Low-altitude communications can promote the integration of aerial and terrestrial wireless resources, expand network coverage, and enhance transmission quality, thereby empowering the development of sixth-generation (6G) mobile communications. As an enabler for low-altitude transmission, 3D channel fingerprints (3D-CF), also referred to as the 3D radio map or 3D channel knowledge map, are expected to enhance the understanding of communication environments and assist in the acquisition of channel state information (CSI), thereby avoiding repeated estimations and reducing computational complexity. In this paper, we propose a modularized multimodal framework to construct 3D-CF. Specifically, we first establish the 3D-CF model as a collection of CSI-tuples based on Rician fading channels, with each tuple comprising the low-altitude vehicle’s (LAV) positions and its corresponding statistical CSI. In consideration of the heterogeneous structures of different prior data, we formulate the 3D-CF construction problem as a multimodal regression task, where the target channel information in the CSI-tuple can be estimated directly by its corresponding LAV positions, together with communication measurements and geographic environment maps. Then, a high-efficiency multimodal framework is proposed accordingly, which includes a correlation-based multimodal fusion (Corr-MMF) module, a multimodal representation (MMR) module, and a CSI regression (CSI-R) module. Numerical results show that our proposed framework can efficiently construct 3D-CF and achieve at least 27.5% higher accuracy than the state-of-the-art algorithms under different communication scenarios, demonstrating its competitive performance and excellent generalization ability. We also analyze the computational complexity and illustrate its superiority in terms of the inference time.

Graphics Processing Unit (GPU) on smartphones is an effective target for hardware attacks. In this paper, we present a new side channel attack on mobile GPUs of Android smartphones, allowing an unprivileged attacker to eavesdrop the user's credentials, such as login usernames and passwords, from their inputs through on-screen keyboard. Our attack targets on Qualcomm Adreno GPUs and investigate the amount of GPU overdraw when rendering the popups of user's key presses of inputs. Such GPU overdraw caused by each key press corresponds to unique variations of selected GPU performance counters, from which these key presses can be accurately inferred. Experiment results from practical use on multiple models of Android smartphones show that our attack can correctly infer more than 80% of user's credential inputs, but incur negligible amounts of computing overhead and network traffic on the victim device. To counter this attack, this paper suggests mitigations of access control on GPU performance counters, or applying obfuscations on the values of GPU performance counters.

New wireless physical-layer designs are the key to improving wireless network performance. Adopting these new designs, however, requires modifications on wireless hardware and is difficult on commodity devices. In this paper, we show that this hardware modification in many cases can be avoided by TransFi, a new software technique that enables custom wireless PHY functionality on commodity WiFi transmitters via fine-grained emulation. Our basic insight is that many custom wireless signals can be emulated by manipulating the MAC payloads of WiFi MIMO streams and mixing the transmitted signals from these streams on the air. To perform such emulation, TransFi considers the target signal as a mixture of QAM constellation points on the complex plane, and reversely computes the MAC payload of each MIMO stream from one selected QAM constellation point. We implemented TransFi on commodity WiFi devices to emulate three custom wireless PHYs with diverse characteristics. Experiment results show that TransFi's accuracy of emulation is >90% when transmitting emulated data payloads at 11.4 Mbps (46x faster than existing methods), and the decoding error at this data rate is <1% (10x lower than existing methods).

Interference could result in significant performance degradation in WiFi networks. Most existing solutions to interference cancellation require extra RF hardware, which is usually infeasible in many low-power wireless scenarios. In this paper, we present AiFi, a new interference cancellation technique that can be applied to commodity WiFi devices without using any extra RF hardware. The key idea of AiFi is to retrieve knowledge about interference from the locally available physical-layer (PHY) information at the WiFi receiver, including the pilot information (PI) and the channel state information (CSI). AiFi leverages the power of AI to address the possible ambiguity when estimating interference from these PHY information, and incorporates the domain knowledge about WiFi PHY to minimize the neural network complexity. Experiment results show that AiFi can correct 80% of bit errors due to interference and improves the MAC frame reception rate by 18x, with <1ms latency for interference cancellation in each frame.

