METHOD, DEVICE AND SYSTEM FOR VERIFYING UWB RANGING RESULTS

Abstract

There is described a method of verifying a time-of-flight based ranging result in a UWB ranging device, the method comprising: exchanging a sequence of messages between the UWB ranging device and a further UWB ranging device as part of a double-sided ranging process to obtain round times and response times at both the UWB ranging device and the further UWB ranging device; estimating a time-of-flight value based on the round times and response times; and verifying the ranging result by performing a consistency check based on the estimated time-of-flight value and one or more predetermined parameter values. Furthermore, a UWB ranging device and a UWB ranging system are described.

Claims

1. A method of verifying a time-of-flight based ranging result in a UWB ranging device, the method comprising: exchanging a sequence of messages between the UWB ranging device and a further UWB ranging device as part of a double-sided ranging process to obtain round times and response times at both the UWB ranging device and the further UWB ranging device; estimating a time-of-flight value based on the round times and response times; and verifying the ranging result by performing a consistency check based on the estimated time-of-flight value and one or more predetermined parameter values.

2. The method according to claim 1, wherein the consistency check comprises a first consistency check, said first consistency check comprising: checking that the estimated time-of-flight value is between zero and a predetermined maximum time-of-flight value.

3. The method according to claim 1, further comprising: estimating a relative frequency factor based on the round times and response times, the relative frequency factor being indicative of a ratio between the frequencies of the UWB ranging device and the further UWB ranging device, wherein the consistency check is further based on the estimated relative frequency factor.

4. The method according to claim 3, wherein the consistency check comprises a second consistency check, said second consistency check comprising: calculating a first single-sided time-of-flight value based on the round time (T.sub.rnd1) of the UWB ranging device, the response time of the further UWB ranging device, and the relative frequency factor; calculating a second single-sided time-of-flight value based on the round time of the further UWB ranging device, the response time of the UWB ranging device, and the relative frequency factor; and checking that both the calculated first single-sided time-of-flight value and the calculated second single-sided time-of-flight value are within a predetermined range around the estimated time-of-flight value.

5. The method according to claim 3, wherein the consistency check comprises a third consistency check, said third consistency check comprising: determining a carrier frequency offset value for each message in the sequence of messages; and checking that the carrier frequency offset values match each other and a control value within a predetermined tolerance range, wherein the control value is based on the relative frequency factor and the carrier frequency.

6. The method according to claim 3, wherein the double-sided ranging process comprises two cycles, each cycle comprising exchanging the sequence of messages between the UWB ranging device and the further UWB ranging device and estimating a respective time-of-flight value and relative frequency factor, wherein the consistency check comprises a fourth consistency check, said fourth consistency check comprising: determining a first time distance between corresponding transmission or reception of a selected message at the UWB ranging device in each of the two cycles; determining a second time distance between corresponding reception or transmission of the selected message at the further UWB ranging device in each of the two cycles; calculating a long-term frequency ratio based on the first time distance, the second time distance, and the corresponding time-of-flight values; and checking that each of the relative frequency factors match the calculated long-term frequency ratio within a predetermined tolerance range.

7. The method according to any one of claim 3, wherein the double-sided ranging process comprises two cycles, each cycle comprising exchanging the sequence of messages between the UWB ranging device and the further UWB ranging device, wherein the consistency check comprises a fifth consistency check, said fifth consistency check comprising: determining a first time distance between corresponding transmission or reception of a selected message at the UWB ranging device in each of the two cycles; determining a second time distance between corresponding reception or transmission of the selected message at the further UWB ranging device in each of the two cycles; estimating a further relative frequency factor based on the first time distance and the second time distance; calculating a time error based on the round times, the response times, and the further relative frequency factor; and checking that the time error is below a predetermined time error threshold value.

8. The method according to claim 3, further comprising: estimating a frequency difference between the UWB ranging device and the further UWB ranging device, wherein the consistency check is further based on the estimated frequency difference.

