The adoption of Service-Based Architecture (SBA) in 5G Core Networks (5GC) has significantly transformed the design and operation of the control plane, enabling greater flexibility and agility for cloud-native deployments. While the infrastructure has initially evolved by implementing key functions, there remains significant potential for additional services, such as localization, paving the way for the integration of the Location Management Function (LMF). However, the extensive functional decomposition within SBA leads to consequences, such as the increase of control plane operations. Specifically, we observe that the additional signaling traffic introduced by the presence of the LMF overwhelms the Access and Mobility Management Function (AMF) which is responsible for authentication and mobility. In fact, in mobile positioning, each connected mobile device requires a significant amount of control traffic to support location algorithms in the 5GC. To address this scalability challenge, we analyze the impact of three well-known optimization techniques on location procedures to reduce control message traffic in the specific context of the 5GC, namely a caching system, a request aggregation system, and a service scalability system. Our solutions are evaluated in an OpenAirInterface (OAI) emulated environment with real hardware. After the analysis in the emulated environment, we select the caching system – due to its feasibility – for being analyzed in a real 5G testbed. Our results demonstrate a significant reduction in the additional overhead introduced by the LMF, improving scalability by minimizing the impact on AMF processing time up to a 50% reduction.

Spectrum crowdsensing is a paradigm where participants upload their collected spectrum data to the cloud for extracting analytics. First movers like Microsoft Spectrum Observatory and Electrosense, though with support from leading industry, research, and government, still suffer from sustainability challenges. In this paper, we present Fiesta, a sustainable framework for spectrum crowdsensing. On the technology side, we use federated learning and blockchain to decentralize the data analysis computations. For individual participants, minimal invasion of privacy suppresses concerns regarding large-scale adoption. From organizations’ perspectives, using blockchain avoids single point of failure and enhances the robustness of the entire system against malicious attacks. On the policy side, we propose a reward quantification mechanism to motivate engagement. Potential funding sources to ensure ongoing sustainability are also discussed. We have demonstrated Fiesta through simulation testbeds and real-world deployments with two demo tasks. Results show that Fiesta, as a decentralized framework, can preserve user privacy, enhance system robustness, maintain data fidelity compared with traditional methods, and fairly reward participants. We believe Fiesta is a stepping stone for the future spectrum crowdsensing paradigm.

Analog backscatter communication enables ultra-low-power and low-cost wireless connectivity, making it a promising alternative to traditional RFID systems. Although analog backscatter systems offer simplicity, they are by design less capable compared to their digital backscatter counterparts. A key drawback of existing analog backscatter systems is their single-tag operation, which poses limitations for applications that require multiple tags to function simultaneously. In this paper, we propose a novel low-cost analog backscatter system that allows multiple tags to sense the channel concurrently, thereby enabling signal strength-based localization and tracking of ambient RF sources. The ability to localize RF sources is essential for interference management, security, and optimization of wireless networks, particularly in dynamic environments. We evaluate our system in indoor settings, and demonstrate localization accuracy of RF sources with an average error of 20 cm in a 3m range, without requiring calibration. Our system is also capable of tracking RF sources with an average speed up to 0.6m/s with an average power consumption of 526µW, making it a promising solution for real-time and energy-constrained applications.

Ensuring user privacy remains a critical concern within mobile cellular networks, particularly given the proliferation of interconnected devices and services. In fact, a lot of user privacy issues have been raised in 2G, 3G, and 4G networks. Acknowledging these concerns, 3GPP has prioritized addressing these issues in the development of 5G, implementing numerous modifications to enhance user privacy since 5G Release 15. In this systematization of knowledge paper, we first provide a framework for studying privacy and security related attacks in cellular networks, setting as privacy objective the User Identity Confidentiality defined in 3GPP standards. Using this framework, we discuss existing privacy and security attacks in pre-5G networks, analyzing the weaknesses that lead to these attacks. Furthermore, we thoroughly study the security characteristics of 5G up to the latest 5G-Advanced Release 19, and examine mitigation mechanisms of 5G to the identified pre-5G attacks. Afterwards, we analyze how recent 5G attacks try to overcome these mitigation mechanisms. Finally, we identify current limitations and open problems in security of 5G, and propose directions for future work.

Solar cells have shown promising performance for Simultaneous Lightwave Information and Power Transfer (SLIPT). Most of literature has focused on applying this concept to battery-powered high-data rate communication. Nevertheless, its application is also particularly advantageous in the low-data rate regime for battery-free systems. However, we find that using the same solar cell causes both communication and harvesting performances degradation. This problem is particularly critical in battery-free systems for its size and power constraints. This paper reveals that the reason behind this problem is that solar cells are typically operated at their Maximum Power Point (MPP), which optimizes energy harvesting but is inefficient for communication. In order to address this finding we introduce, for the first time, the Maximum Communication Point (MCP), a new operating point that complements the traditional MPP by optimizing communication performance. We then propose a transformer-based SLIPT design that enables an accurate control of the impedance at the solar cell’s output and thereby allowing precise selection of its operating point. Extensive experiments show that our system provides communication gains of 5x in peak-to-peak received voltage when operating at the MCP, and harvested power gains of more than 3x when operating at the MPP, with respect to the best performing state-of-the-art design.

Crowdsensing networks for the sole purpose of performing spectrum measurements have resulted in prior initiatives that have failed primarily due to their costs for maintenance. In this paper, we take a different view and propose ORAN-Sense, a novel architecture of Internet of Things (IoT) spectrum crowd-sensing devices integrated into the Next Generation of cellular networks. We use this framework to extend the capabilities of 5G networks and localize a transmitter that does not collaborate in the process of positioning. While 5G signals can not be applied to this scenario as the transmitter does not participate in the localization process through dedicated pilot symbols and data, we show how to use Time Difference of Arrival-based positioning using low-cost spectrum sensors, minimizing hardware impairments of low-cost spectrum receivers, introducing methods to address errors caused by over-the-air signal propagation, and proposing a low-cost synchronization technique. We have deployed our localization network in two major cities in Europe. Our experimental results indicate that signal localization of non-collaborative transmitters is feasible even using low-cost radio receivers with median accuracies of tens of meters with just a few sensors spanning cities, which makes it suitable for its integration in the Next Generation of cellular networks.

Fifth generation (5G) and beyond cellular networks are vulnerable to security threats, primarily due to the lack of integrity protection in the Radio Resource Control (RRC) layer. In order to address this problem, we propose a real-time anomaly detection framework that leverages the concept of distributed applications in 5G Open RAN networks. Specifically, we identify Physical Layer (PHY) features that can generate a reliable fingerprint, infer in a novel way the time of arrival of uplink packets lacking integrity protection, and handle cross-layer features. By identifying legitimate message sources and detecting suspicious activities through an Artificial Intelligence (AI) design, we demonstrate that Open RAN-based applications that run at the edge can be designed to provide additional security to the network. Our solution is first validated in extensive emulation environments achieving over 85% accuracy in predicting potential attacks on unseen test scenarios. We then integrate our approach into a real-world prototype with a large channel emulator to assess its real-time performance and costs. Our solution meets the low-latency real-time constraints of 2 ms, making it well-suited for real-world deployments.

Ensuring user privacy remains critical in mobile networks, particularly with the rise of connected devices and denser 5G infrastructure. Privacy concerns have persisted across 2G, 3G, and 4G/LTE networks. Recognizing these concerns, the 3rd Generation Partnership Project (3GPP) has made privacy enhancements in 5G Release 15. However, the extent of operator adoption remains unclear, especially as most networks operate in 5G Non Stand Alone (NSA) mode, relying on 4G Core Networks. This study provides the first qualitative and experimental comparison between 5G NSA and Stand Alone in real operator networks, focusing on privacy enhancements addressing top 8 pre-5G attacks based on recent academic literature. Also, it evaluates the privacy levels of OpenAirInterface, a leading open-source software for 5G, against real network deployments for the same attacks, revealing two new 5G privacy vulnerabilities, and underscoring the need for further studies and stricter standards.

Positioning is a key focus in 5G standardization, starting with 3GPP Release 16. However, most of the effort from the research community and work presented in the technical standardization has been limited mainly to simulation studies. This paper explores the use of software-defined radios (SDRs) platforms for 5G positioning, presenting an overview of the current state-of-the-art and available open-source platforms. Utilizing an advanced SDR-based multi-gNodeBs (gNBs) synchronized testbed, the paper conducts a series of time-based, over-the-air measurements. Results offer insights into the impact of various real-world system parameters, such as the number of gNBs, transmission bandwidth, signal processing techniques, and localization algorithms on positioning accuracy and Time to First Fix (TTFF). These findings provide a pathway for the cost-effective and efficient implementation of high-precision 5G localization systems. The paper contributes to advancing both theoretical understanding and practical applications, serving as a guide for the development of 5G positioning technology.

