A bluetooth channel sounding high-precision ranging soc method, chip and device

Abstract

The application discloses a Bluetooth channel sounding high-precision ranging SOC method, a chip and equipment. The method comprises the following steps: controlling a radio frequency transceiver front end to output a data frame and a received signal strength quantization value, a direct memory access controller carries the data frame to a memory of a channel sounding coprocessor, the coprocessor compares the quantization value with a multipath deep fading threshold value, and when the quantization value is lower than the threshold value, corresponding data is overwritten as a digital zero, a polar coordinate system conversion forms a frequency domain channel response array, an inverse fast Fourier transform is performed to extract a line-of-sight path main peak and calculate a first distance value, a high-frequency counter records a physical round trip time and converts a second distance value, a hardware interlocking comparator calculates a difference value, and when the difference value exceeds a safety tolerance window, a blocking instruction is sent to the direct memory access controller. The application can solve the data distortion problem in a multipath environment and eliminate the delay vulnerability of the anti-relay attack of the physical layer.

Description

Technical Field

[0001] This invention relates to the field of wireless communication network and integrated circuit design technology, and specifically to a high-precision ranging SOC method, chip, and device for Bluetooth channel detection. Background Technology

[0002] With the rapid evolution of automotive intelligence, digital key systems are becoming increasingly common in modern vehicles, placing stringent demands on keyless entry positioning accuracy and anti-theft security. Current system-on-a-chip (SoC) implementations typically involve acquiring in-phase and quadrature signals at the radio frequency front-end, performing analog-to-digital conversion, and then directly reporting the raw data. The microprocessor in the main control unit then performs phase extraction, multipath elimination, and inverse fast Fourier transform processing via upper-level software algorithms.

[0003] However, in practical applications, the large metal coverings on the vehicle body create a complex electromagnetic reflection environment that leads to multipath interference in radio frequency signals. This causes destructive interference and data distortion in the extracted channel frequency response array. Existing pure software processing mechanisms suffer from computational bottlenecks. Microprocessors calling mathematical function libraries to perform massive floating-point and complex matrix operations cause a sudden surge in system power consumption, with computation cycles often reaching tens of milliseconds. This high-latency software architecture struggles to meet the real-time response requirements of digital keys for low power consumption and high-frequency continuous ranging.

[0004] Furthermore, existing anti-relay attack measures largely rely on upper-layer software logic. When unauthorized RF amplification devices are used for signal relay in physical space, the software-layer security verification is constrained by the operating system's task scheduling mechanism, resulting in latency vulnerabilities. This latency allows attackers to tamper with or bypass the RF payload before the software completes security verification, leading to severe deficiencies in the anti-relay security of digital keys. In summary, overcoming the shortcomings of existing main control systems—high power consumption, delayed multipath interference processing leading to data distortion, and latency vulnerabilities in anti-relay verification—has become a critical technical problem urgently needing to be solved in this field. Summary of the Invention

[0005] The purpose of this invention is to provide a high-precision ranging SOC method, chip and device for Bluetooth channel detection, which solves the data distortion problem of existing Bluetooth ranging schemes in multipath environments, and completely eliminates the time window delay vulnerability of anti-relay attacks from the physical layer.

[0006] This application provides a high-precision ranging SOC method for Bluetooth channel detection, applied to a system-on-a-chip (SoC) comprising a radio frequency transceiver front-end, a direct memory access controller (DMI), a main microprocessor unit, and a channel detection coprocessor. The method includes: controlling the radio frequency transceiver front-end to sequentially receive probe tone signals and output digital in-phase and quadrature data frames and corresponding received signal strength quantization values; transferring the digital in-phase and quadrature data frames to the memory of the channel detection coprocessor via the DMI, while keeping the main microprocessor unit in a sleep state during the transfer process; obtaining the received signal strength quantization value through the data stream preprocessing pipeline built into the channel detection coprocessor, and comparing the received signal strength quantization value with a set multipath deep fading threshold using a dynamic masking trigger; when the received signal strength quantization value is lower than the set multipath deep fading threshold, overwriting the data value of the corresponding frequency point in the digital in-phase and quadrature data frames with a digital zero using a channel selector; and processing the data using the channel selector. The input coordinate rotation digital calculator unit then converts the digital in-phase and quadrature data frames into amplitude and phase values ​​in polar coordinates, and forms a frequency domain channel response array based on the amplitude and phase values. A fast Fourier transform engine converts the frequency domain channel response array into a time domain channel impulse response sequence, extracts the line-of-sight path peak from the time domain channel impulse response sequence, and calculates a first distance value based on the line-of-sight path peak. A high-frequency counter records the physical round-trip time of the ranging frame, and converts the physical round-trip time into a second distance value. A hardware interlock comparator receives the first distance value and the second distance value, calculates the difference between the first distance value and the second distance value, and when the difference exceeds a preset safety tolerance window, a blocking instruction is sent to the direct memory access controller.

[0007] In a preferred embodiment, the process of comparing the quantized value of the received signal strength with a set multipath deep fading threshold using a dynamic masking trigger specifically includes: receiving the quantized value of the received signal strength output by the RF transceiver front end and storing the quantized value of the received signal strength in the first-stage register of the data stream preprocessing pipeline; storing the set multipath deep fading threshold in a read-only memory unit and connecting the output of the read-only memory unit to the first input of a digital comparator via hardwired connections; connecting the output of the first-stage register to the second input of the digital comparator; performing a logical subtraction operation between the quantized value of the received signal strength and the set multipath deep fading threshold using the digital comparator under a synchronous clock cycle; and outputting a trigger level to the dynamic masking trigger when the operation result is negative.