9. The method according to claim 8, wherein the consistency check comprises a sixth consistency check, said sixth consistency check comprising: estimating a first frequency value and a second frequency value based on the frequency difference and the relative frequency factor, wherein the first frequency value corresponds to the frequency of the UWB ranging device, and wherein the second frequency value corresponds to the frequency of the further UWB ranging device; checking, as a first check, that the estimated first frequency value is within a first predetermined range around a nominal frequency value; and checking, as a second check, that the estimated second frequency value is within a second predetermined range around the nominal frequency value, wherein the sixth consistency check is passed if both the first check and the second check are passed.

10. The method according to claim 9, wherein the consistency check comprises a seventh consistency check, said seventh consistency check comprising: estimating a third frequency value and a fourth frequency value based on the estimated first frequency value, the estimated time-of-flight value, the nominal frequency value, the round times, and the response times, wherein the third frequency value corresponds to the frequency of the further UWB ranging device during a time period corresponding to the response time of the further UWB ranging device, and wherein the fourth frequency value corresponds to the frequency of the further UWB ranging device during a time period corresponding to the round time of the further UWB ranging device; calculating a difference between the third frequency value and the fourth frequency value; and checking that the calculated difference is within a predetermined range around zero.

11. The method according to claim 9, wherein the consistency check comprises an eighth consistency check, said eighth consistency check comprising: estimating a fifth frequency value and a sixth frequency value based on the estimated second frequency value, the estimated time-of-flight value, the nominal frequency value, the round times, and the response times, wherein the fifth frequency value corresponds to the frequency of the UWB ranging device during a time period corresponding to the round time of the UWB ranging device, and wherein the sixth frequency value corresponds to the frequency of the UWB ranging device during a time period corresponding to the response time of the UWB ranging device; calculating a difference between the fifth frequency value and the sixth frequency value; and checking that the calculated difference is within a predetermined range around zero.

12. The method according to claim 8, wherein the consistency check comprises a ninth consistency check, said ninth consistency check comprising: calculating a further estimate of the frequency difference between the UWB ranging device and the further UWB ranging device based on the estimated relative frequency factor and the nominal frequency; and checking that the further estimate of the frequency difference is within a predetermined range around the estimated frequency difference.

13. The method according to claim 1, wherein the consistency check comprises a plurality of consistency checks, and wherein verifying the ranging result requires that each of said plurality of consistency checks passes.

14. A UWB ranging device configured to perform the steps of the method according to claim 1.

15. A UWB ranging system, comprising: a UWB ranging device; and a further UWB ranging device, wherein the UWB ranging device and the further UWB ranging device are configured to exchange a sequence of messages as part of a double-sided ranging process to obtain round times and response times at both the UWB ranging device and the further UWB ranging device, and wherein at least one of the UWB ranging device and the further UWB ranging device is further configured to: estimate a time-of-flight value based on the round times and response times, and verify the ranging result by performing a consistency check based on the estimated time-of-flight value and one or more predetermined parameter values.

16. The method according to claim 2, further comprising: estimating a relative frequency factor based on the round times and response times, the relative frequency factor being indicative of a ratio between the frequencies of the UWB ranging device and the further UWB ranging device, wherein the consistency check is further based on the estimated relative frequency factor.

17. The method according to claim 4, wherein the consistency check comprises a third consistency check, said third consistency check comprising: determining a carrier frequency offset value for each message in the sequence of messages; and checking that the carrier frequency offset values match each other and a control value within a predetermined tolerance range, wherein the control value is based on the relative frequency factor and the carrier frequency.

18. The method according to claim 4, wherein the double-sided ranging process comprises two cycles, each cycle comprising exchanging the sequence of messages between the UWB ranging device and the further UWB ranging device and estimating a respective time-of-flight value and relative frequency factor, wherein the consistency check comprises a fourth consistency check, said fourth consistency check comprising: determining a first time distance between corresponding transmission or reception of a selected message at the UWB ranging device in each of the two cycles; determining a second time distance between corresponding reception or transmission of the selected message at the further UWB ranging device in each of the two cycles; calculating a long-term frequency ratio based on the first time distance, the second time distance, and the corresponding time-of-flight values; and checking that each of the relative frequency factors match the calculated long term frequency ratio within a predetermined tolerance range.

