A high-accuracy phase-based ranging solution with Bluetooth Low Energy (BLE)

Zand, Pouria; Romme, Jac; Govers, Jochem; Pasveer, Frank; Dolmans, Guido

doi:10.1109/wcnc.2019.8885791

Cited by 54 publications

(35 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It uses the similarity of the fingerprint to judge whether the devices are co-located within a boundary. Distance bounding [22] or phase-based ranging [7], [23] techniques can also be used to defeat distance reduction attacks. Although these techniques are effective, they are not applicable to COTS devices lacking additional hardware for authentication.…”

Section: Related Workmentioning

confidence: 99%

“…In these attacks, the attacker may amplify transmit/received signals to satisfy the required RSS for decoding at both the attacker and the AP, and pretend as if it were within the authentication range. Ideally, phase-based ranging [7] can defeat those attacks by providing accurate distance estimation, but it requires a customized protocol and a specialized signal that are often hard to implement in commercial off-the-shelf (COTS) devices.…”

mentioning

confidence: 99%

See 1 more Smart Citation

FMS-AMS: Secure proximity-based authentication for wireless access in Internet of Things

et al. 2020

View full text Add to dashboard Cite

Proximity-based authentication enables wireless access points (AP) to allow connection only to devices within a certain authentication range. This would be very convenient for allowing network access only to those within a physical boundary. However, an attacker not within the authentication range may deceive the AP into authenticating its proximity by eavesdropping with higher receiver gain and increasing its transmit power. This can be done easily using an amplifier or a directional antenna. To address this challenge, we propose 'Fixed MCS SNR (FMS)' filtering scheme based on the intuition that high MCS requires high SNR, and amplifying the received signal strength does not necessarily improve SNR. We experimentally show that this is true in reality, and our real-world evaluation in various environments (14 locations) shows that FMS scheme prevents 'amplifier attacks' in all cases. To further counter the false positives of FMS against 'directional antenna attacks' (avg. 35.7%), we also propose 'Authentication Motion with Signal strength gap (AMS)' filtering scheme which defends against both attacks in all cases at the cost of requiring the user to make a simple motion. FMS or AMS scheme can be selected according to the application requirement to enhance the security of proximity-based authentication in upcoming IoT.

show abstract

Section: Related Workmentioning

confidence: 99%

mentioning

confidence: 99%

FMS-AMS: Secure proximity-based authentication for wireless access in Internet of Things

et al. 2020

View full text Add to dashboard Cite

show abstract

“…As per its latest v5.3 specification [11], the only way to infer the distance between two Bluetooth devices is based on signal strength which is known to be notoriously inaccurate [24]. Therefore, vendors increasingly implement Multi-Carrier Phased-Based Ranging (MCPR) aside of Bluetooth [1,2,10,19,30,49,57], recently even within integrated circuits geared towards MCPR [6,29,50]. Since MCPR in the past has been marketed as High Accuracy Distance Measurement (HADM) [10,12,21], it is also interesting to note that the Bluetooth SIG lists a specification under development bearing this very name [13].…”

Section: Introductionmentioning

confidence: 99%

“…RF Proximity Verification. Wireless communication systems can be used for localization and ranging [7,14,57]. Leveraging physicallayer observations such as ToF, Received Signal Strength (RSS), or carrier phase, devices infer distances to others.…”

Section: Introductionmentioning

confidence: 99%

Analog Physical-Layer Relay Attacks with Application to Bluetooth and Phase-Based Ranging

Staat¹,

Jansen²,

Zenger³

et al. 2022

Preprint

View full text Add to dashboard Cite

Today, we use smartphones as multi-purpose devices that communicate with their environment to implement context-aware services, including asset tracking, indoor localization, contact tracing, or access control. As a de-facto standard, Bluetooth is available in virtually every smartphone to provide short-range wireless communication. Importantly, many Bluetooth-driven applications such as Phone as a Key (PaaK) for vehicles and buildings require proximity of legitimate devices, which must be protected against unauthorized access. In earlier access control systems, attackers were able to violate proximity-verification through relay station attacks. However, the vulnerability of Bluetooth against such attacks was yet unclear as existing relay attack strategies are not applicable or can be defeated through wireless distance measurement.In this paper, we design and implement an analog physical-layer relay attack based on low-cost off-the-shelf radio hardware to simultaneously increase the wireless communication range and manipulate distance measurements. Using our setup, we successfully demonstrate relay attacks against Bluetooth-based access control of a car and a smart lock. Further, we show that our attack can arbitrarily manipulate Multi-Carrier Phase-based Ranging (MCPR) while relaying signals over 90 m.

show abstract

“…With the newly proposed ''phase-based ranging'' extension [33], accurate delay and angle estimation also becomes applicable to Bluetooth Low Energy signals. However, it remains to be investigated if a multipath-based positioning system can be realized with this technology.…”

Section: Introduction a Motivation And State Of The Artmentioning

confidence: 99%

Single-Anchor Positioning: Multipath Processing With Non-Coherent Directional Measurements

et al. 2020

View full text Add to dashboard Cite

High-accuracy indoor radio positioning can be achieved by using (ultra) wideband (UWB) radio signals. Multiple fixed anchor nodes are needed to compute the position or alternatively, specular multipath components (SMCs) extracted from radio signals can be exploited. In this work, we study a multipath-based, single-anchor positioning system that acquires directional measurements non-coherently. These non-coherent measurements can be obtained, e.g., from a single-chain mm-wave transceiver with analog beam steering or from a low-complexity ultra-wideband transceiver with switched directional antennas. The directional antennas support the separation of SMCs and the suppression of the undesired diffuse multipath component (DMC) with the benefit that the required signal bandwidth can be drastically reduced. The paper analyzes the Cramér-Rao lower bound (CRLB) on the position estimation error to gain insight in the influence of the system design parameters as well as the impact of the DMC on the position error. The CRLB is compared between the non-coherent antenna setup, a conventional array with coherent processing, and a single-antenna setup. A maximum-likelihood position estimation algorithm is formulated. Its performance is evaluated with synthetically generated data as well as with UWB measurements. We show that the accuracy and robustness are significantly improved due to the processing of angular information. Analyzing the measured data for a line-of-sight link, the median error decreases from 22 down to 7 cm, the measurements better than 20 cm increase from 46 to 95 %, and outliers above 50 cm reduce from 12 to 0 %. INDEX TERMS Radio positioning, single-anchor, Fisher information, position error bound, directional antenna, multipath component, non-coherent array processing.

show abstract

A high-accuracy phase-based ranging solution with Bluetooth Low Energy (BLE)

Cited by 54 publications

References 11 publications

FMS-AMS: Secure proximity-based authentication for wireless access in Internet of Things

FMS-AMS: Secure proximity-based authentication for wireless access in Internet of Things

Analog Physical-Layer Relay Attacks with Application to Bluetooth and Phase-Based Ranging

Single-Anchor Positioning: Multipath Processing With Non-Coherent Directional Measurements

Contact Info

Product

Resources

About