Interference detection and secure ranging in ultra wide band

Abstract

Techniques are provided for performing ranging operations with ultra wide band (UWB) devices in a network. An example method includes providing scrambling timestamp sequence information and a security sequence to a wireless node via a first radio access technology; transmitting one or more initiator data packets to the wireless node via a second radio access technology based at least in part on the scrambling timestamp sequence information; receiving one or more responder data packets from the wireless node via the second radio access technology; calculating a time of arrival estimate based on a correlation of one or more received responder data packets with the scrambling timestamp sequence information and the security sequence; and determining an integrity of the time of arrival estimate based at least in part on the correlation of the one or more received responder data packets with the scrambling timestamp sequence information and the security sequence.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of Greek Patent Application No. 20220100732, filed on September 7, 2022, entitled “INTERFERENCE DETECTION AND SECURE RANGING IN ULTRAWIDEBAND”, which application is assigned to the assignee of this application, and the entire contents of which are hereby incorporated herein by reference for all purposes. Background Art

[0003] Wireless devices are becoming more and more common for many daily activities. Modern wireless devices can utilize one or more wireless communication technologies. For example, wireless devices can communicate using short-range communication technologies such as Bluetooth technology, ultra-wideband (UWB) technology, millimeter wave (mmWave) technology, etc. In recent years, the use of short-range communication technologies such as Bluetooth in wireless devices has become more common and is often used in retail business, offices, homes, automobiles, manufacturing, and public gathering places. The larger bandwidth of UWB devices may be beneficial to ranging protocols used in high-security applications such as digital keys. In some use cases, the ranging accuracy associated with UWB devices may be reduced, such as at long distances or when the line of sight between UWB devices is obstructed. Some ranging message transmissions may be vulnerable to air attacks to falsify arrival time estimates. It is necessary to improve the ranging accuracy and security of UWB devices to support multiple use cases. Summary of the invention

[0004] An example method for determining the integrity of an ultra-wideband (UWB) ranging signal according to the present disclosure includes: providing scrambled timestamp sequence information and a security sequence to a wireless node via a first radio access technology; sending one or more initiator data packets to the wireless node via a second radio access technology based at least in part on the scrambled timestamp sequence information; receiving one or more responder data packets from the wireless node via the second radio access technology; calculating an arrival time estimate based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence; and determining the integrity of the arrival time estimate based at least in part on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

[0005] A specific implementation of this method may include one or more of the following features. The first radio access technology may be based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol. The scrambled timestamp sequence information may include a key value and a counter value associated with an encryption procedure. One or more initiator data packets and one or more responder data packets may utilize a physical protocol data unit frame configuration. Calculating an arrival time estimate may include identifying a peak based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and a security sequence, and determining a time value associated with the peak. Determining the integrity of the arrival time estimate may include identifying a single peak based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and a security sequence. The method may include determining that a single peak exceeds a threshold. Determining the integrity of the arrival time estimate may include determining a peak-to-sidelobe ratio based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and a security sequence. Determining the integrity of the arrival time estimate may include determining a statistical value in the time domain associated with a correlation of one or more received responder data packets with the scrambled timestamp sequence information and a security sequence. A controller sequence orthogonal to the security sequence may be computed such that determining integrity of the arrival time estimate includes performing a generalized operation utilizing the controller sequence and a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

[0006] An example method for sending a secure ultra-wideband (UWB) ranging signal according to the present disclosure includes: receiving scrambled timestamp sequence information and a security sequence from a wireless node via a first radio access technology; receiving one or more initiator data packets from the wireless node via a second radio access technology; generating one or more responder data packets based on the received one or more initiator data packets and the security sequence; and sending one or more responder data packets to the wireless node via the second radio access technology.

[0007] Specific implementations of this method may include one or more of the following features. The first radio access technology may be based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol. The scrambled timestamp sequence information may include a key value and a counter value associated with an encryption procedure. One or more initiator data packets and one or more responder data packets are configured using a physical protocol data unit frame. The length of the security sequence is at least the length of the scrambled timestamp sequence in the one or more initiator data packets.

[0008] The items and / or technologies described herein may provide one or more of the following capabilities and other capabilities not mentioned. Devices with UWB capabilities may be configured to exchange positioning signals to determine the distance between these devices (e.g., based on flight time measurements) and the orientation of each other (e.g., based on arrival angle measurements). Devices with UWB capabilities may provide / receive security sequence information via out-of-band communication. An initiating UWB-capable device may send an initiator ranging frame including a first sequence to a responding UWB-capable device. The responding device may generate a responder ranging frame based on the first sequence and the security sequence, and send the responder ranging frame to the initiating UWB-capable device. The initiating UWB device may correlate the received responder ranging frame based on the security sequence information to determine the arrival time. The integrity and corresponding arrival time value of the responder ranging frame may be verified. Transmissions made by an adversary attempting a replay attack may be discarded, and channel interference may be detected. The security of the UWB ranging session may be improved. Other capabilities may be provided, and not every specific implementation according to the present disclosure must provide any of the capabilities discussed, let alone all of them. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a block diagram of an example wireless local area network (WLAN).

[0010] Figure 2 is a block diagram of components of an example wireless device.

[0011] Figure 3A is a block diagram of components of an example access point.

[0012] Figure 3B is a block diagram of components of an example ultra-wideband (UWB) device.

[0013] Figure 4 is a block diagram of an example communication module having multiple transceivers.

[0014] Figure 5A and Figure 5B Included is an example message flow diagram for an Enhanced Ranging Device (ERDEV).

[0015] Figure 6 is a diagram of an example ranging frame for use in a UWB ranging session.

[0016] Figure 7 is a diagram of an example physical protocol data unit (PPDU) frame configuration incorporating a preamble for ranging.

[0017] Fig. 8A is a diagram of an example signal exchange for UWB ranging.

[0018] Figure 8Bis a diagram of example angles of arrival of UWB signals.

[0019] Fig. 9 is a diagram of an example replay attack for falsifying arrival time estimates.

[0020] Fig.10 is a block diagram of a process for generating pseudo-random numbers based on the Advanced Encryption Standard (AES).

[0021] Fig.11A and Fig. 11B Depicted are example signal exchanges and corresponding time focusing effects based on correlating time-reversed and conjugated versions of the signals.

[0022] Fig. 12A and Fig. 12B An example signal exchange utilizing interference detection and safety ranging signals and example signal curves are depicted.

[0023] Fig.13 Included are example illustrations of sidelobes associated with correlation of different signals.

[0024] Fig.14 is an example process flow for determining the integrity of a UWB ranging signal.

[0025] Fig.15 is an example process flow for sending secure UWB ranging signals. DETAILED DESCRIPTION

[0026] This article discusses the technology for performing ranging operations using ultra-wideband (UWB) devices in a network. UWB positioning technology can be used to provide accurate relative positioning between devices within a limited distance (e.g., 100m). For example, two UWB devices can be configured to exchange UWB radio frequency signals to determine the flight time (ToF) and arrival angle (AoA) information of the RF signal. A device with UWB capabilities can be configured to use a 500MHz spectrum with a 2 nanosecond (ns) pulse to perform positioning measurements. UWB can achieve a ToF ranging accuracy of approximately 7cm to 10cm and an AoA accuracy of 1.5 degrees to 3 degrees. UWB can resist multipath and can achieve millimeter-level ranging accuracy using super-resolution algorithms. UWB uses less power than WiFi and can obtain better ranging accuracy than Bluetooth devices. However, in operation, some UWB ranging technologies may be vulnerable to aerial attacks to forge ToA estimates. The technology provided in this article uses out-of-band communication to increase the security of UWB ranging messages. In one example, a spoofed signal sent by an attacker can be detected. These techniques can also be used to detect channel interference.

[0027] The controller and the controlled party in the UWB ranging session may exchange messages to establish the parameters of the ranging message. For example, the controller may control the ranging session and may define the ranging parameters by transmitting one or more ranging control messages (RCM). The RCM or other messages may be provided in a secure out-of-band transmission, such as via a WiFi or Bluetooth communication link, and may include a security sequence known only to the controller and the controlled party. The initiator may generate a scrambled time stamp sequence (STS) and send one or more data packets based on the STS sequence. The responder station (i.e., the responder) may generate one or more responder data packets based on the STS sequence and the security sequence received via the out-of-band communication, and then send the one or more responder data packets to the initiator. The initiator may receive one or more responder data packets and perform an integrity check on the received data packets. The integrity check may be based on one or more signal processing operations (e.g., convolution, dot product, etc.) using a security sequence (e.g., which is known only to the initiator and the responder). The integrity check may determine a single signal peak to verify the received responder data packet. Other thresholds may be used as integrity checks. For example, a threshold peak-to-sidelobe ratio or a mean-square error in the time domain may be used to determine the integrity of the received ranging signal.These techniques and configurations are examples, and other techniques and configurations may be used.

[0028] The following description provides examples, but does not limit the scope, applicability or examples set forth in the claims. The functions and arrangements of the elements discussed may be changed without departing from the scope of the present disclosure. Various procedures or components may be omitted, replaced or added to each example as appropriate. For example, the described method may be performed in a different order than described, and various steps may be added, omitted or combined. In addition, the features described with respect to some examples may be combined in other examples.

