Robust Location Distinction Using Temporal Link Signatures

1
Robust Location DistinctionUsing Temporal
LinkSignatures

• Presented By
• Firas Kurdi

2
Article/Research By

• Neal Patwari
• Department of Electrical and Computer Engineering
• The University of Utah
• Sneha Kasera
• School of Computing
• The University of Utah
• MobiCom '07 Sept
• Proceedings of the 13th annual ACM
  international conference on Mobile computing and
  networking

3
What is location distinction?

• Ability to know when a transmitter has changed
  position
• Enabled by the physical layer only
• Compared to localization
• no coordinates
• benefits from multipath
• more sensitive, needs less coverage

4
Introduction

• Wireless sensor networks
• Location estimation should be done once the node
  is actually moved.
• Active RFID
• Detect the movement of the object with RFID.
• Secure wireless network
• Prevent MAC address spoofing attack.

5
Existing Techniques

• Accelerometer measurements
• additional device
• detect changes in velocity
• continuous monitoring
• Doppler measurements
• similar as accelerometer
• require continuous transmission
• Received signal strength (RSS) measurements
• multiple measurements at different receivers
• multi-node collaboration

6
Unique Link signature

• Desired in
• Healthcare, transportation distribution,
  shipping, manufacturing, mining, military,
• Idea
• Detect Movement of Objects
• most assets should be stationary
• focus resources on rare moving assets
• Localization Issues
• Coverage, Accuracy, Security

7
Location Estimation in WSNs

• Network self-localization expensive
• Ranging energy, bandwidth
• Communication
• Only re-localize when sensor moves
• WSN low-energy location distinction
• detect movement w/o collaboration

8
Main Goal

• Develop a unique transmitter signature
• Impersonation, MAC-address spoofing, traditional
  crypto methods subject to node compromise
• Notice movement by signature change
• To avoid continuous transmission, validate with
  real measurements
• Efficiency
• energy,
• Time
• cost

9
Temporal link signatures

• Utilizes physical layer characteristic of RF
  multipaths.
• Sum of the effects over the multipaths from
  source to receiver, each with its own time delay
  and complex amplitude.
•  
• Signature will change if the position of the
  transmitter or receiver changes, due to multipath
  link change.

10
Temporal link signatures

• Each radio link is composed of many paths from
  the transmitter to the receiver
• reflection
• diffraction
• scattering
• Receiver gets different copies of signals
• Each copy has different time delay, amplitude and
  phase.

11
Advantage over other techniques

• Doesn't require continuous operation.
• Wireless sensors can sleep and their location
  will be updated when they report their scheduled
  data.
• Doesnt require the addition of extra complexity
  to gather location data.
• robust against impersonation attacks due to three
  main aspects
•  
• Non-measurement Legitimate links signature
  cant be measured by attacker unless it is at the
  transmitter or receiver location.
• Uniqueness Attackers link signature wont be
  the same unless it is at the transmitter
  location.
• Spoof-proof An attacker can change its link
  signature but cant spoof an arbitrary link
  signature unless it is at the receiver location.

12
Link Signature
Receivers (j1, j2) Transmitters (i1, i2, i3)
13
Wireless channel filter
linear filter represents radio link between node
i and j the amplitude and phase of the Lth
multipath component is its time delay is the
total number of multipath is the Dirac delta
function
14
Wireless channel filter

• The filter impulse response is the superposition
  of many impulses,
• each response is a single path in the multiple
  paths of a link.
• Each impulse is delayed by the path delay, and
  multiplied by the amplitude and phase of that
  path.

15
The received signal

• received signal
• transmitted signal
• Convolution
• linear filter represents radio link between node
  i ,j

16
Temporal Link Signature Estimation
the Fourier transforms of the Fourier transforms
of the Fourier transforms of
Then, we multiply
17
Temporal Link Signature Estimation

• complex conjugate of the Fourier transform of
  recreated transmitted signal
• for digital signals

18
Temporal Link Signature Estimation
is inverse Fourier transform
19
Temporal Link Signature Estimation

• Orthogonal Frequency Division Multiplexing
  (OFDM)-based standards (e.g. IEEE 802.11a/g and
  802.16)
• Such receivers can be readily adapted to
  calculate temporal link signatures
• since the signal amplitude and phase in each
  sub-channel provides a sampled version of the
  Fourier transform of the signal.
• R(f) is directly available
• calculation of the temporal link signature
  requires an additional inverse FFT operator.

20
Temporal Link Signature Estimation

• Most of the calculation necessary for the
  computation of temporal link signatures is
  already being done in existing code-division
  multiple access (CDMA) cellular base station
  receives and in access points for WLANs operating
  on the 802.11b standard, and ultra-wideband (UWB)
  receivers.

21
Temporal Link Signature Estimation

• CDMA receivers first correlate the received
  signal with the known pseudo-noise (PN) signal.
•  
• then use the correlator output in a rake
  receiver, which adds in the power from each
  multipath component.
• temporal link signature is just the average of
  the correlator output over the course of many
  bits.

