35  UWB Applications and Security

35.1 Start With the Story

UWB applications often sound compelling because distance can feel like proof. Access, asset tracking, robotics, payments, worker safety, and phone-based proximity all still need policy, privacy, fallback, and relay-resistance evidence.

Use this chapter to connect the use case to the security boundary. Ask what distance is allowed to authorize, what it only informs, which attacks matter, and what operational controls keep the application trustworthy.

35.2 In 60 Seconds

UWB applications succeed when distance or position evidence changes an action: unlock, locate, warn, guide, count, or deny. Security is not automatic. Secure ranging, credential handling, freshness, confidence, fallback rules, logging, and privacy controls all have to support the same application policy. Treat UWB as evidence for a decision, not as a magic location label.

35.3 Learning Objectives

By the end of this chapter, you will be able to:

• Match UWB use cases to the distance, zone, position, or proximity evidence they require.
• Explain why secure ranging helps resist relay-style false-proximity claims.
• Separate radio evidence, credential authorization, and application policy.
• Identify privacy and safety risks in UWB location workflows.
• Build an operations checklist for UWB applications after deployment.

35.4 Quick Check: UWB Security

35.5 Secure Ranging as Decision Evidence

The reason UWB is useful in cars, phones, badges, locks, tools, and warehouse tags is not just centimeter-class positioning under good conditions. It is the ability to turn a ranging exchange into decision evidence: close enough to unlock, far enough to deny, inside the safe zone, outside the handoff area, or too uncertain to automate.

That distinction matters because a position estimate by itself does not identify a person, authorize an action, or prove that the measurement is fresh. A robust UWB application joins four checks: credential authorization, time-bounded ranging evidence, policy rules for the physical zone, and a fallback when confidence is low.

Consider a secure cabinet with a policy threshold of 1.2 m. A phone presents a valid credential, then the cabinet receives a UWB result of 0.74 m with a fresh timestamp and normal confidence. That is eligible evidence, but it still must be checked against the right cabinet side, the current work order, and the cabinet state. If the same phone reports 0.74 m from the wrong side of a wall, or the ranging record is 2.5 seconds old when the policy allows only 500 ms, the correct behavior is deny or manual fallback. The distance number did not become false; it became insufficient for the action.

IEEE 802.15.4z adds secure ranging features such as the Scrambled Timestamp Sequence so legitimate devices can bind timing evidence to unpredictable radio material. That helps resist false-proximity claims, but the application still owns privacy, logging, operator override, and retest rules. In a good design, UWB evidence supports the decision while policy decides what to do when the evidence is fresh, stale, strong, ambiguous, or missing.

35.6 Application Fit

The main reason to choose UWB is not that it is new or precise. The reason is that an application has a decision that depends on trusted physical evidence.

UWB application map linking use cases to required evidence and action

Common application families:

• Access and handoff: A device, tool, door, or vehicle needs evidence that the credential is physically near the allowed point.
• Asset tracking: A workflow needs zone, shelf, bay, room, or coordinate evidence for a moving item.
• Safety zones: A machine or process needs separation evidence before it starts, moves, or escalates an alert.
• Robotics and autonomy: A mobile system needs position evidence to operate near people, assets, or boundaries.
• Spatial interfaces: A user experience needs relative direction or nearby-device context.

Each family should name the action it controls. A location estimate that does not change an action is usually not enough reason to add UWB.

35.7 Secure Access Evidence Chain

Secure access requires more than a short distance estimate. The system has to prove the credential is authorized, the ranging exchange is fresh, the measured proximity fits the policy, and the fallback path is safe.

UWB secure access evidence chain from credential to policy action

Review the chain in layers:

• Credential: Who or what is allowed to request the action?
• Freshness: Is the ranging exchange tied to a recent request rather than an old observation?
• Distance evidence: Does time-of-flight evidence support the claimed proximity?
• Policy: Which zone, door, side, tool, or machine state is acceptable?
• Fallback: What happens when evidence is missing, stale, ambiguous, or disputed?
• Audit record: What event, confidence, and policy result is retained for review?

35.8 Relay Resistance

Relay attacks try to make a far credential appear nearby by forwarding messages through another link. UWB secure ranging helps because distance is inferred from timing evidence. Extra path and processing delay should make the credential appear farther away, not closer.

UWB relay-resistance review comparing direct secure ranging with relayed false proximity

Good review language is careful:

• UWB can help resist relay-style false proximity claims when secure ranging, freshness, and policy checks are implemented correctly.
• UWB does not replace credential security, device hardening, physical tamper resistance, or application authorization.
• A system should not accept old positions, low-confidence positions, or positions from the wrong side of a boundary.
• Safety and access systems need deny or fallback behavior, not only an “unlock when near” rule.

