Countermeasure method against intermediate-type attacks within the UWB protocol
A dual-channel method using UWB and BLE interfaces in UWB protocols addresses intermediate attacks, ensuring accurate distance measurements and secure operation execution by comparing independent measurements.
Patent Information
- Authority / Receiving Office
- FR · FR
- Patent Type
- Utility models
- Current Assignee / Owner
- Filing Date
- 2024-12-16
- Publication Date
- 2026-03-27
AI Technical Summary
Existing UWB protocols are vulnerable to intermediate-type attacks that disrupt distance measurements between transmitting/receiving devices, compromising security operations such as vehicle door unlocking, without adequate countermeasures at the PHY layer.
Implementing a dual-channel approach using UWB and Bluetooth Low Energy (BLE) communication interfaces to perform independent distance measurements, comparing results to detect and mitigate potential attacks by ensuring consistency across both channels.
Enhances security by reducing the likelihood of successful attacks, maintaining accurate distance measurements, and enabling reliable execution of operations like door unlocking or locking.
Smart Images
Figure 00000012_0000 
Figure 00000012_0001 
Figure 00000012_0002
Abstract
Description
Title of the invention: Countermeasure method against intermediate-type attacks within the framework of the UWB protocol. Technical field
[0001] The present invention relates to the UWB ("Ultra Wide Band") protocol implemented to evaluate transmission distance based on the transmission time of messages exchanged between two transmitting / receiving devices. In particular, the present invention aims to counter man-in-the-middle attacks designed to disrupt transmissions between two transmitting / receiving devices, in order to distort the distance assessment between these two devices. State of the art
[0002] Many applications implement the UWB protocol to accurately and reliably assess distance based on message transmission time between sending / receiving devices. This is the case, for example, with a hands-free vehicle door unlocking application that allows the vehicle door to be unlocked when the key is detected at a distance less than a threshold value, typically one to two meters. Thus, the user does not need to pick up the key to press an unlocking button on the key fob, and can therefore leave the key in their pocket. Furthermore, some smartphones are equipped with a UWB interface that can be used by an application installed on the smartphone to act as a hands-free key.
[0003] To obtain a distance estimate with an accuracy of less than one meter using the UWB protocol, it is necessary to take multipath propagation into account. Indeed, due to multipath propagation, the receiver of a message receives several copies of the transmitted message, which may be distorted and attenuated. Each of these copies is offset in time according to the propagation time along the path taken by the copy. Thus, the spread of propagation times between the copies can correspond to a difference of several meters. To obtain the required accuracy, the receiver must determine the arrival time of the first received copy. This task proves particularly difficult, especially when obstacles are present between the transmitter and the receiver.
[0004] An attacker located between the sender and the receiver can deceive the latter by sending a message configured to be perceived as the first copy of a message sent by a genuine sender. Thus, an attacker can, for example, open the door of a vehicle parked in front of a building where the vehicle's owner is located.
[0005] The IR-UWB ("Impulse Radio" - UWB) protocol, based on the transmission of very narrow pulses, improves the accuracy of distance measurement by facilitating the detection of the first copy of the transmitted message. However, this protocol does not completely counter intermediate attacks, but simply limits the alteration of the evaluated distance resulting from the attack to the time it takes to receive all the copies produced by the multipath transmission.
[0006] Distance Bounding protocols introduce cryptographic mechanisms. However, these protocols do not apply to the PHY physical layer, which is affected by the type of attack described above.
