Patent Description:
Many user devices should be protected against theft or, more generally speaking, against unauthorized displacement. Such a protection may for example be realized using radio frequency identification (RFID) tags which are attached to user devices, by means of which the movement of the user devices can be tracked. It may be desirable to increase the level of protection against the unauthorized displacement of user devices.

<CIT> describes an emission control scheme intended to limit the localization and identification of a wireless device to known friendly wireless networks. Use of an intelligent access control (IAC) on a wireless device allows the user or administrator control over the revealing of the wireless device to any particular network. Passive scanning allows collection of network information while passive device-based location and on-board databased information on the wireless networks allows localization to thwart network spoofing for unfriendly positioning and identification of the wireless device.

<CIT> describes an apparatus for wireless communications including a super regenerative receiver adapted to receive an incoming signal from a remote apparatus, and a circuit adapted to at least partially determine the distance to the remote apparatus based on the incoming signal. The super regenerative receiver may be configured for relatively high sensitivity to allow the distance measurement circuit to discern the line-of sight (LOS) portion of the incoming signal from the non-LOS portion thereof. Using the time of the LOS portion of the incoming signal, the circuit is able to more accurately determine the distance to the remote apparatus. By sending a signal to the remote apparatus, and receiving a response signal from the remote apparatus, the circuit may determine the distance to the remote apparatus from the respective times of the transmission and reception of the signals.

<CIT> describes that issuing an alert with respect to a first physical area includes determining a location of a mobile user device of a user with respect to the first physical area controlled by a entity, following determining the current location, remotely configuring the mobile user device to detect when the device is within a predefined proximity to one or more second physical areas within the first physical area, and, in response to detecting that the device is within the predefined proximity, issuing the alert to one or more parties.

<CIT> describes a method for collaboratively monitoring by means of Machine Type Communication (MTC) devices in a wireless communication network and related MTC devices and system. Each of the MTC devices is connected to a MTC server via said wireless communication network and includes a transceiver having a unique ID and security code, and said transceiver periodically broadcasts its normal or abnormal status information to other MTC devices within a certain range in the vicinity of that MTC device and detects and identifies other MTC devices within said range.

<CIT> describes methods, systems, and devices for updating access permissions of users in an access control system. The access permissions are capable of being updated based on rules and thresholds that include as at least one variable presence or contextual information associated with a user. The presence or contextual information associated with a user may be analyzed to trigger a credential update process for that user or other users within the access control system.

In accordance with a first aspect of the present disclosure, a system is provided, as defined in claim <NUM>.

In one or more embodiments, the user device comprises the UWB communication unit and the processing unit or the UWB communication unit and the processing unit are attached to the user device.

In one or more embodiments, the UWB communication unit and the processing unit are attached to the user device by a physical bonding.

In one or more embodiments, the processing unit is further configured to disable one or more functions of the user device or one or more applications executed by the user device in response to detecting the unauthorized displacement.

In one or more embodiments, the processing unit is configured to detect the unauthorized displacement by comparing location data output by said localization operation with one or more predefined sets of location data indicative of authorized locations of the user device.

In one or more embodiments, the predefined sets of location data represent areas or zones in a building.

In one or more embodiments, the processing unit is a secure element.

In accordance with a second aspect of the present disclosure, a localization device is provided, as defined in claim <NUM>.

In one or more embodiments, the processing unit is further configured to activate an alarm or transmit a warning signal in response to detecting the unauthorized displacement.

In one or more embodiments, the processing unit is configured to transmit, through the UWB communication channel or through an out-of-band communication channel, an instruction to disable one or more functions or applications of the user device to the external system.

In accordance with a third aspect of the present disclosure, a method is conceived, as defined in claim <NUM>.

In one or more embodiments, the processing unit further disables one or more functions of the user device or one or more applications executed by the user device in response to detecting the unauthorized displacement.

In accordance with a fourth aspect of the present disclosure, a method is conceived, as defined in claim <NUM>.

In one or more embodiments, the processing unit further activates an alarm or transmits a warning signal in response to detecting the unauthorized displacement.

In accordance with a fifth aspect of the present disclosure, a computer program is provided, comprising instructions which, when executed by a system of the kind set forth or by a localization device of the kind set forth, carry out methods of the kind set forth.

As mentioned above, many user devices should be protected against theft or, more generally speaking, against unauthorized displacements. Such a protection may for example be realized using radio frequency identification (RFID) tags which are attached to user devices, by means of which the movement of the user devices can be tracked. It may be desirable to increase the level of protection against unauthorized displacements of user devices.