Positioning based on aircraft signals has been proposed as an alternative to satellite-based positioning systems (e.g. GPS). However, so far, no deployment of this technique exists, and the real-world performance remains unclear. This paper contributes at better understanding the performance tradeoffs under realistic conditions. We implement SkyPos, a localization system for GPS-denied areas or location integrity that opportunistically uses the large availability of aircraft signals to self-localize receivers. We analyze SkyPos with data collected from hundreds of sensors and thousands of aircraft around Europe. Our results show that we can achieve median accuracy down to 10m in seconds, enabling almost real-time positioning or location verification using aircraft signals at scale.

Indoor positioning is a major challenge for location-based services. WiFi deployments are often used to address indoor positioning. Yet, they requiremultiple access points, which may not be available or accessible for localization in all scenarios, or they make unrealistic assumptions for practical deployments. In this paper we presentSPRING+, a positioning system that extracts and processes Channel State Information (CSI) and Fine Time Measurements (FTM) from a single Access Point (AP) to localize commercial smartphones. First, we propose an adaptive method for estimating the Angle of Arrival (AOA) from CSI that works on single packets and leverages information from the estimated number of paths. Second, we present a new method to detect the first path using FTM measurements, robust to multipath scenarios. We evaluate SPRING+ in an extensive experimental campaign consisting of four different testbeds: i) generic indoor spaces, ii) generic indoor spaces with obstacles, iii) office environments and iv) home environments. Our results show that SPRING+ is able to achieve a median 2D positioning error between 1 and 1.8 meters with asingle WiFi AP.

Light bulbs have been recently explored to design Light Fidelity (LiFi) communication to battery-free tags, thus complementing Radiofrequency (RF) backscatter in the uplink. In this paper, we show that LiFi and RF backscatter are complementary and have unexplored interactions. We introduce PassiveLiFi, a battery-free system that uses LiFi to transmit RF backscatter at a meagre power budget. We address several challenges on the system design in the LiFi transmitter, the tag and the RF receiver. We design the first LiFi transmitter that implements a chirp spread spectrum (CSS) using the visible light spectrum. We use a small bank of solar cells for both communication and harvesting, and reconfigure them based on the amount of harvested energy and desired data rate. We further alleviate the low responsiveness of solar cells with a new low-power receiver design in the tag. We design and implement a novel technique for embedding multiple symbols in the RF backscatter based on delayed chirps. Experimental results with an RF carrier of 17dBm show that we can generate RF backscatter with a range of 92.1 meters/$\mu \text{W}$consumed in the tag, which is almost double with respect to prior work.

While much research effort has been invested in long-range and low-power uplink communication for battery-free IoT networks, current deployments lack a scalable bidirectional communication infrastructure for data collection and processing with battery-free devices. To fill this gap, we introduce Lo W-Fi, a system architecture specifically designed to meet the requirements of battery-free IoT applications. We show the suitability of LoW-Fi for deploying monitoring systems for precision agriculture indoors. This sector is revolutionizing with the installation of smart greenhouses that require the constant monitoring of ambient parameters to ensure optimal conditions for the crops growth. Our system is implemented using commercial off-the-shelf devices, and it works at the intersection of WiFi and LiFi for downlink and RF backscatter for uplink, retaining the advantages of each technology and solving their practical limitations. We evaluate LoW-Fi performance in a real greenhouse, and the experimental results show that it can achieve an uplink (downlink) range of 45m(70m) with 0% BER. The aggregated data rate is up to 4.5 Mb/s.

Spectrum crowdsensing systems do not provide labeled data near real-time yet. We propose a framework that addresses this challenge and relies solely on Power Spectrum Density (PSD) data collected by low-cost receivers. A major hurdle is to design a system that is computationally efficient for near real-time operation, yet using only the limited 2 MHz bandwidth of low-cost spectrum sensors. First, we present a method for unsupervised transmission detection that works with PSD data already collected by the backend of the crowdsensing platform, and that provides stable detection of transmission boundaries. Second, we introduce a data-driven deep learning solution to classify the wireless technology used by the transmitter, using transmission features in a compressed space extracted from single PSD measurements over at most 2 MHz band. We build an experimental platform, and evaluate our framework with real-world data collected from 47 different sensors deployed across Europe. We show that our framework yields an average classification accuracy close to 94.25% over the testing dataset, with a maximum latency of 3.4 seconds when integrated in the backend of a major crowdsensing network. Code and data have been released for reproducibility and further studies.

With the advancement of the Internet of Things (IoT), many devices will be connected to the Internet, enabling digital twin and smart home applications. However, currently, these IoT devices are operating at lower frequency bands of the wireless spectrum, typically ranging from a few hundred MHz (such as RFID and LoRa) to a few GHz (such as BLE and WiFi). As a result, the current IoT devices not only place a huge strain on these bands, but also cannot benefit from the large bandwidth available in the higher frequencies of the spectrum such as mmWave bands. In this paper, our goal is to bring mmWave technology to existing IoT devices so they can benefit from the advantages this technology offers, such as high network capacity, low interference, and Space Division Multiple Access. To this end, we design mmPlug, a novel plug-and-play module which is simple and energy-efficient. mmPlug can be easily connected to the antenna port of any IoT device, enabling it to operate in the mmWave band. mm-Plug is compatible with different wireless technologies (such as WiFi, Lora, etc.) and does not require any modification to the circuit, firmware or communication protocols of the existing IoT devices. mmPlug achieves this by a novel design which can seamlessly be connected to the antenna port of the IoT device. We have implemented mmPlug on PCB and empirically evaluated its performance. Our results show that mmPlug enables existing IoT devices (such as WiFi and Lora) to operate at mmWave band while achieving accurate localization, uplink and downlink even when they are more than 30 m far from the access point.

In this paper, we demonstrate PassiveLiFi, a battery-free system that works at the intersection of Light-Fidelity (LiFi) and Radio-Frequency (RF) backscatter technologies to enable long-range and ultra-low power wireless communications. We show how the PassiveLiFi tag can transmit real measured data through an interactive demo, and we display the received data in a customized graphical user interface. Our demo shows the suitability of PassiveLiFi for implementing real IoT applications, such as monitoring systems for smart agrifood facilities (i.e., greenhouses and vertical farms).

Radio-Frequency (RF) backscatter has emerged as a low-power communication technique. Backscatter systems either rely on active signal generators (spectrum efficient, but dedicated infrastructure) or existing ambient wireless transmissions (existing infrastructure, but spectrum inefficient). In this paper, we aim to make RF backscatter spectrum efficient and at the same time work with existing infrastructure. We propose to leverage the deployment of LiFi networks built upon LED bulbs for pervasive RF backscatter. We experimentally demonstrate that LiFi, which passively leaks RF signals, can be exploited as a radio carrier generator for low-power RF backscatter. We further design LeakageScatter, the first backscatter system operating in the ISM band and exploiting LiFi-leaked RF signals, without the need to actively generate the carrier wave. We customize the design of the loop at the LiFi transmitter, as well as the coil antennas at the tag and RF backscatter receiver, to optimize the system performance. We propose to opportunistically enable the oscillator of the backscatter tag in the software that could reduce the energy consumption on backscattering by up to 75%. Experimental results show that LeakageScatter achieves a backscattering distance up to 10 m and 18 m in indoor and outdoor scenarios, respectively, without using a dedicated RF carrier generator.

The advent of the fourth Industrial Revolution (Industry 4.0) requires wireless networked solutions to connect machines. However, the industrial environment is notorious for being averse to wireless communication, with traditional wireless resource mechanisms prone to errors because of metallic objects. In this work, we propose to exploit the knowledge of location to derive context information and dynamically allocate wireless resources intime and spaceto target devices. We exploit the spatial geometry of the Access Points (APs) and we introduce a statistical model that maps the user position’s spatial distribution to an angle error distribution and derive a hypothesis test to declare if the link is under metallic blockage or not. In order to avoid changes to the client side and operate with a single interface radio, we usethe samewireless network both for positioning and scheduling. We experimentally show that our system can localize four mobile robots deployed in a very harsh environment with metal obstacles and reflections. Context information applied to wireless resources protocol help increasing up to 40 percent of the network throughput in the above industrial-like scenario.

