_hash-rl-l)----------- - qqoax ith atyv dfcd dd λ xnnu --------------------- ► _e.g., contention based access jzu) ojzz, au v "1vl 01 (kl a_ndsn-kz qqoa’ γ’λχτετοϋα unou t 1y -1) jjju v-culml^kl α_πα5π-1-1) cain codfdda 1\ time offset * ,) to sor x sorojju, duk(ki a_nasn-i-i) " s340, rim(rpa_hash-i-2, rpa_prand-i-2)-----► . cko dccd oda d1 ox 'itirne poll --- 1------------ e \ ) "access slot 0 djju, ku0i α_π38π-κ1-z) c27o knr,x oyaj u, κΐ(κι a_nasn-ki-z) cqqo ox-0 jou, a_nasn-i-z j coaa* ογχτ «^«40 j^u, uu_\ki a_nasn-i-j, a pranq- coca· ddcd lnnk>O OY 1-J) κι κι (Ki A_nasn-ij 7 FIG. 14 7 / 11 WO 2024 / 254833 PCT / CN2023 / 100512 Initialization and Setup —(S310) S311, ADV-POLL(RPA_hash-Il, RPA_brand-Il> _______ / 'COOA'l QQ91 ADV PPQP / PPA kadi D 1 Ή N Time A offset (oJZUJ dJZI, 2 LU V "Κΐύαΐ (KJ Α_Πί1Μ1-Κ.1_1^^^^^^^" ZQQQAAGOO 1 CDD / DDA kook T 1Y(□jjujoJji, duk(ki A_nasn-ii) " / cnntcin ΑΤΝΧ7 ηητ τ mnA τ ο nnA JJLL, 2"LU V -1MJ01 ^-1^1 GtJldStl-lXZ ΚΗΊΠΚί'ί'ϊ'? QHPIPPA kadi Τ Ολ(G*zk^LJ1L(1L1 £ k. mull 1 j CQ / IA DTAATDDA Knck T 0 DDA «rnnd T / Time J offset Measurement cycle □J4U, K11V1(K1 A_naSll-lJ, KI A pi allQ-1-J -QOGA DPQWDDA kook D1 Ολ- — Access Slot 0 KJJol (1X1 Α_Παοη-Κ1-Ζ^^^^^^^^" Ranging frame Ranging frame ΟΠΛ DDDT / DDA kooL D1 OYdj / u, κι κι^ki A_nasn-Ki-z^ COCA DDDTYDDA T OYojoU, κι kiqki A_nasn-ij) QOAA· D / DT I / ODA kook T 4 DDA «^«4□ J4U, i uj-i^ixiA_nasn-i-4, κι a pranQ· .COCA’ DBCD / DDA Knnl, DO OY 1-4) -Access Slot 1 dJjU , Kiioi (Ki 'Anasn-KZ-z^^— Ranging frame Ranging frame -- OOOA’ DDDT / UDA Kock DO OYJ / U , Ki IX1 (Ki A_ndbH-lxZ-Z^^" QOQA· DDDT / DDA kook Tojou, κι k. ί (Ki A_nasn-i-4 j / FIG. 15 8 / 11 WO 2024 / 254833 PCT / CN2023 / 100512 RIM Octets :1 3 3 1 variale 2 ID Initiator RPAhash Initiator RPA_prand Message Control Message Content CRC Octets :1 1 3 3 Number of Responders Slot Per Responder Responder 1 RPAhash Responder N RPAhash FIG. 16 Controller Controlee 1 Controlee 2 Initiator Initialization and Setup Session Setup (IRK) Session Setup (IRK) Responder 1 Responder 2 -ADV-POLL (RPA hash-I-Rl-1, RPA_prand-I-l> ■ADV-RESP (RPA hash-Rl-1 )■ ■SOR (RPA hash-Rl-1 )■ ,--------POLL (RPA hash-I-Rl-2, RPA_prand-I-2)· Measurement cycle -RESP (RPA_hash-Rl-2)— -------- Ranging frame-------- -------- Ranging frame-------- -RPRT (RPA hash-Rl-2)- ■RPRT (RPA hash-I-Rl-2)· Initialization and Setup -ADV-POLL (RPA hash-I-R2-l, RPA_prand-I-3)■ADV-RESP (RPA_hash-R2-l ) ■SOR (RPA hash-R2-l )■ Measurement cycle Only Responder 1 can resolve the hash Time offset SOR addressed to Responder 1 Only Responder 1 can resolve the hash Only Responder 2 can resolve the hash RIM (RPA hash-I-2, RPA_prand-I-2, RPA hash-Rl-1, RPA hash-R2-l) ' ---------RESP (RPA_hash-Rl-3)--------- --------------- Ranging frame--------------- --------------- Ranging frame--------------- -------- RPRT (RPA hash-Rl-3)-------- --------- RPRT (RPA_hash-I-2)--------- --------------POLL (RPA hash-I-R2-2, RPA_prand-I-4)· --------------------------RESP (RPA_hash-R2-2)------------ -------------------------------- Ranging frame------------------- -------------------------------- Ranging frame------------------- --------------------------RPRT (RPA_hash-R2-2)------------ ------------------------ RPRT (RPA_hash-I-R2-2)----------- SOR addressed to Responder 2 \ Time offset Access Slot 1 Only Responder 2 can resolve the hash Access Slot 2 FIG. 17 9 / 11 WO 2024 / 254833PCT / CN2023 / 100512 Communication apparatus 2000 Receiving unit 2010 Generating unit 2020 Transmitting unit 2030 FIG. 18 Communication apparatus 2100 Receiving unit 2110 Generating unit 2120 V erifying unit 2130 FIG. 19 10 / 11 WO 2024 / 254833 PCT / CN2023 / 100512 Communication apparatus 2200 FIG. 20 11 / 11 INTERNATIONAL SEARCH REPORT International application No. PCT / CN2023 / 100512 A. CLASSIFICATION OF SUBJECT MATTER H04W 64 / 00(2009.01)1 According to International Patent Classification (IPC) or to both national classification and IPC B. FIELDS SEARCHED Minimum documentation searched (classification system followed by classification symbols) IPC: H04W,H04B,H04L Documentation searched other than minimum documentation to the extent that such documents are included in the fields searched Electronic data base consulted during the international search (name of data base and, where practicable, search terms used) CNKI, CNTXT, ENTXT, DWPI, IEEE: initiator, respond+, response, frame, rang+, private,multi-millisecond, MMS, ultra wide band, UWB, IRK, identity resolving key, random, hash C. DOCUMENTS CONSIDERED TO BE RELEVANT Category* Citation of document, with indication, where appropriate, of the relevant passages Relevant to claim No. X US 2010093347 Al (HAHN, Gene Beck et al.) 15 April 2010 (2010-04-15) description, paragraphs

