Method and system for detecting and cancelling attack signals

Abstract

Systems, methods, and devices as described herein provide a method for detecting and cancelling attack signals during a ranging round, the method comprising: receiving, at a second device, a first message from a first device; transmitting a second message from the second device to the first device; receiving, at the second device, a third message from the first device; transmitting a fourth message from the second device to the first device; calculating, at the second device, a first time of flight based on a plurality of timestamps associated with the first message, the second message, and the third message; and receiving, at the second device, a fifth message from the first device, wherein the fifth message includes a second time of flight calculated by the first device or a failure message for the ranging round.

Description

[0001] Cross-referencing related applications

[0002] This application claims the benefits of U.S. Provisional Application No. 63 / 500,863, filed May 8, 2023; U.S. Provisional Application No. 63 / 515,702, filed July 26, 2023; and U.S. Provisional Application No. 63 / 619,072, filed January 9, 2024, the full text of which is incorporated herein by reference. Technical Field

[0003] This disclosure relates to ultra-wideband-enabled apparatus, systems, and methods for detecting and eliminating attack signals in ultra-wideband (UWB) signaling. Background Technology

[0004] Ultra-wideband (UWB) is a radio technology capable of short-range, high-bandwidth communication using very low energy levels over a large portion of the radio spectrum. More specifically, UWB is a wireless communication technology that uses a wide bandwidth, typically around 500 MHz or greater, or a bandwidth of 10 dB greater than 20% of the center frequency, as defined, for example, in ITU-RSM.1755-0: “Characteristics of Ultra-Wideband Technologies” (ITU, 2006). For example, UWB technology can be used for ranging, the process of determining the distance between two devices. UWB technology can also be used for short-range data transactions. Today, UWB technology is used in a variety of applications involving short-range ranging and data transactions, such as keyless car access.

[0005] UWB typically operates within unlicensed spectrum, and devices must comply with relevant laws and regulations, including transmission templates. Ranging rounds are commonly used to establish a wireless connection between two UWB devices. During a ranging session, the two UWB devices transmit signals to establish a connection between them.

[0006] In addition, IEEE 802.15.4z has introduced Scrambled Timestamp Sequences (STS) to allow secure ranging. An STS is a sequence of UWB impulses (positive and negative) generated by an AES-128 cryptographic generator from a 256-bit seed. Only a receiver that knows the seed can generate a valid Channel Impulse Response (CIR) and determine the timestamp of the received UWB frame. The received signal is a convolution of the CIR and the transmitted STS. Correlating the received signal with the same STS produces the CIR. If the generated and transmitted STS do not match, the correlator output is noise. Each peak of the CIR is a radio frequency (RF) path. The timestamp of the RF frame is the time of the first path (FP), i.e., the first peak exceeds a certain threshold.

[0007] In a secure ranging session, all participating devices have exchanged information to compute the seed of each RF UWB frame involved in the ranging session. Only the receiver that aligns its local seed with the seed of the transmitted STS pattern can contribute to the ranging procedure. Since the seed is secret and not shared with other UWB devices, the time stamp should be secure and not compromised by an attack.

[0008] However, recent vulnerabilities have been discovered in the above ranging framework. Therefore, there is a need for improved systems and methods for securing ranging sessions to address the security vulnerabilities. SUMMARY

[0009] In an example aspect, the disclosure is directed to a method for detecting and eliminating an attack signal during a ranging round. The method further includes receiving, at a second device, a first message from a first device. The method further includes transmitting, from the second device, a second message to the first device. The method further includes receiving, at the second device, a third message from the first device. The method further includes transmitting, from the second device, a fourth message to the first device. The method further includes calculating, at the second device, a first time of flight based on a plurality of timestamps associated with the first message, the second message, and the third message. The method further includes receiving, at the second device, a fifth message from the first device, wherein the fifth message includes a second time of flight calculated by the first device or a failure message of the ranging round.

[0010] In some aspects, embodiments can include one or more of the following features. The method can include determining, at the second device, whether an attack occurred on the first message, the second message, the third message, or the fourth message based on a difference between the first time of flight and the second time of flight; the fifth message can further include a fourth time of flight; the fourth time of flight is based on timestamps associated with the first message and the second message; the receiving the fifth message is over Bluetooth; the method can include determining, at the second device, a distance between the first device and the second device based on the first time of flight, the second time of flight, a third time of flight, and the fourth time of flight; the transmitting the message is over UWB.

[0011] In example aspects, the disclosure is directed to a non-transitory machine- readable medium storing instructions that include receiving, at a second device, a first message from a first device. The non-transitory machine-readable medium storing instructions further includes transmitting, from the second device, a second message to the first device. The non-transitory machine-readable medium storing instructions further includes receiving, at the second device, a third message from the first device. The non-transitory machine-readable medium storing instructions further includes transmitting, from the second device, a fourth message to the first device. The non-transitory machine-readable medium storing instructions further includes calculating, at the second device, a first time of flight based on a plurality of timestamps associated with the first message, the second message, and the third message. The non-transitory machine-readable medium storing instructions further includes receiving, at the second device, a fifth message from the first device, wherein the fifth message includes a second time of flight calculated by the first device or a failure message for a current ranging round.

[0012] In some aspects, the implementations can include one or more of the following features. The non-transitory machine-readable medium further stores instructions that, when executed by the one or more processors, cause the one or more processors to perform operations of determining, at the second device, whether an attack occurred on the first message, the second message, the third message, or the fourth message based on a difference between the first time of flight and the second time of flight. The fifth message can further include a fourth time of flight. The fourth time of flight is based on timestamps associated with the first message and the second message. The receiving the fifth message is over Bluetooth. The non-transitory machine-readable medium further stores instructions that, when executed by the one or more processors, cause the one or more processors to perform operations of determining, at the second device, a distance between the first device and the second device based on the first time of flight, the second time of flight, a third time of flight, and the fourth time of flight. The transmitting the messages is over UWB.

