Improved attack detection in round trip timing estimation

Abstract

A wireless device includes a receiver adapted with Bluetooth # imgabs0 # low power consumption (BLE) capability and logic coupled to or integrated within the receiver at least one of. The logic determines frequency samples of bits of a predetermined pattern of a packet during a round trip timing estimate of the packet, wherein the packet is received during a keyless access attempt to a housing having a transmitter and a receiver. Logic compares frequency samples of bits of a predetermined pattern with reference frequency samples. In response to determining a difference between a reference frequency sample and a frequency sample of a bit of a predetermined pattern, logic detects an intrusion associated with the predetermined pattern.

Description

Technical Field

[0001] This disclosure relates to wireless networks and, more particularly, to improved attack detection in round-trip time (RTT) estimation. Background Art

[0002] Personal area networks (PANs) (such as (BT), low-power (BLE), infrared, etc.) provide wireless connectivity for various personal, industrial, scientific, and medical applications. PANs typically use packet-based protocols and have an architecture that includes a central device (CD) and peripheral devices (PDs). The CD can communicate with multiple PDs via the PAN.

[0003] Some PANs (such as those based on BLE technology) have a communication range similar to that of BT networks but have a considerably lower power consumption and cost. Additionally, when data communication is about to occur, BLE devices typically remain in a sleep mode and transition to an active mode. The BLE protocol also supports mesh networking, where data can flow over multiple paths and does not rely on a rigid hierarchical structure of devices, typically allowing the same device to act as a CD or a PD, depending on the specific network conditions and topology.

[0004] Additionally, some PANs are used in wireless devices (e.g., a CD) that are included in or associated with a locking mechanism of an enclosure (such as a residence, vehicle, garage, shed, etc.) and are used to provide secure keyless access to a person having a keyed PD, e.g., also referred to as keyless entry. A mobile device or a wireless CD device coupled to a mobile device can also use BLE distance estimation techniques to send a specific data pattern within a frame delimiter of a packet. A keyed PD (e.g., which can be a mobile device such as a smart phone) can use BLE distance estimation techniques to estimate the time of arrival and return a specific data pattern within the frame delimiter of the packet, e.g., in order to estimate the round-trip time (RTT) of the packet. The wireless CD device can estimate the time of arrival of the returned packet. The wireless device can perform frame synchronization detection to verify that the specific data pattern matches an expected data pattern that is used to provide a security level for keyless entry based at least in part on distance ranging. This RTT-based ranging is vulnerable to attacks at least in part because it can be spoofed in certain measurement ways, including ranging techniques. Brief Description of the Drawings

[0005] Figure 1A is a block diagram of a system useful for improved attack detection in round-trip time (RTT) estimation between a wireless device acting as a transmitter and a wireless device acting as a receiver, according to at least one embodiment.

[0006] Figure 1B is a simplified block diagram showing the transmission and reception of packets during round-trip time (RTT) estimation between a wireless device acting as a transmitter and a wireless device acting as a receiver according to at least one embodiment.

[0007] Figure 2 is a simplified block diagram of a communication interface of a wireless device according to at least one embodiment.

[0008] Figure 3 is a simplified block diagram showing the packet structure of a wireless device according to at least one embodiment.

[0009] Figure 4A is a flowchart of a method for comparing the frequency of a received (e.g., measured) signal with the frequency of a reference signal for improved attack detection in round-trip time (RTT) estimation according to at least one embodiment.

[0010] Figure 4B is a flowchart of a method for comparing the frequency of a received (e.g., measured) signal with the frequency of a reference signal for improved attack detection in round-trip time (RTT) estimation according to at least one embodiment.

[0011] Figure 4C is a flowchart of a method for comparing the frequency of a received (e.g., measured) signal with the frequency of a reference signal for improved attack detection in round-trip time (RTT) estimation according to at least one embodiment.

[0012] Figure 5 is a simplified graph showing the variation of the frequency of a transmitted signal over time according to at least one embodiment.

[0013] Figure 6A is a simplified graph showing the variation of the frequency of an attack pattern signal over time according to at least one embodiment.

[0014] Figure 6B is a simplified graph showing the variation of the frequency of an attack pattern signal over time according to at least one embodiment. Detailed Description

[0015] The following description sets forth numerous specific details, such as examples of particular systems, devices, components, methods, etc., in order to provide a good understanding of various embodiments of frame synchronization detection between wireless devices associated with a PAN. The disclosed principles can generally be applied to (Gaussian) Frequency Shift Keying ((G)FSK) modulation or (Binary) Phase Shift Keying ((B)PSK) modulation. Frame synchronization (or frame alignment) detection can refer to detecting a portion of a packet, such as payload data or a frame delimiter, also known as a Start Frame Delimiter (SFD), which identifies or signals that data will follow within the frame of the packet.

[0016] In some PAN devices, frame synchronization detection can be used to assist communication between wireless devices by identifying or signaling the data to follow in a packet (i.e., payload data). Optionally, frame synchronization can also identify the sender of a packet. In some PAN devices, frame synchronization or synchronization with data can be used as part of BLE distance estimation. BLE distance estimation is achieved through phase-based distance ranging methods, through packet exchange in Round-Trip Time (RTT) estimation, or a combination thereof, to provide localization between wireless devices. In one example, a data pattern (e.g., a sequence of digits "0" and "1") is used in RTT estimation to estimate the Time of Arrival (ToA) of a packet. In another example, a data pattern is used in RTT estimation to estimate the Time of Departure (ToD) of a packet. In another example, BLE distance estimation can use the frequency estimated during RTT estimation to synchronize BLE distance estimation devices to other BLE distance estimation devices through correction of clock error and to estimate the frequency offset between the estimation devices. Additionally, BLE distance estimation can use a data pattern to estimate the frequency for security features such as an intrusion detection model. Therefore, improved security features are needed for BLE distance estimation devices.

