Blog Article
Unlock at Arm’s Length: How Bluetooth Channel Sounding Ends Smart Lock Guesswork
Published on Oct 30, 2026 in Thought Leadership
Signal strength is thrown off by a pocket and faked by a relay. Bluetooth 6.0 Channel Sounding measures true distance, with security built into the measurement.
A homeowner walks up to the front door with groceries. The lock is supposed to open on its own. It doesn’t, so she sets the bags down and digs out her phone.
An hour later she’s in the kitchen, ten feet from the same door. The lock decides she’s “arriving” and opens.
Both failures have the same cause. The lock never knew how far away she was. It guessed.
Signal strength is a poor ruler
Today, most Bluetooth proximity features estimate distance from the Received Signal Strength Indicator (RSSI). A strong signal means close; a weak one means far.
The problem is everything between the two devices. A phone in a back pocket, a body in the way, a metal door frame or a reflection off a hallway wall can each shift the reading enough to move the estimate by meters. Engineers compensate with thresholds, averaging and delays, which make the product slower without making it reliable.
There is also a security problem. Signal strength can be relayed. An attacker near the owner captures the phone’s signal and replays it near the lock, and the lock sees a strong signal and assumes the owner is at the door. The same family of relay attacks has long been used against keyless car entry.
How Channel Sounding measures distance
Channel Sounding replaces the guess with a measurement. Two connected Bluetooth Low Energy devices exchange a structured series of signals across many channels in the 2.4 GHz band and work out the distance between them using two methods:
- Phase-based ranging. Each channel is a slightly different frequency. As the signal travels, its phase rotates by an amount that depends on frequency and distance. Comparing phase across many channels lets the devices calculate distance precisely, and sweeping many frequencies helps separate the direct path from reflections.
- Round-trip timing. The devices time how long a packet takes to travel there and back. It’s less precise than phase on its own, but it sets a hard limit on how close a device can appear to be.
Used together, the two methods cross-check each other. The Bluetooth SIG positions Channel Sounding for digital keys, item finding and access control, where a lock should only open when an authorized device is within a defined distance.
Security built into the measurement
The timing measurement is what defeats a simple relay. A relay can make a signal stronger, but it can’t make it arrive sooner. Every hop adds delay, so a relayed phone looks farther away, not closer.
Channel Sounding also uses randomized sequences and defined security levels to make the measurement itself hard to spoof or tamper with. For a lock maker, the unlock decision moves from “the signal looks strong” to “the authorized device is measured to be within one meter.” Talaria 6 adds device-level protection on top: it is PSA Certified Level 2.
Today, a two-chip feature
Channel Sounding became part of the Bluetooth core specification in September 2024. The first chips to support it came from Bluetooth-focused vendors, and they are Bluetooth-only parts. None of them includes Wi-Fi.
That leaves the designer of a Wi-Fi smart lock, video doorbell or access panel with a familiar problem. To get Wi-Fi for cloud and Matter connectivity and Channel Sounding for secure ranging, the board needs two radios. Often it needs a host processor to coordinate them, too. That means more parts, more board space, more firmware to integrate and more idle power, the same trade-off we described in The Two-Chip Habit.
One chip for the whole lock
Talaria 6 integrates multiprotocol wireless connectivity, supporting Wi-Fi 6, Bluetooth 6.0, Thread and Zigbee, along with Matter, PSA Certified Level 2 security and a high-performance Arm Cortex-M33 application processor.
| What the lock needs | How Talaria 6 handles it |
|---|---|
| Cloud and app connectivity | Wi-Fi 6 (802.11ax) |
| Smart home interoperability | Matter certified |
| Secure, precise proximity | Bluetooth 6.0 with Channel Sounding |
| Thread or Zigbee | Integrated 802.15.4 radio |
| Application processing | Onboard Arm Cortex-M33, running hostless |
| Device security | PSA Certified Level 2 |
| Battery life | Ultra-low-power digital radio, designed for IoT from the ground up |
The result is a lock that keeps its Wi-Fi link to the cloud, talks Matter to the rest of the home, and makes its unlock decision from a secure distance measurement, all on one chip with no host processor.
Beyond the front door
Once a Wi-Fi device can measure distance securely, other products open up:
- Access control. Office doors, gates and elevators that open for an authorized phone or badge within a set zone, and stay shut for one passing in the hallway.
- Presence-aware appliances. A thermostat, display or appliance that wakes when someone is actually standing in front of it, not just in the house.
Finding Wi-Fi devices. Cameras, sensors and tags that can guide a user to within arm’s length, instead of “somewhere nearby.”
Building automation. Zone-based lighting, climate and security that respond to where people are, using devices that are already on the Wi-Fi network.
What to ask before you design in Channel Sounding
- Which methods are supported? Phase-based ranging alone is precise; combined with round-trip timing, it’s far harder to spoof. Security-sensitive products like locks should require both.
- How many antenna paths? Channel Sounding allows up to four. More paths can improve accuracy in cluttered rooms, at the cost of board space and parts.
- How do Wi-Fi and ranging share the radio? Channel Sounding sweeps the same 2.4 GHz band that Wi-Fi and Thread use. Ask how the chip schedules a ranging session around Wi-Fi traffic. Receiver performance in a crowded 2.4 GHz band matters here too.
- What’s the power cost? Measure ranging sessions inside your real wake schedule, not as a standalone bench test.
- Does the security story hold end to end? Secure ranging is only as strong as the device storing the keys. Look for independent certification such as PSA Certified Level 2.
Measure, don’t guess
Signal strength told products roughly where you were. Channel Sounding tells them how far away you are, and makes that answer hard to fake.
Talaria 6 puts that measurement on one multiprotocol chip alongside Wi-Fi 6, Thread, Zigbee, Matter and the application, so the lock, the panel or the doorbell doesn’t need a second radio to get it.
If you’re designing a Wi-Fi product that needs secure proximity, talk to our team about Channel Sounding, or download the Talaria 6 product brief.
Frequently Asked Questions
What is Bluetooth Channel Sounding?
Bluetooth Channel Sounding is a feature introduced in Bluetooth 6.0 that lets two connected Bluetooth Low Energy devices measure the distance between them. It combines phase-based ranging across many channels with round-trip timing, and includes security features that make the measurement hard to spoof.
How is Channel Sounding different from using signal strength?
Signal strength, or RSSI, estimates distance from how strong a signal looks, which walls, bodies and reflections easily distort. Channel Sounding measures distance from the phase and travel time of the signal itself, so it is far more accurate and much harder to fake with a relay attack.
Why does Channel Sounding matter for smart locks?
A smart lock should open only when its authorized owner is actually at the door. Channel Sounding lets the lock base that decision on a secure distance measurement instead of a signal-strength guess, reducing both false unlocks and failed auto-unlocks.