Early launch late detection attack detection

Abstract

The invention relates to early launch late detection attack detection. In one embodiment, a method includes receiving, by a first device (110), a first signal, determining, by the first device (110), a detection metric indicative of a deviation between the first signal (110) and a reference signal, and performing, by the first device (110), an action based on the detection metric and a detection threshold level.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Patent Application No. 63 / 511,768, filed on July 3, 2023, entitled “EARLY COMMIT LATE DETECT ATTACKDETECTION,” which is incorporated herein by reference. Technical Field

[0003] The present disclosure relates generally to electronic systems and methods, and in certain embodiments, to systems and methods for early commit late detect (ECLD) attack detection. Background Art

[0004] In a wireless communication environment, an early launch late detection (ECLD) attack can occur when an attacking device learns the symbol of a transmitted signal in advance during a communication phase between two devices and launches the symbol later in the communication phase in an attempt to deceive the receiving device in terms of the arrival time of the transmitted signal, and therefore the proximity of the transmitting device to the receiving device. In turn, if successful, the receiving device can perform an action based on the signal, such as unlocking a device (e.g., a vehicle door, a hotel door) for the attacker. Summary of the invention

[0005] Some embodiments advantageously improve wireless transmissions.

[0006] In some embodiments, increasing the bandwidth-time product (BT) during transmission of a message may advantageously reduce symbol transmission time, which may advantageously help prevent early launch late detection (ECLD) attacks.

[0007] In some embodiments, increasing the bandwidth-time product (BT) during the authentication phase may advantageously prevent early-emission late detection (ECLD) attacks when authenticating or attempting to authenticate a device or signal.

[0008] In some embodiments, a lower BT is used during the communication phase, which may advantageously improve coexistence with other radio devices during the communication phase.

[0009] In some embodiments, a lower BT is used during a communication phase that occurs after an authentication phase using a higher BT. Using a lower BT during a communication phase that occurs after an authentication phase using a higher BT may advantageously allow for a secure communication phase with improved coexistence with other RF devices.

[0010] In some embodiments, a higher BT is used only for (e.g., some) data communication channels (e.g., for channel sounding), while a lower BT is used for a primary (e.g., advertising) communication channel. By using a lower BT in the primary communication channel, some embodiments can advantageously improve coexistence with other RF devices during the communication phase.

[0011] In some embodiments, increasing the BT transmitted during transmission of round trip time (RTT) packets can advantageously increase security for performing distance measurements (eg, using channel probing), for example, by preventing ECLD attacks.

[0012] In some embodiments, a higher BT advantageously causes increased distortion of the signal received during the attack.Such increased distortion may advantageously be detectable by determining a detection metric indicative of a deviation between the received signal and a reference signal.

[0013] In some embodiments, such detection metrics include or are based on a signal-to-noise ratio (SNR) of the received signal.

[0014] In some embodiments, such detection metrics include or are based on a received signal strength indicator (RSSI).

[0015] In some embodiments, using a filter with a wider bandwidth to filter received signals with a higher BT, and using a filter with a narrower bandwidth to filter received signals with a lower BT, advantageously allows for more optimized filtering of the received signals (e.g., compared to using the same filter to filter all received signals).

[0016] According to one embodiment, a method includes receiving, by a first device, a first signal; determining, by the first device, a detection metric indicative of a deviation between the first signal and a reference signal; and performing, by the first device, an action based on the detection metric and a detection threshold level.

[0017] According to one embodiment, a method includes: receiving, by a first device, a first signal from a second device; determining, by the first device, a detection metric indicating a deviation between the first signal and a reference signal; determining, by the first device, a signal-to-noise ratio (SNR) associated with the first signal; determining, by the first device, that the first signal is authentic when the SNR is above an SNR threshold and the detection metric is below a detection threshold; determining that the first signal is untrustworthy when the detection metric is above the detection threshold; performing an unlocking operation in response to determining that the first signal is authentic; and terminating communication with the second device in response to determining that the first signal is untrustworthy.

[0018] According to one embodiment, an apparatus includes: a receiver circuit; and a processor configured to: receive a first signal via the receiver circuit; determine an anomaly detection metric associated with the first signal; and perform an action based on the anomaly detection metric exceeding a detection threshold level.

[0019] According to one embodiment, a device includes: a receiver circuit; a detection circuit coupled to the receiver circuit; and an action circuit coupled to the detection circuit; wherein the receiver circuit is configured to receive a first signal; wherein the detection circuit is configured to determine a detection metric associated with the first signal; and wherein the action circuit is configured to perform an action based on the detection metric exceeding a detection threshold level.

[0020] According to one embodiment, a method includes: identifying, by a first device, a first bandwidth time (BT) value; transmitting, by the first device, a first signal using the first BT value during a first communication phase; and transmitting, by the first device, a second signal using a second BT value during a second communication phase, wherein the second BT value is less than the first BT value.

[0021] According to one embodiment, a device includes: a transmitter circuit; and a processor, which is configured to: use the transmitter circuit to transmit a first data packet using a first bandwidth time (BT) value; and use the transmitter circuit to transmit a second data packet using a second BT value lower than the first BT value during a second communication phase.

[0022] According to one embodiment, a method includes: receiving a first signal by a first device; determining a detection metric associated with the first signal; performing a comparison between the detection metric and a metric threshold level to produce an anomaly result; and detecting, by the first device, an anomaly based on the anomaly result indicating that the detection metric exceeds the metric threshold level.

[0023] According to one embodiment, a method includes receiving, by a first device, a first signal; determining an attack detection metric associated with the first signal; and detecting, by the first device, an attack based on the attack detection metric exceeding a detection threshold level.

[0024] According to one embodiment, a method includes: receiving, by a first device, a first signal; and in response to determining that the first signal deviates from a reference signal by more than a predetermined threshold, performing an action.

[0025] According to one embodiment, a method includes: transmitting, by a first device, an authentication data packet during an authentication phase; receiving, by a second device, the authentication data packet; determining a normalized attack detection metric (NADM) associated with the authentication data packet; and detecting, by the second device, an attack when the NADM is above a predetermined NADM threshold.

[0026] According to one embodiment, a wireless device includes: a receiver circuit configured to: receive an authentication packet; determine a normalized attack detection metric (NADM) associated with the authentication packet; and detect an attack when the NADM is above a predetermined NADM threshold. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] For a more complete understanding of the present invention(s) and advantages thereof, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:

[0028] Figure 1A and Figure 1B A block diagram of a system according to an embodiment of the present disclosure is shown;

[0029] Figure 2 A method of transmitting signals between elements of a system according to an embodiment of the present disclosure is shown;

[0030] Figure 3A and Figure 3B A sequence diagram of a system according to an embodiment of the present disclosure is shown;

[0031] Figure 4 shows phase trajectories and instantaneous frequency deviations for three symbol periods according to an embodiment of the present disclosure;

[0032] Figure 5A , Figure 5B and Figure 5C The embodiment according to the present disclosure is shown Figure 1A and Figure 1B The waveform associated with the device;

[0033] Fig. 6A and Figure 6B Waveforms associated with signals transmitted by a device using different bandwidth-time product values ​​(BT) are shown;

[0034] Figure 7 Various parameters that may affect the Total Attack Delay (TAD) according to an embodiment of the present invention are shown;

[0035] Figure 8 shows a table illustrating various parameters of a wireless communication channel and the associated impact on the detectability of a man-in-the-middle (MITM) attack according to an embodiment of the present invention;

[0036] Fig. 9 shows the manipulated signal when the device transmits symbols using BT=2.0 and modes LE1M and LE2M;

[0037] Fig.10 shows a Noise Attack Detection Metric (NADM) curve associated with a signal received by a device;

[0038] Fig.11 NADM curves for modes LE1M and LE2M are shown;

[0039] Fig.12 NADM curves for different pseudo-random noise (PN) sequences are shown;

[0040] Fig.13 NADM curves for different receiver bandwidths (BW) are shown;

[0041] Fig.14 NADM curves for different oversampling ratios (OSR) are shown;

[0042] Fig.15 shows a NADM curve for a specific parameter set according to an embodiment of the present invention; and

[0043] Figure 16-Figure 23 NADM curves for different parameter sets are shown.

[0044] Corresponding numerals and symbols in the different figures generally refer to corresponding parts unless otherwise indicated.The figures are drawn to clearly illustrate the relevant aspects of the preferred embodiments and are not necessarily drawn to scale. DETAILED DESCRIPTION

[0045] The making and using of the disclosed embodiments are discussed in detail below. However, it should be understood that the present disclosure provides many applicable inventive concepts that can be embodied in a wide variety of specific contexts. The specific embodiments discussed are merely illustrative of specific ways to make and use the invention(s) and do not limit the scope of the invention(s).

[0046] The following description explains various specific details to provide a deep understanding of several example embodiments according to the description. These embodiments can be obtained without one or more of the specific details, or obtained using other methods, components, materials, etc. In other cases, known structures, materials, or operations are not shown or described in detail to avoid confusing different aspects of the embodiments. References to "embodiments" in this specification indicate that a specific configuration, structure, or feature described in the embodiment is included in at least one embodiment. Therefore, phrases such as "in one embodiment" that may appear at different points in this specification do not necessarily refer to the same embodiment completely. In addition, in one or more embodiments, specific formations, structures, or features may be combined in any appropriate manner.

[0047] Embodiments of the present disclosure will be described in specific contexts, such as early launch late detection (ECLD) attack prevention and detection of unlocked vehicles, for example, using Bluetooth Low Energy (BLE). Some embodiments may be used in other applications, such as for access control in hotel rooms or businesses, and using other wireless communication protocols. Some embodiments may be used in applications other than access control, such as controlling a first device based on the proximity of the second device to the first device and / or authenticating a second device by a first device based in part on the proximity of the second device to the first device.

[0048] For example, an ECLD attack can be understood as a type of network attack on devices that transmit and receive Bluetooth signals. A malicious device attempting to launch an ECLD attack can mimic the signal of one device to gain access or control of another device. For example, a malicious device can transmit a replicated signal from a smartphone to a vehicle in an attempt to unlock the vehicle and gain access to the interior of the vehicle. In this scenario, if the malicious device succeeds, the vehicle can receive the replicated signal and believe that the signal is from a smartphone or other authorized device, and perform an action based on the signal.

