UWB-ED: Distance Enlargement Attack Detection in Ultra-Wideband

Mridula Singh, Patrick Leu, AbdelRahman Abdou, Srdjan Capkun

Dept. of Computer Science
ETH Zurich
{firstname.lastname}@inf.ethz.ch

Abstract
Mobile autonomous systems, robots, and cyber-physical sys- Distance
tems rely on accurate positioning information. To conduct Reduction
distance-measurement, two devices exchange signals and,
knowing these signals propagate at the speed of light, the time
of arrival is used for distance estimations. Existing distance-
measurement techniques are incapable of protecting against
adversarial distance enlargement—a highly devastating tac- Distance
tic in which the adversary reissues a delayed version of the Enlargement
signals transmitted between devices, after distorting the au-
thentic signal to prevent the receiver from identifying it. The
adversary need not break crypto, nor compromise any upper- Figure 1: Ranging systems are vulnerable to distance reduc-
layer security protocols for mounting this attack. No known tion and enlargement attacks.
solution currently exists to protect against distance enlarge-
ment. We present Ultra-Wideband Enlargement Detection
(UWB-ED), a new modulation technique to detect distance and preventing their collision can be achieved only if they
enlargement attacks, and securely verify distances between are able to calculate their relative positions accurately and
two mutually trusted devices. We analyze UWB-ED under securely. Figure 1 shows that an adversary can manipulate the
an adversary that injects signals to block/modify authentic perceived distance between two mutually trusted devices by
signals. We show how UWB-ED is a good candidate for the distance reduction and enlargement attacks.
802.15.4z Low Rate Pulse and the 5G standard.
Conventional ranging systems, such as GPS and WiFi Po-
sitioning Systems (WPS) [34], are useful for benign environ-
ments and coarse-granular geolocation. However, they pro-
1 Introduction vide insufficient precision for accurate distance estimations
(e.g., cm-level granularity), suffer availability constraints (e.g.,
Ranging and positioning information is often necessary for indoors, outdoors), and are relatively slow to calculate loca-
mobile autonomous systems, robots and cyber-physical sys- tions for fast and mobile autonomous systems. More impor-
tems to operate successfully. These systems are used in se- tantly, the aforementioned ranging systems are susceptible to
curity and safety critical applications. Drones are becom- various spoofing attacks [4, 14, 28].
ing more popular for transportation and rescue [24], and au-
Two-way time-of-flight (ToF)-based ranging systems
tonomous systems are being increasingly tested and integrated
(which map ToF to distance as signals propagate at the speed
as part of the ecosystem. The 5G community emphasizes the
of light) have the potential to conduct accurate, fast, and
importance of designing the wireless protocols for the safety
secure distance measurements. Examples include high pre-
of the autonomous vehicles [33]. A stringent requirement
cision Ultra-wide Band (UWB) ranging systems, some of
for these systems is to avoid crashing into, e.g., buildings,
which are now available off-the-shelf [1, 9, 13, 35]. Numerous
pedestrians, properties, or each other [25]. For example, keep-
previous efforts were directed towards protecting these sys-
ing drones and autonomous vehicles on their intended paths
tems from distance-reduction attacks, e.g., for access control.
Version: February 18, 2019. These mainly rely on the principle that propagation speeds
are bounded by the physical characteristics of the media, and the whole transmission, which could then be detected using
cannot be sped-up. For example, distance bounding protocols standard DoS/jamming-detection techniques.
return an upper bound on the measured distance, armed by the We derive the probability that an adversary succeeds in a
fact that an adversary would not succeed in guessing (secret) distance-enlargement attack against UWB-ED. This is also
bit level information [5, 6]. Other techniques are based on useful in setting input parameters, e.g., balancing an applica-
tailoring modulations to prevent distance-reduction attacks tion’s security requirements and ranging rate, while account-
at the physical layer [26]. None of these approaches prevent ing for channel conditions. For example, we show how proper
distance enlargement attacks. parameterization of UWB-ED limits an adversary’s success
Distance enlargement attacks can deviate vehicles from probability in enlarging distances to < 0.16 × 10−3 .
their intended paths, or cause physical collisions. Existing In summary, the paper’s contributions are twofold.
protection approaches rely on dense, and often fixed, verifi-
• UWB-ED—a novel, readily-deployable modulation tech-
cation infrastructures, e.g., towers. These may not exist, and
nique for detecting distance enlargement attacks against
often do not; installing them in outdoor settings is a costly
UWB ToF ranging systems, requiring absolutely no ver-
affair, and not necessarily feasible (e.g., in drone-based mili-
ification infrastructure, and making no impractical as-
tary missions behind enemy lines). Distance enlargement is a
sumptions limiting adversarial capabilities.
more devastating attack than distance shortening because an
adversary in the communication range only needs to annihi- • Analytical evaluation to UWB-ED, where the probability
late (cancel) [23] or distort the authentic signals to prevent the of adversarial success is derived as a function of input
receiver from identifying them and using their time-of-arrival parameters and channel conditions. This evaluation is
(ToA) for ranging. The adversary then simply replays a de- also validated using simulations.
layed version of the authentic signals, which it has already
received by positioning itself in the vicinity of the sender or The sequel is organized as follows. Sections 2 and 3 provide
the receiver. The adversary need not guess these signals, nor background and detail the threat model. The new distance
compromise any upper-layer protocols to do that. The amount enlargement detection technique is explained in Section 4,
of delay corresponds to the adversary-intended distance to and evaluated in 5. Section 6 complements with a related
enlarge. In a collision-avoidance system of automobiles or discussion, and 7 is related work. Section 8 concludes.
self-driving cars for example, a few meters (∼ a few nanosec-
onds) could be catastrophic. 2 Background and Motivation
We present Ultra-Wideband Enlargement Detection (UWB-
ED)—the first known modulation technique to detect dis- A device’s position can be estimated using the distances be-
tance enlargement attacks against UWB ranging based on tween itself and other landmarks with known locations; or
ToF. UWB-ED relies on the interleaving of pulses of different it could be expressed using a coordinate system, e.g., in a
phases and empty pulse slots (i.e., on-off keying). Unable to Cartesian plane. The distance between two devices can be
perfectly guess the phase, this leaves the adversary with a 50% measured using radio signal properties, such as received sig-
chance of annihilating pulses (similarly for amplification). As nal strength [3], phase [30], or the signal’s propagation time
a result, some of the affected (authentic) pulses will be ampli- including ToF and ToA [15]. Reduction or enlargement of the
fied, while others will be annihilated. Unaffected pulses will calculated distances can lead to wrong positioning.
remain intact, while positions that originally had no pulses Adversarial distance reduction has been analyzed in pre-
may now have adversary-injected ones. The technique pre- vious literature [31], but limited work was performed on en-
sented herein gets the receiver to seek evidence indicating largement attacks. Preventing enlargement is achieved when
whether such a deformed trail of pulses in the transmission a node is inside a polygon determined by an infrastructure
was indeed authentic, albeit corrupt. of devices/towers, where verifiable multilateration [31] is ap-
Similar to Singh et al. [26] (which addresses distance- plied. Enlargement attacks are harder to detect without an
reduction attacks), we leverage a randomized permutation infrastructure. Signal strength-based systems do not provide
of pulses. However, unlike [26], we cannot simply look for strong security guarantees during high variations of signal
whether these are out of order, and ignore them if so be- strengths in some channel conditions. For distance reduction
cause that is precisely the adversary’s objective in distance- attacks, the adversary can amplify a degraded signal but for
enlargement: misleading the receiver to ignore the authentic enlargement, degradation is in the adversary’s favor.
signals. Instead, UWB-ED checks the energy distribution One-way ToF systems, such as GPS, can be spoofed to
of pulses: comparing the aggregate energies of a subset of reduce/enlarge distances [4, 14]. Two-way ToF, such as UWB,
pulses at the positions where high energy was expected (as per provides secure upper bound by using distance bounding
the sender-receiver secret pulse-permutation agreement), with along with secure modulation techniques [5, 6, 26]. This pro-
others where low energy was expected. To subvert this, the ad- vides strong guarantees against reduction attacks, but is still
versary would be forced to inject excessive energy throughout susceptible to enlargement attacks.
2.1 UWB
r(t) Bandpass Z
(·)2
TI

