Detecting attacks in SS-TWR communications

Abstract

Described herein is a communication device (110) configured to perform single-sided bidirectional ranging SS-TWR communication with a further communication device (120), the communication device (110) comprising a control device configured to: i) transmit a first SS-TWR signal to the further communication device (120), the method comprises the steps of: i) receiving a first SS-TWR signal (140) associated with the first SS-TWR signal from the further communication device (120), ii) receiving a second SS-TWR signal (140) associated with the first SS-TWR signal from the further communication device (120), iii) evaluating a carrier frequency offset of the received second SS-TWR signal (140), and iv) determining whether an attack has been performed on the SS-TWR communication based on the evaluation.

Description

Technical Field

[0001] The present disclosure relates to a communication device for single-sided two-way ranging (SS-TWR) with another communication device, in particular wherein a carrier frequency offset of a received SS-TWR signal is evaluated with respect to a potential attack. The present disclosure further relates to a communication system and a method of detecting an attack on such a communication system. Thus, the present disclosure may relate to the technical field of wireless communication devices, in particular in the context of ranging and ultra-wideband (UWB) applications. Background Art

[0002] Wireless communication devices are widely used to enable communication between electronic devices. Such communication devices typically include a transmitter for transmitting (radio frequency, RF) signals and a receiver for receiving signals, in particular in response to the transmitted signals. In addition to data exchange, communication may also include ranging, i.e. measuring the distance between two or more communication devices. For example, the time of flight (ToF) of a signal between two communication devices may be recorded (e.g., based on a timestamp) in order to calculate the physical distance between the two communication devices.

[0003] For example, ultra-wideband (UWB) wireless technology enables secure, accurate ranging with an error of less than 10 cm. The security aspect here comes from the UWB radio's ability to ensure that an attacker cannot reduce the distance estimate, thereby guaranteeing that the measured distance is an upper limit on the actual physical distance between two UWB-enabled communicating devices.

[0004] However, the accuracy of one of the simplest and most common ranging schemes, the so-called Single-Sided Two-Way Ranging (SS-TWR), relies on a frequency offset estimator that is susceptible to a potential attack vector of range degradation. In other words, an attacker could change the measured physical distance between devices. In the example of a UWB application for opening a vehicle's door, an attacker could manipulate the SS-TWR so that the door would open.

[0005] Figure 8A conventional timing diagram of an IR-UWB packet exchange for performing SS-TWR measurements is shown. An initiator device (communication device) transmits a polling message (a transmitted first signal) that is received by a responder device (another communication device). After processing the polling message, the responder device transmits a response message (a received second signal associated with the transmitted first signal). Both devices have an accurate system clock that generates a timestamp whenever a message is received or transmitted. The initiator device stores a timestamp t_send_poll when it transmits its polling message, and stores a timestamp t_rec_resp when it receives a response message from the responder device. The responder device stores t_rec_poll when it receives a polling message, and stores t_send_resp when it transmits a response message. The black line between SYNC and STS represents a packet reference marker used to generate a timestamp. In practice, a packet may include a frame start delimiter (SFD) between the preamble SYNC and STS, with a reference marker or RMARKER located at the end of the SFD (not shown).

[0006] By knowing all stored timestamps, the time of flight (TOF) associated with the UWB message exchange can be calculated. The TOF is calculated based on the measured timestamps as shown in the following equation:

[0007] T resp =t send_resp -t rec_poll

[0008] T round =t rec_resp -t send_poll

[0009] TOF=(T round -T resp ) / 2

[0010] The measured timestamps can be exchanged "out-of-band" (e.g., using Bluetooth), or "in-band" by using UWB packets that additionally include a data segment for the timestamp exchange. The timestamp exchange method does not affect the ranging packet timing of the TOF calculation, so it can be ignored in the calculation.

[0011] Each IR-UWB ranging packet includes a pseudo-random modulated pulse sequence unique to each packet. The sequence is generated based on one or more pre-shared secrets, so both sides (the initiator device and the responder device) know what the sequence of the polling packet and the response packet should be. If the responder device receives a packet whose sequence does not fit the expected STS, the responder device rejects the packet and does not respond, so the packet exchange will not be used to estimate the TOF. The initiator device behaves in a similar manner, and if a packet whose STS does not match the expected STS is received, the message timestamp is not used to calculate the TOF between the devices. In order to inject a packet verified on the initiator / responder side, the attacker needs to know the STS sequence of the packet, which is impossible to achieve with a reasonable probability without knowing the pre-shared secret or without receiving the transmitted packet from the initiator / responder. In other words, without knowing the pre-shared secret required to generate the STS sequence, the attacker cannot in principle shorten the measured TOF between the initiator device and the responder device.

