Implementing a Secure BLE Digital Key Using ECDHE and AES-CCM with UWB Ranging for Passive Entry

Implementing a Secure BLE Digital Key Using ECDHE and AES-CCM with UWB Ranging for Passive Entry

Modern passive entry systems for vehicles, buildings, and secure areas demand both high security and precise location awareness. Traditional Bluetooth Low Energy (BLE)-based digital keys are vulnerable to relay attacks, where an attacker extends the range of the legitimate key using a proxy. To counter this, we combine BLE for secure communication and key exchange with Ultra-Wideband (UWB) ranging for accurate distance measurement. This article details a robust architecture that implements a secure digital key using Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key agreement, AES-CCM encryption, and UWB-based ranging for passive entry.

1. System Architecture and Protocol Overview

The system consists of two primary entities: the Digital Key (DK) – typically a smartphone or dedicated fob – and the Vehicle or Access Point (AP). The protocol operates in three phases: Key Agreement and Session Establishment (via BLE), Secure Ranging (via UWB), and Action Triggering (e.g., unlock door).

We assume the DK has been provisioned with a long-term public key (PK_DK) and the AP with its corresponding private key (SK_AP) during a secure initial pairing process (e.g., using out-of-band methods or a trusted PKI). This long-term key pair is used only for authenticating the initial ECDHE exchange.

2. Phase 1: ECDHE Key Agreement over BLE

Before any ranging or action, the DK and AP must establish a short-lived session key. We use ECDHE over the BLE GATT (Generic Attribute Profile) protocol. The steps are as follows:

• Step 1 - Public Key Exchange: The DK generates an ephemeral ECDH key pair (d_DK_eph, Q_DK_eph). The AP generates its own ephemeral pair (d_AP_eph, Q_AP_eph). The DK sends its ephemeral public key Q_DK_eph to the AP, along with a nonce N_DK, all signed using its long-term private key SK_DK. The AP verifies the signature using PK_DK.
• Step 2 - Shared Secret Computation: Both parties compute the shared secret S = ECDH(d_DK_eph, Q_AP_eph) = ECDH(d_AP_eph, Q_DK_eph).
• Step 3 - Session Key Derivation: A key derivation function (KDF), such as HKDF (HMAC-based Extract-and-Expand Key Derivation Function), is used to derive two session keys: an encryption key (K_enc) and an authentication/message integrity key (K_auth). The KDF input includes S, both ephemeral public keys, and both nonces.

// Simplified C-like pseudocode for key derivation
#include <stdint.h>
#include <string.h>
#include "hkdf.h" // Assume HKDF implementation
#include "ecc.h"  // Assume ECC library

#define SHARED_SECRET_LEN 32 // 256-bit key
#define SESSION_KEY_LEN   16 // 128-bit AES key

typedef struct {
    uint8_t k_enc[SESSION_KEY_LEN];
    uint8_t k_auth[SESSION_KEY_LEN];
} session_keys_t;

session_keys_t derive_session_keys(
    const uint8_t *shared_secret,
    const uint8_t *q_dk_eph, size_t q_dk_len,
    const uint8_t *q_ap_eph, size_t q_ap_len,
    const uint8_t *nonce_dk, size_t nonce_len)
{
    session_keys_t keys;
    uint8_t salt[32] = {0}; // Optional salt
    uint8_t info[128];
    size_t info_len = 0;

    // Construct info parameter with public keys and nonces
    memcpy(info + info_len, q_dk_eph, q_dk_len);
    info_len += q_dk_len;
    memcpy(info + info_len, q_ap_eph, q_ap_len);
    info_len += q_ap_len;
    memcpy(info + info_len, nonce_dk, nonce_len);
    info_len += nonce_len;

    // Derive 32 bytes of key material (2 x 16 bytes)
    uint8_t key_material[2 * SESSION_KEY_LEN];
    hkdf_extract_expand(key_material, sizeof(key_material),
                        shared_secret, SHARED_SECRET_LEN,
                        salt, sizeof(salt),
                        info, info_len);

    memcpy(keys.k_enc, key_material, SESSION_KEY_LEN);
    memcpy(keys.k_auth, key_material + SESSION_KEY_LEN, SESSION_KEY_LEN);
    return keys;
}

3. Phase 2: Secure UWB Ranging with AES-CCM Protection

UWB ranging provides centimeter-level accuracy, making it ideal for detecting the exact proximity of the key. The IEEE 802.15.4a/z UWB standards support two-way ranging (TWR) and time difference of arrival (TDOA) methods. We implement a secure TWR protocol where each ranging message is authenticated and encrypted using AES-CCM (Counter with CBC-MAC) with the session keys derived earlier.

