Securing internal Wi-Fi networks with position verification

For wireless sensor networks, received signal strength (RSS) and proximity (also known as connectivity) measurements have been proposed as simple and inexpensive means to estimate range between devices and sensor location. While RSS measurements are recognized to suffer from errors due to the random nature of the fading channel, proximity measurements, ie., knowing only whether or not two devices are in communication range, are often discussed without considering that they are affected by the same fading channel. Proximity measurements are actually just a binary quantization of RSS measurements. We use the Cramér-Rao bound (CRB) to compare the minimal attainable variances of unbiased sensor location estimators for the cases of RSS and proximity measurements. For completeness, we also present the CRB for sensor localization with systems using K-level quantized RSS (QRSS) measurements, of which proximity measurements are the special case: K=2. Examples are presented for the case of one unknown-location sensor, and for the case of a 5 by 5 grid of sensors. These examples show that lower bounds for standard deviation in proximity-based systems are, as a rule of thumb, about 50% higher than the bounds for RSS-based systems. Furthermore, results are presented which show how many bits of quantization are necessary for a QRSS-based system to nearly achieve the bounds of an unquantized RSS system.

The paper focuses on the performance analysis of the timing acquisition scheme based on received signal strength (RSS) measurements for ultra-wideband (UWB) communication systems. To our knowledge, few paper discusses the performance of the timing acquisition scheme based on RSS measurements for UWB in details. The timing acquisition scheme based on RSS measurements has many advantages, such as low cost, high speed and robustness. However, low transmission power limitation and complicated indoor multipath propagation environments make it difficult to measure accurate RSS at the receiver and affect the accuracy of the time delay offset estimation for the local template signals. In addition, the time variation of the indoor channel state can form a multiple-to-one mapping relation between the RSS measurements and the distance, which largely limits the method application. In the paper, we analyze the accuracy of time delay offset estimation for this method by deriving the Cramer-Rao lower bound (CRLB). The number results show that the accuracy of the timing acquisition method based on RSS measurements suffers from both the UWB signal transmission speed and the varying distance between the transmitter and receiver. It is noted that though the accuracy of the method can hardly fulfil the fine timing acquisition requirement for UWB systems, it will largely reduce the coarse timing acquisition time and improve the performance for UWB timing acquisition systems if combined with other timing acquisition ones

A malicious attacker could, by taking control of internet-of-things devices, use them to capture received signal strength (RSS) measurements and perform surveillance on a person's vital signs, activities, and sound in their environment. This article considers an attacker who looks for subtle changes in the RSS in order to eavesdrop sound vibrations. The challenge to the adversary is that sound vibrations cause very low amplitude changes in RSS, and RSS is typically quantized with a significantly larger step size. This article contributes a lower bound on an attacker's monitoring performance as a function of the RSS step size and sampling frequency so that a designer can understand their relationship. Our bound considers the little-known and counter-intuitive fact that an adversary can improve their sinusoidal parameter estimates by making some devices transmit to add interference power into the RSS measurements. We demonstrate this capability experimentally. As we show, for typical transceivers, the RSS surveillance attacker can monitor sound vibrations with remarkable accuracy. New mitigation strategies will be required to prevent RSS surveillance attacks.

As an emerging technique with a promising application prospect, the device-free localization (DFL) technique has drawn considerable attention due to its ability of realizing wireless localization without the need of equipping the target with any device. The DFL technique detects the shadowed links and realizes localization with the received signal strength (RSS) measurements of these links. However, one major disadvantage of the DFL technique is that the RSS signal is too sensitive, and a slight variation of the environment will cause the variation of RSS measurements, which incurs the misjudgment of shadowed links and degradation of localization performance. To solve this problem, a robust DFL scheme based on differential RSS is proposed. The scheme utilizes the novel differential RSS to judge whether a link is shadowed, which not only eliminates the need of acquiring reference RSS measurements but also overcomes the negative effect incurred by the environment. Meanwhile, an outlier detection scheme is presented to filter out the outlier links that are far away from the target. We present the observation model of the shadowed links and incorporate it into the particle filter framework to realize location estimation robustly. Experimental results demonstrate the outstanding performance of the proposed scheme.

This paper investigates the problem of estimating the location and velocity of a mobile agent using the received signal strength (RSS) measurements. Typical power measurements are inherently nonlinear and in this approach we derive a linear measurement scheme using an analytical measurement conversion technique which can readily be used with RSS measuring sensors. Power measurements are hence used in our robust version of a linear Kalman filter to estimate the dynamic parameters of the moving transmitter.