[0012] However, as shown in the above formula, the assumption for accurately estimating TOF using SS-TWR is that the initiator and responder devices have very accurate system clocks with no drift or negligible drift. Alternatively, one of the devices should estimate and compensate for the clock frequency offset introduced by the drift, which is a common approach used in conventional UWB devices.

[0013] Fig. 9 A timing diagram showing SS-TWR communication / exchange with a responder device having a non-ideal clock is shown. This diagram assumes that the initiator device has an ideal internal clock with a clock frequency f_initiator, and the responder has a non-ideal clock frequency f_responder. The relationship between f_initiator and f_responder is as follows:

[0014] f_responder = f_initiator * k drift

[0015] This means that the physical response time of the responder device to transmit the response packet increases with a factor k. drift The physical response time is scaled, but the actual measured response time on the responder side is constant and does not scale with the frequency scaling factor. The relationship between the physical response time and the measured response time is as follows:

[0016] T resp_physical =T resp_measured / k drift

[0017] If the initiator device and responder device clocks run at different unknown clock frequencies, this will introduce TOF calculation errors. The effect of clock frequency offset on TOF calculation is shown by the following formula:

[0018] T round =2*TOF+T resp_physical

[0019] TOF calc =(T round -T resp_measured ) / 2=(2*TOF+T resp_physical -T resp_physical *k drift ) / 2

[0020] =TOF+(T resp_physical (1-k drift )) / 2

[0021] Assuming for example a response time of 1 ms and a clock frequency deviation of 10 ppm from an ideal clock, the TOF calculation error based on the clock drift is already 5 ns, which results in a distance measurement error of approximately 1.5 m.

[0022] A common approach to correct errors caused by clock frequency offset (CFO) in SS-TWR is to measure and compensate for the CFO on the responder side in the TOF calculation. This compensation can also be done directly at the initiator. To do this, the initiator measures its CFO relative to the responder and then compensates for it directly in the ToF equation.

[0023] The following formula shows the TOF calculation taking into account the measured clock frequency offset. Compensating for the clock frequency offset significantly improves the accuracy of SS-TWR, which is the key to using this scheme:

[0024] TOF comp =((T round -(T resp_measured / k drift_measured )) / 2

[0025] =TOF+((T resp_physical (1-(k drift / k drift_measured )) / 2~TOF

[0026] However, SS-TWR communications are susceptible to attacks that produce range degradation, i.e., attacks that can shorten the range estimate, which may be unacceptable for many applications such as the vehicle key use case mentioned above. For example, in a SS-TWR implementation without CFO compensation, an attacker can reduce the measured range by heating or cooling one of the devices in order to change the clock frequency offset relative to the nominal frequency of one of the devices towards reducing the estimated range.

[0027] The SS-TWR version of clock drift compensation is susceptible to a more practical attack that reduces the calculated TOF by changing the perceived clock drift that is later compensated. Clock drift can be measured by observing the carrier frequency of the incoming signal or across several pulses within a packet. An attacker could change the carrier frequency, for example, by demodulating the incoming RF signal and modulating the resulting baseband signal back onto a higher carrier frequency. To change the PRF of an IR-UWB packet, the packet needs to be replayed faster or slower depending on the desired PRF change.

[0028] Fig.10 A simplified example of a hardware device (attacker device) 130 that can be used to create such a frequency offset attack is shown. The attacker device receives a signal with a carrier frequency fc_orig. This signal is mixed down to baseband or an intermediate frequency by an analog composite mixer. The down-mixed signal frequency is fc0. Thereafter, the signal is filtered and mixed up again at the mixer frequency fc1. The resulting signal now has a frequency fc_orig+(fc1-fc0); this means that by controlling the frequencies fc1 and fc0, the attacker can determine the frequency of the received signal and the clock frequency offset measured and compensated by the legitimate receiver device. Changing this clock frequency offset estimate enables the attacker to increase or decrease the distance estimate in an SS-TWR implementation with clock frequency offset compensation. The power amplifier (PA) in this circuit system ensures that the signal has sufficient signal strength to be detected by the legitimate receiver device.