[0029] refer to Figure 1, the block diagram illustrates an example of a WLAN network 100, such as, for example, a network implementing the IEEE 802.11 and IEEE 802.15 family of standards. The WLAN network 100 may include an access point (AP) 105 and one or more wireless devices 110 or stations (STA) 110, such as mobile stations, head mounted devices (HMDs), personal digital assistants (PDAs), asset tracking devices, other handheld devices, netbooks, notebooks, tablet computers, laptops, display devices (e.g., TVs, computer monitors, etc.), printers, IoT devices, asset tags, key cards, vehicles, etc. The AP 105 and the wireless devices 110 may be devices with UWB capabilities. Although one AP 105 is shown, the WLAN network 100 may also have multiple APs 105. Each of the wireless devices 110, which may also be referred to as mobile stations (MSs), mobile devices, access terminals (ATs), user equipment (UEs), subscriber stations (SSs), or subscriber units, may be associated and communicate with the AP 105 via a communication link 115. Each AP 105 has a geographic coverage area 125 such that wireless devices 110 within the area can generally communicate with the AP 105. The wireless devices 110 may be dispersed throughout the geographic coverage area 125. Each wireless device 110 may be stationary or mobile.

[0030] The wireless device 110 may be covered by more than one AP 105 and may therefore be associated with one or more APs 105 at different times. A single AP 105 and an associated set of sites may be referred to as a basic service set (BSS). An extended service set (ESS) is a collection of connected BSSs. A distribution system (DS) is used to connect the APs 105 in the extended service set. The geographic coverage area 125 of the access point 105 may be divided into sectors that constitute a portion of the coverage area. The WLAN network 100 may include access points 105 of different types (e.g., urban areas, home networks, etc.) having coverage areas of different sizes and overlapping coverage areas for different technologies. In other examples, other wireless devices may communicate with the AP 105.

[0031] Although the wireless devices 110 can communicate with each other through the AP 105 using the communication link 115, each wireless device 110 can also communicate directly with one or more other wireless devices 110 via a direct wireless link 120. When both wireless devices 110 are within the AP geographic coverage area 125, or when one or both wireless devices 110 are not within the AP geographic coverage area 125, two or more wireless devices 110 can communicate via a direct wireless link 120. Examples of direct wireless links 120 may include WiFi direct connections, connections established by using a WiFi tunnel direct link setup (TDLS) link, 5G-NR side links, PC5, UWB, Bluetooth, and other P2P group connections. The wireless devices 110 in these examples can communicate according to WLAN radio and baseband protocols including physical layers and MAC layers from IEEE 802.11 and IEEE 802.15 and various versions thereof. For example, one or more of the wireless devices 110 and the AP 105 may be configured to communicate and / or be used for positioning applications using WiFi, Bluetooth, and / or UWB signals.

[0032] Also refer to Figure 2UE 200 is an example of a wireless device 110 and includes a computing platform including a processor 210, a memory 211 including software (SW) 212, one or more sensors 213, a transceiver interface 214 for a transceiver 215 (including one or more wireless transceivers, such as a first wireless transceiver 240a, a second wireless transceiver 240b, and optionally a wired transceiver 250), a user interface 216, a satellite positioning system (SPS) receiver 217, a camera 218, and a positioning (motion) device 219. The processor 210, the memory 211, the sensor 213, the transceiver interface 214, the user interface 216, the SPS receiver 217, the camera 218, and the positioning (motion) device 219 may be communicatively coupled to each other via a bus 220 (which may be configured, for example, for optical communication and / or electrical communication). One or more of the devices shown (e.g., camera 218, positioning (motion) device 219, and / or one or more sensors in sensor 213, etc.) may be omitted from UE 200. Processor 210 may include one or more hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. Processor 210 may include multiple processors, including a general / application processor 230, a digital signal processor (DSP) 231, a modem processor 232, a video processor 233, and / or a sensor processor 234. One or more of processors 230-234 may include multiple devices (e.g., multiple processors). For example, sensor processor 234 may include, for example, a processor for radio frequency (RF) sensing and ultrasonic waves. Modem processor 232 may support dual SIM / dual connectivity (or even more SIMs). For example, a SIM (subscriber identity module or user identification module) may be used by an original equipment manufacturer (OEM), and another SIM may be used by a terminal user of UE 200 to obtain connectivity. The memory 211 is a non-transitory storage medium that may include random access memory (RAM), flash memory, disk storage, and / or read-only memory (ROM), etc. The memory 211 stores software (which may also include firmware) 212, which may be a processor-readable, processor-executable software code containing instructions that are configured to cause the processor 210 to perform various functions described herein when executed. Alternatively, the software 212 may not be directly executable by the processor 210, but may be configured to cause the processor 210 to perform these functions, for example, when compiled and executed. This specification may refer to the processor 210 performing a function, but this includes other specific implementations, such as specific implementations in which the processor 210 executes software and / or firmware. This specification may refer to the processor 210 performing a function as a shorthand for one or more processors in the processors 230-234 performing the function. This specification may refer to the UE 200 performing a function as a shorthand for one or more appropriate components of the UE 200 performing the function.Processor 210 may include a memory with stored instructions in addition to and / or in lieu of memory 211. The functionality of processor 210 is discussed more fully below.

[0033] Figure 2 The configuration of UE 200 shown is an example and not a limitation of the present disclosure (including claims), and other configurations may be used. For example, an example configuration of UE includes one or more of processors 230-234, memory 211, and wireless transceivers 240a-b of processor 210. Other example configurations include one or more of processors 230-234, memory 211, wireless transceivers 240a-b of processor 210 and sensor 213, user interface 216, SPS receiver 217, camera 218, PMD 219, and / or wired transceiver 250. Other configurations may not include all components of UE 200. For example, an IoT device may include more wireless transceivers 240a-b, memory 211, and a general processor 230. A multi-link device may simultaneously utilize a first wireless transceiver 240a on a first link using a first frequency band and a second wireless transceiver 240b on a second link using a second frequency band. Additional transceivers are also available for additional links and frequency bands and radio access technologies.

[0034] The UE 200 may include a modem processor 232 capable of performing baseband processing of signals received and down-converted by the transceiver 215 and / or the SPS receiver 217. The modem processor 232 may perform baseband processing of signals to be up-converted for transmission by the transceiver 215. Additionally or alternatively, the baseband processing may be performed by the general processor 230 and / or the DSP 231. However, other configurations may be used to perform the baseband processing.

[0035] UE 200 may include sensors 213, which may include, for example, an inertial measurement unit (IMU) 270, one or more magnetometers 271, and / or one or more environmental sensors 272. IMU 270 may include one or more inertial sensors, such as one or more accelerometers 273 (e.g., which collectively respond to acceleration of UE 200 in three dimensions) and / or one or more gyroscopes 274. Magnetometers may provide measurements to determine orientation (e.g., relative to magnetic north and / or true north) that may be used for any of a variety of purposes (e.g., to support one or more compass applications). Environmental sensors 272 may include, for example, one or more temperature sensors, one or more barometric pressure sensors, one or more ambient light sensors, one or more camera imagers, and / or one or more microphones, etc. Sensors 213 may generate analog and / or digital signals, indications of which may be stored in memory 211 and processed by DSP 231 and / or general processor 230 to support one or more applications (such as, for example, applications involving positioning and / or navigation operations).

[0036] The sensor 213 may be used for relative position measurement, relative position determination, motion determination, etc. The information detected by the sensor 213 may be used for motion detection, relative displacement, dead reckoning, sensor-based position determination, and / or sensor-assisted position determination. The sensor 213 may be used to determine whether the UE 200 is fixed (stationary) or moving. In another example, for relative positioning information, the sensor / IMU may be used to determine the angle and / or orientation of another device relative to the UE 200, etc.

[0037] The IMU 270 may be configured to provide measurements of the direction of motion and / or speed of motion of the UE 200, which may be used for relative position determination. For example, one or more accelerometers 273 and / or one or more gyroscopes 274 of the IMU 270 may detect the linear acceleration and rotational speed of the UE 200, respectively. The linear acceleration measurements and rotational speed measurements of the UE 200 may be integrated over time to determine the instantaneous direction of motion and displacement of the UE 200. The instantaneous direction of motion and displacement may be integrated to track the position of the UE 200. For example, a reference position of the UE 200 at a certain moment may be determined, for example, using the SPS receiver 217 (and / or by some other means), and measurements obtained from the accelerometer 273 and the gyroscope 274 after that moment may be used for dead reckoning to determine the current position of the UE 200 based on the movement (direction and distance) of the UE 200 relative to the reference position.

[0038] The magnetometer 271 can determine the magnetic field strength in different directions, which can be used to determine the orientation of the UE 200. For example, the orientation can be used to provide a digital compass for the UE 200. The magnetometer 271 may include a two-dimensional magnetometer configured to detect magnetic field strength in two orthogonal dimensions and provide an indication of the magnetic field strength. Additionally or alternatively, the magnetometer 271 may include a three-dimensional magnetometer configured to detect magnetic field strength in three orthogonal dimensions and provide an indication of the magnetic field strength. The magnetometer 271 may provide a component for sensing a magnetic field and providing an indication of the magnetic field to the processor 210, for example.