Understanding spectrum activity is challenging when attempted at scale. The wireless community has recently risen to this challenge in designing spectrum monitoring systems that utilize many low-cost spectrum sensors to gather large volumes of sampled data across space, time, and frequencies. These crowdsensing systems are limited by the uplink bandwidth available to backhaul the raw in-phase and quadrature (IQ) samples and power spectrum density (PSD) data needed to run various applications. This paper presents FlexSpec, a framework based on the Walsh-Hadamard transform to compress spectrum data collected from distributed and low-cost sensors for real-time applications. This transformation allows sensors to significantly save uplink bandwidth thanks to its inherent properties both when it is applied to IQ and PSD data. Additionally, by leveraging a feedback loop between the sensor and the edge device it connects to, FlexSpec carefully adapts the compression ratio over time to changes in the spectrum and different applications, jointly considering data size, application performance, and spectrum variations. We experimentally evaluate FlexSpec in several applications. Our results show that FlexSpec is particularly suitable for IoT transmissions and signals close to the noise floor. Compared with prior work, FlexSpec provides up to$7\times $more reduction of uplink data size for signal detection based on PSD data, and reduces up to$6\times $to$8\times $the number of undecodable messages for IQ sample decoding.

Localization has achieved great attention in 5G networks, pushed by standardization. However, experimentation in 5G networks lacks the integration of network function modules designed for localization. We present our implementation of the 5G Localization Management Function. It complies with the 3GPP standard and OpenAirInterface, the most advanced framework that implements a full 5G-New Radio stack. We show that we are able to extend the functionality of OpenAirInterface, enabling location services. Finally, we demonstrate that the tool's performance satisfies the 5G Key Performance Indicators required by 3GPP for localization.

RGB LED bulbs have entered the market as a promising alternative to traditional phosphor coating LEDs to meet illumination standards. In this paper, we introduce and propose solutions to address the challenges of RGB LED lighting for the Internet of Things applications, performing communication, harvesting energy and sensing tasks. Through experiments, we demonstrate that we can use RGB LEDs for multiple tasks. We can achieve a bandwidth in the order of 50 kHz and distances of around 3.5 m using commercial RGB LED bulbs as transceivers, without using any dedicated photodetector. RGB LED links are composed of three main colours, and we show that red is the best colour both for communicating to another receiving RGB LED bulb, as well as for harvesting with a solar cell; green and blue can instead be exploited for standard-compliant lighting and/or sensing purposes. We evaluate the system in two proof of concepts and provide insights for operating RGB LEDs for multiple tasks.

Light bulbs have been recently explored to design Light Fidelity (LiFi) communication to battery-free tags, thus complementing Radiofrequency (RF) backscatter in the uplink. In this paper, we show that LiFi and RF backscatter are complementary and have unexplored interactions. We introduce PassiveLiFi, a battery-free system that uses LiFi to transmit RF backscatter at a meagre power budget. We address several challenges on the system design in the LiFi transmitter, the tag and the RF receiver. We design the first LiFi transmitter that implements a chirp spread spectrum (CSS) using the visible light spectrum. We use a small bank of solar cells for communication and harvesting and reconfigure them based on the amount of harvested energy and desired data rate. We further alleviate the low responsiveness of solar cells with a new low-power receiver design in the tag. Experimental results with an RF carrier of 17 dBm show that we can generate RF backscatter with a range of 80.3 meters/μW consumed in the tag, which is almost double with respect to prior work.

Inertial sensors embedded in mobile devices, such as accelerometers and gyroscopes, have shown great potential to study human motion. In this paper, we propose to estimate the device movement without any access to physical inertial sensors in the mobile. Our idea is to infer the movements of the mobile through radio measurements, a concept we call “virtual inertial sensors”. We propose a method for estimating the rotation of a user that uses only WiFi Fine Time Measurements (FTM) to infer the rotation speed. We evaluate and demonstrate the proposed approach with experiments, using commodity 802.11ac Access Point (AP)s for Channel State Information (CSI) and FTMs measurements, and a Google Pixel 3 smartphone as mobile terminal. While FTM works with only one single antenna, it achieves better performance than a CSI-based estimator that exploits four antennas and multiple sub-carriers at the AP, but is limited by the typical one single WiFi antenna at the smartphone side. Together with walking speed estimation of a user, we envision that virtual inertial sensors can be leveraged by location systems and sensing mechanisms, including 5G, to improve localization accuracy, infer user behavior, and design better and more secure communication.

The growth rate of Internet-of-Things (IoT) devices sold globally is constantly lower than the forecast. This deceleration is caused in part by the need for batteries and the scalability cost for their replacement. Backscatter has attracted significant interest over the past couple of years to enable sustainable sensing devices by eliminating batteries. IoT devices have been designed for transmitting sensed data with backscatter, but the question of efficient reception of data with battery-free devices is still open. As shown in this paper, classical low-power Radio Frequency (RF) envelope detectors are affected by low sensitivity, false detection alarms, and low energy efficiency. We argue that Light Fidelity (LiFi) can provide downlink and harvesting medium as LED lights are becoming pervasively deployed for illumination. We show, for the first time, that the advantages of LiFi and RF backscatter can be combined for battery-free communication. We design a low-power platform that leverages the complementary nature of these two mediums. We demonstrate that our platform removes energy-inefficiency in the downlink reception typical of RF backscatter, and significantly expands the deployment scenarios for battery-free tags when compared to conventional single-technology designs.

Given the availability of lightweight radio and processing technology, it becomes feasible to imagine spectrum sensing systems using weather balloons. Such balloons navigate the airspace up to 40 km, and can provide a bird's eye and clear view of terrestrial, as well as aerial spectrum use. In this paper, we present SkySense, which is an extension of the Electrosense sensing framework with mobile GPS-located sensors and local data logging. In addition, we present 6 different sensing campaigns, targeting multiple terrestrial or aerial technologies such as ADS-B, AIS or LTE. For instance, for ADS-B, we can clearly conclude that the number of airplanes that are detected is the same for each balloon altitude, but the message reception rate decreases strongly with altitude because of collisions. For each sensing campaign, the dataset is described, and some example spectrum analysis results are presented. In addition, we analyse and quantify important trends visible when sensing from the sky, such as temperature and hardware variations, increased ambient interference levels, as well as hardware limitations of the lightweight system. A key challenge is the automatic gain control and dynamic range of the system, as a radio navigating over 30km, sees a very wide range of possible signal levels. All data is publicly available through the Electrosense framework, to encourage the spectrum sensing community to further analyse the data or motivate further measurement campaigns using weather balloons.

Light-based positioning systems (LPS) are gaining significant attention as a means to provide localization with cm accuracy. Many of these systems estimate the object position based on the received light intensity, and work properly in `ideal' environments such as large open spaces without obstructions around the light-emitting diode (LED) and the receiver, where reflections are negligible. In more dynamic environments, such as indoor spaces with moving people and city roads with moving vehicles, materials cause a wide variety of reflections. This causes variations in the received light intensity and, as a consequence, gross localization errors in LPS. We propose a new multipath detection technique for improving LPS that does not require the knowledge of the channel impulse response and then, it is suited to be implemented in low-cost positioning receivers that use a single-pixel photodetector. To develop our technique, we (i) analyze the statistical properties of non-line-of-sight (NLOS) components, (ii) develop an automated testbed to study the reflections of different types of surfaces and materials, and (iii) design an algorithm to remove the NLOS components affecting the positioning estimate. Our experimental evaluation shows that, in complex environments, our methodology can reduce the localization error using LEDs up to 93%.

GNSS/GPS is a positioning system widely used nowadays in our lives for real-time localization in Earth. This technology is highly vulnerable to spoofing/jamming attacks caused by malicious intruders. In the recent years, commodity and low-cost radio-frequency hardware have been used to interfere with the legitimate GPS signal. Existing spoofing detection solutions use costly receivers and computationally expensive algorithms which limit the large-scale deployment. In this work we propose a GNSS spoofing detection system that can run on spectrum sensors with Software-Defined Radio (SDR) capabilities and cost in the order of 20 euros. Our approach exploits the predictability of the Doppler characteristics of the received GPS signals to determine the presence of anomalies or malicious attackers. We propose an artificial recurrent neural network (RNN) based on Long short-term memory (LSTM) for anomaly detection. We use data received by low-cost SDR receivers that are processed locally by low-cost embedded machines such as Nvidia Jetson Nano to provide inference capabilities. We show that our solution predicts very accurately the Doppler shift of GNSS signals and can determine the presence of a spoofing transmitter.