<FIG> shows an example of an attack scenario <NUM>. In this scenario <NUM>, a user device <NUM> is being protected by a supervisory multi-antenna system <NUM>, by means of which the location of the user device <NUM> can be determined and its movement can be tracked. For this purpose, a localizing device <NUM> is attached to the user device <NUM>. This localizing device <NUM> may for example be an RFID tag. In that case, the supervisory multi-antenna system <NUM> may establish a communication channel with the RFID tag, such that the location of the tag and the attached user device <NUM> can be determined. However, if a signal blocking element <NUM> is placed between the localizing device <NUM> and the multi-antenna system <NUM>, then the latter may not be able to receive the signals of the former, such that the position of the user device cannot be determined. In addition, an attacking device <NUM> might simulate the localizing device <NUM> by sending similar signals. This type of attack is commonly referred to as a replay attack or a relay attack.

In particular, the systems that are typically employed for localizing devices use Phase Difference of Arrival (PDOA), Received Signal Strength Indication (RSSI), Time Difference of Arrival (TDOA) or a Time of Flight (TOF) measurement technique for determining the position of a device within a room. <FIG> shows an example of a laboratory system that may be used for localizing devices. The system includes a supervisory system <NUM> that is tracking the devices inside the room and a user device <NUM> (a laboratory computer referred to as "Device1") that should be tracked. In the given example, the channel between the supervisory system <NUM> and laboratory computer <NUM> is blocked by an attacker. Every time when the supervisory system <NUM> attempts to localize Device1 the attacker receives the signal and forwards it to Device <NUM>. The response of Device1 is again forwarded by the attacker to the supervisory system <NUM>. As a consequence, the system <NUM> concludes that Device <NUM> is present at the position of the attacking device, which may still be an authorized location (i.e., a location at which also Device1 may be legitimately present). Thus, Device1 can be stolen as long the communication is still forwarded by the attacker. Furthermore, if the device that is responsible for the localization or theft prevention (i.e., the so-called localizing device <NUM> shown in <FIG>) is only attached to the user device that needs to be protected, it is even easier to steal the user device because the localizing device can simply be disconnected. As long as the localizing device is powered and running, the supervising system is not able to determine that the attached device has been stolen.

<FIG> shows an illustrative embodiment of a system <NUM> for protecting a user device <NUM>. The system <NUM> comprises the user device <NUM>, an ultra-wideband (UWB) communication unit <NUM> and a processing unit <NUM>. The UWB communication unit <NUM> is configured to set up a UWB communication channel with an external localization device (not shown) and to perform at least one localization operation through said UWB communication channel <NUM>. Furthermore, the processing unit <NUM> is configured to detect an unauthorized displacement of the user device <NUM> by analyzing an output of said localization operation. In this way, the level of protection against the unauthorized displacement of user devices may be increased.

In particular, UWB is a communication technology that uses a high signal bandwidth, in particular for transmitting digital data over a wide spectrum of frequency bands with very low power. For example, UWB technology may use the frequency spectrum of <NUM> to <NUM> and may feature a high-frequency bandwidth of more than <NUM> and very short pulse signals, resulting in high data rates. The UWB technology enables a high data throughput for communication devices and a high precision for the localization of devices. The inventors have recognized that the latter characteristic of UWB may be used to advantage to accurately and reliably detect an unauthorized displacement of user devices. In particular, UWB can be used for distance measurements which are resistant to replay attacks or relay attacks, which in turn increases the level of security.

It is noted that the UWB communication unit <NUM> may be a UWB transceiver that can easily be integrated into a user device or plugged into a power socket, for example. The system <NUM> may offer a secure localization and theft protection by combining it with a UWB-based infrastructure comprising one or multiple anchors. Furthermore, such a system may be used for non-secure localization. Additionally, the system may contain a secure element that can for example disable a device function or application automatically if the device is stolen, which makes the device effectively unusable for the thief.

It is noted that an unauthorized displacement may be regarded as a displacement of a user device which violates a predefined rule, wherein said predefined rule defines at which locations the user device is legitimately present (i.e., at which locations the user device is authorized to be present). Accordingly, an unauthorized displacement means that the user device moves to a location at which it is not legitimately present according to a predefined rule. Furthermore, a localization operation may be regarded as an operation that determines the location of a particular device.

<FIG> shows an illustrative embodiment of a method <NUM> for protecting a user device, corresponding to the system <NUM> shown in <FIG>. The method <NUM> comprises the following steps. At <NUM>, a UWB communication unit of a system that includes a user device sets up a UWB communication channel with an external localization device and performs at least one localization operation through said UWB communication channel. Furthermore, at <NUM>, a processing unit of said system detects an unauthorized displacement of the user device by analyzing an output of said localization operation. In this way, the level of protection against the unauthorized displacement of user devices may be increased.

In one or more embodiments, the user device comprises the UWB communication unit and the processing unit, or the UWB communication unit and the processing unit are attached to the user device. Thus, the UWB communication unit may be integrated into the user device. Since this will make it difficult for an attacker to decouple the UWB communication unit and the processing unit from the user device, the level of protection may be further increased. Alternatively, the UWB communication unit and the processing unit may be attached to the user device. In this way, the user device does not need to be adapted, which results in a backward compatibility with existing user devices and which offers an adequate solution for user devices in which additional components cannot easily be integrated. It is noted that in both cases the UWB communication unit and the processing unit may be combined into a single functional unit or be implemented as separate functional units. Furthermore, in one or more embodiments, the UWB communication unit and the processing unit are attached to the user device by a physical bonding. This may result in a practical implementation, which offers an adequate level of protection in case the UWB communication unit and the processing unit are attached to the user device.

In one or more embodiments, the processing unit is further configured to disable one or more functions of the user device or one or more applications executed by the user device in response to detecting the unauthorized displacement. In this way, the level of protection against the unauthorized displacement of user devices may be further increased. In particular, functions or applications of the user device may automatically be disabled if the processing unit integrated into or attached to the user device has detected an authorized displacement. The user device may then become effectively unusable by a thief, for example. Another advantage of automatically disabling the functions or application is that the user device autonomously detects (i.e., by means of an embedded processing unit or a processing unit attached to it) the authorized displacement and acts upon said detection, without for example requiring an explicit instruction provided by an external localization device.

In a practical implementation, the processing unit is configured to detect the unauthorized displacement by comparing location data output by said localization operation with one or more predefined sets of location data indicative of authorized locations of the user device. For instance, the predefined sets of location data may represent areas or zones in a building. In this way, authorized and unauthorized displacements can easily be tied to zones in which the user device is legitimately present (e.g., a shop floor) and zones in which the user device is illegitimately present (e.g., outside the shop floor if the user device has not been checked out or paid for).

Furthermore, in one or more embodiments, the processing unit is a secure element. It is relatively difficult to gain physical access to such a secure element. Thus, since the operations executed by the secure element cannot easily be manipulated, the level of protection against the unauthorized displacement of user devices may be further increased. It is noted that a secure element may be implemented as an embedded chip. More specifically, the secure element may be implemented as a tamper-resistant integrated circuit with installed or pre-installed applications, for instance payment applications, which have a prescribed functionality and a prescribed level of security. Furthermore, the secure element may implement security functions, such as cryptographic functions and authentication functions.

<FIG> shows an illustrative embodiment of a localization device <NUM>. The localization device <NUM> comprises a UWB communication unit <NUM> configured to set up a UWB communication channel with an external system (not shown) and to perform at least one localization operation through said UWB communication channel. Furthermore, the localization device <NUM> comprises a processing unit <NUM> configured to detect an unauthorized displacement of a user device comprised in said external system by analyzing an output of said localization operation. In this way, the level of protection against the unauthorized displacement of user devices may be increased. In particular, as an alternative of the embodiment shown in <FIG>, or as an addition thereto, an authorized displacement of a user device may be detected at the side of a localization device (for example, a supervisory system similar to the system shown in <FIG>, complemented with UWB technology) instead of at the side of the user device (i.e., at the side of the object that should be localized). Such a supervisory system may for example raise an alarm when an unauthorized displacement has been detected.

<FIG> shows another illustrative embodiment of a method <NUM> for protecting a user device, corresponding to the localization device <NUM> shown in <FIG>. The method <NUM> comprises the following steps. At <NUM>, a UWB communication unit comprised in a localization device sets up a UWB communication channel with an external system and performs at least one localization operation through said UWB communication channel. Furthermore, at <NUM>, a processing unit comprised in the localization device detects an unauthorized displacement of a user device comprised in said external system by analyzing an output of said localization operation. In this way, the level of protection against the unauthorized displacement of user devices may be increased.

In one or more embodiments, the processing unit is further configured to activate an alarm or transmit a warning signal in response to detecting the unauthorized displacement. In this way, surveillance personnel or a surveillance system can effectively act upon an unauthorized displacement of the user device. For instance, the warning signal can be transmitted to the mobile device of a guard or to the aforementioned surveillance system. The surveillance system may then perform any suitable operation, for example automatically alerting the authorities.