[0007] It is therefore desirable to propose a method to counter intermediate attacks within the framework of the UWB protocol applied to the measurement of distance between two transmitting / receiving devices. Summary
[0008] Embodiments relate to a method of countermeasure against an attack aimed at disrupting a distance measurement obtained by measuring signal transmission times between first and second "Ultra Wide Band" - UWB signal transmitter / receiver devices, the method comprising steps consisting of: performing a first distance measurement separating the first and second transmitter / receiver devices, by the first transmitter / receiver device, by measuring transmission times between first UWB type communication interfaces, belonging respectively to the first and second transmitter / receiver devices;perform a second distance measurement separating the first and second transmitting / receiving devices, in the first transmitting / receiving device, by means of second communication interfaces belonging respectively to the first and second transmitting / receiving devices, the second communication interfaces being of a type distinct from UWB; perform a first comparison of the first and second distance measurements; if a difference between the first and second distance measurements is less than a first threshold value, activate or not a first operation by the first transmitting / receiving device, depending on the result of a second comparison consisting of comparing the first distance measurement to a second threshold value;and if a difference between the first and second distance measurements is greater than the threshold value, do not activate the first operation, the second distance measurement being carried out by measuring transmission times between the second communication interfaces, the second communication interfaces being of the Bluetooth Low Energy -BLE type, the two devices carrying out the first and second distance measurements and carrying out the first comparison, the second transmitter / receiver device activating a second operation if the difference between the first and second measurements of; distance is greater than the first threshold value, the first distance measurement being calculated using a first measurement of the duration between an instant of transmission of a query message and an instant of reception of a response message, by one of the first communication interfaces of the first and second transmitter / receiver devices, and a second measurement of the duration between an instant of reception of the query message and an instant of transmission of the response message, by the other of the first communication interfaces of the first and second transmitter / receiver devices.
[0009] Thus, by using two separate communication channels, it is possible to obtain two distance measurements and compare them. Since it is less likely that an attacker could simultaneously disrupt both measurements, such an attack can be detected by simply comparing the two distance measurements. Implementing this countermeasure is particularly straightforward, as devices incorporating a UWB communication interface generally include another communication interface.
[0010] According to one embodiment, the first distance measurement is further calculated using a third time measurement between the time of receipt of the reply message and a time of transmission of a second query message, by one of the first communication interfaces of the first and second transmitter / receiver devices, and a time measurement between the time of transmission of the first reply message and a time of reception of the second query message by the other of the first communication interfaces of the first and second transmitter / receiver devices.
[0011] According to one embodiment, the first operation includes an unlocking of door and is activated if the difference between the first and second distance measurements is less than the first threshold value, and if the first distance measurement is less than a second threshold value.
[0012] According to one embodiment, the first operation includes a door locking and is activated if the difference between the first and second distance measurements is greater than the first threshold value, or if the first distance measurement is greater than a second threshold value.
[0013] Embodiments may also relate to a system comprising first and second transmitter / receiver devices, each of the first and second transmitter / receiver devices comprising: a first UWB type communication interface, and a second communication interface of a type distinct from UWB, the system being configured to implement the method defined above. Brief description of the figures
[0014] The present invention will be better understood with the aid of the following description of exemplary embodiments with reference to the accompanying figures, in which identical reference signs correspond to structurally and / or functionally identical or similar elements.
[0015] [Fig. 1] Figure 1 schematically represents two transmitter / receiver devices exchanging distance measurement messages, for example according to the UWB protocol,
[0016] [Fig. 2] Figures 2A and 2B schematically represent steps in distance measurement processes, according to the UWB protocol,
[0017] [Fig.3] Figure 3 represents steps of a distance measurement process including countermeasurement steps, according to one embodiment. Detailed description
[0018] Figure 1 shows two transmitter / receiver devices, TX and RX, exchanging distance measurement messages according to the UWB protocol. The TX device is located at a distance DT from the RX device. The TX device is configured to initiate a distance measurement with the RX device. The RX device is configured to trigger an operation, for example, a security operation such as unlocking or opening a door, if the measured distance between the TX and RX devices is less than a distance threshold value TH.
[0019] In an attack configuration shown in Figure 1, the TX device exchanges position measurement messages with the RX device. The RX device thus evaluates the distance DT separating it from the RX device. An attacker equipped with a transmitter device AX positions itself at a distance DA from the RX device, less than the threshold value TH, and emits signals capable of disrupting the messages received by the RX device. The signals emitted by the attacker's AX device are configured to skew the distance evaluated by the RX device, so that this distance corresponds to the distance DA from the AX device. The attacker can thus trigger the action executed by the RX device by positioning itself at a distance DA less than the threshold value TH. To this end, the AX device can be configured to exploit the multipath processing of the received signals performed by the RX device.
