Systems and methods for phase manipulation attack protection and detection

Abstract

Systems and methods for detecting and preventing phase manipulation during AoA or AoD operations are disclosed. For AoA operations, a network device receiving a constant tone extension (CTE) generates an antenna switching pattern, which may be randomly generated. The network device then receives the CTE using multiple antenna elements. In one embodiment, the network device compares the phases of the received CTE signals of portions utilizing the same antenna element. If the phase difference of these portions is greater than a threshold, the network device detects a malicious attack and acts accordingly. In another embodiment, if the AoA algorithm cannot determine the angle of arrival, the network device detects a malicious attack and acts accordingly. For angle of departure operations, a network device transmitting a CTE signal generates an antenna switching pattern and transmits it to a positioning engine, which performs the above comparison.

Description

Technical Field

[0001] The present disclosure describes systems and methods for detecting and protecting against phase manipulation attacks by generating random antenna switching patterns in angle of arrival (AoA) or angle of departure (AoD) applications. Background Art

[0002] Angle of arrival and angle of departure algorithms, collectively referred to as AoX algorithms, operate by determining the phase difference between different antenna elements in an antenna array. The antenna array can be a one-dimensional or two-dimensional array. Since the distance between the antenna elements is known, this phase difference can be used to determine the angle from which the signal originated.

[0003] Specifically, assume a one-dimensional antenna array where the distance between two adjacent antenna elements is d. The phase difference between when an incoming signal is detected at these two adjacent antennas can be given as φ. This phase difference φ divided by 2π, multiplied by the wavelength λ, represents the distance between the two antenna elements when viewed from the source of the signal. Knowing this difference in the distance the incoming signal has traveled allows the angle of arrival to be calculated. Specifically, the angle of arrival can be given by the difference in the distance the incoming signal has traveled divided by d, which represents the cosine of the incoming signal. In other words, the angle of arrival is defined as the arccosine of (φλ / 2π) / d.

[0004] This and other algorithms rely on the accuracy of several parameters. Specifically, the distance between adjacent antenna elements must be accurate. This is usually not a problem because the geometry of the antenna array is well defined. The algorithm also relies on the incoming signal. Specifically, the algorithm assumes that the incoming signal is a continuous pattern. In many systems, the incoming signal is assumed to be constant so that the phase difference between different antenna elements can be used to determine the direction of the incoming signal.

[0005] However, a malicious device can manipulate the transmitted signal in an attempt to confuse the locator device, causing it to believe that the malicious device is located at a different location than it actually is. This can have serious implications in applications such as access control, visitor management, store theft prevention and product monitoring, collision avoidance, dangerous area detection, automatic emergency procedures, etc. For example, by pretending to be located elsewhere, the owner of a malicious tag can prevent access control alarms from being triggered when entering a restricted area. The owner of the malicious tag can then potentially disrupt the positioning system operation, resulting in serious health or financial problems.

[0006] A similar problem exists with regard to the application of departure angle.

[0007] Therefore, it would be beneficial if there existed a system and method that could determine that an incoming signal has been manipulated by a malicious device and ignore the location data associated with the malicious device. Summary of the invention

[0008] Systems and methods for detecting and protecting against phase manipulation during angle of arrival or angle of departure operations are disclosed. For angle of arrival operations, a network device that receives a constant tone extension (CTE) generates an antenna switching pattern. The antenna switching pattern can be randomly generated each time an AoA operation is performed. The network device then uses multiple antenna elements to receive the CTE. In one embodiment, the network device compares the phases of portions of the CTE signal received during different sampling time slots utilizing the same antenna element. If the phase difference of these portions is greater than a threshold, the network device detects a malicious attack and acts accordingly. In another embodiment, if the AoA algorithm cannot determine the angle of arrival, the network device detects a malicious phase attack and acts accordingly. For angle of departure operations, a network device that transmits a CTE signal generates an antenna switching pattern. The antenna switching pattern is also transmitted to a positioning engine that performs the above-mentioned comparison.

[0009] According to one embodiment, a network device for identifying malicious attacks during angle of arrival operations is disclosed. The network device includes a wireless network interface, wherein the wireless network interface includes an antenna array having multiple antenna elements and an analog multiplexer, wherein the wireless network interface receives an incoming signal from the antenna element and generates an I signal and a Q signal associated with the antenna element; a processing unit; and a memory device, including instructions, which, when executed by the processing unit, enable the network device to: generate an antenna switching pattern; receive a packet including a constant tone extension (CTE) from a tag device, wherein the CTE includes a tone with a known frequency, and wherein the CTE includes multiple switching time slots and multiple sampling time slots, wherein the antenna element for receiving each sampling time slot is determined according to the antenna switching pattern; and based on the phase information obtained from the CTE, if a malicious phase attack is detected, an action is performed. In some embodiments, the action is selected from the group consisting of: discarding the location information of the tag device; alerting an operator; recording an incident; and changing radio parameters. In some embodiments, the antenna switching pattern is randomly generated. In some embodiments, the instructions enable the network device to: use an AoA algorithm to attempt to determine an angle of arrival based on phase information from the received CTE; and if the AoA algorithm cannot identify the angle of arrival, a malicious phase attack is detected and an action is performed in response to detecting the malicious attack. In some embodiments, the instructions enable the network device to: use a first antenna element of the plurality of antenna elements to sample the CTE during a first sampling slot in the plurality of sampling slots; calculate the phase of the CTE sampled during the first sampling slot in the plurality of sampling slots, referred to as a first phase; use a second antenna element of the plurality of antenna elements to sample the CTE during a second sampling slot in the plurality of sampling slots; use the first antenna element of the plurality of antenna elements to sample the CTE during a third sampling slot in the plurality of sampling slots; calculate the phase of the CTE sampled during the third sampling slot in the plurality of sampling slots, referred to as a third phase; compare the first phase to the third phase; and if the difference between the first phase and the third phase is greater than a threshold, perform an action in response to detecting a malicious attack.In some further embodiments, the instructions enable the network device to: calculate the phase of the CTE sampled during a second sampling time slot in the plurality of sampling time slots, referred to as a second phase; use a second antenna element in the plurality of antenna elements to sample the CTE during a fourth sampling time slot in the plurality of sampling time slots; calculate the phase of the CTE sampled during a fourth sampling time slot in the plurality of sampling time slots, referred to as a fourth phase; compare the second phase with the fourth phase; and if the difference between the second phase and the fourth phase is greater than a threshold, perform an action in response to detecting a malicious attack. In some further embodiments, the instructions enable the network device to: calculate the angle of arrival of the tag device if the difference is less than the threshold.