LED luminaries are now deployed densely in indoor areas to provide uniform illumination. Visible Light Communication (VLC) can also benefit from this dense LED infrastructure. In this paper, we propose DenseVLC, a cell-free massive MIMO networking system enabled by densely distributed LEDs, that forms different beamspots to simultaneously serve multiple receivers. This is a cell-free system, as there is no notion of autonomous cells and transmitters cooperate to jointly serve the users. Given a power budget for communication, DenseVLC assigns the power budget among the distributed LEDs to optimize the system throughput and user fairness. We formulate an optimization problem to derive the optimal policy for the power allocation. Our insights from the optimal policies allow us to simplify DenseVLC's system design and propose a heuristic algorithm that can reduce the complexity by 99.96%. Besides, we propose a novel synchronization method using non-line-of-sight VLC to synchronize all the transmitters that will form a beamspot to serve the same receiver. We implement DenseVLC with off-the-shelf devices, solve practical challenges in the system design, and evaluate it with extensive and realistic experiments in a system of 36 transmitters and 4 receivers in an area of 3 m × 3 m. Our results show that DenseVLC can improve the average system throughput by 45%, or improve the average power efficiency by 2.3 times, while maintaining the requirement for uniform illumination. Finally, we demonstrate that DenseVLC is robust against blockage.

Despite the large literature on localization, there is no solution yet to localize a commercial off-the-shelf smartphone device using radio measurements from a single WiFi AP. We present SPRING, Smartphone Positioning with Radio measurements from a sINGle wifi access point. SPRING exploits Fine Time Measurements (FTM) and Angle of Arrival (AOA) extracted from commercial chipsets exploiting the specifications of the recent 802.11-2016 and the 802.11ac amendment to combine distance and direction from the AP to the client for positioning. Our system has the potential to bring indoor positioning to homes and small businesses which typically have a single access point. We exploit physical layer (PHY) information to detect the number of paths and their directions. We use this information to derive a new method for filtering ranging measurements obtained with the FTM protocol. We achieve sub-meter distance estimation accuracy eliminating the adverse effect of multipath in FTM using calibrated inputs from Channel State Information (CSI). Our evaluation in indoor scenarios in multipath rich environments demonstrates that the combination of AOA estimation and the proposed FTM refinement approach can locate a Google Pixel 3 smartphone with a median positioning error of 0.9-2.15 m through an area comparable to typical flat sizes.

We analyze and optimize the performance of a new type of channel that exploits sunlight for wireless communication. Recent advances on visible light backscatter have shown that if mobile objects attach distinctive reflective patterns to their surfaces, simple photosensors deployed in our environments can decode the reflected light signals. Although the vision is promising, only initial feasibility studies have been performed so far. There is no analysis on how much information this channel can transmit or how reliable the links are. Achieving this vision is a complex endeavour because we have no control over (i) the sun or clouds, which determine the amount and direction of light intensity, and (ii) the mobile object, which determines the modulated reflection of sunlight. We investigate the impact of the surrounding light intensity and physical properties of the object (reflective materials, size and speed) to design a communication system that optimizes the encoding and decoding of information with sunlight. Our experimental evaluation, performed with a car moving on a regular street, shows that our analysis leads to significant improvements across many dimensions. Compared to the state of the art, we can encode seven times more information, and decode this information reliably from an object moving three times faster (53km/h) at a range that is four times longer (4m) and with three times lower light intensity (cloudy day).

In recent years we are experiencing an important growth of interest for sensing the electromagnetic spectrum and making its access more agile. Emerging initiatives use low-cost receivers in large deployments for sensing the radio spectrum or collecting air-traffic signals at large scale. One of the major drawbacks of low-cost spectrum receivers is their limited sampling rate, which does not allow to decode wideband signals. In order to circumvent the hardware limitations of single receivers, we envision a scenario where non-coherent receivers sample the signal collaboratively to cover a larger bandwidth than the one of the single receiver and then, enable the signal reconstruction and decoding in the backend. We present a methodology to enable the signal reconstruction in the backend by multiplexing in frequency a certain number of noncoherent receivers in order to cover a signal bandwidth that would not otherwise be possible using a single receiver. We propose a method that does not use the knowledge of the modulation scheme, and has been designed to be transparent to the subsequent decoding process. As such, it is equivalent to the reception of the signal by a high-end receiver. We demonstrate and evaluate our approach with two non-coherent receivers which collaboratively sample an aviation signal of almost twice the bandwidth of each receiver. The experimental results show that, using two non-coherent receivers, our method is able to reconstruct and decode correctly more than 80% of data.

Understanding spectrum characteristics with little prior knowledge requires fine-grained spectrum data in the frequency, spatial, and temporal domains; gathering such a diverse set of measurements results in a large data volume. Analysis of the resulting dataset poses unique challenges; methods in the status quo are tailored for specific spectrum-related applications (apps), and are ill equipped to process data of this magnitude. In this paper, we design BigSpec, a general-purpose framework that allows for fast processing of apps. The key idea is to reduce computation costs by performing computation extensively on compressed data that preserves signal features. Adhering to this guideline, we build solutions for three apps, i.e., energy detection, spatio-temporal spectrum estimation, and anomaly detection. These apps were chosen to highlight BigSpec's efficiency, scalability, and extensibility. To evaluate BigSpec's performance, we collect more than 1 terabyte of spectrum data spanning a year, across 300MHz-4GHz, covering 400 km2. Compared with baselines and prior works, we achieve 17× run time efficiency, sublinear rather than linear run time scalability, and extend the definition of anomaly to different domains (frequency & spatio-temporal). We also obtain high-level insights from the data to provide valuable advice on future spectrum measurement and data analysis.

In this paper we document the demo of the latest version of OpenVLC, a low-cost platform for communicating using Visible Light, and we prove we can transmit video with it. This paper shows the setup used, the behavior of each of its components, and the results expected. This is the first time video transmission has been possible with OpenVLC and to the best of our knowledge, the first time it has been done with low-cost components.

LED luminaries are now deployed densely in indoor areas to provide uniform illumination. Visible Light Communication (VLC) can also benefit from this dense LED infrastructure. In this paper, we propose DenseVLC, a cell-free massive MIMO system enabled by densely distributed LEDs, that forms different beamspots to serve multiple receivers simultaneously. Given a power budget for communication, DenseVLC can optimize the system throughput by properly assigning the power budget among the distributed LEDs. We formulate an optimization problem to derive the optimal policy for the power allocation. Our insights from the optimal policies allow us to simplify DenseVLC's system design and propose a heuristic algorithm that can reduce the complexity by 99.96%. Besides, we propose a novel synchronization method using non-line-of-sight VLC to synchronize all the transmitters that will form a beamspot to serve the same receiver. We implement DenseVLC with off-the-shelf devices, solve practical challenges in the system design, and evaluate it with extensive and realistic experiments in a system of 36 transmitters and 4 receivers in an area of 3 m x 3 m. Our results show that DenseVLC can improve the average system throughput by 45%, or improve the average power efficiency by 2.3 times, while maintaining the requirement for uniform illumination.

We introduce BackVLC, a system to connect battery-free IoT tags using LED bulbs. We make use of bulbs beyond illumination. We send data to the tags with visible light communication (VLC), and retrofit the bulbs with simple circuitry to enable the uplink channel current VLC systems lack, using Radio Frequency (RF) backscatter communication from the tags. Tags process and send data, harvesting energy from light and radio. We present our system design and implementation, evaluate it in preliminary simulation studies and experiments, and discuss the research challenges to develop a complete network architecture. BackVLC is the first work that combines VLC with RF backscatter.

Precise Time-of-Arrival (TOA) estimations of aircraft and drone signals are important for a wide set of applications including aircraft/drone tracking, air traffic data verification, or self-localization. Our focus in this work is on TOA estimation methods that can run on low-cost software-defined radio (SDR) receivers, as widely deployed in Mode S / ADS-B crowdsourced sensor networks such as the OpenSky Network. We evaluate experimentally classical TOA estimation methods which are based on a cross-correlation with a reconstructed message template and find that these methods are not optimal for such signals. We propose two alternative methods that provide superior results for real-world Mode S / ADS-B signals captured with low-cost SDR receivers. The best method achieves a standard deviation error of 1.5 ns.

