Patent Description:
International patent application publication number <CIT> discloses a method and system for using a communication network having a relay node to provide wireless communication with a mobile station. A ranging region is established with the mobile station in which the establishment of the ranging region includes the transmission of control information corresponding to the relay node. The mobile station is allowed to enter the communication network. The relay node is used to wirelessly communicate with the mobile station in at least one of the uplink and downlink directions.

United States patent application, publication number <CIT> discloses synchronisation code methods. Disclosed is a method for generating employing numerical sequences that may be used for synchronisation codes for example in UWB communications. Derivation of numerical sequences or codes may be based on an encoding algorithm. The codes enable synchronisation between communicating devices and may also be used for channelization.

According to a first aspect of the present disclosure there is provided a processing module as defined in claim <NUM>, a system as defined in claim <NUM> and a method as defined in claim <NUM>.

The above discussion is not intended to represent every example embodiment or every implementation within the scope of the current or future Claim sets. The figures and Detailed Description that follow also exemplify various example embodiments. Various example embodiments may be more completely understood in consideration of the following Detailed Description in connection with the accompanying Drawings.

Wideband Radio Frequency (RF) applications have been developed that are capable of accurate distance measurement between two or more wireless devices. These measurements are based on Time-of-Flight (ToF) calculations which are derived by accurate determination of departure and arrival times of RF packets between two devices. RF packets travel at the speed of light and thus a calculated ToF allows determination of the distance between devices. Such a procedure is commonly called 'Ranging'. One practical application of Ranging is 'Distance Bounding' whereby ToF calculations are used to verify whether the distance between two devices is less than a predefined threshold, such as used for automotive Passive Keyless Entry (PKE) systems and other access control systems, as well as for contactless electronic payment systems.

A receiving device is able to derive a channel estimate in relation to a transmitting device using known patterns within a received packet from the transmitting device. For example, in IR-UWB (Impulse Radio - Ultra-WideBand) systems, such as defined in IEEE <NUM>. <NUM>, a preamble comprising repeating synchronization symbols and a Start-of-Frame Delimiter (SFD) is placed in front of a payload segment. In IR-UWB receivers, the repeating synchronization symbols within the preamble of a received packet are typically used to realise time and frequency synchronization and to derive a channel estimate for the received packet. A channel estimate consists of an estimate of arrival times of multipath components, the first arrived multipath component represents the shortest radio path and is therefore important for the ToF calculations.

Examples herein are described with reference to a radio frequency (RF) communication device e.g. transmitter device and a receiver device and the processing modules thereof. However, it is contemplated that examples are not limited to being implemented solely within RF communication devices and examples may be applicable to any system in which ToF measurements are required to be determined, and in particular applicable to any system in which a Time-of-Flight (ToF) distance measurement is a specified function, such as IR-UWB (Impulse Radio - Ultra WideBand) radio frequency (RF) transceivers, pulse radars at <NUM> and higher frequencies, and pulse-based light/laser ranging transceivers. Thus it is contemplated that examples may be implemented within a range of different communication systems including, but not limited to, RF communication systems, and optical (e.g. light/laser) communication systems, etc. The applications may range from automotive Passive Keyless Entry (PKE) systems and other access control systems to (contactless) electronic payment systems, and in particular to any application where ranging and distance bounding is performed.

In IR-UWB RF systems, it may be desirable to maximize security and link budget while minimizing current consumption, latency, and system cost.

The IR-UWB physical layer is defined in IEEE Standards Association, IEEE Standard for Low-Rate Wireless Personal Area Networks (WPANs), IEEE Std <NUM>. <NUM>™-<NUM> (hereinafter "IEEE standard"). The specification of the physical layers in the standard may have drawbacks for particular use cases. However, we describe herein a plurality of aspects of the physical layer specification that may provide one or more technical effects for one or more particular use cases. One or more of the aspects herein may provide a technical effect over what is disclosed in the standard, for particular use cases.

Accordingly, one or more of the aspects described herein are described as changes to or improvements on the IR-UWB physical layer IEEE standard and accordingly terms and concepts used herein may be equivalent to terms used and concepts defined in the IEEE standard. Additionally, processes or definitions of the IEEE standard may be combined with the features defined herein.

<FIG> illustrates a schematic block diagram of a system <NUM> comprising at least one transmitter device <NUM> and at least one receiver device <NUM>. The at least one transmitter device <NUM> and the at least one receiver device <NUM> each comprise a respective antenna <NUM>, <NUM> for signal communication and a respective processing module <NUM>, <NUM> that may be implemented by computer logic to perform digital signal processing.

The system <NUM> may comprise Impulse Radio - Ultra-WideBand, IR-UWB, devices to provide:.

The processing modules <NUM>, <NUM> of the transmitter <NUM> and receiver <NUM> are configured to exchange data packets, or frames, and determine time of flight-information associated with the frames in a conventional manner. In this way, the interactions can exchange data to (i) enable ranging and (ii) transfer other information.

In passive keyless entry applications, or other ranging applications, it is typical for a system to be used in an environment where multiple other systems operate using a similar channel. For example, a number of vehicles may be parked together in a car park, each vehicle looking for its own key. In order to avoid conflict between systems, each system transmission may contain a unique identifier. The unique identifier may be encrypted in each transmission to avoid a third party snooping on a user by tracking a unique identifier associated with the user.

To ensure that the ranging is performed in a secure way, for example to prevent Cicada attacks, a target pattern in each transmitted frame may be generated as a security-sequence, or secure training sequence (STS), using a Cryptographically Secure Pseudo Random Number Generator (CSPRNG). Security is achieved by ensuring that the sequence is only known by the sender and the intended recipients.

<FIG> illustrates a block diagram representation of a frame <NUM>. The frame <NUM> may be used for ranging or transmitting data between a tag and an anchor.

The frame <NUM> comprises sequential data structures including a synchronization-symbol-portion <NUM>, a start-frame-delimiter (SFD) <NUM>, a security-sequence-portion <NUM> and a data-payload-portion <NUM>. The security-sequence-portion <NUM> provides a secure training sequence (STS). The synchronization-symbol-portion <NUM> may contain a plurality of repeating, predetermined synchronization symbols. The synchronization-symbol-portion <NUM> and subsequent start-frame-delimiter <NUM> provide a synchronization header (SHR) <NUM> in a conventional manner. The synchronization header <NUM> and subsequent secure training sequence (STS) may be considered to provide a secure preamble <NUM> that can be used to identify the frame and perform ranging.

The STS used by a transmitter and receiver may be synchronized using a shared secret, such as a public encryption key. One shared secret can be used to derive a set of STS sequences by employing a certain algorithm, such as a cryptographic algorithm which may be used with a range of seed values. In a ranging protocol, an intended recipient may have knowledge of the shared secret and the algorithm, but not which STS of the set has been transferred.

For example, the secure training sequence (STS) of the frame <NUM> is a cryptographically secure pseudo random number that may be provided by a cryptographically secure pseudo random number generator (CSPRNG) of the transmitter. The cryptographically secure pseudo random number may be generated using known encryption methodology. Use of the STS enables the receiver to verify the authenticity of the transmitter by comparing the STS that is received with a reference pattern. The comparison may be performed by a correlator that generates the reference value, or expected STS, based on an encryption key and a security-sequence-counter-value (seed value).

The receiving transceiver must know the current security-sequence-counter-value (seed value) in order to determine the expected security-sequence to compare with the received security-sequence. Therefore, for secure ranging via IR-UWB prior knowledge of an expected sequence is needed.

The data-payload-portion <NUM> can be used to notify the recipient which STS has been used or which STS sequences are going to be used next. This may be achieved by providing the security-sequence-counter-value, or an encrypted copy of the security-sequence-counter-value, in the data-payload-portion <NUM>. A receiver can then use this information to determine which STS is going to be sent next, and perform ranging at the next opportunity.

In order to obtain processable data in a coherent receiver, carrier recovery and symbol synchronization is performed on the received signal in order to achieve channel synchronization. Carrier recovery and symbol synchronization may involve phase recovery and timing synchronization, as is known in the art, and may be implemented using well known schemes such as phase-locked loops to track the evolution of a signal with time.