[0032] -

[0074] , figures 3-5 1-52 A CN 115706920 A (APPLE INC.) 17 February 2023 (2023-02-17) the whole document 1-52 A CN 114730003 A (SAMSUNG ELECTRONICS CO., LTD.) 08 July 2022 (2022-07-08) the whole document 1-52 A US 2023171729 Al (SAMSUNG ELECTRONICS CO., LTD.) 01 June 2023 (2023-06-01) the whole document 1-52 | | Further documents are listed in the continuation of Box C. | J | See patent family annex. * Special categories of cited documents: "T” later document published after the international filing date or priority "A” document defining the general state of the art which is not considered date and not in conflict with the application but cited tounderstand the to be of particular relevance principle or theory underlying the invention "D” document cited by the applicant in the international application "X” document of particular relevance; the claimed invention cannot be "E” earlier application or patent but published on or after the international considered novel or cannot be considered to involve an inventive step filing date when the document is taken alone "L” document which may throw doubts on priority claim(s) or which is "Y” document of particular relevance; the claimed invention cannot be cited to establish the publication date of another citation or other considered to involve an inventive step when the document is special reason (as specified) combined with one or more other such documents, such combination "O” document referring to an oral disclosure, use, exhibition or other being obvious to a person skilled in the art means document member of the same patent family "P” document published prior to the internationalfiling date but later than the priority date claimed Date of the actual completion of the international search 29 November 2023 Date of mailing of the international search report 21 December 2023 Name and mailing address of the ISA / CN CHINA NATIONAL INTELLECTUAL PROPERTY ADMINISTRATION 6, Xitucheng Rd., Jimen Bridge, Haidian District, Beijing 100088, China Authorized officer PAN,XiaoDan Telephone No. (+86) 010-53961796 Form PCT / ISA / 210 (second sheet) (July 2022) INTERNATIONAL SEARCH REPORT Information on patent family members International application No. PCT / CN2023 / 100512 Patent document cited in search report Publication date (day / month / year) Patent family member)s) Publication date (day / month / year) US 2010093347 Al 15 April 2010 KR 20080093858 A 22 October 2008 CN 115706920 A 17 February 2023 US 2022137177 Al 05 May 2022 CN 114449660 A 06 May 2022 EP 4130791 Al 08 February 2022 EP 4131807 Al 08 February 2022 KR 20230020928 A 13 February 2022 CN 115706656 A 17 February 2022 CN115706657 A 17 February 2022 CN 114730003 A 08 July 2022 KR 20220104187 A 26 July 2022 EP 4024081 Al 06 July 2022 US 2021173064 Al 10 June 2021 WO 2021112380 Al 10 June 2021 US 2023171729 Al 01 June 2023 WO 2023101429 Al 08 June 2023 KR 20230081039 A 07 June 2023 Form PCT / ISA / 210 (patent family annex) (July 2022) (19) State Intellectual Property Office (12) Invention Patent Application (10) Application Publication Number (43) Application Publication Date (21) Application Number 202380099337.X (22) Application Date 2023.06.15 (85) PCT International Application Entering National Phase Date 2025.12.11 (86) PCT International Application Application Data PCT / CN2023 / 100512 2023.06.15 (87) PCT International Application Publication Data WO2024 / 254833 EN 2024.12.19 (71) Applicant Huawei Technologies Co., Ltd. Address 518129, Bantian Huawei Headquarters Office Building, Longgang District, Shenzhen, Guangdong Province (72) Inventor Roger Chitraka Huang Lei Li Yunbo Yang Xun (74) Patent Agency Beijing Longshuang Lida Intellectual Property Agency Co., Ltd. 11329 Patent Attorney Song Lei Xiao Li (51) Int.Cl. H04W 64 / 00(2006.01) (54) Invention Title: Communication Method and Related Device (57) Abstract: This application provides a communication method and related device. The method includes: a first responder receiving a first frame from an initiator for initiating a ranging process; the first responder generating a first private address based on the first frame and information related to the identity of the first responder; and the first responder sending a second frame carrying the first private address to the initiator. The method can be applied to an ultra-wideband multi-millisecond ranging system. According to this application, the initiator can verify whether a frame truly originates from an authorized responder in an ultra-wideband multi-millisecond ranging session. Claims: 5 pages Description: 23 pages Drawings: 12 pages CN 121336474 A 2026.01.13 CN 1 21 33 64 74 A 1. A communication method applied to a first responder, characterized in that it includes: receiving a first frame from an initiator for initiating a ranging process;1. Generate a first private address based on the first frame and information related to the identity of the first responder; send a second frame carrying the first private address to the initiator. 2. The communication method according to claim 1, wherein the information related to the identity of the first responder includes any one of the following: the public address of the first responder, the multi-millisecond (MMS) ranging configuration requested by the first responder, a first random number generated by the first responder, or a unique identity resolving key (IRK) between the initiator and the first responder. 3. The communication method according to claim 2, wherein the first frame carries a second random number, the second random number being associated with a second private address of the initiator; generating the first private address based on the first frame and information related to the identity of the first responder includes: generating the first private address based on the second random number and the information related to the identity of the first responder. 4. The communication method according to claim 3, wherein the second private address is generated based on information related to the identity of the second responder, and generating the first private address based on the first frame and the information related to the identity of the first responder includes: generating the first private address when it is determined that the second responder and the first responder are the same responder. 5. The communication method according to any one of claims 2 to 4, wherein sending a second frame carrying the first private address to the initiator includes: sending a second frame carrying the first private address and the first random number to the initiator. 6. The communication method according to any one of claims 1 to 5, wherein the first frame is a ranging initialization message (RIM) frame, the RIM frame carrying a list associated with responders, the responders being scheduled to participate in MMS ranging, wherein the responders include the first responder; generating the first private address using information related to the identity of the first responder includes: generating the first private address when it is determined based on the list that the first responder is scheduled to a first access time slot among multiple access time slots. 7. The communication method according to any one of claims 1 to 6, characterized in that the second frame includes any one of the following frames: an announcement-response (ADV-RESP) frame, a response (RESP) frame, or a report (RPRT) frame. 8. The communication method according to any one of claims 1 to 7, characterized in that the first frame or the second frame is a secure frame carrying encrypted information, wherein the encrypted information is obtained based on a first nonce.Associated with any of the following: a private address carried by the security frame, a random number used to generate the private address, or a time period for the transmission of the security frame. 9. The communication method according to claim 8, wherein the first Nonce includes frame counter information, wherein the frame counter information indicates the time period for the transmission of the security frame. 10. The communication method according to claim 8 or 9, wherein the first Nonce further includes block structure indication information, wherein the block structure indication information indicates whether the second frame is transmitted within or outside the block structure. 11. The communication method according to any one of claims 1 to 10, wherein the second frame further carries the private address of the initiator as described in claims 1 / 5 page 2 CN 121336474 A. 12. The communication method according to any one of claims 1 to 11, wherein the method further includes: receiving a third frame carrying time offset information from the initiator, wherein the time offset information indicates the time offset of the transmitted start of ranging (SOR) frame. 13. A communication method applied to an initiator, characterized in that it comprises: receiving a second frame carrying a first private address from a first responder, wherein the first private address is associated with information, the information being associated with the identity of the first responder; generating a third private address based on the information associated with the identity of the first responder; and verifying the identity of the first responder by comparing the third private address and the first private address. 14. The communication method according to claim 13, characterized in that the information associated with the identity of the first responder includes any one of the following: the public address of the first responder, a multi-millisecond (MMS) ranging configuration requested by the first responder, a first random number generated by the first responder, or a unique identity resolving key (IRK) between the initiator and the first responder. 15. The communication method according to claim 14, characterized in that the method further comprises: sending a first frame for initiating a ranging process, wherein the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; the step of generating a third private address based on the information related to the identity of the first responder comprises: generating the third private address based on the second random number and the information related to the identity of the first responder. 16. The communication method according to claim 15, characterized in that the method further comprises: generating a fourth private address based on the information related to the identity of the second responder;17. The communication method according to any one of claims 14 to 16, wherein the second frame further carries the first random number, and generating the third private address based on the information related to the identity of the first responder comprises: generating the third private address based on the first random number. 18. The communication method according to any one of claims 13 to 17, wherein the method further comprises: sending a first frame for initiating a ranging process to the first responder, wherein the first frame is a ranging initialization message (RIM) frame, the RIM frame carrying a list associated with the responder, the responder being scheduled to participate in MMS ranging, wherein the responder includes the first responder. 19. The communication method according to any one of claims 13 to 18, wherein the second frame comprises any one of the following frames: an announcement response (ADV-RESP) frame, a response (RESP) frame, or a report (RPRT) frame. 20. The communication method according to any one of claims 13 to 19, wherein the first frame or the second frame is a secure frame carrying encrypted information, wherein the encrypted information is obtained based on a first Nonce; wherein the first Nonce is associated with any one of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for the transmission of the secure frame. 21. The communication method according to claim 20, wherein the first Nonce includes frame counter information, wherein the frame counter information indicates the time period for the transmission of the secure frame. 22. The communication method according to claim 20 or 21, wherein the first Nonce further includes block structure indication information, wherein the block structure indication information indicates whether the second frame is sent within or outside the block structure. 23. The communication method according to any one of claims 13 to 22, wherein the second frame further carries the private address of the initiator; the method further includes: verifying the identity of the first responder based on the private address of the initiator. 24. The communication method according to any one of claims 13 to 23, characterized in that the method further comprises: sending a third frame carrying time offset information to the first responder, wherein the time offset information indicates the time offset of the sent start of ranging (SOR) frame. 25. A communication apparatus, characterized in that it comprises: a receiving unit, configured to receive from an initiator a first frame for initiating a ranging process;A generation unit is configured to generate a first private address based on the first frame and information related to the identity of the first responder; a sending unit is configured to send a second frame carrying the first private address to the initiator. 26. The communication apparatus according to claim 25, wherein the information related to the identity of the first responder includes any one of the following: the public address of the first responder, the multi-millisecond (MMS) ranging configuration requested by the first responder, a first random number generated by the first responder, or a unique identity resolving key (IRK) between the initiator and the first responder. 27. The communication apparatus according to claim 26, wherein the first frame carries a second random number, the second random number being associated with a second private address of the initiator; the generation unit is configured to: generate the first private address based on the second random number and the information related to the identity of the first responder. 28. The communication apparatus according to claim 27, wherein the second private address is generated based on information related to the identity of the second responder, and the generation unit is configured to: generate the first private address when it is determined that the second responder and the first responder are the same responder. 29. The communication apparatus according to any one of claims 26 to 28, wherein the sending unit is configured to: send a second frame carrying the first private address and the first random number to the initiator. 30. The communication apparatus according to any one of claims 25 to 29, wherein the first frame is a ranging initialization message (RIM) frame, the RIM frame carrying a list associated with a responder, the responder being scheduled to participate in MMS ranging, wherein the responder includes the first responder; the generating unit is configured to: generate the first private address when it is determined, based on the list, that the first responder is scheduled to a first access slot among a plurality of access slots. 31. The communication apparatus according to any one of claims 25 to 30, wherein the second frame includes any one of the following frames: an announcement response (ADV-RESP) frame, a response (RESP) frame, or a report (RPRT) frame. 32. The communication device according to any one of claims 25 to 31, wherein the first frame or the second frame is a secure frame carrying encrypted information, wherein the encrypted information is obtained based on a first nonce; wherein the first nonce is associated with any one of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period used for the transmission of the secure frame.33. The communication apparatus according to claim 32, wherein the first Nonce includes frame counter information, wherein the frame counter information indicates the time period for the transmission of the secure frame. 34. The communication apparatus according to claim 32 or 33, wherein the first Nonce further includes block structure indication information, wherein the block structure indication information indicates whether the second frame is transmitted within or outside the block structure. 35. The communication apparatus according to any one of claims 25 to 34, wherein the second frame further carries the private address of the initiator. 36. The communication apparatus according to any one of claims 25 to 35, wherein the receiving unit is further configured to: receive from the initiator a third frame carrying time offset information, wherein the time offset information indicates the time offset of the transmitted start of ranging (SOR) frame. 37. A communication apparatus, characterized in that it comprises: a receiving unit, configured to receive from a first responder a second frame carrying a first private address, wherein the first private address is associated with information, the information being associated with the identity of the first responder; a generating unit, configured to generate a third private address based on the information associated with the identity of the first responder; and a verification unit, configured to verify the identity of the first responder by comparing the third private address and the first private address. 38. The communication apparatus according to claim 37, characterized in that the information associated with the identity of the first responder includes any one of the following: the public address of the first responder, a multi-millisecond (MMS) ranging configuration requested by the first responder, a first random number generated by the first responder, or a unique identity resolving key (IRK) between the initiator and the first responder. 39. The communication apparatus according to claim 38, wherein the communication apparatus further comprises a sending unit, the sending unit being configured to: send a first frame for initiating a ranging process, wherein the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; the generating unit being configured to: generate the third private address based on the second random number and the information related to the identity of the first responder. 40. The communication apparatus according to claim 39, wherein the generating unit is further configured to: generate a fourth private address based on information related to the identity of the second responder; the sending unit is further configured to: send a frame carrying the fourth private address to the second responder.41. The communication device according to any one of claims 38 to 40, wherein the second frame further carries the first random number, and the generating unit is configured to: generate the third private address based on the first random number. 42. The communication device according to any one of claims 37 to 41, wherein the sending unit is further configured to: send a first frame for initiating a ranging process to the first responder, wherein the first frame is a ranging initialization message (RIM) frame, the RIM frame carrying a list associated with the responder, wherein the responder is scheduled to participate in MMS ranging, and wherein the responder includes the first responder. 43. The communication device according to any one of claims 37 to 42, wherein the second frame includes any one of the following frames: an announcement response (ADV-RESP) frame, a response (RESP) frame, and a report (RPRT) frame. 44. The communication device according to any one of claims 37 to 43, wherein the first frame or the second frame is a secure frame carrying encrypted information, wherein the encrypted information is obtained based on a first nonce; wherein the first nonce is associated with any one of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for the transmission of the secure frame. 45. The communication device according to claim 44, wherein the first nonce includes frame counter information, wherein the frame counter information indicates the time period for the transmission of the secure frame. 46. The communication device according to claim 44 or 45, wherein the first nonce further includes block structure indication information, wherein the block structure indication information indicates whether the second frame is transmitted within or outside a block structure. 47. The communication device according to any one of claims 37 to 46, wherein the second frame further carries the private address of the initiator; the verification unit is further configured to: verify the identity of the first responder based on the private address of the initiator. 48. The communication apparatus according to any one of claims 37 to 47, wherein the transmitting unit is further configured to: transmit a third frame carrying time offset information to the first responder, wherein the time offset information indicates the time offset of the transmitted start of ranging (SOR) frame. 49. A communication apparatus, comprising a processor and a memory, the processor being connected to the memory; wherein the memory is used to store instructions, and the processor is used to execute the instructions; when the processor executes instructions stored in the memory...When the instructions in the memory are executed, the processor is caused to perform the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 24. 50. A communication system, characterized in that it includes a communication device according to any one of claims 25 to 36, and a communication device according to any one of claims 37 to 48. 51. A computer-readable storage medium, characterized in that the computer-readable storage medium stores instructions that, when executed on a processor, cause the processor to perform the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 24. 52. A computer program product, characterized in that it includes computer program code that, when executed on a computer, causes the computer to perform the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 24. Claims 5 / 5 Page 6 CN 121336474 A Communication Method and Related Device Technical Field

[0001] Embodiments of this application relate to the field of communication technology, and more specifically, to a communication method and a related device. Background Technology

[0002] Ultra-wideband (UWB) technology is increasingly being used for indoor positioning and other location services, such as access control and asset location. To address long-range ranging use cases, UWB multi-millisecond (MMS) ranging has been introduced. The key concept of MMS ranging is to distribute UWB ranging frames into multiple segments, which are transmitted over multiple milliseconds (ms), thereby overcoming the transmission energy limit of 37 nanojoules (nJ) per millisecond. By distributing the ranging frames across multiple segments, each transmitted within 1 millisecond, the total energy of the ranging frames can be increased several times, thus significantly improving the ranging range. This means that when block-based mode is used for MMS ranging, the control frame transmission time is limited to 1 ms, which also results in very limited available space in the control frame for actual control information. To overcome this limitation, a compressed physical layer service data unit (PSDU) format using private addresses has been introduced for the control frames.

[0003] In an MMS ranging session, when sending an initial compressed PSDU (e.g., an Advertisement Polling (ADV-POLL) frame or a POLL frame), the initiator generates a pseudo-random number RPA_prand and uses the RPA_prand to generate a private address RPA_hash. The responder verifies the initiator's identity based on the RPA_prand and RPA_hash received from the initiator. If the responder intends to...In a ranging session involving both the initiator and the participant, the responder will send a response frame carrying the same RPA_hash.

[0004] Typically, only ADV-POLL frames and POLL frames carry RPA_hash and RPA_prand, while the remaining frames only carry the RPA_hash from the previous frame. That is, any device that receives an ADV-POLL frame or POLL frame can easily copy the RPA_hash and send a response frame carrying the RPA_hash as its private address. In other words, the initiator cannot determine whether the response frame truly comes from the authorized responder. Summary of the Invention

[0005] Embodiments of this application provide a communication method and a related device that support the initiator in an MMS ranging session to verify that the frame indeed comes from the authorized responder.

[0006] According to a first aspect, this application provides a communication method. The method is applied to a first responder, and the method includes: receiving a first frame from the initiator for initiating a ranging process; generating a first private address based on the first frame and information related to the identity of the first responder; and sending a second frame carrying the first private address to the initiator.

[0007] For example, information related to the identity of the first responder can uniquely identify the identity of the first responder. Frames used to initiate the ranging process include frames used to initiate the initialization and establishment phase, or frames used to initiate the measurement cycle phase.

[0008] The second frame can be a response frame to the first frame, or the second frame can be a frame sent after the response frame to the first frame. For example, the first frame is an ADV-POLL frame, and the second frame is an ADV-RESP frame. Or, the first frame is a POLL frame, and the second frame is a RESP frame. Or, the first frame is a POLL frame, and the second frame is a RPRT frame.

[0009] For example, generating a first private address based on the first frame and information related to the identity of the first responder includes: Verifying the identity of the initiator based on the first frame; when the initiator's authentication is successful, generating a first private address based on information related to the identity of the first responder.

[0010] It should be noted that the information related to the identity of the first responder is known to the initiator.

[0011] According to the above technical solution, since the responder's private address is generated based on the responder's identity, the initiator can identify whether the sender of the compressed frame is an authorized responder, while maintaining the sender's privacy. Simultaneously, since no new fields need to be added to the compressed frame, the size of the compressed frame can be minimized.

[0012] In one possible implementation, the information related to the identity of the first responder includes any one of the following: the public address of the first responder, the MMS ranging configuration requested by the first responder,The first random number generated by the first responder, or the unique identity resolving key (IRK) between the initiator and the first responder.

[0013] The public address of the first responder may include either an in-band extended address or an out-of-band (OOB) public address.

[0014] Crucially, the responder provides its public address during the session establishment phase and / or carries the MMS ranging configuration in the compressed frame sent to the initiator to obtain the ranging result. Therefore, in the above technical solution, the first responder uses the public address or MMS ranging configuration as information related to its identity to generate a private address, thereby eliminating the need for additional signaling interaction to notify the initiator of its identity information, which helps reduce signaling overhead in the ranging session. Furthermore, compared to static identity-related information, random numbers can be updated frequently, so using the first random number as information related to the identity of the first responder helps improve communication security. Using the unique IRK between the initiator and the first responder as information related to the identity of the first responder can reduce the complexity of generating a private address.

[0015] In one possible implementation, the first frame carries a second random number, which is associated with a second private address of the initiator; generating the first private address based on the first frame and information related to the identity of the first responder includes: generating the first private address based on the second random number and the information related to the identity of the first responder.