[0020] Note that the action performed by device RX can also be a door lock when the distance DL with device TX is greater than a second threshold value. In this case, the attacker can aim to prevent this action by positioning device AX close enough to device RX so that the distance measured by device RX remains less than this second threshold value.
[0021] Figures 2A, 2B illustrate TFM1, TFM2 SS-TWR ("Single Sided - Two Way Ranging") and DS-TWR ("Double Sided - Two Way Ranging") distance evaluation methods. Way Ranging") can be used to measure the distance DT between the TX and RX devices. In the TFM1 evaluation method illustrated in Figure 2A, the TX device sends a distance measurement request message M1 to the RX device, and the RX device sends a distance measurement response message M2 back to the TX device. The distance DT between the TX and RX devices can thus be evaluated using the following equation:
[0022] DT = C.(T1' - Tl) / 2, (1)
[0023] where Tl is the time elapsed between the moment of receipt of message Ml by device RX and the moment of transmission of message M2 by device RX, Tl' is the time elapsed between the moment of transmission of message Ml by device TX and the moment of reception of message M2 by device TX, and C is the speed of propagation of electromagnetic waves in air. The time of flight (Tl' - Tl) / 2 (= (TOF1+TOF2) / 2) corresponds to the average of the transmission time TOF1 of message Ml and the transmission time TOF2 of message M2 between devices TX and RX. The time Tl' can be transmitted by device TX to device RX in a message MD following message M2.
[0024] In the DS-TWR evaluation method TFM2 of Figure 2B, the TX device sends the distance measurement request message M1 to the RX device, the RX device sends the distance measurement response message M2 to the TX device, and the TX device sends the distance measurement response message M3 to the RX device. The distance DT between the TX and RX devices can be evaluated by the following equation:
[0025] DT = C.(T1'.T2' - T1.T2) / (2.(T1+T2+T1'+T2')), (2)
[0026] in which T1 is the time elapsed between the time of receipt of message M1 by device RX and the time of transmission of message M2 by device RX, T1' is the time elapsed between the time of transmission of message M1 by device TX and the time of reception of message M2 by device TX, T2 is the time elapsed between the time of reception of message M2 by device TX and the time of transmission of message M3 by device TX, and T2' is the time elapsed between the time of transmission of message M2 by device RX and the time of reception of message M3 by device RX. The times T1' and T2 can be transmitted by device TX to device RX in message M3 or in a subsequent message MD'.
[0027] Once the distance DT is evaluated, the RX device can compare the distance DT to a threshold value TH and trigger an action based on the result of the comparison.
[0028] It should be noted that in Figures 2A, 2B, the roles of the TX and RX devices can be reversed, and the TX device can ultimately evaluate the distance DT and transmit it to the RX device.
[0029] Furthermore, the distance measurement DT can be obtained from the duration measurements T1, T1', T2, T2' using different equations. For example, the distance measurement can be obtained by calculating the average of distances obtained using equation (1) applied on the one hand to the duration measurements T1 and T1', and on the other hand to the duration measurements T2 and T2'.
[0030] Figure 3 illustrates steps S1 to S26 of a remote control method as a function of the distance between a device initiating a command, namely the transmitter / receiver device TX, and a device executing the command, namely the device RX. The devices TX, RX each comprise a first communication interface TX1, RX1 of the UWB type, and a second communication interface TX2, RX2, for example of the BLE ("Bluetooth Low Energy") or WiFi™ type. BLE or WiFi™ communication interfaces have the advantage of being able to remain active or in standby mode without excessive power consumption, which is not the case for UWB communication interfaces. It can therefore be advantageous for the first interface RX2 to be inactive outside of periods when it is not necessary to measure the distance DT with the TX device.
[0031] In step S1, the TX device commands the transmission of a wake-up message WK via its second communication interface TX2. In the following step S2, the TX device activates its first communication interface TX1. In step S3, the WK message is transmitted by the second communication interface TX2 of the TX device to the second communication interface RX2 of the RX device. In step S4, the second communication interface RX2 transmits the wake-up message WK to the RX device, which activates its first communication interface RX1 in step S5. In step S6, the activation of the first communication interface RX1 triggers the transmission of an AK message to activate a distance evaluation method. The AK message is received by the first communication interface TX1 of the TX device. In step S7, the first communication interface TX1 activates the TFM evaluation method, which can be either the TFM1 or TFM2 method described previously.At the end of the execution of the TFM evaluation process by the TX1 communication interface, in steps S8 and S9, the first TX1 communication interface transmits to the TX device and to the first RX1 communication interface, the time of flight measurement Tl' and possibly the time of flight measurement T2, depending on the TFM1 or TFM2 evaluation process executed.