[0017] As described above, RTT-based ranging techniques for security can be spoofed and are thus vulnerable to attacks. For example, an attacker (such as a man-in-the-middle) can use methods called early commit late detection (ECLD) or early detection late commit (EDLC) to spoof RTT-based ranging. In ECLD spoofing, the attacker device guesses each symbol of the data pattern bits before the transmitter intercepts the data pattern bits, and the transmitter attempts to access an enclosure or resource protected by one of the coupled devices. Then, the attacker device detects the symbol and, if the guess is incorrect, changes the symbol before ending the transmission of the symbol to the receiver to still perform frame synchronization detection using the symbol. In EDLC spoofing, the attacker device detects each symbol as early as possible and quickly changes the symbol to compensate for the delay in detection. When the receiver detects a matching data pattern (along with other spoofing information checks), the attacker device can gain access to the enclosure. Certain security techniques have been used to address spoofing, such as obfuscation (e.g., increasing the noise level of the transmitted signal, transmitting packets with accompanying signals at adjacent frequencies to confuse potential intruders, etc.), adding a security signature to the transmitted signal, embedding traps within the packets to enhance detectability, generating small frequency offsets that are difficult for potential intruders to detect. However, these security techniques are generally not sufficient to prevent intrusion, may require a prior protocol between the transmitter and the receiver so that the receiver can identify the security signature or other security techniques used, may reduce the range by increasing noise and embedding traps, or may require hardware modifications, which may make them expensive to implement. Therefore, an additional security layer is sought to ensure that access to the enclosure is secure and that attacks can be detected despite other spoofing techniques.

[0018] Accordingly, to address security vulnerabilities associated with BLE distance estimation employing RTT-based ranging techniques and improve attack detection, in accordance with various embodiments, the present disclosure relates to transmitters and receivers, and related systems and methods, that compare the frequency of a transmitted signal and / or in-phase quadrature (IQ) samples with reference frequency samples to determine the presence of an intrusion (e.g., an attack). For example, in some embodiments, a wireless device (e.g., a receiving device) includes receive logic coupled to or integrated within the receiver of the wireless device. The receive logic is adapted to receive bits within a predetermined pattern (e.g., a frame synchronization pattern) of a packet transmitted (e.g., by a transmitting device) during round-trip timing estimation of the packet and / or a keyless access attempt of an enclosure. The receive logic may determine frequency samples of the bits within the frame synchronization pattern. The receive logic may compare the frequency samples of the bits with reference frequency samples. By way of example, the receive logic may compute reference frequency samples for detecting the presence of higher or lower frequencies relative to an expected (e.g., reference) frequency sample of the bits within the frame synchronization pattern. In another example, the receive logic may use pattern recognition to detect a modification of the frequency samples of the bits within the frame synchronization pattern to an expected frequency value and associate the modification of the frequency value with a pre-computed attack pattern. Based on the comparison, the receive logic may then determine the presence of an intrusion attempt of the frame synchronization pattern. Additionally, in accordance with various embodiments, the receive logic in one of the coupled devices may then enable access to an enclosure (or resource) protected by the receiving device. Access is provided if no intrusion attempt is detected. In some embodiments, the receiving device may detect an intrusion of the frame synchronization pattern and send a notification (e.g., a report, a message, a packet, etc.) identifying the intrusion to the transmitting device.

[0019] The present disclosure includes several advantages, including the ability to add security aspects to distance estimation (e.g., RTT-based ranging for BLE), which can be used to provide secure access to resources such as enclosures (e.g., buildings or vehicles), devices, and / or device functions, software, and any other resources for which any type of access or control is desired. Additionally, the present disclosure relates to minor changes to existing infrastructure, thereby avoiding increased costs associated with other security techniques.

[0020] Figure 1A is a block diagram of a system 100 that can be used to provide improved attack detection in round-trip timing (RTT) estimation between wireless device 150 and wireless device 101. In accordance with an example embodiment, wireless device 101 may act as a transmitter to set a transmission time, and wireless device 150 may act as a receiver. In some embodiments, wireless device 101 may act as a receiver to detect a reception time, and wireless device 150 may act as a transmitter. The difference between the reception time and the transmission time may be referred to as the round-trip timing, which with respect to Figure 1BFurther detailed description. System 100 may include, for example, a secure resource 50 protected using a locking mechanism 60, where the wireless device 150 is adapted to obtain access to the secure resource 50 via the locking mechanism 60. The secure resource 50 may be, for example, an enclosure such as a vehicle, a building, a residence, a garage, a shed, a vault, etc. The secure resource 50 may also be a computer system, an industrial device, or other item that requires secure access via the locking mechanism 60, and the locking mechanism 60 may be, for example, a digital locking mechanism. In some embodiments, the locking mechanism 60 is integrated with the wireless device 101.

[0021] In various embodiments, the wireless device 150 is any one of a plurality of peripheral wireless devices PD1 150A...PDN 150N, as the wireless device 101 may be adapted to communicate with any one or all of the peripheral wireless devices PD1 150A...PDN 150N. In different embodiments, the wireless device 150 is a mobile device such as a mobile phone, a smartphone, a pager, an electronic transceiver, a tablet computer, etc. In these embodiments, the wireless device 150 may be adapted to obtain access to the secure resource 50 by sending data (including frame delimiters and encapsulated frames). In some embodiments, the frames are encapsulated in frame synchronization packets, and one or more frame synchronization packets 111 may be sent from the wireless device 150 to the wireless device 101. Although the wireless device 101 is described in detail, the wireless device 150 may also include components that are the same as or similar to those of the wireless device 101, but will not be repeated for simplicity. There may be transmit-receive symmetry between the two wireless devices (however, for simplicity, the wireless device 150 is considered the transmitter and the wireless device 101 is considered the receiver).

[0022] In at least some embodiments, the wireless device 101 includes, but is not limited to, a transmitter 102 or TX (e.g., a PAN transmitter), a receiver 104 or RX (e.g., a PAN receiver), a communication interface 106, one or more antennas 110, a memory 114, one or more input / output (I / O) devices 118 (such as a display screen, a touch screen, a keypad, etc.), and a processor 120. These components may all be coupled to a communication bus 130.