[0008] In a preferred embodiment, the process of overwriting the data values ​​of the corresponding frequency points in the digital in-phase and quadrature data frames with digital zeros through a channel selector when the quantized value of the received signal strength is lower than the set multipath deep fading threshold specifically includes: when the dynamic masking trigger receives the trigger level, it flips its internal state on the rising edge of the clock and outputs a gating mask signal to the control pin of the channel selector; the channel selector includes a data multiplexer, the first data input channel of the data multiplexer is connected to the data bus of the digital in-phase and quadrature data frames, and the second data input channel is hard grounded to provide a constant multi-bit digital zero level; after receiving the gating mask signal, the data multiplexer switches its internal logic gates to the second data input channel to cover the digital in-phase and quadrature data frames in the current clock cycle with a multi-bit digital zero level, and resumes switching to the first data input channel after the gating mask signal is removed.

[0009] In a preferred embodiment, the process of converting the frequency domain channel response array into a time domain channel impulse response sequence using a fast inverse Fourier transform engine, and extracting the line-of-sight path main peak from the time domain channel impulse response sequence, specifically includes: performing a butterfly operation with a base of r on the frequency domain channel response array using the fast inverse Fourier transform engine to output the time domain channel impulse response sequence containing discrete sampling points; inputting the time domain channel impulse response sequence into a peak detection module, calculating the energy sum of the discrete sampling points and their adjacent sampling points in the time domain channel impulse response sequence using a sliding window algorithm, and determining the earliest arriving signal energy cluster whose energy sum exceeds a preset noise floor threshold as the line-of-sight path main peak.

[0010] In a preferred embodiment, the process of calculating the first distance value based on the main peak of the line-of-sight path specifically includes: extracting the phase deflection data of the discrete sampling points corresponding to the main peak of the line-of-sight path; obtaining the initial phase of the transmitting end and the measured phase of the receiving end of the probe tone signal during channel transmission, and calculating the phase difference between the initial phase of the transmitting end and the measured phase of the receiving end; superimposing and compensating the phase difference with the phase deflection data to obtain the absolute phase difference; performing a linear multiplication and addition operation based on the speed of light constant, the center frequency of the probe tone signal, and the absolute phase difference to determine the first distance value D; the first distance value D is obtained by pure hardware logic circuit operation based on the physical phase offset extracted in the polar coordinate system.

[0011] In a preferred embodiment, the process of transferring the digital in-phase and quadrature data frames to the memory of the channel sounding coprocessor via the direct memory access controller, while keeping the main control microprocessor unit in a sleep state during the transfer process, specifically includes: configuring the source address register and destination address register of the direct memory access controller via the main control microprocessor unit before the radio frequency transceiver front end begins receiving the sounding tone signal; after the configuration is completed, the main control microprocessor unit shuts down its internal high-frequency clock and enters a low-power standby mode; and the hardware state machine of the direct memory access controller takes over the data bus permissions to perform the transfer operation.

[0012] This application also provides a high-precision ranging system-on-a-chip for Bluetooth channel detection, comprising: a radio frequency transceiver front-end configured to receive detection tone signals and output digital in-phase and quadrature data frames and corresponding received signal strength quantization values; a main control microprocessor unit configured to execute a communication protocol; a channel detection coprocessor, which integrates a data stream preprocessing pipeline, a coordinate rotation numerator unit, a fast Fourier transform engine, and a high-frequency counter; and a direct memory access controller, connected to the memory of the radio frequency transceiver front-end and the channel detection coprocessor, configured to move the digital in-phase and quadrature data frames to the memory of the channel detection coprocessor, and keep the main control microprocessor unit in a sleep state during the moving process; the data stream preprocessing pipeline includes a dynamic masking trigger and a channel selector, the dynamic masking trigger being configured to compare the received signal strength quantization value with a set multipath deep fading threshold, and in the specified case... When the quantized value of the received signal strength is lower than the set multipath deep fading threshold, the channel selector is driven to overwrite the data values ​​of the corresponding frequency points in the digital in-phase and quadrature data frames with digital zeros; the coordinate rotation digital calculator unit is configured to receive the digital in-phase and quadrature data frames processed by the channel selector, convert them into amplitude and phase values ​​in polar coordinates, and form a frequency domain channel response array; the inverse fast Fourier transform engine is configured to convert the frequency domain channel response array into a time domain channel impulse response sequence, extract the line-of-sight path peak in the time domain channel impulse response sequence, and calculate a first distance value; the high-frequency counter is configured to record the physical round-trip time of the ranging frame and convert it into a second distance value; the hardware interlock comparator is configured to calculate the difference between the first distance value and the second distance value, and when the difference exceeds a preset safety tolerance window, send a blocking instruction to the direct memory access controller.