Furthermore, in one or more embodiments, the processing unit is configured to transmit, through the UWB communication channel or through an out-of-band communication channel, an instruction to disable one or more functions or applications of the user device to the external system. In this way, if the detection of the unauthorized displacement takes place at the side of the localization device, the user device can still be notified to take appropriate action, in order to render the user device effectively unusable by a thief, for example. It is noted that the out-of-band communication channel may be any suitable communication channel, for example Wi-Fi or Bluetooth. The use of an out-of-band communication channel may decrease the burden on the UWB communication channel.

<FIG> shows an illustrative embodiment of a theft prevention system <NUM>. The system <NUM> comprises a theft protection localization system <NUM> (i.e., an example of a localization device of the kind set forth) and a user device <NUM> that should be protected against theft. The user device <NUM> comprises a UWB controller <NUM> (i.e., an example of a UWB communication unit of the kind set forth), a secure element <NUM> (i.e., an example of a processing unit of the kind set forth), and an application <NUM> that can be executed by the user device <NUM> (e.g., a computer program that can be executed by a host processor included in the user device <NUM>). It is noted that the secure element <NUM> is inherently a protected environment, while the host processor (not shown) may be relatively unprotected.

In particular, the system <NUM> includes central theft protection localization system <NUM> and at least one user device <NUM> (referred to as "Device1") that should be protected. In this embodiment, Device1 <NUM> has an internal UWB controller <NUM> and a secure element <NUM>, in addition to the hardware that is used for executing the device application <NUM>. When Device1 <NUM> is used the internal UWB controller <NUM> may continuously perform ranging operations with the central theft protection localization system <NUM>. For the ranging operations both the UWB controller <NUM> and the heft protection localization system <NUM> may use a secure preamble, which makes it difficult for an attacker to change the estimated position of Device1 <NUM> based on a relay or replay attack. In the system of Device1 <NUM> the secure element <NUM> is also able to communicate with and control the application <NUM> that is executed by the host processor of Device1 <NUM>. If Device1 <NUM> leaves an area where it is not allowed to be used (i.e., if it moves to a location where it is illegitimately present) the secure element <NUM> may disable (e.g., interrupt or suspend) the application <NUM> until Device1 <NUM> enters an area where it is allowed to be used (i.e., if it moves back to a location where it is legitimately present). Furthermore, the central theft protection localization system <NUM> may raise an alarm based on a detected unauthorized displacement, of if the connection to Device1 <NUM> is lost. For example, if an attacker tries to shield the signal transmitted by the UWB controller <NUM> of Device1 <NUM>, multiple messages will be lost and the corresponding ranging operations will fail. The unsuccessful ranging operations may lock the Device1 <NUM> and the security personnel that supervises the theft protection localization system <NUM> may be informed that Device <NUM> has disappeared.

It is noted that if the UWB controller <NUM> and the secure element <NUM> are powered by a battery (not shown), then the localization of Device1 <NUM> will also be possible if no power is received from an external source (e.g., a power socket). Via the UWB controller <NUM> Device1 <NUM> can also report the battery information as well as additional information. Accordingly, the theft protection localization system <NUM> can be warned if Device1 <NUM> has a critical battery status and the battery should be exchanged or recharged before it is empty. Thereby, the level of protection may be further increased. Additional data, such as the maintenance interval of Device1 <NUM>, can be also transmitted via the UWB controller <NUM>. Furthermore, if Device1 <NUM> has not been maintained for a given time duration, an alert can be triggered in the system in order to avoid unmaintained equipment.

<FIG> shows an illustrative embodiment of a UWB extension system <NUM>. The system <NUM> includes a user device <NUM>, again referred to as Device1, and an UWB extension module <NUM>. The UWB extension module <NUM> is attached to Device1 <NUM>, for example by means of a physical bonding of Device1 <NUM>. It is noted that the UWB extension module <NUM> provides Device1 <NUM> with ranging functionality without requiring an adaptation of Device1 <NUM>. Device1 <NUM> is configured to execute at least one application <NUM>, for example by means of a host processor (not shown). Furthermore, Device1 <NUM> contains a power management unit <NUM> which is configured to manage the power available in Device1 <NUM>. The UWB extension module <NUM> contains a UWB controller <NUM> (i.e., an example of a UWB communication unit of the kind set forth), a secure element <NUM> (i.e., an example of a processing unit of the kind set forth), a power management unit <NUM> for managing the power available in the UWB extension module <NUM>, and a battery <NUM>.