[0010] According to another embodiment, a method for detecting malicious attacks during angle of arrival operations is disclosed. The method includes using a network device to generate an antenna switching pattern, wherein the network device includes a wireless network interface, wherein the wireless network interface includes an antenna array having multiple antenna elements and an analog multiplexer, wherein the wireless network interface receives an incoming signal from the antenna element and generates an I signal and a Q signal associated with the antenna element; using the network device to receive a packet transmitted by a tag device, the packet including a constant tone extension (CTE), wherein the CTE includes a tone with a known frequency, and wherein the CTE includes multiple switching time slots and multiple sampling time slots, wherein the antenna element used to receive each sampling time slot is determined according to the antenna switching pattern, and in response to a detected malicious attack, an action is performed based on phase information obtained from the CTE. In some embodiments, the action is selected from the group consisting of: discarding the location information of the tag device; alerting an operator; recording an incident; and changing radio parameters. In some embodiments, the antenna switching pattern is randomly generated. In some embodiments, the method further comprises detecting a malicious attack by the following steps: using an AoA algorithm to attempt to determine an angle of arrival based on phase information from the received CTE; and if the AoA algorithm cannot identify the angle of arrival, a malicious attack is detected. In some embodiments, the method further comprises detecting a malicious attack by the following steps: sampling the CTE using a first antenna element of the plurality of antenna elements during a first sampling slot in the plurality of sampling slots; calculating the phase of the CTE sampled during the first sampling slot in the plurality of sampling slots, referred to as the first phase; sampling the CTE using a second antenna element of the plurality of antenna elements during a second sampling slot in the plurality of sampling slots; sampling the CTE using the first antenna element of the plurality of antenna elements during a third sampling slot in the plurality of sampling slots; calculating the phase of the CTE sampled during the third sampling slot in the plurality of sampling slots, referred to as the third phase; comparing the first phase with the third phase; and if the difference between the first phase and the third phase is greater than a threshold, a malicious attack is detected. In some further embodiments, the method further comprises calculating the angle of arrival of the tag device if the difference is less than a threshold.In some additional embodiments, the method also includes calculating the phase of the CTE sampled during a second sampling time slot in the multiple sampling time slots, referred to as the second phase; using the second antenna element in the multiple antenna elements to sample the CTE during a fourth sampling time slot in the multiple sampling time slots; calculating the phase of the CTE sampled during the fourth sampling time slot in the multiple sampling time slots, referred to as the fourth phase; comparing the second phase with the fourth phase; and if the difference between the second phase and the fourth phase is greater than a threshold, performing an action in response to detecting a malicious attack.

[0011] According to another embodiment, a software program disposed on a non-transitory storage medium is disclosed. The software program includes instructions, when the instructions are executed by a processing unit disposed on a network device including a wireless network interface, wherein the wireless network interface includes an antenna array having a plurality of antenna elements and an analog multiplexer, wherein the wireless network interface receives an incoming signal from the antenna element and generates an I signal and a Q signal associated with the antenna element, enabling the network device to: generate an antenna switching pattern; receive a packet including a constant tone extension (CTE) from a tag device, wherein the CTE includes a tone having a known frequency, and wherein the CTE includes a plurality of switching time slots and a plurality of sampling time slots, wherein the antenna element for receiving each sampling time slot is determined according to the antenna switching pattern; and based on the phase information obtained from the CTE, if a malicious phase attack is identified, an action is performed. In some embodiments, the action is selected from the group consisting of: discarding the location information of the tag device; alerting an operator; recording an incident; and changing radio parameters. In some embodiments, the antenna switching pattern is randomly generated. In some embodiments, the software program includes instructions that enable the network device to: attempt to determine the angle of arrival based on the phase information from the received CTE using an AoA algorithm; and if the AoA algorithm cannot identify the angle of arrival, a malicious attack is detected and an action is performed in response to the detection of the malicious attack. In some embodiments, the software program includes instructions that enable the network device to: sample the CTE during a first sampling time slot in the plurality of sampling time slots using a first antenna element of the plurality of antenna elements; calculate the phase of the CTE sampled during the first sampling time slot in the plurality of sampling time slots, referred to as a first phase; sample the CTE during a second sampling time slot in the plurality of sampling time slots using a second antenna element of the plurality of antenna elements; sample the CTE during a third sampling time slot in the plurality of sampling time slots using the first antenna element of the plurality of antenna elements; calculate the phase of the CTE sampled during the third sampling time slot in the plurality of sampling time slots, referred to as a third phase; compare the first phase to the third phase; and if the difference between the first phase and the third phase is greater than a threshold, perform an action in response to the detection of a malicious attack.In certain other embodiments, the software program includes instructions that enable the network device to: calculate the phase of the CTE sampled during the second sampling time slot in the plurality of sampling time slots, referred to as the second phase; use the second antenna element in the plurality of antenna elements to sample the CTE during a fourth sampling time slot in the plurality of sampling time slots; calculate the phase of the CTE sampled during the fourth sampling time slot in the plurality of sampling time slots, referred to as the fourth phase; compare the second phase to the fourth phase; and if the difference between the second phase and the fourth phase is greater than a threshold, perform an action in response to detecting a malicious attack. In certain other embodiments, the software program includes instructions that enable the network device to: calculate the angle of arrival of the tag device if the difference is less than the threshold. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] For a better understanding of the present disclosure, reference is made to the accompanying drawings, wherein like elements are represented by like numerals, and wherein:

[0013] Figure 1 is a block diagram of a network device that may be used to perform the methods described herein;

[0014] Figure 2 yes Figure 1 A block diagram of a radio receiver of a network device;

[0015] Figures 3A-3C Shown is emitted to Figure 1 The format of a representative direction detection message for a system;

[0016] Figure 4A is the waveform generated by the normal CTE mode;

[0017] Figure 4B is a CTE mode of manipulation according to one embodiment;

[0018] Figure 5A A system for performing angle of arrival operations according to one embodiment is shown;

[0019] Figure 5B Show Figure 5A A system in which a malicious tag device has manipulated the CTE signal;

[0020] Fig. 6A A system for detecting phase manipulation of a CTE signal is shown;

[0021] Figure 6B Show Fig. 6A A system in which a network device has detected that a malicious tag device has manipulated a CTE signal;

[0022] Fig. 7A illustrates a sequence of operations performed by a network device during an AoA operation according to one embodiment;

[0023] Figure 7B illustrates a sequence of operations performed by a network device during an AoA operation according to another embodiment;

[0024] Fig. 8A A system for performing a departure angle operation according to one embodiment is shown;

[0025] Figure 8B Show Fig. 8A A system in which a malicious tag device has manipulated the CTE signal before transmitting it to the positioning engine;

[0026] Fig. 9 Show Figure 8B A system wherein the positioning engine has detected that a malicious tag device has manipulated a CTE signal;

[0027] Fig. 10A illustrates a sequence of operations performed by a network device and a positioning engine during AoD operation according to one embodiment; and

[0028] Fig. 10B A sequence of operations performed by a network device and a positioning engine during an AoD operation according to another embodiment is shown. DETAILED DESCRIPTION

[0029] Positioning systems are used to locate or track items and optionally people, provide directions, and find other important information within buildings and facilities such as airports, shopping malls, etc. Some systems also rely on these positioning systems as a security measure. Malicious attacks can be used to change the location of a tag device or to spoof a tag device in a location where no tag device is present. These malicious attacks may rely on phase manipulation of the CTE signal transmitted during angle of arrival or angle of departure (collectively referred to as AoX) operations. Systems and methods for detecting such phase manipulation are described below.

[0030] Figure 1 A network device is shown that can be used to perform the phase steering detection described herein. The phase steering detection can be used with an angle of arrival (AoA) or angle of departure (AoD) algorithm.

[0031] The network device 10 has a processing unit 20 and an associated memory device 25. The processing unit 20 can be any suitable component, such as a microprocessor, an embedded processor, a dedicated circuit, a programmable circuit, a microcontroller, or another similar device. The memory device 25 contains instructions that, when executed by the processing unit 20, enable the network device 10 to perform the functions described herein. The memory device 25 can be a non-volatile memory, such as a FLASH ROM, an electrically erasable ROM, or other suitable device. In other embodiments, the memory device 25 can be a volatile memory, such as a RAM or a DRAM. The instructions contained in the memory device 25 can be referred to as a software program, which is provided on a non-temporary storage medium.

