Time-of-arrival (ToA) estimation via cross-correlation is an essential building block of time-of-flight ranging. However, in narrowband systems, it is notoriously difficult to protect against distance-decreasing attacks such as Early-Detect/Late-Commit (ED/LC). We present and analyze two new attacks that reshape ranging signals to compromise correlation-based ToA estimation. The first attack multiplies the signal by a symbol-periodic waveform in the time domain, while the second passes it through a negative group delay (NGD) filter. In contrast to ED/LC, our attacks do not require real-time symbol detection or adaptive compensation; they are completely symbol-agnostic. We describe implementation strategies for both attacks and discuss NGD filtering in the context of Bluetooth Channel Sounding (CS), a recent narrowband ranging system. To this end, we simulate an NGD circuit in LTspice and a ToA estimator in MATLAB, demonstrating that the attack can result in distance reductions of up to 18 m against Bluetooth CS RTT ranging. Finally, we verify the feasibility of the NGD approach by building a prototype using commercial off-the-shelf components.

翻译：基于互相关的到达时间（ToA）估计是飞行时间测距的核心基础模块。然而在窄带系统中，抵御如早检测/晚提交（ED/LC）等距离递减攻击历来困难重重。我们提出并分析了两种新型攻击方法，通过重塑测距信号破坏基于相关的ToA估计：第一种攻击在时域上将信号乘以符号周期波形，第二种攻击则使信号通过负群时延（NGD）滤波器。与ED/LC不同，我们的攻击无需实时符号检测或自适应补偿，完全无视符号特性。我们描述了两种攻击的实现策略，并针对蓝牙信道探测（CS）——这一新型窄带测距系统——讨论了NGD滤波的应用。为此，我们使用LTspice仿真了NGD电路，并在MATLAB中构建了ToA估计器，证明该攻击可使蓝牙CS往返时间测距的距离缩减高达18米。最终，我们通过商用现成组件构建原型验证了NGD方法的可行性。