DE102017203914A1 - Security improvements in a wireless data exchange protocol - Google Patents

Abstract

A security solution for Bluetooth Low Energy (BLE) or equivalent wireless data exchange protocols, comprising authentication of a peripheral device by a central device using the advertisement channel, is presented. A method for authenticating a peripheral device in a wireless data exchange has a peripheral device sending an advertisement channel protocol data unit (announcement channel PDU), a central device receiving the announcement channel PDU, the central device sending a sample request sample PDU to the peripheral device. The advantage of this method using the discovery protocol enables a software-based solution for the monitoring device and a software-based hardware-based solution in the beacon device.

Description

Technical area

The present disclosure relates to security enhancements in a wireless communication protocol, and more particularly to the authentication of transmitter devices. The present disclosure also relates to proximity or location detection in a wireless communication protocol.

In this description, the terms "transmitter device" and "observer device" are used, as these are the terms used within the Bluetooth Low Energy (BLE) standard. They are not intended to confer any specific meaning. It could z. For example, the terms "peripheral device" and "central device" may be used.

background

A popular protocol for wireless data exchange is known as Bluetooth. In particular, the Bluetooth Low Energy (BLE) standard, also referred to as Bluetooth Smart, provides a specification for the wireless exchange of data between fixed and / or mobile devices. Its operation is defined by various standards and specifications managed by the Bluetooth Special Interest Group.

However, existing security solutions for BLE and other wireless protocols rely on devices that are interconnected. There are no opportunities for disconnected devices to attack, such as B. re-entry, forwarding or middle man attacks to avoid.

BLE is for low-power devices, such. As labels, beacons, watches, portable devices, sensors and the like. Typically, these devices operate using a low-power battery, such as a battery. A button cell battery to wirelessly connect to mobile phones, tablets, laptops, TVs, and the like that have connectivity to the Internet.

There is an increasing need for an accurate indoor positioning system (IPS), such as: For localization and / or retail purposes, because GPS technology does not work well indoors. However, all current indoor use techniques have their own limitations. Many low-power BLE devices support an approximation that measures the distance between devices. The approximation feature defined by the BLE specification uses the received signal strength (RSSI) indication to calculate the distance. Using a single beacon, for. For example, the proximity to a nearby device can be determined; using multiple beacons and trilateration, a location for a nearby device can be determined. However, it is known that this method is relatively inaccurate and slow and has a high power consumption.

Summary

According to a first aspect of the disclosure, there is provided a method of authenticating a transmitter device in a wireless communication protocol, wherein: the transmitter device transmits an announcement channel protocol data unit (announcement channel PDU) comprising a first nonce; an observer device receives the announcement channel PDU and the first nonce and transmits a sample request sample PDU to the transmitter device, the sample request sample PDU comprising a second nonce; the transmitter device performs an encryption function using the first and second nonce to obtain a first result, and sends a sample response sample PDU back to the observer device, the sample response sample PDU comprising the first result; the observer device performs an encryption function on the first and second nonce to obtain a second result, and authenticates the transmitter device if at least the first and second results match.

Optionally, the first and second nonce comprise random numbers.

Optionally, both the observer device and the transmitter device are provided with at least one key for performing the encryption functions.

Optionally, both the observer device and the transmitter device are provided with at least two keys for performing the encryption function.

Optionally, at least one key is a private user key.

Optionally, the key is a 64-bit random number.

Optionally, the wireless data exchange protocol is a Bluetooth low energy protocol.

Optionally, the first nonce comprises a 64-bit, 128-bit, or 256-bit random number, and the second nonce comprises a 48-bit random number.

Optionally, the announcement channel PDU comprises a connectable undirected announcement event PDU or a scannable undirected announcement event PDU.

Optionally, the announcement channel PDU comprises an encrypted form of at least the first nonce.

Optionally, the announcement channel PDU comprises an encrypted form of combination or concatenation of the first nonce and at least one key.

Optionally, the observer device encrypts the at least one nonce to obtain a third result, comparing the third result with the encrypted form received from the advertisement channel PDU.

Optionally, the observer device encrypts a combination or concatenation of the first nonce and at least one key to obtain a third result, comparing the third result with the encrypted form received from the advertisement channel PDU.

Optionally, the observer device only sends the sample request sample PDU to the transmitter device if the third result matches the encrypted form.

Optionally, the scan request sample PDU comprises an encrypted form of the second nonce.

Optionally, the scan request sample PDU comprises an encrypted form of combination or concatenation of the first nonce and at least one key.

Optionally, the transmitter device at least encrypts the second nonce to obtain a fourth result, comparing the fourth result with the encrypted form received from the scan request sample PDU.

Optionally, the transmitter device encrypts a combination or concatenation of the second nonce and at least one key to obtain a fourth result, comparing the fourth result with the encrypted form received from the scan request sample PDU.

Optionally, the transmitter device sends the sample response sample PDU only to the observer device if the fourth result matches the encoded form.

Optionally, a first time interval, which is the time between the sample request sample PDU and the sample response sample PDU, is 150 μs.

Optionally, the observer device authenticates the transmitter device if the time between the sample request sample PDU and the sample response PDU is about the first time interval.

Optionally, the method includes the step of determining a distance between the transmitter device and the observer device. Optionally, the step of determining the distance between the devices comprises calculating a time of flight (TOF) for at least one of the transmitted PDUs.

Optionally, the TOF is calculated during the implementation of the BLE discovery protocol.

Optionally, the transmitter device comprises a BLE beacon.

Optionally, the step of computing the TOF includes determining a phase offset between at least two of the transmitted PDUs.

Optionally, each transmitted PDU is transmitted using a carrier signal, and the method includes determining an in-phase and a quadrature component of at least one carrier signal.

