Cheap spaceflight has ushered in an explosive growth era for Low Earth Orbit (LEO) satellites. While this has brought us LEO satellite megaconstellations for ubiquitious highspeed data, it has also enabled a proliferation of nanosatellites (e.g. CubeSats) launched by diverse organizations. An unfortunate side-effect is harmful interference to sensitive receivers like those of radio astronomy --- no place on Earth is safe. How can we enjoy the fruits of the satellite revolution without blinding ourselves to the secrets of the universe?

WiFi communication should be possible only between devices inside the same network. However, we find that all existing WiFi devices send back acknowledgments (ACKs) to even fake packets received from unauthorized WiFi devices outside of their network. Moreover, we find that an unauthorized device can manipulate the power-saving mechanism of WiFi radios and keep them continuously awake by sending specific fake beacon frames to them. Our evaluation of over 5000 devices from 186 vendors confirms that these are widespread issues. We believe these loopholes cannot be prevented, and hence they create privacy and security concerns. Finally, to show the importance of these issues and their consequences, we implement and demonstrate two attacks where an adversary performs battery drain and WiFi sensing attacks just using a tiny WiFi module which costs less than ten dollars.

Spectrum monitoring is vital for optimizing wireless spectrum usage, minimizing interference, and ensuring efficient communication systems. In large-scale monitoring systems, the issue of trust in sensor data becomes critical. Separate from the issue of malicious actors, there must be an underlying level of trust in the basic quality of a sensor's data. A sensor can be compromised by physical obstructions, improper installation, or incorrect descriptions. This paper introduces an automated approach for evaluating RF sensor quality, leveraging airplane transponder signals to assess obstructions and other known man-made signals across frequency bands to quantify obstruction severity. Our experiments demonstrate the effectiveness of these techniques in automatically calibrating sensors without supervision.

Recent years have seen significant advances in WiFi Localization. However, existing systems require either multiple access points to cooperate with each other or a single access point to have multiple antennas and transceiver chains. Therefore, they cannot be integrated into most IoT WiFi chipsets which have only a single transceiver chain. This paper presents WiSight, a novel approach to bringing WiFi localization to any WiFi devices, especially those with a single RF chain. We propose a WiFi antenna design and use the inherent properties of the 802.11 protocol to measure Angle-of-Arrival (AoA) and Time-of-Flight (ToF) using a single transceiver chain. Our proof-of-concept simulation and real world experiments promise the feasibility of this approach.

We present Wi-Peep - a new location-revealing privacy attack on non-cooperative Wi-Fi devices. Wi-Peep exploits loopholes in the 802.11 protocol to elicit responses from Wi-Fi devices on a network that we do not have access to. It then uses a novel time-of-flight measurement scheme to locate these devices. Wi-Peep works without any hardware or software modifications on target devices and without requiring access to the physical space that they are deployed in. Therefore, a pedestrian or a drone that carries a Wi-Peep device can estimate the location of every Wi-Fi device in a building. Our Wi-Peep design costs $20 and weighs less than 10 g. We deploy it on a lightweight drone and show that a drone flying over a house can estimate the location of Wi-Fi devices across multiple floors to meter-level accuracy. Finally, we investigate different mitigation techniques to secure future Wi-Fi devices against such attacks.

RFID and WiFi backscatter systems use similar techniques to enable battery-free wireless communication. Despite their similarities, existing WiFi backscatter systems achieve a much shorter range than RFID systems. The main reason for this limitation is self-interference. In particular, in any backscatter communication, the reader needs to transmit and receive at the same time. RFID systems do this by using full-duplex hardware. Unfortunately, existing WiFi devices do not have full-duplex capabilities. Therefore, to enable backscatter communication using existing WiFi devices, today's WiFi backscatter systems use two WiFi devices where one transmits and the other one receives. However, since the tag's reflection is very weak compared to the query signal, it is very challenging to detect and extract the tag's reflection from the query signal. This problem is known as self-interference. In this paper, we propose a novel approach for eliminating this problem in WiFi backscatter systems without any hardware modifications on existing WiFi devices. Our empirical evaluations show that our technique improves the range of in-channel WiFi backscatter systems to that of RFID in both line-of-sight and non-line-of-sight scenarios. Moreover, our approach enables WiFi backscatter communication even in scenarios where the tag has no LOS path to any WiFi device. None of existing WiFi backscatter systems work in this scenario.

WiFi backscatter communication has been proposed to enable battery-free sensors to transmit data using WiFi networks. The main advantage of WiFi backscatter technologies over RFID is that data from their tags can be read using existing WiFi infrastructures instead of specialized readers. This can potentially reduce the complexity and cost of deploying battery-free sensors. Despite extensive work in this area, none of the existing systems are in widespread use today. We hypothesize that this is because WiFi-based backscatter tags do not scale well and their range and capabilities are limited when compared with RFID. To test this hypothesis we conduct several real-world experiments.

WiFi networks employ authentication and encryption mechanisms to protect the network from being accessed by unauthorized devices. Therefore, WiFi communication should be possible only between devices inside the same network. However, we have found that all existing WiFi devices send back acknowledgments (ACK) to even fake packets received from WiFi devices outside of their network. We call this behavior Polite WiFi since WiFi devices respond to all packets even those coming from strangers!