[0013] In a preferred embodiment, the RF transceiver front end is provided with a frame synchronization pin; the frame synchronization pin is physically hardwired to the enable terminal of the high-frequency counter inside the channel detection coprocessor via a metal wire; when the RF transceiver front end detects the start delimiter of the ranging frame, it sends a start pulse signal to the high-frequency counter through the frame synchronization pin, controlling the high-frequency counter to start pulse counting based on a first clock frequency; when the ranging frame transmission is completed, the RF transceiver front end sends a stop pulse signal to the high-frequency counter, and the high-frequency counter multiplies the count value between the two pulse signals by the clock cycle length to determine the physical round-trip time.

[0014] In a preferred embodiment, the first clock frequency of the high-frequency counter is configured to 16 MHz; the hardware interlock comparator includes a differential subtraction circuit and a threshold register, the differential subtraction circuit being connected to the output bus of the inverse fast Fourier transform engine and the output bus of the high-frequency counter respectively; the threshold register is programmed with a distance upper limit value corresponding to the value, the distance upper limit value corresponding to the safety tolerance window; the differential subtraction circuit receives the first distance value and the second distance value, calculates the absolute difference, and performs a nanosecond-level synchronous comparison between the absolute difference and the distance upper limit value in the threshold register through a digital comparison logic gate; when the absolute difference is greater than the distance upper limit value, the digital comparison logic gate directly triggers the interrupt signal line where the blocking instruction is located to cut off the data transmission link of the physical layer.

[0015] This application also provides a high-security digital key device, including an antenna array, a power module, and the aforementioned high-precision ranging system-on-a-chip for Bluetooth channel detection; the antenna array is connected to the input port of the radio frequency transceiver front end for transmitting and receiving wireless radio frequency signals; the power module is used to provide operating voltage for the system-on-a-chip.

[0016] In summary, the embodiments of this application have the following significant advantages:

[0017] By introducing a coordinate rotation digital calculator unit into the underlying hardware structure to directly extract the physical phase of the polar coordinate system from the Cartesian coordinate system data, the pure hardware implementation of complex matrix operations is achieved, reducing the computational load of the main control microprocessor and the overall system power consumption.

[0018] The hardware-level dynamic masking mechanism in the data stream preprocessing pipeline can directly eliminate destructive frequency points that encounter multipath deep fading in the frequency domain, avoiding the pollution of downstream fast Fourier inverse transform engine by multipath distortion false phase data, and providing physical-level data purity guarantee for accurately locking the correct line-of-sight path.

[0019] By hard-wired the frame synchronization pin of the RF transceiver front-end to a high-frequency counter inside the coprocessor, nanosecond-level synchronous round-trip time recording is achieved. Based on this dual hardware interlocking comparison mechanism executed with the time and phase ranging results, relay attack links can be directly blocked at the nanosecond level, fundamentally eliminating security delay vulnerabilities caused by operating system task scheduling and establishing a robust physical layer defense. Attached Figure Description

[0020] Figure 1 This is an overall logic structure block diagram of the system-on-a-chip provided in the embodiments of the present invention.

[0021] Figure 2 This is a flowchart of the Bluetooth channel detection high-precision ranging SOC method provided in the embodiments of the present invention.

[0022] Figure 3 This is a block diagram of the internal logic structure of the channel detection coprocessor provided in an embodiment of the present invention.

[0023] Explanation of reference numerals in the attached figures:

[0024] In the diagram: 101-RF transceiver front-end, 102-Direct Memory Access Controller, 103-Main Control Microprocessor Unit, 104-Channel Probe Coprocessor, 105-System Bus, 106-High-Speed ​​Static Random Access Memory, 107-Clock Generator Circuit, 108-Low-Power Management Unit, 301-Data Stream Preprocessing Pipeline, 302-Dynamic Masking Trigger, 303-Channel Selector, 304-Digital Comparator Circuit, 305-Coordinate Rotation Numerical Calculator Unit, 306-Inverse Fast Fourier Transform Engine, 307-High-Frequency Counter, 308-Hardware Interlock Comparator, 309-Multiplier, 310-Differential Subtraction Circuit, 311-Threshold Register, 312-Peak Detection Module. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0026] like Figure 1As shown, this embodiment of the invention provides a system-on-a-chip (SoC). The overall architecture of this SoC adopts a system-on-a-chip (SoC) topology design, integrating multiple hardware processing units to achieve extremely low-latency low-level data flow control. Specifically, the SoC includes an RF transceiver front-end 101, a direct memory access controller 102, a main control microprocessor unit 103, and a channel detection coprocessor 104. The channel detection coprocessor 104 is connected to the system bus 105 via an independent high-speed slave interface, achieving physical interconnection with other master devices. To meet the seamless buffering requirements of the high-speed data flow for RF sampling, the channel detection coprocessor 104 internally incorporates a high-speed static random access memory 106. Furthermore, to maintain stable clock speeds for all pipelines in the system and the internal high-frequency counting module, the SoC also includes a clock generator circuit 107, which can specifically be a phase-locked loop circuit or a high-precision quartz crystal oscillator. An independent power supply network providing stable voltage rails for the entire chip and the independent coprocessors is handled by a low-power power management unit 108. It should be noted that the above bus architecture is only a preferred data exchange scheme. Those skilled in the art can use similar alternatives such as point-to-point direct connection or cross-matrix bus to achieve the high bandwidth and low latency objective of this application.

