Method and system for detecting and canceling attack signals

Abstract

The systems, methods, and devices described herein provide a method for detecting and canceling an attack signal during a ranging round, the method comprising: receiving a first message from a first device at a second device; transmitting a second message from the second device at the first device; receiving a third message from the first device at the second device; transmitting a fourth message from the second device at the first device; calculating a first time of flight at the second device based on a plurality of timestamps associated with the first, second, and third messages; and receiving a fifth message from the first device at the second device, the fifth message comprising a second time of flight calculated by the first device, or a ranging round invalidation message.

Description

Cross-reference of related applications

[0001] This application claims the interests of U.S. Provisional Patent Application No. 63 / 500,863 filed on 8 May 2023, U.S. Provisional Patent Application No. 63 / 515,702 filed on 26 July 2023, and U.S. Provisional Patent Application No. 63 / 619,072 filed on 9 January 2024, all of which are incorporated herein by reference. [Technical Field]

[0002] This disclosure relates to ultra-wideband (UWB) enabled devices, systems, and methods for detecting and canceling attack signals in ultra-wideband (UWB) signaling. [Background technology]

[0003] Ultra-wideband (UWB) is a radio technology that allows the use of very low energy levels for short-range, high-bandwidth communications across a wide portion of the radio spectrum. More specifically, UWB is a radio communication technology that typically uses a wide bandwidth of approximately 500 MHz or more, or has a 10 dB bandwidth of more than 20% of the center frequency, as defined, for example, in ITU-R SM.1755-0: "Characteristics of Ultra-Wideband Technologies," ITU (International Telecommunication Union), 2006. For example, UWB technology can be used for ranging, which is the process of determining the distance between two devices using UWB technology. UWB technology can also be used for short-range data trading. Today, UWB technology is used in a variety of applications involving short-range ranging and data trading, such as keyless car access.

[0004] UWB typically operates within an unlicensed spectrum, and devices must comply with relevant legal regulations, including transmit masks. Distancing rounds are often used to establish a wireless connection between two UWB devices. During a ranging session, the two UWB devices transmit signals to establish a connection between them.

[0005] In addition, IEEE 802.15.4z introduces the Scrambled Timestamp Sequence (STS) to enable secure ranging. The STS is a sequence of UWB pulses (positive and negative) generated by an AES-128 cryptographic generator from a 256-bit seed. Only a receiver that knows the seed can generate a valid Channel Impulse Response (CIR) and determine the timestamp of a received UWB frame. The received signal is a convolution of the CIR and the transmitted STS. The CIR is generated by correlating the received signal with the same STS. If the generated STS and the transmitted STS do not match, the correlator output becomes noise. Each peak in the CIR is a radio frequency (RF) path. The timestamp of an RF frame is the first pass (FP), i.e., the time of the first peak that exceeds a certain threshold.

[0006] In a secure ranging session, all participating devices exchange information to calculate the seed for each RF UWB frame involved in the ranging session. Only receivers that align that local seed with the seed of the transmitted STS pattern can contribute to the ranging procedure. Since the seed is confidential and not shared with other UWB devices, the timestamp is secure and is assumed not to be tampered with by an attack.

[0007] However, vulnerabilities have recently been identified in the aforementioned ranging framework. Therefore, improved systems and methods are needed to protect ranging sessions in order to address these security vulnerabilities. [Overview of the project]

[0008] In exemplary embodiments, the Disclosure relates to a method for detecting and canceling an attack signal during a ranging round. The method also includes receiving a first message from a first device at a second device. The method also includes transmitting a second message from the second device to the first device. The method also includes receiving a third message from the first device at the second device. The method also includes transmitting a fourth message from the second device to the first device. The method also includes calculating a first time of flight at the second device based on a plurality of timestamps associated with the first, second, and third messages. The method also includes receiving a fifth message from the first device at the second device, the fifth message including a second time of flight calculated by the first device, or a ranging round invalidation message.

[0009] In some embodiments, the implementation may include one or more of the following features: the method may include, in a second device, determining whether an attack was made against a first message, a second message, a third message, or a fourth message based on the difference between the first time flight and the second time flight; the fifth message may further include a fourth time flight; the fourth time flight is based on timestamps associated with the first and second messages; and the reception of the fifth message is via Bluetooth®; the method may also include, in a second device, determining the distance between the first device and the second device based on the first time flight, the second time flight, the third time flight, and the fourth time flight; and the transmission of messages is via UWB.

[0010] In exemplary embodiments, the Disclosure relates to a non-temporary machine-readable medium storing instructions, which includes receiving a first message from a first device at a second device. The non-temporary machine-readable medium storing instructions also includes transmitting a second message from the second device to the first device. The non-temporary machine-readable medium storing instructions also includes receiving a third message from the first device at the second device. The non-temporary machine-readable medium storing instructions also includes transmitting a fourth message from the second device to the first device. The non-temporary machine-readable medium storing instructions also includes calculating a first time of flight at the second device based on a plurality of timestamps associated with the first, second, and third messages. The non-temporary machine-readable medium storing instructions also includes receiving a fifth message from the first device at the second device, the fifth message including a second time of flight calculated by the first device, or a message invalidating the current ranging round.

[0011] In some embodiments, the implementation may include one or more of the following features: The non-temporary machine-readable medium, when executed by one or more processors, further stores instructions causing one or more processors to perform a determination in a second device based on the difference between the first time of flight and the second time of flight, regarding whether an attack was made against the first, second, third, or fourth message. The fifth message may further include the fourth time of flight, which is based on timestamps associated with the first and second messages. The fifth message is received by Bluetooth®. The non-temporary machine-readable medium, when executed by one or more processors, further stores instructions causing one or more processors to perform a determination in a second device based on the distance between the first and second devices, regarding the first time of flight, the second time of flight, the third time of flight, and the fourth time of flight. Message transmission is by UWB.