[0032] At step S10, after the execution of the TFM evaluation process by the first communication interface RX1, the latter transmits to the RX device the flight time measurement T1 and optionally the flight time measurement T2', depending on whether the TFM1 or TFM2 evaluation process was executed. At step SU, the flight times T1' and T2 received by the first communication interface RX1 are transmitted to the RX device. At step S12, the RX device records the current time and stores it in a The timestamp data TS1 is received. At step S13, the timestamp data TS1, and optionally the flight time T1 and flight time T2', are transmitted to the second communication interface RX2. At step S14, the second communication interface RX2 transmits the timestamp data TS1, and optionally the flight time T1 and flight time T2', to the second communication interface TX2 of the TX device. At step S15, the second communication interface TX2 transmits the received data (TS1, T1, T2') to the TX device. At step S16, the TX device records the current time and stores it in a timestamp data TS2. At steps S17, S18, and S19, the timestamp data TS2 is transmitted to the RX device via the second interfaces TX2 and RX2. Upon receiving the timestamp data TS2, at step S20, the RX device records the current time and stores it in a timestamp data TS3.Next, the RX device calculates a DTB1 distance based on the TS2 and TS3 timestamp data, and calculates a DTU distance based on the received flight times Tl' and possibly T2 and the flight times Tl and possibly T2' measured and provided by the first communication interface RX1.
[0033] In step S21, the RX device compares the DTU and DTB1 distances. The RX device executes step S22 if the DTB2 and DTU distances show a non-significant difference, for example, less than a first threshold value; otherwise, it executes step S23. In step S22, the RX device executes an operation CM1 based on the DTU distance measurement, which is then deemed correct. This operation may consist of comparing the DTU distance measurement to a second distance threshold value and executing a command, for example, unlocking a door, if the DTU distance measurement is less than the distance threshold value. Step S23 may include executing another CM2 command and possibly emitting an alarm signal.
[0034] In the example where command CM1 is a door unlock, command CM2 may include locking the door.
[0035] Following step S18, the TX device can perform steps S24 to S26 to verify measured distances. In step S24, the TX device calculates the DTU distance based on the received flight times T1 and optionally T2', and the measured flight times T1' and optionally T2 provided by the first communication interface TX1, and calculates a DTB2 distance based on the timestamp data TS1 and TS2. In step S25, the TX device compares the DTB2 and DTU distances, and issues an alarm signal in step S26 if the DTB2 and DTU distances show a significant difference, for example, greater than the first threshold value.
[0036] The first threshold value and the comparison method implemented in steps S21 and S25 are determined so as to take into account the differences in accuracy of the distance measurements obtained by the time-of-flight calculations of the transmissions between the first interfaces TX1, RX1 and between the second interfaces TX2, RX2. Indeed, a distance calculation from the time-of-flight of a BLE transmission, for example (on the order of meters), is much less precise than a distance calculation from the time-of-flight of a UWB transmission (on the order of 10 cm).
[0037] If the second communication interfaces TX2, RX2 have the capability, they can directly retrieve the timestamp data TS1, TS2, TS3. Thus, the latency between the time of retrieval of each timestamp data and the time to be timestamped of transmission or reception of the message can be reduced, and therefore the accuracy of the timestamp.
[0038] In a simplified version, the timestamp data TS3 is not recorded, and the distance DTB1 is calculated by the RX device at step S20, based on the timestamp data TS1 and TS2.
[0039] Thanks to these provisions, it is possible to detect an attack on the transmissions between the first interfaces TX1 and RX1, aimed at disrupting the distance measurement between the TX and RX devices. Indeed, for such an attack to be successful, the attacker would also have to disrupt the transmissions between the second interfaces TX2 and RX2, and this disruption would have to lead to a disrupted distance measurement close to the disrupted distance measurement determined using the transmissions between the first interfaces TX1 and RX1.