[0039] The transceiver 215 may include wireless transceivers 240a-b and wired transceivers 250 configured to communicate with other devices via wireless connections and wired connections, respectively. In one example, each of the wireless transceivers 240a-b may include a respective transmitter 242a-b and a receiver 244a-b coupled to one or more respective antennas 246a-b for transmitting and / or receiving wireless signals 248a-b and converting signals from the wireless signals 248a-b to wired (e.g., electrical and / or optical) signals and converting signals from the wired (e.g., electrical and / or optical) signals to the wireless signals 248a-b. Thus, the transmitters 242a-b may be the same transmitter, or may include multiple transmitters, which may be discrete components or combined / integrated components, and / or the receivers 244a-b may be the same receiver, or may include multiple receivers, which may be discrete components or combined / integrated components. The wireless transceivers 240a-b may be configured to communicate signals (e.g., with an access point and / or one or more other devices) according to various radio access technologies (RATs), such as 5G New Radio (NR), GSM (Global System for Mobile Communications), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11ax and 802.11be), WiFi, WiFi Direct (WiFi-D), IEEE 802.15 (UWB), Zigbee, etc. The wired transceiver 250 may include a transmitter 252 and a receiver 254 configured for wired communication. The transmitter 252 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the receiver 254 may include multiple receivers that may be discrete components or combined / integrated components. The wired transceiver 250 may be configured, for example, for optical communication and / or electrical communication. The transceiver 215 may be communicatively coupled to the transceiver interface 214, for example, via an optical connection and / or an electrical connection. The transceiver interface 214 may be at least partially integrated with the transceiver 215.

[0040] The user interface 216 may include one or more devices such as, for example, a speaker, a microphone, a display device, a vibration device, a keyboard, a touch screen, etc. The user interface 216 may include more than one of these devices. The user interface 216 may be configured to enable a user to interact with one or more applications hosted by the UE 200. For example, the user interface 216 may store indications of analog and / or digital signals in the memory 211 to be processed by the DSP 231 and / or the general processor 230 in response to actions from the user. Similarly, the application hosted on the UE 200 may store indications of analog and / or digital signals in the memory 211 to present output signals to the user. The user interface 216 may include an audio input / output (I / O) device, which includes, for example, a speaker, a microphone, a digital-to-analog circuit, an analog-to-digital circuit, an amplifier, and / or a gain control circuit (including more than one of these devices). Other configurations of audio I / O devices may be used. Additionally or alternatively, the user interface 216 may include one or more touch sensors that respond to touch and / or pressure on, for example, a keyboard and / or a touch screen of the user interface 216 .

[0041] The SPS receiver 217 (e.g., a global positioning system (GPS) receiver) may be capable of receiving and acquiring the SPS signal 260 via the SPS antenna 262. The antenna 262 is configured to convert the SPS signal 260 into a wired signal, such as an electrical signal or an optical signal, and may be integrated with one or more of the antennas 246a-b. The SPS receiver 217 may be configured to process the acquired SPS signal 260 in whole or in part for estimating the position of the UE 200. For example, the SPS receiver 217 may be configured to determine the position of the UE 200 by performing trilateration using the SPS signal 260. The general purpose processor 230, the memory 211, the DSP 231, and / or one or more dedicated processors (not shown) may be utilized in conjunction with the SPS receiver 217 to process the acquired SPS signal in whole or in part, and / or calculate the estimated position of the UE 200. The memory 211 may store indications (e.g., measurements) of the SPS signals 260 and / or other signals (e.g., signals obtained from the wireless transceivers 240a-b) for use in performing positioning operations. The general processor 230, the DSP 231, and / or one or more special-purpose processors, and / or the memory 211 may provide or support a location engine for use in processing measurements to estimate the location of the UE 200.

[0042] UE 200 may include a camera 218 for capturing still or moving images. Camera 218 may include, for example, an imaging sensor (e.g., a charge coupled device or CMOS imager), a lens, analog-to-digital circuits, a frame buffer, etc. Additional processing, conditioning, encoding, and / or compression of signals representing captured images may be performed by general purpose processor 230 and / or DSP 231. Additionally or alternatively, video processor 233 may perform conditioning, encoding, compression, and / or manipulation of signals representing captured images. Video processor 233 may decode / decompress stored image data for presentation on a display device (not shown) (e.g., of user interface 216).

[0043] A positioning (motion) device (PMD) 219 may be configured to determine the location and possible motion of UE 200. For example, PMD 219 may be in communication with SPS receiver 217, and / or include a portion or all of an SPS receiver. PMD 219 may additionally or alternatively be configured to determine the location of UE 200 using ground-based signals (e.g., at least some of wireless signals 248a-b) for trilateration or multilateration, assist in obtaining and using SPS signals 260, or both. PMD 219 may be configured to determine the location of UE 200 using one or more other techniques (e.g., relying on the UE's self-reported location (e.g., a portion of the UE's location beacon)), and may use a combination of techniques (e.g., SPS and ground-based positioning signals) to determine the location of UE 200. The PMD 219 may include one or more sensors 213 (e.g., gyroscopes, accelerometers, magnetometers, etc.), which may sense the orientation and / or motion of the UE 200 and provide an indication of the orientation and / or motion, which the processor 210 (e.g., the general processor 230 and / or the DSP 231) may be configured to use to determine the motion (e.g., velocity vector and / or acceleration vector) of the UE 200. The PMD 219 may be configured to provide an indication of uncertainty and / or error in the determined positioning and / or motion. In one example, the PMD 219 may be referred to as a positioning engine (PE) and may be executed by the general processor 230. For example, the PMD 219 may be a logical entity and may be integrated with the general processor 230 and the memory 211.

[0044] In addition, refer to Figure 3A , an example of an access point (AP) 300, such as AP 105, includes a computing platform including a processor 310, a memory 311 including software (SW) 312, a transceiver 315, and (optionally) an SPS receiver 317. The processor 310, the memory 311, the transceiver 315, and the SPS receiver 317 may be communicatively coupled to each other via a bus 320 (e.g., which may be configured for optical communication and / or electrical communication). One or more of the devices shown (e.g., a wireless interface and / or the SPS receiver 317) may be omitted from the AP 300. The SPS receiver 317 may be configured similarly to the SPS receiver 217 to be able to receive and acquire an SPS signal 360 via an SPS antenna 362. The processor 310 may include one or more intelligent hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 310 may include multiple processors (e.g., including a general / application processor, a DSP, a modem processor, a video processor, and / or a sensor processor, such as Figure 2). Memory 311 is a non-transitory storage medium that may include random access memory (RAM), flash memory, optical disk memory and / or read-only memory (ROM), etc. Memory 311 stores software 312, which may be a processor-readable, processor-executable software code containing instructions that are configured to cause processor 310 to perform various functions described herein when executed. Alternatively, software 312 may not be directly executable by processor 310, but may be configured to cause processor 310 to perform these functions, for example, when compiled and executed. This specification may refer to processor 310 performing functions, but this includes other specific implementations, such as specific implementations in which processor 310 executes software and / or firmware. This specification may refer to processor 310 performing functions as a shorthand for one or more processors included in processor 310 performing the function. Processor 310 may include a memory with stored instructions as a supplement and / or alternative to memory 311. The functionality of processor 310 is discussed more fully below.

[0045] The transceiver 315 may include a wireless transceiver 340 and a wired transceiver 350 configured to communicate with other devices via wireless connections and wired connections, respectively. For example, the wireless transceiver 340 may include a transmitter 342 and a receiver 344 coupled to one or more antennas 346 for transmitting (e.g., on one or more uplink channels) and / or receiving (e.g., on one or more downlink channels) wireless signals 348 and converting signals from the wireless signals 348 to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to the wireless signals 348. Thus, the transmitter 342 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the receiver 344 may include multiple receivers that may be discrete components or combined / integrated components. The wireless transceiver 340 may be configured to communicate signals (e.g., with the UE 200, one or more other UEs, and / or one or more other devices) in accordance with various radio access technologies (RATs), such as IEEE 802.11 (including IEEE 802.11ax and 802.11be), WiFi, WiFi Direct (WiFi-D), IEEE 802.15 (UWB), Zigbee, etc. The wired transceiver 350 may include a transmitter 352 and a receiver 354 configured for wired communication. The transmitter 352 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the receiver 354 may include multiple receivers that may be discrete components or combined / integrated components. The wired transceiver 350 may be configured, for example, for optical communication and / or electrical communication.

[0046] Also refer to Figure 3BExamples of UWB devices 380 include asset tags, key fobs, TV remote controls, security systems (e.g., vehicles, business software, etc.), or other devices configured to transmit and receive UWB RF transmissions. The UWB device includes a computing platform that includes a processor 381, a memory 382 including software (SW) 383, a wireless transceiver 385, and (optionally) an SPS receiver 387. The SPS receiver 387 may be configured similarly to the SPS receiver 217 to be able to receive and acquire the SPS signal 360 via an SPS antenna 388. The processor 381 may include one or more intelligent hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 381 may include multiple processors (e.g., including a general / application processor, a DSP, a modem processor, a video processor, and / or a sensor processor, such as Figure 2 ). Memory 382 is a non-transitory storage medium that may include random access memory (RAM), flash memory, optical disk memory, and / or read-only memory (ROM), etc. Memory 382 stores software 383, which may be a processor-readable, processor-executable software code containing instructions that are configured to cause processor 381 to perform various functions described herein when executed. Alternatively, software 383 may not be directly executable by processor 381, but may be configured to cause processor 381 to perform these functions, for example, when compiled and executed. This specification may refer to processor 381 performing functions, but this includes other specific implementations, such as specific implementations in which processor 381 executes software and / or firmware. This specification may refer to processor 381 performing functions as a shorthand for one or more processors included in processor 381 performing the function. Processor 381 may include a memory with stored instructions as a supplement and / or alternative to memory 382. The functionality of processor 381 is discussed more fully below.