MAC-layer frame aggregation has significantly improved the efficiency of IEEE 802.11n/ac networks by placing multiple MAC-layer data units in a large PHY-layer frame. In this paper, we focus on finding the optimal length of an Aggregated MAC Protocol Data Unit (A-MPDU) in order to maximize throughput. This problem has proved to be extremely challenging because of the chain of dependencies between consecutive A-MPDUs due to software retransmissions and because error rates can be higher in the later part of the A-MPDU.

Although a variety of rate adaptation algorithms have been proposed for 802.11 networks, sampling-based algorithms are preferred and used in practice because they only require frame loss information which is available on all devices. Unfortunately, sampling can impose significant overheads because it may lead to excessive frame loss or the inefficient operation of frame aggregation algorithms. In this paper, we design a novel Neural network-based Rate Adaptation algorithm, called NeuRA. NeuRA, significantly improves the efficiency of probing in sampling-based algorithms by using neural network models to predict the expected throughput of many rates,rather than sampling their throughput.

WiFi backscatter communication has the potential to enable battery-free sensors which can transmit data using a WiFi network. In order for WiFi backscatter systems to be practical they should be compatible with existing WiFi networks without any hardware or software modifications. Moreover, they should work with networks that use encryption. In this paper, we present WiTAG which achieves these requirements, making the implementation and deployment of WiFi backscatter communication more practical. In contrast with existing systems which utilize the physical layer for backscatter communication, we take a different approach by leveraging features of the MAC layer to communicate. WiTAG is designed to send data by selectively interfering with subframes (MPDUs) in an aggregated frame (A-MPDU). This enables standard compliant communication using modern, open or encrypted 802.11n and 802.11ac networks without requiring hardware or software modifications to any devices. We implement WiTAG using off-the-shelf components and evaluate its performance in line-of-sight and non-line-of-sight scenarios. We show that WiTAG achieves a throughput of up to 4 Kbps without impacting other devices in the network.

Despite the ubiquity of WiFi devices, Bluetooth is widely used for communication in low-power, low data-rate devices. This is because Bluetooth consumes much less power than WiFi which results in longer battery life. The higher power consumption of WiFi devices is due to overheads from either establishing or maintaining connections with the access point. Surprisingly, Bluetooth devices require nearly three times as much energy to transmit a bit of data at the physical layer than WiFi devices.

With the advent of the Internet of Things (IoT), billions of new connected devices will come online, placing a huge strain on today's WiFi and cellular spectrum. This problem will be further exacerbated by the fact that many of these IoT devices are low-power devices that use low-rate modulation schemes and therefore do not use the spectrum efficiently. Millimeter wave (mmWave) technology promises to revolutionize wireless networks and solve spectrum shortage problem through the usage of massive chunks of high-frequency spectrum. However, adapting this technology presents challenges. Past work has addressed challenges in using mmWave for emerging applications, such as 5G, virtual reality and data centers, which require multiple-gigabits-per-second links, while having substantial energy and computing power. In contrast, this paper focuses on designing a mmWave network for low-power, low-cost IoT devices. We address the key challenges that prevent existing mmWave technology from being used for such IoT devices. First, current mmWave radios are power hungry and expensive. Second, mmWave radios use directional antennas to search for the best beam alignment. Existing beam searching techniques are complex and require feedback from access points (AP), which makes them unsuitable for low-power, low-cost IoT devices. We present mmX, a novel mmWave network that addresses existing challenges in exploiting mmWave for IoT devices. We implemented mmX and evaluated it empirically.

WiFi-based backscatter systems provide the potential to deliver battery-free sensors (tags) which can transmit data using a WiFi network. Existing backscatter systems have several problems which make them impractical to deploy and operate using existing WiFi networks. First, they require software or hardware modifications to WiFi access points and devices. Second, they do not work with WiFi networks that use a security protocol such as WPA. Third, they interfere with existing WiFi communication because they reflect their signal to another channel without implementing channel sensing. In this paper, we present WiTAG which addresses these problems, making the implementation and deployment of backscatter systems significantly more practical. In contrast with existing systems that build tags to communicate using the physical layer, we take a radically different approach by building tags that leverage features of the MAC layer to communicate. We design tags which can selectively interfere with subframes (MPDUs) in an aggregated frame (A-MPDU). This enables standard compliant communication using modern 802.11n and 802.11ac networks with minimal infrastructure and without requiring hardware or software modifications to any devices. The evaluation of our prototype system shows that with a client and an access point that are 8 meters apart, a tag can achieve data rates of 40 Kbps when located anywhere between the two devices.