[0016] Generating the first private address based on the second random number and information related to the identity of the first responder includes: after verifying the identity of the initiator using the second random number and the second private address, generating the first private address based on information related to the identity of the first responder; and / or using the first random number and information related to the identity of the first responder combined with a pre-negotiated IRK between the initiator and the first responder as input to a suitable hash function to generate the first private address, wherein the suitable hash function is pre-negotiated between the initiator and the first responder. In the former case, the first frame also carries a second private address.

[0017] For example, when the information related to the identity of the first responder includes any of the following: the public address of the first responder, the MMS ranging configuration requested by the first responder, and a first random number generated by the first responder, generating a first private address based on a second random number and the information related to the identity of the first responder includes: generating a first private address based on a second random number, the information related to the identity of the first responder, and a first IRK, wherein the first IRK is pre-negotiated between the initiator and the first responder.

[0018] For example, the first IRK may include: a public IRK shared between the initiator and multiple responders, and multiple responder packets...Including the first responder; or the unique IRK of the initiator and the first responder.

[0019] According to the above technical solution, the first responder generates a private address based on the random number carried in the compressed frame received from the initiator. This helps to increase the difficulty of attacking the session between the initiator and the authorized responder, because only the responder who knows the random number can generate a private address that can be successfully verified by the initiator. Specification 2 / 23 Page 8 CN 121336474 A

[0020] In one possible implementation, the second private address is generated based on information related to the identity of the second responder. The generation of the first private address based on the first frame and the information related to the identity of the first responder includes: generating the first private address when it is determined that the second responder and the first responder are the same responder.

[0021] According to the above technical solution, the initiator can select a specific responder to participate in MMS ranging.

[0022] In one possible implementation, sending a second frame carrying the first private address to the initiator includes: sending a second frame carrying the first private address and the first random number to the initiator.

[0023] Alternatively, the first responder generates a new first random number when sending the second frame.

[0024] According to the above technical solution, by carrying the first random number in the second frame, the initiator can know the identity of the first responder, which can avoid the risk of static identity information being stolen and improve communication security.

[0025] In one possible implementation, the first frame is a ranging initialization message (RIM) frame, which carries a list associated with the responders, the responders being scheduled to participate in MMS ranging, and the responders including the first responder; generating the first private address based on the information related to the identity of the first responder includes: generating the first private address when it is determined from the list that the first responder is scheduled to the first access time slot among multiple access time slots.

[0026] According to the above technical solution, when the responder receives the RIM, only the responder scheduled to the first access time slot generates and sends its private address, while other responders are in a standby state until they receive the POLL frame.

[0027] In one possible implementation, the second frame includes any one of the following frames: ADV-RESP frame, RESP frame, and RPRT frame.

[0028] The first frame includes an ADV-POLL frame or a POLL frame.

[0029] According to the above technical solution, carrying a private address related to the responder's identity in the frame sent by the responder to the initiator helps the initiator authenticate the responder's identity.

[0030] In one possible implementation, the first frame or the second frame is a secure frame carrying encrypted information, which is obtained based on a first Nonce; the first Nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for the transmission of the secure frame.

[0031] For example, the time period can be an Insider block structure or an Outside block structure. Specifically, if the time period is an Insider block structure, the time period can indicate the time slot, round, and block for sending the secure frame.

[0032] According to the above technical solution, encrypting a portion of the content in the second frame based on the Nonce helps to improve the security of the information carried in the second frame.

[0033] In one possible implementation, the first Nonce includes frame counter information, which indicates the time period for the transmission of the secure frame.

[0034] According to the above technical solution, a frame counter can be generated for the Nonce used to securely protect or desecure the frame based on the time period for the transmission of the secure frame.

[0035] In one possible implementation, the first Nonce further includes block structure indication information, which indicates whether the second frame is sent within or outside the block structure.

[0036] For example, the block structure indication information includes a 1-bit field, which is set to 0 in compressed frames sent outside the block structure and set to 1 in secure compressed frames sent within the block structure.

[0037] According to the above technical solution, the block structure indication information can ensure that the Nonce used for sending secure frames (page 3 / 23, CN 121336474 A) within and outside the block structure will never be reused.

[0038] In one possible implementation, the second frame also carries the private address of the initiator.

[0039] For example, the private address of the initiator includes a second private address.

[0040] According to the above technical solution, including both the private address of the initiator and the private address of the responder in the second frame simplifies the authentication of the responder. For example, if the initiator's private address carried in the second frame does not match the initiator's private address carried in the first frame, the initiator will determine that the responder's authentication has failed; otherwise, the initiator will further verify the responder's identity based on the responder's private address. Furthermore, carrying the initiator's private address in the second frame makes it easier for the initiator to identify the IRK used to verify the responder's private address.

[0041] In one possible implementation, the method further includes: receiving from the initiator a third frame carrying time offset information, the time offset information indicating the time offset of the transmitted start of ranging (SOR) frame.

[0042] According to the above technical solution, when UWB channel coordination is active, the responder can perceive the time offset of the SOR frame.

[0043] According to a second aspect, this application provides a communication method. The method is applied to an initiator, and the method includes: receiving a second frame carrying a first private address from a first responder, the first private address being associated with information, the information being associated with the identity of the first responder; generating a third private address based on the information associated with the identity of the first responder; and verifying the identity of the first responder by comparing the third private address and the first private address.

[0044] Specifically, when the third private address is the same as the first private address, it is determined whether the second frame actually comes from the authorized first responder.

[0045] In one possible implementation, the information associated with the identity of the first responder includes any one of the following: the public address of the first responder, the MMS ranging configuration requested by the first responder, a first random number generated by the first responder, and the unique IRK of the initiator and the first responder.

[0046] In one possible implementation, the method further includes: sending a first frame for initiating a ranging process, wherein the first frame carries a second random number, and the second random number is associated with a second private address of the initiator; generating a third private address based on the identity-related information of the first responder includes: generating the third private address based on the second random number and the identity-related information of the first responder.

[0047] For example, the third private address is generated by combining the first random number and the identity-related information of the first responder with a pre-negotiated IRK between the initiator and the first responder as input to a suitable hash function. The suitable hash function is pre-negotiated between the initiator and the first responder.

[0048] In one possible implementation, the method further includes: generating a fourth private address based on the identity-related information of the second responder; sending a frame carrying the fourth private address to the second responder.

[0049] In some embodiments, the first responder and the second responder are the same responder.

[0050] Optionally, the method further includes: sending a frame carrying the fourth private address to the first responder. It should be noted that since the fourth private address is generated based on the identity of the second responder, only the second responder can successfully verify the fourth private address.

[0051] In one possible implementation, the second frame also carries the first random number, and the generation of the third private address based on the information related to the identity of the first responder (page 4 / 23 of the specification, 10 CN 121336474 A) includes: generating the third private address based on the first random number.

[0052] In one possible implementation, the method further includes: sending a first frame to the first responder for initiating a ranging process, the first frame being a RIM frame carrying a list associated with the responder, the responder being scheduled to participate in MMS ranging, the responder including the first responder.

[0053] In one possible implementation, the second frame includes any one of the following frames: ADV-RESP frame, RESP frame, and RPRT frame.

[0054] In one possible implementation, the first frame or the second frame is a secure frame carrying encrypted information obtained based on a first Nonce; the first Nonce is associated with any one of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for the transmission of the secure frame.

[0055] In one possible implementation, the first Nonce includes frame counter information indicating the time period for the transmission of the secure frame.

[0056] In one possible implementation, the first Nonce further includes block structure indication information, which indicates whether the second frame is sent within or outside the block structure.

[0057] In one possible implementation, the second frame also carries the private address of the initiator; the method further includes: verifying the identity of the first responder based on the private address of the initiator.

[0058] In one possible implementation, the method further includes: sending a third frame carrying time offset information to the first responder, the time offset information indicating the time offset of the sent SOR frame.

[0059] The beneficial effects of the second aspect refer to the first aspect. Further details are omitted here.

[0060] According to a third aspect, this application provides a communication apparatus, including: a receiving unit, configured to receive a first frame from an initiator for initiating a ranging process; a generating unit, configured to generate a first private address based on the first frame and information related to the identity of the first responder, wherein the information related to the identity of the first responder is known to the initiator; and a sending unit, configured to send a second frame carrying the first private address to the initiator.

[0061] In one possible implementation, the information related to the identity of the first responder includes any one of the following: the public address of the first responder, the MMS ranging configuration requested by the first responder, a first random number generated by the first responder, or a unique IRK of the initiator and the first responder.

[0062] In one possible implementation, the first frame carries a second random number, the second random number being associated with a second private address of the initiator; the generation unit is configured to: based on the second random number and the information related to the identity of the first responder...The first private address is generated based on the identity-related information of the responder.

[0063] In one possible implementation, the second private address is generated based on the identity-related information of the second responder, and the generating unit is configured to: generate the first private address when it is determined that the second responder and the first responder are the same responder.

[0064] In one possible implementation, the sending unit is configured to: send the second frame carrying the first private address and the first random number to the initiator.

[0065] In one possible implementation, the first frame is a RIM frame, the RIM frame carries a list associated with the responder, the responder is scheduled to participate in MMS ranging, and the responder includes the first responder; the generating unit is configured to: generate the first private address when it is determined based on the list that the first responder is scheduled to a first access time slot among multiple access time slots. Specification 5 / 23 pages 11 CN 121336474 A

[0066] In one possible implementation, the second frame includes any one of the following frames: ADV-RESP frame, RESP frame, and RPRT frame.

[0067] In one possible implementation, the first frame or the second frame is a secure frame carrying encrypted information, the encrypted information being obtained based on a first Nonce; the first Nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for the transmission of the secure frame.

[0068] In one possible implementation, the first Nonce includes frame counter information indicating the time period for the transmission of the secure frame.

[0069] In one possible implementation, the first Nonce further includes block structure indication information indicating whether the second frame is sent within or outside a block structure.

[0070] In one possible implementation, the second frame also carries the private address of the initiator.

[0071] In one possible implementation, the receiving unit is further configured to: receive a third frame carrying time offset information from the initiator, the time offset information indicating the time offset of the transmitted SOR frame.

[0072] According to a fourth aspect, this application provides a communication apparatus, comprising: a receiving unit, configured to receive from a first responder a second frame carrying a first private address, wherein the first private address is associated with information, the information being associated with the identity of the first responder; a generating unit, configured to generate a third private address based on the information associated with the identity of the first responder; and a verification unit, configured to verify the identity of the first responder by comparing the third private address with the first private address.

[0073] In one possible implementation, the information related to the identity of the first responder includes any one of the following: the public address of the first responder, the MMS ranging configuration requested by the first responder, a first random number generated by the first responder, or a unique IRK of the initiator and the first responder.

[0074] In one possible implementation, the communication device further includes a sending unit, the sending unit being configured to: send a first frame for initiating a ranging process, the first frame carrying a second random number, and the second random number being associated with a second private address of the initiator; the generating unit being configured to: generate the third private address based on the second random number and the information related to the identity of the first responder.

[0075] In one possible implementation, the generating unit is further configured to: generate a fourth private address based on the information related to the identity of the second responder; the sending unit is further configured to: send a frame carrying the fourth private address to the second responder.

[0076] In one possible implementation, the second frame also carries the first random number, and the generating unit is configured to: generate the third private address based on the first random number.

[0077] In one possible implementation, the sending unit is further configured to: send a first frame for initiating a ranging process to the first responder, the first frame being a RIM frame, the RIM frame carrying a list associated with the responder, the responder being scheduled to participate in MMS ranging, the responder including the first responder.

[0078] In one possible implementation, the second frame includes any one of the following frames: ADV-RESP frame, RESP frame, and RPRT frame.

[0079] In one possible implementation, the first frame or the second frame is a secure frame carrying encrypted information, the encrypted information being obtained based on a first Nonce; the first Nonce is associated with any one of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for the transmission of the secure frame. Specification 6 / 23 pages 12 CN 121336474 A

[0080] In one possible implementation, the first Nonce includes frame counter information, the frame counter information indicating the time period for the transmission of the secure frame.

[0081] In one possible implementation, the first Nonce further includes block structure indication information, which indicates whether the second frame is sent within or outside the block structure.

[0082] In one possible implementation, the second frame also carries the private address of the initiator; the verification unit is further configured to: verify the identity of the first responder based on the private address of the initiator.

[0083] In one possible implementation, the sending unit is further configured to: send a third frame carrying time offset information to the first responder, the time offset information indicating the time offset of the sent SOR frame.

[0084] According to a fifth aspect, a communication device is provided, including a processor and a memory. The processor is connected to the memory. The memory is used to store instructions, and the processor is used to execute the instructions. When the processor executes the instructions stored in the memory, it causes the processor to perform the method in any possible implementation of the first or second aspect.

[0085] According to a sixth aspect, this application provides a communication system, the communication system including a communication device in any possible implementation of the third aspect, and a communication device in any possible implementation of the fourth aspect.

[0086] According to a seventh aspect, this application provides a computer-readable storage medium including instructions. When the instructions are executed on a processor, they cause the processor to perform the method in any possible implementation of the first or second aspect.

[0087] According to an eighth aspect, this application provides a computer program product including computer program code. When the computer program code is executed on a computer, it causes the computer to perform the method in any possible implementation of the first or second aspect.

[0088] It should be noted that all or part of the above-mentioned computer program code can be stored in the first storage medium. The first storage medium can be packaged together with the processor or packaged separately from the processor.