[0013] In example aspects, the disclosure relates to an apparatus. The apparatus also includes a transceiver; a non-transitory memory storing instructions; and one or more hardware processors configured to execute the instructions to cause the apparatus to perform operations that can include receiving, at the apparatus, a first message from a first device; transmitting, from the apparatus, a second message to the first device; receiving, at the apparatus, a third message from the first device; transmitting, from the apparatus, a fourth message to the first device; calculating, at the apparatus, a first time of flight based on a plurality of timestamps associated with the first message, the second message, and the third message; and receiving, at the apparatus, a fifth message from the first device, wherein the fifth message includes a second time of flight calculated by the first device or a failure message for a current ranging round.

[0014] In some aspects, the implementations can include one or more of the following features. The apparatus, wherein the one or more hardware processors are configured to execute instructions to cause the apparatus to perform operations that can include determining whether an attack occurred on the first message, the second message, the third message, or the fourth message based on a difference between the first time of flight and the second time of flight. The one or more hardware processors are configured to execute instructions to cause the apparatus to perform operations that can include calculating a third time of flight based on timestamps associated with the second message and the third message; and wherein the fifth message further can include a fourth time of flight. The fourth time of flight is based on timestamps associated with the first message and the second message. The one or more hardware processors are configured to execute the instructions to cause the apparatus to perform operations that can include determining a distance between the first apparatus and the apparatus based on the first time of flight, the second time of flight, the third time of flight, and the fourth time of flight. The transmitting the message is over UWB.

[0015] The scope of the disclosure will be pointed out in the following detailed description with reference to the attached drawings, wherein like elements are designated by like reference numbers and in which: BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings, which are incorporated in and form a part of the specification, illustrate several aspects of the present disclosure and together with the description, serve to explain the principles of the present disclosure.

[0017] Figure 1 An attack scenario during UWB device communication is shown.

[0018] Figure 2A And 2B Illustrative authorized and attack signals during a ranging session are depicted.

[0019] Figure 3 A simplified diagram of a UWB device in accordance with some aspects of the present disclosure.

[0020] Figure 4 A signaling diagram is shown in which a first UWB device communicates with a second UWB device during a ranging round in accordance with some aspects of the present disclosure.

[0021] Figure 5 A signaling diagram is shown in which a first UWB device communicates with a second UWB device during a ranging round in accordance with some aspects of the present disclosure.

[0022] Figure 6 A signaling diagram is shown in which a first UWB device communicates with a second UWB device during a ranging round in accordance with some aspects of the present disclosure.

[0023] Figure 7 A signaling diagram is shown in which a first UWB device communicates with a second UWB device during a ranging round.

[0024] Figure 8 A signaling diagram is shown in which a first UWB device communicates with a second UWB device during a ranging round.

[0025] Figure 9 An exemplary method for attack detection and / or mitigation by a UWB device is shown in accordance with some aspects of the present disclosure. DETAILED DESCRIPTION

[0026] The following detailed description is presented to enable any person skilled in the art to practice the embodiments described herein. Various modifications to the embodiments described herein will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other embodiments without departing from the scope of the disclosure. Thus, the disclosure is not intended to be limited to the embodiments described herein but is to be accorded the widest scope consistent with the claims.

[0027] It will be understood that, although the terms first, second, etc. can be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and, similarly, a second element could be termed a first element, without departing from the scope of the present disclosure. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0028] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. As used herein, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" "comprising," "includes" and / or "including" when used herein, specify the presence of stated features, integers, steps, operations, elements, and / or components but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0029] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. It will be further understood that terms used herein should be interpreted as having a meaning that is consistent with their meaning in the context of this specification and the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein. Additionally, like reference numerals are used to denote like elements throughout the specification and figures.

[0030] It should be understood that blocks in each signaling diagram or flowchart and combinations of signaling diagrams or flowcharts can be implemented by computer program instructions. Because such computer program instructions can be loaded into the processor of the general purpose computer, special purpose computer, or other programmable data processing apparatus, the processor with the computer or other programmable data processing apparatus executes the instructions to generate means for performing the functions described in connection with the block(s) of each signaling diagram or flowchart. Because such computer program instructions can be stored in a computer usable or computer readable memory, they can be directed to the computer or other programmable data processing apparatus to implement a function in a particular manner, the instructions stored in the computer usable or computer readable memory can generate a product comprising instructions for performing the functions described in connection with the block(s) of each signaling diagram or flowchart. Because such computer program instructions can be loaded into the computer or other programmable data processing apparatus, the instructions that generate the program executed by the computer as a series of operational steps and the instructions that operate the computer or other programmable data processing apparatus can provide the steps for performing the functions described in connection with the block(s) of each signaling diagram or flowchart.

[0031] Each block can represent a module, segment, or portion of code, which includes one or more executable instructions for implementing specific logical functions ("instructions"). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the flowcharts. For example, two blocks shown in succession may, in some alternative implementations, be executed substantially concurrently, or in the reverse order, depending on the functions involved.

[0032] In the following, embodiments are described in detail with reference to the accompanying drawings. Further, although a communication system using Ultra Wide Band (UWB) is described in connection with the embodiments, the embodiments can also be applicable to other communication systems having similar technical backgrounds or features as examples. For example, a communication system using Bluetooth or ZigBee can be included therein. Further, the embodiments can be modified within such a range that a person of ordinary skill in the art determines without departing from the scope of the present disclosure significantly, and such modifications can be applicable to other communication systems.