[0049] Existing solutions to prevent ECLD attacks may include, for example, randomizing the symbols transmitted from one device to another, shortening the pulse of the signal transmitted from one device to another, and limiting proximity and distance to shorter values. However, some of these solutions require additional circuit system components, which may increase the cost and design area of ​​the system for access control, and / or may affect the performance of the device.

[0050] Embodiments related to improved detection systems, devices, and methods for preventing and detecting ECLD attacks are disclosed herein. In one embodiment, for example, when the second device uses a bandwidth-time product (BT) or a bandwidth-bit-period product (e.g., equal to 2), a first device (e.g., a vehicle) interacting with a second device (e.g., a key fob or another device acting as a key fob) detects an attack, such as an ECLD or MITM attack, based on a normalized attack detector metric (NADM) value of a receiver signal received by the first device, where NADM can be understood as a metric where the closer the received signal is to an ideal signal, the lower the metric. In some embodiments, when the signal-to-noise ratio (SNR) of the receiver signal is above an SNR threshold and the NADM value is above a NADM threshold, an ECLD attack is detected and an action is taken in response (e.g., not authenticating the second device, not unlocking the door, etc.). In some embodiments, when the receiver signal strength indicator (RSSI) of the receiver signal is above an RSSI threshold and the NADM value is above a NADM threshold, an ECLD attack is detected and an action is taken in response (e.g., not authenticating the second device, not unlocking the door, etc.).

[0051] In some embodiments, a method for preventing ECLD attacks is provided. The method includes receiving a first signal by a first device, determining a detection metric by the first device indicating a deviation between the first signal and a reference signal, and performing an action by the first device based on the detection metric and a detection threshold level.

[0052] In another exemplary embodiment, a method for preventing ECLD attacks is provided, including receiving a first signal from a second device by a first device, determining, by the first device, a detection metric indicating a deviation between the first signal and a reference signal, determining, by the first device, a signal-to-noise ratio (SNR) associated with the first signal, determining that the first signal is authentic when the SNR is above an SNR threshold and the detection metric is below a detection threshold, determining that the first signal is untrustworthy when the detection metric is above the detection threshold, performing an unlocking operation in response to determining that the first signal is authentic, and terminating communication with the second device in response to determining that the first signal is untrustworthy.

[0053] In another example embodiment, an apparatus is provided that includes a receiver circuit and a processor. The processor is configured to receive a first signal via the receiver circuit, determine an anomaly detection metric associated with the first signal, and perform an action based on the anomaly detection metric exceeding a detection threshold level.

[0054] In another example embodiment, a device including a receiver circuit, a detection circuit, and an action circuit is provided. The detection circuit can be coupled to the receiver circuit. The action circuit can be coupled to the detection circuit. The receiver circuit can be configured to receive a first signal. The detection circuit can be configured to determine a detection metric associated with the first signal. The action circuit can be configured to perform an action based on the detection metric exceeding a detection threshold level.

[0055] In another example embodiment, a method for preventing ECLD attacks is provided. The method includes identifying a first bandwidth time (BT) value by a first device, transmitting a first signal by the first device using the first BT value during a first communication phase, and transmitting a second signal by the first device using a second BT value during a second communication phase, wherein the second BT value is less than the first BT value.

[0056] In another example embodiment, a device including a transmitter circuit and a processor is provided. The processor may be configured to use the transmitter circuit to transmit a first data packet using a first bandwidth time (BT) value, and to use the transmitter circuit to transmit a second data packet using a second BT value lower than the first BT value during a second communication phase.

[0057] In another exemplary embodiment, a method for preventing ECLD attacks is provided, including receiving a first signal by a first device, determining a detection metric associated with the first signal, performing a comparison between the detection metric and a metric threshold level to produce an abnormal result, and detecting an abnormality by the first device based on the abnormal result indicating that the detection metric exceeds the metric threshold level.

[0058] In another example embodiment, a method includes receiving, by a first device, a first signal, determining an attack detection metric associated with the first signal, and detecting, by the first device, an attack based on the attack detection metric exceeding a detection threshold level.

[0059] In another example embodiment, a method includes receiving, by a first device, a first signal, and in response to determining that the first signal deviates from a reference signal by more than a predetermined threshold, performing an action.

[0060] In yet another exemplary embodiment, a method is provided that includes transmitting, by a first device, an authentication data packet during an authentication phase, receiving, by a second device, the authentication data packet, determining a normalized attack detection metric (NADM) associated with the authentication data packet, and detecting, by the second device, an attack when the NADM is above a predetermined NADM threshold.

[0061] In yet another example embodiment, a wireless device including a receiver circuit is provided. The receiver circuit may be configured to receive an authentication packet, determine a normalized attack detection metric (NADM) associated with the authentication packet, and detect an attack when the NADM is above a predetermined NADM threshold.

[0062] Some embodiments disclosed herein advantageously result in improvements in protection against early launch late detection attacks. Some embodiments may prevent attacks on devices and systems by manipulating signals transmitted between devices so that attacks on devices are detectable. Advantageously, systems, methods, and devices for preventing ECLD attacks may not only increase the robustness of secure devices providing access, but may also reduce design area requirements and costs by utilizing existing transceiver circuitry to generate filterable distortion to detect attacks while complying with Bluetooth communication standards and protocols.

[0063] Figure 1A and Figure 1B A block diagram of a system according to an embodiment of the present disclosure is shown. Figure 1A An operating environment 101 is included, and the operating environment 101 includes a device 105, a device 110 and components thereof. Figure 1BThe operating environment 102 is included, and the operating environment 102 also includes devices 105, devices 110 and components thereof, and further includes attack devices 120-1 and 120-2. Device 105 includes circuit system 106 and processor 108. Device 110 includes circuit system 111 and processor 115. In various examples, devices 105 and 110 perform early launch late detection (ECLD) attack prevention processes, such as Figure 2 Method 200. Thus, devices 105 and 110 may implement such processes in hardware, software, firmware, or any combination or variation thereof.

[0064] First reference Figure 1A , operating environment 101 represents an environment including device 105 and device 110 that wirelessly communicate with each other. Device 105 can represent any device, apparatus, or system that can transmit signals to and receive signals from device 105 using a wireless communication protocol (such as Bluetooth or BLE). For example, in some embodiments, device 105 can be a key card or a smart phone. Similarly, device 110 can represent any device, apparatus, or system that can transmit signals to and receive signals from device 105 via a wireless communication protocol. In some embodiments, device 110 can be a vehicle, a hotel room keyboard, or any other device configured to provide wireless access control. In some embodiments, the wireless communication between devices 105 and 110 uses Gaussian frequency shift keying (GFSK).

[0065] In various embodiments, devices 105 and 110 include components capable of establishing wireless communications between each other, performing actions based on signals received from each other, and preventing ECLD attacks. For example, device 105 includes circuit system 106 and processor 108, and device 110 includes circuit system 111 and processor 115.

[0066] Circuitry 106 and circuitry 111 may represent one or more hardware components capable of transmitting, receiving, and processing signals transmitted over a wireless network. In some embodiments, examples of circuitry 106 and 111 may include communication equipment, antennas, transmitting circuitry and receiver circuitry (e.g., transceivers), logic devices, amplifiers and buffers, filters, analog-to-digital converters, and the like. Specifically, in such embodiments, circuitry 106 may include transceiver 107, and circuitry 111 may include transceiver 112, detection circuitry 113, and action circuitry 114. In some embodiments, additional circuitry may be included in or outside of devices 105 and 110. For example, in some embodiments, devices 105 and 110 may include or use one or more antennas located outside of devices 105 and 110 (e.g., coupled to circuitry 106 and 111, respectively) to facilitate communication between devices 105 and 110.

[0067] Processors 108 and 115 may represent one or more processors, processing cores, processing circuits or devices, etc., capable of controlling circuitry 106 and 111 and other aspects of devices 105 and 110, respectively.

[0068] In some embodiments, each of processors 108 and 115 may be implemented as a general or custom controller or processor that is coupled to a memory and capable of executing instructions stored in the memory. In some embodiments, examples of processors 108 and 115 may include one or more general or custom microcontrollers, DSPs, general purpose central processing units, dedicated processors or circuits (e.g., ASICs), and / or logic devices (e.g., FPGAs), as well as any other type of processing device, combination, or variation thereof.

[0069] In some embodiments, the processor 115 includes and / or implements the functionality of the detection circuit 112 and / or the action circuit 114 .

[0070] In some embodiments, processor 115 and circuit system 111 are part of a controller of device 110, where device 110 also includes a host (not shown) that communicates with the controller using a host-controller interface (HCI), where the host includes a processor. In such embodiments, the host and controller may be implemented in separate integrated circuits, or may be implemented in the same integrated circuit.

[0071] In some embodiments, processor 108 and circuit system 106 are part of a controller of device 105, where device 105 also includes a host (not shown) that communicates with the controller using HCI, where the host includes a processor. In such embodiments, the host and controller can be implemented in separate integrated circuits, or can be implemented in the same integrated circuit.

[0072] In operation, devices 105 and 110 may perform several communication phases via circuit systems 106 and 111 and processors 108 and 115 to establish communication between each other, authenticate each other, and provide signals and other data to each other. A first communication phase may include an authentication phase (authentication check 116). A second communication phase may include a data communication phase (data communication 117). Other communication phases may occur between devices 105 and 110, such as a signal negotiation phase and other phases.

[0073] In operation, device 110 may initiate an authentication phase to verify that device 105 is an authorized device and that subsequently received signals are authentic signals. During the authentication process, devices 105 and 110 may perform an authentication check 116. Authentication check 116 may begin when device 110 (or device 105 in other examples) transmits an authentication message (e.g., a message having a bit sequence known to both devices 105 and 110) to device 105. In some embodiments, the authentication message may be or include a round trip time (RTT) packet (e.g., an RTT packet is sent by device 110 to device 105, received by device 105 and sent back to device 110 by device 105, and received by device 110, wherein the time between the transmission of the RTT packet by device 110 and the reception of the RTT packet by device 110 may be used to determine the distance between devices 105 and 110). Device 105 may receive the RTT packet during the authentication check 116 and transmit a signal including known bits (or data based on known bits) to device 110. The device 105 may transmit a signal (e.g., an authentication data packet) via the circuit system 106 and the processor 108 using a bandwidth-time product (BT) of 2.0. In some embodiments, when a BT of 2.0 is used to transmit a signal, the device 105 uses a 128-bit pseudo-random noise (PN) sequence to transmit a signal. In some embodiments, when a BT of 2.0 is used to transmit a signal, the device 105 uses a PN sequence of different sequence lengths to transmit a signal, such as 32 bits, 64 bits, or 96 bits and other sequence lengths (in some embodiments, the sequence length may be optional). In this way, relative to a signal transmitted using a lower value of the BT product (e.g., BT is 0.5), the device 105 can transmit a distorted signal having a shorter symbol period and a higher signal-to-noise ratio (SNR). In some embodiments, the device 105 may transmit a signal using a Bluetooth or low-power Bluetooth (BLE) communication protocol. In some such embodiments, the device 105 may transmit a signal using a Bluetooth LE2M mode. In some embodiments, the device 105 may transmit a signal using Gaussian frequency shift keying (GFSK).