[0032] The network device 10 also includes a network interface 30, which may be a wireless network interface including an antenna array 38. The antenna array 38 may include a plurality of antenna elements 37. The antenna array 38 may include 2, 4, 8, 16, or another number of antenna elements 37. In some embodiments, the antenna array 38 includes more than two antenna elements 37. The network interface 30 may support any wireless network protocol that supports AoX determination, such as Bluetooth. The network interface 30 is used to allow the network device 10 to communicate with other devices disposed on a network 39.

[0033] The network interface 30 comprises a radio circuit 31. The radio circuit 31 is used to process incoming signals and convert wireless signals into digital signals. The components within the radio circuit 31 are described in more detail below.

[0034] The network interface 30 also includes a read channel 36. The read channel 36 is used to receive, synchronize and decode digital signals received from the radio circuit 31. Specifically, the read channel 36 has a preamble detector, which is used to identify the beginning of an incoming packet. The read channel 36 also has a synchronization detector, which is used to identify a specific bit sequence called a synchronization character. In addition, the read channel 36 has a decoder, which is used to convert the digital signal into correctly aligned data bytes.

[0035] The network device 10 may include a second memory device 40. Data received from the network interface 30 or to be sent via the network interface 30 may also be stored in the second memory device 40. The second memory device 40 is conventionally a volatile memory.

[0036] Although a memory device 25 is disclosed, any computer readable medium may be used to store the instructions. For example, a read-only memory (ROM), a random access memory (RAM), a magnetic storage device (such as a hard drive), or an optical storage device (such as a CD or DVD) may be used. In addition, the instructions may be downloaded to the memory device 25, such as, for example, via a network connection (not shown), via a CD ROM, or by another mechanism. The instructions may be written in any programming language and are not limited by the present disclosure. Therefore, in some embodiments, there may be multiple computer readable non-transitory media containing the instructions described herein. A first computer readable non-transitory medium may communicate with the processing unit 20, such as Figure 1 The second computer readable non-transitory medium may be a CDROM, or a different memory device located remote from the network device 10. The instructions contained on the second computer readable non-transitory medium may be downloaded to the memory device 25 to allow the instructions to be executed by the network device 10.

[0037] Although the processing unit 20, the memory device 25, the network interface 30 and the second memory device 40 are Figure 1 , but it should be understood that some or all of these components may be integrated into a single electronic assembly. Figure 1 It is used to illustrate the functionality of the network device 10 rather than its physical configuration.

[0038] Although not shown, the network device 10 also has a power source, which may be a battery or a connection to a permanent power source, such as a wall outlet.

[0039] Figure 2 A block diagram of the radio circuit 31 is shown. A wireless signal first enters the radio circuit 31 through one antenna element 37 of an antenna array 38. The antenna array 38 may be a one-dimensional array, such as a linear array. Alternatively, the antenna array 38 may be a two-dimensional array, such as an M×N array. An analog multiplexer 50 may be used to select one antenna element 37 from the antenna array 38. Once selected, the antenna element 37 is in electrical communication with a low noise amplifier (LNA) 51. The LNA 51 receives a very weak signal from the antenna element 37 and amplifies the signal while maintaining the signal-to-noise ratio (SNR) of the incoming signal. The amplified signal is then transmitted to a mixer 52. The mixer 52 is also in communication with a local oscillator 53, which provides two phases to the mixer 52. The cosine of the frequency may be referred to as I o , and the sine of the frequency can be called Q o Then, I o signal is multiplied by the incoming signal to produce an in-phase signal I m Then, Q oThe signal is multiplied by a 90° delayed version of the incoming signal to produce a quadrature signal Q m The in-phase signal I from the mixer 52 m and the quadrature signal Q m It is then fed to a programmable gain amplifier (PGA) 54. PGA 54 converts I m and Q m The signal is amplified by a programmable amount. These amplified signals are called I g and Q g Then, the amplified signal I g and Q g The analog signals are fed from PGA 54 to analog-to-digital converter (ADC) 55. ADC 55 converts these analog signals into digital signals I d and Q d These digital signals may pass through a channel filter 56 before exiting the radio circuitry 31 as I and Q signals (in-phase and quadrature). In some embodiments, the I and Q values ​​may be considered complex numbers, where the I value is the real component and the Q value is the imaginary component.

[0040] The I and Q signals can then go into a CORDIC (Coordinated Rotation Digital Computer), which determines the amplitude and phase of the signal. 2 Add Q 2 The square root of , and the phase is given by tan -1 (Q / I) is given. The CORDIC may be located in the radio circuit 31, or elsewhere in the network interface 30. In some embodiments, the CORDIC may be implemented in software.

[0041] In certain embodiments, the network interface 30 operates over a wireless network utilizing the Bluetooth network protocol. Figure 3A The format of a specific Bluetooth packet for direction detection is shown. These packets typically begin with a preamble 300, an address field 310, a payload 320, and a checksum or CRC 330. However, specific packets also include a constant tone extension (CTE) 340. Figure 3B and 3C Two different formats of CTE 340 are shown. In both formats, CTE 340 includes a guard period 341, a reference period 342, and a plurality of switching time slots 343 and sampling time slots 344. The duration of each switching time slot 343 and sampling time slot 344 may be 1 microsecond or 2 microseconds, respectively. Figure 3B and 3CAs shown. CTE 340 is a specific extension of the Bluetooth packet that transmits a constant frequency such as a 250kHz tone. CTE 340 can be, for example, a string of consecutive "1s". CTE 340 can be as long as 160 microseconds and as short as 16 microseconds. In practice, the network device 10 uses a single antenna element 37 of the antenna array 38 to receive CTE 340 during the protection period 341 and the reference period 342. The network device 10 then switches to another antenna element 37 during each switching slot 343 by changing the selection of the analog multiplexer 50 in the radio circuit 31. The network device 10 samples the tone again using the new antenna element 37 during the sampling slot 344. The network device 10 continues to switch the antenna element 37 during each switching slot 343 and samples the tone during the sampling slot 344. If there are more sampling slots 344 than antenna elements, the network device 10 can return to the first antenna element 37 and repeat the sequence. A set of samples may be referred to as a snapshot, where each antenna element has been used exactly once to sample CTE 340. The order in which network device 10 selects different antenna elements 37 may be referred to as an antenna switching pattern.

[0042] The transmitting device transmits a tone at a constant known frequency throughout the CTE 340. As described above, the network device 10 can receive the tone using one antenna element 37 of the antenna array. Specifically, the same antenna element 37 is used to receive the guard period 341 and the reference period 342, which have a combined duration of 12 microseconds.

[0043] The network device 10 then performs the above steps to generate the I and Q signals. In some embodiments, the processing unit 20 samples the I and Q signals at a very high rate, such as 8 times the frequency of the incoming tone or faster. For example, if the incoming tone is 250kHz, an oversampling rate of 4.0MHz (sixteen times oversampling) or 8.0MHz (thirty-two times oversampling) may be used. The I and Q signals then enter the CORDIC, which determines the amplitude and phase of the signal. The amplitude is given as I 2和 Q 2 The square root of -1 (Q / I) is given.

[0044] Figure 4AA typical CTE pattern 400 is shown. In this embodiment, the CTE pattern 400 is a sine wave having a frequency of 250 kHz. The horizontal axis represents time in microseconds. The network device 10 switches from the first antenna element to the second antenna element at time 410. In other words, time 410 may correspond to the beginning of the switching time slot 343. The network device 10 may be configured to begin sampling the incoming signal at a known time after the switching time slot 343. For example, if the CTE pattern is as Figure 3B As shown, the network device may begin sampling the incoming signal 1 microsecond after time 410. Since the total duration of the switching time slot 343 and the sampling time slot 344 is 2 microseconds, the phase of the even-numbered sampling time slots may be 180° out of phase with the odd-numbered sampling time slots. Since the CTE pattern 400 is constant, the phase difference between the signals received by the first antenna element and the second antenna element is entirely due to the difference in the CTE pattern relative to the distances traveled by the two antenna elements, which is offset by 180°.