[0027] Combination Figure 2 As shown, this embodiment of the invention provides a high-precision ranging SOC method for Bluetooth channel detection based on the above-described hardware architecture. This method relies entirely on... Figure 1 and Figure 3 The underlying hardware logic pipeline inside the system-on-a-chip shown executes a closed-loop flow, and its core mechanism includes the following steps.

[0028] In receiving the probe tone signal S201, the RF transceiver front-end 101 sequentially receives the probe tone signal and outputs digital in-phase and quadrature data frames, along with the corresponding quantized values ​​of the received signal strength. Specifically, the RF transceiver front-end 101 integrates a low-noise amplifier, a mixer, a high-frequency analog-to-digital converter, and a digital down-conversion module. After the radio electromagnetic probe tone signal is captured by the antenna, it undergoes linear amplification by the low-noise amplifier and down-conversion processing by the mixer. According to the Bluetooth physical layer protocol standard, the RF transceiver front-end 101 is configured to sequentially receive the probe tone signal at 72 consecutive 1 MHz frequency steps. At each stationary frequency hopping point, the internal high-frequency analog-to-digital converter performs high-speed discretization sampling of the analog signal, and then the digital down-conversion module orthogonally separates it to generate digital in-phase and quadrature data frames. While outputting the digital in-phase and quadrature data frames of the current frequency hopping point, the bypass detection hardware circuit of the RF transceiver front-end 101 synchronously extracts and outputs the quantized value of the received signal strength at the corresponding frequency point. This quantized value represents the digital reflection of the power level of the received RF signal, used to characterize the electromagnetic wave attenuation degree of the current spatial channel; the more severe the attenuation, the lower the quantized value. By configuring the hardware parameters of the above 72 consecutive 1 MHz step frequency points, the system can provide raw channel detection material spectrum lines with extremely high frequency resolution at the underlying level, thereby providing solid data support for subsequent acquisition of fine multipath impulse waveforms. It should be noted that the 72 step frequency points are only example parameters for Bluetooth channel detection. The method of this application is not limited to this. For other ultra-wideband protocols, those skilled in the art can also achieve the purpose of this application by using 128 frequency points and adjusting their step intervals.

[0029] During the data frame transfer to memory S202, the direct memory access controller 102 transfers the digital in-phase and quadrature data frames to the high-speed static random access memory 106 of the channel detection coprocessor 104. Throughout this full physical layer data transfer process, the main control microprocessor unit 103 remains in a deep sleep state. Specifically, before the RF transceiver front-end 101 begins receiving probe tone signals in batches, the main control microprocessor unit 103 performs only one initialization operation: configuring the source address register of the direct memory access controller 102 to the buffer start address of the RF end, and configuring the destination address register to the start address of the high-speed static random access memory 106 within the coprocessor. After completing this register configuration, the main control microprocessor unit 103 immediately cuts off its internal high-frequency operating clock and enters a low-power standby mode. Subsequently, the independent hardware state machine inside the direct memory access controller 102 takes full control of the read and write permissions of the system bus 105. The Direct Memory Access Controller 102 connects to both ends of the node via an internal high-speed channel independent of the system main bus. During data transfer, it automatically executes burst transfer mode, sequentially filling in the sampling data of 72 frequency points. This hardwired takeover mechanism, which does not require waking up the main controller, reduces the dynamic leakage current power consumption of the system-on-a-chip during long-term ranging and monitoring processes.

[0030] like Figure 3As shown, the channel detection coprocessor 104 integrates a complex pipelined operation structure. In the acquisition and comparison of quantized values ​​(S203), the received signal strength quantization value is obtained through the data stream preprocessing pipeline 301 built into the channel detection coprocessor 104. This quantized value is then compared with a set multipath deep fading threshold using a dynamic masking trigger 302 within the pipeline. This multipath deep fading threshold represents the critical signal strength level that can distinguish between the actual line-of-sight path and the distorted frequency point that experiences destructive interference due to severe reflections from the vehicle's metal environment. Specifically, the data stream preprocessing pipeline 301 integrates a dynamic masking trigger 302 and a channel selector 303. After the RF transceiver front-end 101 bypasses and outputs the received signal strength quantization value for the corresponding frequency point, this quantization value is stored in real-time in the front-end first-stage register within the data stream preprocessing pipeline 301. Simultaneously, the multipath deep fading threshold, representing the critical limit of environmental metal reflection, is permanently stored in a read-only memory unit. At the physical hardware level, the output of the read-only memory unit is directly connected to the first input of the internal digital comparator circuit 304 via a metal hardwire; simultaneously, the output bus of the first-stage register is directly connected to the second input of the digital comparator circuit 304. The arithmetic logic unit in the digital comparator circuit 304 performs a logical subtraction operation under a synchronous clock cycle. In this micro-computation stage, the system follows the core judgment logic: if the judgment result shows that the quantized value of the received signal strength at a specific frequency point is lower than the underlying multipath deep fading threshold (i.e., the highest bit of the two's complement result of the subtraction operation is negative), it indicates that the frequency point has encountered destructive interference in the metal environment of the vehicle body. At this time, the digital comparator circuit 304 immediately generates a high-level trigger signal at its output pin and injects it into the dynamic masking trigger 302.