[0047] The wireless transceiver 385 is configured to communicate with other devices via a wireless connection using the UWB protocol. For example, the wireless transceiver 385 may include a transmitter 392 and a receiver 394 coupled to one or more antennas 396 for transmitting (e.g., on one or more uplink channels) and / or receiving (e.g., on one or more downlink channels) UWB wireless signals 398, and converting signals from the UWB wireless signals 398 to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to UWB wireless signals 398. In one example, the wireless transceiver 385 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the receiver 394 may include multiple receivers that may be discrete components or combined / integrated components. In one example, the wireless transceiver 385 may be configured to communicate signals according to various radio access technologies (RATs) other than UWB technology. For example, the wireless transceiver 385 may also be configured to utilize RATs such as IEEE 802.11 (including IEEE 802.11ax and 802.11be), WiFi, WiFi Direct (WiFi-D), IEEE 802.15(UWB), Zigbee, etc.

[0048] refer to Figure 4 , a block diagram of an example communication module 402 with multiple transceivers is shown. The communication module 402 can be used as a transceiver in a mobile device such as the transceiver 215 in the UE 200, a transceiver in an access point such as the transceiver 315 in the AP 300, or a transceiver 385 in other RF devices such as the UWB 380. In one example, in a V2X network, the communication module may be included in a roadside unit (RSU). The communication module 402 may be communicatively coupled to a processor 404, such as a general processor 230 and / or a modem processor 232. One or more RF modules such as a UWB module 406, a BLE module 408, and a WiFi module 410 may be communicatively coupled to multiple antennas 414a-n via one or more multiplexers 412. The multiplexer 412 may include switches, phase shifters, and tuning circuits configured to enable one or more of the RF modules 406, 408, 410 to transmit and receive signals via one or more of the antennas 414a-n. For example, the WiFi module 410 and the UWB module 406 may be configured to utilize one or more of the antennas 414a-n based on the operating frequency. The phase shifters and other components within the multiplexer 412 (e.g., Butler matrix) may enable beamforming to increase the transmit or receive gain at different boresight angles that deviate from the location of the antennas 414a-n.

[0049] refer to Figure 5A and Figure 5B, shows an example message flow diagram for an enhanced ranging device (ERDEV). Two devices such as UE 200 and UWB device 380 may be configured to exchange messages to determine the range (e.g., distance) between each other. In an example automotive use case, UE 200 may be a smartphone and configured to perform the role of a controller 502, and UWB device 380 may be in a vehicle and configured to perform the role of a controlled party 504. In one example, UE 200 may be configured to unlock and start the vehicle when within a specified range of the vehicle, and Figure 5A and Figure 5B The message flow diagram in can be used to determine the range between a vehicle and a UE. As a controller 502, UE 200 can establish parameters for a UWB ranging session and provide session information to a controlled party 504 via one or more ranging control messages (RCMs) 506. RCMs 506 may include ranging parameters, such as channel information, ranging frames, and time slot configurations, to enable a station to perform a time-scheduled or contention-free UWB ranging session. The controlled party 504 may be configured to utilize the ranging parameters received from the controller 502 in the RCMs 506. In one example, the controller 502 and the controlled party 504 may exchange RCMs 506 to negotiate session parameters. The concepts of the controller 502 and the controlled party 504 are based on the viewpoint of upper layer networking, and the roles of the initiator and responder may be used on the physical and medium access control (MAC) layers. Using the ranging parameters included in the RCM 506, the initiators 508a, 508b are configured to initiate a ranging exchange by transmitting a first message of the exchange (eg, a ranging initiation message (RIM) 512a, 512b). Figure 5A and Figure 5B As depicted in , the controller 502 or the controlled party 504 may assume the respective roles of initiators 508a, 508b. Similarly, the controller 502 and the controlled party 504 may be configured as respective responders 510a, 510b, and may respond to respective RIMs 512a, 512b with ranging response messages (PRMs) 514a, 514b. In general, UWB ranging is designed to have a relatively low-complexity data structure to enable ranging between relatively low-cost devices (e.g., low-complexity devices). A ranging session may be based on time division multiple access (TDMA), with a ranging frame being the primary unit.

[0050] refer to Figure 6 , further reference Figure 5A and Figure 5B, a diagram of an example ranging frame 600 for use in a UWB ranging session is shown. A UWB ranging session between two devices (e.g., UE 200 and UWB device 380) may include consecutive ranging frames 600. Each ranging frame 600 includes multiple ranging rounds 602, which include ranging slots 604. Within the ranging frame 600, responders 510a, 510b may send messages within a single ranging round 602 (e.g., round #2). The round index may be statically configured by the controller 502 or selected based on a hopping pattern configured by the controller 502. The time slots 604 within the selected ranging round 602 may be used sequentially to perform ranging exchanges and / or determine TDOA measurements. Each ranging round 602 (e.g., round #2) may include a single ranging control slot 606, followed by a ranging phase slot 608 and a measurement report slot 610. The ranging rounds 602 and ranging slots 604 may have fixed durations as established in the RCM 506. In one example, different ranging rounds 602 in the sequential ranging frame 600 may be used to reduce interference caused by UWB ranging sessions between other neighboring stations. In one example, the duration of the ranging frame 600 may be approximately 250 milliseconds (ms) and the duration of the ranging round 602 may be approximately 10 ms. The default ranging slot 604 duration is approximately 1 ms. Other blocks, rounds, and slot durations may also be used. The duration of the ranging slot 604 may vary based on the configuration of the ranging packet. In one example, the duration of a ranging packet without a physical layer payload (e.g., STS packet configuration three) may be approximately 150 microseconds (μs). In general, there is one ranging packet per ranging slot 604, and multiple ranging packets may be exchanged between the initiator and the responder in the corresponding ranging phase slot 608.

[0051] refer to Figure 7 , shows an example physical protocol data unit (PPDU) frame 700 incorporating a preamble for ranging. A UWB ranging session may utilize a packet format based on the PPDU frame 700. The PPDU frame 700 is an example and not a limitation, as other data structures may include a preamble for ranging. To reduce the chance of external attacks, such as Fig. 9As depicted in , the secure ranging protocol may use the AES-128 encryption algorithm to encrypt a physical layer (PHY) timestamp sequence. The PPDU frame 700 may include a synchronization header (SHR) 702, which includes a synchronization (SYNC) field 704 and a frame start delimiter (SFD) 706. The SYNC field 704 (also referred to as a preamble sequence) includes a predetermined sequence (such as an Ipatov ternary sequence) configured to improve autocorrelation properties. The SYNC field 704 (i.e., the preamble sequence) may be vulnerable to air attacks because the attacker may expect that a known sequence is being exploited. An encrypted sequence such as a scrambled timestamp sequence (STS) 708 may be used to increase the integrity and accuracy of the ranging measurement. The SSTS 708 may include a pseudo-random pulse sequence generated based on the Advanced Encryption Standard (AES) using a deterministic random bit generator (DRBG), such as Fig.10 . The SFD 706 is configured to help distinguish the SYNC field 704 from the STS 708. The STS 708 can be encrypted using the AES-128 algorithm, and the ToA estimate can be based on the decoded STS 708. In one example, if the received STS 708 can be cross-correlated with a locally generated reference, the range measurement can be verified. The receiving station can be configured to generate a security sequence locally based on the same key information as the key information used by the sending station to generate the STS 708. For example, the STS key and V value used in the AES algorithm can be provided to the receiving station via out-of-band transmission, and both the sending station and the receiving station can be configured to generate the STS 708. The PPDU frame 700 is an example of STS packet configuration three and does not include a data payload. In one example, other STS packet configurations (e.g., zero, one, and two) can also be used for UWB ranging sessions.

[0052] refer to Fig. 8A , a diagram 800 of an example signal exchange for UWB ranging is shown. Diagram 800 includes a first UWB device 802 (e.g., a smart phone) and a second UWB device 804 (e.g., a vehicle). The UWB devices 802, 804 may include some or all of the components of UE 200 and / or UWB device 380. UE 200 is an example of a first UWB device, and UWB device 380 is an example of a second UWB device 804. Each of the UWB devices 802, 804 includes one or more transceivers configured to transmit and receive UWB signals, such as depicted in communication module 402. The signal exchange may be based on the IEEE 802.15.4 standard, and may utilize, for example, FIG. 5A to FIG. 7. The physical layer (PHY) and medium access control (MAC) sublayers described in 802.15.4z are used to implement secure ranging. The positioning exchange can also utilize IEEE 802.15.4z security features, such as STS708 in the UWB ranging frame, to prevent preamble insertion attacks. In a first example, the UWB signal includes a one-sided bidirectional ranging exchange 808, so that the first UWB device 802 sends a ranging tag at time t1, which is received by the second UWB device 804 at time t2. The second UWB device 804 transmits an acknowledgment frame at time t3, which is received by the first UWB device at time t4. The first round-trip time (Tround1) is equal to t4-t1, and the first reply time (Treply1) is equal to t3-t1. The second UWB device 804 can be configured to provide the Treply1 time to the first UWB device 802. The first UWB device 802 can calculate the first round-trip propagation time:

[0053] Tprop1=Tround1-Treply1 (1)

[0054] The distance between the first UWB device 802 and the second UWB device 804 is equal to:

[0055] Distance = c*(Tprop1 / 2) (2)

[0056] Where c = speed of light.

[0057] In a second example, the signal includes a two-sided two-way ranging exchange 810, so that the first UWB device 802 will also send an acknowledgment at time t5, which is received by the second UWB device 804 at time t6. The first UWB device 802 may provide a second reply time (Treply2) (i.e., t5-t4) to the second UWB device 804. The Tprop time may be calculated as:

[0058] Tprop=((Tround1*Tround2)-(Treply1*Treply2)) /

[0059] (Tround1+Tround2-Treply1-Treply2)(3)

[0060] The propagation time (ie, Tprop) represents the time of flight (ToF) of respective signals between UWB devices 802, 804 and can be used to determine the distance between UWB devices 802, 804. In operation, UWB devices may be configured to determine distances up to 100m with an accuracy of approximately + / -10cm.