Existing mobile devices such as smartphones rely on a multi-radio access technology (RAT) architecture to provide pervasive location information in various environmental contexts as the user is moving. Yet, existing architectures consider the different localization technologies as monolithic entities and choose the final navigation position from the RAT that is expected to provide the highest accuracy. In contrast, we propose to fuse timing range measurements of diverse radio technologies in order to circumvent the limitations of the individual radio access technologies. We take a first step in this direction and propose to fuse timing measurements of satellite navigation systems and WiFi networks. We introduce different novel methods such as a data fuser, an estimator of WiFi ToF distance and a geometrical-statistical approach to best fuse the set of ranges in presence of a rich set of measurements. Experimental results show that our solution allows the mobile device to efficiently position itself in diverse challenging scenarios.

Bandwidth hopping spread spectrum (BHSS) has recently been proposed as a spectrum-efficient technique to combat jamming. In BHSS, the transmitter is randomly hopping the signal bandwidth in order to make it unpredictable to an attacker. When the signal bandwidth is unpredictable, the attacker cannot match its interference bandwidth to the signal bandwidth of the transmitter, and the receiver can filter out the interference power (or parts of it) prior demodulation, and thus increase decoding performance. The main challenge in BHSS is that the bandwidth must be hopping very rapidly at the symbol level in order to prevent a reactive jammer from following the hopping pattern by simple tracking techniques. Existing receiver filtering techniques as proposed in prior work require a long time to estimate the filter parameters and are thus unable to suppress the interference from the jammer when the bandwidth is hopping at the symbol level. In this paper, we propose a new filtering approach adapted for BHSS which is able to suppress arbitrary jamming interference even when the signal bandwidth is hopping after every symbol. Our approach is based on a filter bank which applies different filters in parallel and dynamically selects the best filter for every symbol according to the soft-state output of the demodulator. We evaluate the improvement of our method over classical filtering techniques in experiments using software-defined radios. Our results show a gain in interference suppression above 30 dB with respect to state-of-the-art solutions. We further implement frequency hopping for a BHSS system, and demonstrate the superiority of a system combining hopping in bandwidth, code and frequency against jamming attacks.

LEDs in our buildings, vehicles, and consumer products are rapidly gaining visible light communication capabilities. LED links however are notorious for being unreliable: shadowing, blockage, mobility, external light, all of these issues can disrupt the connectivity easily. Therefore, unless a reliable and cost-efficient data link layer is designed, VLC will be confined to niche applications. In this paper, we reveal a reason for unreliable VLC: a single type of photodetector at the receiver cannot establish a reliable link. We show that the photodetectors with complementary properties, in terms of optical spectral response and field-of-view, are necessary to handle the wide dynamic range of optical noise (such as the sun and other unwanted light sources) and mobility of users. Motivated by our experimental observations, we design a reliable and adaptive receiver for VLC (REAL-VLC) for low-end communication systems, an inexpensive receiver that senses light with complementary photodetectors and configures itself (physical and data link layers) dynamically to maintain the communication link. We implement the hardware and the software of REAL-VLC in low-end platforms, and experimentally validate it in representative test scenarios and a proof-of-concept application that consists of mobile nodes maintaining a VLC link under various lighting and path conditions.

Visible light is gaining significant attention as a medium to achieve accurate relative localization. Most of the studies in the area focus on indoor positioning and rely on two important assumptions: (i) lights are static, and (ii) the receiver has line-of-sight with multiple lights. These requirements limit the application of localization methods in scenarios where nodes have a single light and are mobile, such as motorbikes or swarms of robots. In general, this particular type of scenarios (single lights moving on a plane) leads to under-determined localization systems where no unique solution can be found. We follow a holistic approach that includes theory, simulations, and experiments to overcome some of the limitations present in such type of scenarios. Our theoretical and simulation results show that if nodes are enhanced with sensors providing relative directions (such as compasses), we can derive dependencies in the system to obtain unique solutions. Our proof-of-concept implementation validates our model by showing that single lights can provide relative localization with high accuracy: an average error below 5 cm.

Millimeter wave (mm-wave) communication is a topic of intensive recent study, as it allows to significantly boost data rates of future 5G networks. In this paper, we focus on a mm-wave system consisting of a single Access Point (AP) and two User Equipments (UEs), where one UE requires high throughput, while the other is characterized by a low latency demand. Given that setup, we aim at optimally allocating the available AP hardware resources for the beam training phase and data communication, in order to efficiently serve both UEs via hybrid analog-digital beamforming. We evaluate an optimization framework with the objective to maximize the expected rate of one UE, for a given latency constraint set by the other UE. The optimal data rates are illustrated for different latency constraints and for different strategies of exploiting the full RF chain set at the AP side. We observe that our proposed access schemes outperform the basic TDMA approach by up to 22 %.

Crowdsourced signal monitoring systems are gaining attention for capturing the wireless spectrum at large geographical scale. Yet, most of the current systems are still limited to simple power spectrum measurements reported by each sensor. Our objective is to enhance such systems with signal decoding capabilities performed in the backend while retaining the original vision of a low-cost and crowdsourced setup. We propose a distributed system architecture for collaborative radio signal monitoring and decoding that builds on $12 low-cost radio frequency (RF) frontends and embedded boards and that takes into consideration the limited network bandwidth from the sensors to the backend. We present a distributed time multiplexing mechanism to sample the spectrum in a coordinated fashion that exploits the similarity of the radio signal received by more than one RF frontend in the same radio coverage. We address the strict time synchronization required among sensors to reconstruct the signal from the samples they receive when in the same radio coverage. We study and implement techniques to identify and overcome errors in the timing information in the presence of noise sources and decode the data in the backend. We provide an evaluation based on simulations and on real signals transmitted by Long-Term Evolution (LTE) base stations. Our results show that we can reliably reconstruct and decode radio signals received by low-cost crowdsourced sensors.

Micro aerial vehicles (MAVs) provide data such as images and videos from an aerial perspective, with data typically transferred to the ground. To establish connectivity in larger areas, a fleet of MAVs may set up an ad-hoc wireless network. Packet forwarding in aerial networks is challenged by unstable link quality and intermittent connectivity caused by MAV movement. We show that signal obstruction by the MAV frame can be alleviated by adapting the MAV platform, even for low-priced MAVs, and the aerial link can be properly characterized by its geographical distance. Based on this link characterization and making use of GPS and inertial sensors on-board of MAVs, we design and implement a motion-driven packet forwarding algorithm. The algorithm unites location-aware end-to-end routing and delay-tolerant forwarding, extended by two predictive heuristics. Given the current location, speed, and orientation of the MAVs, future locations are estimated and used to refine packet forwarding decisions. We study the forwarding algorithm in a field measurement campaign with quadcopters connected over Wi-Fi IEEE 802.11n, complemented by simulation. Our analysis confirms that the proposed algorithm masters intermittent connectivity well, but also discloses inefficiencies of location-aware forwarding. By anticipating motion, such inefficiencies can be counteracted and the forwarding performance can be improved.

Time-of-flight (ToF) echo techniques have been recently suggested for ranging mobile devices over WiFi radios. However, these techniques have yielded only moderate accuracy in indoor environments because WiFi ToF measurements suffer from extensive device-related noise which makes it challenging to differentiate between direct path from non-direct path signal components when estimating the ranges. Existing multipath mitigation techniques tend to fail at identifying the direct path when the device-related Gaussian noise is in the same order of magnitude, or larger than the multipath noise. In order to address this challenge, we propose a new method for filtering ranging measurements that is better suited for the inherent large noise as found in WiFi radios. Our technique combines statistical learning and robust statistics in a single filter. The filter is lightweight in the sense that it does not require specialized hardware, the intervention of the user, or cumbersome on-site manual calibration. This makes our method particularly suitable for indoor localization in large-scale deployments using existing legacy WiFi infrastructures. We evaluate our technique for indoor mobile tracking scenarios in multipath environments and, through extensive evaluations across four different testbeds covering areas up to 1000m2, the filter is able to achieve a median 2-D positioning error between 2 and 3.4 m.

In this work, we propose a new communication system for illuminated areas, indoors and outdoors. Light sources in our environments --such as light bulbs or even the sun-- are our signal emitters, but we do not modulate data at the light source. We instead propose that the environment itself modulates the {ambient} light signals: if mobile elements `wear' patterns consisting of distinctive reflecting surfaces, single photodiode could decode the disturbed light signals to read passive information. Achieving this vision requires a deep understanding of a new type of communication channel. Many parameters can affect the performance of passive communication based on visible light: the size of reflective surfaces, the surrounding light intensity, the speed of mobile objects, the field-of-view of the receiver, to name a few. In this paper, we present our vision for a passive communication channel with visible light, the design challenges and the evaluation of an outdoor application where our receiver decodes information from a car moving at 18 km/h.

OpenVLC (www.openvlc.org) is an open-source project for research in Visible Light Communication (VLC) systems. It has the potential to help create a new type of infrastructure, an Internet of Lights (IoL), where LED- based devices (e.g., car lights, city lights, billboards, toy, etc) and photodetectors become inter- connected. OpenVLC is built upon an embedded platform and adopts off-the-shelf optical devices and essential electronic components. It has been proved to be a starter kit for VLC research, thanks to its deployments by tens of top universities/research centers in the world (www.openvlc.org/list-of-users.html). This demo introduces its latest version: OpenVLC1.1. The new features include: (1) higher resilience to ambient light noise, e.g., indoor interfering lighting; (2) interface for sensor application. A new board (OpenVLC1.1 cape) is designed and the printed circuit is developed. The cape is plugged directly into the main embedded board and external sensors can be easily connected to the cape. This demo demonstrates OpenVLC1.1's networking performance through standard networking diagnostic tools and shows an application wherein temperature and humidity sensed data are transmitted through VLC links.

Millimeter wave (mmWave) wireless technologies are expected to become key enablers of multi-gigabit wireless access in next-generation cellular and local area networks. Due to unfavorable radio propagation, mmWave systems will exploit large-scale MIMO and adaptive antenna arrays at both the transmitter and receiver to realize sufficient link margin. Unfortunately, power and cost requirements in mmWave radio frontends make the use of fully-digital beamforming very challenging. In this paper, we focus on hybrid analog-digital beamforming and address two relevant aspects of the initial access procedure at mmWave frequencies. First, we propose a beam training protocol which effectively accelerates the link establishment by exploiting the ability of mobile users to simultaneously receive from multiple directions. Second, we deal with practical constraints of mmWave transceivers and propose a novel, geometric approach to synthesize multi-beamwidth beam patterns that can be leveraged for simultaneous multi-direction scanning. Simulation results show that the proposed hybrid codebooks are able to shape beam patterns very close to those attained by a fully-digital beamforming architecture, yet require lower complexity hardware compared with the state of the art. Furthermore, the reduced duration of the beam training phase, in turn enabled by the multi-beam characteristics of our hybrid codebooks, provides a 25% to 70% increase in spectral efficiency compared to existing sequential scanning strategies.

Self-localization systems based on the Time-of-Flight (ToF) of radio signals are highly susceptible to noise and their performance therefore heavily rely on the design and parametrization of robust algorithms. In this work, we study the noise sources of GPS and WiFi ToF ranging techniques and compare the performance of different self-positioning algorithms at a mobile node using those ranges. Our results show that the localization error varies greatly depending on the ranging technology, algorithm selection, and appropriate tuning of the algorithms. We characterize the localization error using real-world measurements and different parameter settings to provide guidance for the design of robust location estimators in realistic settings.

Offloading traffic through opportunistic communications has been recently proposed as a way to relieve the current overload of cellular networks. Opportunistic communication can occur when mobile device users are (temporarily) in each other's proximity, such that the devices can establish a local peer-to-peer connection (e.g., via WLAN or Bluetooth). Since opportunistic communication is based on the spontaneous mobility of the participants, it is inherently unreliable. This poses a serious challenge to the design of any cellular offloading solutions, that must meet the applications' requirements. In this paper, we address this challenge from an optimization analysis perspective, in contrast to the existing heuristic solutions. We first model the dissemination of content (injected through the cellular interface) in an opportunistic network with heterogeneous node mobility. Then, based on this model, we derive the optimal content injection strategy, which minimizes the load of the cellular network while meeting the applications' constraints. Finally, we propose an adaptive algorithm based on control theory that implements this optimal strategy without requiring any data on the mobility patterns or the mobile nodes' contact rates. The proposed approach is extensively evaluated with both a heterogeneous mobility model as well as real-world contact traces, showing that it substantially outperforms previous approaches proposed in the literature.

The optical antenna's directionality of nodes forming a visible light communication (VLC) network, i.e., their field-of-view (FOV), varies greatly from device to device. This encompasses wide FOVs of ambient light infrastructure and directional FOVs of light from low-end embedded devices. This variety of light propagation can severely affect the transmission reliability, despite pointing the devices to each other may seem enough for a reliable communication. The presence of interference among nodes with different FOVs makes traditional access protocols in VLC unreliable, and it also exacerbates the hidden-node problem. In this paper, we propose a carrier sensing multiple access/collision detection and hidden avoidance (CSMA/CD-HA) medium access control protocol for a network, where each node solely uses one light-emitting diode to transmit and receive data. The CSMA/CD-HA can enable in-band intra-frame bidirectional transmission with just one optical antenna. The key idea is to exploit the intra-frame data symbols without the emission of light to introduce an embedded communication channel. This approach enables the transmission of additional data while receiving in the same optical frequency band, and it makes the communication robust to different types of FOVs. We implement the CSMA/CD-HA protocol in a software-defined embedded platform running Linux, and evaluate its performance through analysis and experiments. Results show that collisions caused by hidden nodes can largely be reduced, and our protocol can increase the saturation throughput by nearly up to 50% and 100% under the two- and four-node scenarios, respectively.

We present bandwidth hopping spread spectrum (BHSS), a novel technique to improve the jamming resistance of wireless communications. In BHSS, the bandwidth of a signal is hopped rapidly in a manner that is unpredictable to the jammer. We show in this work that by combining bandwidth hopping at the transmitter with adaptive filtering at the receiver, BHSS is able to improve the jamming resistance of the communication beyond the processing gain of conventional spread spectrum techniques such as DSSS and FHSS without an increase in RF spectrum requirements. We have designed and implemented a BHSS transmitter and receiver system on off-the-shelf software-defined radios. Our experimental results with different hopping patterns show that BHSS is able to boost the power advantage of spread spectrum communication by 8 to 20 dB for jammers of fixed bandwidth. When both transmitter and jammer hop randomly, the average power advantage we achieve with our system is 11.4 dB.

Today's radio frequency (RF) spectrum measurements are mainly performed by governmental agencies which drive around using bulky and expensive specialized hardware. This approach does not scale well, providing us with only a poor situational awareness of the actual RF spectrum usage around us. We have developed a wideband spectrum monitoring sensor for remote operation that builds upon portable and low-cost commercial off-the-shelf (COTS) hardware components with a total cost per sensor device below $100. This results in a stunning cost reduction factor of 50 to 500 comparing to professional equipment. Our sensor platform adopts the software-defined radio paradigm and performs all signal processing steps on the CPU and GPU of a low-cost single-board computer. We address the challenges of large frequency errors and long scanning times due to the hardware constraints by proposing new correction and optimization methods, providing a satisfactory level of accuracy in indoor and outdoor environments. Our remote sensing platform is envisioned to be used at larger scale for various applications such as dynamic spectrum access in cognitive radios, detecting regions with elevated electro-smog, or for policy enforcement in the electromagnetic space.

Today's spectrum measurements are mainly performed by governmental agencies which drive around using expensive specialized hardware. The idea of crowdsourcing spectrum monitoring has recently gained attention as an alternative way to capture the usage of wide portions of the wireless spectrum at larger geographical and time scales. To support this vision, we develop a flexible software-defined sensor architecture that enables distributed data collection in real-time over the Internet. Our sensor design builds upon low-cost commercial off-the-shelf (COTS) hardware components with a total cost per sensor device below $100. The low-cost nature of our sensor platform makes the sensing approach particularly suitable for large-scale deployments but imposes technical challenges regarding performance and quality. To circumvent the limits of our solution, we have implemented and evaluated different sensing strategies and noise reduction techniques. Our results suggest that our sensor architecture may be useful in application areas such as dynamic spectrum access in cognitive radios, detecting regions with elevated electro-smog, or simply to gain an understanding of the spectrum usage for advanced signal intelligence such as anomaly detection or policy enforcement.

