robust location distinction using temporal link signatures

Robust Location DistinctionUsing Temporal Link

SignaturesPresented By

Firas Kurdi

1

Article/Research By• Neal Patwari– Department of Electrical and Computer Engineering– The University of Utah

• Sneha Kasera– School of Computing– The University of Utah

• MobiCom '07: Sept Proceedings of the 13th annual ACM international

conference on Mobile computing and networking

2

What is location distinction?

• Ability to know when a transmitter has changed position

• Enabled by the physical layer only

• Compared to localization– no coordinates– benefits from multipath– more sensitive, needs less coverage

3

Introduction

• Wireless sensor networks– Location estimation should be done once the

node is actually moved.

• Active RFID– Detect the movement of the object with RFID.

• Secure wireless network– Prevent MAC address spoofing attack.

4

Existing Techniques• Accelerometer measurements

– additional device– detect changes in velocity– continuous monitoring

• Doppler measurements– similar as accelerometer– require continuous transmission

• Received signal strength (RSS) measurements– multiple measurements at different receivers– multi-node collaboration

5

Unique Link signature• Desired in– Healthcare, transportation & distribution, shipping,

manufacturing, mining, military, …

• Idea: – Detect Movement of Objects– most assets should be stationary– focus resources on rare moving assets

• Localization Issues: – Coverage, Accuracy, Security

6

Location Estimation in WSNs

• Network self-localization expensive– Ranging energy, bandwidth– Communication• Only re-localize when sensor moves• WSN low-energy location distinction:– detect movement w/o collaboration

7

Main Goal

• Develop a unique transmitter signature– Impersonation, MAC-address spoofing, traditional crypto methods subject to

node compromise

• Notice movement by signature change– To avoid continuous transmission, validate with real measurements

• Efficiency – energy, – Time– cost

8

Temporal link signatures• Utilizes physical layer characteristic of RF

multipaths.

• Sum of the effects over the multipaths from source to receiver, each with its own time delay and complex amplitude.

• Signature will change if the position of the

transmitter or receiver changes, due to multipath link change.

9

Temporal link signatures

• Each radio link is composed of many paths from the transmitter to the receiver– reflection– diffraction– scattering

• Receiver gets different copies of signals• Each copy has different time delay, amplitude

and phase.

10

Advantage over other techniques• Doesn't require continuous operation.• Wireless sensors can sleep and their location will be updated when they

report their scheduled data. • Doesn’t require the addition of extra complexity to gather location data. • robust against impersonation attacks due to three main aspects:

– Non-measurement: Legitimate link’s signature can’t be measured by attacker unless it is at the transmitter or receiver location.

– Uniqueness: Attacker’s link signature won’t be the same unless it is at the transmitter location.

– Spoof-proof: An attacker can change its link signature but can’t “spoof” an arbitrary link signature unless it is at the receiver location.

11

Link Signature

Receivers (j1, j2)Transmitters (i1, i2, i3)

12

Wireless channel filter

linear filter represents radio link between node i and j

the amplitude and phase of the Lth multipath component

is its time delay

is the total number of multipath

is the Dirac delta function13

Wireless channel filter

• The filter impulse response is the superposition of many impulses,

• each response is a single path in the multiple paths of a link.

• Each impulse is delayed by the path delay, and multiplied by the amplitude and phase of that path.

14

The received signal

received signal

transmitted signal

Convolution

linear filter represents radio link between node i ,j

15

Temporal Link Signature Estimation

the Fourier transforms of

the Fourier transforms of

the Fourier transforms of

Then, we multiply…………

16

Temporal Link Signature Estimation

complex conjugate of the Fourier transform of recreated transmitted signal

for digital signals

17

Temporal Link Signature Estimation

is inverse Fourier transform

18

Temporal Link Signature Estimation

• Orthogonal Frequency Division Multiplexing (OFDM)-based standards (e.g. IEEE 802.11a/g and 802.16)

• Such receivers can be readily adapted to calculate temporal link signatures

• since the signal amplitude and phase in each sub-channel provides a sampled version of the Fourier transform of the signal.

• R(f) is directly available• calculation of the temporal link signature requires an additional

inverse FFT operator.

19

Temporal Link Signature Estimation

• Most of the calculation necessary for the computation of temporal link signatures is already being done in existing code-division multiple access (CDMA) cellular base station receives and in access points for WLANs operating on the 802.11b standard, and ultra-wideband (UWB) receivers.

20

Temporal Link Signature Estimation

• CDMA receivers first correlate the received signal with the known pseudo-noise (PN) signal.

• then use the correlator output in a rake receiver,

which adds in the power from each multipath component.

• temporal link signature is just the average of the correlator output over the course of many bits.

21

Temporal Link Signature Estimation

• UWB receivers also measure a signal which shows an approximate impulse response.

• little or no additional calculation would be required to implement a temporal link signature-based method for these standard PHY protocols.

22

Normalization

• Two types of normalization are important when measuring link signatures: 1) time delay.2) amplitude.

23

Time delay• No synchronization between transmitter and receiver

is a significant offset compared to the duration of the link signature

• Setting time delay of line-of-sight (LOS) multi-path to be zero

• All link signatures in this paper are time-delay normalized

24

Amplitude

• Transmit power can be easily increased or decreased

• Detect replication attack

25

Algorithm summ• test location distinction by temporal link signature• record transmitter link while it is not moving and not

under a replication attack• Prove that measured link signature and its history is

not due to normal temporal variations but the measured link signature is that of a different link by a new transmission location, and a location change is detected.

• When a replication attack is suspected, the receiver might collaborate with other receivers to confirm the change in the location of node

26

Algorithm

27

Multiple receivers

• Can employ more than one receiver (access point)

28

Multiple receivers

29

Comparison with RSS-Only Signatures

30

Measurement Experiment (environment)

• Environment:– Typical modern office building, with:

partitioned cubicle offices –Metal and wooden furniture –Computers– test and measurement equipment

31

Measurement Experiment (environment)

• There are further scatterers near the measurement area:– windows – Doors– cement support beams

• There are 44 device locations, within a 14m by 13m rectangular area. (Motorola Labs, Florida Communication Research Lab facility)

32

Measurement Experiment (system)

• System is comprised of:

• Direct-sequence spread-spectrum (DS-SS) transmitter (TX) and receiver (RX) (Sigtek model ST-515).

• The TX outputs a plain DS-SS signal, specifically, an unmodulated pseudo-noise (PN) code signal with a 40 MHz chip rate and code length 1024.

• The center frequency is 2443 MHz, and the transmit power is 10 mW.

33

Measurement Experiment (system)

• The TX and RX are both battery-powered with equipment and batteries placed on carts.

• Both TX and RX antennas are 2.4 GHz sleeve dipole antennas at 1m height above the floor.

• The antennas are omnidirectional in the horizontal plane with gain of 1.1 dBi.

• The RX is essentially a software radio which records I and Q samples at a rate of 120 MHz and downconverts them to baseband.

34

Measurement Collection• measured the channel between each pair of the 44 device locations.

• There is only one TX and one RX, so one link is measured at a time, and between link measurements, the transmitter or receiver is moved.

• All 44x43 = 1892 TX and RX permutations are measured. • At each permutation of TX and RX locations, the RX measures N = 5 link

signatures, over a period of about 30 seconds. • A total of 44x43x5=9460 measurements are recorded.

• Due to the large quantity and manual nature of the experiment, the measurements are completed over the course of eight days.

35

Measurement Dynamics• These measurements could not be conducted during normal

business hours, and as a result, the physical environment is relatively static.

• Due to the size of the TX and RX equipment (and the rechargeable

marine batteries used to power them) the equipment carts would not comfortably fit into an occupied cubicle along side its occupant.

• The measurements were conducted after 6pm. While two or three people were typically working in the measurement environment, the activity level was low relative to daytime.

• Daytime measurements in a busy office will be an important for future measurement-based verification.

36

Office map (test)

Measurement area map including device locations.37

Temporal/Spatial Differences

38

Example Links

Normalized temporal link signatures (5 each) on links (a) (13; 43), and (b) (14; 43).Temporal link difference:

Spatial link difference:

So any between 0.8 and 3.4 should be OK.39

Single Receiver Motion Detector Performance

40

Single Receiver Motion Detector Performance

41

Multiple Receiver Motion Detector Performance

• The evaluation of the multiple-receiver algorithm proceeds as follows:

1. Find the histograms of the multiple-receiver spatial and temporal link differences.

2. Use them to determine the probability of detection and probability of false alarm for a given threshold.

• 3. Plot the results in an ROC curve. (receiver operating characteristics) – ROC curve is for displaying the tradeoff between false alarms and

missed detections in a detection algorithm

42

Multiple Receiver Motion Detector Performance

43

Multiple Receiver Motion Detector Performance (two receivers)

44

Multiple Receiver Motion Detector Performance (three receivers)

45

Summary

• Robust location distinction can be achieved using temporal link signatures

• Significant improvement over RSS-only signature methods

• Challenges and Current Work– Comparison with freq-domain link signatures [Li

‘06] – Study other link characteristics, metrics – Real-time implementation

46