[0029] Fig.11 A timing diagram of a clock drift compensation SS-TWR attack with a clock frequency offset changed by an attacker is shown. For simplicity, ideal initiator and responder device clock frequencies are assumed for the scenario. Also, in this example, the attacker device is able to increase the carrier frequency by a factor k without increasing processing delay. drift_attack For an ideal attacker, a real-world attacker device may add a few nanoseconds. The signal from the responder device to the initiator device is blocked, so the initiator device receives the signal from the attacker device to estimate the clock frequency offset and round-trip time. The attacker timing is described in the following formula:

[0030] T resp_att =T resp

[0031] T round_attack =T resp_att +2*TOF

[0032] The impact of the attack on TOF calculation is shown below:

[0033] TOF attack =(T round_attack -(Tresp / k drift_attack )) / 2=TOF+((T resp -(T resp / k drift_attack )) / 2)

[0034] This formula shows that the impact of the attacker device on the TOF calculation may be linear with the clock drift introduced by the attacker. In one example, assuming a maximum attacker clock drift of 20ppm and a response time of 1ms, the attacker may have been able to reduce the measured TOF by about 10ns, which results in a reduction of the distance measurement by about 3m. This may be unacceptable for many applications, such as (passive) access systems.

[0035] Therefore, considering the limited resources and time for frame processing, up-mixing and down-mixing the incoming signal could be a real example of attacking SS-TWR communication. Summary of the invention

[0036] It may be desirable to detect attacks on SS-TWR communication systems in an efficient and reliable manner. A communication device, a communication system, a method and a method of use are provided.

[0037] According to one aspect of the present disclosure, a communication device (e.g., a mobile phone) is described, wherein the communication device is configured to perform single-sided two-way ranging (SS-TWR) communication (interaction of two devices, which may include ranging exchange) with another communication device (e.g., another mobile phone), wherein the communication device includes a control device (e.g., one or more processors, integrated circuits (ICs), etc.), wherein the control device is configured to:

[0038] i) transmitting (in particular via an antenna) a first SS-TWR signal to the further communication device,

[0039] ii) receiving (in particular via an antenna) from said further communication device a second SS-TWR signal associated with the first SS-TWR signal (i.e. sent as a reply to the first SS-TWR signal),

[0040] iii) evaluating a carrier frequency offset of the received second SS-TWR signal (relative to the first SS-TWR signal), and

[0041] iv) Based on the evaluation, determining whether to perform an attack on the SS-TWR communication (eg, an attack on clock frequency offset correction).

[0042] According to another aspect of the present disclosure, a communication system is described, the communication system comprising:

[0043] i) a communication device as described above,

[0044] ii) said further communication device (configured similarly or differently to said communication device); and in particular

[0045] iii) an attacker device, in particular configured to attack the SS-TWR communication between said communication device and said further communication device.

[0046] According to a further aspect of the present disclosure, a method of detecting an attack in a communication system is described, the method comprising:

[0047] i) transmitting a first SS-TWR signal;

[0048] ii) receiving a second SS-TWR signal associated with the first SS-TWR signal;

[0049] iii) evaluating a carrier frequency offset of the SS-TWR signal; and

[0050] iv) based on said evaluation, determining whether an attack has been performed on said communication system.

[0051] According to one aspect of the present disclosure, a use (method of use) of comparing a carrier frequency offset to a baseband frequency offset for determining an attack in SS-TWR communications, particularly UWB communications, is described.

[0052] In the context of this document, the term "communication device" may refer to any electrical device that is, in particular, portable and can establish wireless communication with another device, in particular by transmitting / receiving SS-TWR signals. In one example, the communication device comprises only a control device, such as a processor or an integrated circuit. In another example, the communication device further comprises an antenna and / or is integrated in a larger device, such as a mobile phone, a key, a door, a gate, etc. In one example, the communication device comprises a front end, in particular a UWB front end.

[0053] According to an exemplary embodiment, the present invention may be based on the idea that an attack on a SS-TWR communication system may be detected in an efficient and reliable manner when a received second SS-TWR signal (associated with a transmitted first SS-TWR signal) is evaluated with respect to its carrier frequency offset, for example whereby the carrier frequency offset is compared with an integrity criterion (checked for integrity). Here, the integrity criterion may be a measure as to whether the carrier frequency offset is i) within an acceptable and therefore credible range or ii) within an unacceptable and therefore untrustworthy range. In the latter case, it may be said that an attack has most likely been performed with respect to the SS-TWR communication. This attack may be as described above with respect to Figures 8 to 11 The description is performed using down-up mixing of the incoming signal in the context of clock frequency offset correction.