22
Temporal Link Signature Estimation

• UWB receivers also measure a signal which shows
  an approximate impulse response.
• little or no additional calculation would be
  required to implement a temporal link
  signature-based method for these standard PHY
  protocols.

23
Normalization

• Two types of normalization are important when
  measuring link signatures
• 1) time delay.
• 2) amplitude.

24
Time delay

• No synchronization between transmitter and
  receiver
• is a significant offset compared to the duration
  of the link signature
• Setting time delay of line-of-sight (LOS)
  multi-path to be zero
• All link signatures in this paper are time-delay
  normalized

25
Amplitude

• Transmit power can be easily increased or
  decreased
• Detect replication attack

26
Algorithm summ

• test location distinction by temporal link
  signature
• record transmitter link while it is not moving
  and not under a replication attack
• Prove that measured link signature and its
  history is not due to normal temporal variations
  but the measured link signature is that of a
  different link by a new transmission location,
  and a location change is detected.
• When a replication attack is suspected, the
  receiver might collaborate with other receivers
  to confirm the change in the location of node

27
Algorithm
28
Multiple receivers

• Can employ more than one receiver (access point)

29
Multiple receivers
30
Comparison with RSS-Only Signatures
31
Measurement Experiment (environment)

• Environment
• Typical modern office building, with partitioned
  cubicle offices
• Metal and wooden furniture
• Computers
• test and measurement equipment

32
Measurement Experiment (environment)

• There are further scatterers near the measurement
  area
• windows
• Doors
• cement support beams
• There are 44 device locations, within a 14m by
  13m rectangular area. (Motorola Labs, Florida
  Communication Research Lab facility)

33
Measurement Experiment (system)

• System is comprised of
• Direct-sequence spread-spectrum (DS-SS)
  transmitter (TX) and receiver (RX) (Sigtek model
  ST-515).
• The TX outputs a plain DS-SS signal,
  specifically, an unmodulated pseudo-noise (PN)
  code signal with a 40 MHz chip rate and code
  length 1024.
• The center frequency is 2443 MHz, and the
  transmit power is 10 mW.

34
Measurement Experiment (system)

• The TX and RX are both battery-powered with
  equipment and batteries placed on carts.
• Both TX and RX antennas are 2.4 GHz sleeve dipole
  antennas at 1m height above the floor.
• The antennas are omnidirectional in the
  horizontal plane with gain of 1.1 dBi.
• The RX is essentially a software radio which
  records I and Q samples at a rate of 120 MHz and
  downconverts them to baseband.

35
Measurement Collection

• measured the channel between each pair of the 44
  device locations.
• There is only one TX and one RX, so one link is
  measured at a time, and between link
  measurements, the transmitter or receiver is
  moved.
• All 44x43 1892 TX and RX permutations are
  measured.
•  
• At each permutation of TX and RX locations, the
  RX measures N 5 link signatures, over a period
  of about 30 seconds.
•  
• A total of 44x43x59460 measurements are
  recorded.
• Due to the large quantity and manual nature of
  the experiment, the measurements are completed
  over the course of eight days.

36
Measurement Dynamics

• These measurements could not be conducted during
  normal business hours, and as a result, the
  physical environment is relatively static.
•  
• Due to the size of the TX and RX equipment (and
  the rechargeable marine batteries used to power
  them) the equipment carts would not comfortably
  fit into an occupied cubicle along side its
  occupant.
• The measurements were conducted after 6pm. While
  two or three people were typically working in the
  measurement environment, the activity level was
  low relative to daytime.
• Daytime measurements in a busy office will be an
  important for future measurement-based
  verification.

37
Office map (test)
Measurement area map including device locations.
38
Temporal/Spatial Differences
39
Example Links
Normalized temporal link signatures (5 each) on
links (a) (13 43), and (b) (14 43).
Temporal link difference
Spatial link difference
So any between 0.8 and 3.4 should be OK.
40
Single Receiver Motion Detector Performance
41
Single Receiver Motion Detector Performance
42
Multiple Receiver Motion Detector Performance

• The evaluation of the multiple-receiver algorithm
  proceeds as follows
• 1. Find the histograms of the multiple-receiver
  spatial and temporal link differences.
• 2. Use them to determine the probability of
  detection and probability of false alarm for a
  given threshold.
• 3. Plot the results in an ROC curve. (receiver
  operating characteristics)
• ROC curve is for displaying the tradeoff between
  false alarms and missed detections in a detection
  algorithm

43
Multiple Receiver Motion Detector Performance
44
Multiple Receiver Motion Detector Performance
(two receivers)
45
Multiple Receiver Motion Detector Performance
(three receivers)
46
Summary

• Robust location distinction can be achieved
  using temporal link signatures
• Significant improvement over RSS-only signature
  methods
• Challenges and Current Work
• Comparison with freq-domain link signatures Li
  06
• Study other link characteristics, metrics
• Real-time implementation