Optionally, the transmitted PDUs are transmitted using a multi-frequency carrier signal, and the step of computing the TOF includes determining a phase offset for a plurality of frequencies of the multi-frequency carrier signal. Optionally, the step of computing the TOF includes determining a gradient of the sequence of phase offsets with respect to the frequencies of the multi-frequency carrier signal.

According to a second aspect of the disclosure, there is provided a wireless data exchange system comprising a transmitter device and an observer device configured to authenticate a transmitter device, wherein: the transmitter device is adapted to receive an announcement channel PDU having a first nonce includes to send; an observer device is adapted to receive the advertisement channel PDU and the first nonce, and a sample request sample PDU to the transmitter device wherein the sample request sample PDU comprises a second nonce; the transmitter device is adapted to perform an encryption function using the first and second nonces to obtain a first result, and sends a sample response sampling PDU back to the observer device, the sample response sampling PDU comprising the first result; and the observer device is adapted to perform an encryption function on the first and second nonce to obtain a second result and to authenticate the transmitter device if the first and second results match.

According to a third aspect of the disclosure, there is provided a method of authenticating a transmitter device in a wireless communication protocol, the transmitter device: transmitting an advertisement channel PDU comprising a first nonce; receiving a sample request PDU to the transmitter device, the sample request sample PDU comprising a second nonce; and performs an encryption function using the first and second nonce to obtain a first result, and sends a sample response sample PDU back to the observer device, the sample response sample PDU comprising the first result.

According to a fourth aspect of the disclosure, there is provided a transmitter apparatus for use with a wireless communication protocol adapted to: transmit an advertisement channel PDU comprising a first nonce; receive a sample request sample PDU to the transmitter device, the sample request sample PDU comprising a second nonce; and perform an encryption function using the first and second nonce to obtain a first result; and send a sample response sample PDU back to the observer device, the sample response sample PDU comprising the first result.

According to a fifth aspect of the disclosure, there is provided a method of authenticating a transmitter device in a wireless communication protocol, wherein an observer device: receives an advertisement channel PDU from the transmitter device, the advertisement channel PDU comprising a first nonce; sending a sample request sample PDU to the transmitter device, the sample request sample PDU comprising a second nonce; a sample response sampling PDU from the transmitter device, the sample response sampling PDU comprising a first result derived from an encryption function using the first and second nonce; performs an encryption function on the first and second nonce to obtain a second result; and the sender device authenticates if the first and second results match.

According to a sixth aspect of the disclosure, there is provided an observer device for use with a wireless communication protocol adapted to: receive an advertisement channel PDU from the transmitter device, the advertisement channel PDU comprising a first nonce; send a sample request sample PDU to the transmitter device, the sample request sample PDU comprising a second nonce; receive a sample response sample PDU from the transmitter device, the sample response sample PDU comprising a first result derived from an encryption function using the first and second nonce; perform an encryption function on the first and second nonces to obtain a second result; and authenticate the sender device if the first and second results match.

According to a seventh aspect of the disclosure, cryptographic authentication of a sender device using a wireless search and discovery protocol is provided.

According to an eighth aspect of the disclosure, there is provided a method of determining a distance between a first and a second device in a wireless communication protocol, the method comprising: transmitting an advertisement channel protocol data unit (announcement channel PDU) from the first device; Receiving the announcement channel PDU at the second device and in response sending a sample request sample PDU from the second device to the first device; Receiving the sample request sample PDU at the first device and in response sending a sample response sample PDU from the first device to the second device; Calculating a time of flight (TOF) for at least one of the sent PDUs; and determining the distance between the first and second devices using the calculated TOF.

Optionally, the wireless data exchange protocol is a Bluetooth Low Energy Protocol (BLE protocol).

Optionally, the first device comprises a transmitter device. Optionally, the first device comprises a BLE beacon. Optionally, the second device comprises an observer device. optional The second device comprises one of a mobile phone, a tablet and a laptop.

Optionally, the step of computing the TOF includes determining a phase offset between at least two of the transmitted PDUs.

Optionally, each transmitted PDU is transmitted using a carrier signal. Optionally, the method includes determining an in-phase and a quadrature component of at least one carrier signal.

Optionally, the transmitted PDUs are transmitted using a multi-frequency carrier signal. Optionally, the step of computing the TOF includes determining a phase offset for a plurality of frequencies of the multi-frequency carrier signal. Optionally, the step of computing the TOF includes determining a gradient of the sequence of phase offsets with respect to the frequencies of the multi-frequency carrier signal.

Optionally, the method includes the step of authenticating the first device to the second device. Optionally, the advertisement channel PDU includes a first nonce, and the sample request sample PDU contains a second nonce, and the first device is configured to perform an encryption function using the first and second nonces to obtain a first result. Optionally, the sample response sample PDU contains the first result and the second device is configured to perform an encryption function on the first and second nonces to obtain a second result. Optionally, the second device authenticates the first device if the first and second results match.

Optionally, the first and second nonce comprise random numbers.

Optionally, both the first and second devices are provided with at least one key for performing the encryption function. Optionally, the key is a 64-bit random number.

Optionally, both the observer device and the transmitter device are provided with at least two keys for performing the encryption function.

Optionally, at least one key is a private user key.

Optionally, the first nonce comprises a 64-bit, 128-bit, or 256-bit random number, and the second nonce comprises a 48-bit random number.

Optionally, the announcement channel PDU comprises a connectable undirected announcement event PDU or a scannable undirected announcement event PDU.

Optionally, the announcement channel PDU comprises an encrypted form of at least the first nonce.

Optionally, the announcement channel PDU comprises an encrypted form of combination or concatenation of the first nonce and at least one key.

Optionally, the observer device encrypts the at least one nonce to obtain a third result, comparing the third result with the encrypted form received from the advertisement channel PDU.

Optionally, the observer device encrypts a combination or concatenation of the first nonce and at least one key to obtain a third result, comparing the third result with the encrypted form received from the advertisement channel PDU.

Optionally, the observer device only sends the sample request sample PDU to the transmitter device if the third result matches the encrypted form.

Optionally, the scan request sample PDU comprises an encrypted form of the second nonce.

Optionally, the scan request sample PDU comprises an encrypted form of combination or concatenation of the first nonce and at least one key.

Optionally, the transmitter device at least encrypts the second nonce to obtain a fourth result, comparing the fourth result with the encrypted form received from the scan request sample PDU.

Optionally, the transmitter device encrypts a combination or concatenation of the second nonce and at least one key to obtain a fourth result, comparing the fourth result with the encrypted form received from the scan request sample PDU.

Optionally, the transmitter device sends the sample response sample PDU only to the observer device if the fourth result matches the encoded form.

Optionally, a first time interval, which is the time between the sample request sample PDU and the sample response sample PDU, is 150 μs.

Optionally, the observer device authenticates the transmitter device if the time between the sample request sample PDU and the sample response PDU is about the first time interval.

According to a ninth aspect of the disclosure, there is provided a system for determining a distance between a first and a second device in a wireless communication protocol, the system comprising: a first device configured to provide an announcement channel protocol data unit (announcement channel PDU) send; a second device adapted to receive the advertisement channel PDU and send a sample request sample PDU to the first device, the first device configured to receive the sample request sample PDU and a sample response sample PDU to the second device and wherein at least one of the first and second devices is configured to calculate a time of flight (TOF) for at least one of the transmitted PDUs, and wherein at least one of the first and second devices is configured to measure the distance between the first and the second device using the calculated TOF.

According to a tenth aspect of the disclosure, there is provided a transmitter apparatus configured to determine a distance between the transmitter apparatus and an observer apparatus in a wireless communication protocol, the transmitter apparatus being adapted to connect an advertisement channel protocol data unit (announcement channel PDU) to an observer apparatus in response to sending a sample request sample PDU to the transmitter device, and wherein the transmitter device is adapted to receive the sample request sample PDU and to send a sample response sample PDU to the observer, and wherein the transmitter device is adapted to provide a time of flight (TOF) for the scan request sample PDU and to determine the distance between the transmitter device and the observer device using the calculated TOF.

According to an eleventh aspect of the disclosure, there is provided an observer apparatus configured to determine a distance between the observer device and a transmitter device in a wireless communication protocol, the observer device configured to receive an announcement channel protocol data unit (Announcement Channel PDU) from the transmitter device and in response to sending a sample request sample PDU to the emitter device, and wherein the observer device is adapted to receive a sample response sample PDU from the emitter device, and wherein the observer device is adapted to provide a time of flight (TOF) for the sample request sample. PDU and to determine the distance between the observer device and the transmitter device using the calculated TOF.

Brief description of the drawings

The disclosure will now be described, by way of example only, with reference to the accompanying drawings, in which:

1 shows a data format of the BLE connection layer;

2 shows an announcement channel PDU format;

3 shows the format of a header field of an advertisement channel PDU;

4 illustrates the exchange of advertisement channel PDUs;

5 and 6 illustrate the exchange of advertisement channel PDUs according to a first embodiment of the disclosure;

7 the timing of the exchange of announcement channel PDUs in the in 5 and 6 illustrated process illustrates;

8th illustrates the exchange of advertisement channel PDUs according to a second embodiment of the disclosure;

9 illustrates the exchange of advertisement channel PDUs according to a third embodiment of the disclosure;

10 is a polar representation of a sine wave with a phase shift, showing the I and Q components;

11 Fig. 12 is a block diagram of a phase detector for generating the I and Q data; and

12 is a plot of phase versus frequency for two separate devices.

description

The BLE is defined in the documents of various standards, including e.g. For example, the "Specification of the Bluetooth System", Covered Core Package Version 4.2, Volumes 1-7, which are hereby incorporated by reference. The BLE defines two types of devices. It is assumed that a transmitter device is a low-power device that reveals a state or information, while an observer device is an energized device with a relatively larger processing capability. Mobile devices, such. As smartphones or tablet computers, can act as observer devices, if they are equipped with the appropriate hardware and software.

The BLE peripherals enter an announcement mode when they are turned on. The observer devices may receive advertisement protocol data units (announcement PDUs) when in range and in a sample state.

The BLE standard uses the unlicensed 2.4 GHz spectrum. The spectrum is divided into thirty nine 2.0 MHz wide channels. Three channels are reserved for advertising while the rest are reserved for data.

The BLE connection layer defines a single packet format for both the announcement and data channel packets. As in 1 As shown, this format specifies a preamble, an access address, a protocol data unit (PDU) and a cyclic redundancy check (CRC). The preamble is transmitted first, followed by the access address, then the PDU, then the CRC.

The PDU can take several different formats. Depending on whether the packet is being transmitted in a physical announcement channel or in a physical data channel, specific announcement channel PDUs and data channel PDUs are defined.

The announcement channel PDU has a 16-bit header and variable size payload as in FIG 2 is shown. The 16-bit header field of the announcement channel PDU is in 3 shown.

There are several types of PDU, the type being specified by the PDU type field. The TxAdd and RxAdd fields contain the information specific to each PDU type, the length indicating the length of the payload field. There are two fields reserved for future use (RFU).

• a. ADV_IND: verbindbares ungerichtetes Ankündigungsereignis,
• b. ADV_DIRECT_IND: verbindbares gerichtetes Ankündigungsereignis,
• c. ADV_NONCONN_IND: nicht verbindbares ungerichtetes Ankündigungsereignis,
• d. ADV_SCAN_IND: abtastbares ungerichtetes Ankündigungsereignis.

The Announcement Channel PDU types include the following, referred to as the Advertisement PDUs, that are used in the specified events:

• a. ADV_IND: connectable undirected announcement event,
• b. ADV_DIRECT_IND: connectable directed announcement event,
• c. ADV_NONCONN_IND: disconnectable undirected announcement event,
• d. ADV_SCAN_IND: Scannable undirected announcement event.

An unconnectable event is one in which the transmission is unidirectional. The sender transmits a data chain, but does not respond to any request and can not connect. A connectable event is one in which the sender can exchange information with an observer device. An undirected announcement event is broadcast and can be received by any listening observer device. A directed announcement event is one that targets a particular observer device.

Each of the ADV_IND, ADV_SCAN_IND, and ADV_NONCONN_IND PDUs includes payload data having an AdvA field containing the advertiser's address and an AdvData field containing advertisement data from the advertiser's host. The advertiser's address is either public or random, as indicated by the TxAdd. The AdvA field may contain advertisement data from the advertiser's host.

The ADV_DIRECT_IND PDU comprises payload data having an AdvA field containing the advertiser's address and an InitA field specifying the address of the device to which the PDU is addressed. The advertiser's address is either public or random, as indicated by the TxAdd, where the initiator's address is either public or random, as indicated by the RxAdd. This package contains no host data.

• a. SCAN_REQ: durch die Verbindungschicht im Abtastzustand gesendet, durch eine Verbindungschicht im Ankündigungszustand empfangen.
• b. SCAN_RESPONSE (außerdem als SCAN_RSP bezeichnet): durch die Verbindungschicht im Ankündigungszustand gesendet, durch eine Verbindungschicht im Abtastzustand empfangen.

The Announcement Channel PDU types include the following, referred to as Sample PDUs, used in the following states:

• a. SCAN_REQ: Sent through the connection layer in the sample state, received through a connection layer in the announcement state.
• b. SCAN_RESPONSE (also referred to as SCAN_RSP): sent through the connection layer in the announcement state, received through a connection layer in the sample state.

The SCAN_REQ PDU has payloads that include a ScanA field containing the address of the scanner that is public or random, as indicated by the TxAdd, and an AdvA field containing the address of the device to which it belongs PDU, which is public or random as stated by the RxAdd. This package contains no host data.

The SCAN RESPONSE PDU has payloads including an AdvA field containing the advertiser's address, which is public or random, as indicated by the TxAdd, and ScanRspData, which may contain any data from the advertiser's host, include.

An introductory announcement channel PDU, CONNECT_REQ, is also provided. This is sent by the link layer in an initial state and received by the link layer in the announcement state.

4 illustrates the exchange of advertisement channel PDUs. A transmitter device 400 sends an announcement PDU, e.g. B. ADV_IND. An observer device 402 responds with a scan request SCAN_REQ. Once this through the transmitter device 400 has received, it sends a sample response announcement channel PDU, SCAN_RESPONSE, with the data for use by the observer device.

Certain aspects of the present disclosure include making use of this discovery procedure to implement a new security solution. This means that even disconnected devices can be protected from replay attacks, thereby maliciously or fraudulently repeating or delaying valid data transfer.

An embodiment of the disclosure is in 5 illustrating an exemplary implementation in BLE. Here, a transmitter device swap 500 (B) and an observer device 502 (0) Announcement channel PDUs in one of the in 4 presented process similar way. According to the discovery process, as in 5 is implemented, are the transmitter device 500 and the observer device 502 but provided with a shared secret key (K). This can be done by a specific application in a telephone or a computer.

The transmitter device 500 transmits an announcement PDU 504 and contains as a part of the payload a first nonce comprising a random number Bn. This random number Bn is preferably different in every packet that is broadcast. It will be appreciated that the disclosure is not limited to any particular size of random number. When the observer device 502 is in a sample state, it receives an announcement PDU 504 and then generates a second nonce comprising a second random number On.

The observer device 502 then sends a sample PDU 506 that contains the second random number On as part of its payload. The transmitter device 500 then encrypts the two random numbers Bn and On with the key K, obtaining the result Res1. The transmitter device 500 then sends a sample PDU 508 back to the transmitter device 502 That's the result Res1 of the encryption along with the other data sent to a host of the sender device 500 are assigned.

The observer device 502 then encrypts and decrypts the two random numbers Bn and On with the key K and obtains the result Res2. It then checks to see if Res1 and Res2 match, and the data it receives is only verified if there is a match. If the data is not verified, the observer device may 502 they reject. The transmitter 500 can also be blacklisted, ie, its identity can be stored so that any interactions with the same sender device 500 be ignored in the future.

The verification means that the observer device 502 can be sure that the transmitter 500 with which it interacts, is a legitimate device and is not a fraud device, and thus provides a defense against replay attacks.

Further details of the process are also available in 6 illustrated. In step 600 A sender (such as a beacon) periodically sends an announcement packet with a nonce. The nonce is different in every package.

In step 602 For example, an observer device (which may also be generally referred to as a monitor) receives a broadcast packet receiving the nonce. Immediately after receiving the broadcast packet, the monitoring device transmits a scan request PDU (SCAN_REQ) with a second nonce.

In step 604 the sender receives the SCAN_REQ packet and the second nonce. The transmitter then calculates (in less than 150 μs) the function AES (key, Nonce1, Nonce2), where K is the key already stored in the peripheral device. This is called RES1 The result of the calculation is then transmitted back to the monitoring device in a sample response PDU (SCAN_RES) together with other application data APP_DATA.

In step 606 the monitor receives both the sample response PDU and the value RES1 and the APP_DATA. The monitoring device then compares RES1 with its own calculation result of AES (K, Bn, On). If the results of the comparison are the same, then the monitor makes use of the APP_DATA, while if the comparison is not equal, the monitor discards the APP_DATA, blacklisting the beacon.

Both the sender and observer devices use the same encryption function. Any suitable cryptographic algorithm may be used. A one-way hash function can be used. One possible technique is the Advanced Encryption Standard (AES). The hardware or firmware for performing this encryption method or others may be integrated with the relevant hardware, firmware, and software to implement the BLE or other wireless data exchange.

While a symmetric key implementation has been illustrated, the disclosure may also support cryptographic algorithms using asymmetric keys. In these embodiments using asymmetric keys, the transmitter device could 500 and observer device 502 to 5 exchange a public key and use private keys to encrypt and decrypt the random numbers that are generated.

• a. Die Zufallszahl soll nicht mehr als zwölf aufeinanderfolgende Nullen und Einsen aufweisen
• b. Die Zufallszahl soll keine Folge sein, die sich von der vorhergehenden Zufallszahl um nur ein Bit unterscheidet
• c. Die Zufallszahl soll nicht alle acht Oktetts gleich aufweisen
• d. Die Zufallszahl soll nicht mehr als 48 Übergänge aufweisen
• e. Die Zufallszahl soll ein Minimum von vier Übergängen in den höchstwertigen zwölf Bits aufweisen

The disclosure is not limited to any specific format for the first and second random numbers Bn, On, and the symmetric key K, but for illustrative purposes, an appropriate specification of these numbers for the purposes of a BLE implementation may be as follows:
The in the announcement PDU 504 transmitted first random number Bn could meet one, several or all of the following requirements:

• a. The random number should not have more than twelve consecutive zeros and ones
• b. The random number should not be a sequence that differs from the previous random number by only one bit
• c. The random number should not have all eight octets equal
• d. The random number should not have more than 48 transitions
• e. The random number should have a minimum of four transitions in the most significant twelve bits

• a. Der Schlüssel soll nicht mehr als zwölf aufeinanderfolgende Nullen und Einsen aufweisen
• b. Der Schlüssel soll nicht alle acht Oktetts gleich aufweisen
• c. Die Zufallszahl soll nicht mehr als 48 Übergänge aufweisen
• d. Die Zufallszahl soll ein Minimum von vier Übergängen in den höchstwertigen zwölf Bits aufweisen

The by the transmitter device 500 and the observer device 502 shared key K could meet one, several, or all of the following requirements:

• a. The key should have no more than twelve consecutive zeros and ones
• b. The key should not have all eight octets equal
• c. The random number should not have more than 48 transitions
• d. The random number should have a minimum of four transitions in the most significant twelve bits

• a. Die Zufallszahl soll nicht mehr als neun aufeinanderfolgende Nullen oder Einsen aufweisen
• b. Die Zufallszahl soll keine Folge sein, die sich von der vorhergehenden Zufallszahl nur um ein Bit unterscheidet
• c. Die Zufallszahl soll nicht alle sechs Oktetts gleich aufweisen
• d. Die Zufallszahl soll nicht mehr als 36 Übergänge aufweisen
• e. Die Zufallszahl soll ein Minimum von vier Übergängen in den höchstwertigen neun Bits aufweisen.

The in the response scan PDU 508 transmitted second random number On could z. B. be a 48-bit random number. This size is compatible with the BLE specifications, the version 4.0 specifies z. A SCAN_REQ packet having the first 48 bits which are the address of the observer device and the following 48 bits which are the address of the peripheral device. The number On could meet one, several, or all of the following requirements:

• a. The random number should not have more than nine consecutive zeros or ones
• b. The random number should not be a sequence that differs from the previous random number by only one bit
• c. The random number should not be the same every six octets
• d. The random number should not have more than 36 transitions
• e. The random number should have a minimum of four transitions in the most significant nine bits.

As in 7 As shown, the Bluetooth specification requires the transmission of a sample response PDU within a specified time limit from the transmission of a sample request. In the case of Bluetooth 4.0, the required time is 150 μs.

The present disclosure performs the required calculations (of Res1, Res2) within this time period and actually within 1 ms. The time required to perform the calculations depends on the choice of random numbers Bn, On, and key K as well as the speed of the hardware, firmware, and software used to perform the calculations. The above specific example illustrates exemplary choices of Bn, On, and K that perform a quick calculation with most enable available implementations of the device.

Meeting this time limit will help protect against replay attacks (in which communication with both sides is initiated by an attacker forwarding the messages between the two sides) and middleman attacks (in which an attacker blocks communication between two participants who use one of the Participant is initiated, intercepted and manipulated) because both of these attacks require time from an opponent to be implemented.

The embodiment according to 5 is illustrated with a connectable undirected announcement event PDU, ADV_IND. However, the disclosure may also function with a scannable, unannounced ADV_SCAN_IND announcement event.

There are also various PDU types defined by an advertisement PDU header that are reserved, the disclosure of which may make use of these reserved types.

The transmitter device may be a beacon in a preferred embodiment, e.g. B. IBeacon ^®, as provided by Apple Computer Inc. one.

Consider a use case where a beacon (B) is attached to an asset (eg, a blood pressure meter in a hospital). An asset manager may monitor at a monitoring device (0) (eg, a mobile phone) the position of the asset by receiving the broadcast data from the beacon. The asset manager must be sure that the data received is from a valid and authorized beacon and not from a hacker device (which is performing a replay attack). The present disclosure explains how security can be implemented in the beacon.

It is considered that the beacons are provided with a secret key K before they are attached to the assets in a hospital. The provision of the beacons may be performed by a specific application in a mobile phone or any other computer. The key should be randomly generated by the provisioning master. It is also possible to provide additional auxiliary masters using a mechanism similar to the original provisioning process so that multiple authorized monitoring devices can be provided with the security functions of the disclosure for a given set of beacons sharing the same key.

When the beacons are attached to the assets, the beacons periodically send a set of known data (eg, the asset ID, the coordinates of the position of the beacon, etc.). A monitoring device (0) (eg, a mobile phone or a gateway) with a specific application can be used to receive the data from all the beacons. The application can receive the data periodically from the beacons. The device 0 checks the security of each beacon to check that the beacon is a legitimate device and is not a hacker device. By checking the safety of each beacon, the monitoring device ensures that the information received from the beacon is reliable and secure.

Additional advantages of the present disclosure include the following:
Using the discovery protocol enables a software-based solution for the monitoring device and a hardware-based solution on the beacon device. A beacon with appropriate hardware can only require software changes to support the security solution.

The new record for the security solution used in the discovery log is simple and easier to support.

The security solution can support a beacon monitor because it is fast (less than 1 millisecond).

The security solution is a much lower-performance solution than a connection-based security solution.

8th shows the exchange of advertisement channel PDUs according to a second embodiment of the disclosure. This embodiment is similar to the first, except that both the transmitter device 400 as well as the observer device 402 to use two keys together. The first key could be a public key, such as a public key. As the key of a manufacturer. The second key could be a private key specific to a particular user.

When the transmitter device 500 if the two random numbers Bn and On are encrypted, it uses a combination or concatenation of the two keys to obtain the result Res1. Similarly, the observer device then encrypts and decrypts 502 the two random numbers Bn and On with both keys to get the result Res2.

9 FIG. 12 shows the exchange of advertisement channel PDUs according to a third embodiment of the disclosure. FIG. In this embodiment, the transmitter device could 400 be a mobile phone while the observer device 402 could be an in-vehicle access system. Such a system would allow an authenticated user to unlock the vehicle in a keyless fashion and access the vehicle in a keyless fashion. In other embodiments, the access system could refer to a building, a vault, or the like. Furthermore, the observer device could be any entity that requires authentication from and / or by a sender device.

This embodiment also includes additional features for improved safety. First, both the observer device and the sender device are provided with two encryption keys as regards the second embodiment, one of the keys being a private user key.

In addition, the announcement channel PDU now contains both an encrypted form of combination or concatenation of the first nonce and both keys as well as the unencrypted first nonce.

The observer device 402 already has the two keys, having the first nonce as soon as the announcement channel PDU has been received. The observer device 402 also encrypts a combination or concatenation of the first nonce and the key to obtain a third result. This third result is compared with the encrypted form received from the advertisement channel PDU. The observer device 402 only sends the scan request scan PDU to the transmitter device 400 if the third result matches the encrypted form.

Further, the sample request sample PDU includes both an encrypted form of combination or concatenation of the second nonce and both keys and the unencrypted second nonce.

The transmitter device 400 Encrypts a combination or concatenation of the second nonce and the key to obtain a fourth result, and compares the fourth result with the encrypted form received from the scan request sample PDU. The transmitter device 400 only sends the sample response sample PDU to the observer device 402 if the fourth result matches the encrypted form.

In this embodiment, the sender device authenticates 400 the observer device 402 , wherein the observer device 402 also the transmitter device 400 authenticated.

As a further security measure, a first time interval, which is the time period between the sample request sample PDU and the sample response sample PDU, is determined. The observer device 402 only authenticates the sender device if the particular first time interval is about 150 μs, such as, e.g. B. ± 1 μs.

Certain other aspects of the present disclosure provide a method for determining a distance between a first and a second device in a wireless communication protocol. This method also makes use of the BLE discovery procedure.

Again in 4 transmits a first device containing a transmitter device 400 is, regularly (for example, every 1 s) an ADV_IND announcement channel PDU. The transmitter device 400 could be a static BLE beacon located in a shopping mall, for example. If a second device, which is an observer device 402 , such as A user-carried mobile phone is in reach, it receives this transmission, immediately responding with a SCAN_REQ PDU. Once this through the transmitter device 400 has been received, it sends a SCAN_RESPONSE PDU with the data for use by the observer device 402 ,

According to the present disclosure, the transmitter device 400 designed to calculate a time of flight (TOF) for at least one of the sent PDUs. The calculated TOF is used to determine the distance between the transmitter device 400 and the observer device 402 to determine. In alternative embodiments, the observer device 402 (or both devices) may be configured to calculate the TOF and / or to determine the distance between the devices.

All of the transmitted PDUs include a carrier signal (C) that has been modulated by the PDU data. The Bluetooth protocol uses frequency hopping when transmitting radio signals by rapidly switching the carrier signal between many frequency channels. This is advantageously used by the present disclosure when computing the TOF.

For two separate devices, a phase difference occurs between any transmitted signal and the corresponding received signal because it takes a period for the radio signal to move between the two devices. This phase difference varies depending on the frequency of the carrier signal. However, it is known that the phase difference between the phases of the carrier frequency at different frequencies is directly proportional to the distance between the devices.

If the observer device 402 the ADV_IND PDU has received, this signal is demodulated to obtain the PDU data. The demodulated signal (C ') comprises a sequence of carrier signals of different frequencies. The demodulated signal (C ') is used as a reference signal when the carrier signal is generated for the subsequent SCAN_REQ PDU. Consequently, the phase information of the first signal is transmitted to the second signal. The SCAN_REQ PDU then becomes the sender device 400 transfer.

The transmitter device 400 receives the SCAN_REQ PDU and demodulates the signal to obtain the PDU data. The demodulated signal (C '') comprises the original carrier signal (C), which has been phase-shifted twice (once from the transmitter device 400 to the observer device 402 propagates and once back from the observer device 402 to the transmitter device 400 propagates).

The carrier and reference signals are sine waves. Each sine wave can be expressed mathematically as: Asin (2.pi.f _i t + φ) are shown, where A is the amplitude, fi is the sequence of frequencies and φ the phase of the wave. The original carrier signal (C) has a zero phase, wherein the amplitude for determining the phase shift can be neglected. Therefore, the carrier signal (C) can be represented as: sin (2πf _i t).

The twice phase-shifted carrier signal (C ") can be represented as: sin (2πf _i (t-2τ)), where τ is the one-way time delay.

The carrier signal (C) and the twice phase shifted carrier signal (C ") are compared. This is done by generating in-phase (I) and quadrature (Q) DC signals to determine the phase shift. Each sine wave that has a phase shift can be split into two amplitude-modulated sinusoids or synthesized from two amplitude-modulated sinusoids whose phase is offset by 90 degrees. These are the I and Q components. 10 shows a polar representation of a sine wave with a phase shift φ and emphasizes the I and Q components. As shown in the figure: I = Acosφ, Q = Asinφ. Therefore: Q / I = Asinφ / Acosφ = tanφ

Because φ = 2πf _i (2τ), the I and Q data can be resolved to τ as follows: Q / I = tan (2πf _i · 2τ),

To implement the above mathematics, the I and Q signals are generated using a phase detector 700 generated as in 11 is shown. The carrier signal (C) and the twice phase shifted carrier signal (C ") are generated using a first RF mixer 704 mixed. In mathematical terms, this is equivalent to multiplying the two signals: C * C ''. The trigonometric identity for multiplying two sine waves, a and b, is in general form (for clarity): sina · sinb = 1/2 [cos (a - b) - cos (a + b)].

Therefore, the mixed signal has two separate frequency components:
(a - b) and (a + b).

The mixed signal is then passed through a first low-pass filter 706 directed. This removes the higher frequency component (a + b). For the specific signals C and C ", the resulting low frequency component of the mixed signal (ignoring the amplitude) is cosφ, which corresponds to I, as shown above.

The carrier signal (C) also becomes a 90 degree phase shifter 702 directed. The output of the 90 degree phase shifter 702 is therefore: cos (2πf _i t). This output is powered by a second RF mixer 708 mixed with the twice phase shifted carrier signal (C '') and then through a second low pass filter 710 directed. The relevant trigonometric identity for mixing these two signals is: cosine · sinb = 1/2 [sin (a + b) - sin (a - b)].

For the specific signals C and C '', the resulting low frequency component of the mixed signal (ignoring the amplitude) is sinφ, which corresponds to Q, as shown above.

That's why the issues of the first mixer 704 and the second mixer 708 the I or the Q data.

The phase shift for each frequency can then be determined: φ _i = 2πf _i · 2τ.

As is clear from the last equation, the phase shift at a particular frequency is directly proportional to the time delay. The time delay is directly proportional to the distance between the devices. If a plot of the phase shift versus frequency is made, the result is a straight line, where the distance can be determined from the gradient of the line. This is in 12 shown.

To remove an error, the least mean square criterion may be used in practice to obtain the straight line.

The above equation can be rearranged to give:

wobei m der Gradient der Geraden der gegen die Frequenz graphisch dargestellten Phasenverschiebung ist (wie in 12 gezeigt ist).Or:

where m is the gradient of the straight line of the phase shift plotted against the frequency (as in 12 is shown).

The distance D between the devices is: D = c · τ,
where c is the speed of light (3 × 108 m / s).

The present disclosure provides a more accurate method of calculating the distance between two devices that can be obtained using something like the RSSI. Using the frequency hopping procedure of the BLE, a more accurate measure of the distance is obtained. The method also uses the BLE detection procedure, thus providing a fast calculation of the distance using existing transmitted signals. The existing BLE devices can be easily upgraded, so they can implement this method of distance calculation.

The method for determining a distance between two devices of the present disclosure is particularly suitable for use with BLE beacons, but it can be used in many other applications. Many of these relate to indoor proximity detection systems or indoor positioning systems (IPS). However, another possible application is for use with a vehicle keyfob.

Various modifications and improvements may be made to the above without departing from the scope of the disclosure. It can z. For example, different means for calculating the distance may be used. There are other existing algorithms for calculating the distance between two devices using the phase shift method or not. As an example, the phase shifting method by laser ranging devices is often used.

Claims (23)

