1. Performance Evaluation on Zero-Padded Waveform
Month Year
doc.: IEEE yy/xxxxr0
Performance Evaluation on Zero-Padded Waveform
Date:
Authors:
John Doe, Some Company

2. Abstract Security is one of the most important features in 11az.
Month Year
doc.: IEEE yy/xxxxr0
Abstract
Security is one of the most important features in 11az.
To achieve secure ranging, the waveform used for channel estimation needs to be protected against attackers.
According to FRD [1]:
Zero-padded waveform and random sequence [2]-[4] shall be used for ranging measurement in the Security Mode to protect against PHY-level attacks [5][6].
In this contribution, we provide numerical results for evaluating different options of zero-padded waveforms.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple
John Doe, Some Company

3. Recap on Zero-Padded Waveform
Zero-padded waveform is composed of three parts: zero prefix, core symbol, and zero postfix.
Zero prefix
Core symbol
Core symbol is composed by the training sequence, which is random.
Zero postfix (when necessary)
Zero signal is appended to each symbol if waveform is followed by non-zero signal.
Examples
One symbol:
Three symbols:
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

4. VHTz/HEz At the Tx side: At the Rx side:
Random sequence of length Lcore is loaded in frequency domain.
Shifted modulation, e.g., pi/2-BPSK or pi/4-QPSK, provides better performance on channel estimation.
At the Rx side:
DFT analysis window shall include the received signal corresponding to zero postfix.
DFT size can be equal to (Lgi+Lcore) or larger by adding more zeros for efficient FFT/IFFT operation (e.g., power of 2, or split-radix FFT).
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

5. DMGz/EDMGz At the Tx side: At the Rx side:
Random sequence of length Lcore is loaded in time domain.
At the Rx side:
DFT analysis window shall include the received signal corresponding to zero postfix.
DFT size can be equal to (Lgi+Lcore) or larger by adding more zeros for efficient FFT/IFFT operation (e.g., power of 2, or split-radix FFT).
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

6. Co-Existence with 11ac/11ax
Replace VHT-LTF/HE-LTF with secure ranging waveform (zero-padded waveform).
No need to support MU case, so VHT-SIGB may be omitted.
No need to include the MU format in the HE case.
Simpler than stitching channel estimates from multiple bands.
VHTz secure ranging:
HEz secure ranging:

7. Co-Existence with 11ad/11ay
Use SC PHY format.
DMGz:
STA defers based on the length field in L-Header.
EDMGz:
STA defers based on the length field in EDMG-Header-A.
Simpler than stitching channel estimates from multiple bands.
DMGz secure ranging:
EDMGz secure ranging:

8. Month Year
doc.: IEEE yy/xxxxr0
Evaluation Methods (1)
Mean squared error (MSE) between the true and estimated channels is chosen for evaluation metric, i.e.,
A baseline and convenient metric for evaluating different options.
The errors on the first arrival path matter more.
Higher power does not hurt, but less power may hurt.
Considering MSEs across all taps makes more sense for both ToA accuracy and security verification.
We envision that raw channel estimates will be used for fractional ToA estimate with high-resolution methods.
For consistency check channel estimate on each tap is used.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple
John Doe, Some Company

9. Month Year
doc.: IEEE yy/xxxxr0
Evaluation Methods (2)
Transform-domain channel estimation is employed at the receiver side.
Simple thus generally used for implementation, and distortionless.
Channel per tone in frequency domain is estimated based on MMSE method.
At the Rx side pilot sequences (in frequency) is the frequency-domain response of core symbol padded with zeros.
The number of padded zeros depends on the DFT size.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple
John Doe, Some Company

10. Options Under Consideration
Month Year
doc.: IEEE yy/xxxxr0
Options Under Consideration
Option 1:
At Tx side: more changes are needed.
Replace cyclic prefix (CP) with zero-padded prefix, use a smaller IDFT and the sum length (Lcore+Lgi) is equal to current existing DFT/IDFT size.
Add zero-added postfix if ranging waveform is followed by non-zero signal.
Need to develop a new tone plan.
At Rx side: less changes, can partially reuse existing modules.
E.g., for 80MHz: Lcore=192, Lgi=64, Nidft,tx=192, Ndft,rx= Nidft,rx=256.
Option 2:
At Tx side: less changes are needed.
Reuse existing numerology/tone plan and replace CP with zero-padded prefix.
Can reuse existing modules.
At Rx side: more changes are needed.
Need to use a large DFT/IDFT compared to existing ones.
E.g., for 80MHz: Lcore=256, Lgi=64, Nidft,tx=256, Ndft,rx= Nidft,rx=512.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple
John Doe, Some Company

11. Numerical Results (1): VHTz
Month Year
doc.: IEEE yy/xxxxr0
Numerical Results (1): VHTz
Assumption:
80MHz, Lgi=64.
Nyquist sampling rate.
Delay of each tap is an integer multiple of sampling periods.
Option 1:
Lcore=192, Nidft,tx=192, Ndft,rx=Ndft,rx=256.
Option 2:
Lcore=256, Nidft,tx=256, Ndft,rx=Ndft,rx=512.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple
John Doe, Some Company