[0012] In exemplary embodiments, the Disclosure relates to a device. The device also includes a transceiver, non-temporary memory for storing instructions, and one or more hardware processors, the one or more hardware processors configured to execute instructions to cause the device to perform operations that may include receiving a first message from a first device, sending a second message from the device to the first device, receiving a third message from the first device, sending a fourth message from the device to the first device, calculating a first time of flight based on a plurality of timestamps associated with the first, second, and third messages, and receiving a fifth message from the first device, the fifth message including a second time of flight calculated by the first device, or a message invalidating the current ranging round.

[0013] In some embodiments, the implementation may include one or more of the following features: The device is configured to have one or more hardware processors execute instructions to cause the device to perform an operation, which may include determining whether an attack occurred with respect to a first message, a second message, a third message, or a fourth message based on the difference between a first time of flight and a second time of flight. One or more hardware processors are configured to have the device perform an operation, which may include calculating a third time of flight based on timestamps associated with the second and third messages, and a fifth message may further include a fourth time of flight. The fourth time of flight is based on timestamps associated with the first and second messages. One or more hardware processors are configured to have the device perform an operation, which may include determining the distance between a first device and another device based on the first time of flight, a second time of flight, a third time of flight, and a fourth time of flight. Message transmission is via UWB.

[0014] Those skilled in the art will understand the scope of the present disclosure and recognize its additional aspects after reading the following detailed description of the preferred embodiments in connection with the accompanying drawings.

Brief Description of the Drawings

[0015] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate some aspects of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0016] [Figure 1] Shows an attack scenario during UWB device communication. [Figure 2A] Shows exemplary authenticated signals and attack signals during a ranging session. [Figure 2B] Shows exemplary authenticated signals and attack signals during a ranging session. [Figure 3] Is a simplified diagram of a UWB device according to some aspects of the present disclosure. [Figure 4] Shows a signal transmission diagram in which a first UWB device communicates with a second UWB device during a ranging round according to some aspects of the present disclosure. [Figure 5] Shows a signal transmission diagram in which a first UWB device communicates with a second UWB device during a ranging round according to some aspects of the present disclosure. [Figure 6] Shows a signal transmission diagram in which a first UWB device communicates with a second UWB device during a ranging round according to some aspects of the present disclosure. [Figure 7] Shows a signal transmission diagram in which a first UWB device communicates with a second UWB device during a ranging round according to some aspects of the present disclosure. [Figure 8] Shows a signal transmission diagram in which a first UWB device communicates with a second UWB device during a ranging round according to some aspects of the present disclosure. [Figure 9] Shows an exemplary method for attack detection and / or cancellation by a UWB device according to some aspects of the present disclosure. [Modes for carrying out the invention]

[0017] The embodiments described below represent the information necessary to enable a person skilled in the art to practice the embodiments and illustrate the best mode of practicing the embodiments. After reading the following description in reference to the accompanying drawings, a person skilled in the art will understand the concepts of this disclosure and recognize the applications of these concepts not specifically described herein. Naturally, these concepts and their applications are included in the scope of this disclosure and the accompanying claims.

[0018] In this specification, various elements may be described using terms such as first, second, etc., but it will be understood that these elements should not be limited by these terms. These terms are used solely to distinguish one element from another. For example, without departing from the scope of this disclosure, the first element may be called the second element, and similarly, the second element may be called the first element. The term "and / or" as used herein includes all combinations of one or more of the related enumerated items.

[0019] The terms used herein are for the purpose of describing specific embodiments and are not intended to limit the disclosure. Where used herein, the singular forms “a,” “an,” and “the” are intended to include the plural form unless otherwise clearly indicated by the context. Where used herein, the terms “comprises,” “comprising,” “includes,” and / or “including” identify the presence of a described feature, integer, process, operation, element, and / or component, but do not preclude the presence or addition of one or more other features, integers, processes, operations, elements, and / or groups thereof.

[0020] Unless otherwise defined, all terms used herein (including technical and academic terms) have the same meaning as those generally understood by those skilled in the art to which this disclosure belongs. Furthermore, terms used herein should be interpreted as having the meaning consistent with their meaning in the context of this specification and related art, and it will be understood that they should not be interpreted in an idealized or overly formal sense unless expressly defined herein. In addition, similar reference numerals indicate similar characteristics throughout this specification and the drawings.

[0021] Naturally, each block in a signaling diagram or flowchart, and combinations of signaling diagrams or flowcharts, may be implemented by computer program instructions. Since computer program instructions can be equipped on the processor of a general-purpose computer, a special-use computer, or other programmable data processing device, instructions executed via the processor of a computer or other programmable data processing device generate means for performing the functions described in relation to each block of a signaling diagram or flowchart. Since computer program instructions can be stored in computer-available or computer-readable memory that is directed to a computer or other programmable data processing device and can implement functions in a specified manner, instructions stored in computer-available or computer-readable memory can produce a product that includes instructions for performing the functions described in relation to each block of a signaling diagram or flowchart. Since computer program instructions can be equipped on a computer or other programmable data processing device, instructions that generate a process executed by a computer as a series of operational steps may be executed by a computer or other programmable data processing device, and instructions that operate a computer or other programmable data processing device may provide steps for performing the functions described in relation to each block of a signaling diagram or flowchart.

[0022] Each block may represent a module, segment, or portion of code containing one or more executable instructions for performing a specified logical function. Furthermore, note that in some interchangeable execution examples, the functions mentioned in a block may occur in different orders. For example, two consecutively presented blocks may be executed substantially simultaneously or in reverse order, depending on their corresponding functions.