Respiratory diseases have been a significant public health challenge. Efficient disease evaluation and monitoring call for daily spirometry tests, as an effective way of pulmonary function testing, out of clinic. This requirement, however, is hard to be satisfied due to the large size and high costs of current spirometry equipments. In this paper, we present SpiroSonic, a new system design that uses commodity smartphones to support complete, accurate yet reliable spirometry tests in regular home settings with various environmental and human factors. SpiroSonic measures the humans' chest wall motion via acoustic sensing and interprets such motion into lung function indices, based on the clinically validated correlation between them. We implemented SpiroSonic as a smartphone app, and verified SpiroSonic's monitoring error over healthy humans as <3%. Clinical studies further show that SpiroSonic reaches 5%-10% monitoring error among 83 pediatric patients. Given that the error of in-clinic spirometry is usually around 5%, SpiroSonic can be reliably used for disease tracking and evaluation out of clinic.

Performance of modern cognitive and interactive mobile applications highly depends on the transmission delay in the wireless link that is vital to supporting real-time wireless traffic. To eliminate wireless network congestion caused by large amounts of concurrent network traffic and minimize such transmission delay, traditional schemes adopt various flow control and QoS-aware traffic scheduling techniques, but fail when the amount of network traffic further increases. In this paper, we present a novel design of high-throughput wireless side channel, which operates concurrently with the existing wireless network channel over the same spectrum but dedicates to real-time traffic. Our key idea of realizing such a side channel is to exploit the excessive SNR margin in the wireless network to encode data as patterned interference. We design such patterned interference in the form of energy erasure over specific subcarriers in an OFDM-based wireless network, and achieve a data rate of 1.25 Mbps in the side channel without affecting the existing wireless network links. Experimental results over both software-defined radios and custom wireless hardware demonstrate the effectiveness of our side channel design in reducing the latency of real-time wireless traffic, while providing a sufficient data throughput for such traffic.

Many IoT applications have stringent requirements on wireless transmission delay, but have to compete for channel access with other wireless traffic. Traditional techniques enable multiple access to wireless channels, but yield severe delay when the channel is congested. In this paper, we present EasyPass, a wireless PHY technique that allows multiple IoT devices to simultaneously transmit data over a congested wireless link without being delayed. The key idea of EasyPass is to exploit the excessive SNR margin in a wireless channel as a dedicated side channel for IoT traffic, and allow multiple access to the side channel by separating signals from different transmitters on the air. We implemented EasyPass on software-defined radio platforms. Experiment results demonstrate that EasyPass reduces the data transmission delay in congested IoT networks by 90%, but provides a throughput up to 2.5 Mbps over a narrowband 20MHz wireless link that can be accessed by more than 100 IoT devices.

Cross-technology coexistence is crucial to avoid collisions of wireless transmissions and improve the efficiency of spectrum utilization in today's large-scale wireless network systems, especially the Internet of Things. However, existing approaches to cross-technology coexistence incur additional transmission delay and signal processing overhead, which are unaffordable by extremely weak wireless devices such as embedded sensors and computational RFIDs. These schemes hence fail when being applied to emerging application scenarios, such as smart cities and connected healthcare where weak devices play important roles. In this paper, we design and implement EmBee, a new wireless PHY technique that enables cross-technology coexistence at zero cost or performance loss to these extremely weak wireless devices. The basic idea of EmBee is to exploit the diversity of different wireless technologies' spectrum utilization, so as to adaptively reserve occupied spectrum from the strong devices for weak wireless devices' concurrent data transmissions. We have implemented EmBee over custom wireless hardware and evaluated EmBee under different wireless scenarios. Experiment results show that EmBee can effectively support ZigBee transmissions over a fully occupied WiFi channel without causing any extra delay, while only resulting in 10% WiFi throughput loss.

Device-free acoustic motion tracking allows a commodity mobile device to precisely track the human user's motion, without applying any extra hardware tracker on the human body. Most of current device-free acoustic motion tracking systems, however, are limited to tracking the motion of small parts of the human body with negligible sizes, such as human fingers. Their accuracy of motion tracking will significantly degrade when being applied to targets with large sizes, such as humans' hands, arms or body trunk. We envision the key reason to such degradation as the target size's significant impact on the pattern of the reflected acoustic signal, and develop analytical modeling of such reflected acoustic signal from large targets. Based on such modeling, we present a new system called Acoustic Tracking over targets with LArge Sizes (ATLAS), which ensures precise motion tracking over large targets by correctly interpreting the reflected acoustic signal and extracting the phase from the signal. Experiment results over commodity Android smartphones show that ATLAS can reduce the error of motion tracking by more than 75%, when being applied to targets with heterogeneous sizes in practice.