The location of mobile terminals in cellular networks is an important problem with applications in resource allocation, location sensitive browsing, and emergency communications. Finding cost effective location estimation techniques that are robust to non-line of sight (NLOS) propagation, quantization, and measurement noise is a key problem in this area. Quantized time difference of arrival (TDoA) and received signal strength (RSS) measurements can be made simultaneously by CDMA cellular networks at low cost. The different sources of errors for each measurement type cause RSS and TDoA measurements to contain independent information about mobile terminal location. This paper applies data fusion to combine the information of RSS and TDoA measurements to calculate a superior location estimate. Nonparametric estimation methods, that are robust to variations of measurement noise and quantization, are employed to calculate the location estimates. It is shown how the data fusion location estimators are robust, provide lower error than the estimators based on the individual measurements, and have low implementation cost.

Wireless intruder geolocation techniques using received signal strength (RSS) measurements from an array of sensors are very attractive for campus wireless network security because of their low cost implementation and simplicity. Both precision in RSS measurements and the relative geometry between RF sensors and the wireless intruder can affect the geolocation accuracy. This paper presents a comparative performance analysis of three RSS-based geolocation algorithms for non-cooperative wireless intruders in terms of their root mean square errors in wireless campus networks. A comparison study is established in a RF sensor grid and circular sensor geometries to fit general campus topology. Geolocation algorithm accuracy is examined for these particular geometric configurations of RF sensors with respect to various wireless intruder locations in and around a campus area. The results show that certain geolocation algorithms perform much better than others when wireless intruders are inside a campus wireless network, whereas the performance of the same geolocation algorithms is turned around when wireless intruders are outside a campus wireless network. As a result, a high accuracy solution to wireless intruder geolocation in campus wireless networks is discovered and proposed. MATLAB-based numerical simulations were used to evaluate the performance of these algorithms for various scenarios and parameters.

Indoor localization is often challenging due to the non-availability of GPS signals. Recently, various radio frequency fingerprinting techniques have been proposed to identify indoor locations using simply received signal strength (RSS) measurements. In general however, RSS measurements are time-varying and are difficult to model for complex environments. This paper proposes the use of dictionary learning (DL) to generate high quality fingerprints that depend also on the channel characteristics for each location. An enhanced DL algorithm is proposed that utilizes prior information about the channel distribution, and can generate the fingerprints in an online fashion. Simulation results demonstrate the efficacy of the proposed approach.

Source localization using RSS (received signal strength) measurements has received considerable attention recently. However, there are few works focusing on the problem of positioning multiple directional sources. To provide a benchmark for evaluating localization algorithms, this paper derives the Cramer-Rao lower bounds (CRLB) for estimating locations, orientations, transmit powers, beam widths of multiple directional sources and the path loss exponent (PLE) of the environment. Meanwhile, in order to facilitate the computation and expression, we also present the relationship of the CRLB among different quantities of sources when estimating their locations and orientations. Given that the maximum likelihood (ML) estimator for the localization problem is highly non-convex and non-linear, this paper proposes an Expectation Maximization (EM) like algorithm to estimate the multiple parameters of each of the sources iteratively. Moreover, the complexity of the presented ML-EM algorithm is significantly reduced via linear representation among the parameters to be estimated. Numerical and simulation results demonstrate the performance of the proposed methods and the derived bounds in terms of estimation error, noise robustness and number of sources.

The fingerprint location method based on the WiFi received signal strength (RSS), is one of the indoor positioning method owning the highest value of application currently. It uses distribution characteristic of WiFi RSS in the space to estimate user's location. But due to the unstable RSS measurements of WiFi signal in a fixed location, in online phase, the uncertain fluctuation of RSS measurements will cause matching error of reference point (RP), and lead to the positioning error. To deal with this problem, a matching positioning method combining spatial multi-points fingerprint is presented in this paper. Firstly, assisted by odometer information, the space uniforming calibration of fingerprint is carried out in radial direction of road. And then, intensity and variation characteristics in space of consecutive multi-points RSS are matched jointly in online process, so as to enhance the positioning accuracy and stability. Through experiments, it is proved that the method in this paper is effective and, under reasonable parameters, positioning performance is good.

