Patent Description:
Radio Frequency (RF) ranging determines a distance between a transceiver, (or a collocated transceiver and receiver), and a second object by measuring a Time-of-Flight (ToF) of an RF transmission between the transceiver and the object. This ToF measurement is then multiplied by the speed of light to determine the distance (or "range"). An erroneous ToF measurement can result from the transceiver receiving a multipath transmission caused by reflections of the RF transmission from other objects or surfaces, rather than a line-of-sight transmission. Accordingly, proper ranging requires the line-of-sight path or "first path" to be determined.

In an unsecured system, an adversary can mimic characteristics of the RF transmission to provide a shorter first path, thereby validating an illegitimate transmitter used for gaining access to the system. In systems employing pseudo random sequences in the RF transmission, an adversary can guess the sequence. The success of an adversary's guess depends in part on the length of the pseudo random sequence, as well as the sensitivity of the RF receiver. Degrading the sensitivity of the RF receiver to require a stronger correlation between the received sequence and the expected sequence undesirably reduces the link budget of the system.

<CIT> discloses a processing module and associated method, in which a channel estimate generation component is arranged to output channel estimate information for a received signal, and a timestamping module arranged to determine a ToA measurement for a marker within a packet of the received signal based at least partly on the channel estimate information for the received signal generated by the channel estimate generation component.

<CIT> discloses a receiver for use in an ultra-wideband communication system, in which a received UWB signal is periodically digitized as a series of ternary samples. Statistics relating to coefficients of a CIR as well as a noise region preceding a leading edge of the CIR are used to calculate a threshold.

<CIT> discloses a secure channel estimation architecture, in which wireless communication between two electronic devices is used to determine a distance between the two devices in the presence of an otherwise-disrupting attacker by correlating wireless signals with a known preamble sequence and performing channel estimation using the result.

In accordance with the invention there is provided an apparatus and a method as defined by the appended claims.

Embodiments described herein provide for an RF receiver having both high sensitivity and high security against distance decreasing attacks, by assessing the noise characteristics in a CIR. Referring to <FIG>, in an embodiment <NUM>, a secure ranging system based on ToF employs a pseudo random sequence of pilot symbols, also referred to as a Secure Training Sequence (STS), to obtain the CIR. A first transceiver <NUM> receives an STS from a second transceiver <NUM>. In the embodiment <NUM>, the second transceiver <NUM> actively retransmits an RF signal received by the first transceiver <NUM>. In another embodiment, the second transceiver <NUM> is replaced with a passive target, which reflects an RF signal previously transmitted by the first transceiver <NUM>. As shown in <FIG>, the second transceiver <NUM> transmits first path <NUM>, which is a line-of-sight path between the second transceiver <NUM> and the first transceiver <NUM>. An indirect path is formed by a path <NUM>, reflected off a surface <NUM>, and continuing as a path <NUM> towards the first transceiver <NUM>. In the embodiment <NUM>, the signal received by the indirect path is inherently weaker than the signal from the direct path <NUM>, due to the increased distance resulting in additional propagation path loss. In the embodiment <NUM>, the indirect path is further attenuated by a body <NUM>, or any intervening object causing absorption, reflection, diffraction or scattering of the RF signal.

<FIG> shows an alternate example embodiment <NUM> wherein the body <NUM> attenuates the direct path <NUM>. In the embodiment <NUM>, the direct path <NUM> is attenuated by the body <NUM> by an amount exceeding the propagation path loss and/or multipath fading of the indirect path formed by paths <NUM> and <NUM>. Accordingly, the direct path <NUM> cannot be determined by signal strength received at the first transceiver <NUM>. Instead, the direct path <NUM> is determined by a first sample in the CIR that exceeds a detection threshold. <FIG> shows a CIR of the embodiment <NUM> plotted as function of time, where each channel tap corresponds to a time slot. In <FIG>, the weak direct path <NUM> has a CIR value <NUM> occurring earlier than indirect path having a CIR value <NUM>, hence the direct path is determined. In <FIG>, the CIR values <NUM> and <NUM> both exceed the receiver detection threshold <NUM>.

