Close enough to unlock — and impossible to fake being close.
Proximity by signal strength is trivially spoofed; proximity by time-of-flight is not. Ultra-wideband ranging measures how long light itself takes to travel to a credential and back, giving an access decision that unlocks only when the device is truly within range — and that a relay cannot shorten.
DomainWireless, secure access
PlatformsFaststream Radio
ScopeUWB ranging to access decision
Binding constraintProximity that a relay attack cannot forge
DisclosureRepresentative programme; customer not named
CONTEXT
Where this started.
Keyless access built on signal strength is insecure: an attacker relays the radio between the credential and the lock, and the lock believes a distant key is near. Ultra-wideband changes the physics. Its wide bandwidth resolves time-of-flight finely enough to measure real distance, and distance measured by time is far harder to fake than distance inferred from signal level.
But the security is a system property, not a chip feature. The ranging exchange has to be bound to a session so it cannot be replayed, the timing has to be tight enough that a relay's added delay is detectable, and the fine UWB timing has to survive real multipath without either false denials or exploitable ambiguity.
So the system is built around trustworthy distance: secure time-of-flight ranging, session binding, and an access decision that fails closed when the distance cannot be established with confidence.
CHALLENGES
4 problems, named.
Stated before any of them had an answer.
01
Signal-strength proximity is broken
Relay attacks defeat any scheme that infers nearness from signal level; the move to time-of-flight is what makes proximity meaningful.
02
Timing must expose the relay
Time-of-flight only stops a relay if the timing is tight enough that the delay a relay adds is detectable; slack is attack surface.
03
Multipath challenges fine timing
UWB's fine time resolution is powerful and delicate; real-world reflections have to be handled without false denials or exploitable ambiguity.
04
The exchange must not replay
A ranging result that can be captured and replayed is no better than a password; each measurement has to be bound to its session.
ARCHITECTURE
How it was built.
Signal strength guesses distance; UWB measures it by the speed of light. The engineering is making that measurement secure, replay-proof and robust to real reflections.
CONTRIBUTION
What Faststream did.
The scope of the work, rather than a capability list.
Time-of-flight ranging — UWB distance measurement that reads real range rather than inferring it from signal level.
Fine-timing handling — exploiting UWB's resolution while managing the multipath that makes it delicate.
Session binding — tying each ranging exchange to its session so a captured measurement cannot be replayed.
Tight timing budget — keeping the exchange tight enough that a relay's added delay is detectable.
Fail-closed decision — refusing when distance cannot be established with confidence rather than guessing.
Credential identity — combining who with where so proximity alone is not authority.
WHAT WAS HARD
The parts that consumed the schedule.
Rarely the subsystem that sounds difficult.
01
Making proximity unforgeable
The whole point is a distance an attacker cannot shorten; achieving that means tight timing and session binding, not just a UWB radio.
02
Fine timing in the real world
UWB resolution is easily degraded by multipath; keeping the ranging accurate and secure amid reflections is the delicate part.
03
Fail-closed without frustration
Refusing under ambiguity is correct but must not deny legitimate users routinely; setting that boundary takes care.
04
Binding without latency
Session binding has to prevent replay without making the unlock feel slow, which is a real design tension.
OUTCOME
What resulted.
Proximity that can't be relayed
An unlock that happens only when the credential is genuinely near, resistant to relay attack.
Distance by time of flight
Real range measured by UWB timing rather than spoofable signal strength.
Replay-proof
Each ranging exchange bound to its session so measurements cannot be captured and reused.
Fails closed, stays usable
Refuses under attack or ambiguity without denying legitimate access in normal use.
Confidentiality
Customer projects are presented at property, capability, outcome and integration level. Customer names, internal architecture, confidential deliverables and commercial terms are not disclosed. Where a detail would identify a customer it is omitted rather than approximated. More is available under a non-disclosure agreement, within the limits the customer has agreed.
Why is UWB more secure than Bluetooth signal-strength proximity?
Because it measures distance by time of flight rather than inferring it from signal strength. Signal-strength proximity is trivially defeated by a relay attack: an attacker amplifies or forwards the signal so a distant credential looks near. Ultra-wideband's wide bandwidth resolves how long the signal actually takes to travel to the credential and back, and distance measured by time is far harder to fake, because a relay necessarily adds delay that tight timing can detect.
02
Does using a UWB chip make the system secure by itself?
No — security is a system property. The UWB radio provides the fine timing, but stopping relay and replay attacks requires binding each ranging exchange to its session so a measurement cannot be captured and reused, keeping the timing budget tight enough that a relay's delay is detectable, and failing closed when confidence is low. A UWB link without those properties measures distance accurately but is not secure.
03
What does 'fail closed' mean for access?
It means the safe default is to refuse. When multipath, jamming or an active attack makes the distance uncertain, the system treats that uncertainty as a reason to deny access rather than to guess and possibly unlock for an attacker. The design work is setting that boundary so genuine attacks and ambiguity are refused while legitimate users in ordinary conditions are not routinely turned away.