[0023] In some embodiments, separate antennas are used for each of the transmitter 102 and the receiver 104, and thus the antenna 110 is shown for simplicity. In at least some embodiments, the memory 114 may include a storage device for storing instructions executable by the processor 120 and / or data generated by the communication interface 106. In various embodiments, front-end components within various devices such as the transmitter 102, the receiver 104, the communication interface 106, and one or more antennas 110 described herein may be adapted to or configured for a PAN-based frequency band, e.g., (BT), BLE, Z-Wave TM wait.

[0024] In some embodiments, communication interface 106 is integrated with transmitter 102 and receiver 104, for example, as an RF front end (RFFE) circuit of wireless device 101. Communication interface 106 may coordinate to request / receive packets from peripheral wireless device 150, as directed by processor 120. Communication interface 106 may further process data symbols received by receiver 104 in a manner that processor 120 may perform further processing, including verifying correlation between phase-based samples of data values ​​obtained from a frame of the packet and expected data patterns as part of a security protocol, as discussed herein.

[0025] Figure 1B 1 is a simplified block diagram 170 showing the sending and receiving of packets during RTT estimation between a device 175 acting as an initiator 171 (e.g., CD) and a device 177 acting as a reflector 173 (e.g., PD) according to at least one embodiment. In some embodiments, the initiator 171 may send (e.g., transmit) a packet 178 to the reflector 173. The reflector 173 may receive the packet 178 and may, for example, estimate the arrival time of the packet 178. The reflector 173 may return a different packet 179 to the initiator 171 after a defined period from the arrival time. The initiator 171 may receive the returned packet 179 and may, for example, estimate the arrival time of the returned packet 179. The initiator 171 may estimate the flight time (or round trip timing) by subtracting the time of the sending and receiving events to estimate the distance between the device 175 and the device 177, etc. Intrusion detection is performed on both devices.

[0026] Figure 2 is according to at least one embodiment operating in receiver mode Figure 1A A simplified block diagram of a wireless device 101 and / or 150A is shown. Recall Figure 1A The components of the wireless device 101 may also be included in Figure 1A Thus, the wireless device 101 may include a wireless device 150A ... 150N adapted to The receiver 202A and the communication interface 206A have low power consumption (BLE) distance estimation capabilities. In various embodiments, the receiver 202A includes a local oscillator (LO) 234A for receiving packets sent at a specific frequency associated with a channel. The communication interface 206A can instruct the receiver 202A to receive frame synchronization packets at a specific frequency in order to establish a secure wireless connection with the wireless device 150A.

[0027] In these embodiments, communication interface 206A includes RF circuitry 240A, which in turn includes logic such as attack detector 254A. In some embodiments, the logic of RF circuitry 240A is coupled to or integrated within at least one of receiver 202A.

[0028] In at least one embodiment, attack detector 254A receives bits within a predetermined pattern (e.g., a frame synchronization pattern) of frame synchronization packet 111 sent during round-trip timing estimation of packet 111 and / or a keyless access attempt to security resource 50. Attack detector 254A may determine frequency samples of the received bits within the frame synchronization pattern. Attack detector 254A or other logic of RF circuitry 240A may compare the frequency samples of the received bits with reference frequency samples. Attack detector 254A may then determine whether there is an intrusion attempt on the frame synchronization pattern. Additionally, according to various embodiments, attack detector 254A may then enable access to an enclosure (or security resource 50) protected by receiver 202A. If no intrusion attempt is detected, access is provided. In some embodiments, attack detector 254A may detect an intrusion on the frame synchronization pattern and send a notification (e.g., a report, message, packet, etc.) identifying the intrusion to sending wireless device 150A.

[0029] In some embodiments, RF circuitry 240A is implemented as a programmable processor, such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a processing unit (such as a CPU or GPU), or other microprocessor device that may include a combination of circuit-based hardware, logic, firmware, and / or software.

[0030] Figure 3 is a simplified block diagram showing a packet structure 311 received from a wireless device (e.g., Figure 1A wireless device 150 in Figure 3 ). As Figure 1A shown, packet structure 311 may include, but is not limited to, a preamble 311a, a start frame delimiter 311b, and data 311c. Preamble 311a is typically a fixed number of bytes (e.g., seven bytes) that indicate or identify that data will follow within the frame of a packet received by a receiver (e.g., Figure 1A receiver 104 in Figure 1A ). Preamble 311a allows a wireless device (e.g., Figure 1A wireless device 101 in Figure 1A ) to synchronize its receiver clock with the transmitter clock of a wireless device (e.g., Figure 1A wireless device 150 in Figure 1A ). Start frame delimiter 311b is typically another fixed number of bytes (e.g., one byte) that indicates the end of preamble 311a and the start of a frame with payload data (e.g., data 311c).

[0031] Figure 4A is a flowchart of a method 400 for improved attack detection in round-trip time (RTT) estimation by comparing the frequency of a received (e.g., measured) signal with the frequency of a reference signal. Method 400 may be executed by processing logic that may include hardware (e.g., a processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, an integrated circuit, etc.), software (e.g., instructions running or executing on a processing device), or a combination thereof. In some embodiments, method 400 is executed by receiver 104 (e.g., as Figure 1A shown).

[0032] At operation 405, the processing logic calculates a reference frequency sample based on frequency samples of reference bits (referred to herein as "reference frequency samples" or "plural reference frequency samples"). In some embodiments, the processing logic may receive the reference frequency samples according to a protocol transmitted to a receiver (e.g., Figure 1A receiver 104)(e.g., from Figure 1A transmitter 102) transmitted. The reference frequency samples may be expected frequency samples of bits within a predetermined pattern (e.g., a frame synchronization pattern) embedded in a packet (e.g., Figure 3 the packet shown), which may be calculated and stored on the receiver and / or the transmission device. In some embodiments, the protocol may be another packet, notification, message, etc. that includes information about the reference frequency samples and / or the predetermined pattern.

[0033] In an example, example mathematical equations may be used to calculate the reference frequency samples, such as:

[0034] f r = angle({r n}) - angle({r n-6}),

[0035] where f r is the reference FM frequency value and r n is the reference IQ data.