[0061] refer to Figure 8B, a diagram 850 of example angles of arrival of a UWB signal is shown. Diagram 850 includes a UWB device 852 (e.g., a first UWB device 802 or a second UWB device 804) having multiple antennas 854a, 854b in an antenna array. The antenna array detects a UWB signal 856 at an angle of arrival (AoA) Φ. In general, the AoA is based on the time difference between the arrival of the UWB signal 856 at each of the antennas 854a, 854b in the antenna array. The time delay between signal arrivals can be determined as:

[0062] t=d*sinΦ / c (4)

[0063] in:

[0064] t is the time delay;

[0065] d is the distance between antennas;

[0066] Φ is the AoA; and

[0067] c is the speed of light.

[0068] In operation, a UWB device may be configured to determine AoA with an accuracy of approximately + / - 1.5 degrees.

[0069] Reference Fig. 9, a diagram 900 of an example replay attack forging an arrival time estimate is shown. Diagram 900 includes a UE 902 and a vehicle 904 configured to exchange UWB ranging messages via a UWB link 908, as described herein. In previous security procedures, a responding station may be configured to receive a PPDU frame 700 from an initiator and then send a time-reversed and conjugated version of the received signal back to the initiator. An attacker 906 may be positioned to intercept a UWB ranging message on the UWB link 908 and perform a replay attack by sending a time-reversed and conjugated version of the signal sent by the initiator. As a result of the attacker's transmission, the initiating station may determine an earlier ToA of the attacker 906 and / or determine that there is interference on the UWB link 908. For example, the vehicle 904 may be an initiator that conducts a UWB ranging exchange with the UE 902 to determine a range to the UE 902. The vehicle 904 may be configured to enable security features based in part on the distance to the UE 902, such as unlocking doors, starting the engine, opening the trunk, etc. The vehicle 904 may send a data packet such as a PPDU frame 700 to the UE 902, and the UE 902 may be configured to transmit a time-reversed and conjugated version of the received signal back to the vehicle 904. The time reversal and conjugation of the signal may provide a time focusing effect for the signal received by the vehicle 904, and thus improve the detection of the ToA peak. However, this procedure is vulnerable to replay attacks because the attacker 906 receives the PPDU frame 700 (including the SYNC and STS sequences) and may generate a time-reversed and conjugated version of the received signal. The attacker 906 may then send the time-reversed and conjugated version of the received signal back to the vehicle 904. The vehicle 904 may determine the ToA based on the spoofed signal and incorrectly determine that the UE 902 is at the location of the attacker 906. Alternatively, the spoofed signal sent by the attacker 906 may cause the vehicle 904 to determine that there is interference on the channel and react accordingly (e.g., change channels, initiate another ranging session, deny access to the vehicle, etc.).

[0070] refer to Fig.10, a block diagram of a process 1000 for generating pseudo-random numbers based on the AES standard is shown. As described in the IEEE 802.15.4z standard, the resulting pseudo-random number can be used as an STS for ranging. Process 1000 utilizes a block size of 128 bits, but other sizes (e.g., 192 bits, 256 bits) may also be used. The STS consists of a sequence of pseudo-random pulses generated by a deterministic random bit generator (DRBG) based on AES-128 in a counter mode, such as process 1000. Each time the DRBG is run, it generates a 128-bit pseudo-random number for the STS. Process 1000 provides a 128-bit value V 1002 and a 128-bit key 1004 to an AES-128 algorithm 1008. The value V 1002 may include the upper 96 bits 1002a and a 32-bit counter 1002b, which may be incremented once per 128-bit output at stage 1006. The output of the AES-128 algorithm 1008 is a 128-bit pseudo-random number 1010 used to form an STS. In operation, the sending station and the receiving station may receive the V value and the key value (including the counter configuration) via the security component, and each station may generate the same 128-bit pseudo-random number 1010 based on those inputs. The receiving station may correlate the locally generated STS with the STS received from the sending station.

[0071] refer to Fig.11A and Fig. 11B , shows an example signal exchange 1100 and a corresponding time focusing effect based on correlating time-reversed and conjugated versions of the signal. Two UWB-capable devices such as a UE 1102 and a vehicle 1104 may be configured to perform a ranging session with each other. In one example, the UE 1102 may be a controller 502 and an initiator 508a, and the vehicle 1104 may be a controlled party 504 and a responder 510a. The UE 1102 may send a first ranging frame 1106 (e.g., PPDU frame 700) including a sequence p[n]. The sequence p[n] may be based on, for example, Figure 7 The vehicle 1104 may be configured to determine a ToA estimate based on relevant techniques as known in the art. The vehicle 1104 may also generate and transmit a second ranging frame 1108 including a sequence s[n] that is a time-reversed and conjugated version of the received p[n]. The received p[n] is implicitly based on the channel state h[n]. For example, referring to Fig. 11B, the first response curve 1110 is based on the channel state h[n], and the second response curve 1112 is the received p[n], which is based on p[n] and h[n]. The UE 1102 can be configured to correlate the received s[n] with the time-reversed version of the local STS (i.e., p*[-n]) to obtain a ToA estimate for the second ranging frame 1108. The correlation of the received s[n] with the time-reversed version of the local STS results in a time focusing effect as depicted in the third response curve 1114. The time focusing effect provides a distinguishable peak in the time domain, which is used for ToA estimation. Fig. 9 As described in , the problem with this approach is that a nearby adversary (e.g., attacker 906) can receive p[n] and then compute and send a time-reversed and conjugated version s[n]. As a result, UE 1102 may erroneously determine that there is interference on the channel and / or that vehicle 1104 is closer to UE 1102 than it actually is. Technical Advantages of the UWB Interference Detection and Secure Ranging Techniques Described in This Article Overcome security issues in the prior art by maintaining secure sequence information between the controller and the controlled party, which will reduce or eliminate the impact of replay attacks.

[0072] refer to Fig. 12A and Fig. 12B , shows an example signal exchange 1200 and an example signal diagram using interference detection and safety ranging signals. Two UWB compatible devices such as UE 1202 and vehicle 1204 are configured to perform signal exchange 1200. Fig.11A Compared to the signal exchange 1100 discussed in the foregoing, the signal exchange 1200 includes a security sequence q[n], which is provided to the UE 1202 and the vehicle 1204 via out-of-band messaging 1210 (e.g., separate from the ranging signal exchange). In one example, the out-of-band communication can utilize different radio access technologies (e.g., WiFi, Bluetooth, D2D, sidelink, etc.) to ensure that the security sequence q[n] is known only to the controller and the controlled party. The security sequence q[n] may be included in the CLM 506 exchanged between the UE 1202 and the vehicle 1204. The UE 1202 as an initiator 508a is configured to send a first ranging frame 1206 including a sequence p[n] (e.g., based on an STS), such as Fig.11A The vehicle 1204 is configured to receive the first ranging frame 1206 and generate and transmit a second ranging frame 1208 including a sequence s[n]. Compared to the signal exchange 1100 in which the sequence s[n] is simply a time-reversed and conjugated version of the received sequence p[n], the sequence s[n] in the second ranging frame 1208 is further based on the convolution of the received sequence p[n] with the safety sequence q[n], such that:

[0073]

[0074] s[n]=q[n]*p * [-n]*h * [-n]=z[n]*h * [-n] (6)

[0075] in:

[0076] h[n] is the channel; and

[0077] z[n] is q[n]*p * [-n].

[0078] The vehicle 1204 sends back a sequence s[n] in a second ranging frame 1208, and the UE 1202 is configured to correlate the received s[n] (i.e., s[n]*h[n]) with a local copy of z[n], which is based on the secure sequence q[n] and the sequence p[n]. Using W[n], a ToA estimate is obtained such that:

[0079] W[n]=(h[n]*h * [-n])*(∑z[m]z[mn]) (7)

[0080] in:

[0081] (h[n]*h * [-n]) is an equivalent channel (i.e., heq[n]); and

[0082] ∑z[m]z[mn] is the autocorrelation of z[n] (i.e., R zz [n]).

[0083] Function W[n] realizes the time focusing effect, making the equivalent channel (h eq [n]) is the portion of the signal received at UE 1202 (e.g., initiator 508a). Fig. 12B , the first response curve 1212 illustrates a channel response with a time focusing effect including a single peak and a relatively high peak-to-sidelobe ratio. UE 1202 can be configured to use, for example, the peak and sidelobe information associated with W[n] to perform integrity checks or interference detection. This approach provides a technical advantage of improving the robustness of signal exchange 1200 against replay attacks because the adversary does not know what q[n] gives.

[0084] In operation, in the presence of a replay attack, the convolution with the time-reversed version provided by the adversary can be expressed as W'[n] such that:

[0085]

[0086] in:

[0087] Yes * [-n] autocorrelation.