19. The method according to any one of claim 4, wherein the double-sided ranging process comprises two cycles, each cycle comprising exchanging the sequence of messages between the UWB ranging device and the further UWB ranging device, wherein the consistency check comprises a fifth consistency check, said fifth consistency check comprising: determining a first time distance between corresponding transmission or reception of a selected message at the UWB ranging device in each of the two cycles; determining a second time distance between corresponding reception or transmission of the selected message at the further UWB ranging device in each of the two cycles; estimating a further relative frequency factor based on the first time distance and the second time distance; calculating a time error based on the round times, the response times, and the further relative frequency factor; and checking that the time error is below a predetermined time error threshold value.

20. The method according to claim 4, further comprising: estimating a frequency difference between the UWB ranging device and the further UWB ranging device, wherein the consistency check is further based on the estimated frequency difference.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0054] FIG. 1 shows an exemplary message exchange between two UWB ranging devices during a double-sided ranging process.

[0055] FIG. 2 illustrates one example of frequency manipulation during a double-sided ranging process.

[0056] FIG. 3 illustrates an exemplary principle of detecting the frequency manipulation shown in FIG. 2.

[0057] FIG. 4A and FIG. 4B show two further exemplary principles of detecting frequency manipulation.

[0058] FIG. 5 shows a flow diagram of a method for verifying a ranging result in accordance with the present disclosure.

[0059] FIG. 6 shows a block diagram of a ranging device according to the present disclosure.

DETAILED DESCRIPTION

[0060] The illustration in the drawing is schematic. It is noted that in different figures, similar or identical elements are provided with the same reference signs or with reference signs, which differ only within the first digit.

[0061] FIG. 1 shows an exemplary message exchange between two UWB ranging devices A and B during a double-sided ranging process as known in the art. The UWB ranging device A may be a mobile device (either a dedicated ranging device or a more complex electronic device with ranging functionality, such as a smartphone) while the further UWB ranging device B may be a stationary device, also referred to as an anchor, within an UWB ranging network. The ranging device A initiates the ranging process (and may therefore also be referred to as the initiator) by transmitting a POLL message to the further ranging device B (which may also be referred to as the responder). At this stage, the offset of the internal clock frequency ƒ.sub.A of the ranging device A (relative to a given nominal frequency ƒ.sub.n) is Δƒ.sub.A, while the corresponding offset of the internal clock frequency ƒ.sub.B of the further ranging device is Δƒ.sub.B. The POLL message is received at the further ranging device B (the actual duration of the transmission is the sought “time of flight”, often abbreviated tof or ToF. In response, the further ranging device B transmits a RESP message which is then received at the ranging device A. The time between receiving the POLL message at the further ranging device B and transmitting the RESP message is denoted the response time of the further ranging device B, T.sub.rsp1, while the time between transmitting the POLL message from the ranging device A and receiving the RESP message at the ranging device A is denoted the round time of the ranging device A, T.sub.rnd1.

[0062] In response to receiving the RESP message, the ranging device A transmits a FINAL message to the further ranging device B. The time between receiving the RESP message at the ranging device A and transmitting the FINAL message is denoted the response time of the ranging device A, T.sub.rsp2, while the time between transmitting the RESP message from the further ranging device B and receiving the FINAL message at the further ranging device B is denoted the round time of the further ranging device B, T.sub.rnd2. The round times and response times are measured by the respective ranging devices A, B and exchanged between the ranging devices A and B, such that each of the ranging device A and B can estimate a corresponding time-of-flight value tof, e.g., utilizing the following known formula:

[00001]$\mathrm{tof}=\frac{T_{\mathrm{rnd}1}{T}_{\mathrm{rnd}2}-T_{\mathrm{rsp}1}{T}_{\mathrm{rsp}2}}{T_{\mathrm{rnd}1}+T_{\mathrm{rnd}2}+T_{\mathrm{rsp}1}+T_{\mathrm{rsp}2}}$