A method of authenticating a peripheral device in a wireless communication protocol, wherein: the peripheral device transmits an advertisement channel protocol data unit (advertisement channel PDU) comprising a first nonce; a central device receiving the announcement channel PDU and the first nonce and sending a sample request sample PDU to the peripheral device, the sample request sample PDU comprising a second nonce; the peripheral device performs an encryption function using the first and the second nonce to obtain a first result, and sends a sample response sampling PDU back to the central device, the sample response sampling PDU comprising the first result; the central device performs an encryption function on the first and second nonce to obtain a second result, and authenticates the peripheral device if the first and second results match. The method of claim 1, wherein the first and second nonce comprise random numbers. A method according to claim 1 or 2, wherein both the central device and the peripheral device are provided with at least one key for performing the encryption functions. The method of claim 3, wherein the key is a 64-bit random number. The method of any preceding claim, wherein the wireless communication protocol is a Bluetooth Low Energy protocol. The method of claim 5, wherein the first nonce comprises a 64-bit, 128-bit or 256-bit random number and the second nonce comprises a 48-bit random number. The method of claim 5 or 6, wherein the advertisement channel PDU comprises a connectable undirected announcement event PDU or a scannable undirected announcement event PDU. The method of any preceding claim, wherein the time between the sample request sample PDU and the sample response sample PDU is 150 μs or less. A wireless data exchange system comprising a peripheral device and a central device configured to authenticate a peripheral device, wherein: the peripheral device is adapted to send an advertisement channel PDU comprising a first nonce; a central device is adapted to receive the advertisement channel PDU and the first nonce and send a sample request sample PDU to the peripheral device, the sample request sample PDU comprising a second nonce; the peripheral device is adapted to perform an encryption function using the first and the second nonce to obtain a first result, and sends a sample response sampling PDU back to the central device, the sample response sampling PDU comprising the first result; and the central device is adapted to perform an encryption function on the first and second nonce to obtain a second result, and to authenticate the peripheral device if the first and second results match. A method of authenticating a peripheral device in a wireless communication protocol, the peripheral device comprising: send an advertisement channel PDU comprising a first nonce; receiving a sample request PDU to the peripheral device, the sample request sample PDU comprising a second nonce; and performs an encryption function using the first and second nonce to obtain a first result, and sends a sample response sample PDU back to the central device, the sample response sample PDU comprising the first result. Peripheral device for use with a wireless data exchange protocol designed to: to send an advertisement channel PDU comprising a first nonce; receive a sample request sample PDU to the peripheral device, the sample request sample PDU comprising a second nonce; and perform an encryption function using the first and second nonces to obtain a first result; and send a sample response sample PDU back to the central device, the sample response sample PDU comprising the first result. A method of authenticating a peripheral device in a wireless communication protocol, wherein a central device comprises: receives an advertisement channel PDU from the peripheral device, the advertisement channel PDU comprising a first nonce; sends a sample request sample PDU to the peripheral device, the sample request sample PDU comprising a second nonce; receives a sample response sample PDU from the peripheral device, the sample response sample PDU comprising a first result derived from an encryption function using the first and second nonce; performs an encryption function on the first and second nonce to obtain a second result; and the peripheral device authenticates if the first and second results match. Central device for use with a wireless data exchange protocol designed to: receive an advertisement channel PDU from the peripheral device, the advertisement channel PDU comprising a first nonce; send a sample request sample PDU to the peripheral device, the sample request sample PDU comprising a second nonce; receive a sample response sample PDU from the peripheral device, the sample response sample PDU comprising a first result derived from an encryption function using the first and second nonce; perform an encryption function on the first and second nonces to obtain a second result; and authenticate the peripheral device if the first and second results match. Cryptographic authentication of a peripheral device using a wireless search and discovery protocol. A method for determining a distance between a first and a second device in a wireless communication protocol, the method comprising: transmitting an advertisement channel protocol data unit (announcement channel PDU) from the first device; Receiving the announcement channel PDU at the second device and in response sending a sample request sample PDU from the second device to the first device; Receiving the sample request sample PDU at the first device and in response sending a sample response sample PDU from the first device to the second device; Calculating a time of flight (TOF) for at least one of the sent PDUs; and determining the distance between the first and second devices using the calculated TOF. The method of claim 15, wherein the wireless communication protocol is a Bluetooth Low Energy Protocol (BLE protocol). The method of claim 15 or 16, wherein the step of computing the TOF includes determining a phase offset between at least two of the transmitted PDUs. The method of any one of claims 15 to 17, wherein each transmitted PDU is transmitted using a carrier signal and wherein the method includes determining an in-phase and a quadrature component of at least one carrier signal. The method of claim 18, wherein the transmitted PDUs are transmitted using a multi-frequency carrier signal, and wherein the step of computing the TOF includes determining a phase offset for a plurality of frequencies of the multi-frequency carrier signal. The method of claim 19, wherein the step of computing the TOF includes determining a gradient of the sequence of phase offsets with respect to the frequencies of the multi-frequency carrier signal. A system for determining a distance between a first and a second device in a wireless communication protocol, the system comprising: a first device configured to transmit an announcement channel protocol data unit (announcement channel PDU); a second device adapted to receive the advertisement channel PDU and send a sample request sample PDU to the first device, the first device configured to receive the sample request sample PDU and a sample response sample PDU to the second device and wherein at least one of the first and second devices is configured to calculate a time of flight (TOF) for at least one of the transmitted PDUs, and wherein at least one of the first and second devices is configured to measure the distance between the first and the second device using the calculated TOF. A transmitter device configured to determine a distance between the transmitter device and an observer device in a wireless communication protocol, the transmitter device configured to send an announcement channel protocol data unit (announcement channel PDU) to an observer device that in response to a sample request scan. Transmitting the PDU to the transmitter device, and wherein the transmitter device is adapted to receive the scan request sample PDU and send a sample response sample PDU to the observer device, and wherein the transmitter device is adapted to provide a time of flight (TOF) for the sample request sample PDU and to determine the distance between the transmitter device and the observer device using the calculated TOF. An observer apparatus configured to determine a distance between the observer device and a transmitter device in a wireless communication protocol, wherein the observer device is adapted to receive an announcement channel protocol data unit (announcement channel PDU) from the transmitter device and in response a scan request sample PDU and wherein the observer device is adapted to receive a sample response sampling PDU from the transmitter device, and wherein the observer device is configured to calculate a time of flight (TOF) for the sample request sample PDU and the distance between the observer device and the transmitter device using the calculated TOF.

Images