[0036] In another example, example mathematical equations may be used to calculate the reference frequency samples, such as:

[0037] f r = angle({r n}) - angle({r n-4}).

[0038] As Figure 5 shown, the reference frequency sample f r may be frequency 507.

[0039] At operation 410, the processing logic determines frequency samples of bits within a predetermined pattern during grouped round-trip timing estimation. In some embodiments, during a keyless access attempt to a resource (e.g., Figure 1A secure resource 50) of a receiver (e.g., Figure 1A receiver 104), the predetermined pattern is received as part of a packet. In some embodiments, the predetermined pattern is sent by a transmitting device (e.g., a transmitter) (e.g., Figure 1A transmitter 102). The processing logic may receive the predetermined pattern as part of a packet sent by the transmitting device.

[0040] In some embodiments, to determine frequency samples of bits within the predetermined pattern of a packet, the processing logic may extract frequency modulation (FM) sampling data from in-phase quadrature (IQ) data within the packet. The processing logic may detect the predetermined pattern within the packet (e.g., by looking for peaks using reference FM sampling data).

[0041] In an example, the processing logic may use an example mathematical equation to determine frequency samples of bits within the predetermined pattern, such as:

[0042] f x = angle({x n}) - angle({x n-6}),,

[0043] where f x is the frequency sample of bits within the predetermined pattern, and x n is the IQ data within the predetermined pattern.

[0044] In another example, the processing logic may use an example mathematical equation to determine frequency samples of bits within the predetermined pattern, such as:

[0045] f x = angle({x n}) - angle({x n-4}).

[0046] As Figure 5 shown, the frequency f x of FM sampled bits within the predetermined pattern may be frequency 509.

[0047] At operation 430, the processing logic compares the frequency samples of bits within the predetermined pattern (e.g., the frequency determined at operation 410) with the reference frequency samples calculated at operation 405.

[0048] In some embodiments, to compare a received frequency sample with a reference frequency sample, the processing logic may calculate a frequency metric. For example, the processing logic may calculate the sum of the absolute values of the received bit frequency samples within a predetermined pattern (e.g., a first sum). The processing logic may calculate another sum of the absolute values of the reference frequency samples (e.g., a second sum). In some embodiments, the second sum of the absolute values of the reference frequency samples is pre-calculated and may be stored on the receiving device and / or the transmitting device. The second sum of the absolute values of the reference frequency samples may be received together with the reference frequency samples in the protocol sent to the receiving device. The processing logic may then calculate a value representing the difference between the second sum and the first sum. As Figure 5 illustrated in

[0049]

[0050] wherein, S →0 is the reference frequency sample, N →0 is the number of "zero" crossings for normalization, f x is the frequency sample of the bits within the predetermined pattern, and f r is the reference frequency value.

[0051] In some embodiments, when calculating the reference frequency sample, the processing logic may omit the calculation of the number of "zero" crossings for normalization. For example, the processing logic may use an example mathematical equation to calculate the frequency metric S, such as:

[0052] S = (∑|f x | - ∑|f r |).

[0053] In some embodiments, the processing logic may use the squared values or other polynomial values of the received frequency samples and / or the reference frequency samples to calculate the frequency metric. For example, the processing logic may use an example mathematical equation to calculate the frequency metric, such as:

[0054]

[0055] In some embodiments, the processing logic may calculate a frequency metric for each of a received set of packets (e.g., 5 packets). The processing logic may then calculate an average of each frequency metric for each of the set of packets. Then, as described above, the processing logic may use the average frequency metric to compare with the frequency samples of the bits within a predetermined pattern.

[0056] In some embodiments, in response to calculating the frequency metric, the processing logic may determine whether the frequency metric meets or exceeds a first threshold value or is less than a second threshold value. The first threshold value may be a high-frequency threshold. The second threshold value may be a low-frequency threshold.

[0057] In some embodiments, comparing the received frequency samples with reference frequency samples may include using pattern recognition to detect a modification of the frequency samples of the bits within a predetermined pattern (e.g., the distortion 501 as Figure 5 shown). By way of example, the processing logic may calculate a value representing the difference between the received frequency samples and the reference frequency samples. For example, the processing logic may use an exemplary mathematical equation to calculate a value Δf, such as:

[0058] Δf = f x - f r ,

[0059] where f x is the frequency sample of the received bits within a predetermined pattern, and f r is the reference bit frequency sample within a predetermined pattern.

[0060] As Figure 5 shown, the frequency sample of the received bits within a predetermined pattern may be frequency 509. The reference frequency sample f r may be frequency 507. As Figure 6A illustrated, the value Δf representing the difference between the frequency sample of the bits within a predetermined pattern and the reference frequency value may be referred to as an attack signature 611 (also shown as distortion 501 in Figure 5 ).

[0061] In response to calculating the above value, the processing logic may perform a correlation between the attack pattern and the value representing the difference between the received frequency samples and the reference frequency samples. In some embodiments, the attack pattern may be pre-calculated and may be stored on the receiving device and / or the transmitting device. In some embodiments, the processing logic may receive the attack pattern in a protocol sent to the receiving device (e.g., sent from the transmitting device). In some embodiments, the protocol may be another packet, notification, message, etc. that includes information about the attack pattern, reference frequency samples, and / or the predetermined pattern. For example, the processing logic may use an exemplary mathematical equation to calculate the correlation, such as:

[0062] c j = Δf·p j ,

[0063] where c j is a relevant value, Δf is a value representing the difference between a received frequency sample and a reference frequency sample, and p j is the above attack mode.

[0064] Reference Figure 6B , the attack mode can be shown as attack mode 613.

[0065] At operation 440, the processing logic detects an intrusion associated with a predetermined pattern. In some embodiments, the processing logic detects the intrusion in response to determining the difference between a reference frequency sample and the frequency samples of the bits of the predetermined pattern. For example, in response to determining at operation 430 that a calculated value representing the difference between a second sum and a first sum is greater than a first threshold value, the processing logic may determine that the intrusion is a high-pass filter intrusion. In some embodiments, in response to determining at operation 430 that a calculated value representing the difference between a second sum and a first sum is less than a second threshold value, the processing logic may determine that the intrusion is one of the following: an early commit late detection (ECLD) intrusion or an early detection late commit (EDLC) intrusion, as described above. In some embodiments, in response to determining that a calculated value representing the difference between a second sum and a first sum is less than or equal to the first threshold value and / or greater than or equal to the second threshold value, the processing logic may determine that no intrusion exists.