[0023] Embodiments are described in detail below with reference to the accompanying drawings. Furthermore, while a communication system using ultra-wideband (UWB) is described as an example in relation to the embodiments, the embodiments may also be applicable to other communication systems having a similar technical background or features. For example, communication systems using Bluetooth® or ZigBee® may be included therein. Furthermore, embodiments may be modified so as not to significantly deviate from the scope of the disclosure as determined by those skilled in the art, and such modifications may be applicable to other communication systems.

[0024] UWB can refer to a short-range, high-speed wireless communication technique that uses a wide frequency band of several GHz or more, low spectral density, and short pulse width (e.g., 1 nsec to 4 nsec) in the baseband state. UWB can also refer to the bandwidth itself to which UWB communication is applied. UWB can enable a secure and accurate range between devices. Thus, UWB enables relative position estimation based on the distance between two devices, or accurate position estimation of a device based on its distance from a fixed device (whose position is known and is also called an anchor device). This disclosure assumes that a reference device can communicate via UWB (referred to as a “UWB-enabled user device”, UWB device, user device, or simply device).

[0025] References to “distancing round” or “distancing session” should be understood to include, but not limited to, other session types, including, but not limited to, ranging, competition-based ranging, and data sessions. In this disclosure, the terms “initiator” and “responder” may take their definitions from the FiRa specification, but are not limited to the FiRa specification protocol. In some cases, the selection of initiator and responder is arranged using Bluetooth® or other means before the ranging round or session begins. Those skilled in the art will understand that the descriptions herein using these and other terms are applicable to other ranging-based protocols. In some cases, a responder may also be called an access system.Furthermore, the following abbreviations may be used throughout: "CCC": Car Connectivity Consortium, "BLE": Bluetooth® Low Energy, "DM": Data Message, "SS-TWR": Single-Sided Two-Way Ranging, "DS-TWR": Double-Sided Two-Way Ranging, "RIM": Ranging Initiation Message, "RRM": Ranging Response Message, "RRRM": Ranging Result Report Message, "RFM": Ranging Final Message, "CRUM T2": Control Ranging Update Message Type 2, "RCM T3": Ranging Control Message Type 3, "SIM": Scheduling Information Message (scheduling information message), "FP": First Path, "CAP": Contention-Access Period, "CFP": Contention-Free Period.

[0026] During a ranging session, multiple UWB-enabled devices attempt to send messages and establish communication between them. The session may contain multiple messages sent and received by UWB-enabled devices. During a ranging session, an attack signal may be sent by an unauthorized user / device. The attack signal may lead another device on the access system to believe that an authorized user is within a given security bubble (i.e., within a certain distance from the access system, such as a car or house), thereby granting the access system early access. This poses a significant security risk.

[0027] Past attempts to address these security risks have been application-dependent and have delayed decision-making that is the intended outcome of the ranging session (e.g., lock / unlock decisions).

[0028] Therefore, it is beneficial to have systems and methods that have the ability to detect and / or cancel attack signals. For example, by comparing various time-of-flight measurements and calculations, two or more devices may be able to determine that an attack occurred in one of the messages during a ranging round. In some cases, once an attack is detected, it may be possible to compensate for the attack. Because the impact of the attack may reduce the distance calculation between two devices, one or more devices may be able to calculate the true distance.

[0029] Embodiments of this disclosure provide a system and method for detecting an attack during a ranging session using two interleaved DS-TWR ranging flows.

[0030] Embodiments of this disclosure provide a system and method for detecting an attack during a range session using a DS-TWR ranging flow, a fourth message, and time-of-flight calculations for two independent SS-TWR ranging flows.

[0031] Embodiments of this disclosure provide a system and method for exchanging information between two UWB devices to enable attack detection, including invalidation notifications based on discrepancies in time-of-flight measurements.

[0032] Embodiments of this disclosure provide a system and method for canceling an attack using the difference in time-of-flight measurements from two DS-TWR flows.

[0033] Embodiments of this disclosure provide a system and method for canceling an attack using the difference in time-of-flight measurements from two SS-TWR flows.

[0034] The disclosed system and method can be easily improved in several ways. For example, with a high probability, the system and method can detect and cancel many attacks that would otherwise alter the measured distance.

[0035] In addition, the disclosed systems and methods improve the security of device-to-device transactions without requiring application-dependent, proprietary physical measures. In some cases, the disclosed systems and methods, when combined with proprietary mechanisms, can support a very high level of security. Furthermore, the disclosed systems and methods can detect sophisticated attacks, such as attacks against both STS patterns and Ipatov preambles. As a result, users may be able to use UUWB technology with greater confidence in transactions, communications, and security / access procedures and systems (e.g., unlocking a car door or a house, or automatically completing a payment after leaving a store, which is identified by the user's primary device, such as a mobile device, entering a certain distance from the store's payment system). Moreover, the systems and methods do not require significant additional power, resources, or time costs.

[0036] Figure 1 shows an attack scenario during UWB device communication. In attack scenario 100, a first UWB device 120 and a second UWB device 130 may be participating in a ranging session. In some embodiments, devices 120 and 130 may also be communicating via Bluetooth®. During the ranging session, attacker 110 may transmit an attack signal 112. Device 120 may be a telephone, and device 130 may be an associated subcomponent of a vehicle. In some cases, as an effect of communication between devices 120 and 130, it is determined when device 120 is within a security zone 135 surrounding device 130. In some cases, the security zone 135 may define a threshold distance beyond which device 130 will not be allowed access (e.g., the car doors will not unlock).

[0037] Attack 112 has the effect of making device 130 mistakenly believe that device 120 is located within the security zone at a false location 145, rather than at its true location 140. Because attack 112 makes device 130 believe that device 120 is within the security zone, device 130 may bypass security protections and allow attacker 110 to gain access.