[0074] Device 110 can receive a distorted signal, filter out noise using circuit system 111 and determine whether the received signal is credible (e.g., an attack signal, anomaly). In some embodiments, this may require determining a detection metric of the received signal via detection circuit 113. Detection circuit 113 may represent one or more circuits or devices (e.g., a hardware accelerator) configured to receive a signal, filter the received signal, and compare the received signal to a reference signal to determine a detection metric. In some embodiments, the detection metric may indicate a deviation between the received signal and a reference signal comprising a known predetermined bit sequence. For example, the detection metric may be a normalized attack detection metric (NADM).

[0075] To determine the detection metric, the detection circuit 113 may be configured to determine the difference between the first signal and the reference signal throughout the transmission period during the authentication phase and accumulate the difference. In some embodiments, determining the detection metric may include determining the root mean square of the received signal relative to the reference signal.

[0076] In some embodiments, the detection circuit 113 may also be configured to determine a received signal strength indicator (RSSI) associated with the received signal. In some embodiments, the detection circuit 113 may also be configured to determine a SNR of the received signal.

[0077] After determining the detection metric, the detection circuit 113 may be configured to compare the detection metric with a detection threshold level. In some embodiments, the detection threshold level may be a predetermined value corresponding to the quality of the filtering capability of the detection circuit 113. For example, the detection threshold level may correspond to the amount of distortion that may be filtered by the detection circuit 113 to determine whether the received signal is credible. In some embodiments, the detection threshold level may be based on the correlation between the received signal and the reference signal. In some embodiments, the detection threshold may be based on a minimum detection metric of a manipulated or abnormal signal indicating a MITM attack on the device. In some such embodiments, the detection threshold may include a first value corresponding to an approximate detection value. In some embodiments, the detection threshold may include a range of values ​​corresponding to a detection range. In some embodiments, the detection threshold may be further based on an SNR threshold and / or an RSSI threshold.

[0078] In the embodiment where the detection circuit 113 determines RSSI and SNR values, the detection circuit 113 can be configured to compare the corresponding value with the corresponding threshold level. For example, the detection circuit 113 can be configured to compare the RSSI of the received signal with the RSSI threshold. Similarly, the detection circuit 113 can be configured to compare the SNR of the received signal with the SNR threshold. In some such embodiments, the SNR threshold can correspond to the SNR level according to the Bluetooth communication protocol standard. In some such embodiments, the SNR threshold can include a value of approximately 19dB. In some such embodiments, the SNR threshold can include a value range between approximately 17-20dB.

[0079] Based on determining one or more metrics associated with the received signal relative to the reference signal and comparing the one or more metrics to corresponding threshold levels, the detection circuit 113 can generate a comparison result indicating whether the received signal is authentic and provide the comparison result to the action circuit 114.

[0080] The action circuit 114 may represent one or more circuits or devices capable of obtaining a comparison result, identifying a value or consequence associated with the comparison result, and performing an action based on the value or consequence. For example, in response to obtaining a comparison result and determining that the comparison result indicates that one or more of the metrics (e.g., the detection metric) has fallen below a corresponding threshold level (e.g., the detection threshold level), the action circuit 114 may be configured to perform an action corresponding to an unlock event (e.g., unlocking the vehicle, unlocking the door, unlocking the device).

[0081] In some embodiments, in response to obtaining the comparison result and determining that the comparison result indicates that one or more of the metrics exceeds the corresponding threshold level, the action circuit 114 can be configured to refuse to perform the action. In some embodiments, the action circuit 114 can be configured to not perform the unlock action. In some embodiments, the action circuit 114 can be configured to stop or terminate communication with the device 105 (i.e., not authenticate the device 105 and continue to further communication stages).

[0082] In some embodiments, determining whether to perform an action may alternatively or additionally require determining a distance between devices 105 and 110 based on an arrival time (e.g., phase) of a received signal and a transmission time of an RTT packet from device 110 (e.g., a round trip delay (RTT) of an authentication message sent from device 105 or device 110). In some examples, the distance may include a threshold distance range (e.g., 0 to 3 meters).

[0083] In some embodiments, if device 110 determines that the distance between devices 105 and 110 is outside a threshold distance range, device 110 may determine not to perform an action, regardless of whether the received signal is authentic. In some embodiments, if device 110 determines that the distance between devices 105 and 110 is within a threshold distance range, device 110 may determine to perform an action if device 110 determines that the received signal is authentic. In some embodiments, device 110 may determine that the signal is not authentic, and therefore may not perform an action even if the determined distance is within a threshold distance range.

[0084] In some embodiments, the distance determination is performed only after the received signal is determined to be credible. In some embodiments, the distance determination is performed regardless of whether the received signal is credible. In some embodiments, the distance determination is performed before determining whether the received signal is credible.

[0085] For example, in some embodiments, device 110 may be a vehicle and device 105 may be a key fob (or a smartphone or other device that functions as a key fob). Based on the arrival time (e.g., phase) of the authentication message that device 110 receives from device 105 during authentication check 116, device 110 may determine the proximity between the devices. If device 105 is less than a predetermined threshold (e.g., 1 meter) from device 110, device 110 may take an action, such as unlocking the vehicle, enabling the unlocking capability of the vehicle (e.g., upon pressing a button in the handle of the vehicle), etc.

[0086] After successful authentication of device 105, devices 105 and 110 may perform data communication 117 during a communication phase. Data communication 117 may include transmission of data and other signals from device 105 to device 110. In some embodiments, data communication 117 between devices 105 and 110 may occur continuously or independently of authentication check 116. Regardless of how and when data communication 117 occurs, device 105 may transmit signals during data communication 117 with a different, lower BT product relative to signals transmitted during authentication check 116. For example, in some embodiments, during this communication phase, device 105 may not intentionally distort signals to introduce noise and delay in the transmitted signals. In some embodiments, device 105 may transmit signals via transceiver 107 with a BT product lower than the BT used during the authentication phase (such as 0.5 in an embodiment where a BT of 2.0 is used during the authentication phase). Therefore, the signals transmitted during the communication phase may have reduced noise and delay relative to the signals transmitted during the authentication phase.

[0087] Next reference Figure 1B , operating environment 102 represents an environment including device 105, device 110, and attack devices 120-1 and 120-2 (collectively referred to as attack devices 120), wherein attack device 120 attempts to wirelessly communicate with devices 105 and 110 to perform an ECLD attack on device 110.

[0088] Attack device 120 may represent any device, apparatus, or system capable of communicating with devices 105 and 110 and with each other. In various examples, attack device 120 may be referred to as a man-in-the-middle (MITM) device that may manipulate communications between devices 105 and 110 and cause device 110 to receive an authentication message during authentication check 116 that appears to arrive earlier than would have been the case without the actions of attack device 120. In such examples, attack device 120-1 may be located near device 105, and attack device 120-2 may be located near device 110. Attack devices 120-1 and 120-2 may be connected to each other via a physical cable or some other high-speed communication mechanism.

[0089] like Figure 1A and Figure 1B As shown, scenario 102 is similar to scenario 101, but with an attacking device 120 that is used to relay / forward communications between devices 105 and 110. In scenario 102, devices 105 and 110 are far away from each other and outside of Bluetooth communication range.

[0090] In operation, the attacking device 120 may attempt to perform an authentication check 116 between the device 105 and the device 110 via a physical link between the attacking device 120 (the devices 105 and 110 may be outside the Bluetooth communication range or within the Bluetooth communication range, but the attacking device 120 may communicate with the devices 105 and 110 using a stronger signal than the normal communication between the devices 105 and 110) to attempt to gain access to the device 110 via an ECLD attack.

[0091] To begin the authentication phase, device 110 may transmit a signal including an RTT packet, which may be relayed from device 110 to device 105 by attack device 120. In response to receiving the RTT packet, device 105 may transmit an authentication signal with a bandwidth-time (BT) product of 2.0. The BT product of the authentication signal may be a higher BT product relative to other signals transmitted by device 105 during other phases. Attacker device 120-1 may intercept the degraded signal, attempt to predict the bit sequence of the degraded signal (trying to replicate the signal transmitted by device 105), and transmit the signal to attacker device 120-2 for further transmission to device 110. More specifically, in some embodiments, attacker device 120 begins transmitting the "relayed" bits before receiving them (based on the prediction), and then makes adjustments (flips bits) if the prediction is wrong. If device 120 determines that the prediction is wrong too late due to noise based on the BT product of the authentication signal, it needs to boost the flipped bits to recover from the bad prediction. The later a bad prediction is identified, the more boost the flipped bit needs to have, and the more distortion is applied to the signal, making it more recognizable.

[0092] Device 110 may receive a signal from attack device 120 and determine whether the received signal is credible. Determining whether the received signal is credible may include determining a detection metric of the received signal. In some embodiments, determining whether the received signal is credible may include determining an SNR and RSSI of the received signal. If the detection metric, SNR, or RSSI of the received signal exceeds a corresponding threshold, device 110 may determine that the received signal is untrustworthy. Additionally or alternatively, determining whether the received signal is credible may require determining a distance between devices 105 and 110 based on the received signal.

[0093] In an example including an attack device 120, device 110 may determine that the received signal is untrustworthy using any of the above methods. For example, device 110 may determine that the round-trip delay time between transmitting the authentication signal and receiving the return signal exceeds a predetermined threshold. The delay may occur based on the BT product used by device 105 to transmit the signal because the attack device 120-1 may experience problems predicting and relaying the signal due to poor signal quality. It can be seen that the BT product used to transmit the signal may also affect the detection metric, RSSI and / or SNR of the signal copied by the attack device 120-1. Therefore, after determining that the received signal is untrustworthy, device 110 may not authorize access or perform an action. As a result, in some examples, device 110 may further terminate data communication 117 between devices 105.

