Cypress Semiconductor Corporation

Claudio Rey

Kiran Uln

Igor Kolych

Pouria Zand

Nozhan Hosseini

Kambiz Shoarinejad

A wireless device includes a transmitter adapted with Bluetooth® low energy (BLE) capability and logic at least one of coupled to or integrated within the transmitter. The logic randomly generates a frequency offset based on bits within a frame synch packet to be transmitted during a keyless access attempt of an enclosure having a receiver. The logic causes the bits of the frame synch packet to be encrypted with an encryption key. The logic causes a frequency of the frame synch packet to modified by the frequency offset before the transmitter transmits the frame synch packet to the receiver.

Security signature for Bluetooth low energy frame synch detection

A device includes a transmitter to generate a sampled stream of data for a packet at a first sample rate. A data re-sampling circuit includes a re-timer engine to determine, using a fractional rate between the first sample rate and a crystal oscillator (XO)-divided sample rate, re-timer values including a difference between pulses of a pseudo-clock corresponding to the XO-integer-divided sample rate and closest corresponding pulses of a clock corresponding to the first sample rate, and a time-shifting circuit to re-sample data values of the sampled stream of data associated with locations of the plurality of re-timer values. A comparator circuit uses the re-sampled data values to match the re-sampled data values to a corresponding data value detected in the data pattern in the frame delimiter. A timing logic uses the plurality of re-timer values and the location of the marker in the data pattern in a timing calculation.

Estimating time of departure for round trip time with rate adaptation

A wireless device includes a receiver adapted with Bluetooth® low energy (BLE) capability and logic at least one of coupled to or integrated within the receiver. The logic determines frequency samples of bits of a predetermined pattern of a packet during a round-trip timing estimation of the packet, wherein the packet is received during a keyless access attempt of an enclosure having a transmitter and the receiver. The logic compares, to a reference frequency sample, the frequency samples of bits of the predetermined pattern. In response to determining a difference between the reference frequency sample and the frequency samples of bits of the predetermined pattern, the logic detects an intrusion associated with the predetermined pattern.

Attack detection in round-trip timing estimation

Techniques are disclosed to leverage co-located radios such as BLE and Wi-Fi radios to increase the security of BLE ranging and localization. In one aspect, a transmitting BLE device may use a co-located Wi-Fi radio to transmit signals to interfere with an intruding device's interception of BLE RTT packets. The obfuscating Wi-Fi transmission may overlap a BLE RTT packet in the time domain with or without overlapping in the frequency domain. In one aspect, the co-located Wi-Fi radio may transmit pre-determined signature Wi-Fi signals concurrently with the BLE RTT packets to a receiver with co-located BLE and Wi-Fi radios. The receiver may detect a change in the pre-determined relationship between the two types of communication to reveal an intrusion attempt. In one aspect, a co-located Wi-Fi radio may capture parts of BLE RTT packets concurrently with a BLE radio transmitting or receiving BLE RTT packets to detect an intrusion attempt.

Additional security ranging for BLE using co-located Wi-Fi devices

Techniques are described to improve the security of frame synchronization detection between wireless devices in high accuracy positioning (HAP) applications using personal area networks (PANs). A receiver may detect whether a frame synchronization pattern has been manipulated by comparing the sampled data of the received frame synchronization pattern with a reference waveform predicted as the frame synchronization pattern. The receiver may reuse the data in the correlation buffer at the moment a correlator finds a peak and declares that the synchronization pattern is found. The correlator may also provide fractional timing information associated with the correlation peak for the receiver to create a delayed reference phase differential pattern. The receiver may subtract the data in the correlation buffer by the delayed reference differential data and look for absolute deviations in the output of such subtraction that exceed a predetermined threshold. Specific patterns or signatures of error may also be analyzed.

Frame synch detection with intrusion detection

A wireless device includes a receiver to receive a packet via one or more antennas. A frame synchronization detection circuit coupled to the receiver identifies a frame synchronization pattern within a portion of the packet. A correlation circuit coupled to the frame synchronization detection circuit computes one or more values of a correlation peak using a correlation method. A fractional timing approximation circuit coupled to the correlation circuit determines a pulse shape using the one or more values of the correlation peak; and determines a fractional timing approximation for the packet using the pulse shape.

Frame synchronization detection with fractional approximation

Techniques described here introduce signature frequency modulation to unmodulated pulse signals as frequency chirps to enhance the security of multi-carrier phase-based ranging signals. The characteristics of the chirps may be mutually known by an initiator and a desired reflector of the ranging applications. The characteristics of the chirps may vary between the multi-carrier signals to thwart any attempt by an eavesdropper to predict the chirps. In one aspect, the characteristics of the chirps may be calculated for each timeslot of a ranging cycle by two authorized devices using a ciphering algorithm such as the Advanced Encryption Standard (AES) based on a shared security key. Each call of the AES may generate one or more pseudo-random numbers based on the shared security key and a time-varying initialization vector that increments every timeslot. Fields of the pseudo-random number may be extracted to determine the characteristics of the chirps associated with the timeslot.

Security enhancement for multi-user ranging systems using signature orthogonal chirps

A method can include receiving a plurality of digital data symbols; encoding each data symbol into frequency domain values, the frequency domain values for each data symbol transmitted over a different frequency range; combining samples of multiple frequency domain values into a sequence of initial output values in time; generating a sequence of modification values that form a modification pulse, the modification pulse having a non-linear slope that decreases as it approaches a modification pulse maximum and increases as it departs from the modification pulse maximum; decreasing the initial output values according to the modification values to generate modified output values; and transmitting a wireless signal compatible with at least one IEEE wireless standard according to the modified output values. Corresponding devices and systems are also disclosed.

Methods, devices and systems for modifying a power profile of a frequency division multiplexed signals

A device includes a receiver to receive a packet over a channel at a first frequency and generate a sampled stream of data at a first sample rate corresponding to the first frequency. A data resampler circuit includes a re-timer engine to determine, using a fractional rate between the first sample rate and a crystal oscillator (XO)-divided sample rate, re-timer values including a difference between pulses of a pseudo clock corresponding to the XO-integer-divided sample rate and closest corresponding pulses of a clock corresponding to the first sample rate. The data resampler circuit includes a time shifting circuit to re-sample data values of the sampled stream of data associated with locations of the plurality of re-timer values. A correlation circuit uses the re-sampled data values, pseudo clock, and the re-timer values to match an expected data pattern to a corresponding data pattern detected in a frame delimiter of the packet.

Frame synch detection with rate adaptation

A wireless device includes a receiver to receive a packet via one or more antennas. A frame synchronization detection circuit coupled to the receiver identifies a frame synchronization pattern within a portion of the packet. A correlation circuit coupled to the frame synchronization detection circuit computes, in response to the identifying of the frame synchronization pattern within the portion of the packet, a frequency offset using a correlation method. A frequency estimation correction circuit coupled to the correlation circuit determines, based on the frame synchronization pattern, a bias value, wherein the bias value corresponds to a data pattern within the frame synchronization pattern indicative of a frequency bias, and applies a correction to the frequency offset, wherein applying the correction to the frequency offset comprises modifying the frequency offset using the bias value.

Growing community of inventors

Chandler, AZ, United States of America

Claudio Rey