IEEE 802.15.4a and IEEE 802.15.4f have standardized im- filter 0

dt Decision

pulse radio UWB as the most prominent technique for pre- E(i)

cision ranging. IEEE 802.15.4z [2] is in the process of stan-

dardizing UWB to prevent attacks on the ranging systems. Figure 2: Non-coherent energy detector receiver.
Off-the-shelf UWB ranging systems were recently devel-
oped [1, 9, 13, 35], and the research community/industry has Np = 2
expressed tremendous interest in these systems (e.g., for au- Tb , bi = 0 Tb , bi+1 = 1

tonomous vehicles). Because current standards do not prevent Legitimate

enlargement attacks, it is important to mitigate them before Signal Tx Ts
standards are deployed in practice. Attack
Scenario
t+
Symbol Structure. UWB systems operate over wide seg- Tx R
t Rx tt+
ments of licensed spectrum. They have to be compliant with a) Replay
Ts
stringent regulatory constraints. Firstly, the power spectral
t+
density should not exceed −41.3dBm/MHz, averaged over Tx
t
R
t
a time interval of 1ms. Secondly, the power measured in a b) Annihilate and Rx tt+
50MHz-bandwidth around the peak frequency is limited to Replay Ts

0dBm. Due to these constraints, the power per pulse is limited. t+

To support longer distances, the energy of multiple pulses is Tx R
Rx tt +
aggregated to construct meaningful information. Figure 3 c) Relay time
Ts
shows On-Off-keying (OOK) modulation, as used in IEEE
802.15.4f-based UWB ranging systems. Each symbol has
Figure 3: Various attack scenarios on UWB.Black and red
two pulses and two empty slots. The symbol length is repre-
colors represent authentic and adversary signals respectively.
sented as Tb and the spacing between consecutive pulses is Ts .
Dotted red represent adversarial signal-annihilation attempts.
Information bits are encoded in the position of the pulse.

Symbol Detection. Figure 2 shows a conventional non- it after some delay. The receiver gets both, authentic and adver-
coherent energy detector (ED) receiver [32]. The energy de- sary’s signal superimposed. Because these authentic signals
tector receiver is consist of square-law device to compute also reach the receiver, the adversary cannot control how the
instantaneous received signal power and an energy integrator. receiver processes them. None of the existing ranging systems
For the received signal r(t), the output of the receiver can be is secure against enlargement attack- be it UWB -802.15.4z,
expressed as: WiFi- 802.11, or GPS. Signal replay is a typical strategy to
Z Ts ∗k+TI mount distance enlargement attacks. Other enlargement at-
E(k) = [r(t)]2 dt (1) tacks, such as jamming, alters the output of the receiver’s
Ts ∗k
automatic gain control (AGC), and are likely to expose the
where Ts ∗ k is the integration start time, TI the integration adversary [22, 27]. Complementing signal replay by signal
window size, and Ts the spacing between consecutive pulses. annihilation prevents the receiver from detecting the authentic
These receivers perform squaring and integration, making signal. Annihilation is possible due to the predictable symbol
phase information irrelevant for pulse detection. In the case structure.
of multi-pulse per symbol, the energies of multiple pulses are In Fig. 3, the devices know each other’s communication
aggregated. For the orthogonal hypothesis tests H1 and H0 range, and could verify that they are within that range, e.g., us-
for bit 1 and 0 respectively, the decision of the ED receiver is ing secure ranging (see Fig. 4). For short LoS distances, a sym-
made in favor of the positions with higher energy. bol length of N p = 1 (i.e., one pulse-per-symbol) could suffice.
(
0 EH0 (i) ≥ EH1 (i) Longer distances are attained by longer symbols (N p = 2 in
b(i) = (2) Fig. 3). Pulses are separated by time Ts , which should be more
1 EH0 (i) < EH1 (i)
than the channel’s delay spread. The length of the symbol (Tb )
is determined by the number of pulses per symbol, and the in-
terval between two consecutive pulses (N p · Ts ). Figure 3 also
2.2 Distance-Enlargement Attack
shows instances of replay attacks on these symbols. When an
In contrast to reduction attacks, to enlarge the distance, the adversary replays authentic signals after some delay (δ), both
adversary need not predict the authentic signal. Instead, it re- authentic and replayed signals are received. To deceive the
plays the authentic signal by replaying an amplified version of receiver, the adversary needs to annihilate authentic signals.
 (positive or negative). Existing hardware is not fast enough
to enable the adversary to sample a pulse’s phase and react
by injecting the reciprocal pulse promptly due to the very
+D
2 narrow UWB pulse width of ≈ 2 ns. We therefore assume
D1
D1 Dmax
that the adversary will not be able to deterministically anni-
D1+D2 <= Dmax hilate pulses from the channel, only with some probability
D1 (Actual Distance) < 1. It succeeds in annihilating pulses if it guesses the phase
D2 (Added Distance) of the pulse correctly. We over-approximate the adversary
Dmax (Communication Range)
by providing the capability to synchronize attack signal with
the authentic transmission. Signal synchronization is a hard
problem, but an adversary can achieve it by using stable clock
and distance information.
Figure 4: If D1 + D2 > Dmax , the devices realize they are We assume the adversary knows the actual physical dis-
outside each other’s communication range without the need tance between the two devices at any point in time. The ad-
to run distance-enlargement detection protocol. versary can calculate this using several means, e.g., by eaves-
dropping on unencrypted position announcements the devices
make. The adversary can also position itself along the direct
In Fig. 3a, an authentic signal reaches the receiver at time t,
path between the two devices, measure the distance between
and the adversary’s signal at t + δ. If the receiver backtracks
itself and each from that position, and add both distances. To
in time (searching for earlier-received signals), the authentic
measure these distances, the adversary’s device can perform
signal will be encountered. Figure 3b shows how the pre-
two-way ranging with each device independently, pretending
dictability of the symbol structure enables an adversary to
to be the other device; or even without such impersonation, it
annihilate its pulses (by emitting a reciprocal pulse phase),
could perform one-way ranging after synchronizing its clock
preventing the receives from detecting it. Figure 3c shows
with each device separately.
the case when nodes are not in the communication range (or
We assume the devices themselves are not compromised;
signal is attenuated by channel condition); the receiver does
the adversary cannot attach a physical cable to their inter-
not get authentic signals, just adversary-relayed (and delayed)
faces, nor hijack their firmware. However, the adversary can
signals.
have multiple network cards and antennas, and is not energy-
bounded. It can be stationary or mobile.
3 Threat Model UWB-ED (Section 4) involves transmitting, between the
victim devices, a code of n pulses, α of which are data-
We focus on the scenario where there are two devices in representing, and the remaining β are absent of energy, where
a wireless network that are interested to securely measure n = α + β. We assume the adversary knows the values of α
the physical distance between them, and protect the measure- and β, but not the positions of these pulses in the transmis-
ments from a third-party adversary. The devices know their sion. (Their positions are determined by both devices pseudo-
maximum communication range. The adversary’s objective randomly in each transmission.) The adversary can learn these
is to enlarge the distance that the devices measure. The adver- parameters by remaining passive in the vicinity of the victim
sary cannot directly block or modify messages on the channel devices, silently observing their transmissions.
(cf. Dolev-Yao’s adversary [10]); it can rather inject signals, Finally, we assume that it is not in the adversary’s interest
and through such injection it can block/modify the authentic to prevent the devices from communicating, e.g., by shielding
signals. If successful, this injection can lead to jamming, sig- them, or jamming the channel.
nal annihilation, and/or content modification. This model cap-
tures the capabilities of man-in-the-middle (MITM) attacks in 4 UWB-ED Design
wireless settings, and is typical in previous literature [7, 12].
The model also fits well with our target application scenario: UWB-ED consists of two phases conducted between both
the communicating devices are typically mobile and move devices: Distance Commitment and Distance Verification.
(drive or fly) in formation. In such scenarios, it is unlikely that Figure 5 shows a timing diagram of both phases. In the first,
an adversary prevents the signals of one device from reaching the devices measure the distance between them using a two-
the other by physical obstacles, and is thus limited to injecting way ranging protocol. The distance measured in this phase
signals. c ) should not exceed the supported communication range
(tto f
We assume the adversary is able to communicate and listen max
(tto f ). In the distance verification phase, the devices measure
on any channel the devices use. However, because the devices their distance by exchanging verification codes (generated
are communicating over UWB, the adversary is unable to de- using a special UWB-ED modulation). To detect enlargement
terministically annihilate pulses without knowing their phase attacks, devices look for distorted traces of that code. The
 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Device 1 Device 2
Original:

Distance
tctof
Permuted:
td
Commitment tp
Figure 6: An example verification code with a randomly-
Check 1:
looking pulse reordering, where α = 5, β = 13, and the code
tctof <= tmax
tof contains n = α + β = 18 pulses. Upon receiving the permuted
Verificati code pulses as per the secret agreement between the sender
on Code
(Challen
ge) and receiver, the receiver knows that Binα will contain the
Distance
Verification
tvtof tp
received energies at the positions (gray) {2, 6, 7, 13, 15},
which are the expected high-energy pulses. Binβ will contain
Check 2: ) the rest: {1, 3, 4, 5, 8, 9, 10, 11, 12, 14, 16, 17, 18}.
esponse
Code (R
tctof = tvtof Verificatio
n

Figure 5: Timing diagram of UWB-ED operation. See inline where α = β). The code length affects the performance and
(Section 4) for notation. security of the presented modulation technique. Larger α
and β values improve the security by reducing the probabil-
ity of adversarial success in mounting undetectable distance-
attack is detected when such traces are found, tto c > t max , enlargement attack. However, increasing the code length re-
f to f
c v
or when tto f 6= tto f (Fig. 5). By enlarging distance in the duces the frequency of conducting two-way ranging. Addi-
commitment phase, the adversary increases tto c by t , but fails tionally, the Federal Communications Commission (FCC)
f d
to enlarge the distance in the verification phase. Annihilation imposes restrictions on the number of pulses with energy,
attempts on the challenge frame are shown, but the adversary effectively limiting α per unit of time. As such, β could be
can also attack responses from both devices. independently increased to compensate for the loss of code
Distance Commitment Phase. The devices measure se- length. Setting these parameters is discussed in Section 5.
cure upper bound by using distance bounding along with Pulse phase. The sender uses a random-phase for the α
secure modulation techniques [5, 6, 26]. This provides strong pulses it transmits. Each phase is equally likely. The phase
guarantees against reduction attacks but is susceptible to will be irrelevant for the receiver because ED receivers are
enlargement attacks. The distance committed in this phase agnostic to the phase, as explained in Section 2.1. The sender
should not exceed the communication range (i.e., an enlarge- need not share this information with the receiver since the
ment attack is detected when tto c > t max ). This check ensures
f to f receiver measures the energy, not the polarity of the pulse.
that the nodes can communicate without a relay. An adversary
Pulse permutation. The sender and receiver secretly agree
enlarging distance by more than the communication range is
on a random permutation of the n positions, obtained from
also exposed using this check.
a uniform distribution. Figure 6 shows an example before
Distance Verification Phase. In this phase, the committed and after the permutation. The verification code can thus be
distance is verified, i.e., an enlargement attack is detected considered a sequence of {−1, 0, 1} pulses, where {−1, 1}
when ttoc 6= t v . To achieve this, the devices measure their
f to f represent the phase, and {0} pulse absence.
distance using round-trip time-of-flight, with both challenge
and response messages protected using specially crafted ver- Spacing between pulses. The time between two consec-
ification codes (i.e., special UWB-ED modulation). In this utive pulses, Ts , is normally lower bounded by the delay
exchange, the sender initiates the distance verification phase spread of the channel. We submit that Ts should be such that
by transmitting a verification code; the receiver tries to detect Ts > 2d/c, where d is the distance between the two devices.
the presence of that code, or traces thereof, in the transmis- If the adversary replays the authentic signal delayed by more
sion, despite the adversary’s efforts to trail-hide its existence than the equivalent RTT, the attack will be detected by the
from the channel (Section 2.2). The verification code and its mismatch between the measured RTT and the one equiva-
check is applied to both time-of-flight messages. Both devices lent to the committed distance. To avoid being detected, the
first agree on the code’s structure as follows. adversary would thus replay its delayed version of a pulse
within the Ts time window. As such, authentic pulse i will not
overlap with the adversary’s delayed version of pulse i − 1, or
4.1 Modulation/Verification Code Structure any further adversary pulses i − 2, i − 3, etc.
Code length. The code consists of n positions, α of which
have energy, and the remaining β = n − α are empty, i.e., An example code structure, and adversarial attempts to
absent of pulses (conceptually similar to OOK modulation, corrupt and replay it, is shown in Fig. 7.
 Start

Yes
Backtracking finished? Stop
No

< > Use Updated

Attack plausibility check
ToA for tp and
tvtof estimation
< Pnoise Pnoise
Robust code verification tctof 6= tvtof

Noise Update Flag as attack

ToA

Figure 7: An example verification code of n slots (9 of which

are shown), the spacing Ts between consecutive pulses is 1µs
and pulse width Tp is 2ns. An adversary transmits a pulse to Figure 8: The receiver backtracks to detect enlargement at-
distort the legitimate pulse (dashed red). The adversary also tacks. An event is flagged as an attack when the aggregate
replays the authentic signal with the delay δ (solid red). Best energy is higher than Γ (e.g., DoS, jamming), i.e., the data
viewed in color. looks more similar to a verification code than noise. The last
flagged position is used for the ToF estimation.

4.2 Verification Code Identification

compared to a predefined threshold, γ. This threshold is based
Upon receiving a transmission, the receiver starts processing on the receiver’s noise figure. If the aggregate exceeds γ, a
the code associated with the highest preamble’s peak. The potential verification code has been found. Otherwise it gets
code associated with a peak is the train of Ts -spaced pulses discarded as noise. The aggregate energy is then compared to
that start at a fixed time interval (e.g., agreed upon between another threshold, Γ. This is calculated based on the overall
the sender and receiver) after the peak. This peak however aggregate energy the receiver expects to receive based on the
may not be authentic, and could be the adversary’s replayed measured distance in the commitment phase, following the
version. The receiver thus backtracks at fixed time steps cor- path loss model. Artificial distance enlargement caused by the
responding to the pulse width Tp (e.g., 2 ns), trying to identify adversary in the commitment phase lowers the receiver’s cal-
if another version of the code (or a possible distorted im- culated Γ (because of the higher path loss), thus increases the
print of it) was present in the transmission at an earlier time. likelihood of the actual received aggregate to exceed Γ. If the
The receiver does not need to backtrack further beyond some aggregate exceeds Γ, an adversary may possibly be injecting
time T0 , knowing the maximum communication range. If the energy into the channel to distort the authentic code. If the
last distance verification occurred recently, the verified range verification code is neither discarded as noise (< γ) nor ex-
could be used (in combination with the devices’ upper bound ceeds Γ, the receiver proceeds to the Robust Code Verification
motion speeds) to reduce the backtracking time. check.
Backtracking requires the receiver to record transmissions. Robust Code Verification. Now the receiver checks the
If an earlier version of the code is found (and their difference verification code content. If the receiver simply flags the pres-
exceeds the receiver’s standard precision, e.g., ±10 cm for ence of one or more pulses (above noise) in Binβ as an attack,
DecaWave [9]), it is used for ToF estimation. false positives increase because such pulses could occur for
As shown in Fig. 8, the receiver performs Attack Plausibil- many legitimate reasons (e.g., noise spikes, reflections, in-
ity check and Robust Code Verification to detect attacks until terfering transmissions, antenna orientation, or multipath).1
the maximum backtracking time is reached. For each code, the Instead, the receiver performs a sequence of binary hypothesis
receiver does not look for an exact match of the transmitted tests on random pulse samples. It tests if the candidate code is
pulses in their positions simply because that could be easily more similar to an authentic code than noise. It chooses r ≤ α
bypassed with minimal adversarial efforts (as explained in random pulses from the α in Binα (where r is the number
Section 2.2). Instead, the receiver proceeds as follows. Know- of pulses per symbol), aggregates their received powers and
ing the mapping of the pulse positions, the receiver distributes compares that to the aggregate of another r pulses randomly
the received powers of each pulse among two bins, Binα and chosen from the β in Binβ . If the aggregate of those selected
Binβ . The former will have the values of the received power from Binα is larger, the receiver identifies this as a candidate
(e.g., in Watts) of the energy-present pulse positions, the latter authentic code, and records its ToA. Finally, the distance is
energy-absent positions (Fig. 6). calculated based on the recorded ToA of the most recently
Attack Plausibility check. For each candidate verification 1 If the receiver instead interprets a pulse in Bin as an indication that the
β
code obtained during backtracking, the overall received sig- code is not authentic and continues backtracking, it may very well skip the
nal power (the aggregate of Binα and Binβ ) is measured, and authentic code thus helping the adversary.
received code, and a mismatch with the committed distance where d is the (unverified) distance in meters between the
is flagged as an attack. sender and receiver obtained at commit stage, either true or
A candidate verification code could be again noise, which artificially enlarged in case of an attack. N is an instantiation
has slipped the Attack Plausibility check perhaps due to some of zero-mean Gaussian noise at the receiver, i.e., the noise
sporadic noise spikes in the transmission. Noise has a proba- present in the receiver’s channel and cannot be removed [19].
bility of ≤ Pnoise to satisfy the Robust Code Verification check, There are other factors that contribute to the degradation
where Pnoise is derived as (32) in Section 5.1.4. As such, the of power. These factors could cause further power loss E,
receiver estimates the probability that the above condition is typically up to E = −8 dB more [17, 21]. If the receiver
satisfied. This is done by repeating the random sampling υ sets Γ as that after the expected further degradation (i.e., too
times, and checking if the ratio of the number of times the small Γ value), false positives may increase because such
condition is satisfied to υ exceeds Pnoise . This would indicate additional signal-degradation factors may or may not occur—
the code is not noise, and is either authentic or adversary- if they do not, the receiver would then falsely assume such
replayed. Regardless, the receiver uses the ToA of the most relatively “too high” aggregate energy is due to an attempted
recent code found. attack. Accordingly, the receiver sets Γ based only on the
(almost certain) path loss deterioration. Any further power
4.3 Setting the Energy Thresholds. loss would then be added benefit to the adversary, as it allows
the adversary to inject more pulses into the channel to corrupt
Setting the upper-bound threshold, Γ. To set Γ, the receiver the authentic code without exceeding Γ.
relies on the committed (unverified) distance between itself Setting the lower-bound threshold, γ. If the aggregate
and the sender. This dictates the path loss—the amount of energy is < γ, it would be either due to noise or a substan-
power loss per pulse as pulses propagate the medium. Larger tial deterioration of the authentic signal where no meaning-
committed distance causes the receiver to expect less power, ful information could be recovered during the Robust Code
thus setting a lower Γ. Thus, by increasing the committed Verification. Too high γ leads to false negatives; too low trig-
distance, the adversary helps divulge its malice. gers Robust Code Verification even for noise. For critical
The path loss function f () for outdoor UWB LoS is [20]: applications seeking to prevent false negatives, γ could be set
  conservatively based on the receiver’s noise variance σ2N :
d
f (d) = PL0 + 10 · n · log (3)
d0 γ = (α + β) · σ2N (10)
where d is the distance in meters, and PL0 is a constant repre-
senting the path loss at the reference distance d0 . For UWB 4.4 Attack Resilience
LoS channel model, these constants are set to [20]:
  Here we explain how UWB-ED resists standard enlargement
6.5 attacks. More complex attacks are discussed in Section 6.
f (d) = −46.3 − 20 log(d) − log (4)
5
4.4.1 Detecting Signal Replay
This is calculated in the standard signal ratio unit, dB, where:
An adversary that simply replays authentic pulses does not
Power ratio (in dB) = 10 log (ratio) (5)
win because the receiver backtracks to detect earlier copies of
The path loss function thus expresses the power loss as the code. UWB-ED provides resilience to benign signal dis-
  tortion, e.g., due to channel conditions or antenna orientation,
(λb )2 because the receiver looks for similarities between the code
f (d) = 10 log (6)
(λsent )2 and the received signal (versus exact data match), allowing
or for a higher bit error rate. In general, poor channel conditions
(λb )2 (low SNR) can be compensated for by increasing the symbol
= 10 f (x)/10 (7) length, r, minimizing the bit error rate.
(λsent )2
where (λb )2 is the pulse instantaneous power the receiver
4.4.2 Complicating Signal Annihilation
expects, and (λsent )2 is that the sender has actually sent, e.g.,
both in Watt. Knowing the constant pulse power of the sender, The unpredictability of the pulse phase means an adversary
then the pulse power is expected to be received as: must either wait to detect it and immediately inject the recip-
rocal pulse for annihilation, or inject a random-phased pulse
(λb )2 = (λsent )2 10 f (x)/10 (8) hoping it is the reciprocal. The former is infeasible in practice
The receiver then calculates Γ as follows: for UWB (see Section 3). The latter results in amplifying
or annihilating the authentic pulse, each with a 50% chance.
Γ = α (λb + N)2 + β (N)2 (9) Amplification is unfortunate to the adversary, as the adversary
 Best receiver-expected signal E = −10 dB
10 E = −5 dB
10−5 E = −5 dB

Adversary room (ζ)

E = −10 dB (worst)
Power loss ratio (10 f (x)/10 )

10−6
5
Receiver’s threshold per pulse
10−7

10−8 0
0 0.5 1 1.5 2 2.5 3
Adversary-added distance ratio (D2 /D1 )
10−9 Actually-received signal

Figure 10: Adversary’s room to add energy, ζ in (12), against

10−10
0 20 40 60 80 100 the ratio of the adversary-added to true distance (D2 /D1 ); E
represents additional signal degradation beyond path loss.
Distance (m)

Figure 9: The best expected signal power as calculated by adversary is trying to add D2 = 32.68 m to make the distance
the receiver using the path loss function in (4), the signal at D1 + D2 = 47.79 m (red line), the receiver will set Γ using
E = −5 db of further power loss, and at E = −10 db (worst the fake distance, D1 + D2 . At such a relatively large added
expected). If the distance is D1 = 15.11 m (green line), and distance, D2 , the received pulse power is unlikely to fall below
the adversary doubles it, i.e., by adding D2 = 15.11 m to f (D1 ) + E = 10−8 (λsent )2 at, e.g., E = −10 dB. The room
make it D1 + D2 = 30.22 m (red line), the receiver will set available to the adversary to inject energy becomes too small,
the threshold following the fake distance, at 10 f (D1 +D2 )/10 = significantly reducing its chances of success.
10−7.6 . The adversary’s room is the difference between the red The room-per-pulse, R, available to the adversary to enlarge
and green lines on the y-axis. At D2 = 32.68 m, the adversary the distance thus lies in-between the received signal and Γ,
has no room. Best viewed in color. and is calculated in dB as:

R = f (D1 + D2 ) − ( f (D1 ) + E) (11)

now needs to compensate with an equivalent amplitude, A.
Amplification doubles the amplitude. The estimated energy where E represents other channel degrading factors, and the
of the pulses will thus amount to ∼ A2 , and the adversary- distances D1 and D2 (in meters) are respectively the true
contributed amplification to ∼ (2A)2 . distance between both devices, and the extra distance the
Since the result is indeterministic for the adversary, it leads adversary intends to add. This room is thus expressed as:
us to the next discussion: how successful would the adversary
ζ = 10R/10 (12)
be in “contaminating the evidence” that an authentic veri-
fication code existed, and how much energy room does the Figure 10 plots ζ at various distance ratios D2 /D1 .
adversary have to do that before exceeding Γ? Recall that the adversary may succeed to annihilate some
of the pulses falling in Binα . But since Binβ in the authentic
4.4.3 Mitigating Evidence Contamination code have nothing but noise, adding pulses into those will
result in an increase in the overall aggregate energy. As such,
To hide the authentic code, the adversary tries to inject energy this available energy room in (11) by itself does not give a
into the channel, hoping it annihilates as many of Binα pulses perfect indication to the adversary’s chances of success.
as possible. We thus calculate the room available to the adver-
sary here, and use that to derive the probability of adversarial 4.5 A Numerical Example
success in distance enlargement in Section 5.
Figure 9 shows the path loss function in (7) as used by the Figure 11 shows an example verification code, expanded from
receiver to detect the threshold Γ, as well as the worst receiver- Fig. 6, where the adversary injects k = 10 random-phased
expected signal after additional deterioration. The receiver pulses. For simplicity, the figure assumes N = 0. If the dis-
sets the threshold based on the best expected signal. The room tance between the sender and receiver is D1 = 4 m, and the
available for the adversary to add energy depends on the actual adversary is trying to enlarge it by D2 = 4.5 m to make it
signal received. The most favorable situation to the adversary D1 + D2 = 8.5 m, and assuming (λsent )2 = 7.6 µW , then the
is when the received signal power is the worst (lowest E), receiver expects a best case received power of:
which allows the adversary to inject pulses without exceeding
Γ. For example, in Fig. 9, if the actual distance between the (λb )2 = (λsent )2 10 f (D1 +D2 )/10
(13)
sender and receiver is D1 = 15.11 m (green line), and the = 7.67 × 10 f (8.5)/10 = 2.4 µW
 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

Sent (after path loss): 0 -1 0 0 0 -1 1 0 0 0 0 0 1 0 -1 0 0 0 Γ = α (λb )2 = 12 µW

Adversary injects: 1 1 -1 1 -1 1 -1 1 -1 -1 k = 10 pulses

Receiver gets: 1 0 0 0 -1 -1 2 -1 1 0 0 -1 2 0 -1 0 -1 -1 α(λreceived )2 = 17µW

Figure 11: An example of the random-phased Binα pulses (dark gray) reordered following the permutation in Fig. 6. After the
adversary injects k = 10 random-phased pulses at random positions, the receiver will get the summation at each pulse position.