The AP sends a ranging poll (R_POLL) encrypted with K_enc and authenticated with K_auth. The DK decrypts it, calculates the round-trip time (RTT), and responds with a ranging response (R_RESP), also encrypted. The AP then computes the distance d = (RTT * c) / 2, where c is the speed of light. The nonce counter (N_AP) prevents replay attacks.

// Pseudocode for secure UWB ranging message structure
typedef struct __attribute__((packed)) {
    uint32_t counter;     // Nonce/sequence number
    uint64_t timestamp_tx; // Transmit timestamp in UWB clock ticks
    uint8_t  reserved[4];  // Padding for AES-CCM
} uwb_payload_t;

typedef struct {
    uint8_t  nonce[12];   // 96-bit nonce (counter + fixed prefix)
    uwb_payload_t payload;
    uint8_t  mic[8];      // Message Integrity Code (AES-CCM output)
} secure_uwb_frame_t;

// Encrypt and authenticate the payload
void send_secure_ranging_poll(session_keys_t *keys, uint32_t counter) {
    secure_uwb_frame_t frame;
    uint8_t nonce[12] = {0};
    memcpy(nonce, &counter, sizeof(counter)); // First 4 bytes = counter

    frame.payload.counter = counter;
    frame.payload.timestamp_tx = get_uwb_timestamp();
    // ... set reserved to zero ...

    // AES-CCM encryption (encrypts payload, generates MIC)
    aes_ccm_encrypt(keys->k_enc, keys->k_auth,
                    nonce, sizeof(nonce),
                    (uint8_t*)&frame.payload, sizeof(uwb_payload_t),
                    frame.mic, sizeof(frame.mic));

    memcpy(frame.nonce, nonce, sizeof(nonce));
    uwb_send_frame(&frame, sizeof(frame));
}

4. Phase 3: Action Triggering Based on Distance Threshold

After several successful secure ranging exchanges, the AP computes a filtered distance estimate (e.g., using a moving average or a Kalman filter). If the distance falls below a predefined threshold (e.g., 1.5 meters for unlock), the AP sends a secure action command (e.g., UNLOCK_DOOR) over BLE. This command is encrypted and authenticated using the same session keys. The DK must respond with an acknowledgment (ACK) to prevent denial-of-service.

5. Performance and Security Analysis

Security: The combination of ECDHE and AES-CCM provides forward secrecy—even if the long-term private key is compromised, past session keys remain secure. The UWB ranging is protected from distance manipulation because each message includes a unique nonce and is authenticated. An attacker cannot forge a valid ranging response without the session keys, thus preventing relay attacks. The use of IEEE 802.15.4a UWB's inherent resistance to multipath interference further strengthens the accuracy of the distance measurement.

Performance: ECDHE key agreement over BLE typically completes in under 100 ms on modern hardware. UWB ranging with AES-CCM adds approximately 10-20 ms per exchange. For a typical passive entry scenario, 3-5 ranging exchanges are sufficient, yielding a total latency of 150-200 ms—well within acceptable limits for user experience. The AES-CCM implementation on a Cortex-M4 class MCU can process a 64-byte payload in under 5 µs, making it suitable for real-time operation.

As noted in the reference materials, UWB technology offers "low power consumption, strong anti-interference ability, and strong penetration" (陆冰琳, 2022). The IEEE 802.15.4a channel model used in those studies is directly applicable to our ranging scenario. Additionally, the hardware design principles from the mining platform (严威, 2020) inform our selection of UWB transceivers (e.g., Decawave DW1000 or Qorvo DWM3000) and antenna placement to minimize NLOS (Non-Line-of-Sight) errors.

6. Conclusion

Implementing a secure BLE digital key with ECDHE and AES-CCM, combined with UWB ranging, creates a robust passive entry system that is resistant to relay attacks and provides sub-meter localization accuracy. The protocol leverages the strengths of both wireless technologies: BLE for low-power, long-range key exchange, and UWB for precise, secure distance measurement. This architecture is not only suitable for automotive passive entry but also for access control in smart buildings and industrial environments where security and precision are paramount.

💬 欢迎到论坛参与讨论： 点击这里分享您的见解或提问