Attack detection in round-trip timing estimation
A wireless device includes a receiver adapted with Bluetooth® low energy (BLE) capability and logic at least one of coupled to or integrated within the receiver. The logic determines frequency samples of bits of a predetermined pattern of a packet during a round-trip timing estimation of the packet, wherein the packet is received during a keyless access attempt of an enclosure having a transmitter and the receiver. The logic compares, to a reference frequency sample, the frequency samples of bits of the predetermined pattern. In response to determining a difference between the reference frequency sample and the frequency samples of bits of the predetermined pattern, the logic detects an intrusion associated with the predetermined pattern.
1. A wireless device comprising:
a receiver adapted with Bluetooth® low energy (BLE) capability; and
logic at least one of coupled to or integrated within the receiver, the logic to:
determine frequency samples of bits of a predetermined pattern of a packet during a round-trip timing estimation of the packet, wherein the packet is received during a keyless access attempt of an enclosure having a transmitter and the receiver;
compare, to a reference frequency sample, the frequency samples of bits of the predetermined pattern; and
in response to determining a difference between the reference frequency sample and the frequency samples of bits of the predetermined pattern, detect an intrusion associated with the predetermined pattern.
2. The wireless device of claim 1 , wherein to compare, to the reference frequency sample, the frequency samples of bits of the predetermined pattern, the logic is to:
compute a first sum of the absolute value of the frequency samples of bits of the predetermined pattern;
compute a second sum of the absolute value of a reference frequency sample value, wherein the reference frequency sample value is pre-computed and stored on the wireless device;
compute a value representing a difference between the second sum and the first sum; and
determine that the value representing the difference between the second sum and the first sum meets or exceeds a first threshold value or is less than a second threshold value.
3. The wireless device of claim 2 , wherein to detect the intrusion associated with the predetermined pattern, the logic is to:
in response to determining that the value representing the difference between the second sum and the first sum meets or exceeds the first threshold value, determine that the intrusion is a high pass filter intrusion; and
in response to determining that the value representing the difference between the second sum and the first sum is less than the second threshold value, determine that the intrusion is one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.
4. The wireless device of claim 1 , wherein to compare, to the reference frequency sample, the frequency samples of bits of the predetermined pattern, the logic is to:
compute a value representing a difference between the frequency samples of bits of the predetermined pattern and a reference frequency sample value; and
perform a correlation between the value representing the difference and an attack pattern.
5. The wireless device of claim 4 , wherein the attack pattern is pre-computed and stored on the wireless device.
6. The wireless device of claim 1 , wherein the intrusion is a high pass filter intrusion.
7. The wireless device of claim 1 , wherein the intrusion is one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.
8. The wireless device of claim 1 , wherein the logic is further to:
send, from the receiver, a notification indicating the intrusion associated with the predetermined pattern.
9. A method comprising:
determining, by logic of a receiver adapted with Bluetooth® low energy (BLE) capability, frequency samples of bits of a predetermined pattern of a packet during a round-trip timing estimation of the packet, wherein the packet is received during a keyless access attempt of an enclosure having a transmitter and the receiver;
comparing, to a reference frequency sample, the frequency samples of bits of the predetermined pattern; and
in response to determining a difference between the reference frequency sample and the frequency samples of bits of the predetermined pattern, detecting an intrusion associated with the predetermined pattern.
10. The method of claim 9 , wherein comparing, to the reference frequency sample, the frequency samples of bits of the predetermined pattern comprises:
computing a first sum of the absolute value of the frequency samples of bits of the predetermined pattern;
computing a second sum of the absolute value of a reference frequency sample value, wherein the reference frequency sample value is pre-computed and stored on a wireless device comprising the receiver;
computing a value representing a difference between the second sum and the first sum; and
determining that the value representing the difference between the second sum and the first sum meets or exceeds a first threshold value or is less than a second threshold value.
11. The method of claim 10 , wherein detecting the intrusion associated with the predetermined pattern comprises:
in response to determining that the value representing the difference between the second sum and the first sum meets or exceeds the first threshold value, determining that the intrusion is a high pass filter intrusion; and
in response to determining that the value representing the difference between the second sum and the first sum is less than the second threshold value, determining that the intrusion is one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.
12. The method of claim 9 , wherein comparing, to the reference frequency sample, the frequency samples of bits of the predetermined pattern comprises:
computing a value representing a difference between the frequency samples of bits of the predetermined pattern and a reference frequency sample value; and
performing a correlation between the value representing the difference and an attack pattern.
13. The method of claim 12 , wherein the attack pattern is pre-computed and stored on a wireless device comprising the receiver.
14. The method of claim 9 , wherein the intrusion is (i) a high pass filter intrusion, or (ii) one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.
15. The method of claim 9 , further comprising:
sending, from the receiver, a notification indicating the intrusion associated with the predetermined pattern.
16. A system comprising:
an antenna;
a transmission device that is to transmit a packet;
a receiving device adapted with Bluetooth® low energy (BLE) capability to receive a predetermined pattern of the packet during a keyless access attempt of an enclosure having the transmission device and the receiving device; and
logic at least one of coupled to or integrated with the receiver, the logic to:
determine frequency samples of bits of the predetermined pattern of the packet during a round-trip timing estimation of the packet;
compare, to a reference frequency sample, the frequency samples of bits of the predetermined pattern; and
in response to determining a difference between the reference frequency sample and the frequency samples of bits of the predetermined pattern, detect an intrusion associated with the predetermined pattern.
17. The system of claim 16 , wherein to compare, to the reference frequency sample, the frequency samples of bits of the predetermined pattern, the logic is to:
compute a first sum of the absolute value of the frequency samples of bits of the predetermined pattern;
compute a second sum of the absolute value of a reference frequency sample value, wherein the reference frequency sample value is pre-computed and stored on the receiving device;
compute a value representing a difference between the second sum and the first sum; and
determine that the value representing the difference between the second sum and the first sum meets or exceeds a first threshold value or is less than a second threshold value.
18. The system of claim 17 , wherein to detect the intrusion associated with the predetermined pattern, the logic is to:
in response to determining that the value representing the difference between the second sum and the first sum meets or exceeds the first threshold value, determine that the intrusion is a high pass filter intrusion; and
in response to determining that the value representing the difference between the second sum and the first sum is less than the second threshold value, determine that the intrusion is one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.
19. The system of claim 16 , wherein to compare, to the reference frequency sample, the frequency samples of bits of the predetermined pattern, the logic is to:
compute a value representing a difference between the frequency samples of bits of the predetermined pattern and a reference frequency sample value; and
perform a correlation between the value representing the difference and an attack pattern.
20. The system of claim 16 , wherein the logic is further to:
send, from the receiver, a notification indicating the intrusion associated with the predetermined pattern.