Performance Evaluation on Zero-Padded Waveform Month Year doc.: IEEE 802.11-yy/xxxxr0 Performance Evaluation on Zero-Padded Waveform Date: 2018-01-16 Authors: John Doe, Some Company

Abstract Security is one of the most important features in 11az. Month Year doc.: IEEE 802.11-yy/xxxxr0 Abstract Security is one of the most important features in 11az. To achieve secure ranging, the waveform used for channel estimation needs to be protected against attackers. According to FRD [1]: Zero-padded waveform and random sequence [2]-[4] shall be used for ranging measurement in the Security Mode to protect against PHY-level attacks [5][6]. In this contribution, we provide numerical results for evaluating different options of zero-padded waveforms. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple John Doe, Some Company

Recap on Zero-Padded Waveform Zero-padded waveform is composed of three parts: zero prefix, core symbol, and zero postfix. Zero prefix Core symbol Core symbol is composed by the training sequence, which is random. Zero postfix (when necessary) Zero signal is appended to each symbol if waveform is followed by non-zero signal. Examples One symbol: Three symbols: Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

VHTz/HEz At the Tx side: At the Rx side: Random sequence of length Lcore is loaded in frequency domain. Shifted modulation, e.g., pi/2-BPSK or pi/4-QPSK, provides better performance on channel estimation. At the Rx side: DFT analysis window shall include the received signal corresponding to zero postfix. DFT size can be equal to (Lgi+Lcore) or larger by adding more zeros for efficient FFT/IFFT operation (e.g., power of 2, or split-radix FFT). Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

DMGz/EDMGz At the Tx side: At the Rx side: Random sequence of length Lcore is loaded in time domain. At the Rx side: DFT analysis window shall include the received signal corresponding to zero postfix. DFT size can be equal to (Lgi+Lcore) or larger by adding more zeros for efficient FFT/IFFT operation (e.g., power of 2, or split-radix FFT). Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

Co-Existence with 11ac/11ax Replace VHT-LTF/HE-LTF with secure ranging waveform (zero-padded waveform). No need to support MU case, so VHT-SIGB may be omitted. No need to include the MU format in the HE case. Simpler than stitching channel estimates from multiple bands. VHTz secure ranging: HEz secure ranging:

Co-Existence with 11ad/11ay Use SC PHY format. DMGz: STA defers based on the length field in L-Header. EDMGz: STA defers based on the length field in EDMG-Header-A. Simpler than stitching channel estimates from multiple bands. DMGz secure ranging: EDMGz secure ranging:

Month Year doc.: IEEE 802.11-yy/xxxxr0 Evaluation Methods (1) Mean squared error (MSE) between the true and estimated channels is chosen for evaluation metric, i.e., A baseline and convenient metric for evaluating different options. The errors on the first arrival path matter more. Higher power does not hurt, but less power may hurt. Considering MSEs across all taps makes more sense for both ToA accuracy and security verification. We envision that raw channel estimates will be used for fractional ToA estimate with high-resolution methods. For consistency check channel estimate on each tap is used. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple John Doe, Some Company

Month Year doc.: IEEE 802.11-yy/xxxxr0 Evaluation Methods (2) Transform-domain channel estimation is employed at the receiver side. Simple thus generally used for implementation, and distortionless. Channel per tone in frequency domain is estimated based on MMSE method. At the Rx side pilot sequences (in frequency) is the frequency-domain response of core symbol padded with zeros. The number of padded zeros depends on the DFT size. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple John Doe, Some Company

Options Under Consideration Month Year doc.: IEEE 802.11-yy/xxxxr0 Options Under Consideration Option 1: At Tx side: more changes are needed. Replace cyclic prefix (CP) with zero-padded prefix, use a smaller IDFT and the sum length (Lcore+Lgi) is equal to current existing DFT/IDFT size. Add zero-added postfix if ranging waveform is followed by non-zero signal. Need to develop a new tone plan. At Rx side: less changes, can partially reuse existing modules. E.g., for 80MHz: Lcore=192, Lgi=64, Nidft,tx=192, Ndft,rx= Nidft,rx=256. Option 2: At Tx side: less changes are needed. Reuse existing numerology/tone plan and replace CP with zero-padded prefix. Can reuse existing modules. At Rx side: more changes are needed. Need to use a large DFT/IDFT compared to existing ones. E.g., for 80MHz: Lcore=256, Lgi=64, Nidft,tx=256, Ndft,rx= Nidft,rx=512. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple John Doe, Some Company

Numerical Results (1): VHTz Month Year doc.: IEEE 802.11-yy/xxxxr0 Numerical Results (1): VHTz Assumption: 80MHz, Lgi=64. Nyquist sampling rate. Delay of each tap is an integer multiple of sampling periods. Option 1: Lcore=192, Nidft,tx=192, Ndft,rx=Ndft,rx=256. Option 2: Lcore=256, Nidft,tx=256, Ndft,rx=Ndft,rx=512. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple John Doe, Some Company