[0045] Alternatively, if the CTE pattern is Figure 3C As shown, the network device 10 may begin sampling the incoming signal 2 microseconds after time 410. Since the total duration of the switching time slot 343 and the sampling time slot 344 is 4 microseconds, the phase of the even-numbered sampling time slots may be in phase with the odd-numbered sampling time slots. Since the CTE pattern 400 is constant, the phase difference between the signals received by the first antenna element and the second antenna element is entirely due to the difference in the CTE pattern relative to the distances traveled by the two antenna elements.

[0046] To determine the phase of the incoming signal, the network device 10 may use the I and Q signals. In one embodiment, the network device 10 uses the output of the CORDIC, i.e., the phase, which is determined by tan -1 In another embodiment, the network device 10 uses the output of the CORDIC, i.e., the amplitude, which is given as I 2 Add Q 2 In another embodiment, the network device 10 uses these two parameters to determine the phase of the incoming signal during each sampling time slot 344. As described above, in order to correctly determine the phase, the network device 10 must start sampling at the same time after the start of each switching time slot 343. In this way, there is no phase offset due to sampling inaccuracy.

[0047] Figure 4BA manipulated CTE pattern 450 is shown. In this embodiment, the manipulated CTE pattern 450 is a sine wave having a frequency of 250 kHz but having a phase discontinuity. For example, time 460 may correspond to the start of the switching time slot 343. However, unlike the normal CTE pattern 400, a phase shift equal to 45° is introduced into the manipulated CTE pattern 450 at time 460. Therefore, when the network device 10 switches antenna elements, the phase difference between the signals received by the first antenna element and the second antenna element is based in part on the difference in transmission distances and in part on the phase discontinuity of the manipulated CTE pattern 450. However, since the network device 10 is unaware of the discontinuity of the manipulated CTE pattern 450, it attributes the entire phase difference to the difference in transmission distances. This results in an erroneous determination of the angle of arrival of the incoming signal.

[0048] For example, Figure 5A A network device 10 is shown having two antenna elements 501, 502. A tag device 500 is also shown. The tag device 500 may have many of the components described above with respect to the network device 10. However, the tag device 500 typically does not have an antenna array; instead, the tag device 500 typically has a single antenna element. Thus, the tag device may not include Figure 2 The analog multiplexer shown. In addition, the processing power of the tag device 500 and the storage capacity of the tag device 500 may be less than the processing power and storage capacity of the network device 10. Finally, the tag device 500 may be battery powered.

[0049] The tag device 500 transmitting the CTE signal is located at an angle θ to the network device 10. The tag device 500 transmits a CTE pattern 510 having a continuous sine wave. In this embodiment, the network device 10 has two antenna elements. Therefore, the network device 10 receives the CTE signal on the first antenna element 501, and during the switching time slot 343, switches the antenna element and then receives the CTE signal on the second antenna element 502. The network device 10 can switch between the two antenna elements multiple times.

[0050] In addition, although Figure 5A A network device 10 with two antenna elements is shown, but the present disclosure is not limited to this embodiment. The network device 10 may include any number of antenna elements. In this embodiment, the network device 10 uses a simple antenna switching pattern. For example, the network device 10 may switch to the next antenna element sequentially. For example, if there are N antenna elements, the network device 10 may sample each antenna element in sequence and then return to the first antenna element. Therefore, the antenna switching pattern may be 1, 2, ... N, 1, 2, ... N, etc.

[0051] Also shown is a received CTE signal 511, where the phase discontinuity is caused by the difference in transmission distance between the first antenna element 501 and the second antenna element 502. The antenna elements receiving each portion of the received CTE signal 511 are shown below the CTE signal 511. As shown in the CTE signal 511, the phase of the portion of the received CTE signal 511 received by the second antenna element 502 is delayed by approximately 90°. The network device 10 can then calculate the angle of arrival based on the received CTE signal 511 using any known algorithm AoX such as MUSIC.

[0052] The Multiple Signal Classification (MUSIC) algorithm uses phase information to determine the direction of arrival. The MUSIC algorithm creates a one-dimensional or two-dimensional graph based on the configuration of the antenna array, where each peak on the graph represents the direction of arrival of the incoming signal. This one-dimensional or two-dimensional graph can be called a pseudo-spectrum. The MUSIC algorithm calculates the value of each point on the graph. In other words, the peaks in the pseudo-spectrum correspond to the angles of some signals entering the antenna array.

[0053] Although the present disclosure describes the use of the MUSIC algorithm, other algorithms may also be used. For example, the minimum variance distortionless response (MVDR) beamformer algorithm (also known as the Capon beamformer), the Bartlett beamformer algorithm, and variations of the MUSIC algorithm may also be used. In each of these algorithms, the algorithm uses a different mathematical formula to calculate the spectrum, but each calculates a spectrum that can be used in the present disclosure.

[0054] There are two ways in which the label position can be manipulated.

[0055] In one embodiment, Figure 5B As shown, the malicious tag device 560 can send a manipulated CTE signal 561. The network device 10 uses the first antenna element 501 and the second antenna element 502 to capture the received CTE signal 570. Again, as described above, the network device 10 uses a simple antenna switching pattern. For example, the network device 10 can switch to the next antenna element sequentially. For example, if there are N antenna elements, the network device 10 can sample each antenna element in sequence and then return to the first antenna element. Therefore, the antenna switching pattern can be 1, 2, ...N, 1, 2, ...N, etc.

[0056] Note that in this example, the phase difference caused by the difference in transmission distance is offset by the phase manipulation introduced by the malicious tag device 560. Therefore, the network device 10 will detect the received CTE signal 570, in which the portion of the CTE signal received by each antenna element has the same phase. Therefore, the network device 10 can determine based on the received CTE signal 570 that the calculated tag position 580 is located in the middle between the first antenna element 501 and the second antenna element 502.

[0057] There are other ways that the CTE signal can be manipulated. For example, an attacker tag can overwrite portions of the CTE signal emitted by a tag device in order to change the calculated position of the tag device.

[0058] Note that if the CTE signal is Figure 3B As shown, and only one antenna element is used, each even-numbered sampling time slot will have the same phase φ, while the odd-numbered sampling time slots will have a phase offset by 180° from that phase, or φ+180°. Similarly, if the CTE signal is as Figure 3C As shown, and only one antenna element is used, each sampling time slot 344 will have the same phase φ.

[0059] This relationship can be used to determine whether the CTE signal is being manipulated. Fig. 6A Shows Figure 5A For simplicity, assume that the CTE pattern is as follows Figure 3C . However, in this embodiment, the antenna switching pattern has been changed so that the first antenna element 501 is used, the second antenna element 502 is used to sample the incoming signal for two consecutive sampling time slots, and finally the first antenna element 501 is used again. Note that in this embodiment, the received CTE signal 511 shows that the phase received by the first antenna element 501 is the same for both time slots. Similarly, the phase received by the second antenna element 502 is the same for both time slots. Therefore, the network device 10 can determine that the incoming signal is not manipulated.

