Even as the COVID-19 pandemic drove advances in contact tracing and exposure notification systems, user privacy challenges continue to plague otherwise promising approaches to contain contagions. We propose a novel, scalable approach to address privacy in contact tracing that improves utility. We apply passive WiFi scan data using two metrics suitable for estimating contact between users. We support this with real world experimental data captured across a range of environments relevant to contact tracing. To preserve privacy, we leverage properties of truncated cryptographic hashes in an adaptation unique to contact tracing. This hash collision filter allows users to share information about potential contacts with a central server without revealing sensitive information. Using an aggressive threat model, including adversarial users and a malicious server, we share how this technique can improve utility while still providing strong security protections compared to other approaches using, for example, only Bluetooth (BT) or global navigation satellite systems (GNSSs). Finally, we discuss a capability of this approach that allows notification for asynchronous co-location from past contacts.

Radar collision prediction systems can play a crucial role in safety critical applications, such as autonomous vehicles and smart helmets for contact sports, by predicting an impending collision just before it will occur. Collision prediction algorithms use the velocity and range measurements provided by radar to calculate time to collision. However, radar measurements used in such systems contain significant clutter, noise, and inaccuracies which hamper reliability. Existing solutions to reduce clutter are based on static filtering methods. In this paper, we present a deep learning approach using frequency modulated continuous wave (FMCW) radar and inertial sensing that learns the environmental and user-specific conditions that lead to future collisions. We present a process of converting raw radar samples to range-Doppler matrices (RDMs) and then training a deep convolutional neural network that outputs predictions (impending collision vs. none) for any measured RDM. The system is retrained to work in dynamically changing environments and maintain prediction accuracy. We demonstrate the effectiveness of our approach of using the information from radar data to predict impending collisions in real-time via real-world experiments, and show that our method achieves an F1-score of 0.91 and outperforms a traditional approach in accuracy and adaptability.

In this work, we expand the discussion of bias in Automatic Speech Recognition (ASR) through a large-scale audit. Using a large and global data set of speech, we perform an audit of some of the most popular English ASR services. We show that, even when controlling for multiple linguistic covariates, ASR service performance has a statistically significant relationship to the political alignment of the speaker's birth country with respect to the United States' geopolitical power.

Transmitter localization remains a challenging problem in large-scale outdoor environments, especially when transmitters and receivers are allowed to be mobile. We consider localization in the context of a Radio Dynamic Zone (RDZ), a proposed experimental platform where researchers can deploy experimental devices, waveforms, or wireless networks. Wireless users outside an RDZ must be protected from harmful interference coming from sources inside the RDZ. In this setting, localizing transmitters that are causing interference is critical. One notable obstacle for developing data-driven methods for localization is the lack of large-scale training datasets. As our first contribution, we present a new dataset for localization, captured at 462.7 MHz in a 4 sq. km outdoor area with 29 different receivers and over 4,500 unique transmitter locations. Receivers are both mobile and stationary, and heterogeneous in terms of hardware, placement, and gain settings. Next, we propose a new machine learning-based localization method that can handle inputs from uncalibrated, heterogeneous receivers. Finally, we leverage our new dataset to study the robustness of our technique and others against “out of distribution” (OOD) inputs that are common in most real life applications. We show that our technique, CUTL (Calibrated U-Net Transmitter Localization), is 49% more accurate on in-distribution data, and more robust than previous methods on OOD data.

ACM TIOT launched its first special issue on the theme of wireless sensing for IoT. As an important component of the special issue and a novel practice of the journal, an online virtual workshop will be held, with presentations for each of the accepted articles. Welcome to join us for online discussion! Free registration is required for an attendee of the workshop. The zoom link will be shared to registered attendees before the workshop.

Software defined radios (SDRs) are often used in the experimental evaluation of next-generation wireless technologies. While crowdsourced spectrum monitoring is an important component of future spectrum-agile technologies, there is no clear way to test it in the real world, i.e., with hundreds of users each carrying an SDR while uploading data to a cloud-based controller. Current fully functional SDRs are bulky, with components connected via wires, and last at most hours on a single battery charge. To address these needs, we design and develop a compact, portable, untethered, and inexpensive SDR we callSitara. Our SDR interfaces with a mobile device over Bluetooth 5 and can function standalone or as a client to a central command and control server. It transmits and receives common waveforms, uploads IQ samples or processed receiver data through a mobile device to a server for remote processing and performs spectrum sensing functions. We present results from a user study involving more than 100 participants to evaluate Sitara in a hypothetical large-scale crowdsourced spectrum monitoring application. We also present a comparative analysis of Sitara to related crowdsensing systems with a particular emphasis on the role of incentives and user participation.

When it comes to studying the impacts of decision making, the research has been largely focused on examining the fairness of the decisions, the long-term effects of the decision pipelines, and utility-based perspectives considering both the decision-maker and the individuals. However, there has hardly been any focus on precarity which is the term that encapsulates the instability in people's lives. That is, a negative outcome can overspread to other decisions and measures of well-being. Studying precarity necessitates a shift in focus -- from the point of view of the decision-maker to the perspective of the decision subject. This centering of the subject is an important direction that unlocks the importance of parting with aggregate measures to examine the long-term effects of decision making. To address this issue, in this paper, we propose a modeling framework that simulates the effects of compounded decision-making on precarity over time. Through our simulations, we are able to show the heterogeneity of precarity by the non-uniform ruinous aftereffects of negative decisions on different income classes of the underlying population and how policy interventions can help mitigate such effects.

Real-time proximity and collision detection via radio distance measurements has application in smart-helmets, drones, autonomous vehicles, and social distancing. In this paper we present a range-based, infrastructure-free, distributed algorithm that utilizes inter-robot range data and intra-robot acceleration data to estimate each robot's recent positions. As the next step, a collision prediction scheme is proposed that uses the derived relative kinematics of each robot to predict an impending collision between any pair of robot. The algorithm is tested and validated with the help of measurement trace-based simulation of motion involving acceleration.

We consider the radio window attack, a privacy threat in which an attacker monitors the wireless link over a period of time, recording the channel state information (CSI) across multiple packets and uses a model to detect, estimate, or classify human movements. To prevent such privacy attacks on a wireless channel, we propose modifying radio training (MoRTr), a novel system for Wi-Fi MIMO-OFDM devices that alters transmitted symbols over time, space and frequency via a pseudo-random process that mimics the changes due to human activity, particularly the training symbols that are used to measure the wireless channel by the receiver. We perform extensive experiments to demonstrate that an attacker is thwarted by the approach. At the same time, we demonstrate that any receiver is able to use its measured CSI to demodulate the data without any significant degradation in performance, despite the fact that the receiver is not measuring the true CSI.

POWDER is a highly flexible, deeply programmable, and city-scale scientific instrument that enables cutting-edge research in wireless technologies. Researchers interact with the POWDER platform via the Internet to conduct their experiments, with zero penalty for remote access. In this two-part demonstration, the POWDER implementers show how to use the platform. First, they present the workflow that researchers follow to conduct experiments. Second, they highlight some of the hardware and software building blocks available through POWDER, including components related to over-the-air wireless and mobile networking, 5G, and massive MIMO.

Next-generation wireless experimentation benefits from new large-scale open-access software defined radio (SDR) platforms. Each SDR's transmissions must be measured and monitored to guarantee spectrum compliance. The measured spectrum is, however, corrupted by external co-channel signals. This demo presents the Bidirectional Incident/Transmit Signal Separator (BITSS), a system which estimates the linear system model, the SDR's transmit signal, and the signals from other sources incident to the antenna, all on the fly and without a signal prior or system information. We implement and run BITSS on POWDER and evaluate its performance. The demo shows that BITSS enables separation over a range of signal parameters with high accuracy and alerts users and the operator whenever a spectrum violation occurs.

A malicious attacker could, by taking control of internet-of-things devices, use them to capture received signal strength (RSS) measurements and perform surveillance on a person's vital signs, activities, and sound in their environment. This article considers an attacker who looks for subtle changes in the RSS in order to eavesdrop sound vibrations. The challenge to the adversary is that sound vibrations cause very low amplitude changes in RSS, and RSS is typically quantized with a significantly larger step size. This article contributes a lower bound on an attacker's monitoring performance as a function of the RSS step size and sampling frequency so that a designer can understand their relationship. Our bound considers the little-known and counter-intuitive fact that an adversary can improve their sinusoidal parameter estimates by making some devices transmit to add interference power into the RSS measurements. We demonstrate this capability experimentally. As we show, for typical transceivers, the RSS surveillance attacker can monitor sound vibrations with remarkable accuracy. New mitigation strategies will be required to prevent RSS surveillance attacks.