[0063] However, if the frequency of one or both of the ranging devices A and B is manipulated during the exchange of messages described above, i.e., if the frequency offset Δƒ.sub.A1 during the round time T.sub.rnd1 and/or the frequency offset Δƒ.sub.A2 during the response time T.sub.rsp2 differs from the initial frequency offset Δƒ.sub.A at the initiator side A, and/or if the frequency offset Δƒ.sub.B1 during the response time T.sub.rsp1 and/or the frequency offset Δƒ.sub.B2 during the round time T.sub.rnd2 differs from the initial frequency offset Δƒ.sub.B at the responder side B, then the round times and/or response times will be inconsistent as they will be measured with a varying clock frequency. This will lead to corresponding errors in the estimated tof values, which will result in corresponding errors in the estimated ranging distance (calculated as d=toƒ.Math.c, where c is the speed of light). The resulting distance error may be large enough (up to several hundred meters) to make the ranging result unusable and insecure in many applications, such as ranging based car opening systems, etc.

[0064] FIG. 2 illustrates one example of frequency manipulation during a double-sided ranging process. As can be seen, the frequency at the initiator side A is constant (ƒ.sub.A1=ƒ.sub.A2) throughout the ranging cycle, whereas the frequency at the responder side B is higher during the response time T.sub.rsp1 than during the round time T.sub.rnd2 (ƒ.sub.B1 >ƒ.sub.B2). Hence, the measured response time T.sub.rsp1 and round time T.sub.rnd2 at the responder side B are measured with different clocks and thus inconsistent.

[0065] In the following, the present disclosure presents a number of ranging consistency checks that can be used—alone or together—to verify the ranging result and detect a wide range of frequency manipulation schemes that may violate the security requirements of UWB ranging system applications.

[0066] A first consistency check comprises checking that the estimated time-of-flight value tof is between zero and a predetermined maximum time-of-flight value. By checking that the estimated tof is not negative, attacks that result in a significantly reduced tof estimate can be detected. Furthermore, by checking that the estimated tof does not exceed a predetermined maximum value, attacks that result in a significantly increased tof estimate, e.g., beyond a value corresponding to a distance that exceeds the physically possible communication range of the ranging device, such as 200m, can be detected. Thus, this first consistency check can exclude extreme ranging results caused by frequency manipulation in a very simple manner. The first consistency check only needs the tof estimate and a predetermined maximum time-of-flight-value as a predetermined parameter value.

[0067] To perform further consistency checks, a relative frequency factor ƒ.sub.r is estimated on the basis of the round times T.sub.rnd1, T.sub.rnd2 and the response times T.sub.rsp1, T.sub.rsp2. The relative frequency factor ƒ.sub.r is indicative of a ratio between the frequency ƒ.sub.A of the ranging device A and the frequency ƒ.sub.B of the further ranging device B and can be calculated as

[00002]$f_r=\frac{f_A}{f_B}=\frac{T_{\mathrm{rnd}1}+T_{\mathrm{rsp}2}}{T_{\mathrm{rsp}1}+T_{\mathrm{rnd}2}}.$

[0068] This formula can be derived based on the assumption that no frequency manipulation has taken place (i.e., ƒ.sub.A =ƒ.sub.A1=ƒ.sub.A2 and ƒ.sub.B=ƒ.sub.B1=ƒ.sub.B2) and the following observations:

[0069] The time between the first frame POLL and the second frame FINAL transmitted by the initiator A must be equal to the time between the first frame POLL and the second frame FINAL received by the responder B, and this time is independent of the actual time-of-flight. Furthermore, the times measured by the initiator and the responder depends on the respective frequency offsets (relative to the nominal frequency ƒ.sub.n). More specifically: [0070] The actual responder response time t.sub.rsp1 depends on the intended response time T.sub.rsp1 and the responder frequency ƒ.sub.B1:

[00003]$t_{\mathrm{rsp}1}=T_{\mathrm{rsp}1}\frac{f_n}{f_{B1}}.$ [0071] The actual initiator response time t.sub.rsp2 depends on the intended response time T.sub.rsp2 and the initiator frequency ƒ.sub.A2

[00004]$t_{\mathrm{rsp}2}=T_{\mathrm{rps}2}\frac{f_n}{f_{A2}}.$ [0072] The measured initiator round time T.sub.rnd1 depends on the actual round time t.sub.rnd1 and the initiator frequency