Built around a cost-effective embedded Linux platform, OpenVLC is an open source project (www.openvlc.org) for research in Visible Light Communication (VLC) Networks. In this work, we introduce and demonstrate the OpenVLC1.0 platform, a flexible, software-defined, and low-cost research platform. OpenVLC1.0 consists of a simple electronic design, and a new driver of the Linux operating system that implements the MAC, part of the PHY layers and it offers an interface to Internet protocols. The electronics of OpenVLC implement a flexible optical front-end consisting of commodity low- and high-power Light Emitting Diodes (LEDs), photodiodes (PDs), and ancillary electronic circuitry. In order to quickly start playing with VLC Networks, we have designed and developed a printed circuit board (OpenVLC1.0 cape). The cape can be plugged into the main embedded Beaglebone board. Researchers can then swiftly build PHY and MAC protocols using the software implementation (OpenVLC1.0 driver), and prototype innovative solutions in realistic network setups. In this demo, we show that OpenVLC1.0 can switch between different MAC protocols, it can choose different optical channel for data transmission and reception, and it can be employed jointly with standard TCP/IP diagnostic tools.

Time-of-flight (ToF) echo techniques have been proposed to estimate the distance between a local and a target station using regular WiFi radio devices. As of today, there is little understanding of the noise sources from ToF measurements. We conduct extensive experimental tests based on a customized WiFi echo technique implementation residing in the core of the 802.11 MAC processor and a high-resolution signal analysis of the WiFi traffic captured with a wideband oscilloscope. We discern the root of the error components in WiFi echo technique measurements and statistically characterize the offset noise added by the target station. Our measurements provide key insights to model the sources of noise and guidance for the design of robust distance estimators.

Time-of-Flight (ToF) echo techniques have been proposed as a way to estimate the range between regular Wi-Fi stations. Recent works either did not address practical questions for deployability, or made evaluations in basic setups, or used advanced 802.11 hardware designs. We build an approach solely deployed using ToF measurements and relying on software access point (AP) upgrades of simple commercial off-the-shelf 802.11 chipsets. Our solution filters noisy measurements collected by WiFi chipsets of six dollars each, it has been tested across different and heterogeneous setups and testbeds, and has the potential to enable ToF ranging in every Wi-Fi chipsets.

Unlike traditional radio frequency communication of consumer devices, the "optical antenna" direction of Visible Light Communication (VLC), i.e., the Field-Of-View (FOV), varies greatly from device to device. This encompasses wide FOVs of ambient infrastructure and directional FOVs of light emitted by low-end embedded devices. This variety of light wave propagation can severely affect the transmission reliability, despite ``pointing'' devices to each other may seem enough for a reliable link. In particular, the fact that FOVs are unknown makes traditional access protocols in VLC unreliable in presence of interference among nodes of different FOVs and exacerbates the hidden-node problem. In this paper, we propose a Carrier Sensing Multiple Access/Collision Detection&Hidden Avoidance (CSMA/CD-HA) Medium Access Control protocol for a network where each node solely uses one Light Emitting Diode (LED) to transmit and receive data. The CSMA/CD-HA can enable in-band intra-frame bidirectional transmission with just one optical antenna. The key idea is to exploit the intra-frame data symbols without emission of light to introduce an embedded communication channel. This approach enables the transmission of additional data while receiving in the same optical channel and it makes the communication robust to different types of FOVs. We build a software-defined embedded platform running on Linux operating system, implement the CSMA/CD-HA protocol, and evaluate its performance through experiments. Results show that collisions caused by hidden nodes can be reduced and our protocol can increase the saturation throughput by nearly up to 50% and 100% under the two-node and four-node scenarios, respectively.

The exponential growing demand of mobile Internet data traffic requires a rethinking of current infrastructures and calls for innovative approaches that provide online-streaming of content to interested subscribed mobile users. We introduce a mobile system called HyCloud for device-to-device content distribution. HyCloud delivers the content from a cloud backend, and it can reduce the total amount of data transferred through the cellular network by exploiting the similarity of interests among multiple mobile users. Our preliminary real-life experiment with video streaming with a simple content scheduler shows that the system can save in average 24% (and up to 38%) of data downloaded by the cellular connection.

Reactive jammers have been shown to be a serious threat for wireless communication. Despite this, it is difficult to detect their presence reliably. We propose a novel method to detect such sophisticated jammers in direct sequence spread spectrum (DSSS) wireless communication systems. The key idea is to extract statistics from the jamming-free symbols of the DSSS synchronizer to discern jammed packets from those lost due to bad channel conditions. Our contribution is twofold. First, we experimentally evaluate new empirical models utilizing the preamble symbols of IEEE 802.15.4 packets, thus enabling the accurate prediction of the packet delivery ratio (PDR). We show that the chip error rate-based metric is superior to metrics used in the literature, offering an accurate and reactive indicator of the true PDR. Our second contribution is the design and evaluation of a detection technique relying on this metric to detect reactive jammers. We build a software-defined radio testbed and show that our technique enables the error-free detection of reactive jammers that jam all packets on links with a PDR above 0.3. To the best of our knowledge, our detector is the first to detect reactive jamming attacks targeting the physical layer header of DSSS packets, and does not require any modifications of the wireless communication system.

Search and rescue missions are entering a new era with the advent of small scale unmanned aerial vehicles (UAVs) with communication capabilities and embedded cameras. Yet, delivering high resolution images of the supervised surface to rescuers is time-critical. To help resolving this problem, we study how UAVs can take advantage of their controlled mobility to derive the optimum strategy for data transmission. Driven by real-world aerial experiments with both airplanes and quadrocopters equipped with 802.11n technology, we show that the UAV should not necessarily transmit as soon as a wireless link is established. Instead, it should wait until it reaches a suitable distance to the receiving UAV, only to transmit when the time to move to the new location and transmit is minimal. We then apply the principle of delayed gratification, where the UAV attempts to solve the tradeoff between postponing until it reaches this minimum and the impatience to deliver as much data as soon as possible, before any physical damage on-the-fly may occur. Our empirical-driven simulations demonstrate that the optimal distance of transmission greatly depends on the interplay of actual throughput, data size, UAV cruise speed, and failure rate, and that state-of-the-art UAVs can already benefit from our approach.

The rapid proliferation of smartphones and the urge to offload mobile data is paving the way to blend the communication capabilities of cellular and opportunistic networks for delivering content. By exploiting the locality of users interested in the same content, the vision of HyCloud project is to design and implement a hybrid architecture where content dissemination through opportunistic communication among several clients is controlled by the online cloud. Based on the foundation of our key theoretical findings, we are implementing a prototype architecture running on Windows Phone 8 mobile devices, taking advantage of the Windows Azure cloud platform.

We propose a novel approach to detect reactive jammers in direct sequence spread spectrum (DSSS) wireless networks. The key idea is to use the chip error rate of the first few jamming-free symbols at the DSSS demodulator during the signal synchronization phase of regular packet reception to estimate the probability of successful packet delivery. If the estimated probability is significantly higher than the actual packet delivery ratio, we declare jamming. As a proof of concept, we implement a prototype in a network of three USRP software-defined radios (transmitter, receiver, and jammer) and evaluate the feasibility, responsiveness, and accuracy of our approach in a controlled lab environment. Our experiments with IEEE 802.15.4 DSSS-based communication show that for links with a jamming-free packet delivery probability above 0.5, the false positive and negative detection rates remain below 5%.

Communication capabilities are becoming a popular feature for premium smart toys. However, the higher cost of such transmitters are limiting the widespread use to all consumer users. In this contribution, we demonstrate a cost-effective toy communication using LED-based visible light communication (VLC), where messages sent via VLC are i) displayed on a screen, or ii) passed from one node (like a car) to another in a multi-hop way.

Wireless local area networks have been designed for wireless communication. Frames are acknowledged (ACKed) after a short and predefined MAC idle time. The MAC idle time varies with i) the physical distance between stations, caused by the delay of wireless signal propagation, and ii) the time to detect the ACK at the local station, which varies with the signal strength of the incoming ACK. We present CAESAR, CArriEr Sense-bAsed Ranging, that combines time of flight and signal-to-noise ratio measurements to calculate the distance between two stations. CAESAR measures the distance by estimating the MAC idle time in a data/ACK communication at a 44 MHz clock resolution and the ACK detection time on a per-frame basis. CAESAR is a software-based solution that is entirely implemented at the transmitter and it requires no protocol modifications and only a limited calibration in links with multi-path propagation. We implement CAESAR on commodity hardware and conduct extensive experiments both in controlled network conditions and dynamic radio environments. Our measurements confirm the accuracy of the solution and show the capability to track the distance to WLAN smartphones at pedestrian speeds.

In this demo we present a novel ranging based on Time Of Flight (TOF) measurements for Wireless LAN (WLAN) and demonstrate the tracking capability of the distance from a WLAN Access Point (AP) to a WLAN mobile device. Conference participants can move with the mobile device around the coverage range of the AP to observe both the accuracy and the convergence of distance tracking. Using our software-based prototype implementation, we achieve accuracies of few meters at a walking speed and in different channel conditions.