[0031] Subsequently, the distortion frequency point is overwritten to zero (S204). When the dynamic masking trigger 302 receives the trigger level, the drive channel selector 303 forcibly overwrites the data value of the corresponding distortion frequency point in the digital in-phase and quadrature data frames to digital zero. Specifically, when the dynamic masking trigger 302 receives the aforementioned trigger level, it immediately flips the state of its internal D-type flip-flop on the rising edge of the next clock signal and outputs a hardware-level gating mask signal to the control enable pin of the channel selector 303. Structurally, the channel selector 303 is essentially a high-speed data multiplexer. The first data input channel of this data multiplexer is connected to the regular data flow path of the digital in-phase and quadrature data frames via a parallel bus. Its second data input channel is hard-grounded on the silicon trace, thereby passively providing a constant multi-bit digital zero-level state. Once the data multiplexer receives a gating and shielding signal, it will force its internal logic gates to switch to the second data input channel, thereby forcibly overwriting all in-phase and quadrature data frame bits within the current clock cycle with multiple digital zero levels. After the data at the problematic frequency is completely overwritten and the gating and shielding signal is removed with the frequency jump, the internal logic gates will spontaneously switch back to the first data input channel to allow subsequent healthy data to pass. By employing this data overwrite and rejection logic based on nanosecond-level hardware switching action, the system can physically isolate spurious phase flip components caused by severe multipath effects, avoid distorted amplitude data contaminating the subsequent complex time-frequency domain conversion chain, and enhance the ranging anti-interference capability.

[0032] After cleaning up inferior frequency points, the polar coordinate system data conversion S205 performs a data domain conversion operation. The effective digital in-phase and quadrature data frames processed by the channel selector 303 are input into the coordinate rotation digital calculator unit 305, converted into amplitude and phase values ​​in polar coordinates, and a frequency domain channel response array is formed based on this. Specifically, the coordinate rotation digital calculator unit 305 is composed of a series of cascaded shift registers and adder networks, with the underlying logic iteratively performing vector rotation operations using the non-recovery remainder method. To balance computational accuracy and response delay, the coordinate rotation digital calculator unit 305 is designed as a hardware network with a 12-stage pipeline. It directly utilizes hardware logic to perform complex division and arctangent decimation algorithms from the extracted effective digital Cartesian coordinate in-phase and quadrature levels, thereby outputting a binary sequence representing the amplitude and phase angle. The continuous sequence composed of the complex frequency responses in polar coordinates corresponding to each discrete detection frequency point constitutes the frequency domain channel response array, which reflects the frequency-selective fading physical characteristics of the wireless channel within a specific frequency band. It should be noted that the hardware design scale of the 12-stage pipeline is only a preferred balanced configuration in this embodiment. Those skilled in the art can configure it as a 16-stage or 24-stage pipeline according to the requirements of phase subdivision granularity, and can also achieve the purpose of accurately extracting physical phase deflection.

[0033] Subsequently, in the line-of-sight path peak extraction S206, the frequency domain channel response array is converted into a time domain channel impulse response sequence by the inverse fast Fourier transform engine 306, the line-of-sight path peak is extracted, and the first distance value is calculated. In this embodiment, the inverse fast Fourier transform engine 306 is configured at the hardware level as a dedicated digital signal processing macrocell with a 64-bit width. The inverse fast Fourier transform engine 306 performs a radix-r butterfly operation structure on the input frequency domain channel response array to generate a time domain channel impulse response sequence containing discrete sampling points. This time domain channel impulse response sequence represents the response time waveform sequence of the communication channel to an ideal impulse signal in the time domain, and is used to visually demonstrate the geometric distribution of the time delay of each multipath energy cluster arriving at the receiver. In order to accurately locate the line-of-sight peak that can characterize the real physical distance, the time domain channel impulse response sequence is fed in parallel into the system's built-in peak detection module 312. The peak detection module 312 uses a digital sliding window comparison algorithm to calculate the sum of the energy of the discrete sampling points and their adjacent sampling points in the time domain sequence. Specifically, the system performs a sliding window calculation of the local energy sum, and the calculation formula is as follows:

[0034]

[0035] Among them, E kdenoted as the local energy sum within the current sliding window, k represents the time axis index of the currently calculated sampling point, W represents the sliding window width set by the system, and h[n] represents the complex amplitude value of the corresponding discrete sampling point in the time-domain channel impulse response sequence.

[0036] The peak detection module 312 then compares the sum of energy in each window with a preset noise floor threshold stored in a register, and identifies the signal energy cluster whose energy exceeds the noise floor threshold and arrives earliest on the time axis as the main peak of the line-of-sight path. After determining the main peak, the system further extracts the phase deflection data of the discrete sampling points where the main peak is located. Subsequently, the system acquires the initial phase of the transmitter and the measured phase of the receiver contained in the transmission of the probe tone signal in the air channel, and calculates the phase difference between the two using a subtractor. At this time, the system performs vector superposition compensation with the previously extracted phase deflection data to obtain an absolute phase difference with environmental resistance correction effect. Specifically, the calculation formula for the absolute phase difference by the system performing superposition compensation is as follows:

[0037]

[0038] in, Indicates absolute phase difference, This indicates the phase measured at the receiver via the antenna. This indicates the initial phase of the transmitter as defined in the protocol. This represents the phase deflection data used to eliminate constant bias.