From (10) at N = 0 and α = 5 (as in Fig. 11), it then calculates from Binβ (bβ) exceeds that of Binα (bα), and the added
the threshold as: energy is ≤ Γ:

Γ = α (λb )2 = 12 µW (14) Psa (α, β, r, Γ, k) = Pbβ>bα (α, β, r, k) ∩ P≤Γ (α, β, k) (17)

At E = −10 dB, the actual signals are received as: 5.1.1 Probability of successfully evading the Robust
Code Verification check (Pbβ>bα )
(λw )2 = (λsent )2 10( f (D1 )+E)/10 ≈ 1 µW (15)
To evade this, the adversary must have an energy aggregated
Now assuming the adversary is D3 = 6 m away from the from Binβ exceed Binα . When the adversary injects k pulses
receiver, and uses a random-phased pulse with transmission into the channel, x will fall into Binα , and the remaining k − x
adversary 2 into Binβ . Pbβ>bα is then the probability of this distribution
power of (λsent ) = 15.77 µW . At E = −10 dB, the re-
ceiver would receive the adversary’s signals as: occurring multiplied by the probability of the attack succeed-
ing under this distribution, for all possible such distributions
adversary 2
(λ0 )2 = (λsent ) 10( f (D3 )+E)/10 ≈ 1 µW (16) 0 ≤ x ≤ α and 0 ≤ k − x ≤ β. To calculate the probability
of the distribution occurring, consider the general case of a
So in the best case for the adversary, where the signal is bucket containing two types of objects (e.g., colored pearls): I
highly deteriorated, the adversary would then have a per-pulse of the first type, and J of the second. If ψ objects are selected
room of R = 3.45 dB to add energy, which amounts to 7 µW at random, the probability that i and j of the ψ are respectively
more, i.e., up to Γ = 12µW . In Fig. 11, after the adversary of the first and second type (i + j = ψ) is:
injects its k = 10 pulses at the example random positions and I
J

with the random phases shown, it results in annihilating a i j
I+J

(18)
single pulse (at position 2), amplifying two pulses (at posi-
i+ j
tions 7 and 13), and adding seven more 1 µW pulses for an
increase of the overall aggregate to be 17 µW . This exceeds n

where r denotes n choose r and is given by:
Γ = 12 µW , and this attack would thus be detected. 
   n!
n , 0≤r≤n
= r!(n − r)!
5 Evaluation r 
0, otherwise
We evaluate UWB-ED by deriving the probability of success Similarly, the probability that x and k − x of the adversary’s
for an adversary enlarging the distance. We also validate that k pulses respectively affect the α in Binα and β in Binβ is:
model using simulations in Section 5.2.
α
β

x k−x
α+β

5.1 Probability of a Successful Attack k

The adversary hides the authentic code by having the aggre- For all possible such distributions, we have:
gate of the r pulses that the receiver chooses from Binβ exceed !
α α
β

Binα . The adversary must also avoid injecting too much en- x k−x
Pbβ>bα (α, β, r, k) = ∑ pα,β,r,k (x) · α+β

(19)
ergy to not exceed Γ. Not knowing which pulse belongs to
x=0 k
which bin, the adversary injects k pulses at random positions
thus affecting k of the n pulses in the code. where pα,β,r,k (x) is the probability bβ > bα given the adver-
To that end, the probability of mounting a successful attack, sary affected x and k − x pulses in Binα and Binβ respectively.
Psa , is the intersection of the probability of two events (the To derive pα,β,r,k (x), we assume for simplicity a unity
checks in Fig. 8): the aggregate of the energy pulses chosen power-per pulse, i.e., the sender’s and the adversary’s pulses
reach the receiver after path loss and other factors at a con-
1 1
stant energy of ±1µW .2 This is similar to the example given
r=1 r=2 r=1 r=2
in Fig. 11. Every adversary-added pulse in Binβ will result
r=4 r=8 r=4 r=8

Probability (Pbβ>bα )

Probability (Pbβ>bα )
in a 1 µW of added energy from the receiver’s point of view
since the receiver’s aggregation is agnostic to a pulse’s phase.
For Binα , after the adversary affects x pulses, some will be
annihilated while others will be amplified. From the receiver’s
point of view, after the adversary’s pulses are injected, Binα
will have a mix of 22 = 4µW and 0 µW (adversary-affected)
pulses, as well as the original 1 µW unaffected pulses. 0 0
0 50 100 150 0 20 40 60
More 0 µW (annihilated) pulses in Binα raises the chances # of adversary pulses (k) # of adversary pulses (k)
that bβ > bα, which is in the adversary’s favor. Since every (a) β = 100 (b) β = 10
affected pulse in Binα will either result in a 0 µW or a 4 µW
pulse, there are 2x possible outcomes. Of those, there are Figure 12: Probability that the Robust Code Verification check
x

g ways that g 0 µW pulses will occur. The probability that fails to detect the adversary’s attack, plotted using (19) in
the x adversary-injected pulses
that fell in Binα result in a Section 5.1.1, at α = 50 and 0 ≤ k ≤ α + β.
annihilation of g pulses is thus gx /(2x ). For all possible num-
bers of annihilated pulses 0 ≤ g ≤ x, the adversarial success
Verification check to detect attacks, since the adversary main-
probability in the event that x fell in Binα is:
tains its success probability by increasing k proportionally;
x

!
x there is a visually similar pattern of adversarial success proba-
g
pα,β,r,k (x) = ∑ pα,β,r,k,x (g) · (20) bility in both Fig. 12a and 12b. As such, the advantage of the
g=0 2x
empty pulses in Binβ does not quite manifest in the Robust
where pα,β,r,k,x (g) is the probability bβ > bα given g annihi- Code Verification check, rather the Attack Plausibility check.
lated pulses in Binα . Another observation is that higher r lowers the adversary’s
When Binα has g annihilated (0 µW ), x − g amplified (4 success probability. For example at β = 100 (Fig. 12a), the
µW ), and α − x unaffected pulses (1 µW ), the probability of adversary has a 27% chance at r = 2 (which occurs at k =
bβ > bα in the event x fell in Binα , and g of the x pulses were 135), versus 5.85% at r = 8 (at k = 130). In Section 5.1.3, we
annihilated is the probability that an aggregate of m − 1 is show that at r = α, we get the optimal security results.
chosen from Binα and an aggregate of ≥ m is chosen from
Binβ . For each possible 0 ≤ y1 , y2 ≤ r, we have: 5.1.2 Final Probability of Adversary’s Success
In (17), the event that the aggregate energy after the adver-
pα,β,r,k,x (g) =
sary’s pulses is ≤ Γ and the event that bβ > bα are dependent,
g
x−g
α−x
k−x
β−(k−x)

! and thus their intersection is not their product. Recall that in
r r r
y1 y2 r−y1 −y2 i r−i

· (20), g is the number of annihilated pulses, x − g is the number
∑ ∑ α β

∑
y1 =0 y2 =0 r i=m r of amplified pulses in Binα , and k − x is the number of added
(21) pulses in Binβ . The aggregate-energy does not exceed Γ when
where m is: the adversary’s pulses satisfy the inequality:
m = 02 × y1 + 22 × y2 + 12 × (r − (y1 + y2 )) + 1 (k − x) (λ0 + N)2 + (x − g) (λ0 + λw + N)2 +
(22) (25)
= r − y1 + 3y2 + 1 (α − x) (λw + N)2 + (β − (k − x) + g) (N)2 ≤ Γ
At r = α (i.e., selecting all Binα pulses) and α ≤ β, we get: where λ0 is defined as in (16), and Γ in (10).
k−x
β−(k−x)

r
If the adversary uses a variable pulse power randomly cho-
pα,β,r,k,x (g) = i r−i sen from a distribution with a mean much different from λw ,
β