In particular, <FIG> shows a user device <NUM> that is extended with a UWB-based theft protection module <NUM>. The application <NUM> executed by Device1 <NUM> is executed independently from the UWB extension module <NUM>, because it was not designed for being tracked and protected. Thus, when the UWB extension module <NUM> has been bonded to Device1 <NUM>, the UWB extension module <NUM> should notify a localization device of the kind set forth that for example the bonding has been broken or removed. Furthermore, the UWB extension module <NUM> should perform ranging operations with the localization device, such that the localization device can trigger an alert to a supervisor if an unauthorized displacement of Device1 <NUM> is detected. Similarly, the localization device can trigger an alert when the connection to the UWB extension module <NUM> has been lost. Accordingly, Device1 <NUM> cannot be stolen without notifying the supervising localization device, as long as the UWB extension module <NUM> is still powered.

It is noted that the UWB extension module <NUM> may use the same power supply as Device1 <NUM>, i.e. it may be powered by the same power socket that would be used for Device1 <NUM>. In that case, the UWB extension module <NUM> may offer an additional power socket, into which the bonded device (i.e., Device1 <NUM>) can be plugged. Since the UWB extension module <NUM> has its own battery <NUM> and power management unit <NUM>, the UWB extension module <NUM> is also usable if it is not plugged into a power socket. Thus, the UWB extension module <NUM> also offers anti-theft protection if Device1 <NUM> is not powered. Furthermore, By transmitting a battery status through the UWB communication channel, the localization device can be warned when the battery <NUM> is almost empty. Accordingly, the battery <NUM> can be recharged, for example by plugging the UWB extension module <NUM> into a power socket, or the battery <NUM> can be replaced by another battery. It is noted that the security level of an UWB extension module of the kind set forth may depend on two layers, i.e. the UWB layer that provides a relay attack-resistant localization function and a physical bonding that ensures that the UWB extension module remains attached to the user device that should be protected.

<FIG> shows an illustrative embodiment of a building ground floor <NUM>. The floor <NUM> contains a plurality of zones, i.e. a first zone <NUM>, a second zone <NUM>, and a third zone <NUM>. In the given example, a first user device D1 is legitimately present in the second zone <NUM>, a second user device D2 is illegitimately present in the third zone <NUM> (i.e., as a result of an unauthorized displacement), and a third device D3 is legitimately present in the first zone <NUM>. A localization device of the kind set forth (not shown) tracks the position and movement of the devices D1, D2 and D3 on the building ground floor <NUM>. Since devices D1 and D3 are legitimately present in zones <NUM> and <NUM>, no alert is triggered by the movement of these devices, as long as they remain in these zones or move into another zone in which they are legitimately present. However, since device D2 is in zone <NUM> as a result of an unauthorized displacement, an alert is triggered and/or one or more functions or applications of device D2 are disabled automatically. More specifically, a processing unit of device D2 may disable said functions or application in response to detecting the unauthorized displacement, and/or a processing unit of the localization device may trigger the alert in response to detecting the unauthorized displacement. If only an UWB extension module is used, then only an alert may be raised to the localization device. The localization device can then decide whether for example a security alert notification should be triggered. It is noted that for a non-secure device tracking, no secure element is needed. Furthermore, the device bonding may be less relevant for non-secure applications. However, it is noted that an internal UWB communication unit (i.e., a UWB communication unit embedded in a user device) facilitates the autonomous disabling of functions and/or applications by the user device. Such an internal UWB communication unit may also prevent said unit from being decoupled or removed from the user device and its applications. Furthermore, it is noted that for each user device different areas may be defined in which the respective devices are legitimately and illegitimately present. This may for example be used to prevent that devices belonging to different rooms (e.g., offices) are mixed without raising a warning to a supervising system.

The systems and methods described herein may at least partially be embodied by a computer program or a plurality of computer programs, which may exist in a variety of forms both active and inactive in a single computer system or across multiple computer systems. For example, they may exist as software program(s) comprised of program instructions in source code, object code, executable code or other formats for performing some of the steps. Any of the above may be embodied on a computer-readable medium, which may include storage devices and signals, in compressed or uncompressed form.

Claim 1:
A system (<NUM>), comprising:
a user device (<NUM>) to be monitored for unauthorized displacement, wherein said unauthorized displacement is a movement of the user device (<NUM>) to a location at which the user device (<NUM>) is not authorized to be present according to a predefined rule;
an ultra-wideband, UWB, communication unit (<NUM>) configured to set up a UWB communication channel with an external localization device and to perform at least one localization operation through said UWB communication channel;
a processing unit (<NUM>) configured to detect said unauthorized displacement of the user device (<NUM>) by analyzing an output of said localization operation.