A problem that has been identified is that the receiver tracking loops cannot operate effectively on an unknown STS, resulting in a degradation of carrier recover so that any payload sent after an STS cannot be received reliably.

Tracking loops operate by comparing an input signal to a reference signal. The tracking loop adjusts the phase and the sampling rate such that the difference is minimized. One example is the operation of the tracking loop for the duration of an a priory known STS sequence.

The tracking loops need to be active during data reception. Since the data is unknown to the receiver, it has to estimate a reference signal. This is commonly done by utilizing hard decisions of the demodulated data. A minimum signal to noise ratio is required such that the tracking loop can operate reliably. In IR-UWB or spread-spectrum systems, each data bit is spread over multiple chips. The receiver accumulates the chips, that correspond to a bit, before it performs a hard decision. This process is called de-spreading. It increases the signal to noise ratio substantially and enables the operation of the tracking loop on unknown data.

The purpose of the STS sequence is to enable secure ranging. An attacker shall not be able to inject a STS or part of an STS ahead of time, and thereby artificially shortening the ranging result. It is hence very important that the STS consists of a sequence of pulses that appear random to the attacker. An a priori known spreading code cannot be used, since it would allow the attacker to perform a so called early-detect-late-commit attack on the spreading code. The attacker would then use the first part of the spreading sequence to detect the polarity of the sequence, send the remainder ahead of time and thereby artificially shorten the ranging result of a genuine receiver. Spreading can thus not be used for the STS. Operating tracking loop on the individual STS pulses would dramatically degrade sensitivity of the system, making it unpractical for an actual application.

Tracking loops (in a phase-locked loop, PLL, for example) can track the signal continuously which would cause a random drift of the carrier during an unknown STS, since the carrier cannot be recovered on symbol level without knowing the spreading sequence, leading to degradation of carrier recovery performance. This degradation may cause the loss of signal lock such that the ability to receive the data-payload-portion following an unknown STS may be lost. Although such lost data-payload-portions are associated with frames that cannot be verified to enable secure ranging (because the STS in the frame is unknown at the receiver), these data-payload-portions may still contain useful information, such as security-sequence-counter-value (seed value) information to enable the recognition of the STS in a subsequent frame. It would therefore be advantageous to recover such lost data-payload-portions.

In order to improve carrier recovery and so enable recovery and processing of data-payload-portions in frames with an unknown STS, the processing module of an example receiver is configured to exclude unknown security-sequence-portions from the carrier recovery process. A portion is excluded from processing in that processing is not performed on that portion. This may be achieved by pausing the signal tracking process in the time domain so that the security-sequence-portion of a frame is not the subject of the carrier recovery process. A conventional carrier recovery process may be controlled in accordance with a recovery process status in order to achieve exclusion of the security-sequence-portions. A data-payload-portion with unknown data may still be tracked because its spreading is known. By demodulation after despreading of each data-payload-portion symbol it is possible to recover the carrier with a relatively high signal-to-noise ratio.

Turning to <FIG>, there is illustrated an example of a method <NUM> for operating a processing module of a receiver device. The method comprises:.

Various example physical layer frame structures and associated carrier-recovery-status-signals and methods for use in a processing module are discussed below with reference to <FIG>.

The processing module of the receiver device may have a priori knowledge of the format of the frames in the signal and may be configured to suspend, or pause, carrier recovery in accordance with the expected frame format to prevent the security-sequence-portion of the frames being the subject of the carrier recovery process.

<FIG> shows a schematic block diagram of a frame <NUM>, which may also be referred to as a data packet, and a timing diagram for a carrier-recovery-status-signal <NUM>. The frame <NUM> comprises a synchronization-symbol-portion <NUM> followed by a start-frame-delimiter <NUM>. Following the start-frame-delimiter <NUM>, there is provided a sequence comprising an optional first guard-interval <NUM>, a security-sequence-portion <NUM>, an optional second guard-interval <NUM> and a data-payload-portion <NUM>.