[0089] According to a ninth aspect, this application provides a chip system including a memory and a processor. The memory is used to store a computer program, and the processor is used to call the computer program from the memory and run the computer program, such that an electronic device configured to configure the chip system performs the method in any possible implementation of the first or second aspect. Brief Description of the Drawings

[0090] FIG1 illustrates the transmission of compressed frames in an MMS ranging session.

[0091] FIG2 is a schematic flowchart of a communication method provided by an embodiment of this application.

[0092] FIG3 is a schematic flowchart of another communication method provided by an embodiment of this application.

[0093] FIG4 is a schematic diagram of an ADV-POLL frame or a POLL frame.

[0094] FIG5 is a schematic diagram of an ADV-RESP frame or a RESP frame provided by an embodiment of this application.

[0095] FIG. 6 is a schematic diagram of another ADV-RESP frame or another RESP frame provided in an embodiment of this application.

[0096] FIG. 7 is a schematic diagram of yet another ADV-RESP frame or yet another RESP frame provided in an embodiment of this application.

[0097] FIG. 8 is a schematic diagram of an SOR frame.

[0098] FIG. 9 is a schematic diagram of a secure compressed frame provided in an embodiment of this application.

[0099] Figure 10 is a schematic diagram of a Nonce provided in an embodiment of this application.

[0100] Figure 11 is a schematic diagram of a method for constructing a Nonce provided in an embodiment of this application. Specification 7 / 23 pages 13 CN 121336474 A

[0101] Figure 12 is a schematic flowchart of another communication method provided in an embodiment of this application.

[0102] Figure 13 is a schematic flowchart of another communication method provided in an embodiment of this application.

[0103] Figure 14 is a schematic flowchart of another communication method provided in an embodiment of this application.

[0104] Figure 15 is a schematic flowchart of another communication method provided in an embodiment of this application.

[0105] Figure 16 is a schematic diagram of a RIM frame provided in an embodiment of this application.

[0106] Figure 17 is a schematic flowchart of another communication method using selective MMS ranging provided in an embodiment of this application.

[0107] Figure 18 is a schematic block diagram of a communication device provided in an embodiment of this application.

[0108] FIG19 is a schematic block diagram of another communication device provided in an embodiment of the present application.

[0109] FIG20 is a schematic block diagram of yet another communication device provided in an embodiment of the present application. Detailed Description

[0110] For ease of understanding, an MMS ranging session is shown below.

[0111] As shown in FIG1, an MMS ranging session may include an initialization and setup phase, followed by one or more ranging measurement cycles. During the initialization and setup phase, frames are transmitted in an initialization channel, while during the measurement cycle, frames are transmitted in a ranging channel. Although the same channel can be used as both the initialization channel and the ranging channel, it is more likely that one or more well-known channels will be used as the initialization channel.

[0112] During the initialization and setup phase, the initiator and the responder may negotiate the ranging configuration. The initiator, based on its own judgment, opportunistically transmits ADV-POLL frames at time intervals, while if the responder intends to participate in the ranging session with the initiator, one or more responders may opportunistically listen for incoming ADV-POLL frames and respond with ADV-RESP frames. Once the initiator receives the ADV-RESP frame, it sends an SOR frame, which provides the time offset for the start of the first ranging cycle.

[0113] The measurement cycle includes a ranging control phase, a ranging phase, and an optional measurement reporting phase. The ranging control phase begins at the start of the ranging cycle. The initiator begins the ranging control phase by sending a POLL frame to the responder at the start of the first ranging time slot of the ranging wheel. The responder, upon receiving the POLL frame, successfully sends a RESP frame back to the initiator. The POLL and RESP frames enable the initiator and responder to synchronize time and frequency. The initiator may also include its own data in the responder's POLL frame.It controls information. During the ranging phase, the initiator and responder may exchange zero or more UWB ranging sequence fragments (RSFs) and optional one or more UWB ranging integrity fragments (RIFs). RSFs are used to perform ranging measurements, while RIFs are used to check the integrity of the ranging measurements. After the initiator or responder has completed receiving all UWB fragments during the ranging phase, the reporting phase begins, in which the initiator and / or responder generates a ranging measurement report and sends an RPRT frame carrying the measurement report to the peer device.

[0114] There are two types of MMS ranging: (1) UWB-only MMS ranging, in which control frames and ranging fragments are transmitted using UWB; and (2) Narrowband Assisted UWB (NBA-UWB) MMS ranging, in which ranging fragments are transmitted using UWB, while control signals are transmitted using narrowband.

[0115] Frame transmission in an MMS ranging session is based on a block-based time structure. As shown in Figure 1, during the initialization and setup phases, frames are transmitted outside the block structure, while during the measurement cycle, frames are transmitted within the block structure. In the block-based time structure, each ranging block comprises the full number of ranging wheels, where a ranging wheel is a time period with sufficient duration to complete a full ranging cycle, the time period involving the set of enhanced ranging capable devices (ERDEVs) participating in the ranging exchange. Here, when a frame is referred to as being transmitted or received within the block structure, it means that both the initiator and the responder are aware of the block-based time structure and are synchronized. However, if the initiator and / or the responder are unaware of the block-based time, the frame is said to be transmitted or received outside the block structure. Each ranging wheel is further subdivided into an integer number of ranging time slots, where a ranging time slot is a time period with sufficient duration for the transmission of at least one ranging frame (RFRAME). The block-based mode uses a structured time axis, where, by default, the ranging block structure is periodic.

[0116] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0117] FIG2 shows a flowchart of an embodiment of the communication method. The method can be applied to the MMS ranging process. The initiator can be a device that initiates UWB exchange by sending exchanged messages. The responder can be a device that responds to messages received from the initiator and participates in UWB exchange.

[0118] S110: The initiator sends a first frame to the first responder.

[0119] The first frame carries a second random number and the initiator's second private address, wherein the second private address and the second random number are...The machine number is associated. For example, the second private address is generated using a hash function by combining a second random number with a second IRK, which is pre-negotiated between the initiator and the first responder.

[0120] In some possible implementations, the first frame is used to initiate the ranging process. For example, the first frame may be one of ADV-POLL frame, POLL frame and RIM frame. RIM frame can be regarded as a variant of POLL frame.

[0121] S120: The first responder generates a first private address based on the first frame and information related to the identity of the first responder.

[0122] The information related to the identity of the first responder is known to the initiator. For example, the information related to the identity of the first responder is pre-negotiated between the initiator and the first responder, or the information related to the identity of the first responder is notified to the initiator by the first responder. In the former case, the information related to the identity of the first responder includes the public address of the first responder, and either the unique IRK of the initiator and the first responder (e.g., IRK-RI). In the latter case, the information related to the identity of the first responder includes either the MMS ranging configuration requested by the first responder or the first random number generated by the first responder.

[0123] For example, the public address of the first responder includes an in-band extended address or an OOB public address.

[0124] For example, the in-band extended address may include an 8-byte extended media access control (MAC) address. The OOB public address may include a 6-byte Bluetooth MAC address. In some embodiments, the public address of the first responder may also include other communication addresses that uniquely identify the first responder.

[0125] For example, the MMS ranging configuration requested by the first responder may include at least one of the following: UWB physical layer (PHY) configuration, UWB MAC configuration, narrowband (NB) PHY configuration, and NB MAC configuration.

[0126] Optionally, the first responder generating a first private address based on the first frame and the information related to the identity of the first responder includes: the first responder generating a first private address based on a second random number and the information related to the identity of the first responder.

[0127] In some embodiments, the first responder generating a first private address based on a second random number and information related to the identity of the first responder includes: the first responder using the first random number and information related to the identity of the first responder, combined with a first IRK pre-negotiated between the initiator and the first responder, as input to a suitable hash function to generate the first private address; or the first responder using the first random number and information related to the identity of the first responder as input to a suitable hash function to generate the first private address. The suitable hash function is pre-negotiated between the initiator and the first responder.

[0128] For example, the first private address can be generated using the following formula: Hash = AH(IRK, random number), where Hash represents the first private address, AH() represents the hash function, IRK can be the first IRK or a unique IRK shared by the initiator and the first responder, and random number can be the second random number or the first random number.

[0129] For example, the first IRK includes: a public IRK shared between the initiator and multiple responders, including the first responder; or a unique IRK shared by the initiator and the first responder.

[0130] Optionally, the second IRK is the same as the first IRK, or the second IRK is paired with the first IRK.

[0131] In other embodiments, the first responder generating the first private address based on the second random number and information related to the identity of the first responder includes: after verifying the identity of the initiator using the second random number and the second private address, the first responder generates the first private address based on information related to the identity of the first responder.

[0132] For example, the first responder verifying the identity of the initiator using a second random number and a second private address includes: the first responder verifying the identity of the initiator using a second IRK, a second random number, and a second private address. Specifically, the first responder uses a first IRK to generate a local private address for the second random number. If the local private address matches the second private address carried in the first frame, the first responder will determine that the initiator's authentication is successful; otherwise, the first responder will discard the first frame.

[0133] S130: The first responder sends a second frame carrying the first private address to the initiator.

[0134] For example, the second frame may be one of an ADV-RESP frame, a RESP frame, and an RPRT frame.

[0135] In some possible implementations, if the first private address is generated based on the first random number, the second frame will carry the first private address and the first random number.

[0136] In some possible implementations, the second frame also carries the second private address.

[0137] S140: The initiator verifies the identity of the first responder based on the first private address.

[0138] For example, the initiator uses information related to the identity of the first responder and a first IRK, which is pre-negotiated between the initiator and the first responder. Specifically, the initiator uses the first IRK and information related to the identity of the first responder to generate a local private address (e.g., a third private address) with a specific random number. If the local private address matches the first private address carried in the second frame, the initiator determines that the first responder's authentication is successful; otherwise, the initiator discards the second frame.

[0139] For example, a specific random number may include a first random number or a second random number. When the first private address is generated based on the first random number, the specific random number includes the first random number. When the first private address is generated based on the second random number, the specific random number includes the second random number.

[0140] In some possible implementations, the initiator generates a second private address based on information related to the identity of the second responder. The first responder generates a local private address based on information related to the identity of the second responder. If the first responder can successfully verify the second private address, the first responder determines that the second responder is the same as the first responder and generates the first private address.

[0141] In some possible implementations, the initiator generates a fourth private address based on information related to the identity of the second responder and sends a frame carrying the fourth private address to the second responder and the first responder. It should be noted that since the fourth private address is generated based on the identity of the second responder, only the second responder can successfully verify the fourth private address.

[0142] Optionally, the first frame or the second frame is a secure frame carrying encrypted information, which is obtained based on a first nonce; the first nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period used for the transmission of the secure frame.

[0143] For example, the first responder generates the first nonce based on the ID field and private address field of the second frame, as well as the time slot, round, and block for sending the second frame. Specification 10 / 23 pages 16 CN 121336474 A

[0144] Optionally, the first nonce includes frame counter information, which indicates the time slot, round, and block for sending the second frame.

[0145] Optionally, the first nonce also includes block structure indication information, which indicates whether the second frame is sent within or outside the block structure.

[0146] It should be noted that in this application, the first frame and the second frame are compressed frames. The compressed frame is a compressed PSDU or an IEEE standard 802.15.4 frame using the compressed header information element (header IE) format.

[0147] In some possible implementations, the controller acts as the initiator, while the controlled end is assigned the role of the first responder. However, it is also possible that the controlled end is assigned the role of the initiator, while the controller acts as the first responder. It should be noted that the controller is a device used to control the UWB session and define session parameters, and the controlled end is a device that participates in the UWB session using the session parameters received from the controller.

[0148] The communication method in a one-to-one MMS ranging session provided by the embodiments of this application is described in detail below with reference to Figures 3 to 12. The embodiments shown in Figures 3 to 12 are illustrated using the controller as the initiator and the controlled end as the responder as an example.

[0149] Figure 3 shows a schematic flowchart of the communication method in one-to-one MMS ranging provided by an embodiment of this application. The method shown in Figure 3 includes a session establishment phase and steps S210 to S270.

[0150] The MMS ranging session begins with the controller and the controlled end performing session establishment, during which long-term session parameters such as UWB channel number, preamble, and block structure are negotiated. Specifically, during session establishment, the controller will also provide at least one IRK to the controlled end to resolve or create a private address. In addition, for NBA-UWB MMS ranging, narrowband-related parameters (e.g., NB channel number, number of MMS segments) can also be negotiated during session establishment. Furthermore, initiator and responder roles can also be assigned during session establishment.

[0151] For example, at least one IRK may include at least one of the first IRK and the second IRK in the above embodiments.

[0152] It is understood that long-term parameters are not expected to change during the MMS ranging session.

[0153] Conversely, parameters related to the measurement period (e.g., wheel / slot duration, number of MMS segments, reporting mode, etc.) can be considered short-term parameters and can be modified during the MMS ranging session.

[0154] Session establishment can be performed out-of-band (e.g., using Bluetooth or Wi-Fi radio) or in-band (e.g., using NB or UWB radio).

[0155] Once the session is established, step S210 is performed.

[0156] S210: The initiator sends an ADV-POLL frame.

[0157] For example, the initiator may send ADV-POLL frames opportunistically at time intervals according to its own judgment, while one or more responders may opportunistically listen for incoming ADV-POLL frames. The ADV-POLL frame may carry a pseudo-random number RPA_prand-I-1 and its private address RPA_hash-I-1, which can be considered as an example of the second private address in the above embodiments.