Received Signal Strength (RSS) localization is widely used due to its simplicity and availability in most mobile devices. The RSS channel model is defined by the propagation losses and the shadow fading. These parameters might vary over time because of changes in the environment. In this paper, the problem of tracking a mobile node by RSS measurements is addressed, while simultaneously estimating a two-slope RSS model. The methodology considers a Kalman filter with Interacting Multiple Model architecture, coupled to an on-line estimation of the observation's variance. The performance of the method is shown through numerical simulations in realistic scenarios.

With the proliferation of the Internet of Things (IoT), employing Received Signal Strength (RSS) as a metric to determine the location of a target (e.g., person or mobile device) is of great interest in terms of cost and ease of implementation. Indeed, RSS measurements can be easily obtained for most off-the-shelf devices, such as WiFi- or ZigBee compatible devices or sensors. This paper deals with the indoor localization problem in wireless sensor networks (WSNs) and proposes a new approach for radio signal propagation modelling and localization estimation, that accounts for the imperfection of RSS measurements and the reliability of RSS sources by using the Dempster-Shafer Theory (DST). In the signal propagation modelling, key information regarding the geometry of indoor environment that is divided into zones separated by walls (zoning), are considered. Based on the number of walls, the RSS irregularities are estimated using different distance intervals, which are weighted by a probability density determined experimentally. To estimate the location of a target node, the PCR6 rule is used to combine the belief masses of the positions obtained from the probability density. In order to evaluate the performance of the proposed approach, an experimental WSN has been deployed in a living apartment. The obtained results demonstrate that the proposed approach improves the localization accuracy compared to the case without zoning. Moreover, the obtained localization mean error proves the feasibility of a precise localization of humans in indoor environments in the case of Ambient Assisted Living and Social Robotics applications.

This paper presents robust empirical path loss models to characterize indoor propagation for access point (AP) deployed at different heights. The proposed models are developed with wireless local area network infrastructure at 2.4 GHz. The models are backed by extensive received signal strength (RSS) measurements acquired in line of sight and obstructed line of sight regions. The models are developed for two conditions, viz; quasi realistic and realistic RSS measurements. The quasi realistic measurements are taken after suppressing human intervention and electrical interferences to minimum. While the realistic RSS measurements are made in presence of all the human interventions and electrical interferences. The shadow fading component for both quasi realistic and realistic conditions is statistically modeled with the dependency on AP height. The proposed technique can be applied with higher confidence level to the buildings with similar construction features where RSS measurements are made upon. The results reveal that the performance of the proposed propagation models is significantly higher than the existing International Telecommunication Union-path loss model. The results also demonstrate that the realistic path loss model is more robust than the quasi realistic model.

Fingerprint-based indoor localization methods rely on a database of Received Signal Strength (RSS) measurements and corresponding location labels. However, collecting and maintaining such a database can be costly and time consuming. In this work, we proposed Wasserstein Generative Adversarial Networks (WGAN) to generate synthetic data for fingerprinting-based indoor localization. The proposed system consists of a WGAN that is trained on a dataset of real RSS measurements and corresponding location labels. The generator of the WGAN learns to generate synthetic RSS measurements, and the critic learns to differentiate the generated and the real measurements. We validate the proposed system on a dataset of real RSS measurements. The result of the proposed system shows better localization accuracy as compared to using real data, while being more cost-effective and scalable.

Advances in miniaturized wireless and sensing technologies have enabled the construction of cheap, low-powered, portable wireless devices capable of forming ad hoc networks. While these networks have shown enormous potential in applications such as remote sensing and target tracking, these applications require the devices to determine their own location. Additionally, devices capable of self-localization can also be used to implement location-based services or to improve coordination between first-responders to disaster sites or infantry in tactical situations. Existing techniques such as GPS may not be available due to design or environmental constraints, so other methods need to be devised. Previous works have proposed methods for wireless devices to self-localize based on received signal strength (RSS), but these methods offer limited accuracy due to the large error in RSS measurements. Recognizing the trend for these portable wireless devices to contain acceleration sensors, we propose an algorithm to combine these acceleration measurements with RSS readings to achieve accurate localization. We apply a distributed extended Kalman filter to track position based on these two measurements and a kinematic node movement model. This algorithm is able to take advantage of correlations between successive location estimates to improve estimation accuracy. We calculate the posterior Cramer-Rao bound for this algorithm and analyze it through simulation. Our analysis shows that by utilizing the acceleration information, the network is able to self-localize despite the large inaccuracy in RSS readings.