Protecting HRP UWB Ranging System Against Distance Reduction Attacks

Ultra-wideband (UWB) communication is an emerging technology that enables secure ranging and localization. Since UWB communication enables measuring an exact distance, enhanced security would be expected based on it. Recently, however, it has been demonstrated that a distance measured by IEEE 802.15.4z high-rate pulse repetition frequency (HRP) UWB ranging system can be maliciously reduced. The HRP UWB ranging system is widely adopted by smartphone manufacturers such as Samsung and Apple. In this paper, we present UWB with sub-template verification (UWB-SV), which is the first method that prevents a practical distance reduction attack on the current HRP UWB ranging system. UWB-SV is designed to act as a verification method, in which the scrambled timestamp sequence (STS) field of a UWB frame is divided into multiple sub-fields. By analyzing the consistency of the cross-correlation results between the sub-fields and their corresponding local templates, UWB-SV is able to detect a distance reduction attack on the HRP UWB ranging system. Since a long bit sequence is not required for a consistency analysis, UWB-SV can be applied to most commercial off-the-shelf devices that are designed with a 4,096-bit length of the STS field. We comprehensively evaluate UWB-SV under 16 different channel conditions between the victim and attacker, through which we show that UWB-SV has an attack detection rate of 96.24% in outdoor environment conditions with a false positive rate of 0.32%.