The IEEE 802.11 standard has become the dominant protocol for Wireless Local Area Networks (WLANs). In a span of 20 years, the speed of these networks has increased from 1 Mbps to more than 1 Gbps. Today's Wi-Fi networks may consist of a variety of client devices, ranging from slow legacy 802.11a/b/g to modern and fast 802.11n/ac devices. We describe preliminary findings from a large-scale study obtained from 448 Google Wifi and Google OnHub access points with 2,975 clients. We focus on characterizing the maximum achievable bitrate of heterogeneous wireless links. We also determine the average physical-layer bitrate used on the down link (AP to client) and compare it with the maximum supported bitrate. We find that about 75% of 802.11n and 50% of 802.11ac client devices operate at 75% of their maximum or more and that the bitrates of the remaining devices can be very far from their maximum. These low bitrates could significantly reduce the throughput of high-bitrate devices.

Recently there has been a huge interest in performing research on millimeter wave (mmWave) communications. Prior work utilize this technology in enabling Gbps wireless links. In contrast, we exploit mmWave technology in designing high-density IoT networks, where there are hundreds of nodes, but each requiring only a Mbps wireless link. However, existing mmWave radios are costly and have high power consumption which makes them unsuitable for IoT sensors. We have built mmPi: a low-cost and low-power mmWave radio that operates as a daughterboard for the Raspberry Pi platform. We believe that mmPi helps advance mmWave research in the IoT domain.

Previous work has shown that benchmark and application performance in public cloud computing environments can be highly variable. Utilizing Amazon EC2 traces that include measurements affected by CPU, memory, disk, and network performance, we study commonly used methodologies for comparing performance measurements in cloud computing environments. The results show considerable flaws in these methodologies that may lead to incorrect conclusions. For instance, these methodologies falsely report that the performance of two identical systems differ by 38% using a confidence level of 95%. We then study the efficacy of the Randomized Multiple Interleaved Trials (RMIT) methodology using the same traces. We demonstrate that RMIT could be used to conduct repeatable experiments that enable fair comparisons in this cloud computing environment despite the fact that changing conditions beyond the user's control make comparing competing alternatives highly challenging.

To increase throughput the 802.11n standard introduced several physical layer transmission features including a short guard interval wider channels, and MIMO. Since obtaining peak throughput depends on choosing the combination of physical layer features (configuration) best suited for the channel conditions, the large number of configurations greatly complicates the decision. A deeper understanding of relationships between configurations under a variety of channel conditions should simplify the choices and improve the performance of algorithms selecting configurations. Examples of such algorithms include: rate and channel width adaptation, frame aggregation, and MIMO setting optimization.

In this paper, we describe the design, implementation and evaluation of a new framework for the trace-based evaluation of 802.11n networks, which we call T-SIMn. We first develop novel techniques for collecting and processing traces for 802.11n networks that incorporate Frame Aggregation (FA). We then demonstrate that the simulator portion of our framework (SIMn) accurately simulates throughput for one, two and three-antenna Physical Layer Data Rates in 802.11n with FA. Finally, we evaluate the T-SIMn framework (including trace collection) by collecting traces using an iPhone which is representative of a wide variety of one antenna devices. We show that our framework can be used to accurately simulate these scenarios and we demonstrate the fidelity of SIMn by uncovering problems with our initial evaluation methodology. We expect that the T-SIMn framework will be suitable for easily and fairly comparing algorithms that must be optimized for different and varying 802.11n channel conditions which are challenging to evaluate experimentally. These include rate adaptation, frame aggregation and channel bandwidth adaptation algorithms. git

Rate adaptation algorithms (RAAs) in 802.11 networks can have a significant impact on network throughput. In order to attempt to maximize throughput, these algorithms dynamically adapt to inferred changes in the channel being used. Evaluating and comparing rate adaptation algorithms is extremely challenging due to the variability of channel conditions. Recent work on developing and evaluating new RAAs has used traces to increase the realism of simulators. We propose a new framework for the trace-driven evaluation of RAAs (called T-RATE) in which we collect and process traces in environments where interference is caused by WiFi and non-WiFi devices. T-RATE enables a more comprehensive evaluation of RAAs in environments that are representative of those in which 802.11 devices are actually used. A key to our approach is that we capture, in traces, information that is relevant to RAAs regarding how channel conditions affect channel access and channel error rates. Our approach minimizes the use of wireless channel models and achieves highly realistic results under a wider variety of scenarios than previously possible. Our evaluation of T-RATE demonstrates it can be used to collect and process traces to accurately evaluate a variety of RAAs under more diverse and representative channel conditions than previously possible.

In this paper, we address the problem of low-latency routing in a vehicular highway network. To cover long highways while minimizing the number of required roadside access points, we utilize vehicle-to-vehicle communication to propagate data in the network. Vehicular networks are highly dynamic, and hence routing algorithms that require global network state information or centralized coordination are not suitable for such networks. Instead, we develop a novel distributed routing algorithm that requires minimal coordination among vehicles, while achieving a highly efficient throughput-delay tradeoff. Specifically, we show that the proposed algorithm achieves a throughput that is within a factor of 1/e of the throughput of an algorithm that centrally coordinates vehicle transmissions in a highly dense network, and yet its end-to-end delay is approximately half of that of a widely studied ALOHA-based randomized routing algorithm. We evaluate our algorithm analytically and through simulations and compare its throughput-delay performance against the ALOHA-based randomized routing.