[0066] In some embodiments, in response to detecting an intrusion, the processing logic (e.g., the receiver) may send a notification (e.g., a report, a message, a packet, etc.) to a transmitting device, where the notification indicates that the receiver has detected an intrusion associated with a predetermined pattern.

[0067] Figure 4B is a flowchart of a method 401 for improved attack detection in round-trip time (RTT) estimation by comparing the frequency of a received (e.g., measured) signal with the frequency of a reference signal according to various embodiments. Method 401 may be executed by processing logic, which may include hardware (e.g., a processing device, circuitry, dedicated logic, programmable logic, microcode, the hardware of a device, an integrated circuit, etc.), software (e.g., instructions running or executing on a processing device), or a combination thereof. In some embodiments, method 401 is executed by a receiver 104 (e.g., as Figure 1A shown).

[0068] At operation 450, the processing logic calculates a reference frequency sample based on the frequency samples of reference bits (referred to herein as "reference frequency sample" or "plurality of reference frequency samples"). In some embodiments, the processing logic may receive a signal transmitted to the receiver (e.g., Figure 1Afrom the receiver 104) (e.g., transmitted from Figure 1A the transmitter 102). The reference frequency sample can be the expected frequency sample of the bits within a predetermined pattern (e.g., a frame synchronization pattern) embedded within a packet (e.g., the packet shown in Figure 3 ), which can be calculated and stored on the receiving device and / or the transmitting device. In some embodiments, the protocol can be another packet, notification, message, etc. that includes information about the reference frequency sample and / or the predetermined pattern.

[0069] In an example, an example mathematical equation can be used to calculate the reference frequency sample, such as:

[0070] f r = angle({r n}) - angle({r n-6}),

[0071] where f r is the reference FM frequency value, and r n is the reference IQ data.

[0072] In another example, an example mathematical equation can be used to calculate the reference frequency sample, such as:

[0073] f r = angle({r n}) - angle({r n-4}).

[0074] As Figure 5 shown, the reference frequency sample f r can be the frequency 507.

[0075] At operation 460, the processing logic determines the frequency sample of the bits within the predetermined pattern during the round-trip timing estimation of the packet. In some embodiments, during a keyless access attempt to a resource (e.g., the secure resource 50 of Figure 1A the receiver 104) having a receiver (e.g., Figure 1A ), the predetermined pattern is received as part of the packet. In some embodiments, the predetermined pattern is sent by a transmitting device (e.g., the transmitter) (e.g., Figure 1A the transmitter 102). The processing logic can receive the predetermined pattern as part of a packet sent by the transmitting device.

[0076] In some embodiments, to determine the frequency sample of the bits within the predetermined pattern of the packet, the processing logic can extract frequency modulation (FM) sampling data from the in-phase quadrature (IQ) data within the packet. The processing logic can detect the predetermined pattern within the packet (e.g., by looking for peaks using the reference FM sampling data).

[0077] In an example, the processing logic can use an example mathematical equation to determine the frequency sample of bits within a predetermined pattern, such as:

[0078] f x = angle({x n}) - angle({x n-6}),

[0079] where f x is the frequency sample of bits within the predetermined pattern, and x n is the IQ data within the predetermined pattern.

[0080] In another example, the processing logic can use an example mathematical equation to determine the frequency sample of bits within a predetermined pattern, for example:

[0081] f x = angle({x n}) - angle({x n-4}).

[0082] As Figure 5 shown, the frequency f x of the bits of the FM sampling within the predetermined pattern can be 509.

[0083] At operation 470, the processing logic compares the frequency sample of the bits within the predetermined pattern (e.g., the frequency determined at operation 460) with the reference frequency sample calculated at operation 450.

[0084] In some embodiments, to compare the received frequency sample with the reference frequency sample, the processing logic can calculate a frequency metric. For example, the processing logic can calculate the sum of the absolute values of the received frequency samples of the bits within the predetermined pattern (e.g., the first sum). The processing logic can calculate another sum of the absolute values of the reference frequency samples (e.g., the second sum). In some embodiments, the second sum of the absolute values of the reference frequency samples is pre-calculated and can be stored on the receiver and / or the transmission device. The second sum of the absolute values of the reference frequency samples can be received together with the reference frequency samples in the protocol sent to the receiving device. The processing logic can then calculate a value representing the difference between the second sum and the first sum. As Figure 5As described, the value representing the difference between the second sum and the first sum is used to detect distortion 501. In some embodiments, the processing logic may calculate the number of "zero" crossings for normalization. In some embodiments, the number of "zero" crossings for normalization is pre-calculated and may be stored on the receiving device and / or the transmitting device. The number of "zero" crossings for normalization may be received together with the second sum of the absolute values of the reference frequency samples in the protocol sent to the receiving device. In an example, the processing logic may use an example mathematical equation to calculate a frequency metric, such as:

[0085]

[0086] where S →0 is the reference frequency sample, N →0 is the number of "zero" crossings for normalization, f x is the frequency sample of the bits within a predetermined pattern, and f r is the reference frequency value.

[0087] In some embodiments, the processing logic may omit the calculation of the number of "zero" crossings for normalization when calculating the frequency metric. For example, the processing logic may use an example mathematical equation to calculate the frequency metric S, such as:

[0088] S = (∑|f x | - ∑|f r |).

[0089] In some embodiments, the processing logic may use the squared value or other polynomial values of the received frequency samples and / or the reference frequency samples to calculate the frequency metric. For example, the processing logic may use an example mathematical equation to calculate the frequency metric, such as:

[0090]

[0091] In some embodiments, the processing logic may calculate the frequency metric for each packet in a received set of packets (e.g., 5 packets). Then, the processing logic may calculate the average of each frequency metric for each packet in the set of packets. Then, as described above, the processing logic may use the average frequency metric to compare the frequency samples of the bits within the predetermined pattern.