The ranging application is secure, when only the genuine transmitter and the genuine receiver have knowledge of the pseudo random sequence, or expected STS, used to correlate with the transmission by the second transceiver <NUM>. In a distance decreasing attack, an adversary shortens the perceived distance between the first transceiver <NUM> and the second transceiver <NUM>, by observing the communication from the second transceiver <NUM> and guessing the expected STS. The adversary then transmits a guessed STS earlier than the genuine transmitter's STS (e.g., the second transceiver <NUM>), to generate a fake first path received by the first transceiver <NUM>.

The probability of success for the adversary depends on the length of the expected STS and the sensitivity of the first path detector in the genuine receiver (e.g., the first transceiver <NUM>). A short STS increases the probability of the adversary guessing a sufficient portion of the STS symbol sequence, such that the correlation of the guessed STS with the pilot symbols transmitted by the second transceiver <NUM>, exceeds a detection threshold <NUM> of the receiving portion of the first transceiver <NUM>.

A detection threshold <NUM> optimized for high sensitivity (e.g., a low threshold), increases the probability of an attack from an adversary. A low detection threshold <NUM> increases the link budget between the first transceiver <NUM> and the second transceiver <NUM> by allowing detection of weaker signals from the second transceiver <NUM>. In one example, the signals are weakened by increasing the distance of the transmission paths, using a weaker transmitter, permitting more attenuation from intervening objects and the like. Increasing the link budget is generally desirable from a system perspective, however, lowering the detection threshold <NUM> also permits weakly correlated values of the guessed STS to be accepted by the receiving portion of the first transceiver <NUM>, thus reducing security. In previous ranging systems, a compromise between security and link budget was required. The embodiments described herein, provide for both high security and a high link budget by assessing the properties of the noise of the CIR to detect a distance decreasing attack, rather than constraining the receiver's detection threshold <NUM>. Upon detection of an attack, the time of arrival for a corresponding channel tap is either discarded, or a higher protocol layer of the communication system is notified (e.g., by a signal flag).

<FIG> shows an example embodiment <NUM> of a channel estimator. The embodiment <NUM> receives a digitized RF signal <NUM> (e.g. a digitized signal received from the second transceiver <NUM> of <FIG>). The digitized RF signal <NUM> includes a plurality of symbols beginning with the received STS. The received STS is correlated with an expected STS <NUM> by a correlator <NUM>. The correlator <NUM> generates a correlation signal <NUM>. The correlation signal <NUM> is sampled for a plurality of sequential channel taps corresponding to a respective symbol clock phase 50a, 50b through 50c (generally <NUM>). Each symbol clock phase <NUM> controls a respective sampler 52a, 52b through 52c (generally <NUM>).

Each symbol correlation value, sampled by a respective sampler <NUM>, is summated by a respective summator 54a, 54b through 54c (generally <NUM>) with a respective accumulated symbol correlation value 56a, 56b through 56c (generally <NUM>). Each accumulated symbol correlation value <NUM> is stored in a storage circuit <NUM> (e.g., a register) by a respective accumulator 60a, 60b through 60c (generally <NUM>). The plurality of accumulator symbol correlation values <NUM> are stored in a storage circuit <NUM> over a path <NUM>. Each of the estimated CIR values <NUM> is stored in a respective addressable location 70a, 70b, 70c, 70d through 70e, <NUM> and <NUM> (generally <NUM>) of the storage circuit <NUM>. <FIG> shows a graphical view of a CIR for a plurality of channel taps determined by the embodiment <NUM> of <FIG>. The CIR is a complex signal including a real part <NUM> and an imaginary part <NUM>, or in-phase ("I") and quadrature phase (Q) respectively.

Referring to <FIG>, an example embodiment <NUM> of a system for first path acceptance for secure ranging comprises a channel estimator <NUM> (e.g., the channel estimator <NUM> of <FIG>), an attack detector <NUM>, which further comprises a noise estimator <NUM> and a noise analyzer <NUM>. The embodiment <NUM> further comprises a first path detector <NUM>. The channel estimator <NUM> generates a plurality of estimated CIR values from a digitized RF signal. Each accumulated symbol correlation value corresponds to a channel tap, which is temporally defined by a symbol clock phase. The various arrival times of one or more paths of an RF transmission will generally fall within a respective channel tap. The noise estimator <NUM> determines a statistical characteristic from an estimated CIR over a certain interval. In one embodiment, the temporal range of channel taps for noise estimation is chosen to be outside the range wherein the direct path is expected to arrive.