[0094] For example, device 110 may be a vehicle parked in a driveway of a house, and device 105 may be located in a master bedroom of the house (e.g., up to 20 meters from device 110). Attacker device 120 may be divided into two nodes, a first node (attack device 120-1) being close to the master bedroom of the house (close to device 105), and a second node (attack device 120-2) being close to the vehicle (close to device 110), wherein the two attacker devices 120 are connected via a physical cable or some other high-speed communication mechanism. When attacker device 120 receives an authentication message from device 105 (e.g., using attack device 120-1), attacker device 120 may attempt to predict the next symbol and transmit the predicted symbol to device 110 (e.g., using attack device 120-2), thereby causing device 110 to receive the authentication message earlier than the time the authentication message would arrive without attack device 120. Thus, based on the shortened arrival time, device 110 may determine that an ECLD attack has occurred and refuse to perform an action, such as unlocking one or more doors of the vehicle.

[0095] In some embodiments, the following equation may represent the signal received by device 110 when attack device 120 does not intervene and introduce anomalies or attack signals, where h(t) represents the transfer function of a normal air channel (e.g., which may include delays, multipath reflections, attenuation, etc.), and s(t) represents the signal transmitted by device 105:

[0096] r1(t)=h(t)*s(t)

[0097] In some embodiments, the following equation may represent the signal received by device 110 when attack device 120 intervenes and device 110 receives signal r2(t) from attack device 120:

[0098] r2(t)=A*sM (t)

[0099] In some embodiments, device 110 eliminates or filters out most channel fading and multipath conditions. When device 110 performs attack or anomaly detection analysis (also referred to as NADM analysis) on the received signal, device 110 can avoid false positives associated with h(t) (e.g., detecting that r1(t) is not associated with an ECLD attack) and can be able to detect real attacks (e.g., detecting that r2(t) is manipulated by another device).

[0100] It should be understood that some examples including different systems or devices may be considered in the present disclosure. For example, device 105 may be a hotel key and device 110 may be a hotel room keypad. Other examples may include other electronic access control devices. Devices 105 and 110 may use the described techniques to prevent ECLD attacks from attacking device 120 attempting to gain unauthorized access.

[0101] Figure 2 A method of transmitting signals between elements of a system to prevent ECLD attacks according to an embodiment of the present disclosure is shown. Figure 2 Includes method 200, which refers to Figure 1A and Figure 1B The method 200 may be implemented in software, hardware, firmware, or any combination or variation thereof.

[0102] Method 200 may include a series of steps taken, for example, by or from the perspective of device 110, during one or more communication phases occurring between device 105 and device 110. In some embodiments, method 200 may include additional or fewer steps, including one or more steps taken by or from the perspective of device 105.

[0103] In operation 201, device 110 receives an authentication signal from device 105 via circuit system 111 (e.g., transceiver 112) during an authentication phase. In response to receiving an RTT packet sent from device 110, device 105 may transmit an authentication signal using a first bandwidth-time (BT) product of 2.0 via circuit system 106 (e.g., transceiver 107) to initiate an authentication phase. The authentication signal may include an authentication packet having a series of bits known to both device 105 and device 110. Device 105 may transmit a signal using a BT product of, for example, 2.0 so that a MITM (e.g., attack device 120) cannot reproduce the authentication signal sufficiently early and / or without substantial distortion. Increasing the BT product (e.g., from 0.5 to 2.0) may cause symbol transitions to occur faster, thereby advantageously reducing the amount of time that an attack device (e.g., 120) must correct a failed predicted bit, thereby increasing the distortion of the signal received by device 110, thereby increasing the likelihood of detecting an attack.

[0104] In operation 202, device 110 may receive an authentication signal, filter out noise using circuit system 111 (e.g., detection circuit 113), and determine whether the received signal is authentic. This may require determining a detection metric of the received signal, which may indicate a deviation between the received signal and a reference signal having a bit sequence known to device 110. In some embodiments, determining whether the received signal is authentic may also include determining an SNR and RSSI of the received signal. Additionally or alternatively, determining whether the received signal is authentic may require determining a distance between devices 105 and 110 based on the received signal.

[0105] In operation 203, device 110 can perform actions based on the determined metrics (e.g., detection metrics, SNR, RSSI, distance) and corresponding threshold levels. For example, if the detection metric, SNR or RSSI of the received signal exceeds the corresponding threshold, device 110 can determine that the received signal is unreliable. Similarly, if the distance exceeds the distance threshold, device 110 can determine that the received signal is unreliable. On the other hand, if the detection metric, for example, drops below the detection threshold level, device 110 can determine that the received signal is credible. The same is true for other metrics relative to the corresponding thresholds. In some embodiments, device 110 can determine that the received signal is credible based on the detection metric and SNR of the received signal both dropping below the corresponding threshold. Other combinations and variants can be considered.

[0106] Based on the device 110 determining that the received signal is authentic, the device 110 can perform an action including an authorization or unlocking operation. For example, the device 105 can be a key fob and the device 110 can be a vehicle. In response to the device 110 determining that the received signal is authentic, the device 110 can perform an action to unlock the vehicle.

[0107] After performing an action (e.g., authorization), devices 105 and 110 may initiate or continue to perform data communications. In various embodiments, the BT product used by device 105 to transmit data communications with device 110 may include a lower value, such as 0.5. As can be seen, data communications can utilize less noisy, faster transition signals.

[0108] In some embodiments, based on device 110 determining that the received signal is unauthentic, device 110 may perform actions including terminating communications between devices 105 and 110, locking operations, etc. In some embodiments, device 110 may refuse to perform actions including authorization or unlocking operations.

[0109] Figure 3A and Figure 3B A sequence diagram of a system according to an embodiment of the present disclosure is shown. Figure 3A Include reference Figure 1A A sequence 301 of elements of the operating environment 101 is provided. Figure 3B Include reference Figure 1B The sequence 302 of elements of the operating environment 102. The sequences 301 and 302 include the elements of Figure 1A and Figure 1B A series of operations taken by the elements of Figure 2 The steps of method 200 are as follows.

[0110] First reference Figure 3A , sequence 301 includes a series of communications and events that occur between device 105 and device 110. Sequence 301 may begin at step 310, when device 110 initiates an authentication phase to verify that device 105 is an authorized device and that subsequently received signals are authentic signals within a predetermined threshold. During the authentication phase, device 110 (or device 105 in other examples) may transmit an authentication message (e.g., a message having a bit sequence known to both devices 105 and 110) to device 105. In some embodiments, the authentication message may be a round-trip time (RTT) packet (e.g., an RTT packet is sent by device 110 to device 105, received by device 105, sent back to device 110 by device 105, and received by device 110, wherein the time between device 110 transmitting the RTT packet and device 110 receiving the RTT packet may be used to determine the distance between devices 105 and 110).

[0111] In step 311, device 105 may receive an RTT packet during authentication check 116, identify a first bandwidth time (BT) value, and utilize the value to transmit an authentication signal including known bits to device 110. The first BT value may include a BT value of 2.0 to prevent ECLD attacks.

[0112] In step 312, device 110 may receive a signal and filter out noise using circuit system 111. In some embodiments, device 110 may filter a signal having a BT of 0.5 using a filter having a first configuration, and filter a signal having a BT of 2.0 using a filter having a second configuration (or a different filter). Thus, in some embodiments, device 110 may filter a received signal during an authentication phase using a first filter, and filter a received signal during a communication phase using a second filter. In some embodiments, the first filter has a wider bandwidth than the second filter.

[0113] In some embodiments, in step 312, device 110 determines whether the received signal is authentic. This may require determining a detection metric of the received signal, which may indicate a deviation between the received signal and a reference signal having a bit sequence known to device 110. In some embodiments, determining whether the received signal is authentic may include determining an SNR and RSSI of the received signal. Additionally or alternatively, determining whether the received signal is authentic may require determining a distance between devices 105 and 110 based on the received signal.

[0114] In step 313, the device 110 compares the metric to a corresponding threshold level. For example, the device 110 may compare the determined detection metric to a detection threshold level, compare the RSSI to an RSSI threshold, compare the SNR to an SNR threshold, and / or compare the distance to a threshold distance. For example, in some embodiments, the detection threshold may be based on a minimum detection metric of a manipulated or abnormal signal indicating a MITM attack on the device. In some embodiments, the SNR threshold may correspond to an SNR level (e.g., 19 dB) according to a Bluetooth communication protocol standard. In some embodiments, the distance threshold may include a distance of approximately 3 meters.

[0115] Based on the results of the comparison between the identified metric and the corresponding threshold level, in step 314, the device 110 can perform an action. For example, if the detection metric drops below the detection threshold level, the device 110 can determine that the received signal is credible. The same is true for other metrics relative to the corresponding thresholds. In some embodiments, the device 110 can determine that the received signal is credible based on both the detection metric and the SNR of the received signal dropping below the corresponding threshold. Other combinations and variations are contemplated.

[0116] Based on the device 110 determining that the received signal is authentic and within the distance range, the device 110 can perform an action including an authorization or unlocking operation. For example, the device 105 can be a key fob and the device 110 can be a vehicle. In response to the device 110 determining that the received signal is authentic, the device 110 can perform an action to unlock the vehicle.

[0117] After performing an action (e.g., authorization), device 105 may initiate or continue to perform data communications during the communication phase in step 315. In various embodiments, the BT product used by device 105 to transmit data communications with device 110 may include a lower value, such as 0.5. As can be seen, data communications can utilize less noisy, faster transition signals.

[0118] Next reference Figure 3B , sequence 302 includes a series of communications and events that occur between device 105, device 110, and attack device 120. In sequence 302, attack device 120 may act as a malicious MITM device attempting to gain access to device 110.

[0119] In sequence 302, attacking device 120 may attempt to gain access to device 110 via an ECLD attack. During the authentication phase, in step 320, device 110 may transmit an RTT packet, which may be relayed (and possibly modified) from device 110 to device 105 by attacking device 120 if the two devices are not close enough to each other. In response to receiving the RTT packet, in step 321, device 105 may identify a BT value for transmitting an authentication signal to device 110, and transmit an authentication signal with the BT value identified by device 105 (e.g., a BT value of 2.0). In step 322, attacking device 120-1 may intercept the signal, attempt to predict the bit sequence of the degraded signal, and transmit a modified version of the signal to attacking device 120-2 for further transmission to device 110.