[0092] In some embodiments, in response to calculating the frequency metric, the processing logic may determine whether the frequency metric meets or exceeds a first threshold value or is less than a second threshold value. The first threshold value may be a high-frequency threshold. The second threshold value may be a low-frequency threshold.

[0093] At operation 480, the processing logic detects an intrusion associated with a predetermined pattern. In some embodiments, the processing logic detects the intrusion in response to determining a difference between a reference frequency sample and a frequency sample of bits of the predetermined pattern. For example, in response to determining at operation 470 that a calculated value representing a difference between a second sum and a first sum is greater than a first threshold value, the processing logic may determine that the intrusion is a high-pass filter intrusion. In some embodiments, in response to determining at operation 470 that a calculated value representing a difference between a second sum and a first sum is less than a second threshold value, the processing logic may determine that the intrusion is one of the following: an early commit late detection (ECLD) intrusion or an early detection late commit (EDLC) intrusion, as described above. In some embodiments, in response to determining that a calculated value representing a difference between a second sum and a first sum is less than or equal to the first threshold value and / or greater than or equal to the second threshold value, the processing logic may determine that no intrusion exists.

[0094] In some embodiments, in response to detecting an intrusion, the processing logic (e.g., a receiver) may send a notification (e.g., a report, a message, a packet, etc.) to a transmission device, where the notification indicates that the receiver has detected an intrusion associated with a predetermined pattern.

[0095] Figure 4C is a flowchart of a method 403 for improved attack detection in round-trip timing (RTT) estimation by comparing the frequency of a received (e.g., measured) signal with the frequency of a reference signal according to various embodiments. Method 403 may be performed by processing logic that may include hardware (e.g., a processing device, circuitry, dedicated logic, programmable logic, microcode, identified hardware, an integrated circuit, etc.), software (e.g., instructions running or executing on a processing device), or a combination thereof. In some embodiments, method 403 is performed by a receiver 104 (e.g., as Figure 1A shown).

[0096] At operation 485, the processing logic calculates a reference frequency sample based on a frequency sample of reference bits (referred to herein as a "reference frequency sample" or "plurality of reference frequency samples"). In some embodiments, the processing logic may receive reference frequency samples in a protocol transmitted to a receiver (e.g., Figure 1A the receiver 104)(e.g., transmitted from Figure 1A the transmitter 102). The reference frequency sample may be an expected frequency sample of bits within a predetermined pattern (e.g., a frame synchronization pattern) embedded in a packet (e.g., Figure 3 the packet shown), which may be calculated and stored on a receiving device and / or a transmission device. In some embodiments, the protocol may be another packet, notification, message, etc. that includes information about the reference frequency sample and / or the predetermined pattern.

[0097] In an example, example mathematical equations can be used to calculate reference frequency samples, such as:

[0098] f r = angle({r n}) - angle({r n-6}),

[0099] where f r is the reference FM frequency value, and r n is the reference IQ data.

[0100] In another example, example mathematical equations can be used to calculate reference frequency samples, such as:

[0101] f r = angle({r n}) - angle({r n-4}).

[0102] As Figure 5 shown, the reference frequency sample f r can be frequency 507.

[0103] At operation 487, the processing logic determines the frequency samples of bits within a predetermined pattern during grouped round-trip timing estimation. In some embodiments, during a keyless access attempt to a resource (e.g., Figure 1A secure resource 50 of Figure 1A receiver 104) having a receiver (e.g., Figure 1A transmitter 102 of

[0104] In some embodiments, to determine the frequency samples of bits within the predetermined pattern of a packet, the processing logic may extract frequency modulation (FM) sampling data from in-phase quadrature (IQ) data within the packet. The processing logic may detect the predetermined pattern within the packet (e.g., by looking for peaks using reference FM sampling data).

[0105] In an example, the processing logic can use example mathematical equations to determine the frequency samples of bits within a predetermined pattern, such as:

[0106] f x = angle({x n}) - angle({x n-6}),

[0107] where, f x is the frequency sample of bits within the predetermined pattern, and xn is IQ data within a predetermined pattern.

[0108] In another example, processing logic may use an example mathematical equation to determine a frequency sample of bits within a predetermined pattern, such as:

[0109] f x = angle({x n}) - angle({x n-4}).

[0110] As Figure 5 shown, the frequency f of FM sampled bits within a predetermined pattern x can be frequency 509.

[0111] At operation 489, processing logic calculates the correlation between the attack pattern and the difference between the reference frequency sample calculated at operation 485 and the frequency sample of the bits of the predetermined pattern determined at operation 487. In some embodiments, calculating the correlation may include using pattern recognition to detect a modification of the frequency sample of the bits within the predetermined pattern (e.g., the distortion 501 as Figure 5 shown). By way of example, processing logic may calculate a value representing the difference between the received frequency sample and the reference frequency sample. For example, processing logic may use an example mathematical equation to calculate a value Δf, such as:

[0112] Δf = f x - f r ,

[0113] where f x is the frequency sample of the received bits within the predetermined pattern, and f r is the frequency sample of the reference bits within the predetermined pattern.

[0114] As Figure 5 shown, the frequency sample f of the received bits within the predetermined pattern x can be frequency 509. The reference frequency sample f r can be frequency 507. As Figure 6A illustrated, the value Δf representing the difference between the frequency sample of the bits within the predetermined pattern and the reference frequency value may be referred to as an attack signature 611 (also shown as the distortion 501 in Figure 5 ).

[0115] In response to calculating the above values, the processing logic may perform a correlation between the attack mode and the value representing the difference between the received frequency samples and the reference frequency samples. In some embodiments, the attack mode may be pre-calculated and stored on the receiving device and / or the transmitting device. In some embodiments, the processing logic may receive the attack mode in a protocol sent to the receiving device (e.g., sent from the transmitting device). In some embodiments, the protocol may be another packet, notification, message, etc. that includes information about the attack mode, reference frequency samples, and / or a predetermined pattern. For example, the processing logic may use an example mathematical equation to calculate the correlation, such as:

[0116] c j =Δf·p j ,

[0117] where c j is the correlation value, Δf is the value representing the difference between the received frequency samples and the reference frequency samples, and p j is the above attack mode.