[0054] The described (SS-TWR) communication device is configured to estimate the frequency offset between the initiator device and the responder device on the radio frequency (RF) band (carrier frequency). This can be achieved, for example, by a time and / or phase tracking unit. In other words, the described method enables the communication device (receiver) to estimate whether the carrier frequency of the signal has been changed by an attacker. If the mechanism detects that the carrier frequency has been changed, then an attacker is likely present.

[0055] Although the SS-TWR communication described above is generally considered secure, the inventors have found that in particular an attack on the carrier frequency is possible, which, however, can be detected in an efficient manner by evaluating the carrier frequency offset of the incoming signal.

[0056] The evaluation of carrier frequency offset in the context of SS-TWR can be further improved by exemplary embodiments of the present disclosure. For example, the comparison of carrier frequency offset to baseband frequency offset may be particularly reliable in detection and particularly difficult for attackers to circumvent. In another example, the evaluation of the channel impulse response (CIR) can produce further valuable information to detect the presence of an attack.

[0057] The aspects defined above and further aspects of the disclosure are apparent from the examples of embodiment to be described hereinafter and are explained with reference to these examples of embodiment.The disclosure will be described in more detail hereinafter with reference to examples of embodiment but to which the disclosure is not limited.

[0058] Exemplary Embodiments

[0059] According to an embodiment, the communication device is configured as an ultra-wideband UWB device and / or wherein the SS-TWR signal is configured as a UWB signal.Thereby, established and economically important standards can be directly applied.

[0060] In the context of this article, the term "ultra-wideband communication" (or ultra-wideband) may refer to a radio technology that can use very low energy levels on most of the radio spectrum for short-range, high-bandwidth communications. UWB may refer to a technology for transmitting information that is extended over a large bandwidth (>500MHz). UWB may be defined as antenna transmission where the bandwidth of the transmitted signal exceeds the smaller of 500MHz or 20% of the arithmetic center frequency. UWB transmission can transmit information by generating radio energy at specific time intervals and occupying a large bandwidth. The range of UWB may be, for example, within a range of tens of meters. UWB (RF) ranging systems may use the time-of-flight principle to determine the distance between a mobile device and a target device (e.g., a car to be opened) and / or an anchor device (tag) on ​​the target device. Typically, the transmitter of a transceiver emits a waveform that is reflected by an object or retransmitted by a second transceiver, typically a chirp or pulse. Based on the amount of time it takes for the reflection or retransmission to reach the receiver of the initiator transceiver, the distance between the objects can be calculated. The distance between the receiver and the transmitter so determined is then used as a control input (to achieve access). In the same way, UWB can be used to deliver payloads.In this context, "UWB communication" includes impulse radio ultra-wideband (IR-UWB) (see, for example, standards IEEE 802.15.4a and IEEE 802.15.4z).

[0061] In another embodiment, another wireless communication scheme (especially according to a certain standard) using SS-TWR may be applied, such as WiFi, BLE, etc.

[0062] In one embodiment, the evaluation includes (at least one of the following):

[0063] i) Determining a carrier frequency offset of the received second SS-TWR signal.

[0064] ii) determining a baseband frequency offset of the received second SS-TWR signal.

[0065] iii) Compare the carrier frequency offset with the baseband frequency offset.

[0066] By comparing the two estimates, SS-TWR attacks can be successfully detected (and counteracted), especially when they down-mix and up-mix legitimate signals (see the examples of such attacks above). To successfully counter this comparison-based evaluation, the attacker would be forced to have both the baseband clock and the RF band clock inline. This approach can be more challenging for an attacker than simply changing the carrier frequency offset, especially considering the added delay due to resampling. In other words, resampling the baseband data will significantly increase the complexity of the system and will also add additional time delays that work against the attacker.

[0067] In a preferred embodiment, the communication device comprises a phase and / or time tracking unit for estimating the frequency offset between the initiator (communication device) and the responder (further communication device) in the baseband and RF band (carrier frequency).

