UWB digital keys for doors and car access via mobile app

Implementing UWB Digital Keys for Door/Car Access via Mobile App

UWB (Ultra-Wideband) is not Bluetooth with precise positioning. It's IEEE 802.15.4z, impulse radio with ±10 cm distance and ±5° angle measurement accuracy. iPhone 11+ and modern Android flagships with Qorvo DWM3000 or NXP SR150 can determine precise UWB device position. Hands-Free keys are built on this: phone in pocket → door opens on approach at 0.5–1.5 m. No button press. No NFC app.

How UWB Ranging Works

UWB uses Two-Way Ranging (TWR): device sends pulse, accessory responds, Time-of-Flight computes distance with centimeter accuracy. Unlike Bluetooth RSSI — no multipath interference, walls, body blocking.

Hands-Free unlock architecture:

1. Smartphone starts BLE advertisement when unlocked
2. UWB module in lock detects phone via BLE
3. UWB session initiated for precise distance measurement
4. Distance < 1.5 m + angle in "before door" sector → unlock
5. Distance > 5 m → lock

iOS: NearbyInteraction Framework

Apple opened UWB via NearbyInteraction (iOS 14+). Works only on iPhone 11+ with U1 chip. Accessory must support MFi UWB protocol.

import NearbyInteraction

class UWBKeyManager: NSObject, NISessionDelegate {
    private var session: NISession?

    func startRanging(accessoryToken: Data) {
        session = NISession()
        session?.delegate = self
        session?.delegateQueue = DispatchQueue.main

        guard let config = NINearbyAccessoryConfiguration(accessoryData: accessoryToken, bluetoothPeerIdentifier: peerBLEId) else {
            return
        }
        session?.run(config)
    }

    func session(_ session: NISession, didUpdate nearbyObjects: [NINearbyObject]) {
        guard let object = nearbyObjects.first else { return }

        if let distance = object.distance {
            // distance in meters, accuracy ±10 cm
            if distance < 1.5 {
                triggerUnlock()
            }
        }

        if let direction = object.direction {
            // SIMD3<Float> — direction vector to object
            let isInFront = direction.z < 0 // object before phone
        }
    }

    func session(_ session: NISession, didInvalidateWith error: Error) {
        // NIErrorCode.invalidConfiguration — wrong token
        // NIErrorCode.userDidNotAllow — user declined Nearby Interaction
        restartWithDelay()
    }
}

accessoryToken is cryptographically signed token that accessory transmits via BLE on first discovery. Apple doesn't publicly reveal token format — it's part of MFi UWB Accessory Protocol. Without MFi license on lock manufacturer side, this scheme is unavailable.

Entitlement for NearbyInteraction with accessories: com.apple.developer.nearby-interaction.allow — standard, available without MFi. But NINearbyAccessoryConfiguration requires token from certified MFi UWB accessory.

Android: UWB API (Android 12+)

Google opened UWB via androidx.core.uwb:uwb (Jetpack). Requires device with UWB chip: Pixel 6 Pro+, Samsung Galaxy S21 Ultra+, some OnePlus and Xiaomi models.

implementation("androidx.core.uwb:uwb:1.0.0-alpha08")

class UWBDigitalKeyManager(context: Context) {
    private val uwbManager = UwbManager.createInstance(context)

    suspend fun startRanging(partnerAddress: UwbAddress) {
        val controllerSession = uwbManager.controllerSessionScope()

        val sessionParameters = UwbRangingParameters(
            uwbConfigType = UwbRangingParameters.CONFIG_MULTICAST_DS_TWR,
            complexChannel = controllerSession.uwbComplexChannel,
            peerDevices = listOf(UwbDevice.createForAddress(partnerAddress)),
            updateRateType = UwbRangingParameters.RANGING_UPDATE_RATE_FREQUENT,
            sessionKeyInfo = generateSessionKey()
        )

        controllerSession.prepareSession(sessionParameters)
            .collect { rangingResult ->
                when (rangingResult) {
                    is RangingResult.RangingResultPosition -> {
                        val distance = rangingResult.position.distance?.value ?: return@collect
                        if (distance < 1.5f) triggerUnlock()
                    }
                    is RangingResult.RangingResultPeerDisconnected -> {
                        restartSession()
                    }
                }
            }
    }
}

CONFIG_MULTICAST_DS_TWR — bidirectional ranging with multiple peer support. For one lock, CONFIG_UNICAST_DS_TWR is enough.

Security: Relay Attack Protection

Main radio key vulnerability — relay attack: attacker retransmits BLE/UWB signal, impersonating phone proximity when real phone is far. UWB makes relay attack physically impossible: speed of light limits it, and retransmission delay (>1 μs) detectable by TWR as anomaly.

Additionally: key tokens must be ephemeral (short-lived, refresh via BLE before each ranging), signed with ECDSA-256 private key stored in Secure Enclave (iOS) or Android Keystore.

Lock Hardware

Without UWB support on lock side, all above doesn't work. Partners with ready UWB modules:

• Allegion (Schlage) — UWB locks for commercial property
• dormakaba — CCC Digital Key 3.0 compatible locks
• NXP SR150 eval kit — for custom equipment development

Timeline

Mobile app with UWB ranging and Hands-Free logic (with ready UWB accessory): 2–4 weeks. Development from scratch including lock firmware and UWB module on NXP SR150: 2–4 months. Cost depends on target platform and equipment manufacturer partnerships.