[0120] In step 323, device 110 may receive a signal from attacking device 120-2 and determine whether the received signal is authentic. This may require determining a detection metric of the received signal, which may indicate a deviation between the received signal and a reference signal having a bit sequence known to device 110. In some embodiments, determining whether the received signal is authentic may also include determining an SNR and RSSI of the received signal. Additionally or alternatively, determining whether the received signal is authentic may require determining a distance between devices 105 and 110 based on the received signal.

[0121] In step 324, the device 110 compares the metric to a corresponding threshold level. For example, the device 110 may compare the determined detection metric to a detection threshold level, compare the RSSI to an RSSI threshold, compare the SNR to an SNR threshold, and / or compare the distance to a threshold distance. For example, in some embodiments, the detection threshold may be based on a minimum detection metric of a manipulated or abnormal signal indicating a MITM attack on the device. In some embodiments, the SNR threshold may correspond to an SNR level (e.g., 19 dB) according to a Bluetooth communication protocol standard. In some embodiments, the distance threshold may include a distance of approximately 3 meters.

[0122] In step 325, device 110 may detect an attack against device 120 based on a comparison between the metric and a corresponding threshold level. For example, if the detection metric, SNR, or RSSI of the received signal exceeds a corresponding threshold, device 110 may determine that the received signal is untrustworthy and therefore the received signal is an attack signal including an anomaly indicative of ECLD.

[0123] In step 326, based on device 110 determining that the received signal is untrustworthy and the received signal is an attack signal, device 110 may perform actions including terminating communication between devices 105 and 110, locking operations, etc. In other words, device 110 may refuse to perform actions including authorization or unlocking operations.

[0124] Figure 4 Possible phase trajectories and instantaneous frequency deviations for three symbol periods according to an embodiment of the present disclosure are shown. Curve 402 represents the symbol (1,1,1). Curve 404 represents the symbol (1,1,0). Curve 406 represents the symbol (1,0,1). Curve 408 represents the symbol (1,0,0). Curve 410 represents the symbol (0,1,1). Curve 412 represents the symbol (0,1,0). Curve 414 represents the symbol (0,0,1). Curve 416 represents the symbol (0,0,0).

[0125] like Figure 4As shown, the last of the three symbols of any one of the curves 402, 404, 406, 408, 410, 412, 414, and 416 can be predicted based on the phase of the signal at the detection delay (DD) period of the second symbol. The DD period (also called the attack window) can be defined from the symbol boundary (e.g., zero crossing), and the DD period can be negative if the bit can be detected based on the Gaussian extension to the previous bit. The signal (r(t)) can include a message (m(t)) representing a time signal, which can be defined by the following equations:

[0126]

[0127] In the first equation, f c can be the carrier value, m(t) can be the message, may be the phase noise created by device 105, i(t) may be the interference value, and n(t) may be the noise received by device 110 or attacking device 120. In the second equation, α may represent the sign of the message, τ may represent the integration variable, p(t) may represent the Gaussian shape of the message, and T s It can indicate the period of a message.

[0128] like Figure 4 As shown, graphical representation 400 shows a signal including curves 402, 404, 406, 408, 410, 412, 414, and 416 at the top, and the derivatives of the signals are shown in the bottom four portions of the graph. The phase noise from device 105 or the above signal equation The attack window may be caused to shift (delay) to the right (making DD less negative or more positive), which may cause more distortion in the signal received by device 110 , ie, a change (eg, increase) in the phase of the signal received by device 110 .

[0129] Figure 5A 501, 502, and 503 are shown in an example where the attacking device 120 does not conduct an attack, and each includes a Figure 1B Waveforms 510 , 512 , and 514 associated with device 105 , attack device 120 , and device 110 . Figure 5B Graphical representations 501 , 504 , and 505 are shown in an example of an attack by attacking device 120 , including waveforms 510 , 516 , and 518 , respectively, associated with device 105 , attacking device 120 , and device 110 , respectively. Figure 5C Graphical representations 501 , 506 , and 507 are shown in an example of an attack by attacking device 120 , and include waveforms 510 , 520 , and 522 , respectively, associated with device 105 , attacking device 120 , and device 110 , respectively. Figure 5A , Figure 5B and Figure 5C Each waveform of may represent a derivative of a message (m(t)) transmitted by device 105, transmitted by attack device 120, and processed at device 110, respectively (eg, an internal signal of device 110 after filtering with a full symbol delay filter).

[0130] First reference Figure 5A In some embodiments, waveform 510 includes a bit sequence, such as "10100111", transmitted by device 105 to device 110. Figure 5A In the scenario shown, attack device 120 intercepts a signal transmitted by device 105 and forwards the signal to device 110 without modifying the signal, as shown by waveform 510. Waveform 514 shows the signal received by device 110. Figure 5A As shown, waveform 514 may be offset (e.g., due to the filtering effect of device 110) and includes the same bit sequence as waveforms 510 and 512, for example, but with a single cycle delay because the zero crossings of device 110 correspond to the zero crossings of device 105 (e.g., due to a full symbol delay filter).

[0131] exist Figure 5B , the attack device 120 may generate waveform 516 while attempting to predict the bit sequence of waveform 510. In some embodiments, the attack device 120 may create the attack signal (waveform 516) from approximately 20 meters from the device 105 and with a detection delay (DD) of -0.16. By comparing Figure 5A and Figure 5B As can be seen, waveform 518 (which shows the waveform received by device 110 after being modified by device 120) is shifted to the left relative to waveform 512. Figure 5B As can be seen, the distortion introduced by the attacking device 120 (e.g., by boosting the predicted signal to cause a waveform shift, as shown in waveform 516) can be filtered by the device 110, thereby allowing the device 110 to recreate the authentication message sent by the device 105 without detecting substantial distortion, while the authentication message appears to arrive in advance, causing the device 105 to appear to be closer to the device 110.

[0132] The longer it takes the attacking device 120 to correctly determine the next symbol, the more distortion the attacking device 120 introduces to cause the authentication message to arrive early. Figure 5C Waveforms 510 , 520 , and 522 associated with device 105 , attack device 120 , and device 110 , respectively, are shown. Figure 5C shows that the higher DD (with Figure 5B) scenarios where the attacking device cannot detect the next symbol too early (e.g., due to increased noise). As a result, device 120 can detect prediction errors and correct such errors later. For example, Figure 5B and Figure 5C A symbol prediction error (prediction 1; actual symbol 0) is shown at about time 4. Once the device 120 detects such an error, it is corrected. Figure 5C Relative to Figure 5B Such errors are detected at a later time (e.g. Figure 5B The DD in is -0.16, while Figure 5C DD in is 0), so Figure 5B Compared with the situation shown in Figure 5C In the case shown, more distortion is introduced at about time 4 (see the magnitude of the sign flip at about time 4 in waveform 520 compared to waveform 514). This type of distortion can become high enough (in some embodiments, if DD is high enough, such as 0 or positive) that it becomes perceptible and detectable after filtering in device 110 (see the increase in distortion of waveform 522 between about time 4 and about 5.4 compared to the distortion of waveform 518 between about time 4 and about 5.4). In some embodiments, device 110 detects the distortion of waveform 520 and, in response, refuses to take action (e.g., does not authenticate device 105 even though device 105 appears to be close to device 110).

[0133] In some embodiments, device 105 changes the transition time of symbols of the signal carrying the RTT data packet (e.g., by transmitting the signal with an increased bandwidth-time product (e.g., 2.0)) to prevent device 120 from predicting symbols in advance (thereby causing DD to be less negative, zero, or even positive relative to an undegraded signal).

[0134] In some embodiments, device 105 dynamically (e.g., abruptly) changes the phase noise component during transmission of a data packet or message (e.g., during an RTT data packet). (and thus changing the signal-to-noise ratio (SNR)).

[0135] In some embodiments, a device (e.g., device 105) may have a transmitter capable of adjusting the SNR output within a given range for a modulated transmission. In some embodiments, as shown in Table 1, there are various (e.g., five or seven) different SNR levels, and a device (e.g., device 105) may be capable of adjusting its SNR output to any of these levels.

[0136] SNR Output Index (SOI) SNR output level (dB) 0 18 1 21 2 24 3 27 4 30

[0137] Table 1

[0138] In some embodiments, the device (e.g., 105 or 110) supports at least one of the SNR levels shown in Table 1 (e.g., level 3 may be mandatory depending on the protocol or standard), but may not support all levels. In some embodiments, the device (e.g., 105 or 110) may support the SNR levels shown in Table 1. In some embodiments, prior to the authentication phase, selecting or identifying the BT value includes selecting a level from a predetermined list of possible levels, such as the 5 possible levels shown in Table 1. A different number of possible levels is also possible, such as 7 or more, or 4 or less.

[0139] In some embodiments, if is a continuation of the observed CS_SYNC packet transmitted by a device (e.g., device 105) at step k, then It is observed The phase of the low-pass filter used to receive the CS_SYNC data packet transmitted by the device (e.g., device 105) can be considered to be wideband.

[0140] In some embodiments, the SNR control error may be calculated by the following formula:

[0141]

[0142] In some embodiments, device 105 changes the BT value by changing one or more settings of transceiver 107 of device 105. For example, during a communication phase between devices 105 and 110, device 105 may select a BT having a lower value relative to the BT transmitted during the authentication phase. Such an increased BT product may result in a reduction in the transition time of symbols of the transmitted signal, which may advantageously increase the chances of device 110 detecting an attack by attacking device 120, or may make it difficult for attacking device 120 to conduct an attack.

[0143] Fig. 6A and Figure 6B Waveforms associated with signals transmitted by a device using different bandwidth-time product values ​​(BT) are shown. Fig. 6A A waveform 601 including values ​​for power spectral density 610 and frequency 611 is shown, and Figure 6B Waveforms 602 and 603 including values ​​for frequency deviation 612 and symbol duration 613 are shown.

[0144] In some embodiments, the BT of the signal transmitted by device 105 can affect the attack window in which the attack device 120 launches an attack. For example, a BT value of 0.5 may be optimal for coexistence with other RF devices (both, LE or non-LE) because it can minimize the energy outside the main lobe by applying filtering to symbol transitions. However, such filtering can give an early indication of the next symbol, which can be exploited in an EDLC or ECLD attack. For example, Fig. 6A and Figure 6B Waveforms associated with signals transmitted by device 105 using a BT of 0.5 (waveform 621) and a BT of 2.0 (waveform 620) are shown. Fig. 6A As shown in waveform 601 of , a perfectly modulated GFSK signal with BT=2 has approximately -60 dBc at the 4 MHz mark (1 Hz RESBW).