Received signal strength based device-free localization applications utilize a model that relates the measurements to position of the wireless sensors and person, and the underlying inverse problem is solved either using an imaging method or a nonlinear Bayesian filter. In this paper, it is shown that the Bayesian filters nearly reach the posterior Cramer-Rao bound and they are superior with respect to imaging approaches in terms of localization accuracy because the measurements are directly related to position of the person. However, Bayesian filters are known to suffer from divergence issues and in this paper, the problem is addressed by introducing a novel Bayesian filter. The developed filter augments the measurement model of a Bayesian filter with position estimates from an imaging approach. This bounds the filter's measurement residuals by the position errors of the imaging approach and as an outcome, the developed filter has robustness of an imaging method and tracking accuracy of a Bayesian filter. The filter is demonstrated to achieve a localization error of 0.11 m in a 75 m2open indoor deployment and an error of 0.29 m in a 82 m2apartment experiment, decreasing the localization error by 30-48 percent with respect to a state-of-the-art imaging method.

The ability to predict, and thus react to, oncoming collisions among a set of mobile agents is a fundamental requirement for safe autonomous movement, both human and robotic. This demonstration tests a pairwise method in which two agents collect repeated range measurements and predict if they will collide. Compared to methods which use GPS or TDOA to track each agent and then predict collisions, this method does not rely on infrastructure or a fixed coordinate system. However, the accurate prediction of future pairwise range, and thus collision prediction, is highly sensitive to noise and changes in velocity. This prototype can be used to provide intuition for the method’s strengths and weaknesses.

Welcome to the 19th ACM/IEEE International Conference on Information Processing in Sensor Networks (IPSN 2020), a premiere event on embedded sensing and networked systems that brings together researchers from academia, industry, and government. We are proud to see the continuing trend of increased interest in IPSN in recent years. A substantial 30% year-to-year increase in the number of submissions allowed us to share with you a particularly strong program this year. However, it is with mixed feelings that we write this message. We have all seen the world come to an abrupt stop in the last few weeks due to the spread of COVID-19 virus and will sadly not see you in the beautiful Darling Harbour in Sydney. Instead, the conference will happen in an entirely virtual format that will be split equally across three major world regions. This will inevitably harm the traditional cross-collaborative spirit of the Cyber- Physical Systems week, an event that brings together researchers across diverse fields, including Embedded, Hybrid, and Real-Time Systems. The inability to travel and exchange ideas face-to-face is a challenge, but also a wonderful opportunity to reach a wider global audience and we are determined to capitalize on the advantages and make the virtual IPSN a success. Testimony to the high quality of our program is the incredible work of our authors and organizers. Following the tradition in IPSN, our technical program committee brought together 27 distinguished experts covering the wide breadth of IPSN topics. The committee has collectively reviewed 124 submissions, providing a minimum of 3 high-quality reviews to each author. The top 50 of these submissions received additional 2 reviews and were discussed in person at the program committee meeting in St. Louis. We accepted 27 papers and followed a robust shepherding process to address the reviews prior to publication. We are proud of the authors and would like to thank them for striving to achieve the highest quality. We want to thank the program committee for their many hours of reviewing and discussion that made the program come together.

We present LLOCUS, a novel learning-based system that uses mobile crowdsourced RF sensing to estimate the location and power of unknown mobile transmitters in real time, while allowing unrestricted mobility of the crowdsourcing participants. We carefully identify and tackle several challenges in learning and localizing, based on RSS, in such a dynamic environment. We decouple the problem of localizing a transmitter with unknown transmit power into two problems, 1) predicting the power of a transmitter at an unknown location, and 2) localizing a transmitter with known transmit power. LLOCUS first estimates the power of the unknown transmitter and then scales the reported RSS values such that the unknown transmit power problem is transparent to the method of localization. We evaluate LLOCUS using three experiments in different indoor and outdoor environments. We find that LLOCUS reduces the localization error by 17-68% compared to several non-learning methods.

The large scale deployment of multi-antenna wireless networks in homes and office buildings introduces new privacy concerns for people residing in these spaces. By measuring the signal strength using receivers placed outside the premises, an attacker can track the movement of people inside. One way to defend against such an attack is to have the signal strengths of the transmitters vary (sometimes reducing to zero) according to some randomized schedule. We show that the question of finding the schedule that minimizes the worst-case "privacy loss" can be formulated as a constant-sum Stackelberg game between an attacker, whose goal is to place receivers in order to learn the movement of users, and a defender who tries to prevent the attacker while maintaining the connectivity and QoS requirements of the network. We introduce a flexible framework that enables us to capture the constraints of the attacker and the defender. The framework allows us to capture features of modern wireless systems such as directional antennas and also allows us to plug in different path-loss models with minimal changes to the setup. We then formulate the problem of finding the optimal defender strategy as a linear program and show that it can be solved efficiently. We also perform numerical evaluations on how the payoffs are affected as the requirements of the defender and the resources the attacker can afford to exhaust change.

Device-free localization (DFL) methods use measured changes in the received signal strength (RSS) between many pairs of RF nodes to provide location estimates of a person inside the wireless network. Fundamental challenges for RSS DFL methods include having a model of RSS measurements as a function of a person's location, and maintaining an accurate model as the environment changes overtime. Current methods rely on either labeled empty-area calibration or labeled fingerprints with a person at each location. Both need to be frequently recalibrated or retrained to stay current with changing environments. Other DFL methods only localize people in motion. In this paper, we address these challenges by, first, introducing a new mixture model for link RSS as a function of a person's location, and second, providing the framework to update model parameters without ever being provided labeled data from either empty-area or known-location classes. We develop two new Bayesian localization methods based on our mixture model and experimentally validate our system at three test sites with seven days of measurements. We demonstrate that our methods localize a person with non-degrading performance in changing environments, and, in addition, reduce localization error by 11 - 51 percent compared to other DFL methods.

Received signal strength based respiration rate monitoring is emerging as an alternative non-contact technology. These systems make use of the radio measurements of short-range commodity wireless devices, which vary due to the inhalation and exhalation motion of a person. The success of respiration rate estimation using such measurements depends on the signal-to-noise ratio, which alters with properties of the person and with the measurement system. To date, no model has been presented that allows evaluation of different deployments or system configurations for successful breathing rate estimation. In this paper, a received signal strength model for respiration rate monitoring is introduced. It is shown that measurements in linear and logarithmic scale have the same functional form, and the same estimation techniques can be used in both cases. The model is numerically and empirically evaluated, and its properties are discussed in depth. The most important model implications are validated under varying signal-to-noise ratio conditions using the performances of three estimators: batch frequency estimator, recursive Bayesian estimator, and model-based estimator. The results are in coherence with the findings, and they imply that different estimators are advantageous in different signal-to-noise ratio regimes.

Software-defined radios (SDRs) are often used in the experimental evaluation of next-generation wireless technologies. While crowd-sourced spectrum monitoring is an important component of future spectrum-agile technologies, there is no clear way to test it in the real world, i.e., with hundreds of users each carrying an SDR while uploading data to a cloud-based controller. Current fully functional SDRs are bulky, with components connected via wires, and last at most hours on a single battery charge. To address the needs of such experiments, we design and develop a compact, portable, untethered, and inexpensive SDR we call Sitara. Our SDR interfaces with a mobile device over Bluetooth 5 and can function standalone or as a client to a central command and control server. The Sitara offers true portability: it operates up to one week on battery power, requires no external wired connections and occupies a footprint smaller than a credit card. It transmits and receives common waveforms, uploads IQ samples or processed receiver data through a mobile device to a server for remote processing and performs spectrum sensing functions. Multiple Sitaras form a distributed system capable of conducting experiments in wireless networking and communication in addition to RF monitoring and sensing activities. In this paper, we describe our design, evaluate our solution, present experimental results from multi-sensor deployments and discuss the value of this system in future experimentation.

We design and build a protocol called on-off noise power communication (ONPC), which modifies the software in commodity packet radios to allow communication, independent of their standard protocol, at a very slow rate at long range. To achieve this long range, we use the transmitter as an RF power source that can be on or off if it does or does not send a packet, respectively, and a receiver that repeatedly measures the noise and interference power level. We use spread spectrum techniques on top of the basic on/off mechanism to overcome the interference caused by other devices' channel access to provide long ranges at a much lower data rate. We implement the protocol on top of commodity WiFi hardware. We discuss our design and how we overcome key challenges such as non-stationary interference, carrier sensing and hardware timing delays. We test ONPC in several situations to show that it achieves significantly longer range than standard WiFi.

RSS-based device-free localization (DFL) systems make use of the received signal strength (RSS) changes in a network of static wireless nodes to locate and track people. Current DFL systems require calibration, which depending on the method and required accuracy, can be very expensive in terms of time and effort, making DFL system deployment and maintenance challenging. This paper implements unsupervised learning of signal strength models (UnLeSS), a Baum-Welch based method to learn the parameters of a hidden Markov model (HMM) for each link, including the RSS distribution during the no-crossing state and the crossing state. The system uses the HMM to estimate the probability of each link being in the crossed state. As a demonstration of its effectiveness, the per-link probability is used in a radio tomographic imaging algorithm to track the location of a person. Experiments are conducted in two different homes to determine the performance of UnLeSS. We demonstrate that our system is capable of estimating the crossing/no-crossing distribution with Kullback-Leibler divergence maximum of 1.43. UnLeSS is capable of tracking a person with high accuracy (0.66 m) without a calibration period.

When several internet-of-things devices are required to be installed in a smart home, significant effort is required to provide each device with the association information for the home's wireless router. We design and build a novel protocol called Secure Transfer of Association Protocol (STRAP), which securely bootstraps connectivity between a set of deployed WiFi devices and a home's wireless router. We show that STRAP works in a variety of environments and is faster than conventional methods for connecting WiFi devices to home wireless routers.

Received signal strength (RSS)-based device-free localization applications utilize the communication between wireless devices for locating people within the monitored area. The technology is based on the fact that humans cause changes in properties of the wireless channel which is observed in the RSS, enabling localization of people without requiring them to carry any sensor, tag or device. Typically this inverse problem is solved using an empirical model that relates the RSS to location of the sensors and person, and utilizing either an imaging method or a particle filter (PF) for positioning. In this paper, we present an extended Kalman filtering (EKF) solution that incorporates some of the beneficial properties of the PF but has a lower computational overhead. In order to make the EKF work, we also need to reconsider how the measurements are sampled and processed, and a new processing scheme is proposed. The developments are validated using simulations and experimental data, and the results imply: i) the non-linear filters outperform a popular imaging method; ii) the robustness of the EKF and PF is improved using the proposed processing scheme; and iii) the EKF achieves similar performance as the PF as long as the new processing scheme is used.

We specify and evaluate a new software-defined clock network architecture, Stitch. We use Stitch to derive all subsystem clocks from a single local oscillator (LO) on an embedded platform, and enable efficient radio frequency synchronization (RFS) between two nodes' LOs. RFS uses the complex baseband samples from a low-power low-cost narrowband transceiver to drive the frequency difference between the two devices to less than 3 parts per billion (ppb). Recognizing that the use of a wideband channel to measure clock frequency offset for synchronization purposes is inefficient, we propose to use a separate narrowband radio to provide these measurements. However, existing platforms do not provide the ability to unify the local oscillator across multiple subsystems. We demonstrate Stitch with a reference hardware implementation on a research platform. We show that, with Stitch and RFS, we are able to achieve dramatic efficiency gains in ultra-wideband (UWB) time synchronization and ranging. We demonstrate the same UWB ranging accuracy in state-of-the-art systems but with 59% less utilization of the UWB channel.

Many networked users through their devices are interested in participating in distributed sensing and data collection for the purpose of betterment of human society or for earning rewards. Preservation of their location privacy is an important requirement for users participating and contributing to the data collection. We develop a novel privacy preserving approach for collecting noise-free data from vehicular users. Collection of noise-free, "pure" data, enhances its utility in the applications that use it. Location privacy must be preserved from the entity that we call a central controller, that collects all the vehicular data, and is assumed to be adversarial. We collect the data in a noise-free form by introducing temporal and spatial variations using Random Delays and Indirections. We run simulations using network and vehicle simulators driven by a real-world traffic scenario from the city of Luxembourg to evaluate our approach. Our simulation results show that the adversary cannot localize the uploaders within the thresholds of the number of streets and the length of the region of interest chosen by them.

This paper addresses the performance of systems which use commercial wireless devices to make bistatic RF channel measurements for non-contact respiration sensing. Published research has typically presented results from short controlled experiments on one system. In this paper, we deploy an extensive real-world comparative human subject study. We observe twenty patients during their overnight sleep (a total of 160 hours), during which contact sensors record ground-truth breathing data, patient position is recorded, and four different RF breathing monitoring systems simultaneously record measurements. We evaluate published methods and algorithms. We find that WiFi channel state information measurements provide the most robust respiratory rate estimates of the four RF systems tested. However, all four RF systems have periods during which RF-based breathing estimates are not reliable.

Received signal strength based radio tomographic imaging is a popular device-free indoor localization method which reconstructs the spatial loss field of the environment using measurements from a dense wireless network. Existing methods achieve high accuracy localization using a complex system with many sophisticated components. In this work, we propose an alternative and simpler imaging system based on link level occupancy detection. First, we introduce a single-bounce reflection based received signal strength model, which allows relating received signal strength variations to a large region around the link-lines. Then, based on the model, we present methods for all system components including a classifier, a detector, a back-projection based reconstruction algorithm, and a localization method. The introduced system has the following advantages over the other imaging based methods: i) a simple image reconstruction method that is straightforward to implement; ii) significantly lower computational complexity such that no floating point multiplication is required; iii) each link's measured data are compressed to a single bit, providing improved scalability; and iv) physically significant and repeatable parameters. The proposed method is validated using measurement data. Results show that the proposed method achieves the above advantages without loss of accuracy compared to the other available methods.

Using an air purifying system can remove indoor air pollutants, but because it increases electric power utilization, results in broader increases in air pollution. To explore the tradeoff between energy consumption and healthful air, we demonstrate the indoor air sensing and automation (IASA) system, an internet-of-things system. The IASA system uses an air quality sensor, gateway device, and smart thermostat to control the fan in a home's heating and cooling system. When fine particulate matter is high, the system operates the fan to pull air through a furnace filter and remove the pollution from the indoor air. We describe our system design, deployment, and collected data. To date, we have collected 861,000 air quality measurements with IASA.

We present results from a system which uses received signal strength (RSS) measurements to estimate the speed at which a person is walking when they cross the link line. While many RSS-based device-free localization systems can detect a line crossing, this system estimates additionally the speed of crossing, which can provide significant additional information to a tracking system. Further, unlike device-free RF sensors which occupy tens of MHz of bandwidth, this system uses a channel of about 10 kHz. Experiments with a person walking from 0.3 to 1.8 m/s show the system can measure walking speed within 0.05 m/s RMS error.

The current mechanisms for locating spectrum offenders are time consuming, human-intensive, and expensive. In this paper, we propose a novel approach to locate spectrum offenders using crowdsourcing. In such a participatory sensing system, privacy and bandwidth concerns preclude distributed sensing devices from reporting raw signal samples to a central agency; instead, devices would be limited to measurements of received power. However, this limitation enables a smart attacker to evade localization by simultaneously transmitting from multiple infected devices. Existing localization methods are insufficient or incapable of locating multiple sources when the powers from each source cannot be separated at the receivers. In this paper, we first propose a simple and efficient method that simultaneously locates multiple transmitters using the received power measurements from the selected devices. Second, we build sampling approaches to select sensing devices required for localization. Next, we enhance our sampling to also take into account incentives for participation in crowdsourcing. We experimentally evaluate our localization framework under a variety of settings and find that we are able to localize multiple sources transmitting simultaneously with reasonably high accuracy in a timely manner.

A growing set of environmental sensing applications use received signal strength measurements of a static wireless network for unobtrusive monitoring purposes. The success of these systems, which typically process low-amplitude signals, depend strongly on the distribution of the measurements when there are no changes in the channel. In this letter, a statistical model for signal strength measurements acquired when the environment is static is studied. As previously empirically verified, it is shown that the measurements have log-normal distribution even in idealistic environments, which cannot be explained using log-normal shadow fading arguments. Quantization and round-off errors induced by different measurement system components are also considered, and their impact are analyzed. As a result, it is shown that the logarithmic received signal strength measurements under static channel conditions are samples from stationary Gaussian process independent of the environment.