[0068] For example, in today's UWB standards (IEEE and FiRa), it is defined that the carrier frequency (CAFO) and the baseband frequency (BBFO) should be derived from the same clock. This means that the CAFO and BBFO estimates need to be the same or have a fixed offset defined, for example, by the settings of the UWB PHY (where PHY is an abbreviation specified in IEEE standard 802.15.4 and stands for "physical layer", so that UWB PHY refers to the UWB physical layer):

[0069] |BBFO-CAFO-PHY offset | <E CAFO +E BBFO

[0070] This formula can be checked to ensure that no Fig.10 The attacker device shown is used to shorten the range estimate. If this formula is not true, an attack can be assumed. BBFO and CAFO are baseband and carrier frequency offset estimates, for example from the corresponding time / phase tracking unit. E_CAFO and E_BBFO are the maximum expected frequency estimate errors that need to be considered due to known hardware limitations. In this example, PHY_offset is the expected offset that must be set based on the UWB PHY channel settings.

[0071] In an embodiment, the control means is configured to determine whether a baseband clock associated with the baseband frequency and a carrier frequency (RF band) clock associated with the carrier frequency are inline or have a fixed offset relative to each other. If this is not the case, then the presence of an attack may be indicated.

[0072] In one embodiment, the carrier frequency offset is determined based on energy change and / or phase change over time. There are several established methods for determining carrier frequency offset. Figure 3 and 4 Illustrative examples are described. Typical state of the art systems can estimate CAFO with an accuracy of approximately 0.1 ppm.

[0073] In one embodiment, the baseband frequency offset determination is based on the amplitude change over time. There are several established methods for determining baseband frequency offset. Figure 5 Illustrative examples are described.

[0074] In one embodiment, the evaluation comprises analyzing the channel impulse response CIR relative to the received second SS-TWR signal. In one embodiment, the analysis comprises comparing the phase (rate of change) behavior of the preamble CIR and the scrambled time stamp sequence (STS) CIR (see, e.g., IEEE 802.15.4z). In other words, the CIRs of the preamble and the STS are analyzed and the phase behavior of the discovered inner path is compared. It has been shown that the phase can be significantly affected by attacks (particularly as described above). The following is directed to Figure 6 and 7 Describe examples of such phase changes.

[0075] In one embodiment, the communication device comprises a phase tracking unit configured to track a phase relative to the received second SS-TWR signal. In one embodiment, the communication device comprises a time tracking unit configured to track a time relative to the received second SS-TWR signal. These units (see, e.g. Figure 2 ) can be used to effectively determine the carrier frequency offset and / or baseband frequency offset of the incoming signal (the received second signal).

[0076] In an embodiment, the communication device comprises a communication functionality, in particular an antenna, which is configured to transmit the first SS-TWR signal and / or the second SS-TWR signal.

[0077] In one embodiment, the method is performed in a vehicle-related application (e.g., a door of a car). In one example, the described concepts can be applied to many (UWB) ranging devices that are intended to measure their distance to one or more responders using SS-TWR. In one example, the present disclosure may be further useful for applications related to: UWB-based ticketing in public transportation scenarios, UWB-based payment, physical access control including car access control, location-based systems, IoT devices, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 A communication system according to an exemplary embodiment of the present disclosure is shown.

[0079] Figure 2 A signal tracking front end of a communication device according to an exemplary embodiment of the present disclosure is shown.

[0080] Figure 3 and 4 Determining a carrier frequency offset according to an exemplary embodiment of the present disclosure is shown.

[0081] Figure 5Determining a baseband frequency offset according to an exemplary embodiment of the present disclosure is shown.

[0082] Figure 6 and 7 Analyzing channel impulse response according to an exemplary embodiment of the present disclosure is shown.

[0083] Figure 8 A general timing diagram of IR-UWB packet exchange for performing SS-TWR measurements is shown.

[0084] Fig. 9 A conventional timing diagram showing SS-TWR communications with a responder device having a non-ideal clock.

[0085] Fig.10 Schematic examples of attacker devices that can be used to create frequency shift attacks are shown.

[0086] Fig.11 A timing diagram showing a clock drift compensated SS-TWR attack with a clock frequency offset changed by an attacker device. DETAILED DESCRIPTION

[0087] Before referring to the drawings, in which the embodiments will be described in more detail, some basic considerations will be outlined based on which embodiments of the present disclosure have been developed.