[0145] In some embodiments, different channels of the communication protocol may use different BT values ​​for communication. For example, in an embodiment using BLE for communication, a BT of 2.0 may be used on the CS data channel and a BT of 2.0 may not be used on the LE primary channel. In some embodiments, 2404 MHz and 2478 MHz are external channels.

[0146] like Figure 6B As shown, the symbol transition time of the signal transmitted using BT equal to 2.0 is faster than the symbol transition time of the signal transmitted using BT equal to 0.5.

[0147] In some embodiments, device 105 transmits a signal using a BT higher than 0.5 (such as a BT of 2.0), which may advantageously allow for easier ECLD attack detection (eg, because an attacker has less time to correct an erroneous bit prediction).

[0148] Figure 7 Various parameters that may affect the Total Attack Delay (TAD) according to an embodiment of the present invention are shown. Figure 7 A table 700 is shown including time advancement and delay parameters, their values ​​and their interpretations.

[0149] Figure 8 A table illustrating various parameters of a wireless communication channel and the associated impact on the detectability of a man-in-the-middle (MITM) attack is shown in accordance with an embodiment of the present invention. Figure 8 A table 800 is shown including configurable transmission parameters and modes for device 105 and the effects of the modes and parameters.

[0150] In some embodiments, in addition to BT, other parameters of the communication channel may also affect the detectability of MITM attacks. For example, Figure 8 A table 800 is shown illustrating various parameters of a wireless communication channel and associated impacts on detectability of a MITM attack according to an embodiment of the present disclosure. In some embodiments, device 105 may transmit an authentication packet to device 110 during an authentication phase using LE2M mode, the authentication packet having a PN sequence of 128 bits and an oversampling rate (OSR) of 8. In some such embodiments, device 110 may include a receiver circuitry (e.g., transceiver 112) capable of operating at a receiver bandwidth between 3 and 5 MHz, such as 4 MHz.

[0151] Fig. 9 The manipulated signal is shown when the device transmits symbols using BT=2.0 and modes LE1M and LE2M.

[0152] As an example, Fig. 9 Graphical representations 901 and 902 are shown illustrating waveforms 920, 921, and 922, and waveforms 930, 931, and 932, respectively. Waveforms 920 and 930 may represent signals transmitted by device 105 using Bluetooth LE 1Msym / s PHY (symbol duration = 1 microsecond) (graphical representation 901) and Bluetooth LE 2Msym / sPHY (symbol duration = 500 nanoseconds) (graphical representation 902) using BT 2.0, waveforms 921 and 931 may represent signals received by device 110, and waveforms 922 and 932 may represent signals generated by an attacking device (e.g., attacking devices 120-1 and / or 120-2) based on waveforms 920 and 930, respectively. In this example:

[0153] LE 1M:

[0154] Tsym=1000ns(1us),

[0155] TAD=100ns=10% of Tsym,

[0156] Fdev (peak-aggressor) ~ 600kHz (x2.4 250kHz), and

[0157] LE 2M:

[0158] Tsym=500ns,

[0159] TAD=100ns=20% of Tsym,

[0160] Fdev (peak - aggressor) ~ 2000kHz (x4 500kHz).

[0161] like Fig. 9As shown, since the relative impact of the attack in LE2M is greater, the footprint of the attack is more obvious. In some embodiments, device 105 transmits signals in LE2M mode (eg, except that BT is 2).

[0162] Fig.10 A Noise Attack Detection Metric (NADM) curve associated with a signal received by a device is shown. Specifically, Fig.10 Included is a graphical representation 1000 including waveforms depicting untrusted attack signals, such as waveforms 1020 , 1021 , and 1022 , and waveforms depicting trusted signals, such as waveforms 1030 , 1031 , and 1032 , including results regarding attack detection metrics 1001 and SNR 1002 .

[0163] As shown in graphical representation 1000, the closer the received signal is to the ideal signal, the smaller the NADM value. NADM can be understood as a measure that the closer the received signal is to the ideal signal, the lower the NADM value. In some embodiments, NADM performs better than a reference Pearson correlator.

[0164] like Fig.10 As shown, for high SNR 1002, and similarly, for high energy per bit relative to noise density (Eb / N0), NADM is approximately 0 (the received signal is very close to the ideal signal). When the attacking device 120 manipulates the signal transmitted by device 105 before it is received by device 106 (such as, for example, Figure 1B 1020, 1021, and 1022. For low SNR 1002, and similarly, for low energy per bit relative to noise density (Eb / N0), NADM also has values ​​greater than zero but less than the NADM produced in the presence of an attack, as shown in waveforms 1030, 1031, and 1032. In some embodiments, the parameters of the wireless communication are selected such that the NADM caused by the attack is greater than the NADM caused by normal operation transmissions (e.g., NADM A Greater than NADM N In some such embodiments, the NADM A The detection threshold level is determined by the value of

[0165] Fig.11NADM curves are shown for modes LE1M (graphical representation 1101) and LE2M (graphical representation 1102). More specifically, graphical representation 1101 includes waveforms 1120 and 1121, which may include waveforms depicting untrusted attack signals and trusted signals with respect to attack detection metric 1110 and SNR 1111, respectively, and graphical representation 1102 includes waveforms 1130 and 1131, which may include waveforms depicting untrusted attack signals and trusted signals with respect to attack detection metric 1110 and SNR 1111, respectively.

[0166] As shown in graphical representation 1101, when mode LE1M is used, the NADM curve during the attack (waveform 1120) is very close to the NADM curve without the attack (waveform 1121). As shown in graphical representation 1102, when mode LE2M is used, the NADM curve during the attack (waveform 1130) is far away from the NADM curve without the attack (waveform 1131). In some embodiments, mode LE2M is selected for wireless communication, which can advantageously allow the detection of an attack based on the NADM value (i.e., the detection metric) of the received signal.

[0167] Fig.12 NADM curves for different pseudo-random noise (PN) sequences are shown. More specifically, Fig.12 Included are graphical representations 1201 and 1202. Graphical representation 1201 includes waveforms 1220 and 1221, which may include waveforms depicting an untrusted attack signal and a trusted signal with respect to attack detection metric 1210 and SNR 1211, respectively, and graphical representation 1202 includes waveforms 1230 and 1231, which may include waveforms depicting an untrusted attack signal and a trusted signal with respect to attack detection metric 1210 and SNR 1211, respectively.

[0168] As shown in graphical representation 1201, when a 32-bit PN sequence is used, the NADM curve during the attack (waveform 1220) is very close to (or can overlap) the NADM curve when there is no attack (waveform 1221). As shown in graphical representation 1202, when a 128-bit PN sequence is used, the NADM curve during the attack (waveform 1230) is far away from the NADM curve when there is no attack (waveform 1231). In some embodiments, less available information (e.g., information generated by a shorter PN sequence) can increase the variance of the measurement, and the results can be affected by noise. In some embodiments, a PN sequence of multiple bits (e.g., 128 bits, 96 bits, 64 bits, 32 bits) is selected for wireless communication (e.g., for secure RTT), which can advantageously allow detection of attacks based on the NADM value of the received signal.

[0169] Fig.13NADM curves for different receiver bandwidths (BW) are shown. More specifically, Fig.13 Included are graphical representations 1301 and 1302. Graphical representation 1301 includes waveforms 1320 and 1321, which may include waveforms depicting an untrusted attack signal and a trusted signal with respect to attack detection metric 1310 and SNR 1311, respectively, and graphical representation 1302 includes waveforms 1330 and 1331, which may include waveforms depicting an untrusted attack signal and a trusted signal with respect to attack detection metric 1310 and SNR 1311, respectively.

[0170] As shown in graphical representation 1302, when a BW of 5 MHz is used, the NADM curve during the attack (waveform 1320) is very close to the NADM curve when there is no attack (waveform 1321). As shown in graphical representation 1301, when a BW of 3 MHz is used, the NADM curve during the attack (waveform 1330) is far away from the NADM curve when there is no attack (waveform 1331). In some embodiments, a smaller BW reduces the separation for high SNR. However, for low SNR and normal communication mode, a larger BW can allow more noise to enter the NADM estimator, which can increase the chance of false alarms. In some embodiments, the receiver bandwidth used (e.g., used by device 110, such as during the authentication phase, such as for receiving RTT packets) is between 3 MHz and 5 MHz, such as 4 MHz.

[0171] Fig.14 NADM curves for different oversampling ratios (OSR) are shown. More specifically, Fig.14 Included are graphical representations 1401 and 1402. Graphical representation 1401 includes waveforms 1420 and 1421, which may include waveforms depicting an untrusted attack signal and a trusted signal with respect to attack detection metric 1410 and SNR 1411, respectively, and graphical representation 1402 includes waveforms 1430 and 1431, which may include waveforms depicting an untrusted attack signal and a trusted signal with respect to attack detection metric 1410 and SNR 1411, respectively.

[0172] As shown in graphical representations 1401 and 1402, in some embodiments, increasing the OSR (once the system is already band limited) may not provide any significant benefit.

[0173] Fig.15 NADM curves for a specific set of parameters according to an embodiment of the present disclosure are shown. Fig.15A graphical representation 1500 is included that includes waveforms 1510 and 1511 regarding an attack detection metric 1501 and an SNR 1502. As shown in graphical representation 1500, secure RTT may be performed using mode LE2M, a PN of 128 bits, a receiver bandwidth of approximately 4 MHz, and an OSR of 4. For example, in some embodiments, a PHY using LE2M mode and a BT of 2 may impose a TAD of 20% of a symbol period. As a result, such settings may result in noticeable distortion of symbols appearing over the air to achieve any time advancement.

[0174] As shown in graphical representation 1500, a signal with a low SNR may not guarantee a safe RTT at the receiver. In some embodiments, the receiver (e.g., device 110) knows the noise floor of the receiver and can determine whether the incoming signal is above a certain threshold. In some embodiments, when the receiver signal has a noise floor above a predetermined SNR threshold 1521 (e.g., Fig.15 19 dB), and the NADM is below the NADM threshold 1520 (e.g., Fig.15 Safe RTT can be achieved when the RTT is approximately 22 units.