The carrier-recovery-status-signal <NUM> indicates whether a carrier recovery function of the processing module of the receiver device is enabled or paused for a corresponding portion of the frame <NUM>. During a paused period, the tracking of the carrier recovery process remains in a steady state and does not change in response to changes in the underlying signal. Carrier recovery is enabled during the synchronization-symbol-portion <NUM> and the start-frame-delimiter <NUM>. The carrier recovery process may transition to being paused at the beginning of, during, or at the end of the first guard-interval that precedes the security-sequence-portion <NUM> and may be reenabled at the beginning of, during, or at the end of the second guard-interval <NUM>. Once resumed, the carrier recovery process remains enabled during the data-payload-portion <NUM>.

In this way, all security-sequence-portions, including both known and unknown security-sequence-portions, can be excluded from carrier recovery processing for ease of implementation. Portions other than the security-sequence portion, and possibly all other portions, are included in the carrier recovery process.

The processing module of the receiver device may be configured to verify whether the security-sequence-portion for each frame contains a known security-sequence by, for example, cross-correlating the security-sequence-portion <NUM> of the frame <NUM> with a target pattern. In such examples, the processing module may be configured to include at least part of the known security-sequence-portions of the one or more frames in the carrier recovery and exclude at least part of the unknown security-sequence-portions of the one or more frames from the carrier recovery process. That is, in some examples, only unknown security-sequence-portions of the one or more frames are entirely excluded from the carrier recovery process.

<FIG> also shows the frame <NUM> described previously with reference to <FIG> and a modified carrier-recovery-status-signal <NUM>. In this example, the carrier recovery process is reenabled by the processing module in response to determining that the security-sequence-portion at least partially matches a target pattern.

Cross-correlation of the security-sequence-portion <NUM> of the frame <NUM> with a target pattern starts at the beginning of the security-sequence-portion <NUM>. If, after a predetermined number of symbols, the security-sequence-portion <NUM> is consistent with the target pattern then the carrier recovery process may be reenabled during the security-sequence-portion <NUM>, as shown in <FIG>. Alternatively, if the security-sequence-portion <NUM> is found not to match the target pattern then the carrier recovery process is reenabled after the security-sequence-portion <NUM> has finished, as described previously with reference to <FIG>. That is, if the security-sequence-portion <NUM> is found not to match the target pattern then the carrier recovery process remains disabled throughout the security-sequence-portion <NUM>.

In this way, unknown security-sequence-portions (portions that contain an unknown security sequence) are excluded from carrier recovery while known security-sequence-portions (portions that contain a known security sequence) are included in carrier recovery. The suspension of carrier recovery may therefore be reduced or even minimised by excluding only security-sequence-portions that relate to unknown security sequences, which may perturb the tracking process of the carrier recovery, while operating on security-sequence-portions that contain a known security sequence, which do not perturb tracking in the carrier recovery process.

<FIG> shows a portion of a frame <NUM> and a corresponding carrier-recovery-status-signal <NUM>. The portion of the frame <NUM> is provided after a start-frame-delimiter (not shown). The portion of the frame <NUM> comprises a plurality of synchronization-symbol-portions <NUM>, <NUM> and a plurality of security-sequence-portions <NUM>, <NUM>, <NUM>. The synchronization-symbol-portions <NUM>, <NUM> may be referred to as resynchronization portions because they are provided within the frame in order to resynchronise the carrier recovery process following a pause due to the provision of a security-sequence-portion <NUM>, <NUM>. The synchronization-symbol-portions <NUM>, <NUM> are therefore interleaved with the security-sequence-portions <NUM>, <NUM>, <NUM>. Respective optional guard-intervals <NUM>-<NUM> are provided between the security-sequence-portions <NUM>, <NUM>, <NUM> and the synchronization-symbol-portions <NUM>, <NUM>.

The specific example of the format of the portion of the frame <NUM> shown in <FIG> comprises, sequentially: a first guard-interval <NUM>, a first security-sequence-portion <NUM>, a second guard-interval <NUM>, a first synchronization-symbol-portions <NUM>, a third guard-interval <NUM>, a second security-sequence-portion <NUM>, a fourth guard-interval <NUM>, a second synchronization-symbol-portion <NUM>, a fifth guard-interval <NUM>, a third security-sequence-portion <NUM> and a sixth guard-interval <NUM>.