[0118] Reference Figure 6B , the attack mode p j may be shown as attack mode 613.

[0119] At operation 491, the processing logic may detect an intrusion associated with a predetermined pattern. In some embodiments, the processing logic detects the intrusion in response to determining the difference between the reference frequency samples and the frequency samples of the bits of the predetermined pattern. For example, in response to determining at operation 430 that the calculated value representing the difference between the second sum and the first sum is greater than a first threshold value, the processing logic may determine that the intrusion is a high-pass filter intrusion. In some embodiments, in response to determining at operation 430 that the calculated value representing the difference between the second sum and the first sum is less than a second threshold value, the processing logic may determine that the intrusion is one of the following: early commit late detection (ECLD) intrusion or early detection late commit (EDLC) intrusion, as described above. In some embodiments, in response to determining that the calculated value representing the difference between the second sum and the first sum is less than or equal to the first threshold value and / or greater than or equal to the second threshold value, the processing logic may determine that there is no intrusion.

[0120] In some embodiments, in response to detecting an intrusion, the processing logic (e.g., the receiver) may send a notification (e.g., a report, message, packet, etc.) to the transmitting device, where the notification indicates that the receiver has detected an intrusion associated with a predetermined pattern.

[0121] Figures 4A - 4CIt is not intended to limit the methods described therein to certain combinations, permutations, or assignments of actors, i.e., whether PD or CD actually performs a particular operation. Instead, they are intended to indicate some embodiments of the present disclosure, and those skilled in the art will recognize that some operations can be rearranged for a particular application, some operations need not always be performed, some operations can be omitted, etc.

[0122] Figure 5 is a simplified graph showing the variation of the frequency of the transmitted signal over time according to at least one embodiment. Figure 5 as referred to above Figures 4A - 4C is described in further detail.

[0123] Figure 6A is a simplified graph showing the frequency of the attack pattern signal over time according to at least one embodiment. Figure 6A as referred to above Figures 4A - 4C is described in further detail.

[0124] Figure 6B is a simplified graph showing the frequency of the attack pattern signal over time according to at least one embodiment. Figure 6B as referred to above Figures 4A - 4C is described in further detail.

[0125] It will be apparent to those skilled in the art that at least some embodiments can be practiced without these specific details. In other instances, well-known components, elements, or methods are not described in detail or are presented in a simple block diagram format to avoid unnecessarily obscuring the subject matter described herein. Thus, the specific details set forth below are merely exemplary. Specific embodiments may vary from these exemplary details and still be contemplated within the spirit and scope of the present embodiments.

[0126] References in the description to "an embodiment", "one embodiment", "example embodiment", "some embodiments", and "various embodiments" mean that a particular feature, structure, step, operation, or characteristic described in connection with the embodiment is included in at least one embodiment. Moreover, the appearances of the phrases "an embodiment", "one embodiment", "example embodiment", "some embodiments", and "various embodiments" in various places in the specification are not necessarily all referring to the same embodiment.

[0127] This specification includes references to the accompanying drawings, which form a part of the detailed description. The drawings illustrate diagrams in accordance with exemplary embodiments. These embodiments (which may also be referred to herein as "examples") are described in sufficient detail to enable those skilled in the art to practice the embodiments of the claimed subject matter described herein. Embodiments may be combined, other embodiments may be utilized, or structural, logical, and electrical changes may be made without departing from the scope and spirit of the claimed subject matter. It should be understood that the embodiments described herein are not intended to limit the scope of the subject matter, but rather to enable those skilled in the art to practice, make, and / or use the subject matter.

[0128] This specification includes references to the accompanying drawings, which form a part of the detailed description. The drawings illustrate diagrams in accordance with exemplary embodiments. These embodiments (which may also be referred to herein as "examples") are described in sufficient detail to enable those skilled in the art to practice the embodiments of the claimed subject matter described herein. Embodiments may be combined, other embodiments may be utilized, or structural, logical, and electrical changes may be made without departing from the scope and spirit of the claimed subject matter. It should be understood that the embodiments described herein are not intended to limit the scope of the subject matter, but rather to enable those skilled in the art to practice, make, and / or use the subject matter.

[0129] Certain embodiments may be implemented by firmware instructions stored on a non-transitory computer-readable medium (e.g., such as volatile memory and / or non-volatile memory). These instructions may be used to program and / or configure one or more devices including a processor (e.g., a CPU) or its equivalent (e.g., such as a processing core, a processing engine, a microcontroller, etc.) such that when executed by the processor or its equivalent, the instructions cause the device to perform the described operations of the USB-C / PD mode conversion architecture described herein. The non-transitory computer-readable storage medium may include, but is not limited to, electromagnetic storage media, read-only memory (ROM), random access memory (RAM), erasable programmable memory (e.g., EPROM and EEPROM), flash memory, or another non-transitory type of medium now known or later developed suitable for storing information.

[0130] Although the operations of the circuits and blocks herein are shown and described in a particular order, in some embodiments, the order of the operations of each circuit / block may be changed such that certain operations may be performed in the reverse order, or such that certain operations may be performed at least partially, simultaneously, and / or in parallel with other operations. In other embodiments, the instructions or sub-operations of different operations may be executed in an intermittent and / or alternating manner.

[0131] In the foregoing specification, the disclosure has been described with reference to specific exemplary embodiments of the present disclosure. However, it will be apparent that various modifications and changes can be made thereto without departing from the broader spirit and scope of the disclosure as set forth in the appended claims. Accordingly, the specification and drawings are to be regarded as illustrative rather than restrictive.

Claims

1. A wireless device comprising: Suitable for Bluetooth Low Energy (BLE) capable receiver; as well as logic coupled to or integrated within the receiver, the logic configured to: determining a frequency sample of bits of a predetermined pattern of packets during a round trip timing estimate of the packets, wherein the packets are received during a keyless access attempt to a housing having a transmitter and the receiver; comparing the frequency samples of the predetermined pattern of bits with reference frequency samples; and In response to determining a difference between the reference frequency samples and the frequency samples of the bits of the predetermined pattern, an intrusion associated with the predetermined pattern is detected.

