robust location distinction using temporal link signatures
DESCRIPTION
Robust Location Distinction Using Temporal Link Signatures. Presented By Firas Kurdi. Article/Research By. Neal Patwari Department of Electrical and Computer Engineering The University of Utah Sneha Kasera School of Computing The University of Utah MobiCom '07: Sept - PowerPoint PPT PresentationTRANSCRIPT
Robust Location DistinctionUsing Temporal Link
SignaturesPresented By
Firas Kurdi
1
Article/Research By• Neal Patwari– Department of Electrical and Computer Engineering– The University of Utah
• Sneha Kasera– School of Computing– The University of Utah
• MobiCom '07: Sept Proceedings of the 13th annual ACM international
conference on Mobile computing and networking
2
What is location distinction?
• Ability to know when a transmitter has changed position
• Enabled by the physical layer only
• Compared to localization– no coordinates– benefits from multipath– more sensitive, needs less coverage
3
Introduction
• Wireless sensor networks– Location estimation should be done once the
node is actually moved.
• Active RFID– Detect the movement of the object with RFID.
• Secure wireless network– Prevent MAC address spoofing attack.
4
Existing Techniques• Accelerometer measurements
– additional device– detect changes in velocity– continuous monitoring
• Doppler measurements– similar as accelerometer– require continuous transmission
• Received signal strength (RSS) measurements– multiple measurements at different receivers– multi-node collaboration
5
Unique Link signature• Desired in– Healthcare, transportation & distribution, shipping,
manufacturing, mining, military, …
• Idea: – Detect Movement of Objects– most assets should be stationary– focus resources on rare moving assets
• Localization Issues: – Coverage, Accuracy, Security
6
Location Estimation in WSNs
• Network self-localization expensive– Ranging energy, bandwidth– Communication• Only re-localize when sensor moves• WSN low-energy location distinction:– detect movement w/o collaboration
7
Main Goal
• Develop a unique transmitter signature– Impersonation, MAC-address spoofing, traditional crypto methods subject to
node compromise
• Notice movement by signature change– To avoid continuous transmission, validate with real measurements
• Efficiency – energy, – Time– cost
8
Temporal link signatures• Utilizes physical layer characteristic of RF
multipaths.
• Sum of the effects over the multipaths from source to receiver, each with its own time delay and complex amplitude.
• Signature will change if the position of the
transmitter or receiver changes, due to multipath link change.
9
Temporal link signatures
• Each radio link is composed of many paths from the transmitter to the receiver– reflection– diffraction– scattering
• Receiver gets different copies of signals• Each copy has different time delay, amplitude
and phase.
10
Advantage over other techniques• Doesn't require continuous operation.• Wireless sensors can sleep and their location will be updated when they
report their scheduled data. • Doesn’t require the addition of extra complexity to gather location data. • robust against impersonation attacks due to three main aspects:
– Non-measurement: Legitimate link’s signature can’t be measured by attacker unless it is at the transmitter or receiver location.
– Uniqueness: Attacker’s link signature won’t be the same unless it is at the transmitter location.
– Spoof-proof: An attacker can change its link signature but can’t “spoof” an arbitrary link signature unless it is at the receiver location.
11
Link Signature
Receivers (j1, j2)Transmitters (i1, i2, i3)
12
Wireless channel filter
linear filter represents radio link between node i and j
the amplitude and phase of the Lth multipath component
is its time delay
is the total number of multipath
is the Dirac delta function13
Wireless channel filter
• The filter impulse response is the superposition of many impulses,
• each response is a single path in the multiple paths of a link.
• Each impulse is delayed by the path delay, and multiplied by the amplitude and phase of that path.
14
The received signal
received signal
transmitted signal
Convolution
linear filter represents radio link between node i ,j
15
Temporal Link Signature Estimation
the Fourier transforms of
the Fourier transforms of
the Fourier transforms of
Then, we multiply…………
16
Temporal Link Signature Estimation
complex conjugate of the Fourier transform of recreated transmitted signal
for digital signals
17
Temporal Link Signature Estimation
is inverse Fourier transform
18
Temporal Link Signature Estimation
• Orthogonal Frequency Division Multiplexing (OFDM)-based standards (e.g. IEEE 802.11a/g and 802.16)
• Such receivers can be readily adapted to calculate temporal link signatures
• since the signal amplitude and phase in each sub-channel provides a sampled version of the Fourier transform of the signal.
• R(f) is directly available• calculation of the temporal link signature requires an additional
inverse FFT operator.
19
Temporal Link Signature Estimation
• Most of the calculation necessary for the computation of temporal link signatures is already being done in existing code-division multiple access (CDMA) cellular base station receives and in access points for WLANs operating on the 802.11b standard, and ultra-wideband (UWB) receivers.