Detecting and locating outdoor border crossing events is valuable information in curbing drug trafficking, reducing poaching, and protecting high-asset equipment and goods. However, border sensing is notoriously challenging, prone to false alarms and missed detections, with serious consequences. Weather events, like rain and wind, make it even more challenging to maintain a low level of missed detections and false alarms. In this paper, we propose and test an automated system of wireless sensors which uses received signal strength (RSS) measurements to localize where a border crossing occurs. In addition, we develop new RSS-based statistical models and methods that can quickly be initialized and updated by using link RSS statistics to adapt to time-varying RSS changes due to weather events. These models are implemented in two new classifiers that localize border crossings with few missed detections and false alarms. We validate our proposed methods by implementing one of the classifiers in a three month long deployment of a solar-powered, real-time system that captures images of the border for ground truth validation. Furthermore, over 75 hours of RSS measurements are collected with an emphasis on collection during weather events, like rain and wind, during which we expect our classifiers to perform the worst. We demonstrate that the proposed classifiers outperform four other baseline classifiers in terms of false alarm probability by 1 to 4 orders of magnitude, and in terms of the misclassification probability by 1 to 2 orders of magnitude.

We introduce an platform architecture and algorithm to frequency synchronize multiple devices. The platform allows clock unification among oscillator, microcontroller, and radio. The platform accesses complex baseband samples from the radio, estimates the carrier frequency offset, and iteratively drives the main local oscillator (LO) frequency difference between two devices to zero.

In recent years, Radio frequency (RF) sensor networks have been used to localize people indoor without requiring them to wear invasive electronic devices. These wireless mesh networks, formed by low-power radio transceivers, continuously measure the received signal strength (RSS) of the links. Radio Tomographic Imaging (RTI) is a technique that generates, starting from these RSS measurements, 2D images of the change in the electromagnetic field inside the area covered by the radio transceivers to spot the presence and movements of animates (e.g., people, large animals) or large metallic objects (e.g., cars). Here, we present a RTI system for localizing and tracking people outdoors. Differently than in indoor environments where the RSS does not change significantly with time unless people are found in the monitored area, the outdoor RSS signal is time-variant, e.g., due to rainfall or wind-driven foliage. We present a novel outdoor RTI method that, despite the nonstationary noise introduced in the RSS data by the environment, achieves high localization accuracy and dramatically reduces the energy consumption of the sensing units. Experimental results demonstrate that the system accurately detects and tracks a person in real-time in a large forested area under varying environmental conditions, significantly reducing false positives, localization error and energy consumption compared to state-of-the-art RTI methods.

Detecting and localizing a person crossing a line segment, i.e., border, is valuable information in security and data analytic applications. To that end, we use the received signal strength (RSS) measured on RF links between nodes deployed linearly along a border as a border crossing detection and localization system. RSS measurements from any single RF link are noisy and prone to variations due to environmental changes (e.g. branches moving in wind). The redundant overlapping nature of the links between pairs of nodes in our proposed system provides an opportunity to mitigate these issues. We propose a hidden Markov model (HMM) which models the RSS on network links as a function of the neighboring nodes between which a person crosses. We demonstrate that the forward-backward solution to this HMM provides a robust and real time border crossing detection and localization system.

The respiration rate of a person provides critical information about their well-being. Conventionally, contact sensing is used for breathing monitoring; however, it is expensive, uncomfortable, and immobile. In-home non-contact breathing monitoring is now possible via Doppler radar and motion capture video sensors, yet these technologies are limited in mobility, among other limitations. When monitoring a patient who is free to move around his or her home, it is dificult to scale current non-contact sensors to cover the large area. Our RUBreathing sensor system uses RF received signal strength (RSS) in a network to estimate breathing rate in real-time with high accuracy over a wide area. In this demonstration, we show the sensor continuously estimating a patient's respiration rate from non-contact RSS measurements between wireless devices.

Radio tomographic imaging (RTI) enables device free localisation of people and objects in many challenging environments and situations. Its basic principle is to detect the changes in the statistics of radio signals due to the radio link obstruction by people or objects. However, the localisation accuracy of RTI suffers from complicated multipath propagation behaviours in radio links. We propose to use inexpensive and energy efficient electronically switched directional (ESD) antennas to improve the quality of radio link behaviour observations, and therefore, the localisation accuracy of RTI. We implement a directional RTI (dRTI) system to understand how directional antennas can be used to improve RTI localisation accuracy. We also study the impact of the choice of antenna directions on the localisation accuracy of dRTI and propose methods to effectively choose informative antenna directions to improve localisation accuracy while reducing overhead. Furthermore, we analyse radio link obstruction performance in both theory and simulation, as well as false positives and false negatives of the obstruction measurements to show the superiority of the directional communication for RTI. We evaluate the performance of dRTI in diverse indoor environments and show that dRTI significantly outperforms the existing RTI localisation methods based on omni-directional antennas.

Device-free localization (DFL) systems locate a person in an environment by measuring the changes in received signals on links in a wireless network. A fingerprint-based DFL method collects a training database of measurement fingerprints and uses a machine learning classifier to determine a person's location from a new fingerprint. However, as the environment changes over time due to furniture or other objects being moved, the fingerprints diverge from those in the database. This paper addresses, for DFL methods that use received signal strength as measurements, the degradation caused as a result of environmental changes. We perform experiments to quantify how changes in an environment affect accuracy, through a repetitive process of randomly moving an item in a residential home and then conducting a localization experiment, and then repeating. We quantify the degradation and consider ways to be more robust to environmental change. We find that the localization error rate doubles, on average, for every six random changes in the environment. We find that the random forests classifier has the lowest error rate among four tested. We present a correlation method for selecting channels, which decreases the localization error rate from 4.8% to 1.6%.

Device-free localization systems, such as variance-based radio tomographic imaging (VRTI), use received signal strength (RSS) variations caused by human motion in a static wireless network to locate and track people in the area of the network, even through walls. However, intrinsic motion, such as branches moving in the wind or rotating or vibrating machinery, also causes RSS variations which degrade the performance of a localization system. In this paper, we propose a new estimator, least squares variance-based radio tomography (LSVRT), which reduces the impact of the variations caused by intrinsic motion. We compare the novel method to subspace variance-based radio tomography (SubVRT) and VRTI. SubVRT also reduces intrinsic noise compared to VRTI, but LSVRT achieves better localization accuracy and does not require manually tuning additional parameters compared to VRTI. We also propose and test an online calibration method so that LSVRT and SubVRT do not require “empty-area” calibration and thus can be used in emergency situations. Experimental results from five data sets collected during three experimental deployments show that both estimators, using online calibration, can reduce localization root mean squared error by more than 40 percent compared to VRTI. In addition, the Kalman filter tracking results from both estimators have 97th percentile error of 1.3 m, a 60 percent reduction compared to VRTI.

A radio tomographic imaging (RTI) system uses the received signal strength (RSS) measured by RF sensors in a static wireless network to localize people in the deployment area, without having them to carry or wear an electronic device. This paper addresses the fact that small-scale changes in the position and orientation of the antenna of each RF sensor can dramatically affect imaging and localization performance of an RTI system. However, the best placement for a sensor is unknown at the time of deployment. Improving performance in a deployed RTI system requires the deployer to iteratively “guess-and-retest”, i.e., pick a sensor to move and then re-run a calibration experiment to determine if the localization performance had improved or degraded. We present an RTI system of servo-nodes, RF sensors equipped with servo motors which autonomously “dial it in”, i.e., change position and orientation to optimize the RSS on links of the network. By doing so, the localization accuracy of the RTI system is quickly improved, without requiring any calibration experiment from the deployer. Experiments conducted in three indoor environments demonstrate that the servo-nodes system reduces localization error on average by 32% compared to a standard RTI system composed of static RF sensors.

Abstract—In this paper, our goal is to develop approaches to reduce the energy consumption in Radio Tomographic Imaging (RTI)-based methods for device free localization without giving up localization accuracy. Our key idea is to only measure those links that are near the current location of the moving object being tracked. We propose two approaches to find the most effective links near the tracked object. In our first approach, we only consider links that are in an ellipse around the current velocity vector of the moving object. In our second approach, we only consider links that cross through a circle with radius r from the current position of the moving object. Thus, rather than creating an attenuation image of the whole area in RTI, we only create the attenuation image for effective links in a small area close to the current location of the moving object. We also develop an adaptive algorithm for determining r. We evaluate the proposed approaches in terms of energy consumption and localization error in three different test areas. Our experimental results show that using our approach, we are able to save 50 % to 80 % of energy. Interestingly, we find that our radius-based approach actually increases the accuracy of localization. I.

Bluetooth has found widespread adoption in phones, wireless headsets, stethoscopes, glucose monitors, and oximeters for communication of, at times, very critical information. However, the link keys and encryption keys in Bluetooth are ultimately generated from a short 4 digit PIN, which can be cracked off-line. We develop an alternative for secure communication between Bluetooth devices using the symmetric wireless channel characteristics. Existing approaches to secret key extraction primarily use measurements from a fixed, single channel (e.g., a 20 MHz WiFi channel); however in the presence of heavy WiFi traffic, the packet exchange rate in such approaches can reduce as much as 200 x. We build and evaluate a new method, which is robust to heavy WiFi traffic, using a very wide bandwidth (B >> 20 MHz) in conjunction with random frequency hopping. We implement our secret key extraction on two Google Nexus One smartphones and conduct numerous experiments in indoor-hallway and outdoor settings. Using extensive real-world measurements, we show that outdoor settings are best suited for secret key extraction using Bluetooth. We also show that even in the absence of heavy WiFi traffic, the performance of secret key generation using Bluetooth is comparable to that of WiFi while using much lower transmit power.

We investigate the ability of an attacker to passively use an otherwise secure wireless network to detect moving people through walls. We call this attack on privacy of people a "monitoring radio windows" (MRW) attack. We design and implement the MRW attack methodology to reliably detect when a person crosses the link lines between the legitimate transmitters and the attack receivers, by using physical layer measurements. We also develop a method to estimate the direction of movement of a person from the sequence of link lines crossed during a short time interval. Additionally, we describe how an attacker may estimate any artificial changes in transmit power (used as a countermeasure), compensate for these power changes using measurements from sufficient number of links, and still detect line crossings. We implement our methodology on WiFi and ZigBee nodes and experimentally evaluate the MRW attack by passively monitoring human movements through external walls in two real-world settings. We find that %our methods an attacker may achieve close to 100% accuracy in detecting line crossings and determining direction of motion, even through reinforced concrete walls.

RF sensor networks are wireless networks that can localize and track people (or targets) without needing them to carry or wear any electronic device. They use the change in the received signal strength (RSS) of the links due to the movements of people to infer their locations. In this paper, we consider real-time multiple target tracking with RF sensor networks. We apply radio tomographic imaging (RTI), which generates images of the change in the propagation field, as if they were frames of a video. Our RTI method uses RSS measurements on multiple frequency channels on each link, combining them with a fade level-based weighted average. We introduce methods, inspired by machine vision and adapted to the peculiarities of RTI, that enable accurate and real-time multiple target tracking. Several tests are performed in an open environment, a one-bedroom apartment, and a cluttered office environment. The results demonstrate that the system is capable of accurately tracking in real-time up to four targets in cluttered indoor environments, even when their trajectories intersect multiple times, without mis-estimating the number of targets found in the monitored area. The highest average tracking error measured in the tests is 0.45 m with two targets, 0.46 m with three targets, and 0.55 m with four targets.

RSS-based device-free localization (DFL) monitors changes in the received signal strength (RSS) measured by a network of static wireless nodes to locate and track people without requiring them to carry or wear any electronic device. Current models assume that the spatial impact area, i.e., the area in which a person affects a link's RSS, has constant size. This paper shows that the spatial impact area varies considerably for each link. Data from extensive experiments are used to derive a spatial weight model that is a function of the fade level, i.e., a measure of whether a link is experiencing destructive or constructive multipath interference, and of the sign of RSS change. In addition, a measurement model is proposed which calculates for each RSS measurement the probability of a person being located inside the derived spatial impact area. An online radio tomographic imaging (RTI) system is described which uses channel diversity and the presented models. Experiments in an open indoor environment, in a typical one-bedroom apartment and in a through-wall scenario are conducted to determine the performance of the proposed system. We demonstrate that the new system is capable of localizing and tracking a person with high accuracy (≤ 0.30 m) in all the environments, without the need to change the model parameters.

Ultra-wideband (UWB) multistatic radar can be used for target detection and tracking in buildings and rooms. Target detection and tracking relies on accurate knowledge of the bistatic delay. Noise, measurement error, and the problem of dense, overlapping multipath signals in the measured UWB channel impulse response (CIR) all contribute to make bistatic delay estimation challenging. It is often assumed that a calibration CIR, that is, a measurement from when no person is present, is easily subtracted from a newly captured CIR. We show this is often not the case. We propose modeling the difference between a current set of CIRs and a set of calibration CIRs as a hidden Markov model (HMM). Multiple experimental deployments are performed to collect CIR data and test the performance of this model and compare its performance to existing methods. Our experimental results show an RMSE of 2.85 ns and 2.76 ns for our HMM-based approach, compared to a thresholding method which, if the ideal threshold is known a priori, achieves 3.28 ns and 4.58 ns. By using the Baum-Welch algorithm, the HMM-based estimator is shown to be very robust to initial parameter settings. Localization performance is also improved using the HMM-based bistatic delay estimates.

This paper shows experimentally that standard wireless networks which measure received signal strength (RSS) can be used to reliably detect human breathing and estimate the breathing rate, an application we call “BreathTaking”. We present analysis showing that, as a first order approximation, breathing induces sinusoidal variation in the measured RSS on a link, with amplitude a function of the relative amplitude and phase of the breathing-affected multipath. We show that although an individual link may not reliably detect breathing, the collective spectral content of a network of devices reliably indicates the presence and rate of breathing. We present a maximum likelihood estimator (MLE) of breathing rate, amplitude, and phase, which uses the RSS data from many links simultaneously. We show experimental results which demonstrate that reliable detection and frequency estimation is possible with 30 seconds of data, within 0.07 to 0.42 breaths per minute (bpm) RMS error in several experiments. The experiments also indicate that the use of directional antennas may improve the systems robustness to external motion.

Secret key establishment is a fundamental requirement for private communication between two entities. In this article, we propose and evaluate a new approach for secret key extraction where multiple sensors collaborate in exchanging probe packets and collecting channel measurements. Essentially, measurements from multiple channels have a substantially higher differential entropy compared to the measurements from a single channel, thereby resulting in more randomness in the information source for key extraction, and this in turn produces stronger secret keys. We also explore the fundamental trade-off between the quadratic increase in the number of measurements of the channels due to multiple nodes per group versus a linear reduction in the sampling rate and a linear increase in the time gap between bidirectional measurements. To experimentally evaluate collaborative secret key extraction in wireless sensor networks, we first build a simple yet flexible testbed with multiple TelosB sensor nodes. Next, we perform large-scale experiments with different configurations of collaboration. Our experiments show that in comparison to the 1 × 1 configuration, collaboration among sensor nodes significantly increases the secret bit extraction per second, per probe, as well as per millijoule of transmission energy. In addition, we show that the collaborating nodes can improve the performance further when they exploit both space and frequency diversities.

A radio tomographic (RT) system uses the received signal strength (RSS) measurements collected on the links of a wireless mesh network composed of low-power transceivers in order to form real-time images of the attenuation field of the monitored area. These images indicate the position of people, without requiring them to participate in the localization effort by wearing or carrying any electronic device. Accurate localization and tracking of multiple people in real-time is required in several real-world applications, such as ambient-assisted living, tactical operations, and pedestrian traffic analysis in stores. In these scenarios, RT systems must perform reliably also a) when the number of targets is not known a priori and varies over time, and b) when people interact, i.e., have intersecting trajectories, in the monitored area. We demonstrate a RT system which tackles all of these challenges and provides accurate tracking of a varying and unknown number of people (both stationary and mobile) in real-time.

Network radio frequency (RF) environment sensing (NRES) systems pinpoint and track people in buildings using changes in the signal strength measurements made by a wireless sensor network. It has been shown that such systems can locate people who do not participate in the system by wearing any radio device, even through walls, because of the changes that moving people cause to the static wireless sensor network. However, many such systems cannot locate stationary people. We present and evaluate a system which can locate stationary or moving people, without calibration, by using kernel distance to quantify the difference between two histograms of signal strength measurements. From five experiments, we show that our kernel distance-based radio tomographic localization system performs better than the state-of-the-art NRES systems in different non line-of-sight environments.