[0039] Finally, the system performs linear multiplication and addition operations in the multiply-add unit based on the vacuum speed of light constant, the center frequency of the detected tone signal, and the extracted absolute phase difference, thereby determining the first distance value D. Specifically, the system performs the absolute spatial distance conversion calculation using the following formula:

[0040]

[0041] Where D represents the calculated physical first distance value, c represents the electromagnetic wave speed constant, and f represents the center frequency of the currently detected tone signal. This represents the absolute phase difference obtained from the previous step.

[0042] It must be pointed out that in this application, the first distance value D is not obtained by upper-level software calculation, but is entirely based on the physical phase offset extracted in polar coordinates, and is obtained through hard calculation by the underlying pure hardware logic multiply-accumulate circuit. By adopting this hardware distance calculation method based on the combination of multipath elimination and phase decimation, the processor memory interaction latency is reduced, and high-precision distance measurement is achieved for the first time.

[0043] While the phase ranging pipeline is running, the physical round-trip time (PRT) S207 is recorded to initiate the ranging branch. The actual PRT of the ranging frame is recorded by the high-frequency counter 307, and this PRT is converted into a second distance value by the multiplier 309. Specifically, this mechanism relies on underlying hard-wired coordination: a dedicated frame synchronization pin is reserved on the RF transceiver front-end 101. This frame synchronization pin is directly hard-wired to the enable trigger of the high-frequency counter 307 inside the channel detection coprocessor 104 via metal wires on the silicon physical circuit. When the demodulator at the bottom layer of the RF transceiver front-end 101 detects the start delimiter of the ranging request frame, it sends a steep start pulse signal to the high-frequency counter 307 through this frame synchronization pin. This control signal causes the high-frequency counter 307 to immediately begin its internal pulse accumulation counting based on its first clock frequency. When the ranging response frame is fully received and the end delimiter is detected, the RF transceiver front-end 101 sends a stop pulse signal to the high-frequency counter 307 again. The logic circuitry inside the high-frequency counter 307 then captures the stop edge and multiplies the accumulated count value between the two pulse signal triggers by the length of a single clock cycle to accurately determine the physical round-trip time of the radio frequency wave propagating in physical space. This time is then converted into a second distance value representing the actual distance traveled by a post-multiplier 309. In this embodiment, the first clock frequency of the high-frequency counter 307 is preferably configured to 16 MHz. This high-frequency design ensures that the round-trip time timing achieves high-resolution accuracy at the nanosecond level. It should be noted that the 16 MHz reference frequency here is only an embodiment adapted to Bluetooth bandgap pulses; those skilled in the art can use a 32 MHz ultra-high-frequency clock based on an internal frequency divider to achieve higher time scale accuracy.

[0044] Finally, the system proceeds to the security verification and circuit breaker stage, involving calculating the absolute difference (S208) and sending the physical layer blocking instruction (S209). The hardware interlock comparator 308 receives the first distance value and the second distance value, and calculates the absolute difference between them. In this security mechanism, the system follows the following underlying hardware logic trigger condition: when the calculated difference exceeds a preset security tolerance window, the interlock logic bypasses the microprocessor and immediately sends a physical layer blocking instruction to the direct memory access controller 102. Specifically, in terms of internal structure, as... Figure 3As shown, the hardware interlock comparator 308 internally includes a dedicated differential subtraction circuit 310 and a threshold register 311. The first and second input pins of the differential subtraction circuit 310 are respectively connected to the data bus output by the inverse fast Fourier transform engine 306 for the first distance value, and the data bus output by the high-frequency counter 307 and multiplier 309 for the second distance value. After receiving the first and second distance values ​​in parallel, the differential subtraction circuit 310 performs a differential complement operation to calculate their absolute difference. Specifically, the system performs the following formula for absolute difference secure comparison:

[0045]

[0046] in, The values ​​represent the physical absolute difference calculated under two different systems. D1 represents the first distance value based on the extremely low delay of the phase, and D2 represents the second distance value including flight and relay delays.

[0047] At this point, a fixed value has been programmed into the silicon memory area of ​​the threshold register 311 at the factory. This value represents the upper limit of the allowed distance, which corresponds to the aforementioned security tolerance window. The differential subtraction circuit 310 then sends the absolute difference to the digital comparison logic gate, which performs a nanosecond-level low-level synchronous comparison between the absolute difference and the upper limit of the distance in the threshold register 311. If a slight signal lag introduced by the relay amplifier causes the measured second distance value to be abnormally large, resulting in an absolute difference greater than the upper limit of the distance, the digital comparison logic gate will instantly conduct. This conduction state will directly trigger the interrupt signal line connected to the blocking instruction of the direct memory access controller 102. This interrupt action requires no software intervention and instantly cuts off the data transmission link of the physical layer, just like cutting off the power, stopping all RF payload handling initiated by the direct memory access controller. It should be noted that the security tolerance window is a parameter to balance signal jitter and anti-theft sensitivity. For vault access control scenarios with higher security requirements, tightening the hard-wired tolerance window threshold can also achieve stricter physical defense. By employing this hardware differential interlocking circuit breaker mechanism that is independent of the software stack, nanosecond-level physical isolation can be performed before the attacker's signal reaches the higher layers of the system, thereby eliminating the relay forwarding time window vulnerability caused by system task scheduling.