20
Temporal Link Signature Estimation
• CDMA receivers first correlate the received signal with the known pseudo-noise (PN) signal.
• then use the correlator output in a rake receiver,
which adds in the power from each multipath component.
• temporal link signature is just the average of the correlator output over the course of many bits.
21
Temporal Link Signature Estimation
• UWB receivers also measure a signal which shows an approximate impulse response.
• little or no additional calculation would be required to implement a temporal link signature-based method for these standard PHY protocols.
22
Normalization
• Two types of normalization are important when measuring link signatures: 1) time delay.2) amplitude.
23
Time delay• No synchronization between transmitter and receiver
is a significant offset compared to the duration of the link signature
• Setting time delay of line-of-sight (LOS) multi-path to be zero
• All link signatures in this paper are time-delay normalized
24
Amplitude
• Transmit power can be easily increased or decreased
• Detect replication attack
25
Algorithm summ• test location distinction by temporal link signature• record transmitter link while it is not moving and not
under a replication attack• Prove that measured link signature and its history is
not due to normal temporal variations but the measured link signature is that of a different link by a new transmission location, and a location change is detected.
• When a replication attack is suspected, the receiver might collaborate with other receivers to confirm the change in the location of node
26
Algorithm
27
Multiple receivers
• Can employ more than one receiver (access point)
28
Multiple receivers
29
Comparison with RSS-Only Signatures
30
Measurement Experiment (environment)
• Environment:– Typical modern office building, with:
partitioned cubicle offices –Metal and wooden furniture –Computers– test and measurement equipment
31
Measurement Experiment (environment)
• There are further scatterers near the measurement area:– windows – Doors– cement support beams
• There are 44 device locations, within a 14m by 13m rectangular area. (Motorola Labs, Florida Communication Research Lab facility)
32
Measurement Experiment (system)
• System is comprised of:
• Direct-sequence spread-spectrum (DS-SS) transmitter (TX) and receiver (RX) (Sigtek model ST-515).
• The TX outputs a plain DS-SS signal, specifically, an unmodulated pseudo-noise (PN) code signal with a 40 MHz chip rate and code length 1024.
• The center frequency is 2443 MHz, and the transmit power is 10 mW.
33
Measurement Experiment (system)
• The TX and RX are both battery-powered with equipment and batteries placed on carts.
• Both TX and RX antennas are 2.4 GHz sleeve dipole antennas at 1m height above the floor.
• The antennas are omnidirectional in the horizontal plane with gain of 1.1 dBi.
• The RX is essentially a software radio which records I and Q samples at a rate of 120 MHz and downconverts them to baseband.
34
Measurement Collection• measured the channel between each pair of the 44 device locations.
• There is only one TX and one RX, so one link is measured at a time, and between link measurements, the transmitter or receiver is moved.
• All 44x43 = 1892 TX and RX permutations are measured. • At each permutation of TX and RX locations, the RX measures N = 5 link
signatures, over a period of about 30 seconds. • A total of 44x43x5=9460 measurements are recorded.
• Due to the large quantity and manual nature of the experiment, the measurements are completed over the course of eight days.
35
Measurement Dynamics• These measurements could not be conducted during normal
business hours, and as a result, the physical environment is relatively static.
• Due to the size of the TX and RX equipment (and the rechargeable
marine batteries used to power them) the equipment carts would not comfortably fit into an occupied cubicle along side its occupant.
• The measurements were conducted after 6pm. While two or three people were typically working in the measurement environment, the activity level was low relative to daytime.
• Daytime measurements in a busy office will be an important for future measurement-based verification.
36
Office map (test)
Measurement area map including device locations.37
Temporal/Spatial Differences
38
Example Links
Normalized temporal link signatures (5 each) on links (a) (13; 43), and (b) (14; 43).Temporal link difference:
Spatial link difference:
So any between 0.8 and 3.4 should be OK.39
Single Receiver Motion Detector Performance
40
Single Receiver Motion Detector Performance
41
Multiple Receiver Motion Detector Performance
• The evaluation of the multiple-receiver algorithm proceeds as follows:
1. Find the histograms of the multiple-receiver spatial and temporal link differences.
2. Use them to determine the probability of detection and probability of false alarm for a given threshold.
• 3. Plot the results in an ROC curve. (receiver operating characteristics) – ROC curve is for displaying the tradeoff between false alarms and
missed detections in a detection algorithm
42
Multiple Receiver Motion Detector Performance
43
Multiple Receiver Motion Detector Performance (two receivers)
44
Multiple Receiver Motion Detector Performance (three receivers)
45
Summary
• Robust location distinction can be achieved using temporal link signatures
• Significant improvement over RSS-only signature methods
• Challenges and Current Work– Comparison with freq-domain link signatures [Li
‘06] – Study other link characteristics, metrics – Real-time implementation
46