Numerical Results (2): VHTz Month Year doc.: IEEE 802.11-yy/xxxxr0 Numerical Results (2): VHTz BPSK vs. pi/2-BPSK pi/2-BPSK is superior to BPSK. The distribution of magnitude of pilot sequence in freq. of pi/2-BPSK is more favorable for channel estimation. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple John Doe, Some Company

Numerical Results (3): DMGz Month Year doc.: IEEE 802.11-yy/xxxxr0 Numerical Results (3): DMGz Assumption: 2.16GHz, Lgi=128. Nyquist sampling rate. Delay of each tap is an integer multiple of sampling periods. Option 1: null GI at Tx side. Lcore=384, Ndft,rx=Nidft,rx=512. Option 2: Add additional GI at Tx side. Lcore=512, Ndft,rx=Nidft,rx=1024. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple John Doe, Some Company

Numerical Results (4): DMGz Month Year doc.: IEEE 802.11-yy/xxxxr0 Numerical Results (4): DMGz BPSK vs. pi/2-BPSK pi/2-BPSK has similar performance as BPSK. The distributions of magnitude of pilot sequence in freq. of both modulations are similar. pi/2-BPSK is preferred for better PA performance. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple John Doe, Some Company

Future Work Impairments to be considered: Out-of-band emissions. Non-ideal signal ramping up/down. PAPR of core symbol. Phase noise, CFO, AGC, etc. Beyond transform-domain channel estimation. Efficient methods of channel estimation to deal with non-ideal effective pilot sequences (in freq), i.e., magnitudes of pilot sequences are not flat. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

Summary The performance of zero-padded waveforms with different parameters (Options 1&2) are similar. Option 1 needs more changes at Tx side and Option 2 needs more changes at Rx side. Implementation complexity will be the major concern for decision in between Option 1 and Option 2. Prefer Option 2: Longer core symbol dilutes the effects of non-ideal signal ramping up/down. Modulation format of pi/2-BPSK should be used for better performance. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

References [1] IEEE 802.11-16/nnnn, 11az FRD. [2] IEEE 802.11-17/1378r2: “Zero-padded waveform for secure channel estimation”, M. Xu, J. Dogan, SK Yong, Q. Wang, K. Brogle, and AJ Ringer, Sept. 2017. [3] IEEE 802.11-17/1372r1: “CP replay attack protection”, E. Lindskog, N. Zhang, C. Zhang, N. Kakani, and A. Raissinia, Sept. 2017. [4] IEEE 802.11-17/0795r3: “PHY-level security protection”, Q. Li, F. Jiang, J. Segev, B. Abramovsky, C. Ghosh, O. Bar-Shalom, and R. Stacey, July 2017. [5] IEEE 802.11-17/0120r2: “Intel secured location threat model”, B. Abramovsky, O. Bar-Shalom, and C. Ghosh, Jan. 2017. [6] IEEE 802.11-17/1122r0: “CP-replay threat model for 11az”, M. Xu, J. Dogan, K. Brogle, AJ Ringer, SK Yong, and Q. Wang, July 2017. Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

Straw Poll 1 For VHTz and HEz, we prefer the design of Null CP on the Tx side only, and have an implementation specific Rx FFT size (i.e. not specified by the standard). Y: N: A: Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

Motion 1 Move to adopt the set of spec framework requirements listed below instruct the SFD editor to include it in the TGaz SFD under the sub-section 6 (security) for the .11az protocol . For VHTz and Hez, the secured PHY LTF shall have a Null GI on the Tx side only, and have an implementation specific Rx FFT size (i.e. not specified by the standard). Y: N: A: Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

Straw Poll 2 For secured PHY LTF we prefer the design of Null GI on the Tx side only, and have the receive processing stay unchanged (e.g., Rx FFT size). For example: GI is 72ns, core symbol is 218ns. For DMGz, Lgi=128, Lcore=384, and NFFT,rx=512; For EDMGz with channel bonding: Lgi=128*ncb, Lcore=384*ncb, and NFFT,rx=512*ncb. Y: N: A: Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

Motion 2 Move to adopt the set of spec framework requirements listed below instruct the SFD editor to include it in the TGaz SFD under the sub-section 6 (security) for the .11az protocol . For DMGz and EDMGz, the secured PHY LTF shall have a Null GI on the Tx side only, and the receive processing shall remain unchanged (e.g., Rx FFT size). For example: GI is 72ns, core symbol is 218ns. For DMGz, Lgi=128, Lcore=384, and NFFT,rx=512; For EDMGz with channel bonding: Lgi=128*ncb, Lcore=384*ncb, and NFFT,rx=512*ncb. Y: N: A: Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple