Patent Application
20220149977
This disclosure describes systems and methods for detecting and protecting against a phase manipulation attack by generating random antenna switching patterns in Angle of Arrival (AoA) or Angle of Departure (AoD) applications.
Angle of Arrival and Angle of Departure algorithms, collectively referred to as AoX algorithms, operate by determining a phase difference between different antenna elements in an antenna array. The antenna array may be a one or two dimensional array. This phase difference can be used to determine the angle from which the signal originated, since the distance between antenna elements is known.
Specifically, assume a one dimensional antenna array where the distance between two adjacent antenna elements is d. The phase difference between when the incoming signal is detected at these two adjacent antennas can be given as φ. This phase difference, φ, divided by 2π, multiplied by the wavelength, λ, represents the distance between the two antenna elements, as viewed from the signal source. Knowing this difference in the distance that the incoming signal travelled allows the angle of arrival to be calculated. Specifically, the angle of arrival can be given by the difference in the distance that the incoming signal travelled, divided by d represents the cosine of the incoming signal. In other words, the angle of arrival is defined as the arc cosine of (φλ/2π)/d.
This algorithm, and others, relies on the accuracy of several parameters. Specifically, the distance between adjacent antenna elements must be accurate. This is typically not problematic, as the geometry of the antenna array is well defined. The algorithm also relies on the incoming signal. Specifically, the algorithms assume that the incoming signal is a continuous pattern. In many systems, it is assumed that the incoming signal is non-varying such that phase differences between different antenna elements can be used to determine the direction of the incoming signal.
However, a malicious device may manipulate the transmitted signal in an attempt to confuse the locator device so that the locator believes that the malicious device is located in a position that is different from its actual location. This may have serious implications in applications such as access control, visitor management, store theft prevention and product monitoring, collision avoidance, danger zone detection, automated emergency procedures and others. For example, by pretending to be located elsewhere, the owner of a malicious tag may prevent access control alarms from triggering when entering restricted areas. The malicious tag owner can then disrupt the location system operation, causing serious health or financial implications . . . .
Similar issues exist with respect to Angle of Departure applications.
Therefore, it would be beneficial if there were a system and method that could determine that the incoming signal has been manipulated by a malicious device and ignore the location data associated with the malicious device.
Systems and methods for detecting and protecting against phase manipulation during angle of arrival or angle of departure operations are disclosed. For angle of arrival operations, the network device receiving the constant tone extension (CTE) generates an antenna switching pattern. The antenna switching pattern may be randomly generated each time an AoA operation is to be performed. The network device then receives the CTE using the plurality of antenna elements. In one embodiment, the network device compares the phase of portions of the CTE signal received during different sample slots that utilize the same antenna element. If the phase of these portions differs by more than a threshold, the network device detects a malicious attack and acts accordingly. In another embodiment, if the AoA algorithm cannot determine the angle of arrival, the network device detects a malicious phase attack and acts accordingly. For angle of departure operations, the network device that transmits the CTE signal generates an antenna switching pattern. This antenna switching pattern is also transmitted to the position engine, which performs the comparisons described above.
According to one embodiment, a network device to identify a malicious attack during an Angle of Arrival operation is disclosed. The network device comprises a wireless network interface, wherein the wireless network interface comprises an antenna array having a plurality of antenna elements and an analog multiplexer, wherein the wireless network interface receives an incoming signal from an antenna element and generates an I signal and a Q signal associated with the antenna element; a processing unit; and a memory device, comprising instructions, which when executed by the processing unit, enable the network device to: generate an antenna switching pattern; receive a packet that includes a constant tone extension (CTE) from a tag device, wherein the CTE comprises a tone having a known frequency and wherein the CTE comprises a plurality of switch slots and a plurality of sample slots, wherein the antenna element used to receive each sample slot is determined from the antenna switching pattern; and based on phase information obtained from the CTE, perform an action if a malicious phase attack is detected. In certain embodiments, the action is selected from the group consisting of: discarding location information for the tag device; alerting an operator; logging an incident; and changing a radio parameter. In some embodiments, the antenna switching pattern is randomly generated. In certain embodiments, the instructions enable the network device to: attempt to determine an angle of arrival based on phase information from the received CTE using an AoA algorithm; and if the AoA algorithm cannot identify the angle of arrival, detect a malicious phase attack and perform the action in response to a detection of the malicious attack. In some embodiments, the instructions enable the network device to: sample the CTE during a first of the plurality of sample slots using a first of the plurality of antenna elements; calculate the phase of the CTE sampled during the first of the plurality of sample slots, referred to as a first phase; sample the CTE during a second of the plurality of sample slots using a second of the plurality of antenna elements; sample the CTE during a third of the plurality of sample slots using the first of the plurality of antenna elements; calculate the phase of the CTE sampled during the third of the plurality of sample slots, referred to as a third phase; compare the first phase to the third phase; and if the difference between the first phase and the third phase is greater than a threshold, perform the action in response to the detection of the malicious attack. In some further embodiments, the instructions enable the network device to: calculate the phase of the CTE sampled during the second of the plurality of sample slots, referred to as a second phase; sample the CTE during a fourth of the plurality of sample slots using the second of the plurality of antenna elements; calculate the phase of the CTE sampled during the fourth of the plurality of sample slots, referred to as a fourth phase; compare the second phase to the fourth phase; and if the difference between the second phase and the fourth phase is greater than the threshold, perform the action in response to the detection of the malicious attack. In some further embodiments, the instructions enable the network device to: calculate an angle of arrival for the tag device if the difference is less than the threshold.
According to another embodiment, a method of detecting a malicious attack during an Angle of Arrival operation is disclosed. The method comprises using a network device to generate an antenna switching pattern, wherein the network device comprises a wireless network interface, wherein the wireless network interface comprises an antenna array having a plurality of antenna elements and an analog multiplexer, wherein the wireless network interface receives an incoming signal from an antenna element and generates an I signal and a Q signal associated with the antenna element; using the network device to receive a packet transmitted by a tag device that includes a constant tone extension (CTE), wherein the CTE comprises a tone having a known frequency and wherein the CTE comprises a plurality of switch slots and a plurality of sample slots, wherein the antenna element used to receive each sample slot is determined from the antenna switching pattern and performing an action, based on phase information obtained from the CTE, in response to a detected malicious attack. In certain embodiments, the action is selected from the group consisting of: discarding location information for the tag device; alerting an operator; logging an incident; and changing a radio parameter. In some embodiments, the antenna switching pattern is randomly generated. In certain embodiments, the method further comprises detecting the malicious attack by: attempting to determine the angle of arrival based on phase information from the received CTE using an AoA algorithm; and if the AoA algorithm cannot identify the angle of arrival, detecting the malicious attack. In some embodiments, the method further comprises detecting the malicious attack by: sampling the CTE during a first of the plurality of sample slots using a first of the plurality of antenna elements; calculating the phase of the CTE sampled during the first of the plurality of sample slots, referred to as a first phase; sampling the CTE during a second of the plurality of sample slots using a second of the plurality of antenna elements; sampling the CTE during a third of the plurality of sample slots using the first of the plurality of antenna elements; calculating the phase of the CTE sampled during the third of the plurality of sample slots, referred to as a third phase; comparing the first phase to the third phase; and if the difference between the first phase and the third phase is greater than a threshold, detecting the malicious attack. In certain further embodiments, the method further comprises calculating an angle of arrival for the tag device if the difference is less than the threshold. In some further embodiments, the method further comprises calculating the phase of the CTE sampled during the second of the plurality of sample slots, referred to as a second phase; sampling the CTE during a fourth of the plurality of sample slots using the second of the plurality of antenna elements; calculating the phase of the CTE sampled during the fourth of the plurality of sample slots, referred to as a fourth phase; comparing the second phase to the fourth phase; and if the difference between the second phase and the fourth phase is greater than the threshold, performing the action in response to the detection of the malicious attack.
According to another embodiment, a software program disposed on a non-transitory storage media is disclosed. The software program comprises instructions, which when executed by a processing unit disposed on a network device comprising a wireless network interface, wherein the wireless network interface comprises an antenna array having a plurality of antenna elements and an analog multiplexer, wherein the wireless network interface receives an incoming signal from an antenna element and generates an I signal and a Q signal associated with the antenna element, enable the network device to: generate an antenna switching pattern; receive a packet that includes a constant tone extension (CTE) from a tag device, wherein the CTE comprises a tone having a known frequency and wherein the CTE comprises a plurality of switch slots and a plurality of sample slots, wherein the antenna element used to receive each sample slot is determined from the antenna switching pattern; and based on the phase information obtained from the CTE, perform an action if a malicious phase attack is identified. In certain embodiments, the action is selected from the group consisting of: discarding location information for the tag device; alerting an operator; logging an incident; and changing a radio parameter. In some embodiments, the antenna switching pattern is randomly generated. In certain embodiments, the software program comprises instructions that enable the network device to: attempt to determine the angle of arrival based on phase information from the received CTE using an AoA algorithm; and if the AoA algorithm cannot identify the angle of arrival, detect a malicious attack and perform the action in response to a detection of the malicious attack. In some embodiments, the software program comprises instructions that enable the network device to: sample the CTE during a first of the plurality of sample slots using a first of the plurality of antenna elements; calculate the phase of the CTE sampled during the first of the plurality of sample slots, referred to as a first phase; sample the CTE during a second of the plurality of sample slots using a second of the plurality of antenna elements; sample the CTE during a third of the plurality of sample slots using the first of the plurality of antenna elements; calculate the phase of the CTE sampled during the third of the plurality of sample slots, referred to as a third phase; compare the first phase to the third phase; and if the difference between the first phase and the third phase is greater than a threshold, perform the action in response to a detection of a malicious attack. In certain further embodiments, the software program comprises instructions that enable the network device to: calculate the phase of the CTE sampled during the second of the plurality of sample slots, referred to as a second phase; sample the CTE during a fourth of the plurality of sample slots using the second of the plurality of antenna elements; calculate the phase of the CTE sampled during the fourth of the plurality of sample slots, referred to as a fourth phase; compare the second phase to the fourth phase; and if the difference between the second phase and the fourth phase is greater than the threshold, perform the action in response to the detection of the malicious attack. In certain further embodiments, the software program comprises instructions that enable the network device to: calculate an angle of arrival for the tag device if the difference is less than the threshold.
For a better understanding of the present disclosure, reference is made to the accompanying drawings, in which like elements are referenced with like numerals, and in which:
Location systems are used to locate or track items and optionally people, provide directions and find other important information within buildings and facilities such as airports, shopping malls and others. Some systems also rely on these location systems as a security measure. A malicious attack may be used to either change the location of a tag device or to spoof a tag device in a location where there is no tag device. These malicious attacks may rely on the phase manipulation of the CTE signal that is transmitted during the Angle of Arrival or Angle of Departure (collectively AoX) operation. Systems and method to detect this phase manipulation are described below.
The network device 10 has a processing unit 20 and an associated memory device 25. The processing unit 20 may be any suitable component, such as a microprocessor, embedded processor, an application specific circuit, a programmable circuit, a microcontroller, or another similar device. The memory device 25 contains the instructions, which, when executed by the processing unit 20, enable the network device 10 to perform the functions described herein. This memory device 25 may be a non-volatile memory, such as a FLASH ROM, an electrically erasable ROM or other suitable devices. In other embodiments, the memory device 25 may be a volatile memory, such as a RAM or DRAM. The instructions contained within the memory device 25 may be referred to as a software program, which is disposed on a non-transitory storage media.
The network device 10 also includes a network interface 30, which may be a wireless network interface that includes an antenna array 38. The antenna array 38 may comprise a plurality of antenna elements 37. The antenna array 38 may comprise 2, 4, 8, 16 or another number of antenna elements 37. In some embodiments, the antenna array 38 comprises more than two antenna elements 37. The network interface 30 may support any wireless network protocol that supports AoX determination, such as Bluetooth. The network interface 30 is used to allow the network device 10 to communicate with other devices disposed on the network 39.
The network interface 30 include radio circuit 31. This radio circuit 31 is used to process the incoming signal and convert the wireless signals to digital signals. The components within the radio circuit 31 are described in more detail below.
The network interface 30 also includes a read channel 36. The read channel 36 is used to receive, synchronize and decode the digital signals received from the radio circuit 31. Specifically, the read channel 36 has a preamble detector that is used to identify the start of an incoming packet. The read channel 36 also has a sync detector, which is used to identify a particular sequence of bits that are referred to as a sync character. Additionally, the read channel 36 has a decoder which is used to convert the digital signals into properly aligned bytes of data.
The network device 10 may include a second memory device 40. Data that is received from the network interface 30 or is to be sent via the network interface 30 may also be stored in the second memory device 40. This second memory device 40 is traditionally a volatile memory.
While a memory device 25 is disclosed, any computer readable medium may be employed to store these instructions. For example, read only memory (ROM), a random access memory (RAM), a magnetic storage device, such as a hard disk drive, or an optical storage device, such as a CD or DVD, may be employed. Furthermore, these instructions may be downloaded into the memory device 25, such as for example, over a network connection (not shown), via CD ROM, or by another mechanism. These instructions may be written in any programming language, which is not limited by this disclosure. Thus, in some embodiments, there may be multiple computer readable non-transitory media that contain the instructions described herein. The first computer readable non-transitory media may be in communication with the processing unit 20, as shown in
While the processing unit 20, the memory device 25, the network interface 30 and the second memory device 40 are shown in
Although not shown, the network device 10 also has a power supply, which may be a battery or a connection to a permanent power source, such as a wall outlet.
The I and Q signals may then enter a CORDIC (Coordination Rotation Digital Computer), which determines the amplitude and phase of the signals. Amplitude is given as the square root of I2 and Q2, while phase is given by the tan−1 (Q/I). The CORDIC may be disposed in the radio circuit 31, or elsewhere within the network interface 30. In certain embodiments, the CORDIC may be implemented in software.
In certain embodiments, the network interface 30 operates on a wireless network that utilizes the Bluetooth network protocol.
During the entirety of the CTE 340, the sending device is transmitting a tone at a constant known frequency. As stated above, the network device 10 may receive that tone using one antenna element 37 of the antenna array. Specifically, the guard period 341 and the reference period 342, which have a combined duration of 12 μsec, are received using the same antenna element 37.
The network device 10 then performs the steps described above to generate the I and Q signals. In certain embodiments, the processing unit 20 samples the I and Q signals at a very high rate, such as 8 times or more faster than the frequency of the incoming tone. For example, if the incoming tone is 250 kHz, an oversample rate of 4.0 MHz (sixteen times oversampling) or 8.0 MHz (thirty two times oversampling) may be used. The I and Q signals then enter a CORDIC, which determines the amplitude and phase of the signals. Amplitude is given as the square root of I2 and Q2, while phase is given by the tan−1 (Q/I).
Alternatively, if the CTE pattern is as shown in
To determine the phase of the incoming signal, the network device 10 may use the I and Q signals. In one embodiment, the network device 10 uses the output of the CORDIC, namely the phase, which is given by the tan−1 (Q/I). In another embodiment, the network device 10 uses the output of the CORDIC, namely the amplitude, which is given as the square root of I2 plus Q2. In another embodiment, the network device 10 uses both parameters to determine the phase of the incoming signal during each sample slot 344. As noted above, to correctly determine the phase, the network device 10 must begin sampling at the same time after the start of each switch slot 343. In this way, there is no phase offset due to sampling inaccuracies.
For example,
The tag device 500 transmitting the CTE signal is located at an angle θ from the network device 10. The tag device 500 transmits a CTE pattern 510 having a continuous sine wave. The network device 10, in this embodiment, has two antenna elements. Thus, the network device 10 receives the CTE signal on the first antenna element 501 and, during the switch slot 343, switches the antenna element and then receives the CTE signal on the second antenna element 502. The network device 10 may switch between these two antenna elements a plurality of times.
Further, while
The received CTE signal 511 is also shown, where the phase discontinuity is due to the difference in transmission distance between the first antenna element 501 and the second antenna element 502. The antenna element that received each portion of the received CTE signal 511 is shown below the CTE signal 511. As shown in CTE signal 511, the phase of the portion of the received CTE signal 511 received by second antenna element 502 is delayed by about 90°. The network device 10 may then calculate the angle of arrival based on this received CTE signal 511, using any known AoX algorithm, such as MUSIC.