35.9 Why RSSI Proximity Fails and ToF Needs Protection

Approach	How it estimates closeness	Attack
RSSI, such as BLE signal strength	Stronger signal looks closer.	A relay, amplifier, antenna change, body shadow, or orientation change moves the signal-strength number without moving the credential.
Naive time of flight	The receiver timestamps a pulse and converts travel time to distance.	A distance-reduction attack tries to make the receiver timestamp an early signal and measure a shorter distance than reality.
Secure UWB with IEEE 802.15.4z STS	The receiver timestamps an unpredictable pulse sequence tied to legitimate ranging material.	Harder to forge, because the attacker should not be able to predict and inject a valid early pulse sequence.

The practitioner question is not “Did we get a range?” It is “Can this range be trusted enough for this action?” Signal strength offers little defense because strength is not distance. Time-of-flight is closer to physics, but only if the receiver timestamps legitimate, unpredictable radio energy rather than a guessed early pulse.

Work the review as a small evidence matrix. In a door pilot, run 50 authorized attempts from inside the allowed side and 50 denied attempts from the outside side. If the allowed side produces 48/50 fresh, high-confidence ranges below 1.2 m, and the outside side produces 0/50 accepted unlock decisions, the boundary rule is behaving. If moving the phone near the wall on the denied side creates 9/50 near readings, the fix is not to ignore side evidence; it is to tighten anchor placement, policy geometry, and fallback handling until wrong-side measurements stop granting the action.

Record both accepted and denied cases because denied cases prove that the safety boundary is real. Use the same discipline for privacy and asset workflows. A hospital asset tag near a doorway might produce 110 raw observations in a shift, but the application may only need 12 entered-zone and left-zone events after stale data, duplicates, and low-confidence estimates are filtered. Keeping every raw coordinate forever can create privacy and governance risk without improving the operational decision.

35.10 STS, Timing, and Acceptance Policy

The IEEE 802.15.4z Scrambled Timestamp Sequence is a cryptographically generated pseudo-random sequence embedded in the ranging exchange. Because the pulse pattern is derived from material shared by legitimate devices, an attacker should not be able to predict the next valid pattern and transmit a convincing early copy. The receiver timestamps energy that correlates with the expected STS, so a forged pulse that does not match should be rejected.

The timing arithmetic explains why policy cannot stop at “near.” Radio waves travel at roughly 300,000,000 m/s, so 1 ns of one-way flight time is about 0.30 m. In a two-way ranging exchange, a 20 ns extra round-trip delay corresponds to about 300,000,000 x 20 ns / 2 = 3 m of extra apparent path. Ordinary relays usually add delay, which should make a credential look farther away. The dangerous distance-reduction attack is different: it tries to make the receiver timestamp an early signal and therefore subtract distance. STS protection is meant to make that early signal unpredictable and unusable.

A concrete access policy combines this physics with application checks. Suppose the unlock zone is 1.2 m, the system records 0.83 m, and the timestamp is 180 ms old. If the credential is authorized, the side-of-door evidence matches, and confidence is high, the policy may allow the action. If an attack path or poor geometry adds enough delay to report 3.8 m, the result should be denied as too far. If a record is stale at 1.6 seconds, or if confidence falls below the acceptance threshold, the result should also be denied or sent to manual fallback even when the distance is numerically below 1.2 m.

Careful wording: UWB secure ranging can help resist relay-style false proximity claims when implemented correctly. It does not replace credential security, device hardening, privacy controls, or operational retesting.

35.11 Quick Check: STS Secure Ranging

35.12 Asset Tracking and Operations

Asset tracking uses UWB differently from secure access. The main risk is not always a malicious relay. The risk is that a position estimate becomes a business fact without enough context.

Useful asset-tracking questions:

• Which event matters: present, absent, entered zone, left zone, near workstation, or moving through a boundary?
• Is the output a coordinate, a zone, a shelf, a bay, or a route state?
• How does the application handle drift, obstruction, stale data, and ambiguous zone boundaries?
• What privacy rules apply when tags are attached to people, badges, tools, or clinical assets?
• Which team owns anchor layout, calibration, tag assignment, firmware, and retest records?

35.13 Safety and Privacy

UWB can support safety workflows, but it should not be the only guard for a hazardous process unless the safety case explicitly supports that role. Position evidence can be blocked, delayed, stale, or interpreted incorrectly.