The number of people aged 65 and over continues to rapidly increase, leading to a greater need for technologies to assist in caring for an aging population. Among these technologies are fall detection systems, since falling is a major concern for the elderly. In this paper we present a method of detecting falls using radio tomographic imaging. A two-level array of RF sensor nodes is deployed around the perimeter of a room, and the shadowing losses in the signals relayed between sensors is used to detect a person's horizontal and vertical position. Training data is used to provide a relationship between the attenutation measured as a function of height and a person's pose, which is then used in a hidden Markov model. During system operation, a forward algorithm estimates the most likely current state at each time. If the time between a standing pose and a lying down pose is too short, the system detects a fall. Using a collected experimental test set, we show that the system can distinguish falls from controlled lying down actions (e.g., sitting on the floor) with 100% reliability and no false alarms.

Accurate device free localization (DFL) based on received signal strength (RSS) measurements requires placement of radio transceivers on all sides of the target area. Accuracy degrades dramatically if sensors do not surround the area. However, law enforcement officers sometimes face situations where it is not possible or practical to place sensors on all sides of the target room or building. For example, for an armed subject barricaded in a motel room, police may be able to place sensors in adjacent rooms, but not in front of the room, where the subject would see them. In this paper, we show that using two ultra-wideband (UWB) impulse radios, in addition to multiple RSS sensors, improves the localization accuracy, particularly on the axis where no sensors are placed (which we call the x-axis). We introduce three methods for combining the RSS and UWB data. By using UWB radios together with RSS sensors, it is still possible to localize a person through walls even when the devices are placed only on two sides of the target area. Including the data from the UWB radios can reduce the localization area of uncertainty by more than 60%.

Configuration errors are the most significant cause of failure in networks. Little research has been devoted to preventing network configuration errors using device fingerprints. We demonstrate how they can be used to prevent information from being incorrectly routed in an IEEE 802.15.4 beacon-enabled wireless sensor network with multiple coordinators. To determine if they are appropriate for this application, we investigate the number of unique fingerprints that clock skew and radio frequency characteristics provide.

We evaluate the effectiveness of secret key extraction, for private communication between two wireless devices, from the received signal strength (RSS) variations on the wireless channel between the two devices. We use real world measurements of RSS in a variety of environments and settings. The results from our experiments with 802.11-based laptops show that in certain environments, due to lack of variations in the wireless channel, the extracted bits have very low entropy making these bits unsuitable for a secret key, an adversary can cause predictable key generation in these static environments, and in dynamic scenarios where the two devices are mobile, and/or where there is a significant movement in the environment, high entropy bits are obtained fairly quickly. Building on the strengths of existing secret key extraction approaches, we develop an environment adaptive secret key generation scheme that uses an adaptive lossy quantizer in conjunction with Cascade-based information reconciliation and privacy amplification. Our measurements show that our scheme, in comparison to the existing ones that we evaluate, performs the best in terms of generating high entropy bits at a high bit rate. The secret key bit streams generated by our scheme also pass the randomness tests of the NIST test suite that we conduct. We also build and evaluate the performance of secret key extraction using small, low-power, hand-held devices-Google Nexus One phones-that are equipped 802.11 wireless network cards. Last, we evaluate secret key extraction in a multiple input multiple output (MIMO)-like sensor network testbed that we create using multiple TelosB sensor nodes. We find that our MIMO-like sensor environment produces prohibitively high bit mismatch, which we address using an iterative distillation stage that we add to the key extraction process. Ultimately, we show that the secret key generation rate is increased when multiple sensors are involved in the key extraction process.

Orthogonal frequency division multiplexing (OFDM), widely recommended for sharing the spectrum among different nodes in a dynamic spectrum access network, imposes tight timing and frequency synchronization requirements. We examine the use of filterbank multicarrier (FBMC), a somewhat lesser known and understood alternative, for dynamic spectrum access. FBMC promises very low out-of-band energy of each subcarrier signal when compared to OFDM. In order to fully understand and evaluate the promise of FBMC, we first examine the use of special pulse-shaping filters of the FBMC PHY layer in reliably transmitting data packets at a very high rate. Next, to understand the impact of FBMC beyond the PHY layer, we devise a distributed and adaptive medium access control (MAC) protocol that coordinates data packet traffic among the different nodes in the network in a best-effort manner. Using extensive simulations, we show that FBMC consistently achieves at least an order of magnitude performance improvement over OFDM in several aspects including packet transmission delays, channel access delays, and effective data transmission rate available to each node in static, indoor settings. Using measurements of power spectral density and high data rate transmissions from a transceiver that we build using our National Instruments hardware platform, we show that while FBMC can decode/distinguish all the received symbols without any errors, OFDM cannot. Finally, we also examine the use of FBMC in a vehicular network setup. We find that FBMC achieves an order of magnitude performance improvement over large distances in this setup as well. Furthermore, in the case of multihop vehicular networks, FBMC can achieve about 20 × smaller end-to-end data packet delivery delays and relatively low packet drop probabilities. In summary, FBMC offers a much higher performing alternative to OFDM for networks that dynamically share the spectrum among multiple nodes.

We present an interactive demonstration of histogram distance-based radio tomographic imaging (HD-RTI), a device-free localization (DFL) system that uses measurements of received signal strength (RSS) on static links in a wireless network to estimate the locations of people who do not participate in the system by wearing any radio device in the deployment area. Compared to prior methods of RSS-based DFL, using a histogram difference metric is a very accurate method to quantify the change in RSS on the link compared to historical metrics. The new method is remarkably accurate, and works with lower node densities than prior methods.

Radio tomographic imaging (RTI) is an emerging device-free localization (DFL) technology enabling the localization of people and other objects without requiring them to carry any electronic device. Instead, the RF attenuation field of the deployment area of a wireless network is estimated using the changes in received signal strength (RSS) measured on links of the network. This paper presents the use of channel diversity to improve the localization accuracy of RTI. Two channel selection methods, based on channel packet reception rates (PRRs) and fade levels, are proposed. Experimental evaluations are performed in two different types of environments, and the results show that channel diversity improves localization accuracy by an order of magnitude. People can be located with average error as low as 0.10 m, the lowest DFL location error reported to date. We find that channel fade level is a more important statistic than PRR for RTI channel selection. Using channel diversity, this paper, for the first time, demonstrates that attenuation-based through-wall RTI is possible.

Variance-based Radio Tomographic Imaging (VRTI) is an emerging technology that locates moving objects in areas surrounded by simple and inexpensive wireless sensor nodes. VRTI uses human motion induced variation in RSS and spatial correlation between link variations to locate and track people. An artificially induced power variations in the deployed network by an adversary can introduce unprecedented errors in localization process of VRTI and, given the critical applications of VRTI, can potentially lead to serious consequences including loss of human lives. In this paper, we tackle the problem of detecting malicious receivers that report false RSS values to induce artificial power variations in a VRTI system. We use the term “Receiver Attack” to refer to such malicious power changes. We use a combination of statistical hypothesis testing and heuristics to develop real-time methods to detect receiver attack in a VRTI system. Our results show that we can detect receiver attacks of reasonable intensity and identify the source(s) of malicious activity with very high accuracy.

Device-free localization (DFL) is the estimation of the position of a person or object that does not carry any electronic device or tag. Existing model-based methods for DFL from RSS measurements are unable to locate stationary people in heavily obstructed environments. This paper introduces measurement-based statistical models that can be used to estimate the locations of both moving and stationary people using received signal strength (RSS) measurements in wireless networks. A key observation is that the statistics of RSS during human motion are strongly dependent on the RSS "fade level” during no motion. We define fade level and demonstrate, using extensive experimental data, that changes in signal strength measurements due to human motion can be modeled by the skew-Laplace distribution, with parameters dependent on the position of person and the fade level. Using the fade-level skew-Laplace model, we apply a particle filter to experimentally estimate the location of moving and stationary people in very different environments without changing the model parameters. We also show the ability to track more than one person with the model.