[0038] Figures 2A and 2B show exemplary legitimate and attack signals during a ranging session. A portion of the frame of the legitimate signal 205 is shown. The attack signal 210, also known as a ghost peak attack, is a sequence of strong, random UWB pulses. The STS pattern of the legitimate signal is overlaid with the attack signal. Figure 2B shows graphs of the overlaid channel impulse response associated with the legitimate signal 225 and the channel impulse response associated with the attack signal 220, with axis 230 representing signal intensity and axis 235 representing time. The attack signal is not structured or constructed based on knowledge of the seed that generates the STS. Because this attack signal is not generated from the expected seed, it introduces noise. If the noise peak is strong enough to exceed the detection threshold, it may be interpreted as an RF wave in a multipath channel. And if this peak occurs before the actual RF first pass (FP), the timestamp of the UWB ranging frame is corrected. In the figure, the noise peak appears before the actual FP, which is interpreted as an FP, resulting in a distance reduction of 240.

[0039] Figure 3 is a simplified diagram of the UWB device 300. One or more UWB devices 300 may exist in the scenarios depicted in and relating to Figures 1-2 and 4-8, according to one embodiment described herein. As shown in Figure 3, the UWB device 300 includes a processor 310 coupled to memory 320. The operation of the UWB device 300 is controlled by the processor 310. Although the UWB device 300 is shown as having only one processor 310, it is understood that the processor 310 may represent one or more central processing units, multicore processors, microprocessors, microcontrollers, digital signal processors, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), graphics processing units (GPUs), and / or similar within the UWB device 300. The UWB device 300 may be implemented as a standalone subsystem, as a board added to a computing device, and / or as a virtual machine, partially or entirely.

[0040] Memory 320 may be used to store software executed by one or more data structures used during the operation of the UWB device 300 and / or UWB device 300. Memory 320 may include one or more types of machine-readable media. Some common forms of machine-readable media may include floppy disks, flexible disks, hard disks, magnetic tapes, any other magnetic media, CD-ROMs, any other optical media, punch cards, paper tapes, any other physical media having a pattern of holes, RAM, PROMs, EPROMs, FLASH®-EPROMs, any other memory chips or cartridges, and / or any other media adapted to be read by a processor or computer.

[0041] The processor 310 and / or memory 320 can be located in any suitable physical arrangement. In some embodiments, the processor 310 and / or memory 320 may be mounted on the same board, in the same package (e.g., system-in-package), on the same chip (e.g., system-on-a-chip), and / or similar. In some embodiments, the processor 310 and / or memory 320 may include distributed, virtualized, and / or containerized computing resources. In accordance with these embodiments, the processor 310 and / or memory 320 may be located in one or more data centers and / or cloud computing facilities.

[0042] In some embodiments, the memory 320 may include a non-temporary, tangible, machine-readable medium, the non-temporary, tangible, machine-readable medium, which includes executable code, which, when executed by one or more processors (e.g., processor 310), can cause one or more processors to implement methods further described herein. For example, as shown, the memory 320 includes instructions for a session module 330, which may be used to implement and / or mimic a system and model, and / or implement any of the methods described herein. The session module 330 may receive an input signal 340 via a transceiver 315 and generate an output signal 350, which may be a response to a message contained within the input signal 340. Examples of input signals may include messages and transmissions from a UWB different from those shown in Figure 3. The input signals may be structured in frames, for example, in the form described in the FiRa standard. Examples of output signals may include transmissions by a UWB device 300 in response to a received message, and transmissions of messages to initiate a ranging session.

[0043] The transceiver 315 may include a transmitter and / or receiver, an antenna, or any other means of transmitting and / or receiving in UWB. For example, a UWB device 300 may receive an input signal 340 (such as an initial ranging message) from another UWB device via the transceiver 315.

[0044] In some embodiments, the session module 330 is configured to control the content and timing of the output signal 350. The session module 330 may further include a detection submodule 331 (e.g., an instruction for calculating time of flight as described herein) and / or a cancellation submodule 332 (e.g., an instruction for correcting the estimated distance between two UWB devices when an attack is detected).

[0045] Some embodiments of a UWB device, such as UWB device 300, may include a non-temporary, tangible, machine-readable medium, which may include executable code, which, when executed by one or more processors (e.g., processor 310), may cause one or more processors to carry out the process of the Method. Some common forms of machine-readable media that may include the process of the Method are, for example, floppy disks, flexible disks, hard disks, magnetic tapes, any other magnetic media, CD-ROMs, any other optical media, punch cards, paper tapes, any other physical media having a pattern of holes, RAM, PROMs, EPROMs, FLASH®-EPROMs, any other memory chips or cartridges, and / or any other media adapted to be read by a processor or computer.

[0046] Figure 4 shows a signal transduction diagram in which a first UWB device 402 communicates with a second UWB device 404 during a session, according to some aspects of the present disclosure. In some embodiments, UWB device 1 402 acts as an initiator, while UWB device 2 404 acts as a responder with respect to DS-TWR session 405. Session 400 describes DS-TWR session 405, which can also be seen as two SS-TWR sessions 415, 420, where UWB device 1 402 and UWB device 2 404 have opposite roles in each of the two SS-TWR sessions. DS-TWR session 405 consists of messages 422, 424, and 426. The first SS-TWR session 415 consists of messages 422 and 424, and the second SS-TWR session 420 consists of messages 424 and 426. Session 400 may also include a ranging control message (RCM) 410. Time of flight (TOF) can be calculated for each of the TWR sessions, namely 405, 415, and 420. The DS-TWR TOF can be calculated as follows:

[0047]

number

[0048] Where, T ROUND1 is the time elapsed from when the UWB device 1 transmits RIM422 until it receives RRM424, and T ROUND2 is the time elapsed from when the UWB device 2 transmits RRM424 until it receives RFM426, and T reply1 is the time elapsed from when the UWB device 2 404 receives RIM422 until it transmits RRM424, and T reply2 is the time elapsed from when the UWB device 1 402 receives RRM424 until it transmits RFM426. Further, the SS-TWR TOF can be calculated as follows.