[0088] The function W'[n] in equation (8) will not produce the time focusing effect of equation (7), and therefore the resulting signal will appear as noise rather than a channel impulse response. Fig. 12B , the second response plot 1214 illustrates W'[n] when the adversary does not know the secure sequence q[n] and therefore s[n] sent by the adversary cannot be based on q[n]. Compared to the first response plot 1212, the second response plot 1214 includes multiple peaks distributed across time and a relatively low peak-to-sidelobe ratio. The presence of multiple peaks and / or low sidelobes can be used to detect replay attacks or channel interference. In one example, referring to Fig.13 , shows example illustrations of sidelobes associated with different correlation sequences. The first illustration 1300 depicts a relatively strong peak signal 1302 and a relatively low sidelobe signal 1304. The first illustration 1300 is associated with a time focusing effect and will result in an accurate ToA measurement. In contrast, the second illustration 1350 is associated with a sequence with a low correlation property (e.g., no time focusing effect). In this example, the difference between the peak signal 1352 and the sidelobe signal 1354 is small. The UE 1202 can be configured to detect the presence of sidelobes and determine whether the peak-to-sidelobe ratio is below a threshold (e.g., 1:4, 1:3:1:2, etc.) to detect a replay attack or channel interference. Other integrity checks based on the function W'[n] can be used.

[0089] In one example, an additional positive integrity check / interference detection procedure may utilize another controller sequence r[n] such that the point-by-point dot product (or other generalized operation) of W'[n] and r[n] becomes zero. This will occur when q[n] and r[n] are orthogonal to each other. This implies:

[0090]

[0091] Therefore, for a real signal:

[0092]

[0093] The security sequence q[n] and the controller sequence r[n] may be generated and / or provided by the controller. In the case where the sending station (e.g., UE 1202) is both the controller and the initiator, only the security sequence q[n] is provided to the responder via out-of-band messaging 1210 (i.e., r[n] is not provided to the responder). Other operations may be used to determine the controller sequence r[n] that is orthogonal to the security sequence q[n].

[0094] refer to Fig.14 , further reference Figures 1 to 13 , a method 1400 for determining the integrity of a UWB ranging signal includes the stages shown. However, the method 1400 is an example and not a limitation. The method 1400 may be modified, for example, by adding, removing, rearranging, combining, performing concurrently, and / or splitting a single stage into multiple stages. For example, calculating ToA at stage 1408 and determining the integrity of ToA at stage 1410 may be performed in a single stage. The method 1400 may be performed by a controller 502 in a UWB ranging session. The controller 502 may be a UE 200, an access point 300, a UWB device 380, or other wireless node configured to utilize a UWB ranging procedure.

[0095] At stage 1402, the method includes providing scrambled timestamp sequence information and a security sequence to a wireless node via a first radio access technology. UE 200, including processor 210 and transceiver 215, is a component for providing STS and security sequence to the wireless node. In one example, reference Fig. 12A , UE 1202 is configured to communicate with a responding station such as a vehicle 1204 via out-of-band messaging 1210. Out-of-band messaging may utilize security features such as WiFi security protocols (WEP, WPA, WPA2), Bluetooth security modes, or other security protocols to enable secure communications between UE 1202 and vehicle 1204. In one example, out-of-band messaging 1210 may utilize cellular topologies such as LTE, 5G NR, and other D2D and sidelink technologies. The STS information may include parameters for enabling / decoding AES encryption, such as STS keys and counter information, such as Fig.10 The security sequence q[n] may be included in the out-of-band message transmission. In one example, the length of the security sequence q[n] may be the same as the length of the STS. Other sequence lengths may also be used.

[0096] At stage 1404, the method includes sending one or more initiator data packets to the wireless node via the second radio access technology based at least in part on the scrambled timestamp sequence information. The UE 200 including the processor 210 and the transceiver 215 is a component for sending the one or more initiator data packets. In one example, the second radio access technology may be based on a UWB configuration, and the one or more initiator data packets may be included in a first ranging frame 1206 sent by the UE 1202. The one or more initiator data packets may be based on a UWB PHY format for ranging, such as a PPDU frame 700 including an STS 708 and STS information may be based on the STS key and counter information provided to the wireless node at stage 1402. In an example vehicle use case, such as Fig. 12AAs depicted in , UE 1202 may provide STS information and a security sequence q[n] via a WiFi exchange with a vehicle 1204, and then utilize UWB to send one or more initiator data packets including a sequence p[n] based on the STS to the vehicle 1204. Other use cases may utilize different combinations of radio access technologies.

[0097] At stage 1406, the method includes receiving one or more responder packets from the wireless node via the second radio access technology. The UE 200, including the processor 210 and the transceiver 215, is a component for receiving the one or more responder packets. The responder station is configured to generate a response based on the security sequence information received at stage 1402 and the one or more initiator data packets received at stage 1404. For example, referring to Fig. 12A , the vehicle 1204 as a responding station is configured to send a response packet including a sequence s[n] based on a time-reversed and conjugated version of the received sequence p[n] and the safety sequence q[n] as described in equation (6). The responder packet may utilize a UWB PHY format for ranging, such as a PPDU frame. The UE 1202 is configured to receive one or more responder packets including the sequence s[n] sent by the vehicle 1204.

[0098] At stage 1408, the method includes calculating an arrival time estimate based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence. The UE 200, including the processor 210, is a component for calculating the arrival time estimate. The initiating station is configured to utilize the STS information (e.g., p[n]) and the security sequence (e.g., q[n]) to generate a local sequence z[n] as described in equation (6). As indicated in equation (7), the ToA estimate is obtained based in part on z[n]. The function W[n] in equation (7) enables the time focusing effect to determine the ToA value. For example, referring to Fig. 12B , the first response curve 1212 illustrates a channel response having a time focusing effect including a single peak and a relatively high peak-to-sidelobe ratio. The time value 1200 associated with the single peak in the first curve 1212 is a ToA estimate.

[0099] At stage 1410, the method includes determining the integrity of the arrival time estimate based at least in part on the correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence. The UE 200 including the processor 210 is a component for determining the integrity of the ToA estimate. The initiator in the UWB ranging exchange can use the W[n] sequence to determine the peak signal, such as depicted in the first response plot 1212. The presence of a single peak suggests that the ToA estimate is based on a signal sent from the responder rather than the opponent station, or is otherwise reduced due to interference. In one example, the peak can be evaluated against a threshold to determine the integrity of the ToA estimate. For example, the presence of a single peak above a threshold (e.g., 0.6, 0.7, 0.8, etc.) can be used to determine that the ToA estimate is legitimate. Other techniques such as thresholds based on peak-to-sidelobe ratios can also be used to determine the integrity of the ToA estimate. In one example, another controller sequence r[n] orthogonal to q[n] can be used to determine the integrity of the ToA estimate, as described in equations (9) and (10). In one example, the threshold may be imposed on a statistic (such as a mean or variance) associated with a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence in the time domain, such as described in equation (8).

[0100] refer to Fig.15 , further reference Figures 1 to 13 , a method 1500 for sending a secure UWB ranging signal includes the stages shown. However, the method 1500 is an example and not a limitation. The method 1500 may be modified, for example, by adding, removing, rearranging, combining, performing concurrently, and / or splitting a single stage into multiple stages. The method 1500 may be performed by responders 510a, 510b in a UWB ranging session. The responders 510a, 510b may be UE 200, access point 300, UWB device 380, or other wireless nodes configured to utilize UWB ranging procedures.

[0101] At stage 1502, the method includes receiving scrambled timestamp sequence information and a security sequence from a wireless node via a first radio access technology. The UE 200 including the processor 210 and the transceiver 215 is a component for receiving the STS and the security sequence from the wireless node. In one example, reference Fig. 12A, the vehicle 1204 is configured to communicate with an initiating station such as UE 1202 via out-of-band messaging 1210. The out-of-band messaging may utilize security features such as WiFi security protocols (WEP, WPA, WPA2), Bluetooth security modes, or other security protocols to enable secure communications between the initiator and responder stations. In one example, the out-of-band messaging 1210 may utilize a cellular topology such as LTE, 5G NR, and other D2D and sidelink technologies. The STS information may include parameters for enabling / decoding AES encryption, such as STS keys and counter information, such as Fig.10 The security sequence q[n] is included in the out-of-band message transmission. In one example, the length of the security sequence q[n] can be the same as the length of the STS. Other sequence lengths can also be used.

[0102] At stage 1504, the method includes receiving one or more initiator data packets from a wireless node via a second radio access technology. The UE 200, including the processor 210 and the transceiver 215, is a means for receiving one or more initiator data packets. In one example, the second radio access technology may be based on a UWB configuration, and the one or more initiator data packets may be included in a first ranging frame 1206 sent by the UE 1202. The one or more initiator data packets may be based on a UWB PHY format for ranging, such as a PPDU frame 700 including an STS 708 and STS information, which may be decoded based on the STS key and counter information received from the wireless node at stage 1502. In an example vehicle use case, such as Fig. 12A As depicted in , UE 1202 may provide STS information and a security sequence q[n] via a WiFi exchange with a vehicle 1204, and then utilize UWB to send one or more initiator data packets including a sequence p[n] based on the STS to the vehicle 1204. Other use cases may utilize different combinations of radio access technologies. In one example, the responder may be configured to decode the one or more initiator data packets based on the STS information (e.g., a key and a counter value), and determine the ToA of the one or more initiator data packets.

[0103] At stage 1506, the method includes generating one or more responder packets based on the received one or more initiator data packets and the security sequence. The UE 200 including the processor 210 is a means for generating one or more responder packets. The responders 510a, 510b are configured to generate a response based on the security sequence information received at stage 1502 and the one or more initiator data packets received at stage 1504. For example, referring to Fig. 12A, the vehicle 1204 is configured to generate a sequence s[n] based on a time-reversed and conjugated version of the received sequence p[n] and the safety sequence q[n] as described in equation (6).