The carrier-recovery-status-signal <NUM> is enabled during the synchronization-symbol-portions <NUM>, <NUM> and paused during the security-sequence-portions <NUM>, <NUM>, <NUM>. Reenabling of the carrier-recovery-status-signal <NUM> may occur at the beginning of, during or at the end of an optional guard-interval <NUM>, <NUM> that immediately follows a security-sequence-portion <NUM>, <NUM>. Also, reenabling may occur during a security-sequence-portion if the security-sequence-portion is determined to be known, as described previously with reference to <FIG>. The pausing of the carrier-recovery-status-signal <NUM> may occur at the beginning of, during, or at the end of a guard-interval <NUM>, <NUM> that immediately precedes a security-sequence-portion <NUM>, <NUM>.

<FIG> illustrates a frame <NUM> and a corresponding carrier-recovery-status-signal <NUM>. The frame <NUM> is similar to that described previously with reference to <FIG> except that a synchronization-symbol-portion <NUM> is provided immediately following the security-sequence-portion <NUM>, before a guard-interval <NUM> and a data-payload-portion <NUM>. Corresponding reference numerals are used between <FIG> and <FIG> to describe like features. The carrier-recovery-status-signal <NUM> is reenabled following the security-sequence-portion <NUM> and at the beginning of, or during, the synchronization-symbol-portion <NUM>. The synchronization-symbol-portion <NUM> in this example may also be considered to provide resynchronization for the frame because the synchronization portion <NUM> is provided in the same frame as, but following, the security-sequence-portion <NUM>.

<FIG> illustrates a frame <NUM> and a corresponding carrier-recovery-status-signal <NUM>. The frame <NUM> is similar to that described previously with reference to <FIG> except that a fixed data portion <NUM> is provided following the security-sequence-portion <NUM>. In this example, the fixed data portion <NUM> is provided as part of the data-payload-portion <NUM>. The fixed data portion <NUM> is separated from the security-sequence-portion <NUM> by an optional guard-interval <NUM>. The fixed data portion <NUM> also acts as a resynchronization-symbol-portion and contains a priori known data that can be used by a processing module in a receiver device to resynchronize tracking of the carrier recovery process.

The carrier-recovery-status-signal <NUM> is reenabled at the beginning of, during, or at the end of the guard-interval before the fixed data portion <NUM> so that the carrier recovery process can act on the fixed data portion <NUM>.

In some examples, a quadrature or higher order modulation scheme (such as quadrature phase shift keying) may be used to modulate a pilot signal or the data-payload-portion onto the security-sequence-portion. The pilot signal may be provided by synchronization-symbols, which are a priori known by the receiver.

<FIG> illustrates a constellation diagram for a quadrature modulation scheme. The scheme has a first state <NUM> and an alternative second state <NUM> for representing a pilot signal or payload data provided in a first dimension (quadrature in this example) and a third state <NUM> and an alternative fourth state <NUM> for representing the secure training sequence in an orthogonal, second dimension (in-phase in this example). In this way, the security-sequence-portion and (i) data-payload-portion or (ii) synchronization-symbol-portion of a frame may be received simultaneously. In such examples, the carrier recovery process is not paused as such, but the security-sequence-portion may be excluded from the carrier recovery process while the carrier recovery process is allowed to act on the data-payload-portion or synchronization-symbol-portion by performing the carrier recover process only on the second dimension of the signal.

<FIG> illustrates another frame <NUM> which is similar to that described previously with reference to <FIG> except that the frame <NUM> comprises a plurality of synchronisation-symbol-sub-portions that are interleaved with a plurality of security-sequence-sub-portions in an interleaved security-sequence/synchronisation-symbol portion <NUM>, instead of a security-sequence-portion. The interleaved security-sequence/synchronisation-symbol portion <NUM> contains (re-)synchronisation symbols and security sequence symbols distributed in a predetermined arrangement. In this example, a single synchronisation symbol is provided between each of the security sequence symbols.

The synchronisation-symbols, or pilot symbols, can be separated from the security-sequence-symbols by a processing module of the receiver device if the processing module has access to the predetermined sequence with which the synchronisation symbols are distributed within the interleaved portion <NUM>. The processing module may therefore use this a priori knowledge in order to exclude the security sequence symbols from carrier recovery processing whilst including the synchronisation symbols.