[0049]

Equation

[0050] In some embodiments, TOF ss―TWR1 and TOF ss―TWR2 are less accurate than TOF DS―TWR due to the clock frequency offset between the UWB device 1 and the UWB device 2. In some examples, the UWB device 2 can calculate all three TOFs because it has all the necessary timestamps (received locally or at MRM428). Therefore, in some cases, the UWB device 2 can perform TOF calculation 430 using the available data. Without an attack on the STS pattern, these three TOFs (for each of the TWRs 405, 415, and 420) should match.

[0051] During session 400, an attack such as that described with respect to FIGS. 1-2 can affect one of the messages such as RIM422, RRM424, or RFM426. If the attacker successfully shifts the timestamp of RIM 422 by dt, then TOF ss―TWR1 is tampered with by dt / 2, TOF ss―TWR2 is not affected, and TOFDS―TWR Only dt / 4 is changed. Therefore, provided the magnitude of the tampering is greater than the precision, UWB device 2 can easily detect such attacks by calculating and comparing three TOF values.

[0052] In some configurations, with a 1ms distance measurement slot, the accuracy is 1ms*ε CFO and ε CFO This is the residual clock frequency offset after compensation. If the CFO compensation is better than 1 ppm, the accuracy of the SS-TWR will be better than 1 ns. As an example, let's assume that an attack that falsifies the distance measurement by more than 2 m, i.e., a 3 ns TOF falsification, is detected. Under these assumptions, TOF ss―TWR1 TOF DS―TWR , and TOF ss―TWR2 The difference between them is greater than the accuracy. Therefore, a ghost peak attack can be detected. A similar conclusion can be drawn for an attack against RFM426. However, if the attack signal succeeds in changing the timestamp of RRM by an amount of dt, all three TOFs will be changed by dt / 2. If there is no difference in TOFs, the attack cannot be detected. In this sense, the response message RRM is called a weak message in DS-TWR because the attack cannot be detected by the countermeasures described above with respect to Figure 4. In some embodiments, the systems and methods provided herein solve this problem.

[0053] Figure 5 shows a signal transduction diagram in which a first UWB device communicates with a second UWB device during a session, according to some aspects of the present disclosure. In some aspects, session 500 includes two interleaved DS-TWR ranging sessions, DS-TWR1 515 and DS-TWR2 520. In some embodiments, for DS-TWR1 515, UWB device 1 502 may act as the initiator while UWB device 2 504 may act as the responder, and for DS-TWR2 520, UWB device 1 502 may act as the responder while UWB device 2 504 may act as the initiator. DS-TWR1 session 515 includes messages RIM522, RRM524, and RFM526. DS-TWR2 session 520 includes messages RRM524, RFM526, and RFM2 530. In some embodiments, RFM2 530 functions as a fourth ranging frame. In addition to the messages contained in DS-TWR sessions 515 and 520, session 500 may also include RCM510, MRM528, MRM2 532, and RRRM538.

[0054] The MRM 528 transmits the timestamp of UWB device 1 to UWB device 2 so that it can calculate its own TOF 536. DS-TWR2 consists of an RRM (used as the start message for this DS-TWR), an RFM (used as the response message), and a fourth ranging message as RFM Type 2. UWB device 2 transmits its timestamp to UWB device 1 via MRM2 532, and the initiator calculates its own TOF 534. In some cases, these two additional messages are announced by the initiator of RCM 510.

[0055] UWB device 2 calculates its TOF 536 from DS-TWR1 515. If it detects an attack on RIM522 or RFM526, it notifies the upper layer about the attack. UWB device 1 calculates its TOF 534 from DS-TWR2 520. The TOF of DS-TWR2 can be given by the following formula.

[0056]

number

[0057] In DS-TWR2 520, UWB device 1 performs the same type of checks on the two SS-TWRs (the first SS-TWR consists of RRM 524 and RFM 526, and the second SS-TWR consists of RFM 526 and RFM2 530) as described in Figure 4. In DS-TWR2 520, RRM524 acts as the initiation message, and RFM526 acts as the response message for the weak message. Therefore, UWB device 1 can detect any attacks on this RRM524, which is the weak message of DS-TWR1 515, and if it detects that RRM524 or RFM2 530 has been attacked, it stops all TOF calculations. Thus, by combining both interleaved DS-TWRs, any attack on any ranging message can be detected.

[0058] The roles of messages in the two DS-TWR ranging methods discussed above are summarized and shown in Table 1 below.

[0059] [Table 1]

[0060] In the final stage, UWB device 1 may send a distance measurement report result message (RRRM538). In some cases, RRRM538 includes a TOF534 calculated by UWB device 1. If UWB device 1 detects an attack on the RRM, it may set the TOF to a value indicating the attack, or it may send the calculated TOF value.

[0061] UWB device 2, potentially acting as an access system, may make a final determination of whether an attack has occurred by comparing the TOF. The local TOF536 and TOF534 values ​​transmitted by UWB device 1 (e.g., RRRM538) should match fairly well, as they are DS-TWR TOF, which are very accurate TOFs.

[0062] For example, suppose a ghost peak attack shifts the arrival time of a ranging frame by dt, and a successful ghost peak attack is defined as an arrival time shift of dt > 2ns (corresponding to a distance of 60cm). The DS-TWR TOF is tampered with by dt / 4 or dt / 2, i.e., 15cm or 30cm, as shown in the table below. A ghost peak attack is detected if the TOF difference is higher than the typical DS-TWR accuracy. Typical DS-TWR accuracy is better than 0.5ns (corresponding to 15cm). The TOF difference is at least dt / 4 > 0.5ns, which is higher than the DS-TWR accuracy. Therefore, a ghost peak attack is detected.