Tracking of people via active badges is important for location-aware computing and for security applications. However, the human body has a major effect on the antenna gain pattern of the device that the person is wearing. In this paper, the gain pattern due to the effect of the human body is experimentally measured and represented by a first-order directional gain pattern model. A method is presented to estimate the model parameters from multiple received signal strength (RSS) measurements. An alternating gain and position estimation (AGAPE) algorithm is proposed to jointly estimate the orientation and the position of the badge using RSS measurements at known-position anchor nodes. Lower bounds on mean squared error (MSE) and experimental results are presented that both show that the accuracy of position estimates can be greatly improved by including orientation estimates in the localization system. Next, we propose a new tracking filter that accepts orientation estimates as input, which we call the orientation-enhanced extended Kalman filter (OE-EKF), which improves tracking accuracy in active RFID tracking systems.

New techniques in cross-layer wireless networks are building demand for ubiquitous channel sounding, that is, the capability to measure channel impulse response (CIR) with any standard wireless network and node. Towards that goal, we present a software-defined IEEE 802.11b receiver and CIR measurement system with little additional computational complexity compared to 802.11b reception alone. The system implementation, using the universal software radio peripheral (USRP) and GNU Radio, is described and compared to previous work. We validate the CIR measurement system and present the results of a measurement campaign which measures millions of CIRs between WiFi access points and a mobile receiver in urban and suburban areas.

Perimeter distinction in a wireless network is the ability to distinguish locations belonging to different perimeters. It is complementary to existing localization techniques. A draw-back of the localization method is that when a transmitter is at the edge of an area, an algorithm with isotropic error will estimate its location in the wrong area at least half of the time. In contrast, perimeter distinction classifies the location as being in one area or the adjacent regardless of the transmitter position within the area. In this paper, we use the naturally different wireless fading conditions to accurately distinguish locations across perimeters. We examine the use of two types of wireless measurements: received signal strength (RSS) and wireless link signature (WLS), and propose multiple methods to retain good distinction rates even when the receiver faces power manipulation by malicious transmitters. Using extensive measurements of indoor and outdoor perimeters, we find that WLS outperforms RSS in various fading conditions. Even without using signal power WLS can achieve accurate perimeter distinction up to 80%. When we train our perimeter distinction method with multiple measurements within the same perimeter, we show that we are able to improve the accuracy of perimeter distinction, up to 98%.

We propose to demonstrate a new radio tomographic localization algorithm - subspace variance-based radio tomography (SubVRT), which is more robust to RSS variations caused by objects that are intrinsic parts of the environment. We first introduce the subspace decomposition method, then we derive the formulations of SubVRT, and finally we describe the demonstration setup, requirements and procedures.

Human motion in the vicinity of a wireless link causes variations in the link received signal strength (RSS). Device-free localization (DFL) systems, such as variance-based radio tomographic imaging (VRTI) use these RSS variations in a wireless network to detect, locate and track people in the area of the network, even through walls. However, intrinsic motion, such as branches moving in the wind, rotating or vibrating machinery, also causes RSS variations which degrade the performance of a DFL system. In this paper, we propose and evaluate a subspace decomposition method subspace variance-based radio tomography (SubVRT) to reduce the impact of the variations caused by intrinsic motion. Experimental results show that the SubVRT algorithm reduces localization root mean squared error (RMSE) by 41%. In addition, the Kalman filter tracking results from SubVRT have 97% of errors less than 1.4 m, a 65% improvement compared to tracking results from VRTI.

Measurements of received signal strength (RSS) on wireless links provide position information in various localization systems, including multilateration-based and fingerprint-based positioning systems, and device-free localization systems. Existing localization schemes assume a fixed or known transmit power. Therefore, any variation in transmit power can result in error in location estimate. In this paper, we present a generic framework for detecting power attacks and identifying the source of such transmit power variation. Our results show that we can achieve close to zero missed detections and false alarms with RSS measurements of only 50 transmissions. We also present an analysis of trade-off between accuracy and latency of detection for our method.

A wireless network can use the variance of measured received signal strength (RSS) on the links in a network to infer the locations of people or objects moving in the network deployment area. This paper provides a statistical model for the RSS variance as a function of a person's position with respect to the transmitter (TX) and receiver (RX) locations. We show that the ensemble mean of the RSS variance has an approximately linear relationship with the expected value of total affected power (ETAP), for a range of ETAP. We derive approximate expressions for the ETAP as a function of the person's position, for scattering and reflection, which are tested via simulation. Counterintuitively, we show that reflection, not scattering, causes the RSS variance contours to be shaped similar to Cassini ovals. Results reported in past literature and from a new experiment reported in this paper are shown to be as predicted by the analysis.

We investigate location distinction, the ability of a receiver to determine when a transmitter has changed location, which has application for energy conservation in wireless sensor networks, for physical security of radio-tagged objects, and for wireless network security in detection of replication attacks. In this paper, we investigate using a measured temporal link signature to uniquely identify the link between a transmitter (TX) and a receiver (RX). When the TX changes location, or if an attacker at a different location assumes the identity of the TX, the proposed location distinction algorithm reliably detects the change in the physical channel. This detection can be performed at a single RX or collaboratively by multiple receivers. We use 9,000 link signatures recorded at different locations and over time to demonstrate that our method significantly increases the detection rate and reduces the false alarm rate, in comparison to existing methods. We present a procedure to estimate the mutual information in link and link signature using the Edgeworth approximation. For the measured data set, we show that approximately 66 bits of link information is contained in each measured link signature.

This paper presents a new method for imaging, localizing, and tracking motion behind walls in real time. The method takes advantage of the motion-induced variance of received signal strength measurements made in a wireless peer-to-peer network. Using a multipath channel model, we show that the signal strength on a wireless link is largely dependent on the power contained in multipath components that travel through space containing moving objects. A statistical model relating variance to spatial locations of movement is presented and used as a framework for the estimation of a motion image. From the motion image, the Kalman filter is applied to recursively track the coordinates of a moving target. Experimental results for a 34-node through-wall imaging and tracking system over a 780 square foot area are presented.

We propose an approach where wireless devices, interested in establishing a secret key, sample the channel impulse response (CIR) space in a physical area to collect and combine uncorrelated CIR measurements to generate the secret key. We study the impact of mobility patterns in obtaining uncorrelated measurements. Using extensive measurements in both indoor and outdoor settings, we find that (i) when movement step size is larger than one foot the measured CIRs are mostly uncorrelated, and (ii) more diffusion in the mobility results in less correlation in the measured CIRs. We develop efficient mechanisms to encode CIRs and reconcile the differences in the bits extracted between the two devices. Our results show that our scheme generates very high entropy secret bits and that too at a high bit rate. The secret bits, that we generate using our approach, also pass the 8 randomness tests of the NIST test suite.

This paper presents novel methodologies which allow robust secret key extraction from radio channel measurements which suffer from real-world non-reciprocities and a priori unknown fading statistics. These methodologies have low computational complexity, automatically adapt to differences in transmitter and receiver hardware, fading distribution and temporal correlations of the fading signal to produce secret keys with uncorrelated bits. Moreover, the introduced method produces secret key bits at a higher rate than has previously been reported. We validate the method using extensive measurements between TelosB wireless sensors.

An RF sensor network is a sensor network, which measures the radio frequency (RF) channel at its sensor nodes, and infers properties of the network or the surrounding environment. General wireless sensor networks sense using other modalities - an RF sensor network uses its radio as a sensor. Applications include sensor localization, network management, secret key establishment, and device-free localization. This talk will explore RF sensor network applications, with an emphasis on received-signal strength (RSS)-based device-free localization, that is, locating moving people and objects based on measurements of RSS between pairs of nodes in the sensor network. We will describe 1) new multipath channel fading models which provide the basis for our ability to accurately estimate a person's location; 2) algorithms for RSS-based device-free localization; and 3) lessons learned from prototype development and deployment.

This special issue highlights the state-of-the-art enabling technologies which are critical to sensor networking and explores today's application areas as well as expected future developments.

In this paper, we discuss the emerging application of device-free localization (DFL) using wireless sensor networks, which find people and objects in the environment in which the network is deployed, even in buildings and through walls. These networks are termed “RF sensor networks” because the wireless network itself is the sensor, using radio-frequency (RF) signals to probe the deployment area. DFL in cluttered multipath environments has been shown to be feasible, and in fact benefits from rich multipath channels. We describe modalities of measurements made by RF sensors, the statistical models which relate a person's position to channel measurements, and describe research progress in this area.