[0048] In another preferred embodiment, the present invention also provides a high-security digital key device. This digital key device includes an antenna array for deployment in a concealed structure of a vehicle, a power module for providing power to various modules, and a high-precision ranging system-on-a-chip (SoC) for Bluetooth channel detection, as described in detail in the foregoing embodiments. The antenna array is connected to the input port of the RF transceiver front-end inside the SoC via an impedance matching network for transmitting and receiving wireless RF signals for interaction with smartphones. The power module interfaces with the chip's power management unit to provide stable operating voltages to the various core areas of the SoC. By applying this chip, which possesses a low-level cleaning mechanism and physical anti-relay characteristics, to the digital key device, the unlocking accuracy of the vehicle in environments with severe multipath interference, such as large parking lots, is improved, and it is given physical-level immunity against relay amplification attacks by car theft gangs.

[0049] In summary, this application's embodiments, by introducing pure hardware masking logic consisting of channel selectors and comparators into the underlying pipeline, can achieve complete removal of deep fading distortion data at the source physical level based on the original quantization value. Furthermore, a hardware coordination mechanism directly performs a hard comparison between the flight time extracted by the high-frequency timer and the physical phase resolved by the coordinate rotation digital calculator unit network, forming an interlocked fuse protection. This not only reduces the computational power consumption of the main control processor for multipath suppression and security authentication, but more importantly, it directly overcomes the response latency of software task scheduling, establishing a physical-level defense against wireless RF repeater amplification through hard calculation of polar coordinate system data, ultimately achieving an advanced on-chip system architecture that simultaneously possesses low power consumption, high-precision ranging, and high-dimensional hardware defense.

[0050] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A high-precision ranging SOC method for Bluetooth channel detection, applied to a system-on-a-chip comprising a radio frequency transceiver front-end, a direct memory access controller, a main control microprocessor unit, and a channel detection coprocessor, characterized in that, include: The radio frequency transceiver front end is controlled to sequentially receive the detection tone signal and output digital in-phase and quadrature data frames and the corresponding received signal strength quantization value; The direct memory access controller moves the digital in-phase and quadrature data frames to the memory of the channel detection coprocessor, and keeps the main control microprocessor unit in a sleep state during the moving process; The received signal strength quantization value is obtained through the data stream preprocessing pipeline built into the channel detection coprocessor, and the received signal strength quantization value is compared with the set multipath deep fading threshold through a dynamic masking trigger. When the received signal strength quantization value is lower than the set multipath deep fading threshold, the data value of the corresponding frequency point in the digital in-phase and quadrature data frames is overwritten to digital zero by the channel selector. The digital in-phase and quadrature data frames processed by the channel selector are input into the coordinate rotation digital calculator unit, converted into amplitude and phase angle values ​​in polar coordinates, and a frequency domain channel response array is formed based on the amplitude and phase angle values. The frequency domain channel response array is converted into a time domain channel impulse response sequence using a fast inverse Fourier transform engine. The line-of-sight path peak in the time domain channel impulse response sequence is extracted, and a first distance value is calculated based on the line-of-sight path peak. The physical round-trip time of the ranging frame is recorded by a high-frequency counter, and the physical round-trip time is converted into a second distance value. The first distance value and the second distance value are received by a hardware interlock comparator, and the difference between the first distance value and the second distance value is calculated. When the difference exceeds a preset safety tolerance window, a blocking instruction is sent to the direct memory access controller.

2. The method as described in claim 1, characterized in that, The step of comparing the quantized value of the received signal strength with a set multipath deep fading threshold using a dynamic masking trigger includes the following process: The received signal strength quantization value output by the radio frequency transceiver front end is received, and the received signal strength quantization value is stored in the first-stage register of the data stream preprocessing pipeline; The set multipath deep fading threshold is stored in a read-only memory unit, and the output of the read-only memory unit is connected to the first input of the digital comparator via hardwire. The output of the first-stage register is connected to the second input of the digital comparator. The digital comparator performs a logical subtraction operation on the received signal strength quantization value and the set multipath deep fading threshold under synchronous clock cycles. When the operation result is negative, the trigger level is output to the dynamic masking trigger.

3. The method as described in claim 2, characterized in that, When the quantized value of the received signal strength is lower than the set multipath deep fading threshold, the data values ​​of the corresponding frequency points in the digital in-phase and quadrature data frames are overwritten with digital zeros through a channel selector, including the following process: When the trigger level is received, the internal state is toggled on the rising edge of the clock, and a gating shield signal is output to the control pin of the channel selector. The channel selector includes a data multiplexer, wherein a first data input channel of the data multiplexer is connected to the data bus of the digital in-phase and quadrature data frames, and a second data input channel is hard grounded to provide a constant multi-bit digital zero level. After receiving the gating and shielding signal, the internal logic gate is switched to the second data input channel to cover the digital in-phase and quadrature data frames in the current clock cycle with multiple digital zero levels, and the switching back to the first data input channel is restored after the gating and shielding signal is removed.

4. The method as described in claim 1, characterized in that, The process of converting the frequency domain channel response array into a time domain channel impulse response sequence using a fast inverse Fourier transform engine, and extracting the line-of-sight path main peak from the time domain channel impulse response sequence, includes the following steps: The inverse fast Fourier transform engine performs a radix-r butterfly operation on the frequency domain channel response array, outputting the time domain channel impulse response sequence containing discrete sampling points; The time-domain channel impulse response sequence is input into the peak detection module. The energy sum of discrete sampling points and their adjacent sampling points in the time-domain channel impulse response sequence is calculated by the sliding window algorithm. The earliest arriving signal energy cluster whose energy sum exceeds the preset noise floor threshold is determined as the main peak of the line-of-sight path.