The multiple signal classification (MUSIC) algorithm utilizes phase information to determine the direction of arrival. The MUSIC algorithm creates a one or two dimensional graph, depending on the configuration of the antenna array, where each peak on the graph represents a direction of arrival for an incoming signal. This one or two dimensional graph may be referred to as a pseudo-spectrum. The MUSIC algorithm calculates a value for each point on the graph. Stated differently, a peak in the pseudo-spectrum corresponds to the angle of some signal entering the antenna array.
While this disclosure describes use of the MUSIC algorithm, other algorithms may also be used. For example, the Minimum Variance Distortionless Response (MVDR) beamformer algorithm (also referred to as Capon's beamformer), the Bartlett beamformer algorithm, and variations of the MUSIC algorithm may also be used. In each of these, the algorithms use different mathematical formulas to calculate the spectrum, but each calculates a spectrum which can be used in the present disclosure.
There are two ways in which the tag position may be manipulated.
In one embodiment, shown in
Note that, in this example, the phase difference caused by the difference in transmission distance is offset by the phase manipulation introduced by the malicious tag device 560. Consequently, the network device 10 will detect a received CTE signal 570 wherein the portion of the CTE signal received by each antenna element has the same phase. Thus, the network device 10 may determine that the calculated tag position 580 is located halfway between the first antenna element 501 and the second antenna element 502, based on this received CTE signal 570.
There are other ways in which the CTE signal may be manipulated. For example, an attacker tag may overwrite portions of the CTE signal transmitted by a tag device, so as to change the calculated location of that tag device.
Note that if the CTE signal is as shown in
This relationship may be used to determine whether the CTE signal is being manipulated. For example,
This technique is also applicable when an attacker tag may overwrite the CTE signal from a tag device, so as to change its calculated location. Specifically, the network device 10 will detect that the phase of the CTE signal that was received during two or more sample slots by one antenna element differed.
Additionally, in some embodiments, the network device 10 may also compare the amplitude of two sample slots that were received by the same antenna element.
Note that the clock used by the network device 10 may be slightly different from the clock used by the tag device to generate the CTE signal. Therefore, in certain embodiments, the network device 10 may compare the phase of two or more sample slots that were received using the same antenna element. The network device 10 may have a predetermined threshold, such that if the phases differ by more than this predetermined threshold, the network device 10 may determine that a malicious attack is being performed. In certain embodiments, the predetermined threshold may be less than 5°.
In certain embodiments, the threshold may be adaptive. For example, in noisy environments, the resulting phrase differences between two sample slots may be larger than in a quieter environment. Thus, in certain embodiments, the system may monitor average phase differences between samples received using the same antenna element and determine the threshold based on this average. This average maybe a cumulative average or may be a moving average.
Further, as noted above, if the CTE of
Note that the manipulated CTE signal 561 was not detected by the network device 10 when the antenna switching pattern was sequential. In other words, the malicious tag device 560 manipulated the CTE pattern based on an assumption of which antenna element would be used by the network device 10 to receive each sample slot 344. In other words, the malicious tag device 560 may know the configuration of the antenna array in the network device 10, and anticipate the antenna switching pattern based on this configuration.
Thus, in one embodiment, the network device 10 randomizes the antenna switching pattern each time an AoA operation is to be performed. This may be performed using a true random number generator or a cryptographically secure pseudorandom number generator (CSPRNG). In other embodiment, the network device 10 may randomly insert a second sample slot that is used by one of the antenna elements. The important point is that the antenna switching pattern is preferably unpredictable and therefore, impossible to guess.
For example, if there are 37 sample slots and 16 antenna elements, all of the antenna elements may be used for 2 sample slots, and there are 5 additional sample slots. In one embodiment, the order in which the antenna elements are used is randomized, such as using a true random number generator or a CSPRNG algorithm. In another embodiment, these five additional sample slots may be randomly inserted into the sequence and all of these additional may use the same antenna element.
In both instances, the malicious tag device 560 will not be able to correctly predict the antenna switching pattern, and therefore cannot manipulate the CTE pattern in a manner that will be undetected.
