Localization with witnesses

1
Localization with witnesses

• Arun Saha, Mart Molle
• University of California, Riverside

2
Position Verification

• Other nodes(s) verify the position claimed by the
  prover, relative to
• Global co-ordinate system e.g. GPS, or
• Local co-ordinate system
• Proximity to a designated point
• Position verification is orthogonal to Identity
  verification.
• Finding the position of a node is known as
  Localization

3
Why Position Authentication?

• Example 1 Is Bob really at his place of duty?
• Did he relay his messages to another location?
• Example 2 What is the temperature at Santa
  Monica Beach?
• The Beaches are covered with a temperature
  sensing sensor network
• Alice does not know which sensor is at the target
  location.

4
Range-based localization

• Range-based localization finds distance bounds
  between nodes.
• Distance bounding is the process by which the
  verifier entity establishes an upper bound on the
  distance to the prover entity.
• Multiple distance bounds are geometrically
  combined to constrain the provers location.

5
Timed Echo Distance Bounding

• The message RTT is converted to distance bound
• Verifier sends a random number and starts a
  timer,
• Prover echoes the number back to verifier
• Verifier receives the response and stops timer.
• Limitations to accuracy
• Measurement error at the verifier,
• Variability in the response delay at prover

6
Conflict between required and achievable timing
accuracy

• To localize objects within a room or building
• distance errors must be in meters
• timing errors must be in tens of nanoseconds.
• Such fine grained time measurement is impossible
  in software.
• There are delays in the layers of the protocol
  stack.
• Experiment with sending 1 byte payload in TCP/IP
  over local LAN ZBcF05
• Sending latency 8.39 microsecond
• Receiving latency 19.25 microsecond
• Informal experiment ping c 1000 localhost
  gives
• 1000 packets transmitted, 1000 received, 0
  packet loss, time 999410ms
• rtt min/avg/max/mdev 0.034/0.056/0.100/0.010 ms.

7
Wireless Localization Model

• A group of nodes in an ad-hoc or sensor network
• Mutually trusted
• Mutually co-operative
• A new node in the neighborhood, not in the
  network yet, i.e. untrusted
• The group of nodes want to find out the location
  of the new node
• If there are (at least) three independent
  distance measurements to the prover, then the
  location of the prover can be found as the
  intersection of the three curves.

8
Localization via time-difference of arrival with
multiple verifiers

• Multilateration Time-Differences of signal
  arrival from a single source (prover) to multiple
  known locations (verifiers) can localize the
  source of the signal.
• Existing solutions
• Assume verifiers are already time synchronized,
  and
• can record the Time-of-Arrival for a particular
  signal
• Our solution
• Verifiers get time synchronized by acquiring the
  clock rate of the challenge signal, and
• can record the time difference between a pair of
  consecutive signals

9
One dimensional localization with witnesses
10
Messages between the lead-verifier and the prover
11
Difference of Distances
Known difference of distance lead to Hyperbola
with foci At W and W
Note that the hyperbola does not depend on
Response Delay tau_U
12
Realizations

• Any verifier-pair can form the locus of the
  prover
• Any verifier-triplet can localize the prover
• The location found by the triplet is independent
  of the response delay (tau_U) at the prover

13
Some features of PHY which can help us

• PHY state transitions
• For transmitting, sender PHY goes from IDLE to
  SENDING
• For receiving, receiver PHY goes from IDLE to
  RECEIVING
• Some code groups like SSD, ESD helps in this
  transitioning
• There is one-to-one relationship between
  data-groups (bytes) and code-groups (channel
  symbols).

14
Tackling Delays

• Measurement Delay takes place at the verifier.
• The PHY of verifier helps to minimize measurement
  delay as
• Start a timer as soon as the SFD (or SSD) of the
  challenge frame is transmitted
• Stop the timer as soon as the SFD (or SSD) of the
  subsequent frame, i.e. the response frame, is
  received.
• Response Delay happens at the prover.
• A verifier cannot expect co-operation from an
  untrusted Prover
• Even a honest prover cannot maintain or report
  exact delay!
• As a result of combining results from multiple
  witnesses, the locus of the prover does not
  depend on the Response Delay ?

15
Measuring tau_W

• The witnesses measure the delay in three steps
• The lead-verifier sends a DummyChallenge the
  witnesses acquire the transmission clock rate
  and locks to that, transceiver is kept in
  ready-to-receive state.
• The lead-verifier sends the (real) challenge the
  witnesses starts a timer on reception of SFD of
  the challenge
• The prover sends the response The witness stops
  the timer on reception of SFD of the subsequent
  frame i.e. the response
• The witnesses report (through some application
  specific protocol) the delay measured at the
  timer to the lead-verifier.
• The delay measured at the lead-verifier itself is
  stored in the PHY, and reported when requested
  from higher layer localization application.

16
Measurement Errors in tau_W

• If there are no errors in measurement of tau_Ws,
  then all hyperbolas will intersect at the true
  location of the prover.
• There might be other intersection points too.
• However, if there are errors, the intersection
  points will not exactly be at the true location
  of the prover
• If the measurement errors are like random noise
  with zero mean, then the intersection points will
  be clustered around the true location point.

17
An over-determined system

• Let there be n verifiers
• There will be h (n choose 2) hyperbolas
• There will be approx. N (h choose 2)
  intersection points.
• How can we combine the N solution points into one
  single estimate?

18
Combining multiple solution points

• 2D median of the solution points
• Peel Off the outermost points forming the minimum
  enclosing convex hull
• Imagine all solution points are different
  measurements of the same signal and use them to
  make the final estimate
• One way to do that is Kalman filtering
• We obtained all solution points by pairwise
  solving all hyperbolas
• Then we passed the solution points one-by-one
  through the Kalman Filter
• After sufficient number of steps, the solution
  converges.

19
Results from Kalman Filtering

• The order in which we different solution points
  are considered significantly effect the final
  estimate.
• The same set of solution points processed in
  different order by the filtering algorithm
  produces different final estimate.
• Some solution points are more significant than
  others
• Points should be processed in decreasing order of
  significance.
• If the solution point is inside the triangle
  formed by the corresponding verifier triplet,
  then it is more significant than others which are
  outside
• The solution point whose sum of normal distances
  to all hyperbolas is minimum is the most
  significant one.

20
Sensitivity w.r.t. to verifier triplet

• If the solution point lies outside the verifier
  triplet, then it is more sensitive to measurement
  errors

21
Error Sensitivity
22
Regions of uncertainty around Prover location
23
Regions are greater for Provers located out of
the verifier triangle
24
(Selected) References
25
Thanks for your presence and patience

• Questions?