[0104] At stage 1508, the method includes sending one or more responder packets to the wireless node via the second radio access technology. The UE 200, including the processor 210 and the transceiver 215, is a component for sending the one or more responder packets. The one or more responder packets may utilize a UWB PHY format for ranging, such as a PPDU frame. Fig. 12A In the vehicle security use case depicted in , the vehicle 1204 is configured to send one or more responder packets including a sequence s[n] to the UE 1202, and the UE 1202 is configured to verify the integrity of the one or more responder packets based at least in part on the security sequence q[n].

[0105] Other examples and specific implementations are within the scope of the present disclosure and the appended claims. For example, due to the nature of software and computers, the above functions can be implemented using software, hardware, firmware, hard wiring or any combination thereof executed by a processor. The features of the implementation functions can also be physically located at different locations, including being distributed so that the various parts of the functions are implemented at different physical locations. Unless otherwise stated, the components (functional or otherwise) shown in the figures and / or discussed herein as connected or communicating with each other are communicatively coupled. That is, these components can be directly or indirectly connected to achieve communication between them.

[0106] As used herein, the singular forms "a", "an", and "the" also include the plural forms, unless the context clearly indicates otherwise. For example, "a processor" may include one processor or a plurality of processors. As used herein, the terms "comprises", "includes" specify the presence of recited features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0107] As used herein, unless otherwise stated, a statement that a function or operation is "based on" an item or condition means that the function or operation is based on the stated item or condition, and may be based on one or more items and / or conditions other than the stated item or condition.

[0108] Likewise, as used herein, “or” used in a list of items (possibly followed by “at least one of” or followed by “one or more of”) indicates a disjunctive list, so that, for example, a list of “at least one of A, B, or C,” or a list of “one or more of A, B, or C,” or a list of “A or B or C” means A or B or C, or AB (A and B), or AC (A and C), or BC (B and C), or ABC (i.e., A and B and C), or a combination having more than one feature (e.g., AA, AAB, ABBC, etc.). Thus, a statement that an item (e.g., a processor) is configured to perform a function with respect to at least one of A or B, or a statement that an item is configured to perform function A or function B means that the item can be configured to perform the function with respect to A, or can be configured to perform the function with respect to B, or can be configured to perform the function with respect to both A and B. For example, the phrase "a processor configured to measure at least one of A or B" or "a processor configured to measure A or measure B" means that the processor may be configured to measure A (and may or may not be configured to measure B), or may be configured to measure B (and may or may not be configured to measure A), or may be configured to measure A and measure B (and may be configured to select which of A and B to measure or both). Similarly, a recitation of a component for measuring at least one of A or B includes: a component for measuring A (which may or may not be able to measure B), or a component for measuring B (and may or may not be configured to measure A), or a component for measuring A and B (which may be able to select which of A and B to measure or both). As another example, a recitation of an item (e.g., a processor) being configured to perform at least one of function X or to perform function Y means that the item may be configured to perform function X, or may be configured to perform function Y, or may be configured to perform function X and perform function Y. For example, the phrase "a processor configured to measure at least one of X or Y" means that the processor may be configured to measure X (and may or may not be configured to measure Y), or may be configured to measure Y (and may or may not be configured to measure X), or may be configured to measure X and measure Y (and may be configured to select which or both of X and Y to measure). Substantial changes may be made depending on specific requirements. For example, customized hardware may also be used, and / or particular elements may be implemented in hardware, in software executed by a processor (including portable software, such as applets, etc.), or in both. In addition, connections to other computing devices such as network input / output devices may be employed.

[0109] The systems and devices discussed above are examples. Various configurations may appropriately omit, replace, or add various procedures or components. For example, features described with respect to certain configurations may be combined in various other configurations. Different aspects and elements of a configuration may be combined in a similar manner. In addition, technology is constantly evolving, and therefore many elements are examples and do not limit the scope of the present disclosure or claims.

[0110] A wireless communication system is a system in which communications are transmitted wirelessly, i.e., by electromagnetic waves and / or sound waves propagating through atmospheric space rather than by wires or other physical connections. A wireless communication network may not cause all communications to be sent wirelessly, but may be configured to cause at least some communications to be sent wirelessly. Furthermore, the term "wireless communication device" or similar terms does not require that the functionality of the device is used exclusively or even primarily for communication, or that the device is a mobile device, but rather indicates that the device includes wireless communication capabilities (unidirectional or bidirectional), for example, including at least one radio component (each radio component is part of a transmitter, receiver or transceiver) for wireless communication.

[0111] Specific details are given in this specification to provide a thorough understanding of exemplary configurations (including specific implementations). However, configurations can be practiced without these specific details. For example, well-known circuits, processes, algorithms, structures, and techniques have been shown without unnecessary details to avoid confusing these configurations. This specification provides exemplary configurations without limiting the scope, applicability, or configuration of the claims. On the contrary, the previous description of the configuration provides a description for implementing the described technology. Various changes can be made to the functions and arrangements of the elements without departing from the spirit or scope of the present disclosure.

[0112] As used herein, the terms "processor-readable medium," "machine-readable medium," and "computer-readable medium" refer to any medium that participates in providing data that causes a machine to operate in a particular manner. Using a computing platform, various processor-readable media may be involved in providing instructions / codes to a processor for execution, and / or may be used to store and / or carry such instructions / codes (e.g., as signals). In many specific implementations, processor-readable media are physical and / or tangible storage media. Such media may take many forms, including, but not limited to, non-volatile media and volatile media. Non-volatile media include, for example, optical disks and / or magnetic disks. Volatile media include, but are not limited to, dynamic memory.

[0113] A statement that a value exceeds (or is greater than or above) a first threshold is equivalent to a statement that the value meets or exceeds a second threshold that is slightly greater than the first threshold, e.g., the second threshold is one value higher than the first threshold at the resolution of the computing system. A statement that a value is less than (or within or below) a first threshold is equivalent to a statement that the value is less than or equal to a second threshold that is slightly less than the first threshold, e.g., the second threshold is one value lower than the first threshold at the resolution of the computing system.

[0114] Specific implementation examples are described in the following numbered clauses:

[0115] Item 1. A method for determining the integrity of an ultra-wideband (UWB) ranging signal, the method comprising: providing scrambled timestamp sequence information and a security sequence to a wireless node via a first radio access technology; sending one or more initiator data packets to the wireless node via a second radio access technology based at least in part on the scrambled timestamp sequence information; receiving one or more responder data packets from the wireless node via the second radio access technology; calculating an arrival time estimate based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence; and determining the integrity of the arrival time estimate based at least in part on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

[0116] Clause 2. The method of clause 1, wherein the first radio access technology is based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol.

[0117] Clause 3. The method of clause 1, wherein the scrambled timestamp sequence information comprises a key value and a counter value associated with an encryption procedure.

[0118] Clause 4. The method of clause 1, wherein the one or more initiator data packets and the one or more responder data packets are configured using a physical protocol data unit frame.

[0119] Clause 5. A method according to clause 1, wherein calculating the arrival time estimate includes identifying a peak based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence, and determining a time value associated with the peak.

[0120] Clause 6. The method of clause 1, wherein determining the integrity of the arrival time estimate comprises identifying a single peak based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

[0121] Clause 7. The method of clause 6, further comprising: determining that the single peak value exceeds a threshold.

[0122] Clause 8. The method of clause 1, wherein determining the integrity of the arrival time estimate comprises determining a peak-to-sidelobe ratio based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

[0123] Clause 9. The method of clause 1, wherein determining the integrity of the arrival time estimate comprises determining a statistical value in the time domain associated with the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

[0124] Clause 10. The method according to clause 1 further comprises: calculating a control side sequence orthogonal to the security sequence, wherein determining the integrity of the arrival time estimate comprises: performing a generalized operation using the control side sequence and the correlation between the one or more received responder data packets and the encrypted timestamp sequence information and the security sequence.

[0125] Clause 11. A method for sending a secure ultra-wideband (UWB) ranging signal, the method comprising: receiving scrambled timestamp sequence information and a security sequence from a wireless node via a first radio access technology; receiving one or more initiator data packets from the wireless node via a second radio access technology; generating one or more responder data packets based on the received one or more initiator data packets and the security sequence; and sending the one or more responder data packets to the wireless node via the second radio access technology.

[0126] Clause 12. The method of clause 11, wherein the first radio access technology is based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol.

[0127] Clause 13. The method of clause 11, wherein the scrambled timestamp sequence information comprises a key value and a counter value associated with an encryption procedure.

[0128] Clause 14. The method of clause 11, wherein the one or more initiator data packets and the one or more responder data packets are configured using a physical protocol data unit frame.

[0129] Clause 15. The method of clause 11, wherein the length of the security sequence is at least the length of a scrambled timestamp sequence in the one or more initiator data packets.

[0130] Item 16. A device comprising: a memory; at least one transceiver; at least one processor, the at least one processor being communicatively coupled to the memory and the at least one transceiver and the at least one processor being configured to: provide scrambled timestamp sequence information and a security sequence to a wireless node via a first radio access technology; send one or more initiator data packets to the wireless node via a second radio access technology based at least in part on the scrambled timestamp sequence information; receive one or more responder data packets from the wireless node via the second radio access technology; calculate an arrival time estimate based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence; and determine the integrity of the arrival time estimate based at least in part on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

[0131] Clause 17. The apparatus of clause 16, wherein the first radio access technology is based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol.

[0132] Clause 18. The apparatus of Clause 16, wherein the scrambled timestamp sequence information comprises a key value and a counter value associated with an encryption procedure.

[0133] Clause 19. The apparatus of Clause 16, wherein the one or more initiator data packets and the one or more responder data packets are configured using a physical protocol data unit frame.

[0134] Clause 20. An apparatus according to clause 16, wherein the at least one processor is further configured to: identify a peak based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence; and determine a time value associated with the peak.