[0063] Alternatively, UWB device 1 may not need to transmit RRRM538, and instead, if it detects an attack on RRM524, it may use an out-of-band channel to send an alert to UWB device 2. In such a situation, UWB device 2 will reject the reported distance measurement.

[0064] [Table 2]

[0065] Table 2 lists the various impacts on Time-of-Flight (TOF) caused by attacks on each message in two DS-TWR sessions.

[0066] Figure 6 shows a signaling diagram in which a first UWB device communicates with a second UWB device during a ranging round, according to some aspects of the present disclosure. In some aspects, session 600 includes two interleaved DS-TWR ranging sessions, DS-TWR1 615 and DS-TWR2 620. In some embodiments, for DS-TWR1 615, UWB device 1 602 may act as the initiator while UWB device 2 604 may act as the responder, and for DS-TWR2 620, UWB device 1 602 may act as the responder while UWB device 2 604 may act as the initiator. DS-TWR1 session 615 includes messages RIM622, RRM624, and RFM626. DS-TWR2 session 620 includes messages RRM624, RFM626, and RFM2 630. In some embodiments, RFM2 630 functions as a fourth ranging frame. In addition to the messages included in DS-TWR sessions 615 and 620, session 600 may also include RRRM636.

[0067] In some embodiments, the interleaved DS-TWR sessions 615 and 620 of session 600 may be conducted in non-deferred mode, i.e., with SP1 frames carrying measurement report messages (i.e., similar to MRM528 and MRM2 532 shown in Figure 5) in RFM626 and RFM2 630, and SP1 frames carrying control messages (e.g., similar to RCM510 in Figure 5) in RIM622. RFM2 630 is indeed the final ranging message frame, but differs in that it is transmitted by UWB device 2. The payload of MRM2 is also similar to MRM, except that the reference time is different. In the current MRM, the time reference is the timestamp of the RIM on UWB device 1, whereas it is the timestamp of the RRM on UWB device 2. UWB device 1 still calculates TOF632 based on information delivered in information or messages specific to each device, and UWB device 2 similarly calculates TOF634.

[0068] Figure 7 shows a signaling diagram in which a first UWB device communicates with a second UWB device during a ranging round, according to some aspects of the present disclosure. In some aspects, session 700 includes two SS-TWR ranging sessions, SS-TWR1 715 and SS-TWR2 720, as well as a DS-TWR ranging session 725. In some embodiments, for both SS-TWR1 715 and SS-TWR2 720, UWB device 1 702 may act as the initiator, while UWB device 2 704 may act as the responder. SS-TWR1 session 715 includes messages RIM722 and RRM724. SS-TWR2 session 720 includes messages RFM726 and RFM2 730. In some embodiments, for DS-TWR725, UWB device 1 702 may operate as an initiator and UWB device 2 04 may operate as a responder. DS-TWR session 725 includes messages RIM722, RRM724, and RFM726. In some embodiments, RFM2 730 functions as a fourth ranging frame. In addition to the messages included in SS-TWR sessions 715 and 720, session 700 may also include in-band or out-of-band notices 736.

[0069] In session 700, a fourth ranging message is added (i.e., RFM2 730), but the second DS-TWR is not created. UWB device 1 702 acts as the initiator for the two SS-TWRs. In this flow, UWB device 2 704 is T in RRM 724. reply1 It sends this, but in the standard DS-TWR flow, it is not sent in RRM724. Then, UWB device 1702 can calculate the first SS-TWR TOF732 according to the following formula.

[0070]

number

[0071] UWB device 2704 is Treply3 Using the MRM2 information including the above, the fourth ranging message, RFM2 730, is transmitted, and thereafter, the UWB device 1 can calculate the second SS-TWR TOF 732 according to the following formula.

[0072]

number

[0073] If the TOF values ​​of each SS-TWR 715 and 720 do not match and the error exceeds the expected accuracy, UWB device 1 invalidates the TOF 734 calculated for the DS-TWR session 725 on the UWB device 2 side via an in-band or out-of-band message 736. The TOF calculation 734 for DS-TWR 725 may be performed according to Equation 1.

[0074] If the attack is successful, the location of the fake first pass is random, and the probability of two consecutive fake first passes matching within 1 ns is very low.

[0075] Figure 8 shows a signaling diagram in which a first UWB device communicates with a second UWB device during a ranging round, according to some aspects of the present disclosure. In some aspects, session 800 includes two interleaved DS-TWR ranging sessions, DS-TWR1 810 and DS-TWR2 815, and two interleaved SS-TWR ranging sessions, SS-TWR1 835 and SS-TWR2 840. In some embodiments, for DS-TWR1 810, UWB device 1 802 may operate as an initiator while UWB device 2 804 operates as a responder; for DS-TWR2 815, UWB device 1 802 may operate as a responder while UWB device 2 804 operates as an initiator; for SS-TWR1 835, UWB device 1 802 may operate as an initiator while UWB device 2 804 operates as a responder; and for SS-TWR2 840, UWB device 1 802 may operate as a responder while UWB device 2 804 operates as an initiator. A DS-TWR1 session 810 includes messages RIM820, RRM822, and RFM824. DS-TWR2 session 815 includes messages RRM822, RFM824, and RFM2 826. SS-TWR1 session 835 includes messages RIM820 and RRM822. SS-TWR2 session 840 includes messages RRM822 and RFM824. In some embodiments, RFM2 826 functions as a fourth ranging frame. In addition to the messages included in DS-TWR sessions 810, 815 and SS-TWR sessions 835, 840, session 800 may also include RRRM828.