[0175] In some embodiments, if the SNR of the received signal is above SNR threshold 1521 and the NADM of the received signal is above NADM threshold 1520, an attack is detected and action is taken (e.g., not authenticating a key fob or a mobile device acting as a key fob, even if the device appears to be close to device 110 based on other metrics). For example, waveform 1511 may represent a NADM curve indicating an attack on a device based on the NADM of the signal being above NADM threshold 1520.

[0176] In some embodiments, the RSSI metric may be used instead of the SNR to determine the safe RTT region and when an ECLD attack is detected. For example, in some embodiments, a safe RTT may be achieved when the receiver signal has an RSSI above a predetermined RSSI threshold and the NADM is below a NADM threshold.

[0177] In some embodiments, the following discussion and equations may indicate how a detection threshold, such as NADM threshold 1520, may be determined.

[0178] In some embodiments, B may be a binary sequence of N elements in the [0,1] space, where B = [b0..b N-1 ]. Similarly, A can be a symbol sequence corresponding to N elements of a binary sequence, where A = [a0..a N-1 ], and in which:

[0179]

[0180] In some such embodiments, for a normalized symbol period of 1, p(t) can be a Gaussian pulse function with BT = 0.5, as defined by the following equation:

[0181]

[0182] And g(t) is the convolution of p(t) with a rectangular pulse of normalized duration 1, where rect(t) = 1 when 0 < t < 1 and 0 otherwise, as defined by the following equation, where "*" represents the time convolution of two signals:

[0183] g(t) = p(t) * rect(t)

[0184] In some such embodiments, according to these definitions, the reference phase is given by:

[0185]

[0186] A NADM calculation to determine the NADM threshold 1520 can be performed on the incoming r(t) signal, where the nominal NADM calculation will attempt to measure the mean square error of the incoming signal compared to the reference signal through the following reference operation:

[0187]

[0188] where r B (t - t0) is any incoming signal on the baseband (after removing the carrier frequency), and t0 represents any delay that minimizes the total integral value, and angle(r B (τ - τ O )) represents a function that returns the phase angle of a complex number.

[0189] If the incoming signal corresponds to a normal transmitter (r N (t)):

[0190] r N (t) = Ae j(m(t0tθ(t)) + n(t)

[0191] where:

[0192]

[0193] In addition, θ(t) corresponds to the phase noise present in the transmitted signal, and n(t) corresponds to the thermal noise present in the receiver.

[0194] Thus, in some embodiments, if and m(t) are defined the same, then they correspond to the same modulation process (e.g., a normal transmitter follows a reference phase that is expected to be part of the Bluetooth signal definition). For this case, after finding t0 (which corresponds to perfect time alignment of the reference and incoming signals), the resulting NADM equation will be minimized to a very small value containing only the noise term.

[0195] Note that when A>>n(t):

[0196] angle(r N It))≈m(t)+θ(t)

[0197] However, if there is an attacked r at the receiver A (t) signal, the output of the NADM equation can be significantly higher.

[0198] Figure 16-Figure 23 NADM curves for different parameter sets are shown.

[0199] Example embodiments of the present disclosure are summarized here. Other embodiments may also be understood from the overall description and claims submitted herein.

[0200] Example 1. A method comprising: receiving, by a first device, a first signal; determining, by the first device, a detection metric indicating a deviation between the first signal and a reference signal; and performing, by the first device, an action based on the detection metric and a detection threshold level.

[0201] Example 2. The method of Example 1 further comprises comparing the detection metric to a detection threshold level to produce a comparison result, wherein performing an action based on the detection metric and the detection threshold level comprises performing an action based on the comparison result.

[0202] Example 3. A method according to one of Examples 1 or 2, wherein receiving the first signal includes receiving the first signal during an authentication phase, and wherein performing the first action includes performing an action based on a successful authentication during the authentication phase.

[0203] Example 4. The method of one of Examples 1 to 3, further comprising detecting an anomaly based on the detection metric and the detection threshold level, wherein performing an action comprises performing an action in response to detecting the anomaly.

[0204] Example 5. The method of one of Examples 1 to 4, wherein receiving the first signal comprises receiving the first signal from the second device, and wherein performing the action comprises stopping communication between the first device and the second device.

[0205] Example 6. A method according to one of Examples 1 to 5, wherein receiving the first signal includes receiving the first signal from a second device, and wherein performing the action includes declining to perform a vehicle action associated with the vehicle.

[0206] Example 7. A method according to one of Examples 1 to 6, wherein refusing to perform the vehicle action includes refusing to unlock the vehicle.

[0207] Example 8. A method according to one of Examples 1 to 7, wherein detecting the anomaly includes detecting the anomaly when the detection metric is above a detection threshold level.

[0208] Example 9. The method of one of Examples 1 to 8, wherein the reference signal comprises a predetermined bit sequence, and wherein the first signal comprises a predetermined bit sequence.

[0209] Example 10. The method of one of Examples 1 to 9, wherein performing the action includes denying an unlock operation to be performed by the first device.

[0210] Example 11. The method of one of Examples 1 to 10, wherein performing the action includes providing, by the first device, an indication that the detection metric exceeds a detection threshold level.

[0211] Example 12. The method of one of Examples 1 to 11, further comprising performing, by the first device, an unlocking action based on the attack detection metric falling below a detection threshold level.

[0212] Example 13. The method of one of Examples 1 to 12, further comprising transmitting the first signal by the second device.

[0213] Example 14. The method of one of Examples 1 to 13, wherein performing the action by the first device includes detecting an attack on the first device.

[0214] Example 15. The method of one of Examples 1 to 14, further comprising terminating communication between the first device and the second device based on detecting the attack.

[0215] Example 16. A method according to one of Examples 1 to 15, wherein detecting the attack includes detecting the attack based on the detection metric exceeding a detection threshold level and based on a received signal strength indicator (RSSI) associated with the first signal exceeding an RSSI threshold.

[0216] Example 17. A method according to one of Examples 1 to 16, wherein detecting an attack includes detecting an attack based on a detection metric exceeding a detection threshold level and based on a signal-to-noise ratio (SNR) associated with the first signal exceeding an SNR threshold.

[0217] Example 18. The method of one of Examples 1 to 17, wherein the detection threshold level comprises a first value, and wherein the RSSI threshold comprises a second value.

[0218] Example 19. The method of one of Examples 1 to 18, further comprising performing an authentication action by the first device based on the detection metric falling below a detection threshold level.

[0219] Example 20. The method of one of Examples 1 to 19, wherein transmitting, by the second device, the first signal comprises transmitting, by the second device, the first signal using a bandwidth time (BT) value of 2.0.

[0220] Example 21. A method according to one of Examples 1 to 20, wherein transmitting the first signal by the second device includes transmitting the first signal during the first communication phase, and the method further includes transmitting the second signal by the second device during the second communication phase using a BT value of 0.5.

[0221] Example 22. The method of one of Examples 1 to 21, wherein transmitting the first signal by the second device comprises transmitting the first signal using a Bluetooth LE2M profile.

[0222] Example 23. The method of one of Examples 1 to 22, wherein transmitting the first signal by the second device comprises transmitting the first signal using Bluetooth.

[0223] Example 24. The method of one of Examples 1 to 23, wherein transmitting the first signal by the second device comprises transmitting the first signal using Bluetooth Low Energy (BLE).

[0224] Example 25. The method of one of Examples 1 to 24, wherein transmitting the first signal by the second device comprises transmitting the first signal using Gaussian frequency shift keying (GFSK) modulation.

[0225] Example 26. The method of one of Examples 1 to 25, further comprising determining a distance between the first device and the second device based on the first signal.

[0226] Example 27. A method according to one of Examples 1 to 26, further comprising: determining, by the first device, that the detection metric is below a detection threshold level; determining, by the first device, that the first signal has an associated first SNR that is above a predetermined SNR threshold; determining, by the first device, that the distance is below a predetermined distance; and in response to determining that the detection metric is below the detection threshold level, the first SNR is above a predetermined SNR threshold, and the distance is below a predetermined distance, performing an unlocking operation by the first device.

[0227] Example 28. A method according to one of Examples 1 to 27, wherein the first device is a vehicle or an electronic access control device, wherein the second device is a smart phone or a key fob, and wherein performing the unlock operation includes unlocking the first device.

[0228] Example 29. A method according to one of Examples 1 to 28, wherein the predetermined distance is three meters.

[0229] Example 30. The method of one of Examples 1 to 29, wherein the first device and the second device are part of an access control system for a room.

[0230] Example 31. A method according to one of Examples 1 to 30, wherein the first signal includes a round-trip time (RTT) data packet, the method further comprising: determining a distance between the first device and the second device based on the received RTT data packet; and unlocking the vehicle based on the determined distance.

[0231] Example 32. A method according to one of Examples 1 to 31, wherein determining the distance includes determining the distance based on a phase of a symbol of the RTT data packet.

[0232] Example 33. The method of one of Examples 1 to 32, wherein performing the action includes detecting, by the first device, an attack based on distortion of the first signal, and refusing, by the first device, to perform the unlocking action based on detecting the attack.

[0233] Example 34. A method according to one of Examples 1 to 33, wherein the detection metric includes a normalized attack detection metric (NADM).

[0234] Example 35. A method according to one of Examples 1 to 34, wherein determining the detection metric includes determining a difference between the first signal and a reference signal and accumulating the difference.

[0235] Example 36. A method according to one of Examples 1 to 35, wherein determining the detection metric includes determining a mean square error of the first signal relative to a reference signal.

[0236] Example 37. A method, comprising: receiving, by a first device, a first signal from a second device; determining, by the first device, a detection metric indicating a deviation between the first signal and a reference signal; determining, by the first device, a signal-to-noise ratio (SNR) associated with the first signal; determining, by the first device, that the first signal is authentic when the SNR is above an SNR threshold and the detection metric is below a detection threshold; determining that the first signal is untrustworthy when the detection metric is above the detection threshold; performing an unlocking operation in response to determining that the first signal is authentic; and terminating communication with the second device in response to determining that the first signal is untrustworthy.

[0237] Example 38. The method of Example 37, further comprising determining that the first signal is untrustworthy when the SNR is below an SNR threshold.

[0238] Example 39. A device comprising: a receiver circuit; and a processor configured to: receive a first signal via the receiver circuit; determine an anomaly detection metric associated with the first signal; and perform an action based on the anomaly detection metric exceeding a detection threshold level.