[0135] Clause 21. An apparatus according to clause 16, wherein the at least one processor is further configured to: identify a single peak based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence to determine the integrity of the arrival time estimate.

[0136] Clause 22. The apparatus of clause 21, wherein the at least one processor is further configured to determine that the single peak exceeds a threshold.

[0137] Clause 23. An apparatus according to clause 16, wherein the at least one processor is further configured to determine a peak-to-sidelobe ratio based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence to determine the integrity of the arrival time estimate.

[0138] Clause 24. An apparatus according to clause 16, wherein the at least one processor is further configured to: determine a statistical value in the time domain associated with the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence to determine the integrity of the arrival time estimate.

[0139] Clause 25. An apparatus according to clause 16, wherein the at least one processor is further configured to: calculate a controller sequence orthogonal to the security sequence; and perform a generalized operation using the controller sequence and the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence to determine the integrity of the arrival time estimate.

[0140] Clause 26. A device comprising: a memory; at least one transceiver; at least one processor, the at least one processor being communicatively coupled to the memory and the at least one processor and the at least one processor being configured to: receive scrambled timestamp sequence information and a security sequence from a wireless node via a first radio access technology; receive one or more initiator data packets from the wireless node via a second radio access technology; generate one or more responder data packets based on the received one or more initiator data packets and the security sequence; and send the one or more responder data packets to the wireless node via the second radio access technology.

[0141] Clause 27. The apparatus of clause 26, wherein the first radio access technology is based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol.

[0142] Clause 28. The apparatus of Clause 26, wherein the scrambled timestamp sequence information comprises a key value and a counter value associated with an encryption procedure.

[0143] Clause 29. The apparatus of Clause 26, wherein the one or more initiator data packets and the one or more responder data packets are configured using a physical protocol data unit frame.

[0144] Clause 30. The apparatus of clause 26, wherein the length of the security sequence is at least the length of a scrambled timestamp sequence in the one or more initiator data packets.

[0145] Item 31. An apparatus for determining the integrity of an ultra-wideband (UWB) ranging signal, the method comprising: a component for providing scrambled timestamp sequence information and a security sequence to a wireless node via a first radio access technology; a component for sending one or more initiator data packets to the wireless node via a second radio access technology based at least in part on the scrambled timestamp sequence information; a component for receiving one or more responder data packets from the wireless node via the second radio access technology; a component for calculating an arrival time estimate based on a correlation between the one or more received responder data packets and the scrambled timestamp sequence information and the security sequence; and a component for determining the integrity of the arrival time estimate based at least in part on the correlation between the one or more received responder data packets and the scrambled timestamp sequence information and the security sequence.

[0146] Clause 32. An apparatus for sending a secure ultra-wideband (UWB) ranging signal, the method comprising: a component for receiving scrambled timestamp sequence information and a security sequence from a wireless node via a first radio access technology; a component for receiving one or more initiator data packets from the wireless node via a second radio access technology; a component for generating one or more responder data packets based on the received one or more initiator data packets and the security sequence; and a component for sending the one or more responder data packets to the wireless node via the second radio access technology.

[0147] Item 33. A non-transitory processor-readable storage medium, the non-transitory processor-readable storage medium comprising processor-readable instructions, the processor-readable instructions being configured to cause one or more processors to determine the integrity of an ultra-wideband (UWB) ranging signal, the processor-readable instructions comprising code for the following operations: providing scrambled timestamp sequence information and a security sequence to a wireless node via a first radio access technology; sending one or more initiator data packets to the wireless node via a second radio access technology based at least in part on the scrambled timestamp sequence information; receiving one or more responder data packets from the wireless node via the second radio access technology; calculating an arrival time estimate based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence; and determining the integrity of the arrival time estimate based at least in part on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

[0148] Clause 34. A method for sending a secure ultra-wideband (UWB) ranging signal, the method comprising: receiving scrambled timestamp sequence information and a security sequence from a wireless node via a first radio access technology; receiving one or more initiator data packets from the wireless node via a second radio access technology; generating one or more responder data packets based on the received one or more initiator data packets and the security sequence; and sending the one or more responder data packets to the wireless node via the second radio access technology.

Claims

1. A method for determining the integrity of an ultra-wideband (UWB) ranging signal, the method comprising: providing scrambled timestamp sequence information and a security sequence to a wireless node via a first radio access technology; transmitting one or more initiator data packets to the wireless node via a second radio access technology based at least in part on the scrambled timestamp sequence information; receiving one or more responder data packets from the wireless node via the second radio access technology; calculating an arrival time estimate based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence; as well as The integrity of the arrival time estimate is determined based at least in part on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence. 2 . The method of claim 1 , wherein the first radio access technology is based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol. 3 . The method of claim 1 , wherein the scrambled timestamp sequence information comprises a key value and a counter value associated with an encryption procedure.

4. The method of claim 1, wherein the one or more initiator data packets and the one or more responder data packets are configured using a physical protocol data unit frame.

5. The method of claim 1 , wherein calculating the arrival time estimate comprises: identifying a peak based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence; and determining a time value associated with the peak value.

6. The method of claim 1 , wherein determining the completeness of the arrival time estimate comprises: A single peak is identified based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

7. The method according to claim 6, further comprising: It is determined that the single peak exceeds a threshold.

8. The method of claim 1 , wherein determining the completeness of the arrival time estimate comprises: A peak-to-sidelobe ratio is determined based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

9. The method of claim 1 , wherein determining the completeness of the arrival time estimate comprises: A statistic in a time domain associated with the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence is determined.

10. The method according to claim 1, further comprising: and calculating a controller sequence orthogonal to the security sequence, wherein determining the integrity of the arrival time estimate comprises performing a generalized operation using the controller sequence and the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence.

11. A method for transmitting a secure ultra-wideband (UWB) ranging signal, the method comprising: receiving scrambled timestamp sequence information and a security sequence from a wireless node via a first radio access technology; receiving one or more initiator data packets from the wireless node via a second radio access technology; generating one or more responder data packets based on the received one or more initiator data packets and the security sequence; as well as The one or more responder data packets are sent to the wireless node via the second radio access technology. 12 . The method of claim 11 , wherein the first radio access technology is based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol.

13. The method of claim 11, wherein the scrambled timestamp sequence information comprises a key value and a counter value associated with an encryption procedure.

14. The method of claim 11, wherein the one or more initiator data packets and the one or more responder data packets are configured using a physical protocol data unit frame.

15. The method of claim 11, wherein the length of the security sequence is at least the length of a scrambled timestamp sequence in the one or more initiator data packets.

16. A device, comprising: Memory; at least one transceiver; at least one processor communicatively coupled to the memory and the at least one transceiver and configured to: providing scrambled timestamp sequence information and a security sequence to a wireless node via a first radio access technology; transmitting one or more initiator data packets to the wireless node via a second radio access technology based at least in part on the scrambled timestamp sequence information; receiving one or more responder data packets from the wireless node via the second radio access technology; calculating an arrival time estimate based on a correlation of one or more received responder data packets with the scrambled timestamp sequence information and the security sequence; as well as An integrity of the arrival time estimate is determined based at least in part on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence. 17 . The apparatus of claim 16 , wherein the first radio access technology is based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol.

18. The apparatus of claim 16, wherein the scrambled timestamp sequence information comprises a key value and a counter value associated with an encryption procedure.

19. The apparatus of claim 16, wherein the one or more initiator data packets and the one or more responder data packets are configured using a physical protocol data unit frame.

20. The apparatus of claim 16, wherein the at least one processor is further configured to: identify a peak based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence; and determine a time value associated with the peak.

21. The apparatus of claim 16, wherein the at least one processor is further configured to identify a single peak based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence to determine the integrity of the arrival time estimate.

22. The apparatus of claim 21, wherein the at least one processor is further configured to determine that the single peak value exceeds a threshold.

23. The apparatus of claim 16, wherein the at least one processor is further configured to determine a peak-to-sidelobe ratio based on the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence to determine the integrity of the arrival time estimate.

24. The apparatus of claim 16, wherein the at least one processor is further configured to determine a statistical value in a time domain associated with the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence to determine the integrity of the arrival time estimate.

25. The apparatus of claim 16, wherein the at least one processor is further configured to: calculate a controller sequence orthogonal to the security sequence; and perform a generalized operation using the controller sequence and the correlation of the one or more received responder data packets with the scrambled timestamp sequence information and the security sequence to determine the integrity of the arrival time estimate.

26. An apparatus, comprising: Memory; at least one transceiver; at least one processor, the at least one processor being communicatively coupled to the memory and the at least one processor and the at least one processor being configured to: receiving scrambled timestamp sequence information and a security sequence from a wireless node via a first radio access technology; receiving one or more initiator data packets from the wireless node via a second radio access technology; generating one or more responder data packets based on the received one or more initiator data packets and the security sequence; as well as The one or more responder data packets are sent to the wireless node via the second radio access technology.

27. The apparatus of claim 26, wherein the first radio access technology is based on at least one of a WiFi protocol, a Bluetooth protocol, and a cellular network protocol.

28. The apparatus of claim 26, wherein the scrambled timestamp sequence information comprises a key value and a counter value associated with an encryption procedure.

29. The apparatus of claim 26, wherein the one or more initiator data packets and the one or more responder data packets are configured using a physical protocol data unit frame.

30. The apparatus of claim 26, wherein the length of the security sequence is at least the length of a scrambled timestamp sequence in the one or more initiator data packets.

Images