[0076] In some embodiments, the interleaved DS-TWR sessions 810, 815, and SS-TWR sessions 835, 840 of session 800 may be conducted in non-delay mode, i.e., in SP1 frames carrying measurement report messages (i.e., similar to MRM528 and MRM2 532 shown in Figure 5) in RIM824 or RFM2 826, and control messages (e.g., RCM510 in Figure 5) in RIM820. RFM2 826 is indeed the final ranging message frame, but differs in that it is transmitted by UWB device 2. The payload of MRM2 is also similar to MRM, except that the reference time is different. In the current MRM, the time reference is the timestamp of the RIM on UWB device 1, whereas it is the timestamp of the RRM on UWB device 2. UWB device 1 still calculates TOF832 based on information delivered in information or messages specific to each device, and UWB device 2 similarly calculates TOF834.

[0077] Here, we will discuss attack cancellation with respect to Figure 8. However, those skilled in the art will understand that the description of attack cancellation is also applicable to other ranging sessions described herein.

[0078] D ds =TOF(DS-TWR2)-TOF(DS-TWR1). D ds If the accuracy is higher than the DS-TWR accuracy, session 800 is under attack. As shown in Table 2, D ds If >0, the attack occurs against either RIM820 or RRM822. If the attack occurs on RIM, the TOF 834 measured by UWB device 2 804 on DS-TWR1 810 is +dt / 4 = D ds It shall be compensated by: If an attack occurs in RRM822, the TOF 834 measured by UWB device 2 804 in DS-TWR1 810 shall be compensated by +dt / 2.

[0079] As shown in Table 2,Dds If <0, the attack occurs against either RFM824 or RFM2 826. If the attack occurs against RFM 824, the TOF 834 measured by DS-TWR1 810 via UWB device 2 804 shall be compensated by +dt / 4. If the attack occurs against RFM2 828, the TOF 834 measured by UWB device 2 804 via DS-TWR1 810 shall be unaffected.

[0080] Dds If >0, UWB device 2 804 determines whether RIM820 or RRM822 is under attack and what compensation (D for each) will be awarded. ds It is necessary to determine whether to apply 2Dds. For that purpose, DS-TWR1 810 may be split into two SS-TWR835, 840. ss This is the TOF difference between the two SS-TWR835 and 840. As shown in Figure 4 and described herein, if RRM822 is attacked, D ss If RRM820 is attacked, the value is not zero. Therefore, UWB device 2804 can determine if RRM822 has been attacked and cancel the attack by compensating for the measured distance. True distance = Measured distance + |2 Dds |.

[0081] Similarly, Dds If <0, UWB device 2 804 determines whether RFM 824 or RFM2 826 is under attack and, as a result, what compensation (|D ds It is necessary to determine whether to apply | or none). DS-TWR2 may similarly be split into two SS-TWR sessions, and the similar analysis described above will reveal which of the two messages, RFM824 or RFM2826, was attacked. The difference D of the TOF measurements of these two SS-TWR sessions. ss The value is not 0 if RFM824 is attacked, and D if RFM2826 is attacked. ss = 0

[0082] This information can be used to determine which ranging frames have been attacked and the compensation needed to cancel the attack.

[0083] [Table 3]

[0084] Figure 9 illustrates an exemplary method for attack detection and / or cancellation by a UWB device according to certain aspects of the present disclosure. Method 900 is merely an example and is not intended to limit the present disclosure beyond what is expressly enumerated in the claims. Additional operations may be provided before, during, and after Method 900, and some of the operations described may be replaced, excluded, or moved for additional embodiments shown in Figures 3–8. For ease of illustration, Figure 9 is described in relation to Figures 1–8. In some embodiments, Method 900 may be implemented by a device, such as UWB device 300 as shown in Figure 3, or any of the UWB devices described herein.

[0085] In step 902, the second device (e.g., UWB device 2 804 in Figure 8) receives the first message (e.g., RIM 820 in Figure 8) from the first device (e.g., UWB device 1 802 in Figure 8). In some embodiments, data is transmitted and received via UWB.

[0086] In step 904, the second device sends a second message (e.g., RRM822 in Figure 8) to the first device. In some embodiments, data is transmitted and received via UWB.

[0087] In step 906, the second device receives a third message (e.g., RFM824 in Figure 8) from the first device. In some embodiments, data is transmitted and received via UWB.

[0088] In step 908, the second device sends a fourth message (e.g., RFM2 826 in Figure 8) to the first device. In some embodiments, data is transmitted and received via UWB.

[0089] In step 910, the second device calculates the first time of flight (e.g., the TOF of DS-TWR1 810 as described herein) based on multiple timestamps associated with the first message, the second message, and the third message (e.g., the message including DS-TWR1 810 in Figure 8).

[0090] In step 912, the second device receives a fifth message from the first device (e.g., RRRM828 in Figure 8), the fifth message containing a second time of flight calculated by the first device (e.g., TOF for DS-TWR2815 as described herein).

[0091] In some embodiments, the second flight time may be received via Bluetooth® or other out-of-band modes. In some embodiments, data is transmitted and received via UWB.

[0092] In step 914, the second device determines, based on the difference between the first flight time and the second flight time, whether an attack (for example, as shown and described with respect to Figures 1-2 and listed in Table 3) has occurred in the first, second, third, or fourth message.

[0093] In step 916, the second device calculates the third time of flight (e.g., the TOF of SS-TWR2 840 as described herein) based on the timestamps associated with the second and third messages. In some embodiments, the fifth message may include the fourth time of flight (e.g., the TOF of SS-TWR1 835 as described herein).