12. Numerical Results (2): VHTz
Month Year
doc.: IEEE yy/xxxxr0
Numerical Results (2): VHTz
BPSK vs. pi/2-BPSK
pi/2-BPSK is superior to BPSK.
The distribution of magnitude of pilot sequence in freq. of pi/2-BPSK is more favorable for channel estimation.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple
John Doe, Some Company

13. Numerical Results (3): DMGz
Month Year
doc.: IEEE yy/xxxxr0
Numerical Results (3): DMGz
Assumption:
2.16GHz, Lgi=128.
Nyquist sampling rate.
Delay of each tap is an integer multiple of sampling periods.
Option 1: null GI at Tx side.
Lcore=384, Ndft,rx=Nidft,rx=512.
Option 2: Add additional GI at Tx side.
Lcore=512, Ndft,rx=Nidft,rx=1024.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple
John Doe, Some Company

14. Numerical Results (4): DMGz
Month Year
doc.: IEEE yy/xxxxr0
Numerical Results (4): DMGz
BPSK vs. pi/2-BPSK
pi/2-BPSK has similar performance as BPSK.
The distributions of magnitude of pilot sequence in freq. of both modulations are similar.
pi/2-BPSK is preferred for better PA performance.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple
John Doe, Some Company

15. Future Work Impairments to be considered:
Out-of-band emissions.
Non-ideal signal ramping up/down.
PAPR of core symbol.
Phase noise, CFO, AGC, etc.
Beyond transform-domain channel estimation.
Efficient methods of channel estimation to deal with non-ideal effective pilot sequences (in freq), i.e., magnitudes of pilot sequences are not flat.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

16. Summary
The performance of zero-padded waveforms with different parameters (Options 1&2) are similar.
Option 1 needs more changes at Tx side and Option 2 needs more changes at Rx side.
Implementation complexity will be the major concern for decision in between Option 1 and Option 2.
Prefer Option 2: Longer core symbol dilutes the effects of non-ideal signal ramping up/down.
Modulation format of pi/2-BPSK should be used for better performance.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

17. References
[1] IEEE /nnnn, 11az FRD. [2] IEEE /1378r2: “Zero-padded waveform for secure channel estimation”, M. Xu, J. Dogan, SK Yong, Q. Wang, K. Brogle, and AJ Ringer, Sept [3] IEEE /1372r1: “CP replay attack protection”, E. Lindskog, N. Zhang, C. Zhang, N. Kakani, and A. Raissinia, Sept [4] IEEE /0795r3: “PHY-level security protection”, Q. Li, F. Jiang, J. Segev, B. Abramovsky, C. Ghosh, O. Bar-Shalom, and R. Stacey, July [5] IEEE /0120r2: “Intel secured location threat model”, B. Abramovsky, O. Bar-Shalom, and C. Ghosh, Jan [6] IEEE /1122r0: “CP-replay threat model for 11az”, M. Xu, J. Dogan, K. Brogle, AJ Ringer, SK Yong, and Q. Wang, July 2017.
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

18. Straw Poll 1
For VHTz and HEz, we prefer the design of Null CP on the Tx side only, and have an implementation specific Rx FFT size (i.e. not specified by the standard).
Y: N: A:
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

19. Motion 1
Move to adopt the set of spec framework requirements listed below instruct the SFD editor to include it in the TGaz SFD under the sub-section 6 (security) for the .11az protocol .
For VHTz and Hez, the secured PHY LTF shall have a Null GI on the Tx side only, and have an implementation specific Rx FFT size (i.e. not specified by the standard).
Y: N: A:
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

20. Straw Poll 2
For secured PHY LTF we prefer the design of Null GI on the Tx side only, and have the receive processing stay unchanged (e.g., Rx FFT size). For example: GI is 72ns, core symbol is 218ns.
For DMGz, Lgi=128, Lcore=384, and NFFT,rx=512;
For EDMGz with channel bonding: Lgi=128*ncb, Lcore=384*ncb, and NFFT,rx=512*ncb.
Y: N: A:
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple

21. Motion 2
Move to adopt the set of spec framework requirements listed below instruct the SFD editor to include it in the TGaz SFD under the sub-section 6 (security) for the .11az protocol .
For DMGz and EDMGz, the secured PHY LTF shall have a Null GI on the Tx side only, and the receive processing shall remain unchanged (e.g., Rx FFT size). For example: GI is 72ns, core symbol is 218ns.
For DMGz, Lgi=128, Lcore=384, and NFFT,rx=512;
For EDMGz with channel bonding: Lgi=128*ncb, Lcore=384*ncb, and NFFT,rx=512*ncb.
Y: N: A:
Mingguang Xu, John Dogan, SK Yong, Qi Wang, Kyle Brogle, AJ Ringer, Apple