[0060] Figure 6B Shows Figure 5B For simplicity, assume that the CTE pattern is as follows Figure 3CHowever, in this embodiment, the antenna switching pattern has been changed so that the first antenna element 501 is used, the second antenna element 502 is used to sample the incoming signal for two consecutive sampling time slots, and finally the first antenna element 501 is used again. Note that in this embodiment, the received CTE signal 511 shows that the phase received by the first antenna element 501 is different for the two time slots. Similarly, the phase received by the second antenna element 502 is also different for the two time slots. However, as described above, it is assumed Figure 3C The phase received by a particular antenna element should be the same for all sampling time slots. Therefore, the network device 10 can determine that the incoming signal has been manipulated. In response, the network device can provide a warning that the malicious tag device 560 is attempting to manipulate the CTE signal in the network. In addition, the network device 10 can discard the location information of the malicious tag device 560.

[0061] This technique is also applicable when an attacker tag may overwrite the CTE signal from the tag device in order to change its calculated position. Specifically, the network device 10 will detect that the phase of the CTE signal received by one antenna element during two or more sampling time slots is different.

[0062] Additionally, in some embodiments, the network device 10 may also compare the amplitudes of two sampling time slots received by the same antenna element.

[0063] Note that the clock used by the network device 10 may be slightly different from the clock used by the tag device to generate the CTE signal. Therefore, in some embodiments, the network device 10 may compare the phases of two or more sampling time slots received using the same antenna element. The network device 10 may have a predetermined threshold such that if the phase difference is greater than the predetermined threshold, the network device 10 may determine that a malicious attack is being performed. In some embodiments, the predetermined threshold may be less than 5°.

[0064] In some embodiments, the threshold may be adaptive. For example, in a noisy environment, the resulting phase difference between two sampling time slots may be greater than in a quieter environment. Therefore, in some embodiments, the system may monitor the average phase difference between samples received using the same antenna element and determine the threshold based on the average. The average may be a cumulative average or may be a moving average.

[0065] In addition, as mentioned above, if you use Figure 3B If the CTE of the even-numbered sampling time slots is greater than 1, the network device 10 must incorporate any phase differences that exist between the even-numbered sampling time slots and the odd-numbered sampling time slots into its calculations. For example, the network device 10 may add 180° to all odd-numbered sampling time slots and then perform the above comparison.

[0066] Note that when the antenna switching pattern is sequential, the network device 10 does not detect the manipulated CTE signal 561. In other words, the malicious tag device 560 manipulates the CTE pattern based on an assumption of which antenna element the network device 10 will use to receive each sampling time slot 344. In other words, the malicious tag device 560 may know the configuration of the antenna array in the network device 10 and predict the antenna switching pattern based on the configuration.

[0067] Therefore, in one embodiment, the network device 10 randomizes the antenna switching pattern each time an AoA operation is to be performed. This may be performed using a true random number generator or a cryptographically secure pseudo-random number generator (CSPRNG). In other embodiments, the network device 10 may randomly insert a second sampling time slot used by one of the antenna elements. The point is that the antenna switching pattern is preferably unpredictable and therefore impossible to guess.

[0068] For example, if there are 37 sampling slots and 16 antenna elements, all antenna elements can be used for 2 sampling slots, and there are 5 additional sampling slots. In one embodiment, the order in which the antenna elements are used is randomized, such as using a true random number generator or CSPRNG algorithm. In another embodiment, the five additional sampling slots can be randomly inserted into the sequence, and all of these additional sampling slots can use the same antenna element.

[0069] In both cases, the malicious tag device 560 will not be able to correctly predict the antenna switching pattern and therefore will not be able to manipulate the CTE pattern in a way that will go undetected.

[0070] Fig. 7AA flow chart that can be used by the network device 10 to detect malicious attacks during AoA operation is shown. First, in some embodiments, the network device 10 generates an antenna switching pattern, as shown in box 700. The antenna switching pattern can be randomized. This can be implemented using a true random number generator, a CSPRNG algorithm, or another method. Then, the network device 10 receives an incoming CTE signal using the antenna switching pattern. As part of receiving the incoming CTE signal, the network device uses a first antenna element in a plurality of antenna elements to sample a first sampling time slot of the CTE signal from the tag device, as shown in box 710. The network device 10 can then determine the phase of the first sampling time slot, referred to as the first phase, as shown in box 720. Optionally, the network device 10 can also determine the amplitude of the first sampling time slot. Then, as shown in box 730, the network device uses a second antenna element in a plurality of antenna elements to sample a second sampling time slot of the CTE signal from the tag device. The network device 10 can then determine the phase of the second sampling time slot, referred to as the second phase, as shown in box 740. If the network device has more than 2 antenna elements, the network device can select other antenna elements for receiving portions of the CTE signal. However, at some moments, the network device 10 uses the first antenna element of the plurality of antenna elements again to receive the third sampling time slot, as shown in box 750. The network device 10 can then determine the phase of the third sampling time slot, referred to as the third phase, as shown in box 760. Optionally, the network device 10 can also determine the amplitude of the first sampling time slot. The network device 10 then compares the first phase and the third phase, as shown in box 770. If the phase difference is greater than a threshold, the network device can perform some actions in response to detecting a malicious attack, as shown in box 780. If the phase is within the threshold, the network device 10 can determine the angle of arrival, as shown in box 790. In some embodiments, the network device 10 can also compare the amplitude of the first sampling time slot and the third sampling time slot to detect a malicious attack. In these embodiments, the network device 10 uses both amplitude and phase information.

[0071] Actions taken in response to detecting a malicious attack may include providing a warning to an operator, discarding the location information of the tag device, recording the incident, changing radio parameters such as timing, channel, synchronization word or others in the hope that the malicious tag device cannot follow.

[0072] In some embodiments, block 740 may not be performed until it is determined whether a malicious attack is being performed. In this way, less computing power is used.

[0073] Additionally, in some embodiments, the CTE may be transmitted in a noisy environment such that noise is present in the received signal. This noise may result in incorrect phase calculations at various sampling time slots. By using this approach, CTE signals with a lot of noise may not be compared (even in the absence of a malicious attack). Therefore, since the AoA algorithm is not executed on CTE signals with a lot of noise, computing power is saved.

[0074] In addition, the two sampling time slots used by the first antenna element of the plurality of antenna elements may be sequential or non-sequential. Of course, the first antenna element of the plurality of antenna elements may be used for more than two sampling time slots. In addition, the above comparison may also be performed for one or more additional antenna elements, where these additional antenna elements are used for more than one sampling time slot. In other words, the second antenna element may be used to receive the fourth sampling time slot, and the fourth phase may be calculated. The second and fourth phases may also be compared to determine whether a malicious attack is being performed.

[0075] While the previous disclosure describes the ability to explicitly detect phase manipulation attacks, the concepts described herein may also be used in other ways.The second mode may be referred to as a protection mode, where the network device does not explicitly detect malicious phase attacks, but rather detects such attacks implicitly.

[0076] For example, Figure 7B As shown, the network device 10 may generate an antenna switching pattern before performing an AoA operation, as shown in block 700. The network device 10 then receives CTE using the antenna switching pattern, as shown in block 701. The network device 10 then attempts to calculate the angle of arrival of the signal based on the received CTE signal, as shown in block 702. This may be done using MUSIC or any other algorithm. If the result is inconclusive, the network device may detect that a malicious attack is ongoing. The network device 10 may then perform an action similar to the action taken above, as shown in block 780. If the result of the angle of arrival calculation is deterministic, the network device 10 may accept the location data, as shown in block 704.