[00005]$f_{A1}:T_{\mathrm{rnd}1}=t_{\mathrm{rnd}1}\frac{f_{A1}}{f_n}.$ [0073] The measured responder round time T.sub.rnd2depends on the actual round time t.sub.rnd2and the responder frequency

[00006]$f_{B2}:T_{\mathrm{rnd}2}=t_{\mathrm{rnd}2}\frac{f_{B2}}{f_n}.$

[0074] Remembering that t.sub.rsp1+t.sub.rnd2=t.sub.rnd1+t.sub.rsp2 then yields the equation

[00007]$\frac{T_{\mathrm{rsp}1}}{f_{B1}}+\frac{T_{\mathrm{rnd}2}}{f_{B2}}=\frac{T_{\mathrm{rnd}1}}{f_{A1}}+\frac{T_{\mathrm{rsp}2}}{f_{A2}}$

which in case of no frequency manipulation reduces to

[00008]$\frac{T_{\mathrm{rsp}1}+T_{\mathrm{rnd}2}}{f_B}=\frac{T_{\mathrm{rnd}1}+T_{\mathrm{rsp}2}}{f_A}$

[0075] This last equation can then be rearranged to yield the above formula for estimating the relative frequency factor ƒ.sub.r.

[0076] The estimated relative frequency factor ƒ.sub.r. can be used in a second consistency check to extract two single-sided ranging cycles from a double-sided ranging cycle (cf. FIG. 1) and to calculate a first single-sided tof estimate toƒ.sub.SS1 and a second single-sided tof estimate toƒ.sub.SS2 based on the respective round times and the respective response times as follows:

toƒ.sub.SS1=(T.sub.rnd1−T.sub.rsp1.Math.ƒ.sub.r)/2

toƒ.sub.SS2=(T.sub.rnd2.Math.ƒ.sub.r −T.sub.rsp2)/2

[0077] By checking that both the calculated first single-sided time-of-flight value toƒ.sub.SS1 and the calculated second single-sided time-of-flight value toƒ.sub.SS2 are within a predetermined range around the estimated time-of-flight value tof (double-sided), in particular attacks involving frequency manipulation for only one of the measured periods (such as the situation shown in FIG. 2 where ƒ.sub.B1 >ƒ.sub.B2) can be effectively detected. Unfortunately, the frequencies ƒ.sub.B1 and ƒ.sub.B2 can be adjusted in such a way, that all 3 tof values get smaller, all stay consistent, and the attack cannot be detected. Hence, not all frequency manipulations can be detected this way, but this second consistency check makes it extra difficult for an attacker, who must control the frequency offset very precisely.

[0078] The estimated relative frequency factor ƒ.sub.r. can further be used in a third consistency check which comprises determining a carrier frequency offset value for each message in the sequence of messages and checking that the carrier frequency offset values match each other and a control value within a predetermined tolerance range, wherein the control value is based on the relative frequency factor ƒ.sub.r and the carrier frequency ƒ.sub.ƒ.

[0079] More specifically, for non-manipulated systems, the carrier frequency offset measured for the POLL frame, cfo.sub.POLL must equal the offset measured for the FINAL frame, cfo.sub.FINAL, and it must equal the inverted value of the offset measured for the RESP frame, cfo.sub.RESP. Furthermore, it must match the measured frequency ratio ƒ.sub.r:

cfo.sub.POLL=cfo.sub.FINAL=−cfo.sub.RESP=(ƒ.sub.r−1).Math.ƒc, where ƒc is the carrier frequency.