∑0 (23)
i=m r
authentic pulses colliding with their reciprocal will not be
fully annihilated. The adversary thus sets its power such that
where m0 is: its mean at the receiver matches the sender, i.e., (λ0 )2 = (λw )2 .
m0 = 22 × (x − g) + 12 × (α − x) + 1 Assuming (λw )2 = (λ0 )2 in (25), we get:
(24)
= 4(x − g) + (α − x) + 1 α λ2b − ε
k + 2x − 4d + α ≤ (26)
λ2w
Figure 12 plots Pbβ>bα , where α = 50. From these results,
increasing β is not necessarily effective for the Robust Code where ε is a representation of noise, and evaluates to:
2 Analogous analysis applies for non-constant energy. ε = N (λw (2k + 2α − 4g) − λb (2α))
As ε → 0, (26) becomes: it is imperative to calculate the probability, Pnoise , that noise
  in the channel satisfies that check. Unlike the adversary’s
λ2b pulses targeted to alter the authentic code, such a candidate
k + 2x − 4d ≤ α −1 (27)
λ2w trail of noise pulses does not get added to the sender’s code
because they are at different positions. Without loss of gener-
From (13) and (15), we have: ality, we can separate the noise-intervals in low-energy and
high-energy, e.g., across the median of the distribution of N 2 .
λ2b (λsent )2 10 f (D1 +D2 )/10
= We refer to the number of high-energy intervals as κ. The
λ2w (λsent )2 10( f (D1 )+E))/10 probability that noise satisfies the Robust Code Verification
(28)
= 10( f (D1 +D2 )−( f (D1 )+E))/10 check is the probability that x of κ pulses fell into Binα , by
=ζ the probability of satisfying the test in that event, p0α,r (x):

α
β

!
where ζ, from (12), represents the room-per-pulse available α

to the adversary to add energy into the channel. Pnoise (α, β, r, κ) = ∑ p0α,r (x) · x κ−x
α+β

(32)
x=0 κ
We now calculate pα,β,r,k (x, Γ), similar to (20) as:
x

! where,
x
pα,β,r,k (x, Γ) = pα,β,r,k,x,Γ (g) ·
g
(29) α−x
x
y β−(κ−x)
κ−x

!
∑ 2x r
r−y y
g=0 p0α,r (x) = ∑ α
· ∑r−i
α

i
(33)
y=0 r i=0 r
such that
( This is the probability that an aggregate of y is chosen from
pα,β,r,k,x (g), k + 2x − 4d ≤ α(ζ − 1) Binα , and of ≤ y from Binβ . Since we separate along the
pα,β,r,k,x,Γ (g) =
0, otherwise median, the expected κ is (α + β)/2. Figure 14 plots Pnoise
(30) against α using (32) at κ = (α + β)/2 and β = 100. Intuitively
Using (29), the final adversarial success probability is: (and as the chart confirms), Pnoise −→ 0.5 as α −→ ∞.
! Since a candidate verification code is discarded as noise if
α α
β
the Robust Code Verification check is satisfied with a probabil-
x k−x
Psa (α, β, r, Γ, k) = ∑ pα,β,r,k (x, Γ) · α+β

(31) ity < Pnoise (recall: Fig. 8), the adversary must have a success
x=0 k probability of at least 1 − Pnoise to hide the authentic code
from the receiver. At r = α, Pnoise (80, 100, 80, 40) = 0.53,
Figures 13a and 13b plot Psa in (31). At ζ = 20, Γ is too
and the adversary must thus have a success probability of at
high to reduce Psa , but the Robust Code Verification check
least 0.47. As this is much higher than the calculated prob-
enables the receiver to limit it to Psa < 0.16 × 10−3 . At ζ =
abilities in Section 5.1.2, the adversary will not be able to
10, Psa stops growing beyond 0.73 × 10−4 , which limits the
disguise authentic code as noise. The value 0.53 is a lower-
adversary’s pulses to k = 495 for its highest success chance.
bound; in practice Pnoise should be set ≥ 0.53 depending on
Figure 13c shows the effect of β on Psa ; Psa is almost con-
applications’ requirements and channel conditions.
stant with β, at around 0.2 × 10−3 , and only starts dropping
when β is sufficiently large so that the aggregate energy after
the adversary’s pulses exceeds Γ. At a certain point, increas- 5.2 Validating the Probabilistic Model
ing β no longer helps. For example, at ζ = 5 and β ≥ 400,
The use of prototype implementation using Software Defined
Psa ≈ 0. β should thus be set wisely, reflecting the applica-
Radios (SDRs) and simulations are well-established methods
tion’s sensitivity to distance increases and channel conditions,
for evaluating wireless systems. Existing SDRs do not support
to avoid increasing transmission lengths unnecessarily.
UWB. Therefore, we validate the probabilistic model above
with simulations. The channel condition such as noise, mul-
5.1.3 Symbol length (r) tipath effect, and path loss are important factors to consider
Figures 13d and 13e plot Psa against the ratio of r : α. As while designing a wireless system. The IEEE 802.14.4a [18]
shown, longer symbol length (larger r) is better for security; channel model for different environments is purposefully pro-
the best results are achieved when the ratio is 1 (r = α). vided for UWB. The preamble and the verification code are
converted into physical layer signals using this model for the
outdoor LoS conditions. The model generates the pulse and
5.1.4 False positives: noise passing Robust Code Verifi-
multipath components to resemble the real world effect of the
cation
channel condition. We assume that upper layers, e.g., Medium
Higher-than-usual noise in the channel might satisfy the Ro- Access Control (MAC) layer, could decide on when to per-
bust Code Verification check. Since the receiver backtracks, form enlargement detection so that it doesn’t interfere with
 ·10−4 ·10−4 ·10−4
2 2 4
ζ = 20 ζ=20 ζ=20
ζ = 20 ζ = 20
ζ = 15 10−1 10−1

Probability (Psa )
Probability (Psa )

Probability (Psa )
ζ=10 ζ=10

Probability (Psa )

Probability (Psa )
ζ = 10
ζ = 10
ζ=5 10−2 10−2

10−3 10−3

0 0 0 10−4 10−4
200 300 400 500 60 80 100 200 400 600 800 0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1
# of adversary pulses (k) # of adversary pulses (k) Size of Binβ (β) Ratio (r : α) Ratio (r : α)

(a) β = 500; r = α = 50. (b) β = 50; r = α = 50. (c) r = α = 50. (d) α = 50 and β = 500 (e) α = 50 and β = 50

Figure 13: Adversarial success probability in (31).

The goal of our validation is to (1) confirm the probabilis-

1 tic model’s correctness, and (2) analyze the effect of the pa-
r = a/4 r = a/2 r = a/1
rameters abstracted from the model, namely noise and the
receiver’s ability to reconstruct the signal after long distance
Probability (Pnoise )