[0077] In both modes, the network device 10 generates an antenna switching pattern. The network device 10 then uses the antenna switching pattern to receive the CTE signal. In addition, in both modes, the network device can identify malicious phase attacks based on the phase information contained in the CTE signal. In the detection mode, the network device 10 can compare the phases of two or more sampling time slots received using the same antenna element to detect malicious attacks. In the protection mode, the phase information is used as input to the AoA algorithm. If the algorithm cannot resolve the AoA based on the phase information, the network device 10 can detect a malicious phase attack. In both modes, a malicious phase attack is identified. In the event that a malicious phase attack is detected, the network device 10 can take some actions, such as discarding location data, alerting an operator, recording an incident, or changing radio parameters.

[0078] This technology also works with departure angle configurations. Fig. 8A A network device 810 is shown having two antenna elements 801, 802. The network device 810 may have a reference Figure 1 and Figure 2 Describes the components. Fig. 8A Also shown is a tag device 820. The tag device 820 may be similar to the tag device 500 described above, and may have most of the components included in the network device 810. However, unlike the tag devices described above, the tag device 820 receives CTE. Fig. 8A Also shown is a positioning engine 830. The positioning engine 830 is a device capable of calculating a departure angle based on data received by the tag device 820. The positioning engine may include components similar to those of a network device, such as Figure 1 and Figure 2 As shown. However, the positioning engine 830 may not include an antenna array. Instead, the positioning engine 830 may have a single antenna element. In addition, the computing power of the positioning engine 830 may be greater than that of the tag device, thereby enabling the positioning engine 830 to execute necessary AoX algorithms, such as MUSIC. In some embodiments, the positioning engine 830 may be included in the network device 810. In other embodiments, the positioning engine 830 may be incorporated into another device or may be a stand-alone device. In other embodiments, the positioning engine 830 may be in the tag device 820 or be set in the cloud.

[0079] The network device 810 transmits a CTE signal to a tag device 820 located at an angle θ from the network device 810. The network device 810 transmits a CTE signal 805 having a continuous sine wave. In this embodiment, the network device 810 has two antenna elements. Therefore, the network device 810 transmits the CTE signal on the first antenna element 801, and during the switching time slot 343, switches the antenna element, and then transmits the CTE signal on the second antenna element 802. The network device 810 can switch between the two antenna elements multiple times.

[0080] In addition, although Fig. 8A A network device 810 with two antenna elements is shown, but the present disclosure is not limited to this embodiment. The network device 810 may include any number of antenna elements. In this embodiment, the network device 810 uses a simple antenna switching pattern to transmit the CTE signal 805. For example, the network device 810 can switch to the next antenna element sequentially. For example, if there are N antenna elements, the network device 810 can select each antenna element in sequence and then return to the first antenna element. Therefore, the antenna switching pattern can be 1, 2, ... N, 1, 2, ... N, etc.

[0081] The tag device 820 receives the transmitted CTE signal. The received CTE signal 811 is also shown, wherein the phase discontinuity is caused by the difference in transmission distance between the first antenna element 801 and the second antenna element 802. The antenna elements that transmit each portion of the received CTE signal 811 are shown below the CTE signal 811. As shown in the CTE signal 811, the phase of the portion of the received CTE signal 811 transmitted by the second antenna element 802 is delayed by approximately 90°. The tag device 820 can transmit data representing the received CTE signal 811 to the positioning engine 830. The transmission of data is application specific. In some embodiments, the IQ data can be transmitted to the positioning engine 830 via a wireless network such as Bluetooth or Wi-Fi. The IQ data can also be stored in a memory in the tag device 820 and loaded into the positioning engine 830 when the tag device 820 has access to a wired network. In some embodiments, the positioning engine 830 may be incorporated into the network device 810. In other embodiments, the positioning engine 830 may be a separate component or may be integrated into another device or cloud including the tag device 820. The positioning engine 830 may then calculate the departure angle based on the data indicating the received CTE signal 811 using any known AoX algorithm such as MUSIC.

[0082] exist Figure 8BIn one embodiment shown, the malicious tag device 860 can receive the CTE signal 805 from the network device 810, as described above. However, the malicious tag device 860 can transmit data indicating the manipulated CTE signal 861 to the positioning engine 830. The positioning engine 830 will then calculate the departure angle based on the manipulated CTE signal 861. This may produce incorrect location information for the malicious tag device. For example, the positioning engine 830 can calculate a calculated tag location 880 that is different from the actual location of the tag device.

[0083] In another embodiment, the attacker tag device may be configured to modify the CTE signal when it is transmitted from the network device 10 to the tag device. Thus, the tag device will receive a CTE signal that is different from the CTE signal transmitted by the network device 810.

[0084] In both embodiments, the positioning engine 830 will receive data indicative of a manipulated CTE signal 861 from a tag device.

[0085] The above mechanism can also be used to detect this phase manipulation. Fig. 9 A system is shown in which the antenna switching pattern is changed by the network device 810. In addition, if the positioning engine 830 is different from the network device 810, then the network device 810 transmits this antenna switching pattern to the positioning engine 830. In other words, the positioning engine 830 receives the CTE signal from the tag device and receives the antenna switching pattern from the network device 810. The positioning engine can then compare the phases of the two parts of the CTE signal received by the same antenna element in the manner described above.

[0086] Fig. 10A The actions of the network device 810 and the positioning engine 830 in this embodiment are shown. Fig. 10A The left side of shows the operation of network device 810.

[0087] First, as shown in box 900, the network device 810 generates an antenna switching pattern. This antenna switching pattern can be randomized using a true random number generator or a CSPRNG algorithm. Alternatively, as described above, the antenna switching pattern can include the insertion of multiple sampling time slots using the same antenna element. Then, the network device 810 uses the antenna switching pattern to transmit the CTE signal to the tag device, as shown in box 910. Finally, as shown in box 920, the network device 810 transmits the antenna switching pattern to the positioning engine 830, such as via a wireless network. The transmission can be encrypted. For example, a special predefined antenna switching security key can be used to encrypt the transmission of the antenna switching pattern. In some embodiments, the order of these operations can be changed. For example, the network device 810 can transmit the antenna switching pattern to the positioning engine 830 before transmitting the CTE signal to the tag device. In an embodiment where the positioning engine 830 is set within the network device 810, the operation shown in box 920 can be an internal operation that does not utilize a wireless network.

[0088] If the antenna switching pattern is generated by the network device 810 using a CSPRNG algorithm, it is sufficient to initially provide the seed value to the positioning engine 830 without the network device 810 continuing to provide the antenna switching pattern to the positioning engine 830. In this way, the positioning engine 830 can independently generate the same antenna switching pattern using the seed value and the same CSPRNG algorithm.

[0089] The operation of the positioning engine 830 is Fig. 10A is shown on the right side.

[0090] The positioning engine 830 receives data indicating the received CTE signal from the tag device 820, as shown in block 930. This can be transmitted over a wireless network. The type of data transmitted can depend on certain parameters, such as the processing power and available bandwidth of the tag device 820. In some embodiments, the data can be in raw IQ format. In other embodiments, the IQ data can be pre-processed by the tag device 820 before transmission. In some embodiments, the data can be encrypted or signed so that the positioning engine 830 can verify the source of the received data.

[0091] In addition, the positioning engine 830 receives the antenna switching pattern from the network device 810, as shown in block 940. The transmission may be encrypted and transmitted over the wireless network. For example, the transmission of the antenna switching pattern may be encrypted using a special predefined antenna switching security key. In some embodiments, the order of these operations may be changed. For example, the network device 810 may transmit the antenna switching pattern to the positioning engine 830 before the positioning engine 830 receives the received CTE signal from the tag device.