[0033] UWB can refer to a short-range high-rate wireless communication technology that uses a wide frequency band of several GHz or more in a baseband state, low spectral density, and short pulse width (e.g., 1 nsec to 4 nsec). UWB can mean the frequency band to which UWB communication is applied itself. UWB can enable safe and accurate ranging between devices. Accordingly, UWB enables relative position estimation based on the distance between two devices, or accurate position estimation of a device based on the distance from a fixed device whose position is known, also referred to as an anchor device. The present disclosure assumes that a reference device is capable of communicating via UWB (referred to as a "UWB-enabled user device," a UWB device, a user device, or simply a device).

[0034] References to "ranging round" or "ranging session" should be understood to include other session types such as, but not limited to, ranging, contention-based ranging, and data sessions. In the present disclosure, the terms "initiator" and "responder" can take their definitions from the FiRa specification, but are not limited to the protocols in the FiRa specification. In some cases, the selection of the initiator and responder will be negotiated through Bluetooth or other means prior to the start of a ranging round or session. Those skilled in the art will understand the applicability of the description herein using these and other terms to other protocols based on ranging. In some cases, the responder can also be referred to as an access system. Furthermore, the following abbreviations can be used throughout: "CCC" for Car Connectivity Consortium, "BLE" for Bluetooth Low Energy, "DM" for Data Message, "SS-TWR" for Single-Sided Two-Way Ranging, "DS-TWR" for Double-Sided Two-Way Ranging, "RIM" for Ranging Initiation Message, "RRM" for Ranging Response Message, "RRRM" for Ranging Result Report Message, "RFM" for Ranging Final Message, "CRUM T2" for Control Ranging Update Message Type 2, "RCM T3" for Ranging Control Message Type 3, "SIM" for Schedule Information Message, "FP" for First Path, "CAP" for Contention Access Period, and "CFP" for Contention Free Period.

[0035] During a ranging session, multiple UWB-enabled devices attempt to transmit messages, establishing communication between the devices. The session can include multiple messages transmitted and received by the UWB-enabled devices. During the ranging session, an attack signal can be transmitted by an unauthorized user / device. The attack signal can cause another device of the access system to believe that an authorized user is within a given security bubble (i.e., within a certain distance from the access system, such as a car or a house), causing the access system to prematurely allow access. This presents a significant security risk.

[0036] Past attempts to address these security risks have been application-dependent and delayed decision making, which is the intended result of a ranging session (e.g., lock / unlock decision).

[0037] Accordingly, it would be beneficial to have systems and methods that can detect and / or eliminate attacks. For example, by comparing various time-of-flight measurements and calculations, two or more devices can be able to determine that an attack has occurred against one of the messages in a ranging round. In some cases, once an attack has been detected, it can be possible to remedy the attack. Because the effect of an attack can be to reduce the distance calculation between two devices, one or more devices can be able to calculate the true distance.

[0038] Embodiments of the present disclosure provide systems and methods for detecting attacks during a ranging session using two interleaved DS-TWR ranging streams.

[0039] Embodiments of the present disclosure provide systems and methods for detecting attacks during a ranging session using a DS-TWR ranging stream, a fourth message, and time-of-flight calculations for two independent SS-TWR ranging streams.

[0040] Embodiments of the present disclosure provide systems and methods for exchanging information between two UWB devices to allow detection of attacks, including invalidity notifications based on mismatches in time-of-flight measurements.

[0041] Embodiments of the present disclosure provide systems and methods for eliminating attacks using differences in time-of-flight measurements from two DS-TWR streams.

[0042] Embodiments of the present disclosure provide systems and methods for eliminating attacks using differences in time-of-flight measurements from two SS-TWR streams.

[0043] The disclosed systems and methods can facilitate several improvements. For example, the systems and methods detect and eliminate many attacks that would otherwise alter the measured distance with a high probability.

[0044] Further, the disclosed systems and methods improve the security of transactions between devices without requiring the application of related proprietary physical countermeasures. In some cases, the disclosed systems and methods can be combined with proprietary mechanisms to facilitate very high levels of security. Further, the disclosed systems and methods can detect sophisticated attacks, such as attacks against both STS mode and Ipatov preamble. Accordingly, users can be more comfortable using UWB technology for transactions, communications, and using security / access procedures and systems (e.g., unlocking a car or house, or automatically completing a payment after leaving a store, which is identified by a first device (e.g., a person's mobile device) coming within a certain distance of a store payment system). Additionally, the systems and methods do not require significant additional power, resources, or time costs.

[0045] Figure 1An attack scenario during UWB device communication is shown. In attack scenario 100, a first UWB device 120 and a second UWB device 130 can participate in a ranging session. In some embodiments, devices 120 and 130 can also communicate over Bluetooth. During the ranging session, an attacker 110 can transmit an attack signal 112. Device 120 can be a phone, and device 130 can be a related subcomponent of a vehicle. In some cases, the effect of the communication between devices 120 and 130 is to determine when device 120 is within a safety zone 135 around device 130. In some cases, safety zone 135 can define a threshold distance beyond which device 130 can not allow access (e.g., a car door will not unlock).

[0046] Attack 112 has the effect of convincing device 130 that device 120 is not at its true location 140 but at a false location 145 within the safety zone. Because attack 112 causes device 130 to determine that device 120 is within the safety zone, device 130 can allow attacker 110 to bypass the safety protection for access.

[0047] Figure 2A and 2B An illustrative legitimate signal and attack signal during a ranging session are depicted. A portion of a frame of a legitimate signal 205 is shown. Attack signal 210, also known as a Ghost Peak Attack, is a sequence of strong and random UWB pulses. The STS pattern of the legitimate signal overlaps with the attack signal. Figure 2B A plot of overlapping channel impulse responses associated with a legitimate signal 225 and a channel impulse response associated with an attack signal 220 is depicted in FIG. 2B, where axis 230 represents signal strength and axis 235 represents time. The attack signal is not constructed or configured based on knowledge of the seed that generates the STS. Because this attack signal is not generated from the expected seed, it results in noise. If the noise peak is strong enough to exceed a detection threshold, it can be interpreted as an RF ray of the multipath channel. And if this peak occurs before the true RF 1stpath (FP), it modifies the timestamp of the UWB ranging frame. In this plot, the noise peak occurs before the true FP; it is interpreted as the FP and causes the distance to be shortened 240.