[0088] According to exemplary embodiments, the present disclosure proposes a SS-TWR attack detection mechanism based on an evaluation of a carrier frequency offset to estimate whether the carrier frequency of a signal has been changed by an attacker. If the mechanism detects a carrier frequency change, it is assumed that an attacker is present. In a first example, a comparison of clock frequency offset estimates obtained from baseband and RF band frequency tracking loops within a UWB receiver enables the receiver to estimate whether the carrier frequency of the signal has been changed by an attacker. In a second example, a comparison of the phase ratio change between the preamble CIR and the STS CIR enables the receiver to estimate whether the carrier frequency of the signal has been changed by an attacker.

[0089] Figure 1A communication system 100 according to an exemplary embodiment of the present disclosure is shown. The communication system 100 includes a communication device 110 and a further communication device 120, wherein the communication device 110 performs single-sided two-way ranging (SS-TWR) communication with the further communication device 120. The communication device 110 (initiator device) can be further coupled to an access infrastructure 112, for example for vehicle-related applications (particularly the door of a car). The communication device 110 includes an antenna 111 for wirelessly transmitting and receiving SS-TWR signals. The transmission and reception are triggered / controlled by a control device (not shown) (e.g., a processor). The control device is configured to transmit a first SS-TWR signal to the further communication device 120 (via the antenna 112), and to receive a second SS-TWR signal associated with the first SS-TWR signal from the further communication device 120.

[0090] The communication system 100 further comprises an attacker device 130. The attacker uses an attack signal directed to the communication device 110 (attack signal 133 via antenna 132) and / or an attack signal directed to the further communication device 120 (attack signal 134 via antenna 131). In order to detect such an attack, the control device of the communication device 110 is configured to evaluate the carrier frequency offset of the received second SS-TWR signal 140 with respect to an integrity check. In case the frequency offset does not satisfy the integrity check, it will be assumed that an attack exists. As described in detail below, the evaluation can be further supported by determining the baseband frequency offset and / or analyzing the CIR.

[0091] Figure 2 An example of a UWB signal tracking front end in a communication device 110 according to an exemplary embodiment of the present disclosure is shown. Using this communication device 110, carrier frequency offset (CAFO) and baseband frequency offset (BBFO) can be estimated. In this specific example, the incoming signal (at the antenna 111) is mixed to baseband and filtered by an analog mixer fed by an RF-PLL (phase-locked loop) to obtain a complex signal. Thereafter, the complex signal is filtered and inserted in a digital mixer. The digital mixer is used here to compensate for the remainder of the residual CAFO. For example, if the RF-PLL is running at 8GHz, but the incoming signal has 8GHz*(1+10ppm), this residual frequency offset should be compensated. After the digital mixer, the signal is fed into a correlator that is correlated on a known code sequence.

[0092] The communication device further comprises a time tracking unit 115 downstream of the correlator to perform time tracking for evaluating the carrier frequency offset. In addition, there is a carrier tracking unit (or phase tracking unit 116) coupled to the digital mixer and the correlator to perform phase / frequency tracking for evaluating the carrier frequency offset.

[0093] Figure 3 and 4 An example of determining the carrier frequency offset of the received second SS-TWR signal 140 according to an exemplary embodiment of the present disclosure is shown. An example of how CFO affects in an actual system when performing IQ sampling is specifically shown.

[0094] Figure 3 : shows the correlator output in perfect frequency synchronization. There is no energy change over time between the I and Q data. Assuming the mixer does not compensate for any CAFO, the estimated CAFO based on such a signal would be 0ppm.

[0095] Figure 4 An example of the correlator output for a signal with a CAFO of 10ppm is shown (again assuming a digital mixer CAFO of 0ppm). Due to this residual CAFO, the energy is constantly changing between the I and Q data, which is essentially caused by a continuous phase change. Based on this energy change, the carrier tracking unit (phase tracking unit, see above) can observe the phase change over time, which allows the receiver device to estimate the CAFO. In this example, this CAFO estimate is then fed into the digital mixer to compensate for the negative impact on the correlation result.

[0096] Figure 5 Determination of a baseband frequency offset according to an exemplary embodiment of the present disclosure is shown. In this example, the proposed time tracking unit 115 focuses on the sample amplitude along the samples. Figure 5 An example of an ideal pulse is shown, i.e. sampled once up and down in time ("downsampled ideal" trace) and once downsampled with an offset ("downsampled with offset" trace). If the system is fully inline, the sampling unit will always have the same peak to side sample amplitude ratio, but if baseband timing tracking is off, the amplitude ratio of the samples will continually change, meaning that a "downsampled ideal" sample will slowly transform into a "downsampled with offset" sample and vice versa. This sample amplitude change can be observed over time, and based on this sampling, the BBFO can be estimated.

