Using UWB and BLE together to create practical and efficient secure entry systems

Combining UWB and BLE radios can create efficient secure entry systems. To understand why this is so, it is important to have knowledge of the strengths and weaknesses of the two underlying radio technologies and how they fit together to create practical and secure entry systems.

Introduction to UWB

Ultra-Wide Band (UWB) radios have been available for nearly 10 years for use as a precise positioning technology. There have been previous incarnations of the technology as a high-speed data transfer technology, but we will not be discussing these here.

First, let us recap the basics of UWB as a radio transmission method. UWB is defined as “transmission for which emitted signal bandwidth exceeds the lesser of 500 MHz or 20% of fractional bandwidth”. To provide some real-world context, Insight SIP’s current generation UWB modules (conforming to global standards, which will be discussed later) operate at 6.5MHz (band 5) and 8 MHz (band 9), both with a 500MHz bandwidth.

In practice, this means that a UWB radio transmits at low power over a wide bandwidth. This in turn leads to some key characteristics for the radio transmission. Firstly, you can generate a pulse with sharp time definition, and this signal is relatively impervious to noise (recall Fourier Transforms). Secondly, the primary pulse can be easily separated from a reflected secondary pulse due to this sharp temporal definition. By contrast, a narrow band pulse will be much less well defined in time, significantly impacted by noise, and any reflected signal is likely to be mixed in with the primary one, thus leading to additional error in time definition.

These differences are illustrated in the diagrams below.

 

 

 
   

The reason to focus on this time definition of a pulse is that for positioning applications, a precisely defined timed pulse can, via knowledge of the speed of light, be used as a time-of-flight method to accurately measure distance.

UWB as a localisation technology. Two-way ranging and Time Difference of Arrival

There are two main ways to use UWB to measure distance. The first is “Two Way Ranging” (TWR), whereby a pulse is sent from one device to second one, and then immediately returned to the original device. As long as you know the “turnaround time” at the second device, and this is controlled to be a known number of clock cycles, you can determine the distance between the two devices.

This method is the simplest and most effective for point-to-point measurements. However, should you want to localise an object in three dimensions, you would need to exchange position information with at least three “Anchors” (units in a fixed and known position). This carries the disadvantage of much higher power consumption, and in the case of many objects being tracked, higher chance of interference between devices.

The other method which can be used is “Time Difference of Arrival” (TDoA). In such a case, an object to be tracked emits a single pulse, which is detected by multiple anchors. The difference in time that the pulse arrives at different anchors can be used to determine a 3-D position. This reduces the power consumption by an order of magnitude, and in turn reduces the risk of pulse collisions. The disadvantage, however, is that you need to very precisely synchronise/calibrate the Anchors (to picosecond level), so that the time difference can be detected, and you also need a method to “reassemble” the pulse information arriving at different Anchors. It therefore requires a complex system to link Anchors, calibrate timing, and link information from the Anchors to a single specific pulse.

 

 

For the remainder of this article, we will focus on TWR solutions as these are relatively easy to implement and can be used in small battery powered objects and add precision and security to existing localisation solutions. By contrast, a TDoA solution requires a major hardware and software system engineering effort.

Secure Distance Measurement and “Relay Attacks”

There are existing methods for determining the distance between two objects. Many cars, for example, have what are described as “keyless entry systems”, whereby the car doors unlock as you approach the car. This is a rather inaccurate phrase, as there remains a key in the system. This key transmits a radio signal to the car to open it rather than having to enter a physical key into a mechanical lock. We will nevertheless stick with the phrase “keyless entry” as it is in common usage.

The first generation of such systems used signal strength to determine when the person with the key was approaching the car. There are two issues with this approach. The signal strength is a rather inaccurate way of detecting proximity – it will be influenced by where the key is located on the body, any other objects in the proximity of the car and other factors. This was not a critical factor – solutions could be made “good enough” – but the more significant issue is that such systems have a major security flaw.

With a signal strength-based proximity detection, it is relatively easy to pick up the signal from a key, boost it via a simple power amplifier, and retransmit it to the car. By such a method, you can “spoof” proximity to the car, as the car will see a strong signal indicating close-proximity of a key. In the real world, it has been shown that you can pick up a key signal from inside a house, and use it to open the car, or follow someone from a car park, and pick up the signal from their bag or pocket. This is called a “relay attack” and is not just a theoretical possibility. It has been shown to be used in real world thefts, particularly of high-end vehicles. Note that in the above scenario, you do not need to break any cryptographic exchange between the key and car – these simply pass transparently via the relay.

UWB as protection against Relay Attacks

A UWB based distance measurement is not susceptible to relay attacks as UWB measures distance via time of flight, so the relay is easily detected. Any distance added via the relay adds extra time to the round-trip time measurement, so the UWB measurement accurately measures the real distance. Indeed, the relay is likely to add a further delay to the transmission time, so the key will appear even further away from the car than it is. Whilst it would be naive to describe any security as “unbreakable”, UWB offers a solution that is orders of magnitude harder to crack.