[0048] Figure 3 is a simplified diagram of a UWB device 300. According to one embodiment described herein, one or more UWB devices 300 can exist in the scenarios and sessions depicted in Figure 1 -2 and 4-8 and described with respect to Figure 1 -2 and 4-8. As Figure 3As shown, the UWB device 300 includes a processor 310 coupled to a memory 320. The operation of the UWB device 300 is controlled by the processor 310. Although the UWB device 300 is shown as having only one processor 310, it should be understood that the processor 310 may represent one or more central processing units, multi-core processors, microprocessors, microcontrollers, digital signal processors, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), graphics processing units (GPUs), etc., within the UWB device 300. The UWB device 300 may be implemented as a standalone subsystem, implemented as a board added to a computing device, and / or partially or completely implemented as a virtual machine.

[0049] Memory 320 may be used to store software executed by UWB device 300 and / or one or more data structures used during operation of UWB device 300. Memory 320 may include one or more types of machine-readable media. Some common forms of machine-readable media may include floppy disks, hard disks, magnetic tapes, any other magnetic media, CD-ROMs, any other optical media, punched cards, paper tapes, any other physical media with a perforated pattern, RAM, PROMs, EPROMs, flash-EPROMs, any other memory chips or cassettes, and / or any other media suitable for a processor or computer to read from.

[0050] Processor 310 and / or memory 320 can be arranged in any suitable physical configuration. In some embodiments, processor 310 and / or memory 320 may be implemented on the same board, in the same package (e.g., system-in-package), on the same chip (e.g., system-on-a-chip), etc. In some embodiments, processor 310 and / or memory 320 may include distributed, virtualized, and / or containerized computing resources. According to these embodiments, processor 310 and / or memory 320 may reside in one or more data centers and / or cloud computing facilities.

[0051] In some examples, memory 320 may include a non-transitory tangible machine-readable medium comprising executable code that, when run by one or more processors (e.g., processor 310), enables the processors to perform methods described further in detail herein. For example, as shown, memory 320 includes instructions for session module 330, which may be used to implement and / or simulate systems and models, and / or implement any of the methods described herein. Session module 330 may receive input signal 340 via transceiver 315 and generate output signal 350, which may be a response to a message contained within input signal 340. Examples of input signals may include those from... Figure 3The messages and transmissions of different UWB devices are depicted. The input signal can be structured in frames, which for example can take the form as described in the FiRa standard. Examples of output signals can include transmissions by the UWB device 300 in response to received messages and transmission of messages that start a ranging session.

[0052] The transceiver 315 can include a transmitter and / or receiver, an antenna, or any other means for transmitting and / or receiving in UWB. For example, the UWB device 300 can receive the input signal 340 (e.g., an initial ranging message) from another UWB device at the transceiver 315.

[0053] In some embodiments, the session module 330 is configured to control the content and timing of the output signal 350. The session module 330 can further include a detection submodule 331 (e.g., instructions for calculating time of flight, as described herein) and / or a mitigation submodule 332 (e.g., instructions for modifying the estimated distance between two UWB devices upon detecting an attack).

[0054] Some examples of UWB devices, such as the UWB device 300, can include a non-transitory, tangible, machine-readable medium that includes executable code that, when executed by one or more processors (e.g., the processor 310), can cause the one or more processors to perform the processes of a method. Some common forms of machine- readable media that can include the processes of a method are, for example, floppy diskettes, flexible disks, hard disks, magnetic tape, any other magnetic medium, CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, RAM, PROM, EPROM, a FLASH- EPROM, any other memory chip or cartridge, and / or any other medium from which a processor or computer is adapted to read.

[0055] Figure 4A signaling diagram is shown in accordance with some aspects of the disclosure in which a first UWB device 402 communicates with a second UWB device 404 during a session. In some embodiments, with respect to a DS-TWR session 405, UWB device 1 402 is operating as an initiator and UWB device 2 404 is operating as a responder. Session 400 depicts DS-TWR session 405, which can also be viewed as two SS-TWR sessions 415, 420 in which UWB device 1 402 and UWB device 2 404 have opposite roles in each of the two SS-TWR sessions. DS-TWR session 405 is composed of messages 422, 424, and 426. First SS-TWR session 415 is composed of messages 422 and 424, while second SS-TWR session 420 is composed of messages 424 and 426. Session 400 can also include a ranging control message (RCM) 410. A time of flight (TOF) can be calculated for each of the TWR sessions (i.e., 405, 415, and 420). The DS-TWR TOF can be calculated as follows:

[0056] where is the time elapsed between UWB device 1 transmitting RIM 422 and receiving RRM 424, is the time elapsed between UWB device 2 transmitting RRM 424 and receiving RFM 426, is the time elapsed between UWB device 2 404 receiving RIM 422 and transmitting RRM 424, and is the time elapsed between UWB device 1 402 receiving RRM 424 and transmitting RFM 426. Further, the SS-TWR TOF can be calculated as follows:

[0057] In some aspects, due to clock frequency offset between UWB device 1 and UWB device 2, and are not as accurate as In some cases, UWB device 2 can calculate all three TOFs, as it has all the required timestamps (either local or received in MRM 428). Thus, in some cases, UWB device 2 can perform TOF calculation 430 with the available data. If there is no attack of STS mode, then these 3 TOFs (one for each TWR 405, 415, and 420) should match.

