  Secure ranging is poised to play a critical role in several emerging
applications such as self-driving cars, unmanned aerial systems, wireless IoT
devices, and augmented reality. In this paper, we propose a design of a secure
broadcast ranging systems with unique features and techniques. Its
spectral-flexibility, and low-power short ranging bursts enable co-existence
with existing systems such as in the 2.4GHz ISM band. We exploit a set of RF
techniques such as upsampling and successive interference cancellation to
achieve high accuracy and scalability to tens of reflectors even when operating
over narrow bands of spectrum. We demonstrate that it can be implemented on
popular SDR platforms FPGA and/or hosts (with minimal FPGA modifications). The
protocol design, and cryptographically generated/detected signals, and
randomized timing of transmissions, provide stealth and security against denial
of service, sniffing, and distance manipulation attacks. Through extensive
experimental evaluations (and simulations for scalability to over 100
reflectors) we demonstrate an accuracy below 20cm on a wide range of SNR (as
low as 0dB), spectrum 25MHz-100MHz, with bursts as short as 5us.
