Robust Location Distinction Using Temporal Link Signatures

1. Robust Location DistinctionUsing Temporal LinkSignatures Presented By Firas Kurdi

2. Article/Research By • Neal Patwari • Department of Electrical and Computer Engineering • The University of Utah • SnehaKasera • School of Computing • The University of Utah • MobiCom '07: Sept Proceedings of the 13th annual ACM international conference on Mobile computing and networking

3. What is location distinction? • Ability to know when a transmitter has changed position • Enabled by the physical layer only • Compared to localization – no coordinates – benefits from multipath – more sensitive, needs less coverage

4. Introduction • Wireless sensor networks • Location estimation should be done once the node is actually moved. • Active RFID • Detect the movement of the object with RFID. • Secure wireless network • Prevent MAC address spoofing attack.

5. Existing Techniques • Accelerometer measurements • additional device • detect changes in velocity • continuous monitoring • Doppler measurements • similar as accelerometer • require continuous transmission • Received signal strength (RSS) measurements • multiple measurements at different receivers • multi-node collaboration

6. Unique Link signature • Desired in – Healthcare, transportation & distribution, shipping, manufacturing, mining, military, … • Idea: • Detect Movement of Objects • most assets should be stationary • focus resources on rare moving assets • Localization Issues: • Coverage, Accuracy, Security

7. Location Estimation in WSNs • Network self-localization expensive – Ranging energy, bandwidth – Communication • Only re-localize when sensor moves • WSN low-energy location distinction: • detect movement w/o collaboration

8. Main Goal • Develop a unique transmitter signature • Impersonation, MAC-address spoofing, traditional crypto methods subject to node compromise • Notice movement by signature change • To avoid continuous transmission, validate with real measurements • Efficiency • energy, • Time • cost

9. Temporal link signatures • Utilizes physical layer characteristic of RF multipaths. • Sum of the effects over the multipaths from source to receiver, each with its own time delay and complex amplitude. • Signature will change if the position of the transmitter or receiver changes, due to multipath link change.

10. Temporal link signatures • Each radio link is composed of many paths from the transmitter to the receiver • reflection • diffraction • scattering • Receiver gets different copies of signals • Each copy has different time delay, amplitude and phase.

11. Advantage over other techniques • Doesn't require continuous operation. • Wireless sensors can sleep and their location will be updated when they report their scheduled data. • Doesn’t require the addition of extra complexity to gather location data. • robust against impersonation attacks due to three main aspects: • Non-measurement: Legitimate link’s signature can’t be measured by attacker unless it is at the transmitter or receiver location. • Uniqueness: Attacker’s link signature won’t be the same unless it is at the transmitter location. • Spoof-proof: An attacker can change its link signature but can’t “spoof” an arbitrary link signature unless it is at the receiver location.

12. Link Signature Receivers (j1, j2) Transmitters (i1, i2, i3)

13. Wireless channel filter linear filter represents radio link between node i and j the amplitude and phase of the Lthmultipath component is its time delay is the total number of multipath is the Dirac delta function

14. Wireless channel filter • The filter impulse response is the superposition of many impulses, • each response is a single path in the multiple paths of a link. • Each impulse is delayed by the path delay, and multiplied by the amplitude and phase of that path.

15. The received signal received signal transmitted signal Convolution linear filter represents radio link between node i ,j

16. Temporal Link Signature Estimation the Fourier transforms of the Fourier transforms of the Fourier transforms of Then, we multiply…………

17. Temporal Link Signature Estimation complex conjugate of the Fourier transform of recreated transmitted signal for digital signals

18. Temporal Link Signature Estimation is inverse Fourier transform

19. Temporal Link Signature Estimation • Orthogonal Frequency Division Multiplexing (OFDM)-based standards (e.g. IEEE 802.11a/g and 802.16) • Such receivers can be readily adapted to calculate temporal link signatures • since the signal amplitude and phase in each sub-channel provides a sampled version of the Fourier transform of the signal. • R(f) is directly available • calculation of the temporal link signature requires an additional inverse FFT operator.

20. Temporal Link Signature Estimation • Most of the calculation necessary for the computation of temporal link signatures is already being done in existing code-division multiple access (CDMA) cellular base station receives and in access points for WLANs operating on the 802.11b standard, and ultra-wideband (UWB) receivers.

21. Temporal Link Signature Estimation • CDMA receivers first correlate the received signal with the known pseudo-noise (PN) signal. • then use the correlator output in a rake receiver, which adds in the power from each multipath component. • temporal link signature is just the average of the correlator output over the course of many bits.