The action taken in response to the detection of a malicious attack may include providing an alert to an operator, discarding the location information for this tag device, log the incident, change a radio parameter, such as timing, channel, sync word or others in the hope that the malicious tag device cannot follow.
In certain embodiments, Box 740 may not be performed until after the determination is made as to whether a malicious attack is being performed. In this way, less computation power is used.
Additionally, in some embodiments, the CTE may be transmitted in a noisy environment, such that there is noise in the received signal. This noise may result in incorrect phase calculations for the various sample slots. By using this approach, CTE signals with a large amount of noise may fail the comparison (even if there is no malicious attack). Thus, computational power is saved, as the AoA algorithm is not executed on CTE signals with a large amount of noise.
Further, the two sample slots that are used by the first of the plurality of antenna elements may be sequential or non-sequential. Of course, the first of the plurality of antenna elements may be used for more than two sample slots. In addition, the comparison described above may also be performed for one or more additional antenna elements, where these additional antenna elements are used for more than one sample slot. In other words, a fourth sample slot may be received using the second of the antenna elements and a fourth phase may be calculated. The second and fourth phases may also be compared to determine whether a malicious attack is being performed.
While the previous disclosure described the ability to explicit detect a phase manipulation attack, the concepts described herein may be used in other ways. A second mode may be referred to as a protection mode, wherein the network device does not explicitly detect a malicious phase attack, but implicitly detects such an attack.
For example, as shown in
In both modes, the network device 10 generates an antenna switching pattern. The network device 10 then receives the CTE signal using this antenna switching pattern. Further, in both modes, the network device may identify a malicious phase attack based on the phase information contained within the CTE signal. In the detection mode, the network device 10 may compare the phase of two or more sample slots that were received using the same antenna element to detect a malicious attack. In the protection mode, the phase information is used as an input to the AoA algorithm. If the algorithm cannot resolve the AoA based on this phase information, the network device 10 may detect a malicious phase attack. In both modes, a malicious phase attack is identified. In the event of a detected malicious phase attack, the network device 10 may take some action, such as discarding the location data, alerting an operator, logging the incident or changing radio parameters.
This technique is also applicable to Angle of Departure configurations.
The network device 810 transmits the CTE signal to a tag device 820 is located at an angle θ from the network device 810. The network device 810 transmits a CTE signal 805 having a continuous sine wave. The network device 810, in this embodiment, has two antenna elements. Thus, the network device 810 transmits the CTE signal on the first antenna element 801 and, during the switch slot 343, switches the antenna element and then transmits the CTE signal on the second antenna element 802. The network device 810 may switch between these two antenna elements a plurality of times.
Further, while
The tag device 820 receives this transmitted CTE signal. The received CTE signal 811 is also shown, where the phase discontinuity is due to the difference in transmission distance between the first antenna element 801 and the second antenna element 802. The antenna element that transmitted each portion of the received CTE signal 811 is shown below the CTE signal 811. As shown in CTE signal 811, the phase of the portion of the received CTE signal 811 transmitted by second antenna element 802 is delayed by about 90°. The tag device 820 may transmit the data indicative of the received CTE signal 811 to a position engine 830. The transmission of the data is application specific. In some embodiments, the IQ data may be transmitted to position engine 830 over a wireless network such as Bluetooth or Wi-Fi. The IQ data may also be stored to the memory in the tag device 820 and loaded to the position engine 830 later when tag device 820 has access to a wired network. In certain embodiments, the position engine 830 may be incorporated in the network device 810. In other embodiments, the position engine 830 may be a separate component or may be integrated into another device, including the tag device 820 or the cloud. The position engine 830 may then calculate the angle of departure based on this data which is indicative of the received CTE signal 811, using any known AoX algorithm, such as MUSIC.
In one embodiment, shown in
In another embodiment, an attacker tag device may be used to modify the CTE signal as it is transmitted from the network device 10 to the tag device. Thus, the tag device will receive a CTE signal that is different from that which was transmitted by the network device 810.
In both embodiments, the position engine 830 will receive data that is indicative of a manipulated CTE signal 861 from the tag device.