5. The method as described in claim 4, characterized in that, The process of calculating the first distance value based on the main peak of the line-of-sight path includes the following steps: Extract the phase deflection data of the discrete sampling points corresponding to the main peak of the line-of-sight path; The initial phase of the transmitting end and the measured phase of the receiving end of the probe tone signal are obtained during the channel transmission process, and the phase difference between the initial phase of the transmitting end and the measured phase of the receiving end is calculated. The phase difference value is superimposed and compensated with the phase deflection data to obtain the absolute phase difference; The first distance value D is determined by performing a linear multiplication-addition operation based on the speed of light constant, the center frequency of the detected tone signal, and the absolute phase difference; The first distance value D is obtained by pure hardware logic circuit calculation based on the physical phase offset extracted in the polar coordinate system.

6. The method as described in claim 1, characterized in that, The process of transferring the digital in-phase and quadrature data frames to the memory of the channel detection coprocessor via the direct memory access controller, while keeping the main control microprocessor unit in a sleep state during the transfer process, includes the following steps: Before the radio frequency transceiver front end starts receiving the probe tone signal, the source address register and destination address register of the direct memory access controller are configured; After configuration is complete, the internal high-frequency clock is turned off and the system enters low-power standby mode. The hardware state machine of the direct memory access controller takes over the data bus permissions and performs the transfer operation.

7. A high-precision ranging system-on-a-chip for Bluetooth channel detection, characterized in that, include: The radio frequency transceiver front end is configured to receive the probe tone signal and output digital in-phase and quadrature data frames and the corresponding received signal strength quantization value. The main control microprocessor unit is configured to execute communication protocols; The channel detection coprocessor has a built-in data stream preprocessing pipeline, coordinate rotation digitizer unit, fast inverse Fourier transform engine and high frequency counter; A direct memory access controller, connected to the memory of the radio frequency transceiver front end and the channel detection coprocessor, is configured to move the digital in-phase and quadrature data frames to the memory of the channel detection coprocessor, and keep the main control microprocessor unit in a sleep state during the moving process; The data stream preprocessing pipeline includes a dynamic masking trigger and a channel selector. The dynamic masking trigger is configured to compare the received signal strength quantization value with a set multipath deep fading threshold, and when the received signal strength quantization value is lower than the set multipath deep fading threshold, drive the channel selector to overwrite the data value of the corresponding frequency point in the digital in-phase and quadrature data frames with a digital zero. The coordinate rotation digital calculator unit is configured to receive the digital in-phase and quadrature data frames processed by the channel selector, convert them into amplitude and phase values ​​in polar coordinates, and form a frequency domain channel response array. The fast Fourier inverse transform engine is configured to convert the frequency domain channel response array into a time domain channel impulse response sequence, extract the line-of-sight path main peak in the time domain channel impulse response sequence, and calculate the first distance value. The high-frequency counter is configured to record the physical round-trip time of the ranging frame and convert it into a second distance value; A hardware interlock comparator is configured to calculate the difference between the first distance value and the second distance value, and send a blocking instruction to the direct memory access controller when the difference exceeds a preset safety tolerance window.

8. The high-precision ranging system-on-a-chip for Bluetooth channel detection as described in claim 7, characterized in that, The radio frequency transceiver front end is equipped with a frame synchronization pin. The frame synchronization pin is physically hardwired to the enable pin of the high-frequency counter inside the channel detection coprocessor via a metal wire. When the radio frequency transceiver front end detects the start delimiter of the ranging frame, it sends a start pulse signal to the high-frequency counter through the frame synchronization pin, and controls the high-frequency counter to start pulse counting based on the first clock frequency. When the ranging frame is completed, the radio frequency transceiver front end sends a stop pulse signal to the high-frequency counter, and the high-frequency counter multiplies the count value between the two pulse signals by the clock cycle length to determine the physical round-trip time.

9. The high-precision ranging system-on-a-chip for Bluetooth channel detection as described in claim 8, characterized in that, The first clock frequency of the high-frequency counter is configured to be 16 MHz; The hardware interlock comparator includes a differential subtraction circuit and a threshold register. The differential subtraction circuit is connected to the output bus of the inverse fast Fourier transform engine and the output bus of the high-frequency counter, respectively. The threshold register is programmed with a distance upper limit value corresponding to the numerical value, and the distance upper limit value corresponds to the safety tolerance window; The differential subtraction circuit receives the first distance value and the second distance value, calculates the absolute difference, and performs a nanosecond-level synchronous comparison between the absolute difference and the upper distance value in the threshold register through a digital comparison logic gate. When the absolute difference is greater than the upper limit of the distance, the digital comparison logic gate directly triggers the interrupt signal line where the blocking instruction is located to cut off the data transmission link of the physical layer.

10. A high-security digital key device, characterized in that, Includes an antenna array, a power module, and the high-precision ranging system-on-a-chip for Bluetooth channel detection as described in claim 7; The antenna array is connected to the input port of the radio frequency transceiver front end and is used to transmit and receive wireless radio frequency signals; The power module is used to provide operating voltage for the system-on-a-chip.

Images