[0097] The UWB system will lock onto the attacker signal and will also configure its tracking loop accordingly.

[0098] Figure 6 and 7 Analysis of a channel impulse response (CIR) according to an exemplary embodiment of the present disclosure is shown.

[0099] Figure 6: In this example of a scrambled timestamp sequence (STS) CIR, the first path (FP) and the main path (MP) have different phases, which should be constant between the preamble CIR and the STS CIR. If there is an attack, the FP may come from the established ranging device and the MP may come from the attacker. Since only the MP is tracked, the phase will change between CIRs.

[0100] Figure 7 : In this example, the comparison of the preamble CIR and STS CIR in the presence of an attacker is shown. Assuming the time delay between the preamble and the STS is, for example, 32 μs, and the frequency offset is 10 ppm, this results in a time offset of 320 ps. Assuming the carrier frequency is ~8 GHz, this results in a carrier period of about ~125 ps, resulting in a phase shift of (320% 125) / 125*360°=201.6°. This phase shift can be directly observed in the FP to MP phase ratio change. In a specific embodiment, assuming an error tolerance of, for example, +-18°, 9 out of 10 attacks have been observed, provided that the FP of a given signal can still be seen in the CIR.

[0101] Reference numerals

[0102] 100 Communication Systems

[0103] 110 Communication device

[0104] 111 First Antenna

[0105] 112 Access Infrastructure

[0106] 115 Time Tracking Unit

[0107] 116 Phase Tracking Unit

[0108] 120 Other communication devices

[0109] 121 Second Antenna

[0110] 130 Attacker Device

[0111] 131 First Attacker Antenna

[0112] 132 Second Attacker Antenna

[0113] 133 First Attack Signal

[0114] 134 Second Attack Signal

[0115] 140SS-TWR signal.

Claims

1. A communication device (110) configured to perform single-sided two-way ranging (SS-TWR) communication with another communication device (120), characterized in that: The communication device (110) comprises a control device, wherein the control device is configured to: transmitting a first SS-TWR signal to the further communication device (120), receiving a second SS-TWR signal (140) associated with the first SS-TWR signal from the further communication device (120), evaluating a carrier frequency offset of the received second SS-TWR signal (140), and Based on the evaluation, it is determined whether an attack has been performed on the SS-TWR communication.

2. The communication device (110) according to claim 1, It is characterized in that The communication device (110) is configured as an ultra-wideband (UWB) device, and The SS-TWR signal is configured as a UWB signal.

3. The communication device (110) according to claim 1 or 2, characterized in that: The assessment includes: determining the carrier frequency offset of the received second SS-TWR signal; determining a baseband frequency offset of the received second SS-TWR signal; and The carrier frequency offset is compared to the baseband frequency offset.

4. The communication device (110) according to claim 3, characterized in that The assessment additionally includes: A determination is made as to whether a baseband clock associated with the baseband frequency and a carrier frequency clock associated with the carrier frequency are inline or have a fixed offset relative to each other.

5. The communication device (110) according to any one of claims 3 to 4, It is characterized in that The baseband frequency offset determination is based on amplitude changes over time.

6. The communication device (110) according to any of the preceding claims, characterized in that The assessment includes: A channel impulse response CIR with respect to the received second SS-TWR signal is analyzed.

7. The communication device (110) according to claim 6, characterized in that The analysis included: Compare the phase behavior of the preamble CIR and the scrambled timestamp sequence STS CIR.

8. The communication device (110) according to any of the preceding claims, characterized in that Also includes at least one of the following: a phase tracking unit configured to track a phase relative to the received second SS-TWR signal; A time tracking unit is configured to track time relative to the received second SS-TWR signal.

9. A communication system (100), characterized in that: include: A communication device (110) according to any preceding claim; and The further communication device (120).

10. A method for detecting an attack in a communication system (100), characterized in that The method comprises: transmitting a first SS-TWR signal; receiving a second SS-TWR signal associated with the first SS-TWR signal; estimating a carrier frequency offset of the received second SS-TWR signal; and Based on the evaluation, it is determined whether an attack has been performed on the communication system (100).

Images