[0158] For example, RPA_hash-I-1 can be calculated using Formula 1 and truncated to 24 bits: RPA_hash-I-1 = AES-128-ECB(key=IRK, data=(0x000…

[13] || RPA_prand-I-1 [3])) % 2^24. Formula 1 AES-128-ECB is a hash function, and other hash functions can be used instead. [n] indicates that the preceding parameter is n octets.

[0159] IRK can be a pre-negotiated public IRK between the initiator and the responder, such as IRK-B.

[0160] A schematic diagram of the ADV-POLL frame is shown in Figure 4. As shown in Figure 4, the ADV-POLL frame includes: 1 octet message ID.The fields include a 3-octet private address field carrying the initiator's RPA_hash (e.g., RPA_hash-I-1), a 3-octet field carrying the initiator's RPA_prand (e.g., RPA_prand-I-1), a 1-octet MessageControl field that determines the format of the MessageContent field, a variable-length MessageContent field whose format depends on the content of the MessageContent field, and a 2-octet cyclic redundancy check (CRC) field. The initiator's RPA_hash can also be referred to as the initiator's RPA_hash or the initiator's private address. The initiator's RPA_prand can also be referred to as the initiator's RPA_prand or the initiator's random number.

[0161] After receiving the ADV-POLL frame, the responder generates a local hash of RPA_prand-I-1 using a pre-negotiated IRK (such as IRK-B as described above). For example, the responder uses IRK-B as input to Formula 1 to generate a local hash of RPA_prand-I-1. Furthermore, if the local hash does not match the RPA_hash-I-1 carried in the ADV-POLL frame, the responder will discard the ADV-POLL frame; otherwise, the responder will determine that the initiator's authentication was successful; then, if the responder intends to participate in a ranging session with the initiator, the responder will send an ADV-RESP frame to the initiator, as shown in step S220.

[0162] S220: The responder sends an ADV-RESP frame to the initiator.

[0163] Specifically, the ADV-RESP frame carries a private address (i.e., RPA_hash-R-1) that can identify the responder, which is generated using information related to the responder's identity. RPA_hash-R-1 can be considered as an example of the first private address in the above embodiments.

[0164] Once the initiator receives the ADV-RESP frame, the initiator will verify the responder's identity based on RPA_hash-R-1.

[0165] In one embodiment, information related to the responder's identity may include the responder's public address Responder MAC Address, such as an 802.15 MAC address extended by 8 octets, which can then be calculated using Formula 2 and truncated to 24 bits: RPA_hash-R-1 = AES-128-ECB(key=IRK, data=(0x000…[5] || Responder MAC Address [8]||RPA_prand-I-1)) % 2^24. Formula 2. In addition, once the initiator receives the ADV-RESP frame, the initiator uses the responder's public address (e.g., an 802.15 MAC address extended by 8 octets) combined with RPA_prand-I-1 carried in the ADV-POLL, and uses IRK as input to Formula 2, to generate a local hash for the responder.

[0166] In another embodiment, information related to the identity of the responder may include the MMS ranging configuration requested by the responder, such as various NB and UWB configurations requested by the responder in the ADV-RESP frame, and then RPA_hash-R-1 can be calculated and truncated to 24 bits using the following formula 3: RPA_hash-R-1 = AES-128-ECB(key=IRK, data=(0x00[1] || UWB PHY Config || UWB MAC Config || NB PHY Config || NB MAC Config || RPA_prand-I-1)) % 2^24. Formula 3 Here, UWB PHY Config, UWB MAC Config, NB PHY Config and NB MAC Config refer to various configuration parameters carried in the MessageContent field of the ADV-RESP frame.

[0167] It should be noted that as long as the configuration requests from different responders differ by at least 1 bit, the responder's private address will be unique and can be used to identify the responder in subsequent frames.

[0168] Furthermore, once the initiator receives the ADV-RESP frame, the initiator uses the configuration parameters carried in the MessageContent field of the ADV-RESP frame in combination with RPA_prand-I-1, and uses IRK as the input to Formula 3 above to generate a local hash for the responder.

[0169] In another embodiment, information related to the responder's identity may include the responder's public address Responder OOB MAC Address, such as a 6-octet Bluetooth MAC address, which can then be calculated using Formula 4 (page 12 / 23, CN 121336474 A) and truncated to 24 bits: RPA_hash-R-1 = AES-128-ECB(key=IRK, data=(0x000…[7] || ,6 octets Bluetooth MAC address [6] || RPA_hash-R-1)) %2^24. Formula 4. Furthermore, once the initiator receives the ADV-RESP frame, the initiator uses the responder's public address (e.g., a 6-byte Bluetooth MAC address) in combination with RPA_prand-I-1, and uses IRK as input to Formula 4, to generate a local hash for the responder.

[0170] In some possible implementations, the initiator will maintain a record of the public addresses of one or more responders during session establishment.

[0171] In another embodiment, the information related to the identity of the responder may include one of the unique pair of IRKs (e.g., IRK-RI & IRK-IR) between the initiator and the first responder (e.g., IRK-RI & IRK-IR), for the frame sent by the responder to the initiator. Then, RPA_hash-R-1 can be calculated using Formula 5 and truncated to 24 bits: RPA_hash-R-1 = AES-128-ECB(key=IRK-RI, data=(0x000…

[13] || Initiator RPA_prand-I-1)) % 2^24. Formula 5 Furthermore, once the initiator receives the ADV-RESP frame, the initiator uses the combination of IRK-RI and RPA_prand-I-1 as input to Formula 5 to generate a local hash for the responder.

[0172] A schematic diagram of an ADV-RESP frame carrying the responder's private address (e.g., RPA_hash-R-1) generated by any of the above Formulas 2 to 5 is shown in Figure 5. As shown in Figure 5, the ADV-RESP frame includes: a 1-byte message ID field, a 3-byte field carrying the responder's private address (e.g., RPA_hash-R-1), a 1-byte MessageControl field determining the format of the MessageContent field, a variable-length MessageContent field whose format depends on the content of the MessageContent field, and a 2-byte CRC field.

[0173] In some embodiments, the ADV-RESP frame also carries a private address obtained from ADV-POLL, namely the initiator's RPA_hash. A schematic diagram of an ADV-RESP frame carrying both the responder's private address and the initiator's private address is shown in Figure 6.

[0174] Including both the initiator's RPA_hash and the responder's RPA_hash in the ADV-RESP frame makes it easier to identify the associated IRK and simplifies the initiator's authentication of the responder. Specifically, if the initiator's RPA_hash carried in the ADV-RESP frame does not match the initiator's RPA_hash carried in the ADV-POLL frame, the initiator will determine the identity of the responder.If the verification fails, the initiator will further verify the responder's identity based on the responder's RPA_hash. The responder's RPA_hash can also be referred to as the responder's RPA_hash or the responder's private address.

[0175] In some embodiments, information related to the responder's identity may include a random number (e.g., RPA_prand-R-1) generated by the responder, which can then be calculated using Formula 6 and truncated to 24 bits: RPA_hash-R-1 = AES-128-ECB(key=IRK, data=(0x000…

[13] || RPA_prand-R-1])) % 2^24. Formula 6 For example, the responder may generate its own pseudo-random number RPA_prand-R-1 using any suitable pseudo-random generation function.

[0176] In one embodiment, the responder generates RPA_prand-R-1 when the responder successfully verifies the initiator's identity.

[0177] In another embodiment, the responder generates RPA_prand-R-1 each time it sends ADV-RESR and RESP frames.

[0178] Furthermore, if RPA_hash-R-1 is generated using Formula 6, the ADV-RESP frame also needs to carry the responder's random number so that the initiator can verify the responder's identity. A schematic diagram of an ADV-RESP frame carrying the responder's private address and the responder's random number is shown in Figure 7. Optionally, the frame shown in Figure 7 may carry the initiator's private address obtained from ADV-POLL, or it may not.

[0179] It should be noted that different formats of ADV-RESP or RESP frames can be distinguished by using different IDs for the frames. For example, 0x02 is used for the format shown in Figure 5, 0x32 is used for the format shown in Figure 6, 0x42 is used for the format shown in Figure 7, and so on.

[0180] It should be noted that the IRK used in formulas 2 to 4 and formula 6 can be the first IRK in the above embodiments. For example, the IRK used in formulas 2 to 4 and formula 6 can be a common IRK (e.g., IRK-B), or the IRK used in formulas 2 to 4 and formula 6 can be one of a pair of IRKs (e.g., IRK-RI). Furthermore, formulas 2 to 6 can be seen as some specific examples of Hash = AH (IRK, random number).

[0181] Furthermore, if the responder's local hash does not match the RPA_hash-R-1 carried in the ADV-RESP frame, the initiator will discard the ADV-RESP frame; otherwise, the initiator will determine that the responder's authentication is successful, and then the initiator will send a response to the responder.The initiator sends an SOR frame, as shown in step S230.

[0182] S230: The initiator sends an SOR frame to the responder.

[0183] Specifically, the SOR frame provides a time offset at which the first ranging period will begin. The SOR frame carries the same RPA_hash-I-1 included in the ADV-POLL frame.

[0184] A schematic diagram of the SOR frame is shown in Figure 8. As shown in Figure 8, the SOR frame includes: a 1-byte message ID field, a 3-byte private address field carrying the initiator's RPA_hash (e.g., RPA_hash-I-1), a 1-byte MessageControl field determining the format of the MessageContent field, a variable-length MessageContent field whose format depends on the content of the MessageContent field, and a 2-byte CRC field. The SOR frame carries a time offset indicating the time at which the measurement phase of MMS ranging will begin.

[0185] S240: The initiator sends a POLL frame to the responder.

[0186] At the time indicated by the time offset in the SOR frame, the initiator sends a POLL frame to the responder at the start of the first ranging time slot of the ranging wheel.

[0187] For example, the POLL frame shares the same format as shown in Figure 4 and carries a pseudo-random number RPA_prand-I-2 and its private address RPA_hash-I-2, which is generated using RPA_prand-I-2 and IRK as inputs to Formula 1.

[0188] After receiving the POLL frame, the responder verifies the identity of the initiator based on the private address carried in the POLL frame. The specific verification method is the same as the verification method based on the ADV-POLL frame in S210. It will not be repeated here.

[0189] When the initiator's authentication is successful, the responder will send a RESP frame to the initiator, as shown in step S250.

[0190] S250: The responder sends a RESP frame to the initiator.

[0191] Specifically, the RESP frame carries the responder's private address, such as RPA_hash-R-2. The method for generating the responder's private address, the format of the RESP frame, and the method for the initiator to verify the responder's identity based on the RESP frame are described in detail in S220. The methods are the same, except that a pseudo-random number (such as RPA_prand-I-2) carried in the POLL frame is used to generate the responder's RPA_hash. In short, when generating RPA_hash-R-2 using the above formula, RPA_prand-I-1 in the relevant formula is replaced with RPA_prand-I-2. This will not be elaborated further here.

[0192] When the responder's authentication is successful, the initiator initiates the ranging phase. During the ranging phase, the initiator and the responder...Exchange zero or more RSFs, and optionally exchange one or more RIFs.

[0193] After the initiator or responder receives all UWB segments in the ranging phase, the initiator and / or responder generates a ranging measurement report and sends an RPRT frame carrying the measurement report to the peer device, as shown in steps S260 and S270.

[0194] S260: The responder sends an RPPT frame to the initiator.

[0195] For example, the RPRT frame in this step shares the same format as shown in FIG8 and carries the private address RPA_hash-R-2 generated in step S250.

[0196] S270: The initiator sends an RPPT frame to the responder.

[0197] For example, the RPRT frame in this step shares the same format as shown in FIG8 and carries the private address RPA_hash-I-2 generated in step S240.

[0198] Considering the sensitive nature of some information carried in the above frames, the embodiments of this application provide secure compressed frames to improve the security of information.

[0199] It should be noted that the secure compressed frames in this application are compressed frames that are protected by encryption operations such as authentication or encryption.

[0200] Figure 9 shows a schematic diagram of a secure compressed frame. As shown in Figure 9, the fields of the secure compressed frame are as follows: 1. The ID field indicates the identity of the secure version of the compressed frame. For example, the ID space 0x60 to 0x6F can be reserved for the secure version of the compressed frame. 0x60 represents a secure ADV-RESP frame, 0x61 represents a secure version of the SOR frame, and 0x65 and 0x66 represent the secure versions of the RPRT frames sent by the initiator and the responder, respectively. The RPRT frame can also be called a REPORT frame.

[0201] 2. A 3-octet private address field carrying RPA_hash.

[0202] 3. An optional 3-octet field carrying RPA_prand. This field may only exist in certain frames (e.g., ADV-POLL or POLL) and not in other compressed PSDUs (e.g., ADV-RESP, RESP, SOR, REPORT).

[0203] 4.1 An octet MessageControl field that determines the format of the MessageContent field.

[0204] 5. A variable-length MessageContent field whose format depends on the content of the MessageContent field. If a security level is selected for encryption, all or part of the MessageContent field will be encrypted. If only a portion of the MessageContent field is encrypted, the subfield to be encrypted (also known as the private payload field) will be placed in...The end of the MessageContent field, while the unencrypted subfield (also known as the open payload field) is placed at the beginning of the MessageContent field.

[0205] 6. A variable-length message integrity check (MIC) field replaces the CRC field. The length of the MIC depends on the security level. For example, the length of the MIC can be one of 0 octets, 4 octets, and 8 octets. When the length of the MIC is 0 octets, the frame is insecure, and the field is used for a 2-octet CRC.