[0058] During session 400, an attack (e.g., regarding Figure 1The attack described in -2 can affect one of the messages, e.g. RIM 422, RRM 424 or RFM 426. If the attacker succeeds in shifting the timestamp of RIM 422 by dt, then is tampered with dt / 2, is unaffected, and is changed by dt / 4. Thus, UWB device 2 can easily detect this attack by computing and comparing the three TOF values, provided that the tampering magnitude is above the precision.

[0059] In some aspects, with 1 ms ranging slots, the precision is: 1 ms where is the residual clock frequency offset after compensation. In case of CFO compensation better than 1 ppm, the precision of SS-TWR is better than 1 ns. As an example, assume that an attack that tampers the ranging distance by more than 2 m is detected, i.e. a TOF tampering of 3 ns. With these assumptions, , and the difference between them is above the precision. Thus, the ghost attack can be detected. For attacks on RFM 426, similar conclusions follow. However, if the attack signal succeeds in changing the timestamp of RRM by an amount dt, then all 3 TOFs are changed by dt / 2. If there is no difference in TOF, then the attack cannot be detected. In this sense, the response message RRM is called a weak message in DS-TWR, as it cannot be detected by the countermeasures described above with respect to Figure 4 In some aspects, the systems and methods provided herein remedy this problem.

[0060] Figure 5A signaling diagram is shown in accordance with some aspects of the disclosure in which a first UWB device communicates with a second UWB device during a session. In some aspects, the session 500 includes two interleaved DS-TWR ranging sessions, DS-TWR1 515 and DS-TWR2 520. In some embodiments, for DS-TWR1 515, UWB device 1 502 can be operating as the initiator, while UWB device 2 504 can be operating as the responder; and, for DS-TWR2 520, UWB device 1 502 can be operating as the responder, while UWB device 2 504 can be operating as the initiator. The DS-TWR1 session 515 includes messages RIM 522, RRM 524, and RFM 526. The DS-TWR2 session 520 includes messages RRM 524, RFM 526, and RFM2 530. In some aspects, RFM2 530 acts as a 4th ranging frame. In addition to the messages included in the DS-TWR sessions 515 and 520, the session 500 can also include RCM 510, MRM 528, MRM2 532, and RRRM 538.

[0061] The MRM 528 sends UWB device 1's timestamp to UWB device 2 so that it can calculate its own TOF 536. DS-TWR2 consists of a RRM (used as the initiating message for this DS-TWR), a RFM (used as the response message), and a 4th ranging message as a RFM Type2. UWB device 2 sends its timestamp to UWB device 1 via MRM2 532. And the initiator calculates its side TOF 534. In some cases, these 2 extra messages are announced by the initiator in the RCM 510.

[0062] UWB device 2 calculates its TOF 536 from DS-TWR1 515. If it detects an attack on RIM 522 or RFM 526, it informs the upper layer of the attack. UWB device 1 calculates TOF 534 from DS-TWR2 520. The TOF of DS-TWR2 can be given by the following equation:

[0063] In DS-TWR2 520, UWB device 1 utilizes two SS-TWRs to perform with respect to Figure 4The same kind of checks are described (by RRM 524 and RFM 526 for the first SS-TWR and RFM 526 and RFM2 530 for the second SS-TWR). In DS-TWR2 520, RRM 524 plays the role of the initiating message and the weak message is RFM 526 playing the role of the responding message. Thus, UWB device 1 can detect any attack on this RRM 524 that is a weak message of DS-TWR1 515 and will abort any TOF computation if it detects that RRM 524 or RFM2 530 is attacked. Thus, by combining the two interleaved DS-TWRs, an attack can be detected on any ranging message.

[0064] The roles of the messages in the two DS-TWR ranging discussed above are organized and shown in Table 1 below.

[0065] Table 1

[0066] In the last phase, UWB device 1 can send a ranging report result message (RRRM 538). In some cases, RRM 538 contains the TOF 534 computed by UWB device 1. If UWB device 1 detects an attack on RRM, it can set the TOF to a value indicating an attack, or it can send the computed TOF value.

[0067] UWB device 2 (in some cases an access system) can make the final decision about whether an attack has occurred by comparing the TOFs. The local TOF 536 value and the TOF 534 value sent by UWB device 1 (e.g., in RRM 538) should match very well because they are DS-TWR TOFs, which are very precise TOFs. For example, assume a ghost peak attack shifts the arrival time of the ranging frame by dt, and the criterion for a successful ghost peak attack is that the arrival time shift dt > 2ns (equivalent to a distance of 60 cm). The DS-TWR TOF is tampered with dt / 4 or dt / 2, as shown in the table below, i.e., 15 cm or 30 cm. If the TOF difference is higher than the typical DS-TWR precision, a ghost peak attack is detected. The typical DS-TWR precision is better than 0.5ns (equivalent to 15 cm). The TOF difference is at least dt / 4 > 0.5ns, which is higher than the DS-TWR precision. Thus, a ghost peak attack is detected.

[0068] Alternatively, UWB device 1 can not send RRM 538; in fact, if it detects an attack on RRM 524, it can use an out-of-band channel to send a warning to UWB device 2. In these cases, UWB device 2 will reject the reported ranging distance.

[0069] Table 2

[0070] Table 2 lists various impacts on TOF resulting from attacks on each of the messages in the two DS-TWR sessions.

[0071] Figure 6 A signaling diagram is shown in which a first UWB device communicates with a second UWB device during a ranging round. In some aspects, session 600 includes two interleaved DS-TWR ranging sessions, DS-TWR1 615 and DS-TWR2 620. In some embodiments, for DS-TWR1 615, UWB device 1 602 can be operating as the initiator, while UWB device 2 604 can be operating as the responder; and, for DS-TWR2 620, UWB device 1 602 can be operating as the responder, while UWB device 2 604 can be operating as the initiator. The DS-TWR1 session 615 includes messages RIM 622, RRM 624, and RFM 626. The DS-TWR2 session 620 includes messages RRM 624, RFM 626, and RFM2 630. In some aspects, RFM2 630 acts as a 4th ranging frame. In addition to the messages included in the DS-TWR sessions 615 and 620, session 600 can also include RRRM 636.