[0092] Once the positioning engine 830 has received the antenna switching pattern (or calculated the antenna switching pattern using the CSPRING algorithm) and the received CTE signal, it can determine whether a malicious attack has occurred. For example, as shown in box 950, the positioning engine 830 can determine the phase of the first portion of the received CTE signal transmitted by the network device 810 using the first antenna element. The positioning engine can then identify the second portion of the received CTE signal that also utilizes the first antenna element. The positioning engine 830 can then determine the phase of the second portion of the received CTE signal transmitted by the network device 810 using the first antenna element, as shown in box 960.

[0093] Additionally, the positioning engine may determine a magnitude of the first portion and the second portion.

[0094] The positioning engine 830 then compares the first phase and the second phase, as shown in block 970. Figure 3C The positioning engine 830 simply compares the two phases. However, if the CTE is used Figure 3B If the CTE is 1, the positioning engine 830 must incorporate any phase difference between even-numbered sampling slots and odd-numbered sampling slots into its calculations. For example, the positioning engine 830 can add 180° to all odd-numbered sampling slots and then perform the above comparison.

[0095] If the difference between these phases is greater than the threshold, the positioning engine 830 detects a malicious attack and performs an action, as shown in block 980. The threshold can be predetermined, or can be adaptive, such as based on a cumulative or moving average as described above. The action may include discarding the location information associated with the tag device, alerting an operator, recording an incident, or changing radio parameters. Thus, in some embodiments, the positioning engine 830 may provide information to the network device 810. If the difference between these phases is less than the threshold, the positioning engine 830 determines a departure angle, as shown in block 990.

[0096] Likewise, the positioning engine 830 may use amplitude in addition to phase to make this determination.

[0097] In addition, if desired, the positioning engine 830 can also compare the phases of the two parts of the received CTE signal transmitted from the network device 810 to the tag device using the second antenna element. If the difference between these phases is greater than a predetermined threshold, the positioning engine 830 detects a malicious attack and performs the actions shown in block 980.

[0098] As described above, the positioning engine can operate in a second mode, referred to as protection mode, in which the positioning engine 830 does not explicitly detect malicious phase attacks, but rather detects such attacks implicitly.

[0099] For example, Fig. 10B As shown, the network device 10 may generate an antenna switching pattern before performing an AoD operation, as shown in block 900. The network device 10 then uses the antenna switching pattern to transmit CTE, as shown in block 910. The network engine also forwards the antenna switching pattern to the positioning engine 830, as shown in block 920.

[0100] The positioning engine 830 receives data indicating the received CTE signal from the tag device 820, as shown in box 930. In addition, the positioning engine 830 receives an antenna switching pattern from the network device 810, as shown in box 940. Alternatively, the positioning engine 830 uses a seed value and an SPRNG algorithm to determine the antenna switching pattern. The positioning engine 830 then attempts to calculate the departure angle of the signal based on the received CTE signal, as shown in box 941. This can be done using MUSIC or any other algorithm. If the result is uncertain, the positioning engine 830 can detect that a malicious attack is ongoing. The positioning engine or the network device can then perform an action similar to the action taken above, as shown in box 980. If the result of the angle of arrival calculation is certain, the positioning engine 830 can accept the location data, as shown in box 981.

[0101] In both modes, the network device 810 generates an antenna switching pattern. The network device 810 then uses the antenna switching pattern to transmit a CTE signal. In addition, in both modes, the positioning engine 830 can identify malicious phase attacks based on the phase information contained in the CTE signal. In the detection mode, the positioning engine 830 can compare the phases of two or more sampling time slots received using the same antenna element to detect malicious attacks. In the protection mode, the phase information is used as an input to the AoD algorithm. If the algorithm cannot resolve the AoD based on the phase information, the positioning engine 830 can detect a malicious phase attack. In both modes, malicious phase attacks are identified. In the event of a malicious phase attack being detected, the positioning engine 830 or the network device 810 can take an action such as discarding location data, alerting an operator, recording an incident, or changing radio parameters.

[0102] Angle of arrival or angle of departure can be used for many functions. For example, an angle of arrival locator can be used to locate beacons. Such applications can be called pathfinding. For example, a beacon can be a set of car keys or another device that a user needs to find. A user holding a locator device can be directed to a beacon based on the angle of arrival detected by the locator device. As an example, a car can be equipped with Bluetooth. A command can be sent by the owner to a car set in a parking lot to send a beacon or a sequence of beacons. The locator device carried by the owner detects the angle of arrival and can direct the owner to the car in the parking lot. In another embodiment, a large shopping mall can install beacons at certain locations, such as near exits, certain stores, or cafeterias. Shoppers can use these beacons to use portable locator devices to guide their routes through the shopping mall. Similarly, the angle of arrival can be used to guide operators towards assets in a warehouse or other structure. The locator device can include an indicator that allows the operator to determine the angle of arrival. For example, the locator device can have a visual display indicating the direction of the beacon. Alternatively, the locator device can have an audio output that informs the user of the direction of the beacon.

[0103] When multiple locators are used, the exact location of the transmitter can be determined. This type of application is called spatial positioning. For example, within a structure with multiple locator devices, the exact location of any transmitter can be determined. This can be used to replace GPS in these environments because GPS positioning requires more power to perform or is used for indoor locations where GPS signals are weak or unavailable. In one example, an operator can carry a mobile phone. The angle of arrival of the beacon emitted by the phone is determined in multiple locator devices. In one embodiment, these angles of arrival are forwarded to the mobile phone. In another embodiment, these angles of arrival are forwarded to a centralized computing device, which calculates the location of the mobile phone based on all received angles of arrival. Therefore, the angle of arrival from each locator device can be used by the mobile phone or another device to accurately locate the specific location of the mobile phone. If multiple locator devices are used, three-dimensional spatial positioning is also possible.

[0104] The present system and method have many advantages. The method increases the security of the system and makes it more difficult to falsify location data, thereby making the system more trustworthy and less vulnerable to malicious attacks. This is especially important in systems where incorrect positioning can have serious consequences. In addition, discarding corrupted packets can improve the power consumption of the system and the accuracy of the location data.

[0105] The present disclosure is not limited by the scope of the specific embodiments described herein. In fact, in addition to those embodiments described herein, according to the foregoing description and the accompanying drawings, various other embodiments and modifications of the present disclosure should be apparent to those of ordinary skill in the art. Therefore, such other embodiments and modifications are intended to fall within the scope of the present disclosure. In addition, although the present disclosure has been described herein for a specific purpose in the context of a specific implementation in a specific environment, it should be appreciated by those of ordinary skill in the art that its usefulness is not limited thereto, and the present disclosure can be beneficially implemented in any number of environments for any number of purposes. Therefore, the claims set forth below should be interpreted in view of the full breadth and spirit of the present invention as described herein.

Claims

1. A network device for identifying malicious attacks during angle-of-arrival operations, comprising: a wireless network interface, wherein the wireless network interface comprises an antenna array having a plurality of antenna elements and an analog multiplexer, wherein the wireless network interface receives incoming signals from the antenna elements and generates I and Q signals associated with the antenna elements; a processing unit; and a memory device comprising instructions that, when executed by the processing unit, enable the network device to: generating an antenna switching pattern; receiving a packet including a constant tone extension (CTE) from a tag device, wherein the CTE includes a tone having a known frequency, and wherein the CTE includes a plurality of switching slots and a plurality of sampling slots, wherein the antenna element used to receive each sampling slot is determined according to the antenna switching pattern; and Based on phase information obtained from the CTE by one of the plurality of antenna elements during two or more sampling time slots, an action is performed if a malicious attack is detected.