[0206] In some possible implementations, all or part of the contents of the MessageContent field can be encrypted using a Nonce-based authenticated encryption with associated data (AEAD) operation.

[0207] It should be noted that when security is enabled, the initiator of the AEAD operation and one or more responders can exchange one or more keys different from the IRK.

[0208] The Nonce for the AEAD transformation or inverse transformation used for secure compressed frames is shown in Figure 10. This Nonce format can be used for compressed frames sent outside of or within the block structure. As shown in Figure 10, the Nonce fields are as follows: 1. The RPA_hash field is set to the RPA_hash field of the compressed frame to be secured or desecured.

[0209] 2. The RPA_prand field is set to the RPA_prand field of the compressed frame to be secured. If such a field exists, it is set to RPA_prand to generate the RPA_hash field of the compressed frame to be secured or desecured.

[0210] 3. The ID field is set to the ID field of the compressed frame to be secured or desecured.

[0211] 4. If the block structure exists and is known to both the transmitting and receiving devices (e.g., the intra-block structure in Figure 1), the frame counter field includes a slot index field, a round index field, and a block index field, which are set to the indices of the slot, round, and block of the transmitted or received frame, respectively. If the block structure does not exist and is unknown to at least one of the transmitting or receiving devices (e.g., the off-block structure in FIG1), the frame counter field is reserved and set to 0. The information carried in the frame counter field can be considered as an example of frame counter information.

[0212] 5. A 1-bit field called the block structure indicator indicates whether the secure frame is transmitted inside or outside the block structure. For example, the block structure indicator field is set to 0 in secure compressed frames transmitted outside the block structure, and to 0 in secure compressed frames transmitted inside the block structure.The information carried in the block structure indicator field can be seen as an example of block structure indicator information.

[0213] 6. The security level field is an unsigned integer and should be set to the value of the security level negotiated during session establishment.

[0214] Furthermore, FIG11 illustrates how a Nonce is constructed for security operations related to secure compressed frames sent within a block structure, according to an embodiment of this application.

[0215] Once the device is synchronized with the block structure, it knows the slot / round / block index for sending or receiving compressed frames, and it can construct the frame counter field of the Nonce, otherwise the frame counter field is set to 0. For the example shown in FIG11, for an RPRT frame sent by the responder in slot m of the first round of block 1, the slot index field, round index field, and block index field of the frame counter field of the Nonce are set to m, 1, and 1, respectively, corresponding to slot m, the first round, and block 1; while the block structure indicator is set to 1. The RPA_hash field and ID field of the Nonce are copied from the RPA_hash field and ID field of the REPORT frame. However, since the RPA_prand field does not exist in the REPORT frame, the Nonce's RPA_prand field is set to the RPA_prand used to generate the RPA_hash field, such as the RPA_prand carried in the previous POLL frame sent by the initiator. The Nonce security level is set to an appropriate security level, such as the security level negotiated during session establishment.

[0216] Similarly, for frames sent outside the block structure, such as SOR frames, the Nonce's frame counter field is set to 0, and the block structure indicator is set to 0. The Nonce's RPA_hash field and message ID field are copied from the RPA_hash field and ID field of the SOR frame. Since the RPA_prand field does not exist in the SOR frame, the Nonce's RPA_prand field is set to the RPA_prand used to generate the RPA_hash field, i.e., the RPA_prand carried in the previous ADV-POLL frame sent by the initiator. The Nonce security level is set to an appropriate security level, such as the security level negotiated during session establishment.

[0217] For example, to secure or desecure compressed frames, the procedures provided in 9.3.5 (AEAD Transformed Data Representation) or 9.3.6 (AEAD Inverse Transformed Data Representation) of the 802.15.4-2020 specification are reused, except that, for compressed frames, the MAC header (MHR) is replaced by the ID field, RPA_hash field, RPA_prand field (if present), and MessageControl field.

[0218] Although in most secure compressed frames, the entire MessageControl field is considered a private payload field and is encrypted when negotiating any security level with encryption, for secure RPRT compressed frames (SECURE-RPRT), only selected fields of the MessageControl field can be considered private payload fields and are encrypted when negotiating any security level with encryption. This is summarized in Table 1: Table 1 Specification 16 / 23 pages 22 CN 121336474 A

[0219] In the above embodiments, by encrypting the compressed frame, the security of communication during MMS ranging can be further improved.

[0220] In some possible implementations, UWB channel coordination may be active, and before sending the SOR frame, the initiator scans the initialization channel and the default UWB channel in the NB to obtain acquisition packets (APs) from other initiators. In order to perform a capture scan, when the initiator receives an ADV-RESP frame from the responder, it does not immediately send an SOR frame, but instead sends an Advertisement Confirmation (ADV-CONF) frame to the responder. The ADV-CONF frame carries a time offset indicating the transmission time of the SOR, as shown in step S230' of FIG12. The initiator performs a capture scan on the AP. Based on the information collected from the AP, the initiator can adjust the configuration parameters used for MMS ranging in the SOR frame.

[0221] The communication method provided in the embodiments of this application can also be applied to one-to-many MMS ranging sessions. FIG13 to FIG15 show schematic flowcharts of the communication method in one-to-many MMS ranging provided in the embodiments of this application.

[0222] As shown in FIG13, similar to one-to-one MMS ranging, a one-to-many MMS ranging session begins with the controller and two controlled terminals performing session establishment. During the session establishment, long-term session parameters such as UWB channel number, preamble, and block structure are negotiated. When privacy is enabled, the controller will also provide at least one IRK to each controlled terminal to parse the private address carried in the frame sent by the initiator and generate a private address to be included in the frame sent by the responder, thereby protecting the privacy of the device.

[0223] Once a session is established, step S310 is executed.

[0224] S310: The initiator sends an ADV-POLL frame.

[0225] For example, the initiator sends ADV-POLL frames opportunistically at time intervals according to its own judgment, while the responder can opportunistically listen for incoming ADV-POLL frames.

[0226] Specifically, the method for generating the initiator's private address carried in the ADV-POLL frame and the format of the ADV-POLL frame refer to the above embodiments. Further details will not be repeated here.

[0227] When the initiator expects more than one responder to participate in MMS ranging, the initiator allocates a fixed duration to the responders to compete for the medium and send their corresponding ADV-RESP frames.

[0228] Responder 1 or Responder 2 verifies the identity of the initiator after receiving the ADV-POLL frame. The method for verifying the identity of the initiator is the same as described in the above embodiment. It will not be repeated here.

[0229] When the initiator's authentication is successful, if Responder 1 and Responder 2 intend to participate in the ranging session with the initiator, Responder 1 and Responder 2 will send ADV-RESP frames to the initiator, as shown in step S320. Specifically, S320 includes S321 and S322.

[0230] S321: Responder 1 sends an AVD-RESP carrying its private address RPA_hash-R1-1 to the initiator.

[0231] S322: Responder 2 sends an AVD-RESP carrying its private address RPA_hash-R2-1 to the initiator.

[0232] The method for generating a private address can be referred to the above embodiments. It will not be repeated here. Specification 17 / 23 pages 23 CN 121336474 A

[0233] S330: The initiator sends an SOR frame to responder 1 and responder 2.

[0234] The initiator generates a local hash using the method in the above embodiments. If at least one local hash matches either RPA_hash-R1-1 or RPA_hash-R2-1, the initiator sends an SOR frame that provides the time offset at which the first ranging cycle will begin. The SOR frame carries the same RPA_hash-I-1 included in the ADV-POLL frame.

[0235] S340: The initiator sends an RIM frame to responder 1 and responder 2.

[0236] At the time indicated by the time offset in the SOR frame, the initiator sends an RIM frame to the responder at the start of the first ranging time slot of the ranging wheel.

[0237] A schematic diagram of the RIM frame is shown in Figure 16. Besides providing time and frequency synchronization for the responders, another important purpose of the RIM frame is to provide the responders with a schedule for access slots used in MMS ranging. As shown in Figure 16, the MessageControl field of the RIM frame carries a list of responders scheduled to participate in MMS ranging. The responder's RPA_hash (e.g., RPA_hash-Rn-1 (n=1, 2, etc.)) used in the ADV-RESP frame from responder n serves as the responder's private address. The order in which the responder's RPA_hash appears in the MessageContent field of the RIM frame determines the order of the responder's access slots used for MMS ranging. Furthermore, the RIM frame can also carry a second pseudo-random number from the initiator, i.e., the number in the initiator's RPA_prand field.RPA_prand-I-2, and its private address, i.e., RPA_hash-I-2 in the initiator's RPA_hash field, to allow the responder to verify the initiator's identity.

[0238] For example, responder 1 is scheduled to the first access slot (access slot 0), and responder 2 is scheduled to the second access slot (access slot 1). Then steps S350 to S380 and S350' to S380' are executed.

[0239] S350: Responder 1 sends a RESP carrying its private address RPA_hash-I-2 to the initiator.

[0240] Upon receiving a RIM frame, each responder that receives the RIM frame generates a local hash (e.g., RPA_prand-I-2) of the initiator's RPA_prand based on the IRK. If the local hash matches the RPA_hash-I-2 carried in the initiator's RPA_hash field of the RIM frame, the responder will verify the initiator's identity.

[0241] The responder who successfully receives the RIM frame and is scheduled to the first access slot (access slot 0) generates its own private address as described above, but uses the RPA_prand-I-2 carried in the RIM frame, and sends the RESP frame carrying the private address back to the initiator. As described above, the responder can be responder 1.

[0242] It should be noted that the RIM and RESP frames enable the initiator and responder to achieve time and frequency synchronization. The initiator can also include other control information in the responder's RIM frame.

[0243] When the authentication of responder 1 based on RESP is successful, the initiator initiates the ranging phase. In the ranging phase, the initiator and responder exchange zero or more RSFs, and optionally exchange one or more RIFs.

[0244] After the initiator or responder receives all UWB segments in the ranging phase, the initiator and / or responder generate a ranging measurement report and send an RPRT frame carrying the measurement report to the peer device. Each RPRT frame carries the appropriate private address, as shown in steps S370 and S380.

[0245] Subsequently, as shown in step S340', the initiator sends a POLL frame to the responder 2 at the beginning of the first ranging time slot of the second access time slot (access time slot 1).

[0246] The remaining steps of FIG13 are similar to the steps described above and the above embodiments. They will not be repeated here.

[0247] In some possible implementations, the format of the ADV-RESP (or RESP) frame in FIG13 can be as shown in one of FIG5 to FIG7. The specific format of the ADV-RESP (or RESP) frame can be determined by the parameters used to generate the ADV-RESP (or RESP) frame. For example, if the private address carried in the ADV-RESP (or RESP) frame is generated using any of formulas 2 to 5, then...The format of the ADV-RESP (or RESP) frame in Figure 13 can be as shown in Figure 5 or Figure 6. Alternatively, if the private address carried in the ADV-RESP (or RESP) frame is generated by Formula 6, the format of the ADV-RESP (or RESP) frame in Figure 13 can be as shown in Figure 7, page 18 / 23, CN 121336474 A.

[0248] The one-to-many MMS ranging session shown in Figure 14 is similar to that in Figure 13. The difference is that UWB channel coordination can be active, and before sending the SOR frame, the initiator scans the initialization channel and the default UWB channel in the NB to obtain acquisition packets (APs) from other initiators. In order to perform the acquisition scan, when the ADV-RESP frame is received from the responder, the initiator does not immediately send the SOR frame, but instead sends an ADV-CONF frame to the responder, which carries a time offset indicating the transmission time of the SOR, as shown in step S330' in Figure 14, whereby the initiator performs an acquisition scan on the AP. Based on the information collected from the AP, the initiator can adjust the configuration parameters used for MMS ranging in the SOR frame.

[0249] In some possible implementations, the format of the ADV-RESP (or RESP) frame in FIG14 can be as shown in FIG5 to FIG7, and the specific format of the ADV-RESP (or RESP) frame can be determined by the parameters used to generate the ADV-RESP (or RESP) frame. For example, if the private address carried in the ADV-RESP (or RESP) frame is generated by any of Equations 2 to 5, then the format of the ADV-RESP (or RESP) frame in FIG14 can be as shown in FIG5 or FIG6. Alternatively, if the private address carried in the ADV-RESP (or RESP) frame is generated by Equation 6, then the format of the ADV-RESP (or RESP) frame in FIG14 can be as shown in FIG7.

[0250] The one-to-many MMS ranging session shown in FIG15 is also similar to FIG13. The difference is that the responder generates its own private address based on the pair of IRKs. In some of the embodiments described above, it is assumed that the IRK exchanged between the initiator and all responders is common to all responders; that is, only a single IRK is maintained in the network for identification and resolution. However, it is also possible that a common IRK (IRK-B) is shared between all initiators and responders in the same network only for broadcast frames (e.g., RIM), and pairs of IRKs (IRK-IRn & IRK-RIn, n = responder index) are exchanged between the initiator and each responder for unicast frames in each direction. (i.e., one IRK (IRK-IRn, n = responder index) for initiator-to-responder frames; one IRK (IRK-RIn, n = responder index) for responder-to-initiator frames.)Responder Index). The IRK is used in subsequent frames as an indirect means of identifying the frame sender.

[0251] For example, for a unicast frame to be sent to responder n (i.e., a frame for a single responder, such as an ADV-POLL frame, a POLL frame, or a REPORT frame), the initiator generates a unique pseudo-random number (RPA_prand-I-n) for the responder and uses the initiator's paired IRK for the responder (IRK-IRn, n = responder index) to generate the initiator's RPA_hash (RPA_hash-I-n) using Formula 1, and includes RPA_hash-I-n and RPA_prand-I-n in the initial unicast frame of responder n. When responder n receives the initial unicast frame sent by the initiator's ADV-POLL (or POLL) frame, responder n generates the local hash of the initiator's RPA_prand and IRK-IRn carried in the ADV-POLL (or POLL) frame as input to Formula 1. If the local hash matches the initiator's RPA_hash carried in the ADV-POLL (or POLL) frame, the responder will have verified the initiator's identity.

[0252] Similarly, for broadcast frames (i.e., frames for multiple responders, such as POLLs for one-to-many ranging, i.e., RIM frames), the initiator generates a unique pseudo-random number (RPA_prand-B-I) and uses the public broadcast IRK (IRK-B) to generate the initiator's RPA_hash (RPA_hash-B-I) using Equation 1, and includes RPA_hash-B-I and RPA_prand-B-I in the broadcast frame. When the responder receives the initial broadcast frame (e.g., a RIM frame) sent by the initiator, the responder generates the local hash of the initiator's RPA_prand carried in the frame and IRK-B as input to Equation 1. If the local hash matches the initiator's RPA_hash carried in the frame, the responder will have verified the initiator's identity.

[0253] Similarly, in its response frame, responder n includes its unique address field (e.g., ADV-RESP or RESP) generated using Formula 5 as its frame; the responder generates its RPA_hash (RPA_hash-R-n) using its unique paired IRK (IRK-RI1) and the initiator's RPA_prand (e.g., RPA_prand-I-n) from the previous initial frame. For example, responder 1 generates its own private address based on IRK-RI1, and responder 2 generates its own private address based on IRK-RI2 using Formula 5. Accordingly, the initiator verifies the identity of responder 1 based on IRK-RI1 and verifies the identity of responder 2 based on IRK-RI2. (See Specification 19 / 23, Page 25, CN 121336474 A)Identity. Based on the IRK used, the initiator can implicitly identify the responder (e.g., by mapping the IRK to the initiator record of the responder's public address). Another difference is that, since paired IRKs are used to generate private addresses in ADV-POLL and POLL frames (e.g., initiator RPA_hash), only the target responder (the responder with the correct IRK) can correctly verify the private address, and therefore only the target responder will respond to ADV-POLL or POLL frames with ADV-RESP or RESP frames respectively. Accordingly, SOR frames are also for one responder at a time. This allows the initiator to selectively select one or more responders to participate in MMS ranging.

[0254] For example, the format of the ADV-RESP (or RESP) frame in FIG15 can be as shown in FIG5 to FIG7, and the specific format of the ADV-RESP (or RESP) frame can be determined by the parameters used to generate the ADV-RESP (or RESP) frame. For example, if the private address carried in the ADV-RESP (or RESP) frame is generated using any of formulas 2 to 5, then the format of the ADV-RESP (or RESP) frame in Figure 15 can be as shown in Figure 5 or Figure 6. Alternatively, if the private address carried in the ADV-RESP (or RESP) frame is generated using formula 6, then the format of the ADV-RESP (or RESP) frame in Figure 15 can be as shown in Figure 7.

[0255] In the above examples using the public IRK shown in Figures 3 and 12 to 14, the initiator's ADV-POLL and POLL frames are not targeted at any specific responder, and any responder possessing the public IRK can verify the initiator's private address and respond to the ADV-POLL and POLL frames. However, sometimes the initiator may wish to select specific responders to participate in MMS ranging. Figure 17 shows such an example. The initiator can achieve this by including the identity of the target responder (e.g., an 8-octet extended 802.15 MAC address) and the ID of the compressed PSDU (e.g., ADV-POLL) in the calculation of the initiator's RPA_hash (e.g., RPA_hash_I-Rn, n = 1, 2, ...) of the responder n and truncating it to 24 bits using Formula 7: RPA_hash = AES-128-ECB(key=IRK, data=(0x000…[4] || ID || 8-octets extended 802.15 MAC address of responder n [8]|| RPA_prand-I)) % 2^24. Formula 7 For example, in the first ADV-POLL, the initiator includes the initiator's RPA_hash (RPA_...) in the ADV-POLL frame.The calculation of hash-I-R1-1 includes the extended 802.15 MAC address of responder 1. Even if both responder 1 and responder 2 receive the ADV-POLL frame, only responder 1 can verify the initiator's private address (RPA_hash-I-R1-1), therefore, only responder 1 responds with the ADV-RESP frame.

[0256] Similarly, responder n can also use the same formula 7 to generate its private address (RPA_hash-Rn) for use in the ADV-RESP and RESP frames. Although the same formula is used, including the ID field (e.g., ADV-RESP) ensures that the private addresses generated by the initiator and responder are different, and the initiator can verify whether the responder has a valid IRK. For example, responder 1 uses formula 7 to generate its private address and sends the ADV-RESP frame to the initiator, who then responds with an SOR frame to invite responder 1 to participate in one-to-one MMS ranging. Subsequently, the initiator sends another ADV-POLL to responder 2. If an ADV-RESP is received from responder 2, an SOR frame is sent to it, inviting responder 2 to join responder 1 in a one-to-many MMS ranging. It is assumed here that responder 1 continues the MMS ranging session in the next round / block. The RIM frame from the initiator assigns responder 1 and responder 2 to the first and second access slots of the one-to-many MMS ranging, respectively, by including the private addresses of responder 1 and responder 2 in the RIM frame, as previously described in FIG16.

[0257] It should be noted that the RPRT frame in the above embodiment may also carry the private address of the initiator and the private address of the responder.

[0258] It should also be noted that in a one-to-many MMS ranging session, the method for generating the private address of the responder, the method for verifying the identity of the responder, and other related content can refer to the above embodiment. They will not be repeated here.

[0259] This application provides a communication method that supports the initiator in determining whether the response frame is truly from the authorized responder. In particular, in one-to-many MMS ranging, the communication method enables the initiator to identify different responders without exposing the responder's identity. Furthermore, the security of compressed frames is also considered.

[0260] In conjunction with the above method embodiments, this application also provides related devices, which can be located in a controller or controlled terminal. The related devices can perform the steps of the above method embodiments.

[0261] FIG18 is a schematic block diagram of a communication device 2000 provided in an embodiment of this application. The communication device 2000 can perform the steps performed by the responder in the above embodiments. As shown in FIG18, the communication device 2000 includes: a receiving unit 2010, which uses...The system receives a first frame from the initiator for initiating the ranging process; a generation unit 2020 is used to generate a first private address based on the first frame and information related to the identity of the first responder, wherein the information related to the identity of the first responder is known to the initiator; a sending unit 2030 is used to send a second frame carrying the first private address to the initiator.

[0262] In one possible implementation, the information related to the identity of the first responder includes any one of the following: the public address of the first responder, the MMS ranging configuration requested by the first responder, a first random number generated by the first responder, or a unique IRK of the initiator and the first responder.

[0263] In one possible implementation, the first frame carries a second random number, which is associated with a second private address of the initiator; the generation unit 2020 is used to generate the first private address based on the second random number and the information related to the identity of the first responder.

[0264] In one possible implementation, the second private address is generated based on information related to the identity of the second responder, and the generation unit 2020 is configured to: generate the first private address when it is determined that the second responder and the first responder are the same responder.

[0265] In one possible implementation, the sending unit 2030 is configured to: send a second frame carrying the first private address and the first random number to the initiator.

[0266] In one possible implementation, the first frame is a RIM frame, the RIM frame carries a list associated with the responder, the responder is scheduled to participate in MMS ranging, and the responder includes the first responder; the generation unit 2020 is configured to: generate the first private address when it is determined based on the list that the first responder is scheduled to a first access time slot among multiple access time slots.

[0267] In one possible implementation, the second frame includes any one of the following frames: ADV-RESP frame, RESP frame, and RPRT frame.

[0268] In one possible implementation, the first frame or the second frame is a secure frame carrying encrypted information, the encrypted information being obtained based on a first nonce; the first nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for the transmission of the secure frame.

[0269] In one possible implementation, the first nonce includes frame counter information indicating the time period for the transmission of the secure frame.

[0270] In one possible implementation, the first nonce further includes block structure indication information, the block structure indicating...The information indicates whether the second frame is sent within or outside the block structure.

[0271] In one possible implementation, the second frame also carries the private address of the initiator.

[0272] In one possible implementation, the receiving unit 2010 is further configured to: receive a third frame carrying time offset information from the initiator, the time offset information indicating the time offset of the transmitted SOR frame.

[0273] FIG19 is a schematic block diagram of a communication device 2100 provided in an embodiment of this application. The communication device 2100 can perform the steps performed by the initiator in the above embodiments. As shown in Figure 19, the communication device 2100 includes: a receiving unit 2110, configured to receive a second frame carrying a first private address from a first responder, the first private address being associated with information, the information being associated with the identity of the first responder; a generating unit 2120, configured to generate a third private address based on information associated with the identity of the first responder; and a verification unit 2130, configured to verify the identity of the first responder by comparing the third private address and the first private address.

[0274] In one possible implementation, the information associated with the identity of the first responder includes any one of the following: the public address of the first responder, the MMS ranging configuration requested by the first responder, a first random number generated by the first responder, or a unique IRK of the initiator and the first responder.

[0275] In one possible implementation, the communication device further includes a sending unit, the sending unit being configured to: send a first frame for initiating a ranging process, the first frame carrying a second random number, and the second random number being associated with a second private address of the initiator; the generating unit 2120 being configured to: generate the third private address based on the second random number and the information related to the identity of the first responder.

[0276] In one possible implementation, the generating unit 2120 is further configured to: generate a fourth private address based on the information related to the identity of the second responder; the sending unit is further configured to: send a frame carrying the fourth private address to the second responder.

[0277] In one possible implementation, the second frame also carries the first random number, and the generating unit 2120 is configured to: generate the third private address based on the first random number.

[0278] In one possible implementation, the sending unit is further configured to: send a first frame for initiating a ranging process to the first responder, the first frame being a RIM frame, the RIM frame carrying a list associated with responders, the responders being scheduled to participate in MMS ranging, the responders including the first responder.

[0279] In one possible implementation, the second frame includes any one of the following frames: ADV-RESP frame, RESP frame, and RPRT frame.

[0280] In one possible implementation, the first frame or the second frame is a secure frame carrying encrypted information, the encrypted information being obtained based on a first Nonce; the first Nonce is associated with any one of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period for the transmission of the secure frame.

[0281] In one possible implementation, the first Nonce includes frame counter information indicating the time period for the transmission of the secure frame.

[0282] In one possible implementation, the first Nonce further includes block structure indication information indicating whether the second frame is sent within or outside a block structure.

[0283] In one possible implementation, the second frame also carries the private address of the initiator; the verification unit 2130 is further configured to: verify the identity of the first responder based on the private address of the initiator.

[0284] In one possible implementation, the sending unit is further configured to: send a third frame carrying time offset information to the first responder, the time offset information indicating the time offset of the sent SOR frame.

[0285] As shown in FIG20, the communication device 2200 may include a processor 2210, a transceiver 2220, and a memory 2230. The transceiver 2220 may be used to receive queries. The memory 2230 may be used to store code, instructions, etc., executed by the processor 2210.

[0286] In addition, the memory 2230 may also be used to store data corresponding to the generation and / or verification of private addresses, such as the pre-negotiated IRK between the initiator and the responder.

[0287] The memory 2230 may include random access memory, flash memory, read-only memory, programmable read-only memory, non-volatile memory, registers, etc. The processor 2210 may be a central processing unit (CPU).

[0288] Other functions and operations of the communication device 2200 can be found in the process of the embodiment described in the method specification of Figures 2, 3, 12 to 15, and 17, pages 22 / 23, CN 121336474 A. To avoid repetition, they will not be described again here.

[0289] Embodiments of this application also provide a communication system. The communication system includes a communication device 2000 and a communication device 2100, or the communication system includes a communication device 2200.

[0290] Embodiments of this application also provide a computer storage medium that can store program instructions to execute the steps in the above method.

[0291] Optionally, the storage medium may specifically be a memory 2230.

[0292] Embodiments of this application also provide a computer program product. The computer program product includes computer program code. When the computer program code is run on a computer, it causes the computer to perform the steps of the above-described method.

[0293] Optionally, all or part of the computer program code may be stored in a first storage medium. The first storage medium may be packaged together with the processor or packaged separately from the processor.

[0294] Embodiments of this application also provide a chip system, wherein the chip system includes an input / output interface, at least one processor, at least one memory, and a bus. At least one memory is used to store instructions, and at least one processor is used to call the instructions of at least one memory to perform the operation of the method in the above-described embodiments.

[0295] In embodiments of this application, "at least one" means one or more, and "multiple" means two or more. The term "and / or" describes the association relationship between associated objects, indicating that there may be three relationships. For example, A and / or B may represent the following three cases: only A exists, A and B exist simultaneously, and only B exists, wherein A and B may be singular or plural. The character " / " typically represents an "OR" relationship between associated objects. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of one or more items. For example, at least one of a, b, and c can represent: a, b, c; a and b; a and c; b and c; or a, b, and c, where a, b, and c can be singular or plural.