[0072] In some embodiments, the interleaved DS-TWR sessions 615 and 620 of session 600 can be conducted with a non-delayed mode, i.e., with the SP1 frame carrying the measurement report messages (i.e., similar to MRM 528 and MRM2 532 as depicted in FIG. 5B) in RFM 626 and RFM2 630 and carrying the control messages (e.g., similar to RCM 510 in FIG. 5A) in RIM 622. RFM2 630 is actually a ranging final message frame, except that it is sent by UWB device 2. The payload of MRM2 is also similar to MRM, except that the reference time is different: in the current MRM, the time reference is the timestamp of RIM on the UWB device 1 side, while it is the timestamp of RRM on the UWB device 2 side. With the information local to each device or delivered in the above messages, UWB device 1 still computes TOF 632, and UWB device 2 still computes TOF 634. Figure 5 Figure 5 In some embodiments, the interleaved DS-TWR sessions 615 and 620 of session 600 can be conducted with a delayed mode, i.e., with the SP1 frame carrying the measurement report messages (i.e., similar to MRM 528 and MRM2 532 as depicted in FIG. 5B) in RFM 626 and RFM2 630 and carrying the control messages (e.g., similar to RCM 510 in FIG. 5A) in RIM 622. RFM2 630 is actually a ranging final message frame, except that it is sent by UWB device 2. The payload of MRM2 is also similar to MRM, except that the reference time is different: in the current MRM, the time reference is the timestamp of RIM on the UWB device 1 side, while it is the timestamp of RRM on the UWB device 2 side. With the information local to each device or delivered in the above messages, UWB device 1 still computes TOF 632, and UWB device 2 still computes TOF 634.

[0073] Figure 7 ​A signaling diagram is shown in accordance with some aspects of the disclosure in which a first UWB device communicates with a second UWB device during a ranging round. In some aspects, session 700 includes two SS-TWR ranging sessions, SS-TWR1 715 and SS-TWR2 720, and a DS-TWR ranging session 725. In some embodiments, for both SS-TWR1 715 and SS-TWR2 720, UWB device 1 702 can be operating as the initiator while UWB device 2 704 can be operating as the responder. The SS-TWR1 session 715 includes messages RIM 722 and RRM 724. The SS-TWR2 session 720 includes messages RFM 726 and RFM2 730. In some embodiments, for DS-TWR 725, UWB device 1 702 can be operating as the initiator while UWB device 2 04 can be operating as the responder. The DS-TWR session 725 includes messages RIM 722, RRM 724, and RFM 726. In some aspects, RFM2 730 acts as a 4th ranging frame. In addition to the messages included in the SS-TWR sessions 715 and 720, session 700 can include an in-band or out-of-band notification 736.

[0074] In session 700, a 4th ranging message (i.e., RFM2 730) is added, but a 2nd DS-TWR is not created. UWB device 1 702 acts as the initiator for both SS-TWRs. In this flow, UWB device 2 704 sends in RRM 724, which it does not send with RRM 724 in a standard DS-TWR flow. UWB device 1 702 can then calculate the 1st SS-TWR TOF 732 according to the following equation:

[0075] UWB device 2 704 sends the 4th ranging message RFM2 730, where the MRM2 information includes ; UWB device 1 can then calculate the 2nd SS-TWR TOF 732 according to the following equation:

[0076] If the TOFs for each SS-TWR 715, 720 do not match and the error is greater than the expected precision, UWB device 1 invalidates the TOF 734 calculated for the DS-TWR session 725 on the UWB device 2 side via in-band or out-of-band message 736. The TOF calculation 734 for DS-TWR 725 can be made according to Equation 1.

[0077] If the attack is successful, the location of the false first path is random and the probability of 2 consecutive false FPs matching within 1 ns is very low.

[0078] Figure 8 A signaling diagram is shown in accordance with some aspects of the disclosure in which a first UWB device communicates with a second UWB device during a ranging round. In some aspects, session 800 includes two interleaved DS-TWR ranging sessions, DS-TWR1 810 and DS-TWR2 815, and two interleaved SS-TWR ranging sessions, SS-TWR1 835 and SS-TWR2 840. In some embodiments, for DS-TWR1 810, UWB device 1 802 can be operating as the initiator while UWB device 2 804 can be operating as the responder; for DS-TWR2 815, UWB device 1 802 can be operating as the responder while UWB device 2 804 can be operating as the initiator; for SS-TWR1 835, UWB device 1 802 can be operating as the initiator while UWB device 2 804 can be operating as the responder; and for SS-TWR2 840, UWB device 1 802 can be operating as the responder while UWB device 2 804 can be operating as the initiator. DS-TWR1 session 810 includes messages RIM 820, RRM 822, and RFM 824. DS-TWR2 session 815 includes messages RRM 822, RFM 824, and RFM2 826. SS-TWR1 session 835 includes messages RIM 820 and RRM 822. SS-TWR2 session 840 includes messages RRM 822 and RFM 824. In some aspects, RFM2 826 serves as a 4th ranging frame. In addition to the messages included in DS-TWR sessions 810, 815 and SS-TWR sessions 835, 840, session 800 can also include RRRM 828.

[0079] In some embodiments, interleaved DS-TWR sessions 810, 815 and SS-TWR sessions 835, 840 of session 800 can be conducted with a non-delayed mode, i.e., with the measurement report message (i.e., similar to MRM 528 and MRM2 532 as depicted in FIG. 5B) carried in RFM 824 or RFM2 826 or the control message (e.g., RIM 820) carried in RIM 820. Figure 5 Figure 5 ​The RFM2 826 is actually the final ranging message frame, but it is sent by UWB device 2. The payload of MRM2 is also similar to that of MRM, except that the reference time is different: in the current MRM, the time reference is the timestamp of RIM on the UWB device 1 side, while this is the timestamp of RRM on the UWB device 2 side. Using the information local to each device or delivered in the above message, UWB device 1 still calculates TOF 832, and UWB device 2 still calculates TOF 834.

[0080] Regarding Figure 8 Attack elimination is discussed. However, those skilled in the art will understand that the description of attack elimination is applicable to other ranging sessions as described herein.

[0081] Let D ds = TOF(DS-TWR2) - TOF(DS-TWR1). If D ds If the accuracy is higher than DS-TWR, then session 800 is under attack. As shown in Table 2, if D... ds If the value is greater than 0, the attack occurred on either the RIM 820 or RRM822. If the attack occurred on the RIM, the TOF 834 measured by the UWB device 2 804 with DS-TWR1 810 should be compensated by +dt / 4=D. ds If the attack occurs on the RRM822, the TOF 834 measured by the UWB device 2 804 with DS-TWR1 810 should be compensated by +dt / 2.

[0082] As shown in Table 2, if D ds If the value is less than 0, the attack occurred on RFM 824 or RFM2 826. If the attack occurred on RFM824, the TOF 834 measured by UWB device 2 804 using DS-TWR1 810 should be compensated by +dt / 4. If the attack occurred on RFM2 828, the TOF 834 measured by UWB device 2 804 using DS-TWR1 810 is unaffected.

[0083] If D ds If the value is >0, then the UWB device 2 804 must determine whether the RIM 820 or RRM 822 is under attack, so that it knows what compensation should be applied (D respectively). ds or 2D ds For this purpose, the DS-TWR1 810 can be split into two SS-TWR835 and 840. Let D... ss This represents the TOF difference between two SS-TWRs, 835 and 840. For example... Figure 4 As shown and described in this article, if the RRM 822 is attacked, then Dss = 0, and if RIM 820 is attacked, it is not zero. Thus, UWB device2 804 can determine if RRM 822 is attacked and eliminate the attack by correcting the measured distance: Real distance = measured distance + |2D ds .

[0084] Similarly, if D ds < 0, UWB device2 804 must determine if RFM 824 or RFM2 826 is attacked so that it knows what compensation should be applied (|D ds | or no compensation). DS-TWR2 can be similarly split into two SS-TWR sessions, and similar analysis as described above reveals which of the two messages (RFM 824 or RFM2 826) is attacked. If RFM 824 is attacked, the difference D ss is not 0, and if RFM2 826 is attacked, D ss = 0.

[0085] Using this information, it can be determined which ranging frame is attacked and the correction needed to eliminate the attack:

[0086] Table 3

[0087] Figure 9 An exemplary method for attack detection and / or elimination by a UWB device according to some aspects of the present disclosure is shown. The method 900 is an example only and is not intended to limit the present disclosure beyond what is explicitly recited in the claims. Additional operations can be provided before, during, and after the method 900, and some of the operations described can be replaced, eliminated, or moved to a different location. Figures 3-8 For example, additional embodiments of the method 900 can include additional operations, replace operations, eliminate operations, or move operations to a different location. Figures 1-8 For example, the method 900 can be implemented by a device such as the UWB device 300 in Figure 9 or any of the UWB devices described herein. Figure 3 In some embodiments, the method 900 can be implemented by a device such as the UWB device 300 in or any of the UWB devices described herein.

[0088] At step 902, a second device (e.g., UWB device2 804 in Figure 8 ) receives a first message (e.g., RIM 820 in Figure 8 ) from a first device (e.g., UWB device1 802 in Figure 8 ). In some embodiments, data is transmitted and received over UWB.

[0089] At step 904, the second device transmits a second message (e.g.,Figure 8 (RRM 822 in the example). In some embodiments, data is transmitted and received via UWB.

[0090] At step 906, the second device receives a third message from the first device (e.g., Figure 8 (RFM 824 in the text). In some embodiments, data is transmitted and received via UWB.

[0091] At step 908, the second device transmits a fourth message to the first device (e.g., Figure 8 (RFM2 826 in [reference]). In some embodiments, data is transmitted and received via UWB.

[0092] At step 910, the second device, based on the first message, the second message, and the third message (e.g., including...), Figure 8 Multiple timestamps associated with the DS-TWR1 810 message are used to calculate the first time of flight (e.g., the TOF of the DS-TWR1 810 as described herein).

[0093] At step 912, the second device receives a fifth message from the first device (e.g., Figure 8 (RRRM 828 in the document), where the fifth message includes the second time of flight calculated by the first device (e.g., the TOF of DS-TWR2 815 as described herein).

[0094] In some embodiments, the second time of flight can be received via Bluetooth or other out-of-band modes. In some embodiments, data is transmitted and received via UWB.

[0095] At step 914, the second device determines whether an attack has occurred on the first message, second message, third message, or fourth message based on the difference between the first flight time and the second flight time (e.g., regarding...). Figure 1 -2 as depicted and described, and listed in Table 3).

[0096] At step 916, the second device calculates a third time of flight (e.g., the TOF of SS-TWR2 840 as described herein) based on the timestamps associated with the second and third messages. In some embodiments, the fifth message may include a fourth time of flight (e.g., the TOF of SS-TWR1 835 as described herein).

[0097] At step 918, the second device determines the distance between the first and second devices (e.g., the "true distance" listed in Table 3 and described herein) based on the first, second, third, and fourth flight times. In some embodiments, the second device may compare the distance between the first and second devices with a threshold distance (e.g., as in...).Figure 1 China and about Figure 1 The distance between the first device and the second device is compared to the described security zone. In some embodiments, if the distance between the first device and the second device is greater than a threshold distance, the second device may deny access to the first device. In some embodiments, if the distance between the first device and the second device is less than a threshold distance, the second device may grant access to the first device. For example, the distance between the first device and the second device may be... Figure 1 The precise estimate of the distance between the first UWB device 120 and the second UWB device 130. The safe zone 135 corresponds to the threshold distance.

[0098] While some of the terms used in this document may match or approximate the terminology of a particular standard (such as FiRa), those skilled in the art will recognize its relevance and application to other protocols based on the concept of ranging rounds (e.g., as defined in the CCC-Automotive Connectivity Consortium).

[0099] Those skilled in the art will recognize improvements and modifications to the preferred embodiments of this disclosure. All such improvements and modifications are considered to be within the scope of the concepts disclosed herein and the following claims.

Claims

1. A method for detecting and eliminating attack signals during ranging rounds, comprising: Receive the first message from the first device at the second device; Transmit a second message from the second device to the first device; Receive a third message from the first device at the second device; Transmit a fourth message from the second device to the first device; The first flight time is calculated at the second device based on multiple timestamps associated with the first message, the second message, and the third message; as well as The second device receives a fifth message from the first device, wherein the fifth message includes a second flight time calculated by the first device or a failure message of the ranging round.

2. The method according to claim 1, further comprising: At the second device, it is determined whether an attack has occurred on the first message, the second message, the third message, or the fourth message based on the difference between the first flight time and the second flight time.

3. The method of claim 2, further comprising: At the second device, the third flight time is calculated based on the timestamps associated with the second message and the third message; and The fifth message further includes a fourth flight time.

4. The method of claim 3, wherein the fourth flight time is based on a timestamp associated with the first message and the second message.

5. The method of claim 3, further comprising: The distance between the first device and the second device is determined at the second device based on the first flight time, the second flight time, the third flight time, and the fourth flight time; as well as At the second device, the distance between the first device and the second device is compared with a threshold distance. Wherein, if the distance between the first device and the second device is greater than the threshold distance, the second device refuses access to the first device, and if the distance between the first device and the second device is less than the threshold distance, the second device grants access to the first device.

6. The method of claim 5, wherein the message transmission is performed via UWB.

7. The method of claim 4, wherein receiving the fifth message is performed via Bluetooth.

8. A non-transitory machine-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform the following operations: Receive the first message from the first device at the second device; Transmit a second message from the second device to the first device; Receive a third message from the first device at the second device; Transmit a fourth message from the second device to the first device; The first flight time is calculated at the second device based on multiple timestamps associated with the first message, the second message, and the third message; as well as The second device receives a fifth message from the first device, wherein the fifth message includes a failure message for the second flight time or the current ranging round calculated by the first device.

9. The non-transitory machine-readable medium of claim 8, further storing instructions that, when executed by the one or more processors, cause the one or more processors to perform the following operations: At the second device, it is determined whether an attack has occurred on the first message, the second message, the third message, or the fourth message based on the difference between the first flight time and the second flight time.

10. The non-transitory machine-readable medium of claim 9, further storing instructions that, when executed by the one or more processors, cause the one or more processors to perform the following operations: At the second device, the third flight time is calculated based on the timestamps associated with the second message and the third message; and The fifth message further includes a fourth flight time.

11. The non-transitory machine-readable medium of claim 10, wherein the fourth time of flight is based on a timestamp associated with the first message and the second message.

12. The non-transitory machine-readable medium of claim 10, further storing instructions that, when executed by the one or more processors, cause the one or more processors to perform the following operations: The distance between the first device and the second device is determined at the second device based on the first flight time, the second flight time, the third flight time, and the fourth flight time; At the second device, the distance between the first device and the second device is compared with a threshold distance. in, If the distance between the first device and the second device is greater than the threshold distance, the second device denies access to the first device; and if the distance between the first device and the second device is less than the threshold distance, the second device grants access to the first device.

13. The non-transitory machine-readable medium of claim 12, wherein the transmission of messages is performed via UWB.

14. The non-transitory machine-readable medium of claim 11, wherein the reception of the fifth message is performed via Bluetooth.

15. An apparatus comprising: transceiver; Non-temporary memory, which stores instructions; as well as One or more hardware processors configured to execute the instructions to cause the device to perform operations, the operations including: Receive a first message from the first device at the device; Transmit a second message from the device to the first device; Receive a third message from the first device at the device; Transmit a fourth message from the device to the first device; The first flight time is calculated at the device based on multiple timestamps associated with the first message, the second message, and the third message; and The device receives a fifth message from the first device, wherein the fifth message includes a failure message for the second flight time or the current ranging round calculated by the first device.

16. The apparatus of claim 15, wherein the one or more hardware processors are configured to execute the instructions to cause the apparatus to perform operations, the operations further comprising: The difference between the first flight time and the second flight time is used to determine whether an attack has occurred on the first message, the second message, the third message, or the fourth message.

17. The apparatus of claim 16, wherein the one or more hardware processors are configured to execute the instructions to cause the apparatus to perform operations, the operations further comprising: The third flight time is calculated based on the timestamps associated with the second and third messages; and The fifth message further includes a fourth flight time.

18. The apparatus of claim 17, wherein the fourth flight time is based on a timestamp associated with the first message and the second message.

19. The apparatus of claim 17, wherein the one or more hardware processors are configured to execute the instructions to cause the apparatus to perform operations, the operations further comprising: The distance between the first device and the device is determined based on the first flight time, the second flight time, the third flight time, and the fourth flight time; At the second device, the distance between the first device and the second device is compared with a threshold distance. Wherein, if the distance between the first device and the second device is greater than the threshold distance, the second device refuses access to the first device, and if the distance between the first device and the second device is less than the threshold distance, the second device grants access to the first device.

20. The apparatus of claim 19, wherein the transmission of messages is performed via UWB.

Images