2. The network device according to claim 1, wherein: The action is selected from the group consisting of: discarding the location information of the tag device; Warning to the operator; Recording incidents; and Change radio parameters.

3. The network device according to claim 1, wherein: The antenna switching pattern is randomly generated.

4. The network device according to claim 1, wherein: The instructions enable the network device to: attempting to determine the angle of arrival based on phase information from the received CTE using an AoA algorithm; and If the AoA algorithm fails to identify the angle of arrival, a malicious attack is detected and the actions are performed in response to detecting the malicious attack.

5. The network device according to claim 1, wherein: The instructions enable the network device to: sampling the CTE during a first sampling time slot of the plurality of sampling time slots using a first antenna element of the plurality of antenna elements; calculating a phase of the CTE sampled during the first sampling time slot among the plurality of sampling time slots, referred to as a first phase; sampling the CTE during a second sampling time slot of the plurality of sampling time slots using a second antenna element of the plurality of antenna elements; sampling the CTE during a third sampling time slot of the plurality of sampling time slots using the first antenna element of the plurality of antenna elements; calculating a phase of the CTE sampled during the third sampling time slot among the plurality of sampling time slots, referred to as a third phase; comparing the first phase to the third phase; as well as If the difference between the first phase and the third phase is greater than a threshold, the action is performed in response to detecting the malicious attack.

6. The network device according to claim 5, wherein: The instructions enable the network device to: calculating a phase of the CTE sampled during the second sampling time slot among the plurality of sampling time slots, referred to as a second phase; sampling the CTE during a fourth sampling time slot of the plurality of sampling time slots using the second antenna element of the plurality of antenna elements; calculating a phase of the CTE sampled during the fourth sampling time slot among the plurality of sampling time slots, referred to as a fourth phase; comparing the second phase to the fourth phase; as well as If the difference between the second phase and the fourth phase is greater than the threshold, the action is performed in response to detecting the malicious attack.

7. The network device according to claim 5, wherein: The instructions enable the network device to: If the difference is less than the threshold, the arrival angle of the tag device is calculated.

8. A method for detecting a malicious attack during an angle of arrival operation, comprising: generating an antenna switching pattern using a network device, wherein the network device includes a wireless network interface, wherein the wireless network interface includes an antenna array having a plurality of antenna elements and an analog multiplexer, wherein the wireless network interface receives incoming signals from the antenna elements and generates I signals and Q signals associated with the antenna elements; receiving, using the network device, a packet transmitted by a tag device, the packet comprising a constant tone extension (CTE), wherein the CTE comprises a tone having a known frequency, and wherein the CTE comprises a plurality of switching time slots and a plurality of sampling time slots, wherein the antenna element used to receive each sampling time slot is determined according to the antenna switching pattern; and In response to a detected malicious attack, an action is performed based on phase information obtained from the CTE by one of the plurality of antenna elements during two or more sampling time slots.

9. The method according to claim 8, wherein: The action is selected from the group consisting of: discarding the location information of the tag device; Warning to the operator; Recording incidents; and Change radio parameters.

10. The method according to claim 8, wherein: The antenna switching pattern is randomly generated.

11. The method of claim 8, further comprising detecting the malicious attack by: attempting to determine the angle of arrival based on phase information from the received CTE using an AoA algorithm; and If the AoA algorithm cannot identify the angle of arrival, a malicious attack is detected.

12. The method of claim 8, further comprising detecting the malicious attack by: sampling the CTE using a first antenna element of the plurality of antenna elements during a first sampling time slot of the plurality of sampling time slots; calculating a phase of the CTE sampled during the first sampling time slot among the plurality of sampling time slots, referred to as a first phase; sampling the CTE using a second antenna element of the plurality of antenna elements during a second sampling time slot of the plurality of sampling time slots; sampling the CTE using the first antenna element of the plurality of antenna elements during a third sampling time slot of the plurality of sampling time slots; Calculating a phase of the CTE sampled during the third sampling time slot among the plurality of sampling time slots, referred to as a third phase; comparing the first phase with the third phase; as well as If the difference between the first phase and the third phase is greater than a threshold, a malicious attack is detected.

13. The method of claim 12, further comprising calculating an angle of arrival of the tag device if the difference is less than the threshold.

14. The method according to claim 12, further comprising: calculating a phase of the CTE sampled during the second sampling time slot among the plurality of sampling time slots, referred to as a second phase; sampling the CTE using the second antenna element of the plurality of antenna elements during a fourth sampling time slot of the plurality of sampling time slots; Calculating a phase of the CTE sampled during the fourth sampling time slot among the plurality of sampling time slots, referred to as a fourth phase; comparing the second phase with the fourth phase; as well as If the difference between the second phase and the fourth phase is greater than the threshold, the action is performed in response to detecting the malicious attack.

15. A computer program product comprising instructions which, when executed by a processing unit disposed on a network device comprising a wireless network interface, wherein: The wireless network interface includes an antenna array having a plurality of antenna elements and an analog multiplexer, wherein the wireless network interface receives incoming signals from the antenna elements and generates I signals and Q signals associated with the antenna elements, enabling the network device to: generating an antenna switching pattern; receiving a packet including a constant tone extension (CTE) from a tag device, wherein the CTE includes a tone having a known frequency, and wherein the CTE includes a plurality of switching slots and a plurality of sampling slots, wherein the antenna element used to receive each sampling slot is determined according to the antenna switching pattern; and Based on phase information obtained from the CTE by one of the plurality of antenna elements during two or more sampling time slots, an action is performed if a malicious attack is identified.

16. The computer program product of claim 15, wherein: The action is selected from the group consisting of: discarding the location information of the tag device; Warning to the operator; Recording incidents; and Change radio parameters.

17. The computer program product of claim 15, wherein: The antenna switching pattern is randomly generated.

18. The computer program product of claim 15, further comprising instructions for enabling the network device to: attempting to determine the angle of arrival based on phase information from the received CTE using an AoA algorithm; and If the AoA algorithm fails to identify the angle of arrival, a malicious attack is detected and the actions are performed in response to detecting the malicious attack.

19. The computer program product of claim 15, further comprising instructions for enabling the network device to: sampling the CTE during a first sampling time slot of the plurality of sampling time slots using a first antenna element of the plurality of antenna elements; calculating a phase of the CTE sampled during the first sampling time slot among the plurality of sampling time slots, referred to as a first phase; sampling the CTE during a second sampling time slot of the plurality of sampling time slots using a second antenna element of the plurality of antenna elements; sampling the CTE during a third sampling time slot of the plurality of sampling time slots using the first antenna element of the plurality of antenna elements; calculating a phase of the CTE sampled during the third sampling time slot among the plurality of sampling time slots, referred to as a third phase; comparing the first phase to the third phase; as well as If the difference between the first phase and the third phase is greater than a threshold, the action is performed in response to detecting a malicious attack.

20. The computer program product of claim 19, further comprising instructions for enabling the network device to: calculating a phase of the CTE sampled during the second sampling time slot among the plurality of sampling time slots, referred to as a second phase; sampling the CTE during a fourth sampling time slot of the plurality of sampling time slots using the second antenna element of the plurality of antenna elements; calculating a phase of the CTE sampled during the fourth sampling time slot among the plurality of sampling time slots, referred to as a fourth phase; comparing the second phase to the fourth phase; as well as If the difference between the second phase and the fourth phase is greater than the threshold, the action is performed in response to detecting the malicious attack.

21. The computer program product of claim 19, further comprising instructions for enabling the network device to: If the difference is less than the threshold, the arrival angle of the tag device is calculated.

Images