Privacy review is also required. Fine location evidence can reveal work patterns, personal movement, sensitive visits, or asset usage. A responsible design should limit collection, retention, access, and secondary use.

Privacy and safety controls:

• Collect only the evidence required for the application decision.
• Keep retention and access rules explicit.
• Separate personal identity from tag identity where the workflow allows it.
• Show low-confidence states instead of hiding uncertainty.
• Use independent safety controls where harm could result from a wrong position.
• Record retest triggers after layout, anchor, tag, firmware, policy, or workflow changes.

35.14 Operating Control Loop

UWB applications need operations discipline after installation.

UWB application operations loop covering install, test, monitor, respond, and retest

The loop should include:

• Install record: anchor locations, orientation, power, networking, firmware, and tag assignment.
• Evidence test: representative motion, obstruction, materials, and boundary cases.
• Monitoring: missing data, stale data, low confidence, zone flapping, denied access, and fallback events.
• Incident response: lost credentials, moved anchors, damaged tags, suspicious proximity requests, and privacy complaints.
• Retest: after layout changes, firmware updates, tag model changes, policy edits, and workflow changes.

35.15 Example: Secure Tool Checkout

A facility wants a tool cabinet to open only when an authorized worker is near the cabinet and the tool is checked out to that work order.

Evidence review:

1. The worker credential is authorized for the work order.
2. UWB secure ranging confirms the credential is near the cabinet side that should open.
3. The tool tag is present in the cabinet before checkout and absent after checkout.
4. The application records the decision, confidence, time, and fallback status.
5. A low-confidence or stale result denies the automatic action and requests a manual procedure.

This design uses UWB for proximity evidence, not as the only authorization mechanism.

35.16 Common Mistakes

• Calling UWB automatically safe: Treat UWB as relay-resistant when secure ranging, freshness, and policy are correctly implemented.
• Skipping authorization: A nearby credential still has to be allowed to perform the action.
• Accepting stale position data: Freshness matters for access, safety, and high-value workflows.
• Ignoring the wrong side of a boundary: Near a door is not the same as being on the permitted side.
• Turning every coordinate into a business event: Application rules need confidence, timestamps, and zone logic.
• Forgetting privacy: Fine location evidence requires retention, access, consent, and purpose controls.
• No retest plan: Moved anchors, layout changes, and new materials can change behavior.

35.17 Review Checklist

Before approving a UWB application, confirm:

• The controlled action and required evidence are written down.
• Credential authorization is separate from distance evidence.
• Secure ranging, freshness, confidence, and policy checks are all part of the design.
• Fallback behavior is safer than silent acceptance.
• The application records enough evidence for review without excessive retention.
• Privacy impact and data access rules are documented.
• Real workflow tests include motion, obstruction, boundary cases, and denied cases.
• Owners exist for anchors, tags, firmware, keys, policies, logs, and retest triggers.

35.18 Knowledge Check

35.19 Match Application Needs to Controls

35.20 Order the Secure UWB Review

35.21 Summary

UWB applications should be reviewed as decision systems. Secure ranging can strengthen proximity evidence, but authorization, freshness, confidence, fallback, privacy, and operations controls decide whether the final action is trustworthy. The right question is not “Does this use UWB?” It is “What decision does UWB evidence support, and what happens when that evidence is uncertain?”

35.22 Key Takeaway

UWB applications and security review should connect location accuracy, privacy, spoofing risk, anchor trust, fallback behavior, and operational value.

35.23 Concept Relationships

• Application action defines the evidence requirement.
• Secure ranging strengthens proximity evidence against relay-style claims.
• Authorization decides whether a credential is allowed to act.
• Confidence and freshness decide whether position evidence is usable.
• Privacy controls limit how fine location evidence is collected and retained.
• Operations records keep the system trustworthy after deployment.

35.24 References

• IEEE 802.15.4z-2020: enhanced UWB physical layers and associated ranging techniques.
• FiRa Consortium: UWB secure ranging and interoperability work.
• Car Connectivity Consortium Digital Key: standardized device-to-vehicle access ecosystem using UWB with related technologies.
• NIST Cybersecurity Framework: useful reference for access-control governance, logging, and incident response framing.

35.25 What’s Next

• UWB Fundamentals: study the radio and timing foundations behind UWB evidence.
• UWB Ranging Techniques: compare TWR, TDoA, and AoA method details.
• UWB Positioning Systems: design anchor geometry, engines, and operating records.
• RFID Security and Privacy: compare identity, privacy, and access-control risks across short-range identification systems.