The mechanism described above can be used to detect this phase manipulation as well.
First, as shown in Box 900, the network device 810 generates an antenna switching pattern. This antenna switching pattern may be randomized using a true random number generator or a CSPRNG algorithm. Alternatively, the antenna switching pattern may include the insertion of multiple sample slots that utilize the same antenna element, as described above. The network device 810 then transmits the CTE signal using this antenna switching pattern to a tag device, as shown in Box 910. Finally, as shown in Box 920, the network device 810 transmits the antenna switching pattern to the position engine 830, such as over the wireless network. This transmission may be encrypted. For example, a special predefined antenna switching security key may be used to encrypt the transmission of the antenna switching pattern. In certain embodiments, the order of these operations may be changed. For example, the network device 810 may transmit the antenna switching pattern to the position engine 830 prior to transmitting the CTE signal to the tag device. In embodiments where the position engine 830 is disposed within the network device 810, the operation shown in Box 920 may be an internal operation, which does not utilize the wireless network.
If the antenna switching pattern is generated by the network device 810 using a CSPRNG algorithm, it may be sufficient to initially provide the position engine 830 with the seed value and not have the network device 810 continue to provide the antenna switching pattern to the position engine 830. In this way, the position engine 830 may use the seed value and the same CSPRNG algorithm to generate the same antenna switching pattern independently.
The operations of the position engine 830 are shown on the right side of
The position engine 830 receives data indicative of the received CTE signal from the tag device 820, as shown in Box 930. This may be transmitted over the wireless network. The type of data that is transmitted may depend on certain parameters, such as the processing power of the tag device 820 and the available bandwidth. In certain embodiments, the data may be in raw IQ format. In other embodiments, the IQ data may be preprocessed by the tag device 820 prior to transmission. In certain embodiments, the data may be encrypted or signed such that the position engine 830 may verify the source of the received data.
Additionally, the position engine 830 receives the antenna switching pattern from the network device 810, as shown in Box 940. This transmission may be encrypted and transmitted over the wireless network. For example, a special predefined antenna switching security key may be used to encrypt the transmission of the antenna switching pattern. In certain embodiments, the order of these operations may be changed. For example, the network device 810 may transmit the antenna switching pattern to the position engine 830 prior to the position engine 830 receiving the received CTE signal from the tag device.
Once the position engine 830 has received the antenna switching pattern (or calculated the antenna switching pattern using a CSPRING algorithm) and the received CTE signal, it can determine whether a malicious attack has occurred. For example, as shown in Box 950, the position engine 830 may determine the phase of a first portion of the received CTE signal that was transmitted by the network device 810 using a first antenna element. The position engine may then identify a second portion of the received CTE signal that also utilized the first antenna element. The position engine 830 may then determine a phase of this second portion of the received CTE signal that was transmitted by the network device 810 using a first antenna element, as shown in Box 960.
Additionally, the position engine may determine the amplitudes of the first portion and the second portion.
The position engine 830 then compares this first phase and this second phase, as shown in Box 970. If the CTE of
If the difference between these phases is more than a threshold, the position engine 830 detects a malicious attack and performs some action, as shown in Box 980. This threshold may be predetermined or may be adaptive, such as based on a cumulative or moving average, as described above. This action may include discarding the location information associated with this tag device, alerting an operator, logging the incident or changing a radio parameter. Thus, in certain embodiments, the position engine 830 may provide information to the network device 810. If the difference between these phases is less than this threshold, the position engine 830 determines the angle of departure, as shown in Box 990.
Again, the position engine 830 may also use amplitude in addition to phase, to make this determination.
Further, if desired, the position engine 830 may also compare the phase of two portions of the received CTE signal that were transmitted from the network device 810 to the tag device using a second antenna element. If the difference between these phases is more than a predetermined threshold, the position engine 830 detects the malicious attack and performs the action shown in Box 980.
As was described above, the position engine may operate in second mode referred to as a protection mode, wherein the position engine 830 not explicitly detect a malicious phase attack, but implicitly detects such an attack.