[0040] It will be evident to those skilled in the art that the present invention is susceptible to various embodiments and applications. In particular, the invention is not limited to measuring the distance between the TX and RX devices by measuring flight time using the second communication interfaces TX2, RX2. Indeed, this second distance measurement can be performed by any other means sufficiently precise to validate the first distance measurement obtained from the flight times measured by the first communication interfaces TX1, RX1. For example, one of the TX, RX devices may be fixed and have a precisely known position. The other device may determine its position by any means, for example, using a satellite geographic positioning system.
[0041] The invention can be applied to the control of operations such as opening and locking a door, such as a vehicle or room door, or opening a barrier, for example, for access to parking lots. The invention can also be applied to validation operations, for example, of a payment by mobile phone, or of a concert or public transport ticket. The invention can also be applied to access operations, for example, to a personal device such as a personal computer or tablet, or even to activation operations of devices such as household appliances.
Claims
1. Demands 1. A method for countermeasuring an attack aimed at disrupting a distance measurement obtained by measuring signal transmission times between first and second transmitting / receiving (TX, RX) devices of "Ultra Wide Band" (UWB) signals, the method comprising steps consisting of: perform a first distance measurement (DTU) separating the first and second transmitting / receiving devices, by the first transmitting / receiving device (RX), by measuring transmission times between first communication interfaces (TX1, RX1) of type UWB, belonging respectively to the first and second transmitting / receiving devices; perform a second distance measurement (DTB1) separating the first and second transmitter / receiver devices, in the first transmitter / receiver device, by means of second communication interfaces (TX2, RX2) belonging respectively to the first and second transmitter / receiver devices, the second communication interfaces being of a distinct type of UWB; perform a first comparison of the first and second distance measurements; if a difference between the first and second distance measurements is less than a first threshold value, activate or not a first operation by the first transmitting / receiving device, depending on the result of a second comparison consisting of comparing the first distance measurement to a second threshold value (TH);and if a difference between the first and second distance measurements is greater than the threshold value, do not activate the first operation, the second distance measurement being carried out by measuring transmission times between the second communication interfaces (TX2, RX2), the second communication interfaces (TX2, RX2) being of the Bluetooth Low Energy - BLE type, the two devices (TX, RX) carrying out the first and second distance measurements (DTU, DTB1, DTB2) and carrying out the first comparison, the second transmitter / receiver device activating a second operation (AL) if the difference between the first and second distance measurements is greater than the first threshold value, the first distance measurement being calculated using a first measurement of; duration (TT) between an instant of transmission of an interrogation message (M1) and an instant of reception of a response message (M2), by one of the first communication interfaces of the first and second transmitter / receiver devices (TX, RX), and a second measurement a duration (T1) between an instant of reception of the interrogation message and an instant of transmission of the response message, by the other of the first communication interfaces of the first and second transmitter / receiver devices.
2. 2. Method according to claim 1, wherein the first distance measurement is further calculated using a third time measurement (T2) between the time of receipt of the reply message (M2) and a time of transmission of a second interrogation message (M3), by one of the first communication interfaces of the first and second transmitter / receiver devices (TX, RX), and a time measurement (T2') between the time of transmission of the first reply message and a time of reception of the second interrogation message by the other of the first communication interfaces of the first and second transmitter / receiver devices.
3. 3. A method according to any one of claims 1 or 2, wherein the first operation includes a door unlocking and is activated if the difference between the first and second distance measurements is less than the first threshold value, and if the first distance measurement is less than a second threshold value.
4. 4. A method according to any one of claims 1 to 3, wherein the first operation includes a door lock and is activated if the difference between the first and second distance measurements is greater than the first threshold value, or if the first distance measurement is greater than a second threshold value.
5. 5. System comprising first and second transmitter / receiver devices (TX, RX), each of the first and second transmitter / receiver devices comprising: a first communication interface (RX1, TX1) of the UWB type, and a second communication interface (RX1, TX1) of a distinct type of UWB, the system being configured to implement the method according to any one of claims 1 to 4.