The majority of sport events are of interest only to a relatively small group of viewers, such as college and regional league competitions. The broadcasting of these sport events is often not economically viable because of the required installation/cabling and the need for an on-site crew for content production. An automated or semi-automated broadcast system with multiple cameras would potentially enable a significant cost reduction. This contribution analyzes to what extent wireless technology simplifies the deployment and reduce the cost of such automated multi-camera systems. We present a networking architecture for wirelessly connected cameras and discuss research challenges and potential solutions. A particular emphasis is given on how emerging wireless technologies can be exploited towards this path and on mechanisms that could be used to relax the system requirements.

This article proposes a set of strategies to improve the performance stability and reliability of purely software ToA-based ranging with off-the-shelf WLAN equipment. Taking as starting point the core design lines proposed in, where timing measurements were taken at OS level using the CPU clock of the client device, we optimize the OS configuration and the capture of the time-stamps. Results obtained with a prototype demonstrate that the proposed enhancements improve the performance stability by a factor four. The interest in this kind of ranging methods is because they enable cost-effective and accurate positioning in GNSS-less environments.

Aggregating multiple 802.11 Access Point (AP) backhauls using a single-radio WLAN card has been considered as a way of bypassing the backhaul capacity limit. However, current AP aggregation solutions greedily maximize the individual station throughput without taking fairness into account. This can lead to grossly unfair throughput distributions, which can discourage user participation and severely limit commercial deployability.

We propose a powerful MAC/PHY cross-layer approach to measuring IEEE 802.11 transmission opportunities in WLAN networks on a per-link basis. Our estimator can operate at a single station and it is able to: 1) classify losses caused by noise, collisions, and hidden nodes; and 2) distinguish between these losses and the unfairness caused by both exposed nodes and channel capture. Our estimator provides quantitative measures of the different causes of lost transmission opportunities, requiring only local measures at the 802.11 transmitter and no modification to the 802.11 protocol or in other stations. Our approach is suited to implementation on commodity hardware, and we demonstrate our prototype implementation via experimental assessments. We finally show how our estimator can help the WLAN station to improve its local performance.

ADSL is becoming the standard form of residential and small-business broadband Internet access due to, primarily, its low deployment cost. These ADSL residential lines are often deployed with 802.11 Access Points (AP) that provide wireless connectivity. Given the density of ADSL deployment, it is often possible for a residential wireless client to be in range of several other APs, belonging to neighbors, with ADSL connectivity. While the ADSL technology has showed evident limits in terms of capacity (with speeds ranging 1-10 Mbps), the short-range wireless communication can guarantee a much higher capacity (up to 20 Mbps). Furthermore, the ADSL links in the neighborhood are generally under-utilized, since ADSL subscribers do not connect 100% of the time. Therefore, it is possible for a wireless client to simultaneously connect to several APs in range and effectively aggregate their available ADSL bandwidth.In this paper, we introduce ClubADSL, a wireless client that can simultaneously connect to several APs in range on different frequencies and aggregate both their downlink and uplink capacity. ClubADSL is a software that runs locally on the client-side, and it requires neither modification to the existing Internet infrastructure, nor any hardware/protocol upgrades to the 802.11 local area network. We show the feasibility of ClubADSL in seamlessly transmitting TCP traffic, and validate its implementation both in controlled scenarios and with current applications over real ADSL lines. In particular we show that a ClubADSL client can greatly benefit from the aggregated download bandwidth in the case of server-client applications such as video streaming, but can also take advantage of the increased upload bandwidth greatly reducing download times with incentive-based P2P applications such as BitTorrent.

A very common conclusion of many experimental studies about IEEE 802.11 outdoor network deployments is that their poor performance results derive from the unfavorable interference and multi-path signals in which the WLAN-cards are required to operate. Goal of this paper is to show that this condition does not always hold, and unexpected and inaccurated PHY layer implementations can be a primary cause of packet losses. With the support of extensive measurement campaigns led in our campus, we provide the performance evidence that IEEE 802.11 outdoor performance impairments are strongly affected by proprietary interference mitigation techniques that adaptively adjust the WLAN-card receiver sensitivity thresholds on the basis of the perceived noise levels. Because of the immediate relationship between these receiver sensitivity parameters with the carrier sense functions, we show how, in highly interfered outdoor scenarios, interference mitigation algorithms may cause tremendous amplifications of either the hidden or the exposed terminal phenomena, thus determining dramatic wireless link failures. Surprisingly, deactivating such mechanisms allows to achieve high link quality performance.

This paper provides experimental evidence that "weird'/poor outdoor link-level performance measurements may be caused by driver/card-specific antenna diversity algorithms unexpectedly supported/activated at the WLAN transmitter side. We focus our analysis on the Atheros/MADWiFi card/driver case, and we observe that the transmit antenna diversity mechanisms remain by default enabled when the available antennas are not homogeneous in terms of gain or, even worse, when only a single antenna is connected. This may cause considerable performance impairments (large frame loss ratio), in conditions frequently encountered in outdoor link deployments. The negative impact of transmit antenna diversity is not limited to the transmission of broadcast frames (where a cyclic shift between the "two" assumed antennas is performed), but under certain circumstances it can severely affect the delivery of unicast frames as well, and despite the fact that in this case the ACK receptions may provide a feedback about the best receiving antenna. While, as obvious, driver developers are expectedly fully aware of the existence of such mechanisms, we believe that the scientific research community has very limited awareness of the implications these mechanisms have on the measured link-level performance. Indeed, to the best of our knowledge, ours is the first research paper which explicitly raises this issue.

Broadcast probes are typically used in Wireless LAN networks to assess the quality of the radio link and/or to runtime derive metrics to be used by higher layer protocols (e.g., routing in WLAN-based ad hoc or mesh networks). This work raises the concern that proprietary vendor operation may severely affect broadcast-based measurements. More precisely, we present and analyze experimental outdoor link quality measurement results obtained with a device/driver pair (Atheros card + MADWiFi driver) widely exploited in the research community. We show that an unexpected periodic transmission power reduction mechanism at the NIC level, undocumented by the device vendor and apparently hard to be disabled, may dramatically impair the measured link quality performance. Our experimental evidence shows that links which would otherwise experience good quality are subject to a significant frame loss ratio, when tested through a broadcast frame transmission methodology. This frame loss ratio is artificially induced by the NIC card operation on broadcast frames: unicast frames are in fact shown to be exempt from such a problem.

This paper describes an unexpected finding concerning link quality measurements carried out through broadcast frames. We found out that, with experimental equipments/drivers widely used by the scientific community (Atheros WLAN cards with MADWiFi driver), broadcast-based link quality measurements seem to be affected by a NIC-proprietary power saving mode. The striking conclusion is that some packet losses, typically attributed to bad channel characteristics, rather may depend on the broadcast measurement methodology. Unicast measurements are shown to be exempt from such a problem. A very simple test is furthermore proposed to verify whether measurement results are affected by the described phenomenon.

Outdoor WLAN communication is envisioning an increasing interest, due to the massive emergence and deployment of outdoor wireless mesh networks. This paper provides a report on an extensive measurement campaign carried out in an outdoor wireless LAN campus scenario. A public domain driver, namely MADWiFi, has been modified in order to achieve a high (per-node and per-frame) measurement granularity, and in order to distinguish the different causes that contribute to link-layer errors. The main result of our experimental investigation is that, unlike 802.11b, which appears a robust technology in most of the operational conditions, 802.11g may lead to severe inefficiencies when employed in an outdoor scenario

A major challenge in the area of space time (ST) codes is to find codes suitable for efficient decoding, thus overcoming the problem of many existing ST code designs which require maximum-likelihood (ML) decoding. A solution could be to apply single-input single-output (SISO) channel codes and theory over temporal channel fading to the multi-input single-output (MISO) code construction and classical suboptimum decoding methods. For these purposes, an ST code construction which allows the use of efficient decoding algorithms is described. We propose a concatenated code, where the inner code is the diagonal ST Hadamard (D-STH) code with Paley constructions and the outer code is an algebraic block code, such as a Reed-Solomon (RS) code. As a decoding method, we investigate a bounded minimum distance (BMD) with erasure decoding algorithm. A simple method to achieve the optimum threshold for deciding on an erased symbol is derived. Using this, the proposed concatenated scheme is able to exploit almost all of the spatial diversity of the system.