Detecting Non-Line-of-Sight Channel Spoofing in Time-of-Flight Ranging

Wireless ranging estimates the distance between two devices and is a core component of localisation systems. Ranging measurements from multiple reference are combined to estimate an object’s current position, so localisation requires reliable and accurate ranging measurements. Time-of-Flight(ToF) ranging with Ultrawideband(UWB) has received renewed attention due to its growing prevalence, e.g. increased availability of chipsets supporting the IEEE 802.15.4a standard for UWB ranging, and the introduction of UWB in Apple and Android phones to support item tracking, e.g. AirTags, and access control, e.g. keyless entry. However, UWB has long been considered a prominent wireless ranging technology, which has distinguished itself from other wireless ranging approaches with its ability to achieve highly accurate distance estimates. The expected accuracy of UWB ranging, however, is generally achieved in line-ofsight( LOS) conditions, with distance error increasing significantly in non-line-ofsight( NLOS) conditions, i.e. when an obstacle in the ranging path forces the signal to travel around or through it. The impact of these ranging errors can be reduced if we can 1) detect if ranging was done under NLOS conditions (NLOS identification), and 2) correct the ranging distance (NLOS mitigation). Existing methods for NLOS identification and mitigation are built on classification and regression models, respectively, operating with channel impulse response (CIR) data. However, attacks have been demonstrated where adversaries interfere with a LOS ranging transmission so that it appears to occur under NLOS conditions, i.e. spoofing an NLOS CIR. This potentially results in the system over-correcting, e.g. distance estimate reduction, a non-existent NLOS error so the sender appears closer to the receiver than is the case. NLOS identification and mitigation methods are needed to ensure reliable ranging operation in real-world environments, so there is a need for making these methods resistant to NLOS spoofing attacks for UWB ranging to support both reliable and secure localisation. We address this problem by developing methods to distinguish true NLOS channel conditions from spoofed NLOS channel conditions. Specifically, we will study and characterise the features of NLOS CIRs spoofed under both LOS and NLOS conditions and then develop new methods that leverages this knowledge to detect spoofed CIRs. Using CIR characteristics to detect distance spoofing can also be implemented without modifications to current UWB receivers but is an unexplored topic in literature. Our project would therefore improve current UWB ranging systems while also having scientific merit in initiating early formative work on attack-resistant methods for NLOS identification and mitigation.