Power Management with UWB

At this point, UWB might seem the perfect solution, but unfortunately things aren’t quite that simple. UWB radios are relatively power hungry, with even the latest generation devices consuming around 50-60mA when radios are on. This isn’t an issue if mains power or a large battery is available, but it certainly is for portable/handheld devices operating on coin cell type batteries or similar. The reasons for this are quite complex, but for precise timing, you need to run very fast clocks and match pulse trains to identify UWB genuine signals above noise.

The first issue for a coin cell solution is that typical coin cells simply can’t deliver that level of current, and even with that issue solved, if the radios were active for long periods the battery charge would be drained very fast. So, a UWB only solution would be useless for an automatic keyless entry system.

On the more positive side, the advantage of UWB time of flight solutions is that they only use very short pulses. So in theory, the radios do not need to operate for long periods. The peak current issue can therefore be solved by use of capacitors to deliver the necessary 50mA to drive the radios. However, the more basic question is how you manage the two ends of the solution to have radios operating only for the minimum necessary time.

BLE and UWB working together as a low power solution

To overcome this problem, it is possible to use BLE and UWB together to create an overall low power solution. BLE has the useful property of being designed for devices to “find” each other via standard protocols whilst consuming very little power. It is also possible to detect proximity using BLE signal strength, albeit with poor accuracy and weak security as we have discussed above.

The use case that can be deployed therefore has the following steps:

  1. Start point: Door locked, UWB radios off/deep sleep.
  2. BLE radio on Door is in listening for connection mode.
  3. BLE radio in Key is Advertising mode.
  4. Key and Door make connection via BLE.
  5. Approximate (and insecure) proximity measured by BLE.
  6. When Proximity reaches (programmable) threshold, UWB radios switched on and measure precise and secure proximity according to timed cycle.
  7. When UWB measured secure distance goes below threshold, door opens.
  8. Return to start point.

Thus, it is possible to have a key solution that combines UWB’s accuracy and security with BLE’s low power properties, if you have a device that combines both radios. Insight SIP’s ISP3080 module has exactly that, for example, BLE and UWB radios with integrated antennas, and a “Door” example is provided with the development kit.

 

 

 

Insight SIP ISP3080 module which contains BLE and UWB radios with integrated antennas in a miniature 12x12mm package, thus providing a near complete solution for a keyless entry system. 

The above can be refined further using additional hardware such as accelerometer, so even BLE radios can be in deep sleep until the key is moved.

Standardisation with UWB

Until relatively recently, the market for UWB solutions was hampered by a lack of standardisation, so customers were limited to vendor dependent proprietary solutions. This has changed in the last few years with FiRa (Fine Ranging) consortium standards, supporting interoperability between vendor UWB chips, including those from Apple, Qorvo, NXP and others. In turn, that has led to UWB radios being included on mobile phones. For the moment this is limited to the higher end devices, but history indicates that technology propagates fast to become standard (e.g., BLE, WiFi). For example, the latest generation of Apple “Air Tag” uses UWB technology to improve localisation capability.

Future applications and evolution of UWB

With most industry players signed up to the FiRa standard, we have an established platform for OEMs to build applications with confidence that they won’t be stuck in a proprietary dead end. The CCC (Car Connectivity Consortium) has developed specific car key applications that sit on top of the FiRa standards that are specific to cars. Thus, one can imagine that in future the typical way to open your car won’t be via a physical key but simply by using your phone.

UWB applications won’t be limited to cars. Any kind of secure entry system (e.g., in buildings) could also take advantage of UWB, both for additional security and convenience. For example, doors could open automatically for those carrying goods or for those who might otherwise be encumbered such as a porter wheeling a patient in a hospital. Ticketing and entry to venue systems could also take advantage to open gates without having to scan tickets in a reader. The precise location capability could also act as a “keep out” zone monitor in the vicinity of dangerous equipment. No doubt there will be many other clever applications developed.

Conclusion

This article has discussed the advantages of UWB as secure entry technology taking advantage of its high precision and secure distance measurement. It has also shown that one of the issues that remains with UWB – relatively high-power consumption – can be handled by combining UWB and BLE radios to enable coin cell driven solutions. “Keyless entry” solutions have been discussed in detail, but various other possible solutions also covered, together with the important recent evolution of standards to truly enable the market going forward.

 

Dr Nick Wood

Sales and Marketing Director, Insight SIP

Nick Wood has 25 years of experience in high technology companies, in particular in the Mobile Devices sector. He is a board member of the Innovation Europe investment fund and is part of the Success Europe Investment team and runs his own consulting company, Riviera Associates. Previously, he was a shareholder/director in Teleca Ltd, a UK company specializing in software for advanced mobile handsets, and later Senior Vice President for Teleca AB, a Swedish listed company, responsible for global development of the Mobile Devices Sector. Nick has a 1st Class Degree in Physics from the University of Bristol, and a PhD in Particle Physics gained at University College London and CERN.

CONTACT US

Insight SiP
GreenSide, Bat.7, Entree2,
400 Avenue Roumanille, BP 309
F-06906 Sophia–Antipolis FRANCE

Phone: +33 (0) 493 008 880

Privacy Policy :: Legal Notice

OFFICE

NEWSLETTER

Please enable the javascript to submit this form