[0094] In step 918, the second device determines the distance between the first and second devices (e.g., listed in Table 3 and referred to herein as the “true distance”) based on the first, second, third, and fourth flight times. In some embodiments, the second device may compare the distance between the first and second devices to a threshold distance (e.g., a security zone as described herein). In some embodiments, if the distance between the first and second devices is greater than the threshold distance, the second device may deny access to the first device. In some embodiments, if the distance between the first and second devices is less than the threshold distance, the second device may allow access to the first device. For example, the distance between the first and second devices may be an accurate estimate of the distance between the first UWB device 120 and the second UWB device 130 in Figure 1. The security zone 135 corresponds to the threshold distance.

[0095] Some of the terms used herein may correspond to or approximate those of specific standards such as FiRa, but those skilled in the art will recognize their relevance and application to other protocols based on the concept of round scope (for example, as defined by the CCC-Car Connectivity Consortium).

[0096] Those skilled in the art will recognize improvements and modifications to preferred embodiments of this disclosure. All such improvements and modifications are deemed to be within the scope of the concepts disclosed herein and the following claims.

Claims

1. A method for detecting and canceling attack signals during a ranging round, The first message from the first device is received by the second device, Sending a second message from the second device to the first device, The second device receives a third message from the first device, Sending a fourth message from the second device to the first device, The second device calculates a first flight time based on a plurality of timestamps associated with the first message, the second message, and the third message. A method comprising receiving a fifth message from the first device with the second device, wherein the fifth message includes a second flight time calculated by the first device, or a message invalidating the ranging round.

2. The method according to claim 1, further comprising the second device determining, based on the difference between the first flight time and the second flight time, whether an attack has occurred with respect to the first message, the second message, the third message, or the fourth message.

3. The second device further includes calculating a third flight time based on the timestamps associated with the second message and the third message, The method according to claim 2, wherein the fifth message further includes a fourth flight time.

4. The method according to claim 3, wherein the fourth flight time is based on timestamps associated with the first and second messages.

5. The second device determines the distance between the first device and the second device based on the first flight time, the second flight time, the third flight time, and the fourth flight time. The second device further includes comparing the distance between the first device and the second device with a threshold distance, The method according to claim 3, wherein if the distance between the first device and the second device is greater than the threshold distance, the second device refuses access to the first device, and if the distance between the first device and the second device is less than the threshold distance, the second device allows access to the first device.

6. The method according to claim 5, wherein the transmission of the message is performed by UWB.

7. The method according to claim 4, wherein the reception of the fifth message is via Bluetooth®.

8. A non-temporary machine-readable medium for storing instructions, wherein when an instruction is executed by one or more processors, the one or more processors... The first message from the first device is received by the second device, Sending a second message from the second device to the first device, The second device receives a third message from the first device, Sending a fourth message from the second device to the first device, The second device calculates a first flight time based on a plurality of timestamps associated with the first message, the second message, and the third message. The second device receives a fifth message from the first device, and the fifth message is a non-temporary machine-readable medium containing a second flight time calculated by the first device, or a message invalidating the current ranging round.

9. When executed by one or more processors, the one or more processors: The non-temporary machine-readable medium according to claim 8, further storing instructions causing the second device to perform a determination on whether an attack has occurred with respect to the first message, the second message, the third message, or the fourth message, based on the difference between the first flight time and the second flight time.

10. When executed by the one or more processors, the one or more processors: The second device further stores an instruction to calculate a third flight time based on the timestamps associated with the second message and the third message. The non-temporary machine-readable medium according to claim 9, wherein the fifth message further includes a fourth flight time.

11. The non-temporary machine-readable medium according to claim 10, wherein the fourth flight time is based on timestamps associated with the first and second messages.

12. When executed by the one or more processors, the one or more processors: The second device determines the distance between the first device and the second device based on the first flight time, the second flight time, the third flight time, and the fourth flight time. The second device further stores an instruction to perform the following: compare the distance between the first device and the second device with a threshold distance. The non-temporary machine-readable medium according to claim 10, wherein if the distance between the first device and the second device is greater than the threshold distance, the second device refuses access to the first device, and if the distance between the first device and the second device is less than the threshold distance, the second device allows access to the first device.

13. The non-temporary machine-readable medium according to claim 12, wherein the transmission of the message is by UWB.

14. The non-temporary machine-readable medium according to claim 11, wherein the reception of the fifth message is via Bluetooth®.

15. It is a device, Transceiver and, Non-temporary memory for storing instructions, The device comprises one or more hardware processors, and the one or more hardware processors execute the instructions to the device, The first message from the first device is received by the said device, Sending a second message from the aforementioned device to the first device, The device receives a third message from the first device, Sending a fourth message from the aforementioned device to the first device, The device calculates a first flight time based on a plurality of timestamps associated with the first message, the second message, and the third message. A device configured to perform an operation including receiving a fifth message from the first device, wherein the fifth message includes a second time-of-flight calculated by the first device, or a message invalidating the current ranging round.

16. The one or more hardware processors execute the instruction to the device, The device according to claim 15, further configured to perform an operation that includes determining whether an attack has occurred with respect to the first message, the second message, the third message, or the fourth message, based on the difference between the first flight time and the second flight time.

17. The one or more hardware processors execute the instruction to the device, The system is configured to perform an operation that further includes calculating a third flight time based on the timestamps associated with the second message and the third message, The device according to claim 16, wherein the fifth message further includes a fourth flight time.

18. The device according to claim 17, wherein the fourth flight time is based on timestamps associated with the first and second messages.

19. The one or more hardware processors execute the instruction to the device, The distance between the first device and the device is determined based on the first flight time, the second flight time, the third flight time, and the fourth flight time. The second device is configured to perform an operation that further includes comparing the distance between the first device and the second device with a threshold distance, The device according to claim 17, wherein if the distance between the first device and the second device is greater than the threshold distance, the second device denies access to the first device, and if the distance between the first device and the second device is less than the threshold distance, the second device allows access to the first device.

20. The device according to claim 19, wherein the transmission of the message is performed by UWB.

Images