The noise analyzer <NUM> analyzes a statistical characteristic based on qualitative statistical parameters from the noise estimate to determine if a distance decreasing attack has occurred The statistical characteristic is a probability distribution type (e.g., a Gaussian, Binomial, Chi-Squared or Rayleigh distribution), of the estimated CIR values within a temporal range of the channel taps. Under normal conditions, where an attack is not present, the noise typically has a Gaussian distribution. If another type of distribution is detected, the noise analyzer <NUM> will indicate that a distance decreasing attack has occurred, and either the ranging sequence terminates, no ranging estimate is generated, or a higher level protocol is notified.

When the noise analyzer determines that no distance decreasing attack has occurred, the first path detector <NUM> estimates the time of arrival for the direct path corresponding to the earliest channel tap having an estimated CIR value with sufficient correlation to the expected STS to meet or exceed the detection threshold <NUM>. The time of arrival of the direct (e.g., "first") path is converted to a distance by multiplying by the speed of light in the communication medium.

<FIG> with continued reference to <FIG>, shows an absolute CIR for the embodiment <NUM> of <FIG>, for a sequential range of channel tap values. In <FIG>, the noise estimator <NUM> analyzes estimated CIR values within a temporal range <NUM> of the channel taps. In one embodiment, the temporal range <NUM> includes channel taps that are each earlier than the expected channel tap of the direct path. In <FIG>, a faked first path <NUM> generates a random response CIR <NUM> with a certain statistical characteristic, within the temporal range <NUM> of channel taps, significantly altered from the genuine first path <NUM>. The genuine first path <NUM> has a random response CIR <NUM> with a statistical characteristic of a random variable with a Gaussian distribution. The noise analyzer <NUM> of <FIG> detects the difference in the statistical characteristics of the random response CIR <NUM> and <NUM> to determine that a distance decreasing attack has occurred.

<FIG> with reference to <FIG>, shows a method <NUM> for first path acceptance for secure ranging. At <NUM>, a CIR is determined by estimated CIR values <NUM> (e.g., by a channel estimator <NUM>). At <NUM>, a statistical characteristic is extracted from the estimated CIR values <NUM> (e.g., by a noise estimator <NUM>). At <NUM>, the statistical characteristic is compared to a reference value to detect a distance decreasing attack (e.g., by a noise analyzer <NUM>).

Alternative embodiments of the system include one of the following features, or any combination thereof. A range detector circuit is configured to determine a distance based on a time of arrival of the first path. The system discards a time of arrival corresponding to a channel tap comprising the distance decreasing attack.

Claim 1:
An apparatus (<NUM>) for a first path acceptance for secure ranging comprising a channel estimator circuit (<NUM>, <NUM>), an attack detector circuit (<NUM>) and a first path detector circuit (<NUM>),
the channel estimator circuit (<NUM>, <NUM>) comprising:
a symbol correlator circuit (<NUM>) configured to generate a plurality of symbol correlation values of a sequence of pilot symbols, the pilot symbols received by the apparatus and correlated to a predefined sequence of secure symbols;
a plurality of accumulator circuits (60a-c), configured to summate the plurality of symbol correlation values for a respective channel tap to generate a respective estimated Channel Impulse Response, CIR, value, each channel tap corresponding to a phase of a symbol; and
a memory circuit (<NUM>) configured to store the estimated CIR values for each channel tap,
the attack detector circuit (<NUM>) configured to extract a statistical characteristic from the plurality of estimated CIR values within a temporal range of the channel taps chosen to be outside a range wherein a direct path is expected to arrive, and to compare the statistical characteristic to a reference value to detect a distance decreasing attack,
the first path detector circuit (<NUM>) configured to determine a first path of the estimated CIR values when the attack detector circuit determined that no distance decreasing attack has occurred, wherein the first path corresponds to an earliest channel tap comprising a respective estimated CIR value with correlation to an expected secure training sequence, STS, exceeding a detection threshold,
wherein the statistical characteristic is a probability distribution of the estimated CIR values within the temporal range of the channel taps, wherein the attack detector circuit (<NUM>) is configured to indicate that a distance decreasing attack has occurred if another type of probability distribution than the reference value is detected.