2. The wireless device according to claim 1, wherein: To compare the frequency samples of the predetermined pattern of bits with the reference frequency samples, the logic is to: calculating a first sum of absolute values ​​of frequency samples of bits of the predetermined pattern; calculating a second sum of absolute values ​​of reference frequency sample values, wherein the reference frequency sample values ​​are pre-calculated and stored on the wireless device; calculating a value representing a difference between the second sum and the first sum; and It is determined whether the value representing the difference between the second sum and the first sum meets or exceeds a first threshold value or is less than a second threshold value.

3. The wireless device according to claim 2, wherein: To detect the intrusion associated with the predetermined pattern, the logic is to: In response to determining that the value representing the difference between the second sum and the first sum meets or exceeds the first threshold value, determining that the intrusion is a high pass filter intrusion; as well as In response to determining that the value representing the difference between the second sum and the first sum is less than the second threshold value, determining that the intrusion is one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.

4. The wireless device according to claim 1, wherein: To compare the frequency samples of the predetermined pattern of bits with the reference frequency samples, the logic is to: calculating a value of a difference between a frequency sample representing the predetermined pattern of bits and a reference frequency sample value; as well as A correlation between said value representing said difference and an attack pattern is performed.

5. The wireless device according to claim 4, wherein: The attack patterns are pre-computed and stored on the wireless device.

6. The wireless device according to claim 1, wherein: The intrusion is a high pass filter intrusion.

7. The wireless device of claim 1, wherein: The intrusion is one of: an early submission, late detection (ECLD) intrusion or an early detection, late submission (EDLC) intrusion.

8. The wireless device of claim 1, wherein: The logic is also used to: A notification is sent from the receiver, the notification indicating an intrusion associated with the predetermined pattern.

9. A method comprising: By the adapter logic of a Bluetooth Low Energy (BLE) capable receiver determines frequency samples of bits of a predetermined pattern of packets during a round trip timing estimate of the packets, wherein the packets are received during a keyless access attempt to a housing having a transmitter and the receiver; comparing the frequency samples of the predetermined pattern of bits with reference frequency samples; and In response to determining a difference between the reference frequency samples and the frequency samples of the bits of the predetermined pattern, an intrusion associated with the predetermined pattern is detected.

10. The method according to claim 9, wherein: Comparing the frequency samples of the bits of the predetermined pattern with the reference frequency samples comprises: calculating a first sum of absolute values ​​of frequency samples of bits of the predetermined pattern; calculating a second sum of absolute values ​​of reference frequency sample values, wherein the reference frequency sample values ​​are pre-calculated and stored on a wireless device including the receiver; calculating a value representing a difference between the second sum and the first sum; and It is determined whether the value representing the difference between the second sum and the first sum meets or exceeds a first threshold value or is less than a second threshold value.

11. The method according to claim 10, wherein: Detecting the intrusion associated with the predetermined pattern comprises: In response to determining that the value representing the difference between the second sum and the first sum meets or exceeds the first threshold value, determining that the intrusion is a high pass filter intrusion; and In response to determining that the value representing the difference between the second sum and the first sum is less than the second threshold value, determining that the intrusion is one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.

12. The method according to claim 9, wherein: Comparing the frequency samples of the bits of the predetermined pattern with the reference frequency samples comprises: calculating a value of a difference between a frequency sample representing the predetermined pattern of bits and a reference frequency sample value; and A correlation between said value representing said difference and an attack pattern is performed.

13. The method according to claim 12, wherein: The attack pattern is pre-computed and stored on a wireless device including the receiver.

14. The method according to claim 9, wherein: The intrusion is (i) a high pass filter intrusion, or (ii) one of the following: an early submission, late detection (ECLD) intrusion or an early detection, late submission (EDLC) intrusion.

15. The method according to claim 9, further comprising: A notification is sent from the receiver, the notification indicating an intrusion associated with the predetermined pattern.

16. A system comprising: antenna; Transmission equipment for sending packets; Suitable for a Bluetooth Low Energy (BLE) capable receiving device for receiving said packets of a predetermined pattern during a keyless access attempt to a housing having said transmitting device and said receiving device; as well as logic at least one of coupled to or integrated with the receiving device, the logic to: determining a frequency sample of a predetermined pattern of bits of the packet during a round trip timing estimate of the packet; comparing the frequency samples of the predetermined pattern of bits with reference frequency samples; as well as In response to determining a difference between the reference frequency samples and the frequency samples of the bits of the predetermined pattern, an intrusion associated with the predetermined pattern is detected.

17. The system of claim 16, wherein: To compare the frequency samples of the predetermined pattern of bits with the reference frequency samples, the logic is to: calculating a first sum of absolute values ​​of frequency samples of bits of the predetermined pattern; calculating a second sum of absolute values ​​of reference frequency sample values, wherein the reference frequency sample values ​​are pre-calculated and stored on the receiving device; calculating a value representing a difference between the second sum and the first sum; and It is determined whether the value representing the difference between the second sum and the first sum meets or exceeds a first threshold value or is less than a second threshold value.

18. The system of claim 17, wherein: To detect the intrusion associated with the predetermined pattern, the logic is to: In response to determining that the value representing the difference between the second sum and the first sum meets or exceeds the first threshold value, determining that the intrusion is a high pass filter intrusion; as well as In response to determining that the value representing the difference between the second sum and the first sum is less than the second threshold value, determining that the intrusion is one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.

19. The system of claim 16, wherein: To compare the frequency samples of the predetermined pattern of bits with the reference frequency samples, the logic is to: calculating a value of a difference between a frequency sample representing the predetermined pattern of bits and a reference frequency sample value; as well as A correlation between said value representing said difference and an attack pattern is performed.

20. The system of claim 16, wherein: The logic is also used to: A notification is sent from the receiving device, the notification indicating an intrusion associated with the predetermined pattern.

Images