Localization with witnesses Arun Saha, Mart Molle University of California, Riverside 9/19/2018 University of California, Riverside

Position Verification Other nodes(s) verify the position claimed by the prover, relative to: Global co-ordinate system e.g. GPS, or Local co-ordinate system Proximity to a designated point Position verification is orthogonal to Identity verification. Finding the position of a node is known as Localization 9/19/2018 University of California, Riverside

Range-based localization Range-based localization finds distance bounds between nodes. Distance bounding is the process by which the verifier entity establishes an upper bound on the distance to the prover entity. Multiple distance bounds are geometrically combined to constrain the prover’s location. 9/19/2018 University of California, Riverside

“Timed Echo” Distance Bounding The message RTT is converted to distance bound: Verifier sends a random number and starts a timer, Prover echoes the number back to verifier Verifier receives the response and stops timer. Limitations to accuracy: Measurement error at the verifier, Variability in the response delay at prover ECHO protocol Challenge – Response Paradigm 9/19/2018 University of California, Riverside

Conflict between required and achievable timing accuracy To localize objects within a room or building distance errors must be in meters timing errors must be in tens of nanoseconds. Such fine grained time measurement is impossible in software. There are delays in the layers of the protocol stack. Experiment with sending 1 byte payload in TCP/IP over local LAN [ZBcF05] Sending latency = 8.39 microsecond Receiving latency = 19.25 microsecond Informal experiment “ping –c 1000 localhost” gives 1000 packets transmitted, 1000 received, 0% packet loss, time 999410ms rtt min/avg/max/mdev = 0.034/0.056/0.100/0.010 ms. 9/19/2018 University of California, Riverside

Wireless Localization Model A group of nodes in an ad-hoc or sensor network Mutually trusted Mutually co-operative A new node in the neighborhood, not in the network yet, i.e. untrusted The group of nodes want to find out the location of the new node If there are (at least) three independent distance measurements to the prover, then the location of the prover can be found as the intersection of the three curves. 9/19/2018 University of California, Riverside

Localization via time-difference of arrival with multiple verifiers Multilateration: Time-Differences of signal arrival from a single source (prover) to multiple known locations (verifiers) can localize the source of the signal. Existing solutions: Assume verifiers are already time synchronized, and can record the Time-of-Arrival for a particular signal Our solution: Verifiers get time synchronized by acquiring the clock rate of the challenge signal, and can record the time difference between a pair of consecutive signals 9/19/2018 University of California, Riverside

One dimensional localization with witnesses 9/19/2018 University of California, Riverside

Messages between the lead-verifier and the prover 9/19/2018 University of California, Riverside

Difference of Distances Known difference of distance lead to Hyperbola with foci At W and W’ Note that the hyperbola does not depend on Response Delay tau_U 9/19/2018 University of California, Riverside

University of California, Riverside Realizations Any verifier-pair can form the locus of the prover Any verifier-triplet can localize the prover The location found by the triplet is independent of the response delay (tau_U) at the prover 9/19/2018 University of California, Riverside

University of California, Riverside Tackling Delays Measurement Delay takes place at the verifier. The PHY of verifier helps to minimize measurement delay as: Start a timer as soon as the SFD (or SSD) of the challenge frame is transmitted Stop the timer as soon as the SFD (or SSD) of the subsequent frame, i.e. the response frame, is received. Response Delay happens at the prover. A verifier cannot expect co-operation from an untrusted Prover Even a honest prover cannot maintain or report exact delay! As a result of combining results from multiple witnesses, the locus of the prover does not depend on the Response Delay  As a matter of fact, 9/19/2018 University of California, Riverside

University of California, Riverside Measuring tau_W The witnesses measure the delay in three steps: The lead-verifier sends a DummyChallenge; the witnesses “acquire” the transmission clock rate and locks to that, transceiver is kept in “ready-to-receive” state. The lead-verifier sends the (real) challenge; the witnesses starts a timer on reception of SFD of the challenge The prover sends the response; The witness stops the timer on reception of SFD of the subsequent frame i.e. the response The witnesses report (through some application specific protocol) the delay measured at the timer to the lead-verifier. The delay measured at the lead-verifier itself is stored in the PHY, and reported when requested from higher layer localization application. 9/19/2018 University of California, Riverside

Measurement Errors in tau_W If there are no errors in measurement of tau_W’s, then all hyperbolas will intersect at the true location of the prover. There might be other intersection points too. However, if there are errors, the intersection points will not exactly be at the true location of the prover If the measurement errors are like random noise with zero mean, then the intersection points will be clustered around the true location point. 9/19/2018 University of California, Riverside

An over-determined system Let there be n verifiers: There will be h = (n choose 2) hyperbolas There will be approx. N = (h choose 2) intersection points. How can we combine the N solution points into one single estimate? 9/19/2018 University of California, Riverside

Combining multiple solution points 2D median of the solution points: Peel Off the outermost points forming the minimum enclosing convex hull Imagine all solution points are different measurements of the same signal and use them to make the final estimate One way to do that is Kalman filtering We obtained all solution points by pairwise solving all hyperbolas Then we passed the solution points one-by-one through the Kalman Filter After sufficient number of steps, the solution converges. 9/19/2018 University of California, Riverside

Results from Kalman Filtering The order in which we different solution points are considered significantly effect the final estimate. The same set of solution points processed in different order by the filtering algorithm produces different final estimate. Some solution points are more significant than others Points should be processed in decreasing order of significance. If the solution point is inside the triangle formed by the corresponding verifier triplet, then it is more significant than others which are outside The solution point whose sum of normal distances to all hyperbolas is minimum is the most significant one. 9/19/2018 University of California, Riverside

Sensitivity w.r.t. to verifier triplet If the solution point lies outside the verifier triplet, then it is more sensitive to measurement errors 9/19/2018 University of California, Riverside

University of California, Riverside Error Sensitivity 9/19/2018 University of California, Riverside

Regions of uncertainty around Prover location 9/19/2018 University of California, Riverside

Regions are greater for Provers located out of the verifier triangle 9/19/2018 University of California, Riverside

(Selected) References 9/19/2018 University of California, Riverside

Thanks for your presence and patience Questions?