0.8
propagation. In practice, the latter point can be accounted for
by increasing the number of pulses (n = α + β)—see below.
0.6 Validating Pbβ>bα . Figure 15 shows the validation for
Pbβ>bα , at a simulated distance between both devices of
0.4
d = 10m. A boxplot is drawn at distinct k, where each sce-
0 20 40
# of high-energy pulses (α)
60 80 nario is run 106 times. The results confirm that abstracting
noise from the model does not largely affect its accuracy. Next
we show the effect of longer distances on the model.
Figure 14: Probability that noise passes the Robust Code
Verification check, calculated using (32); κ = α/2, β = 100. Validating Psa . Figure 16 shows the validation for Psa , at
r = α and Pnoise = 0.8. Results are shown for different k, at
distances of 10m and 100m. Each scenario is run 106 times,
other ranging applications. The simulations account for the and Psa is calculated as the proportion of these where the
noise and interference due to the noise figure of the receiver adversary succeeded to hide the authentic code. Again the
and multipath components. To verify the simulation setup, we results show comparable patterns between the model and
performed a thorough evaluation to cross-check simulation simulations. There is a slight horizontal shift at k due to the
metrics with previous proof-of-concept implementation [26]. abstracted noise. In the simulator, Γ is set as in (9), which may
Each pulse uses 500 MHz bandwidth, and the sampling time be a bit too high or low depending on actual noise patterns. In
between consecutive pulses is 1 µs. Transmission power is Fig. 16a, Γ was relatively low, causing a drop in the simulated
limited to -35 dBm/MHz, well under the limits applied by the Psa at smaller k compared to the model. In Fig. 16b, Γ was
FCC/ETSI regulations [11]. The energy is further reduced to relatively high, replicating Psa at higher k.
adapt to path loss model and extra losses (E; cf. Fig. 9). Another difference between simulations and the model
An adversary is simulated to inject k signals to annihilate manifests with increasing the distance d between both de-
or distort the authentic code, and to replay a delayed and vices. In practice, in UWB, receivers increase their ability
amplified versions of the authentic signals. Similar to our to reconstruct the signals (hence, the SNR) by aggregating
assumptions, the adversary in the simulator is capable of over more pulses. We noticed that the model provides such
annihilating the pulse and its multipath if the phase is guessed comparable probability patters when we decrease α and β
correctly; it doubles the amplitude of the pulse otherwise. in the model proportionally with increasing d in simulations.
The time difference between authentic and delayed signals is For example in Fig. 16b where d = 100m, α and β in the
δ = 200ns in the simulations (see Fig. 7). simulator had to be increased from 15 and 158 to 50 and 500
Before demodulation, additive white Gaussian noise respectively (∼ tripled) to account for the increased distance.
(AWGN) is added to the signal. The receiver in Section 2.1 is Validating the false positives. We also used simulations
implemented for code verification; it always locks on to the to confirm that noise would not be falsely mistaken for au-
highest peak, i.e., the peak generated by the adversary due thentic code upon proper selection of Pnoise and Γ. For various
to its replay attack. The communication range is considered distances between 10m and 100m, the probability of a false
100m, and the backtracking restricted to 660ns. positive was ∼ 1 × 10−6 , confirming the noise analysis in
 Probabilistic Model Simulation Results (box plots)
1 1 0.3 1 1 0.3
Pbβ>bα

Pbβ>bα

Pbβ>bα

Pbβ>bα

Pbβ>bα

Pbβ>bα
0 0 0 0 0 0
0 k 100 0 k 100 0 k 100 0 k 200 0 k 200 0 k 200

(a) {50,50,1} (b) {50,50,2} (c) {50,50,8} (d) {50,150,1} (e) {50,150,2} (f) {50,150,8}

Figure 15: Probability of adversary’s failure calculated using (19), and simulations results validating the probabilistic derivations.
Each scenario is run with the {α, β, r} parameters shown in the charts’ individual captions.

sary can then utilize its knowledge of n, α and β in order

Prob. Model: α = 20, β = 204 Prob. Model: α = 15, β = 158 to, not only decide the optimal value of k statically before
Sim: d = 10, α = 50, β = 500 Sim: d = 100, α = 50, β = 500
the transmission begins, but also adjust their distribution in
·10−4 ·10−4
1.5 6 realtime. This attack does not succeed because the adversary
cannot control the resultant pulse phase. Injecting excessive
Probability (Psa )

Probability (Psa )

1 4
energy in Binβ exceeds Γ; injecting in Binα does not guaran-
tee annihilation because of the unpredictable phase.
0.5 2
Varying energy levels. To achieve perfect signal annihila-
tion, an adversary uses the same amplitude expected at the
receiver. Instead of injecting k pulses each with a constant en-
0 0
0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1 ergy of, e.g., 2µW , the adversary can inject one pulse with an
# of adversary pulses (k) # of adversary pulses (k)
energy of, e.g., 2kµW . If all k pulses fell in Binβ , the aggregate
(a) (b) energy would be the same as when that single high-energy
pulse also falls in Binβ . However, intuitively, the adversary
Figure 16: The attack is detected when the aggregate energy is better off injecting multiple pulses with constant energies
is between γ and Γ, but Pbβ>bα is more than Pnoise . The attack for two reasons. First, multiple pulses in Binβ have higher
is also detected when energy aggregate is more than Γ; ζ = 5. chances of being selected than a single pulse, thus evading
the Robust Code Verification check. Second, for those that
Section 5.1.4. fall in Binα , any leftover energy after annihilating a pulse,
regardless of the phase, will be counted towards the overall
In conclusion, the simulated probabilities follow compara- aggregate, thus hurts the adversary’s cause.
ble patterns with the model, and are in the same range. The Influencing Γ through distance shortening. Instead of
model derived herein thus serves as a formal means for evalu- enlarging distances directly, the adversary can first mount
ating the efficacy and suitability of UWB-ED in practice. The a distance-reduction attack to trick the devices into using
results also show that the channel condition, such as path loss, higher Γ (recall: smaller signal attenuation due to shorter path
noise, and interference due to multipath components, does loss leads to higher Γ calibration). It is thus imperative to
not affect the performance and security of the system. An complement UWB-ED with a distance-reduction detection [5,
adversary can increase the noise level, which can increase 6, 26]. Devices should alternate between both techniques;
false positives. High false positives may eventually cause e.g., if distances of d1 and d2 are verified using respectively
DoS (which the adversary can mount anyway by jamming UWB-ED and a distance-reduction detection technique, it
the channel), but the adversary remains unable to enlarge should be concluded that the actual distance, d, is in the range
distances. d1 ≤ d ≤ d2 (d1 is a lower bound, d2 an upper).
Influencing the number of pulses, n. An adversary can
6 Discussion inject a low stream of noise-like energy, not too high to be
detected as jamming. However because Γ is set beforehand,
Adaptive attacks. An adversary can notice the effect of each it is not influenced by the adversary. By injecting noise, the
of its added pulses on the resultant energy, whether annihi- adversary actually hurts its own cause as it reduces the amount
lated or amplified. It can then adapt its attack strategy by of energy it can use strategically to prevent code detection.
dynamically deciding k based on the number of pulses it has Integrating UWB-ED with 802.15.4z and 5G. The
added/annihilated so far during the transmission. The adver- 802.15.4z enhanced impulse radio task group is defining a
series of physical layer improvements to provide secure and 8 Conclusion
precise ranging [2]. Those include additional coding, pream-
bles, and improvement to existing modulations to increase We present UWB-ED—the first known technique to detect
ranging integrity and accuracy. UWB-ED is a potential can- distance-enlargement attacks against standard UWB ranging
didate for enlargement detection in 802.15.4z. It adheres to systems. UWB-ED is readily deployable for current off-the-
the low pulse repetition (LRF) mode frequency (1-2 MHz), shelf receivers, requiring no additional infrastructure. Evalua-
works with non-coherent receivers, and supports up to 100m. tion is performed by deriving the probability of adversarial
success in mounting distance enlargement attacks. Results
The 3GPP technical specifications groups are designing show that the verification code structure herein prevents signal
the 5G-new radio technology, and it aims to include secure annihilation. The code also allows the use of longer symbol
and precise ranging based on wireless signals [16,33]. Proper- length at the receiver, which is essential to achieve longer
ties such as high carrier frequencies, large bandwidths, large distance in the energy constrained UWB system. UWB-ED is
antenna arrays, device-to-device communication, and ultra- thus a good candidate for enlargement detection in practice
dense networking will help attain this objective. It is early to (e.g., for 802.15.4z and 5G).
say the exact modulation techniques 5G will use for distance
measurement, but it is safe to assume that wideband will be
used to attain position accuracy; beamforming techniques will References
achieve long distances. This system is equivalent to setting
r = 1 herein without restrictions on α, as transmission power [1] 3db. 3db Access AG - 3DB6830 ("proximity based
restrictions imposed on UWB do not apply to 5G. However, access control"). https://www.3db-access.com/
the security of 5G can be increased further, as it allows for Product.3.html. [Online; Accessed 22. October
the use of beamforming and coherent receivers. 2018].

[2] Task Group 4z. IEEE 802.15 WPAN "enhanced im-

pulse radio". http://www.ieee802.org/15/pub/
TG4z.html. [Online; Accessed 22. October 2018].