[0296] Those skilled in the art will understand that all or part of the processes of the methods in the embodiments can be implemented by a computer program instructing the relevant hardware. The program can be stored in a computer-readable storage medium. When the program runs, the processes of the methods in the embodiments are executed. The aforementioned storage medium may include: a disk, an optical disk, a read-only memory (ROM), or a random-access memory (RAM).

[0297] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the described apparatus embodiments are merely exemplary. For example, unit segmentation is merely a logical functional segmentation, and other segmentations may be used in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not performed. Additionally, the mutual coupling or direct coupling or communication connection shown or described can be implemented through some interface. Indirect coupling or communication connection between devices or units can be implemented electronically, mechanically, or otherwise.

[0298] Units described as separate components may or may not be physically separate, as shown as units...Components may or may not be physical units, and may be located in one place or distributed across multiple network units. Some or all units may be selected to achieve the purpose of the embodiment scheme according to actual needs.

[0299] In addition, the functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist physically separately, and two or more units may be integrated into one unit.

[0300] The above are merely exemplary embodiments of the present invention. Those skilled in the art can make various modifications and variations to the present invention without departing from the scope of the present invention. Instruction manual page 23 / 23, page 29, CN 121336474 A, Figure 1; Instruction manual figure 1 / 12 page 30, CN 121336474 A, Figure 2, Figure 3; Instruction manual figure 2 / 12 page 31, CN 121336474 A, Figure 4, Figure 5, Figure 6, Figure 7; Instruction manual figure 3 / 12 page 32, CN 121336474 A, Figure 8, Figure 9, Figure 10; Instruction manual figure 4 / 12 page 33, CN 121336474 A, Figure 11; Instruction manual figure 5 / 12 page 34, CN 121336474 A, Figure 12; Instruction manual figure 6 / 12 page 35, CN 121336474 A, Figure 13; Instruction manual figure 7 / 12 page 36, CN 121336474 A, Figure 14; Instruction manual figure 8 / 12 page 37, CN 121336474 A, Figure 15; Instruction manual figure 9 / 12 page 38, CN Figure 16 of the instruction manual, page 39 (10 / 12); Figure 17 of the instruction manual, page 40 (11 / 12); Figure 18, Figure 19, Figure 20 of the instruction manual, page 41 (12 / 12);

Claims

1. A communication method applied to a first responder, characterized in that, include: Receive the first frame from the initiator to initiate the ranging process; A first private address is generated based on the first frame and information related to the identity of the first responder. Send a second frame carrying the first private address to the initiator.

2. The communication method according to claim 1, characterized in that, The information related to the identity of the first responder includes any one of the following: the public address of the first responder, the multi-millisecond (MMS) ranging configuration requested by the first responder, the first random number generated by the first responder, or the unique identity resolving key (IRK) of the initiator and the first responder.

3. The communication method according to claim 2, characterized in that, The first frame carries a second random number, which is associated with the second private address of the initiator. The step of generating the first private address based on the first frame and information related to the identity of the first responder includes: The first private address is generated based on the second random number and the information related to the identity of the first responder.

4. The communication method according to claim 3, characterized in that, The second private address is generated based on information related to the identity of the second responder. Generating the first private address based on the first frame and the information related to the identity of the first responder includes: When it is determined that the second responder and the first responder are the same responder, the first private address is generated.

5. The communication method according to any one of claims 2 to 4, characterized in that, Sending the second frame carrying the first private address to the initiator includes: Send the second frame, carrying the first private address and the first random number, to the initiator.

6. The communication method according to any one of claims 1 to 5, characterized in that, The first frame is a ranging initialization message (RIM) frame, which carries a list of responders associated with each other and scheduled to participate in MMS ranging. The responders include the first responder. The step of generating the first private address using information related to the identity of the first responder includes: When it is determined from the list that the first responder is scheduled to the first access slot among multiple access slots, the first private address is generated.

7. The communication method according to any one of claims 1 to 6, characterized in that, The second frame includes any of the following: an announcement response (ADV-RESP) frame, a response (RESP) frame, or a report (RPRT) frame.

8. The communication method according to any one of claims 1 to 7, characterized in that, The first frame or the second frame is a secure frame carrying encrypted information, wherein the encrypted information is obtained based on a first nonce, which is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period used for the transmission of the secure frame.

9. The communication method according to claim 8, characterized in that, The first Nonce includes frame counter information, wherein the frame counter information indicates the time period for the transmission of the secure frame.

10. The communication method according to claim 8 or 9, characterized in that, The first nonce also includes block structure indication information, wherein the block structure indication information indicates whether the second frame is sent within or outside the block structure.

11. The communication method according to any one of claims 1 to 10, characterized in that, The second frame also carries the private address of the initiator.

12. The communication method according to any one of claims 1 to 11, characterized in that, The method further includes: The third frame carrying time offset information is received from the initiator, wherein the time offset information indicates the time offset of the sent start of ranging (SOR) frame.

13. A communication method applied to an initiator, characterized in that, include: Receive a second frame from the first responder carrying a first private address, wherein the first private address is associated with information related to the identity of the first responder; A third private address is generated based on the information related to the identity of the first responder; The identity of the first responder is verified by comparing the third private address with the first private address.

14. The communication method according to claim 13, characterized in that, The information related to the identity of the first responder includes any one of the following: the public address of the first responder, the multi-millisecond (MMS) ranging configuration requested by the first responder, the first random number generated by the first responder, or the unique identity resolving key (IRK) of the initiator and the first responder.

15. The communication method according to claim 14, characterized in that, The method further includes: A first frame for initiating the ranging process is sent, wherein the first frame carries a second random number and the second random number is associated with a second private address of the initiator; The step of generating a third private address based on the information related to the identity of the first responder includes: The third private address is generated based on the second random number and the information related to the identity of the first responder.

16. The communication method according to claim 15, characterized in that, The method further includes: A fourth private address is generated based on information related to the identity of the second responder; A frame carrying the fourth private address is sent to the second responder.

17. The communication method according to any one of claims 14 to 16, characterized in that, The second frame also carries the first random number, and the generation of the third private address based on the information related to the identity of the first responder includes: The third private address is generated based on the first random number.

18. The communication method according to any one of claims 13 to 17, characterized in that, The method further includes: A first frame for initiating the ranging process is sent to the first responder, wherein the first frame is a ranging initialization message (RIM) frame, the RIM frame carrying a list of responders associated with the responders scheduled to participate in MMS ranging, wherein the responders include the first responder.

19. The communication method according to any one of claims 13 to 18, characterized in that, The second frame includes any of the following: an announcement response (ADV-RESP) frame, a response (RESP) frame, or a report (RPRT) frame.

20. The communication method according to any one of claims 13 to 19, characterized in that, The first frame or the second frame is a secure frame carrying encrypted information, wherein the encrypted information is obtained based on a first nonce; wherein the first nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period used for the transmission of the secure frame.

21. The communication method according to claim 20, characterized in that, The first Nonce includes frame counter information, wherein the frame counter information indicates the time period for the transmission of the secure frame.

22. The communication method according to claim 20 or 21, characterized in that, The first nonce also includes block structure indication information, wherein the block structure indication information indicates whether the second frame is sent within or outside the block structure.

23. The communication method according to any one of claims 13 to 22, characterized in that, The second frame also carries the private address of the initiator; the method further includes: The identity of the first responder is verified based on the private address of the initiator.

24. The communication method according to any one of claims 13 to 23, characterized in that, The method further includes: A third frame carrying time offset information is sent to the first responder, wherein the time offset information indicates the time offset of the sent start of ranging (SOR) frame.

25. A communication device, characterized in that, include: The receiving unit is used to receive the first frame used to initiate the ranging process from the initiator. The generation unit is configured to generate a first private address based on the first frame and information related to the identity of the first responder; The sending unit is used to send a second frame carrying the first private address to the initiator.

26. The communication device according to claim 25, characterized in that, The information related to the identity of the first responder includes any one of the following: the public address of the first responder, the multi-millisecond (MMS) ranging configuration requested by the first responder, the first random number generated by the first responder, or the unique identity resolving key (IRK) of the initiator and the first responder.

27. The communication device according to claim 26, characterized in that, The first frame carries a second random number, which is associated with the initiator's second private address; the generation unit is used for: The first private address is generated based on the second random number and the information related to the identity of the first responder.

28. The communication device according to claim 27, characterized in that, The second private address is generated based on information related to the identity of the second responder, and the generation unit is used for: When it is determined that the second responder and the first responder are the same responder, the first private address is generated.

29. The communication device according to any one of claims 26 to 28, characterized in that, The sending unit is used for: Send the second frame, carrying the first private address and the first random number, to the initiator.

30. The communication device according to any one of claims 25 to 29, characterized in that, The first frame is a ranging initialization message (RIM) frame, which carries a list of responders associated with each other and scheduled to participate in MMS ranging. The responders include the first responder. The generation unit is used for: When it is determined from the list that the first responder is scheduled to the first access slot among multiple access slots, the first private address is generated.

31. The communication device according to any one of claims 25 to 30, characterized in that, The second frame includes any of the following: an announcement response (ADV-RESP) frame, a response (RESP) frame, or a report (RPRT) frame.

32. The communication device according to any one of claims 25 to 31, characterized in that, The first frame or the second frame is a secure frame carrying encrypted information, wherein the encrypted information is obtained based on a first nonce; wherein the first nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period used for the transmission of the secure frame.

33. The communication device according to claim 32, characterized in that, The first Nonce includes frame counter information, wherein the frame counter information indicates the time period for the transmission of the secure frame.

34. The communication device according to claim 32 or 33, characterized in that, The first nonce also includes block structure indication information, wherein the block structure indication information indicates whether the second frame is sent within or outside the block structure.

35. The communication device according to any one of claims 25 to 34, characterized in that, The second frame also carries the private address of the initiator.

36. The communication device according to any one of claims 25 to 35, characterized in that, The receiving unit is also used for: The third frame carrying time offset information is received from the initiator, wherein the time offset information indicates the time offset of the sent start of ranging (SOR) frame.

37. A communication device, characterized in that, include: A receiving unit is configured to receive a second frame carrying a first private address from a first responder, wherein the first private address is associated with information, and the information is associated with the identity of the first responder; A generation unit is configured to generate a third private address based on the information related to the identity of the first responder; The verification unit is used to verify the identity of the first responder by comparing the third private address with the first private address.

38. The communication device according to claim 37, characterized in that, The information related to the identity of the first responder includes any one of the following: the public address of the first responder, the multi-millisecond (MMS) ranging configuration requested by the first responder, the first random number generated by the first responder, or the unique identity resolving key (IRK) of the initiator and the first responder.

39. The communication device according to claim 38, characterized in that, The communication device further includes a transmitting unit, the transmitting unit being used for: A first frame for initiating the ranging process is sent, wherein the first frame carries a second random number and the second random number is associated with a second private address of the initiator; The generation unit is used for: The third private address is generated based on the second random number and the information related to the identity of the first responder.

40. The communication device according to claim 39, characterized in that, The generation unit is also used for: A fourth private address is generated based on information related to the identity of the second responder; The transmitting unit is further configured to: A frame carrying the fourth private address is sent to the second responder.

41. The communication device according to any one of claims 38 to 40, characterized in that, The second frame also carries the first random number, and the generation unit is used to: The third private address is generated based on the first random number.

42. The communication device according to any one of claims 37 to 41, characterized in that, The transmitting unit is further configured to: A first frame for initiating the ranging process is sent to the first responder, wherein the first frame is a ranging initialization message (RIM) frame, the RIM frame carrying a list of responders associated with the responders scheduled to participate in MMS ranging, wherein the responders include the first responder.

43. The communication device according to any one of claims 37 to 42, characterized in that, The second frame includes any one of the following: an announcement response (ADV-RESP) frame, a response (RESP) frame, and a report (RPRT) frame.

44. The communication device according to any one of claims 37 to 43, characterized in that, The first frame or the second frame is a secure frame carrying encrypted information, wherein the encrypted information is obtained based on a first nonce; wherein the first nonce is associated with any of the following: a private address carried by the secure frame, a random number used to generate the private address, or a time period used for the transmission of the secure frame.

45. The communication device according to claim 44, characterized in that, The first Nonce includes frame counter information, wherein the frame counter information indicates the time period for the transmission of the secure frame.

46. ​​The communication device according to claim 44 or 45, characterized in that, The first nonce also includes block structure indication information, wherein the block structure indication information indicates whether the second frame is sent within or outside the block structure.

47. The communication device according to any one of claims 37 to 46, characterized in that, The second frame also carries the private address of the initiator; the verification unit is further configured to: The identity of the first responder is verified based on the private address of the initiator.

48. The communication device according to any one of claims 37 to 47, characterized in that, The transmitting unit is further configured to: A third frame carrying time offset information is sent to the first responder, wherein the time offset information indicates the time offset of the sent start of ranging (SOR) frame.

49. A communication device, characterized in that, The device includes a processor and a memory, the processor being connected to the memory; wherein the memory is used to store instructions, and the processor is used to execute the instructions; when the processor executes the instructions stored in the memory, the processor performs the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 24.

50. A communication system, characterized in that, It includes the communication device according to any one of claims 25 to 36, and the communication device according to any one of claims 37 to 48.

51. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a processor, cause the processor to perform the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 24.

52. A computer program product, characterized in that, It includes computer program code that, when run on a computer, causes the computer to perform the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 24.

Images