22. Temporal Link Signature Estimation • UWB receivers also measure a signal which shows an approximate impulse response. • little or no additional calculation would be required to implement a temporal link signature-based method for these standard PHY protocols.

23. Normalization • Two types of normalization are important when measuring link signatures: 1) time delay. 2) amplitude.

24. Time delay • No synchronization between transmitter and receiver is a significant offset compared to the duration of the link signature • Setting time delay of line-of-sight (LOS) multi-path to be zero • All link signatures in this paper are time-delay normalized

25. Amplitude • Transmit power can be easily increased or decreased • Detect replication attack

26. Algorithm summ • test location distinction by temporal link signature • record transmitter link while it is not moving and not under a replication attack • Prove that measured link signature and its history is not due to normal temporal variations but the measured link signature is that of a different link by a new transmission location, and a location change is detected. • When a replication attack is suspected, the receiver might collaborate with other receivers to confirm the change in the location of node

27. Algorithm

28. Multiple receivers • Can employ more than one receiver (access point)

29. Multiple receivers

30. Comparison with RSS-Only Signatures

31. Measurement Experiment (environment) • Environment: • Typical modern office building, with: partitioned cubicle offices • Metal and wooden furniture • Computers • test and measurement equipment

32. Measurement Experiment (environment) • There are further scatterers near the measurement area: • windows • Doors • cement support beams • There are 44 device locations, within a 14m by 13m rectangular area. (Motorola Labs, Florida Communication Research Lab facility)

33. Measurement Experiment (system) • System is comprised of: • Direct-sequence spread-spectrum (DS-SS) transmitter (TX) and receiver (RX) (Sigtek model ST-515). • The TX outputs a plain DS-SS signal, specifically, an unmodulated pseudo-noise (PN) code signal with a 40 MHz chip rate and code length 1024. • The center frequency is 2443 MHz, and the transmit power is 10 mW.

34. Measurement Experiment (system) • The TX and RX are both battery-powered with equipment and batteries placed on carts. • Both TX and RX antennas are 2.4 GHz sleeve dipole antennas at 1m height above the floor. • The antennas are omnidirectional in the horizontal plane with gain of 1.1 dBi. • The RX is essentially a software radio which records I and Q samples at a rate of 120 MHz and downconverts them to baseband.

35. Measurement Collection • measured the channel between each pair of the 44 device locations. • There is only one TX and one RX, so one link is measured at a time, and between link measurements, the transmitter or receiver is moved. • All 44x43 = 1892 TX and RX permutations are measured. • At each permutation of TX and RX locations, the RX measures N = 5 link signatures, over a period of about 30 seconds. • A total of 44x43x5=9460 measurements are recorded. • Due to the large quantity and manual nature of the experiment, the measurements are completed over the course of eight days.

36. Measurement Dynamics • These measurements could not be conducted during normal business hours, and as a result, the physical environment is relatively static. • Due to the size of the TX and RX equipment (and the rechargeable marine batteries used to power them) the equipment carts would not comfortably fit into an occupied cubicle along side its occupant. • The measurements were conducted after 6pm. While two or three people were typically working in the measurement environment, the activity level was low relative to daytime. • Daytime measurements in a busy office will be an important for future measurement-based verification.

37. Office map (test) Measurement area map including device locations.

38. Temporal/Spatial Differences

39. Example Links Normalized temporal link signatures (5 each) on links (a) (13; 43), and (b) (14; 43). Temporal link difference: Spatial link difference: So any between 0.8 and 3.4 should be OK.

40. Single Receiver Motion Detector Performance

41. Single Receiver Motion Detector Performance

42. Multiple Receiver Motion Detector Performance • The evaluation of the multiple-receiver algorithm proceeds as follows: 1. Find the histograms of the multiple-receiver spatial and temporal link differences. 2. Use them to determine the probability of detection and probability of false alarm for a given threshold. • 3. Plot the results in an ROC curve. (receiver operating characteristics) • ROC curve is for displaying the tradeoff between false alarms and missed detections in a detection algorithm

43. Multiple Receiver Motion Detector Performance

44. Multiple Receiver Motion Detector Performance (two receivers)

45. Multiple Receiver Motion Detector Performance (three receivers)

46. Summary • Robust location distinction can be achieved using temporal link signatures • Significant improvement over RSS-only signature methods • Challenges and Current Work • Comparison with freq-domain link signatures [Li ‘06] • Study other link characteristics, metrics • Real-time implementation