For example, as shown in
The position engine 830 receives data indicative of the received CTE signal from the tag device 820, as shown in Box 930. Additionally, the position engine 830 receives the antenna switching pattern from the network device 810, as shown in Box 940. Alternatively, the position engine 830 determines the antenna switching pattern using a seed value and a SPRNG algorithm. The position engine 830 then attempts to calculate the angle of departure of the signal based on the received CTE signal, as shown in Box 941. This may be done using MUSIC or any other algorithm.
If the results are indeterminate, the position engine 830 may detect that a malicious attack is underway. The position engine or network device may then perform some action, similar to the actions taken above, as shown in Box 980. If the result of the angle of arrival calculation are determinate, the position engine 830 may accept the location data, as shown in Box 981.
In both modes, the network device 810 generates an antenna switching pattern. The network device 810 then transmits the CTE signal using this antenna switching pattern. Further, in both modes, the position engine 830 may identify a malicious phase attack based on the phase information contained within the CTE signal. In the detection mode, the position engine 830 may compare the phase of two or more sample slots that were received using the same antenna element to detect a malicious attack. In the protection mode, the phase information is used as an input to the AoD algorithm. If the algorithm cannot resolve the AoD based on this phase information, the position engine 830 may detect a malicious phase attack. In both modes, a malicious phase attack is identified. In the event of a detected malicious phase attack, the position engine 830 or the network device 810 may take some action, such as discarding the location data, alerting an operator, logging the incident or changing radio parameters.
The angle of arrival or departure may be used for many functions. For example, one angle of arrival locator can be used to locate a beacon. This class of applications may be referred to as wayfinding. For example, the beacon may be a set of car keys or another device that a user needs to find. A user, holding the locator device, may be led to the beacon based on the angle of arrival detected by the locator device. As an example, an automobile may be equipped with Bluetooth. A command may be sent by the owner to the automobile disposed in a parking lot to transmit a beacon or sequence of beacons. The locator device, which is carried by the owner, detects the angle of arrival and can lead the owner toward the automobile in the parking lot. In another embodiments, a shopping mall may install beacons at certain locations, such as near exits, certain stores, or the food court. The shopper may use these beacons to guide their way through the mall using a portable locator device. Similarly, the angle of arrival can be used to guide an operator toward an asset in a warehouse or other structure. The locator device may include an indicator that allows the operator to determine the angle of arrival. For example, the locator device may have a visual display that indicates the direction of the beacon. Alternatively, the locator device may have an audio output that informs the user of the direction of the beacon.
When multiple locators are used, the exact location of the transmitter can be determined. This class of applications is referred to as spatial positioning. For example, inside a structure that has multiple locator devices, the exact location of any transmitter may be determined. This may serve to replace GPS in these environments, as GPS positioning requires more power to execute or for indoor locations where the GPS signal is weak or not available. In one example, an operator may carry a mobile telephone. A plurality of locator devices each determine the angle of arrival for a beacon transmitted by this phone. In one embodiment, these angles of arrival are forwarded to the mobile phone. In another embodiment, these angles of arrival are forwarded to a centralized computational device, which calculates the position of the mobile phone based on all of the received angles of arrival. Thus, the angle of arrival from each locator device may be used by the mobile phone or another device to pinpoint the specific location of the mobile phone. If a plurality of locator devices are employed, three dimensional spatial positioning may also be possible.
The present system and method have many advantages. This method increases the security of the system and makes it more difficult to counterfeit the location data, thereby making the system more trustworthy and less prone malicious attacks. This is especially important in systems where incorrect location may have severe implications. Additionally, discarding corrupted packets may improve the power consumption of the system and the accuracy of the location data.
The present disclosure is not to be limited in scope by the specific embodiments described herein. Indeed, other various embodiments of and modifications to the present disclosure, in addition to those described herein, will be apparent to those of ordinary skill in the art from the foregoing description and accompanying drawings. Thus, such other embodiments and modifications are intended to fall within the scope of the present disclosure. Further, although the present disclosure has been described herein in the context of a particular implementation in a particular environment for a particular purpose, those of ordinary skill in the art will recognize that its usefulness is not limited thereto and that the present disclosure may be beneficially implemented in any number of environments for any number of purposes. Accordingly, the claims set forth below should be construed in view of the full breadth and spirit of the present disclosure as described herein.