7 Related Work [3] P. Bahl and V. N. Padmanabhan. RADAR: an in-

building RF-based user location and tracking system.
In IEEE INFOCOM, volume 2, pages 775–784, 2000.
Detecting enlargement attacks has lately been a prominent
research area. Previous literature explored timing acquisition [4] K. Bauer, D. McCoy, E. Anderson, M. Breitenbach,
at the preamble, and data ambiguity at payload. Taponecco et G. Grudic, D. Grunwald, and D. Sicker. The Directional
al. [27] show that the success of enlargement attacks using re- Attack on Wireless Localization -or- How to Spoof Your
play (or overshadowing) depends on the amount of delay the Location with a Tin Can. In IEEE GLOBECOM, pages
adversary introduces. Such success is harder for controllable 1–6, 2009.
attacks, where the adversary is required to position nodes at [5] Ioana Boureanu, Aikaterini Mitrokotsa, and Serge Vau-
specific locations. Compagno et al. [8] provide a probabilis- denay. Towards Secure Distance Bounding. Cryptol-
tic model for the success of overshadowing attacks, which ogy ePrint Archive, Report 2015/208, 2015. https:
captures different channel conditions and leading edge detec- //eprint.iacr.org/2015/208.
tion techniques for ToA estimation. None of the above efforts
considered adversarial signal annihilation. [6] Stefan Brands and David Chaum. Distance-bounding
protocols. In EUROCRYPT, pages 344–359. Springer,
Tippenhauer et al. [29] explored a theoretical approach to
1994.
detect adversarial signal annihilation for distance enlargement:
using a single pulse-per-symbol (consecutive integration win- [7] M. Cagalj, S. Čapkun, R. Rengaswamy, I. Tsigkogian-
dows represent a symbol). They found that modulation with a nis, M. Srivastava, and J. Hubaux. Integrity (I) codes:
2ns slot size, i.e., mostly equivalent to a pulse width, might message integrity protection and authentication over in-
help detect signal annihilation. This, however limits the rang- secure channels. In IEEE Symposium on Security and
ing technique to short distances. The effect of multipath on Privacy (S&P), pages 15 pp.–294, 2006.
that scheme in practice is also unclear, since reflected signals
would directly interfere with authentic ones causing distor- [8] A. Compagno, M. Conti, A. A. D’Amico, G. Dini, P. Per-
tion (no empty gaps between authentic pulses). In contrast, azzo, and L. Taponecco. Modeling Enlargement Attacks
UWB-ED allows for increased distances by increasing the Against UWB Distance Bounding Protocols. IEEE
symbol length, and the sampling time between consecutive Transactions on Information Forensics and Security,
pulses is sufficient to handle the multipath effect. 11(7):1565–1577, 2016.
 [9] DecaWave. DecaWave "dw1000 product descrip- [21] A. Muqaibel, A. Safaai-Jazi, A. Bayram, and S. M.
tion and applications". https://www.decawave.com/ Riad. Ultra wideband material characterization for in-
products/dw1000. [Online; Accessed 22. October door propagation. In IEEE Antennas and Propagation
2018]. Society International Symposium, volume 4, pages 623–
626, 2003.
[10] D. Dolev and A. Yao. On the security of public key
protocols. IEEE Transactions on Information Theory, [22] Pericle Perazzo, Lorenzo Taponecco, Antonio A.
29(2):198–208, 1983. D’amico, and Gianluca Dini. Secure Positioning in
Wireless Sensor Networks Through Enlargement Mis-
[11] Robert J Fontana and Edward A Richley. Observations
control Detection. ACM Transactions on Sensor Net-
on low data rate, short pulse uwb systems. In IEEE
works, 12(4):27:1–27:32, 2016.
International Conference on Ultra-Wideband (ICUWB),
pages 334–338, 2007. [23] Christina Pöpper, Nils Ole Tippenhauer, Boris Danev,
[12] Shyamnath Gollakota, Nabeel Ahmed, Nickolai Zel- and Srdjan Čapkun. Investigation of Signal and Mes-
dovich, and Dina Katabi. Secure in-band wireless pair- sage Manipulations on the Wireless Channel. In Vijay
ing. In USENIX Security Symposium, 2011. Atluri and Claudia Diaz, editors, Computer Security –
ESORICS 2011, pages 40–59. Springer, 2011.
[13] Humatics. Time Domain’s PulsON ("p440"). http:
//www.timedomain.com/products/pulson-440/. [24] Swiss Post. Drones as transportation ve-
[Online; Accessed 23. October 2017]. hicle. https://www.post.ch/en/about-
us/company/media/press-releases/2017/swiss-
[14] Todd E. Humphreys. Assessing the spoofing threat: De- post-drone-to-fly-laboratory-samples-for-
velopment of a portable gps civilian spoofer. In Institute ticino-hospitals, May 2018.
of Navigation GNSS (ION GNSS), 2008.
[25] Mary-Ann Russon. Drones to the rescue! http://www.
[15] Benjamin Kempke, Pat Pannuto, and Prabal Dutta. Sure- bbc.com/news/business-43906846, May 2018.
Point: Exploiting Ultra Wideband Flooding and Diver-
sity to Provide Robust, Scalable, High-Fidelity Indoor [26] Mridula Singh, Patrick Leu, and Srdjan Čapkun. UWB
Localization. In ACM SenSys, pages 318–319, 2016. with Pulse Reordering: Securing Ranging against Relay
and Physical Layer Attacks. In NDSS, 2019.
[16] Xingqin Lin, Jingya Li, Robert Baldemair, Thomas
Cheng, Stefan Parkvall, Daniel Larsson, Havish Koora- [27] L. Taponecco, P. Perazzo, A. A. D’Amico, and G. Dini.
paty, Mattias Frenne, Sorour Falahati, Asbjörn Grövlen, On the Feasibility of Overshadow Enlargement Attack
and Karl Werner. 5G New Radio: Unveiling the Essen- on IEEE 802.15.4a Distance Bounding. IEEE Commu-
tials of the Next Generation Wireless Access Technol- nications Letters, 18(2):257–260, 2014.
ogy, 2018.
[28] Nils Ole Tippenhauer, Kasper Bonne Rasmussen,
[17] A. F. Molisch. Ultrawideband propagation channels- Christina Pöpper, and Srdjan Čapkun. Attacks on Public
theory, measurement, and modeling. IEEE Transactions WLAN-based Positioning. In ACM/Usenix MobiSys,
on Vehicular Technology, 54(5):1528–1545, 2005. 2009.
[18] A. F. Molisch, D. Cassioli, C. Chong, S. Emami, A. Fort, [29] Nils Ole Tippenhauer, Kasper Bonne Rasmussen, and
B. Kannan, J. Karedal, J. Kunisch, H. G. Schantz, Srdjan Čapkun. Physical-layer Integrity for Wireless
K. Siwiak, and M. Z. Win. A Comprehensive Stan- Messages. Computer Networks, 109(P1):31–38, 2016.
dardized Model for Ultrawideband Propagation Chan-
nels. IEEE Transactions on Antennas and Propagation, [30] Deepak Vasisht, Swarun Kumar, and Dina Katabi.
54(11):3151–3166, 2006. Decimeter-level localization with a single wifi access
point. In USENIX NSDI, pages 165–178, 2016.
[19] Andreas F. Molisch. Wireless Communications. Wiley
Publishing, 2nd edition, 2011. [31] S. Čapkun and J. Hubaux. Secure positioning of wireless
devices with application to sensor networks. In IEEE
[20] Andreas F. Molisch, Kannan Balakrishnan, Chia chin Computer and Communications Societies., volume 3,
Chong, Shahriar Emami, Andrew Fort, Johan Karedal, pages 1917–1928, 2005.
Juergen Kunisch, Hans Schantz, Ulrich Schuster, and
Kai Siwiak. IEEE 802.15.4a channel model - final re- [32] K. Witrisal, G. Leus, G. J. M. Janssen, M. Pausini,
port. In Converging: Technology, work and learning. F. Troesch, T. Zasowski, and J. Romme. Noncoher-
Australian Government Printing Service. [Online; Ac- ent ultra-wideband systems. IEEE Signal Processing
cessed 4. November 2018], 2004. Magazine, 26(4):48–66, 2009.
[33] Henk Wymeersch, Gonzalo Seco-Granados, Giuseppe tioning. Blackwell Transactions in GIS, 13(s1), 2009.
Destino, Davide Dardari, and Fredrik Tufvesson. 5G
mmWave Positioning for Vehicular Networks. Wireless [35] Zebra Technologies. "sapphire dart ultra wideband
Communications, 24(6):80–86, 2017. (uwb) real time locating system 2010.". https:
//www.zebra.com/us/en/solutions/location-
[34] Paul A Zandbergen. Accuracy of iPhone locations: A solutions/enabling-technologies/dart-
Comparison of Assisted GPS, WiFi and Cellular Posi- uwb.html. [Online; Accessed 22. October 2018].