[0239] Example 40. A device comprising: a receiver circuit; a detection circuit coupled to the receiver circuit; and an action circuit coupled to the detection circuit; wherein the receiver circuit is configured to receive a first signal; wherein the detection circuit is configured to determine a detection metric associated with the first signal; and wherein the action circuit is configured to perform an action based on the detection metric exceeding a detection threshold level.

[0240] Example 41. A method comprising: identifying a first bandwidth time (BT) value by a first device; transmitting a first signal by the first device using the first BT value during a first communication phase; and transmitting a second signal by the first device using a second BT value during a second communication phase, wherein the second BT value is less than the first BT value.

[0241] Example 42. The method of Example 41, wherein transmitting the first signal using the first BT value comprises transmitting the first signal in a first communication channel, and wherein transmitting the second signal using the second BT value comprises transmitting the second signal in a second communication channel.

[0242] Example 43. A device comprising: a transmitter circuit; and a processor configured to: use the transmitter circuit to transmit a first data packet using a first bandwidth time (BT) value; and use the transmitter circuit to transmit a second data packet using a second BT value lower than the first BT value during a second communication phase.

[0243] Example 44. A method comprising: receiving a first signal by a first device; determining a detection metric associated with the first signal; performing a comparison between the detection metric and a metric threshold level to produce an anomaly result; and detecting, by the first device, an anomaly based on the anomaly result indicating that the detection metric exceeds the metric threshold level.

[0244] Example 45. A method according to Example 44, wherein: performing a comparison between the detection metric and the metric threshold level includes performing a correlation between the received first signal and a reference signal to generate a correlation result, and wherein the abnormal result is based on the correlation result.

[0245] Example 46. A method comprising: receiving, by a first device, a first signal; determining an attack detection metric associated with the first signal; and detecting, by the first device, an attack based on the attack detection metric exceeding a detection threshold level.

[0246] Example 47. A method comprising: receiving, by a first device, a first signal; and in response to determining that the first signal deviates from a reference signal by more than a predetermined threshold, performing an action.

[0247] Example 48. The method according to Example 47 further includes calculating a deviation metric indicating a deviation between the first signal and a reference signal, wherein determining that the first signal deviates from the reference signal by more than a predetermined threshold includes determining that the first signal deviates from the reference signal by more than a predetermined threshold based on comparing the deviation metric with the predetermined threshold.

[0248] Example 49. A method according to one of Examples 47 or 48, wherein determining that the first signal deviates from the reference signal by more than a predetermined threshold comprises determining that the deviation metric is above a predetermined threshold.

[0249] Example 50. A method comprising: transmitting, by a first device, an authentication data packet during an authentication phase; receiving, by a second device, the authentication data packet; determining a normalized attack detection metric (NADM) associated with the authentication data packet; and detecting, by the second device, an attack when the NADM is above a predetermined NADM threshold.

[0250] Example 51. The method of Example 50, further comprising unlocking the vehicle in response to the NADM being below a predetermined NADM threshold.

[0251] Example 52. The method of one of Examples 50 or 51, further comprising refusing to take action based on detecting an attack.

[0252] Example 53. A method according to one of Examples 50 to 52, wherein detecting an attack includes detecting an attack when the NADM is above a predetermined NADM threshold and a received signal strength indicator (RSSI) associated with the authentication data packet is above a predetermined RSSI threshold.

[0253] Example 54. A method as in one of Examples 50 to 53, wherein transmitting the authentication data packet comprises transmitting the authentication data packet using a BT equal to 2.0 and a PN sequence of 128 bits.

[0254] Example 55. A method as in one of Examples 50 to 54, wherein transmitting the authentication data packet comprises transmitting the authentication data packet using Bluetooth LE2M mode.

[0255] Example 56. A method as in one of Examples 50 to 55, wherein a receiver bandwidth of the second device is between 3 MHz and 5 MHz.

[0256] Example 57. A method according to one of Examples 50 to 56, wherein the receiver bandwidth is equal to 4 MHz.

[0257] Example 58. A method according to one of Examples 50 to 57, wherein transmitting the authentication data packet includes transmitting the authentication data packet using Bluetooth.

[0258] Example 59. The method of one of Examples 50 to 58, wherein the first device is a key fob or a smart phone.

[0259] Example 60. A method according to one of Examples 50 to 59, wherein the second device is a vehicle.

[0260] Example 61. A wireless device comprising a receiver circuit configured to: receive an authentication packet; determine a normalized attack detection metric (NADM) associated with the authentication packet; and detect an attack when the NADM is above a predetermined NADM threshold.

[0261] The above detailed description of the technical examples is not intended to be exhaustive or to limit the technology to the precise form disclosed above. Although the above describes the specific examples of the present technology for illustrative purposes, it will be recognized by those skilled in the relevant art that various equivalent modifications are possible within the scope of the present technology. For example, although the process or block is presented in a given order, alternative implementations can perform routines with steps in different orders or adopt systems with blocks, and some processes or blocks can be deleted, moved, added, subdivided, combined and / or modified to provide alternatives or sub-combinations. Each of these processes or blocks can be implemented in various different ways. In addition, although the process or block is sometimes shown as being executed in series, these processes or blocks can be executed or implemented in parallel, or can be executed at different times. In addition, any specific numbers mentioned herein are only examples: alternative implementations can adopt different values ​​or ranges.

[0262] The technical teachings provided herein can be applied to other systems, not necessarily the above-mentioned systems. The elements and actions of the above-mentioned various examples can be combined to provide further embodiments of the present technology. Some alternative embodiments of the present technology can include not only the additional elements of those embodiments described above, but also fewer elements.

[0263] According to the above detailed description, these and other changes can be made to the technology. Although the above description describes certain examples of the present technology and describes the expected best mode, no matter how detailed the above content is presented in the text, the present technology can be practiced in many ways. The details of the system can vary considerably in its specific implementation, while still being covered by the technology disclosed herein. As mentioned above, the specific terms used when describing certain features or aspects of the present technology should not be understood to imply that the term is redefined herein to be limited to any specific feature, characteristic or aspect of the present technology associated with the term. In general, the terms used in the attached claims should not be interpreted as limiting the technology to the specific examples disclosed in the specification unless the above detailed description section clearly defines these terms. Therefore, the actual scope of the present technology includes not only the disclosed examples, but also all equivalent ways of practicing or implementing the technology under the claims.

[0264] Although the present disclosure has been described with reference to illustrative embodiments, this description is not intended to be limiting. Various modifications and combinations of the exemplary embodiments and other embodiments will be apparent to those skilled in the art with reference to the description.

Claims

1. A method comprising: Receiving a first signal by a first device; determining, by the first device, a detection metric indicative of a deviation between the first signal and a reference signal; and An action is performed by the first device based on the detection metric and a detection threshold level.

2. The method of claim 1 , further comprising comparing the detection metric to the detection threshold level to produce a comparison result, wherein performing the action based on the detection metric and the detection threshold level comprises performing the action based on the comparison result. 3 . The method of claim 1 , wherein receiving the first signal comprises receiving the first signal during an authentication phase, and wherein performing the first action comprises performing the action based on a successful authentication during the authentication phase. 4 . The method of claim 1 , further comprising detecting an anomaly based on the detection metric and the detection threshold level, wherein performing the action comprises performing the action in response to detecting the anomaly. 5 . The method of claim 4 , wherein receiving the first signal comprises receiving the first signal from a second device, and wherein performing the action comprises stopping communication between the first device and the second device. The method of claim 4 , wherein detecting the anomaly comprises detecting the anomaly when the detection metric is above the detection threshold level. The method according to claim 6 , wherein the reference signal comprises a predetermined bit sequence, and wherein the first signal comprises the predetermined bit sequence. 8 . The method of claim 1 , further comprising performing, by the first device, an unlocking action based on the attack detection metric falling below the detection threshold level.

9. The method of claim 1, further comprising transmitting, by the second device, the first signal.

10. The method of claim 9, wherein detecting the attack comprises detecting the attack based on the detection metric exceeding the detection threshold level and based on a received signal strength indicator (RSSI) associated with the first signal exceeding an RSSI threshold.

11. The method of claim 10, wherein detecting the attack comprises detecting the attack based on the detection metric exceeding the detection threshold level and based on a signal-to-noise ratio (SNR) associated with the first signal exceeding an SNR threshold. 12 . The method of claim 9 , wherein transmitting, by the second device, the first signal comprises transmitting, by the second device, the first signal using a bandwidth time value (BT value) of 2.

0.

13. The method of claim 12, wherein transmitting the first signal by the second device comprises transmitting the first signal during a first communication phase, the method further comprising transmitting, by the second device, a second signal using a BT value of 0.5 during a second communication phase.

14. The method of claim 9, wherein transmitting the first signal by the second device comprises transmitting the first signal using Bluetooth LE2M mode.

15. The method of claim 9, wherein transmitting the first signal by the second device comprises transmitting the first signal using Bluetooth Low Energy (BLE).

16. The method of claim 9, wherein transmitting the first signal by the second device comprises transmitting the first signal using Gaussian Frequency Shift Keying modulation (GFSK) modulation.

17. The method of claim 9, further comprising determining a distance between the first device and the second device based on the first signal.

18. The method according to claim 17, further comprising: determining, by the first device, that the detection metric is below the detection threshold level; determining, by the first device, that the first signal has an associated first SNR above a predetermined SNR threshold; determining, by the first device, that the distance is less than a predetermined distance; as well as In response to determining that the detection metric is below the detection threshold level, the first SNR is above the predetermined SNR threshold, and the distance is below the predetermined distance, performing an unlock operation by the first device.

19. The method of claim 18, wherein the first device is a vehicle or an electronic access control device, wherein the second device is a smart phone or a key fob, and wherein performing the unlock operation comprises unlocking the first device.

20. The method of claim 8, wherein the first signal comprises a round trip time (RTT) packet, the method further comprising: determining a distance between the first device and the second device based on the received RTT data packet; and The vehicle is unlocked based on the determined distance.

21. The method of claim 20, wherein determining the distance comprises determining the distance based on a phase of a symbol of the RTT data packet.

22. The method of claim 20, wherein performing the action comprises detecting, by the first device, an attack based on distortion of the first signal, and refusing, by the first device, to perform an unlocking action based on detecting the attack.

23. The method of claim 1, wherein determining the detection metric comprises determining a difference between the first signal and the reference signal and accumulating the difference.

24. The method of claim 1, wherein determining the detection metric comprises determining a mean square error of the first signal relative to the reference signal.

Images