In some examples, the processing module of the receiver may be further configured to modify the bandwidth of the carrier recovery process using, for example, a dynamic-bandwidth-controller tracking loop.

Turning to <FIG>, a tracking loop for carrier phase recovery is illustrated. A signal source <NUM> is fed to an RF mixer <NUM> via a receiver filter <NUM>. A symbol correlator may be provided in the receiver filter <NUM> to de-spread the received symbols.

In the tracking loop, an output of the mixer <NUM> is fed to a decision block <NUM>. The decision block <NUM> may, for example, demodulate/decode a symbol (e.g. decides if a symbol was '<NUM>' or '<NUM>'). For example, for a binary phase shift keyed (BPSK) carrier recovery it is necessary to know if a <NUM>° phase error is present on the carrier or if the modulated symbol shifts the carrier by <NUM>°. If the modulated symbol has rotated the carrier, then the decision block <NUM> may first de-rotate the symbol before feeding it to the error detector.

A phase detector <NUM> receives the output of the mixer <NUM> and the output of the decision block <NUM> as its inputs and provides a phase difference at its output. The output of the phase detector is fed back as a second input to the mixer <NUM> via a loop filter <NUM> and a numerically controller oscillator <NUM>. A dynamic bandwidth controller tracking loop may be implemented by adopting the bandwidth of the loop filter <NUM> during phase tracking.

<FIG> shows a frame <NUM> and carrier recovery status signal <NUM> that are similar to those described previously with reference to <FIG>. In addition, <FIG> shows a plot of a tracking loop bandwidth <NUM> for a dynamic-bandwidth-controlled tracking loop. The tracking loop bandwidth <NUM> is gradually reduced as tracking progresses through the synchronisation-symbol-portion and start frame delimiter at the beginning of the frame in order to reduce a residual error in the carrier recovery process. After tracking has been paused, prior to the beginning of the security-sequence-portion, the bandwidth <NUM> remains constant for the remainder of the processing of the current frame. The bandwidth of the tracking loop <NUM> may be increased subsequent to the processing of the current frame and before carrier recovery processing of a subsequent frame.

<FIG> illustrates a frame <NUM>, carrier recovery status signal <NUM> and an associated profile for the tracking loop bandwidth <NUM> similar to those described previously with reference to <FIG>, except that the tracking loop bandwidth <NUM> is increased during the processing of the frame <NUM>. Specifically, the tracking loop bandwidth <NUM> is increased following the security-sequence-portion, at the beginning of, or in advance of, the payload-data-portion <NUM>. The increase in the tracking loop bandwidth <NUM> coincides with the recommencing of tracking for the carrier recovery status signal <NUM>. Increasing the tracking loop bandwidth <NUM> in this way results in a reduction in the settling time of the tracking loop following resumption of tracking within the current frame. The increase in bandwidth is asymptotic in this example. Following the increase in the tracking loop bandwidth <NUM>, the tracking loop bandwidth <NUM> may be gradually reduced at a similar rate to that seen in the example of <FIG>. In this example, the tracking loop bandwidth <NUM> is reduced to be the same level that it was before the increase in the tracking loop bandwidth <NUM>.

The term processor includes microprocessors, microprocessors, processor modules or subsystems (including one or more microprocessors or microprocessors), or other control or computing devices.

These may include cloud, internet, intranet, mobile, desktop, processor, look-up table, microprocessor, consumer equipment, infrastructure, or other enabling devices and services.

Claim 1:
A processing module for an Impulse-Radio Ultra-WideBand, I-R UWB, receiver device, the processing module configured to:
receive (<NUM>) a signal comprising one or more frames, each frame comprising a synchronization-symbol-portion (<NUM>), a secure-training-sequence-portion (STS), and a data-payload-portion (<NUM>), wherein each data bit is spread over multiple chips and wherein the STS-portion is unknown at the receiver and not spread; and
perform (<NUM>) a carrier recovery process on the signal,
wherein at least part of the secure-training-sequence-portion of each of the one or more frames is excluded from the carrier recovery process by pausing the carrier recovery process for a duration of the at least part of the secure-training-sequence-portion.