[0080] The estimated relative frequency factor ƒ.sub.r. can further be used in a fourth consistency check. This fourth consistency check aims at detecting the kind of frequency manipulation that is shown in FIG. 2, and the principle of this check is shown in FIG. 3. First of all, the double-sided ranging process comprises (at least) two cycles as shown in FIG. 3, each cycle comprising exchanging the sequence of messages between the UWB ranging device A and the further UWB ranging device B and estimating a respective time-of-flight value (toƒ.sub.(n−1), toƒ.sub.(n)) and relative frequency factor (ƒ.sub.r(n−1), ƒ.sub.r(n)) in the manner discussed above. The fourth consistency check then comprises: determining a first time distance T.sub.CA between corresponding transmission or reception of a selected message (such as POLL) at the UWB ranging device A in each of the two cycles, determining a second time distance T.sub.CB between corresponding reception or transmission of the selected message (such as POLL) at the further UWB ranging device B in each of the two cycles, calculating a long-term frequency ratio ƒ.sub.rLT based on the first time distance T.sub.CA, the second time distance T.sub.CB, and the corresponding time-of-flight values toƒ.sub.(n−1) and toƒ.sub.(n)), and checking that each of the relative frequency factors ƒ.sub.r(n−1) and ƒ.sub.r(n)match the calculated long-term frequency ratio ƒ.sub.rLT within a predetermined tolerance range. The long term frequency ratio ƒ.sub.rLT may in particular be calculated as:

ƒ.sub.rLT=T.sub.CA/(T.sub.CB+toƒ.sub.(n−1)−tOƒ.sub.(n)).

[0081] The estimated relative frequency factor ƒ.sub.r. can further be used in a fifth consistency check. FIG. 4A and FIG. 4B show two exemplary principles of detecting frequency manipulation utilizing the fifth consistency check. Like in the fourth consistency check described above, the double-sided ranging process comprises (at least) two cycles as shown in FIG. 4A and FIG. 4B, each cycle comprising exchanging the sequence of messages between the UWB ranging device A and the further UWB ranging device B. The fifth consistency check then comprises: determining a first time distance T.sub.1 between corresponding transmission or reception of a selected message at the UWB ranging device A in each of the two cycles (such as between transmission of the FINAL message in each of the two cycles as shown in FIG. 4A, or such as between receipt of the RESP message in each of the two cycles as shown in FIG. 4B), determining a second time distance T.sub.R between corresponding reception or transmission of the selected message at the further UWB ranging device B in each of the two cycles (such as between receipt of the FINAL message in each of the two cycles as shown in FIG. 4A, or such as between transmission of the RESP message in each of the two cycles as shown in FIG. 4B), estimating a further relative frequency factor ƒ′.sub.r, based on the first time distance T.sub.1 and the second time distance T.sub.R (e.g., as the ratio T.sub.1/T.sub.R), calculating a time error T.sub.E based on the round times T.sub.rnd1, T.sub.rnd2, the response times T.sub.rsp1, T.sub.rsp2, and the further relative frequency factor ƒ′.sub.r, and checking that the calculated time error T.sub.e is below a predetermined time error threshold value T.sub.e_thr. The time error T.sub.e may in particular be calculated as

T.sub.e=(T.sub.rsp2+T.sub.rnd1)−(T.sub.rsp1+T.sub.rnd2).Math.ƒ′.sub.r.

[0082] To perform even more consistency checks, an estimated frequency difference Δƒ between the UWB ranging device and the further UWB ranging device may be utilized. The frequency difference between initiator A and responder B is normally estimated during reception of a frame, and a precise estimate is needed in order to receive the frame. Typically, the accuracy is better than 1 ppm. The initiator frequency ƒ.sub.A has an offset Δƒ.sub.A from the nominal frequency ƒ.sub.n: ƒ.sub.A=ƒ.sub.n+Δƒ.sub.A. Similarly, the responder frequency ƒ.sub.B has an offset Δ ƒ.sub.B from the nominal frequency ƒ.sub.n: ƒ.sub.B=ƒ.sub.n+Δƒ.sub.B. The frequency difference Δƒis the difference of the initiator frequency ƒ.sub.A and responder frequency ƒ.sub.B:

Δƒ=ƒ.sub.A−ƒ.sub.B=Δƒ.sub.A−Δƒ.sub.B

The estimated frequency difference Δƒ may be used in a sixth consistency check, comprising: estimating a first frequency value IA and a second frequency value fa based on the frequency difference Δƒ and the relative frequency factor ƒ.sub.r, wherein the first frequency value corresponds to the frequency of the UWB ranging device A, and wherein the second frequency value corresponds to the frequency of the further UWB ranging device B, checking, as a first check, that the estimated first frequency value ƒ.sub.A is within a first predetermined range around a nominal frequency value ƒ.sub.n, and checking, as a second check, that the estimated second frequency value ƒ.sub.B is within a second predetermined range around the nominal frequency value ƒ.sub.n. The sixth consistency check is passed if both the first check and the second check are passed. More specifically, the first frequency value is estimated as ƒ.sub.A=Δƒ.Math.ƒ.sub.r/(ƒ.sub.r −1) and the second frequency value is estimated as ƒ.sub.B=Δƒ/(ƒ.sub.r−1). In this exemplary embodiment, the first predetermined range may be ±10ppm and the second predetermined range may be ±15 ppm. The calculations in this sixth consistency check rely on the assumption that there is no frequency manipulation at either side A or B. If the first and/or second checks are not passed, this is an indication that the assumption does not hold and that an attack has happened.

[0083] The estimated frequency difference Δƒ may further be used in a seventh consistency check, comprising: estimating a third frequency value ƒ.sub.B1 and a fourth frequency value ƒ.sub.B2 based on the estimated first frequency value ƒ.sub.A, the estimated time-of-flight value tof, the nominal frequency value ƒ.sub.n, the round times T.sub.rnd1, T.sub.rnd2, and the response times T.sub.rsp1, T.sub.rsp2, wherein the third frequency value ƒ.sub.B1 corresponds to the frequency of the further UWB ranging device B during a time period corresponding to the response time T.sub.rsp1 of the further UWB ranging device B, and wherein the fourth frequency value ƒ.sub.B2 corresponds to the frequency of the further UWB ranging device B during a time period corresponding to the round time T.sub.rnd2 of the further UWB ranging device B, calculating a difference between the third frequency value and the fourth frequency value; and checking that the calculated difference is within a predetermined range around zero. The calculations in this seventh consistency check rely on the assumption that there is no frequency manipulation on the initiator side A. More specifically:

[00009]$t_{\mathrm{rnd}1}=t_{\mathrm{rsp}1}+2\mathrm{tof}.fwdarw.\frac{T_{\mathrm{rnd}1}}{f_A}=\frac{T_{\mathrm{rsp}1}}{f_{B1}}+\frac{2\mathrm{tof}}{f_n}.fwdarw.f_{B1}=\frac{T_{\mathrm{rsp}1}{f}_A}{T_{\mathrm{rnd}1}-2\mathrm{tof}\frac{f_A}{f_n}}{t}_{\mathrm{rnd}2}=t_{\mathrm{rsp}2}+2\mathrm{tof}.fwdarw.\frac{T_{\mathrm{rnd}2}}{f_{B2}}=\frac{T_{\mathrm{rsp}2}}{f_A}+\frac{2\mathrm{tof}}{f_n}.fwdarw.f_{B2}=\frac{T_{\mathrm{rnd}2}{f}_A}{T_{\mathrm{rsp}2}+2\mathrm{tof}\frac{f_A}{f_n}}$

[0084] If the third and fourth frequency values ƒ.sub.B1 and ƒ.sub.B2 differ significantly from each other, an attack involving frequency manipulation has occurred.

[0085] The estimated frequency difference 41 may further be used in an eighth consistency check, comprising: estimating a fifth frequency value(ƒ.sub.A1 and a sixth frequency value ƒ.sub.A2, based on the estimated second frequency value fa, the estimated time-of-flight value tof, the nominal frequency value ƒ.sub.n, the round times T.sub.rnd1, T.sub.rnd2, and the response times T.sub.rsp1, T.sub.rsp2, wherein the fifth frequency value ƒ.sub.A1 corresponds to the frequency of the UWB ranging device A during a time period corresponding to the round time T.sub.rnd1 of the UWB ranging device A, and wherein the sixth frequency value ƒ.sub.A2 corresponds to the frequency of the UWB ranging device A during a time period corresponding to the response time T.sub.rsp2 of the UWB ranging device A, calculating a difference between the fifth frequency value and the sixth frequency value, and checking that the calculated difference is within a predetermined range around zero. The calculations in this eighth consistency check rely on the assumption that there is no frequency manipulation on the responder side B. More specifically:

[00010]$t_{\mathrm{rnd}1}=t_{\mathrm{rsp}1}+2\mathrm{tof}.fwdarw.\frac{T_{\mathrm{rnd}1}}{f_{A1}}=\frac{T_{\mathrm{rsp}1}}{f_B}+\frac{2\mathrm{tof}}{f_n}.fwdarw.f_{A1}=\frac{T_{\mathrm{rnd}1}{f}_B}{T_{\mathrm{rsp}1}+2\mathrm{tof}\frac{f_B}{f_n}}{t}_{\mathrm{rnd}2}=t_{\mathrm{rsp}2}+2\mathrm{tof}.fwdarw.\frac{T_{\mathrm{rnd}2}}{f_B}=\frac{T_{\mathrm{rsp}2}}{f_{A2}}+\frac{2\mathrm{tof}}{f_n}.fwdarw.f_{A2}=\frac{T_{\mathrm{rsp}2}{f}_B}{T_{\mathrm{rnd}2}-2\mathrm{tof}\frac{f_B}{f_n}}$

[0086] If the fifth and sixth frequency values ƒ.sub.A1 and ƒ.sub.A2 differ significantly from each other, an attack involving frequency manipulation has occurred.

[0087] The estimated frequency difference Δƒ may further be used in a ninth consistency check, comprising: calculating a further estimate of the frequency difference Δƒ′ between the UWB ranging device A and the further UWB ranging device B based on the estimated relative frequency factor ƒ.sub.r and the nominal frequency ƒ.sub.n, and checking that the further estimate of the frequency difference Δƒ′ is within a predetermined range around the estimated frequency difference Δƒ. In this consistency check, the estimated frequency difference Δƒ is compared to a further estimate of the frequency difference Δƒ′. The latter may be estimated as follows:

[00011]$f_r=\frac{f_A}{f_B}=\frac{f_n+\Delta f_A}{f_n+\Delta f_B}=\frac{f_n+\Delta f_B-\Delta f_B+\Delta f_A}{f_n+\Delta f_B}=1+\frac{\Delta f_A-\Delta f_B}{f_n+\Delta f_B}=1+\frac{\Delta f}{f_n+\Delta f_B}\approx 1+\frac{\Delta f}{f_n}.fwdarw.\Delta f^{\prime }\approx \left(f_r-1\right)f_n$

[0088] FIG. 5 shows a flow diagram of a method 500 for verifying a ranging result in accordance with the present disclosure.

[0089] The method 500 begins at 510 by exchanging a sequence of messages (POLL, RESP, FINAL as shown e.g., in FIG. 1) between a UWB ranging device, initiator A, and a further UWB ranging device, responder B, as part of a double-sided ranging process to obtain round times T.sub.rnd1, T.sub.rnd2 and response times T.sub.rsp1, T.sub.rsp2 at both the UWB ranging device A and the further UWB ranging device B.

[0090] Then, the method 500 continues at 520 by estimating a time-of-flight value tof based on the round times and response times.

[0091] The method then continues at 530 by verifying the ranging result by performing a consistency check based on the estimated time-of-flight value tof and one or more predetermined parameter values. The consistency check may in particular comprise one, more or all of the above-described first to ninth consistency check. The verification is successful if all applied consistency checks are passed. If the verification fails, an error message or warning may be output to a user and/or operator of the device and/or ranging system.

[0092] FIG. 6 shows a block diagram of a UWB ranging device 601 according to the present disclosure. The ranging device 601 comprises RF circuitry 611 connected to antenna 613 and to processing circuitry 621, which in turn is connected to memory circuitry 631. The processing circuitry 621 is configured to perform the method 500 discussed above utilizing program code and/or parameter values stored in the memory circuitry 631.

[0093] It is noted that, unless otherwise indicated, the use of terms such as “upper”, “lower”, “left”, and “right” refers solely to the orientation of the corresponding drawing.

[0094] It is noted that the term “comprising” does not exclude other elements or steps and that the use of the articles “a” or “an” does not exclude a plurality. Also, elements described in association with different embodiments may be combined. It should also be noted that reference signs in the claims should not be construed as limiting the scope of the claims.