Secret keys can be generated and shared between two wireless nodes by measuring and encoding radio channel characteristics without ever revealing the secret key to an eavesdropper at a third location. This paper addresses bit extraction, i.e., the extraction of secret key bits from noisy radio channel measurements at two nodes such that the two secret keys reliably agree. Problems include 1) nonsimultaneous directional measurements, 2) correlated bit streams, and 3) low bit rate of secret key generation. This paper introduces high-rate uncorrelated bit extraction (HRUBE), a framework for interpolating, transforming for decorrelation, and encoding channel measurements using a multibit adaptive quantization scheme which allows multiple bits per component. We present an analysis of the probability of bit disagreement in generated secret keys, and we use experimental data to demonstrate the HRUBE scheme and to quantify its experimental performance. As two examples, the implemented HRUBE system can achieve 22 bits per second at a bit disagreement rate of 2.2 percent, or 10 bits per second at a bit disagreement rate of 0.54 percent.

Radio Tomographic Imaging (RTI) is an emerging technology for imaging the attenuation caused by physical objects in wireless networks. This paper presents a linear model for using received signal strength (RSS) measurements to obtain images of moving objects. Noise models are investigated based on real measurements of a deployed RTI system. Mean-squared error (MSE) bounds on image accuracy are derived, which are used to calculate the accuracy of an RTI system for a given node geometry. The ill-posedness of RTI is discussed, and Tikhonov regularization is used to derive an image estimator. Experimental results of an RTI experiment with 28 nodes deployed around a 441 square foot area are presented.

In this paper, to improve the performance of multihop wireless networks, we explore a cross layer multirate adaptation scheme (we call it CROMA) that uses the phenomenon of physical capture at the physical layer for effectively distinguishing losses due to collisions from those due to channel-error. We first estimate the number of packets dropped due to collisions, at each node by counting the number of packets that are not successfully retrieved by physical capture. Next, using a simple algorithm, we assign this collision loss to neighboring sources of packets that might have generated the colliding packets. Using extensive ns-2 simulations, we show that our multirate adaptation scheme consistently outperforms the existing schemes.

We evaluate the effectiveness of secret key extraction, for private communication between two wireless devices, from the received signal strength (RSS) variations on the wireless channel between the two devices. We use real world measurements of RSS in a variety of environments and settings. Our experimental results show that (i) in certain environments, due to lack of variations in the wireless channel, the extracted bits have very low entropy making these bits unsuitable for a secret key, (ii) an adversary can cause predictable key generation in these static environments, and (iii) in dynamic scenarios where the two devices are mobile, and/or where there is a significant movement in the environment, high entropy bits are obtained fairly quickly. Building on the strengths of existing secret key extraction approaches, we develop an environment adaptive secret key generation scheme that uses an adaptive lossy quantizer in conjunction with Cascade-based information reconciliation [7] and privacy amplification [14]. Our measurements show that our scheme, in comparison to the existing ones that we evaluate, performs the best in terms of generating high entropy bits at a high bit rate. The secret key bit streams generated by our scheme also pass the randomness tests of the NIST test suite [21] that we conduct.

Accurate representation of the physical layer is required for analysis and simulation of multi-hop networking in sensor, ad hoc, and mesh networks. Radio links that are geographically proximate often experience similar environmental shadowing effects and thus have correlated shadowing. This paper presents and analyzes a non-site-specific statistical propagation model which accounts for the correlations that exist in shadow fading between links in multi-hop networks. We describe two measurement campaigns to measure a large number of multi-hop networks in an ensemble of environments. The measurements show statistically significant correlations among shadowing experienced on different links in the network, with correlation coefficients up to 0.33. Finally, we analyze multi-hop paths in three and four node networks using both correlated and independent shadowing models and show that independent shadowing models can underestimate the probability of route failure by a factor of two or greater.

Accurate analysis and simulation in multi-hop (sensor, ad hoc, and mesh) networks requires accurate representation of physical layer fading processes. Current models either ignore fading or assume independent fading on links. In reality, the shadowing losses on two geographically proximate links are correlated by the common environment through which the radio waves travel. In this paper we propose a network shadowing (NeSh) model which connects shadowing on all links in a network to a model for the physical environment in which the network operates, thus explaining shadowing correlations between links. The NeSh model is then used to analyze connectivity in a simple multi-hop network.

Unlike current models for radio channel shadowing indicate, real-world shadowing losses on different links in a network are not independent. The correlations have both detrimental and beneficial impacts on sensor, ad hoc, and mesh networks. First, the probability of network connectivity reduces when link shadowing correlations are considered. Next, the variance bounds for sensor self-localization change, and provide the insight that algorithms must infer localization information from link correlations in order to avoid significant degradation from correlated shadowing. Finally, a major benefit is that shadowing correlations between links enable the tomographic imaging of an environment from pairwise RSS measurements. This paper applies measurement-based models, and measurements themselves, to analyze and to verify both the benefits and drawbacks of correlated link shadowing.

Location distinction is the ability to determine when a device has changed its position. We explore the opportunity to use sophisticated PHY-layer measurements in wireless networking systems for location distinction. We first compare two existing location distinction methods - one based on channel gains of multi-tonal probes, and another on channel impulse response. Next, we combine the benefits of these two methods to develop a new link measurement that we call the complex temporal signature. We use a 2.4 GHz link measurement data set, obtained from CRAWDAD [10], to evaluate the three location distinction methods. We find that the complex temporal signature method performs significantly better compared to the existing methods. We also perform new measurements to understand and model the temporal behavior of link signatures over time. We integrate our model in our location distinction mechanism and significantly reduce the probability of false alarms due to temporal variations of link signatures.

The ability of a receiver to determine when a transmitter has changed location is important for energy conservation in wireless sensor networks, for physical security of radio-tagged objects, and for wireless network security in detection of replication attacks. In this paper, we propose using a measured temporal link signature to uniquely identify the link between a transmitter and a receiver. When the transmitter changes location, or if an attacker at a different location assumes the identity of the transmitter, the proposed link distinction algorithm reliably detects the change in the physical channel. This detection can be performed at a single receiver or collaboratively by multiple receivers. We record over 9,000 link signatures at different locations and over time to demonstrate that our method significantly increases the detection rate and reduces the false alarm rate, in comparison to existing methods.

Distributed estimation of sensor location is a key enabling technology for sensor networks. This demonstration will provide an interactive display of distributed, cooperative localization, using wideband received signal-strength measurements, and the distributed weighted multi-dimensional scaling (dwMDS) algorithm.

Accurate, distributed localization algorithms are needed for a wide variety of wireless sensor network applications. This article introduces a scalable, distributed weighted-multidimensional scaling (dwMDS) algorithm that adaptively emphasizes the most accurate range measurements and naturally accounts for communication constraints within the sensor network. Each node adaptively chooses a neighborhood of sensors, updates its position estimate by minimizing a local cost function and then passes this update to neighboring sensors. Derived bounds on communication requirements provide insight on the energy efficiency of the proposed distributed method versus a centralized approach. For received signal-strength (RSS) based range measurements, we demonstrate via simulation that location estimates are nearly unbiased with variance close to the Cramér-Rao lower bound. Further, RSS and time-of-arrival (TOA) channel measurements are used to demonstrate performance as good as the centralized maximum-likelihood estimator (MLE) in a real-world sensor network.

Accurate, distributed localization algorithms are needed for a wide variety of wireless sensor network applications. This paper introduces a scalable, distributed weighted-multidimensional scaling (dwMDS) algorithm that adaptively emphasizes the most accurate range measurements available and naturally accounts for communication constraints within the sensor network. For received signal-strength (RSS) based range measurements, we demonstrate via simulation that location estimates are nearly unbiased with variance close to the Cramer-Rao lower bound (CRB). Further, RSS and time-of-arrival (TOA) channel measurements are used to demonstrate performance as good as the centralized maximum-likelihood estimator (MLE) in a real-world sensor network.

If a dense network of static wireless sensors is deployed to measure a time-varying isotropic random field, then sensor data itself, rather than range measurements using specialized hardware, can be used to estimate a map of sensor locations. Furthermore, distributed and scalable sensor localization algorithms can be derived. We apply the manifold learning algorithms, Isomap, locally linear embedding (LLE), and Hessian LLE (HLLE). The HLLE-based estimator demonstrates the best bias and variance performance, but may not be robust for all random sensor deployments.

In energy-limited wireless sensor networks, detection using 'censoring sensors' reduces the probability that a sensor must transmit, thereby saving energy. We introduce a hierarchical distributed detection scheme designed specifically for multihop networks. If a sensor's local likelihood ratio (LLR) crosses a threshold, it is sent to the next higher level sensor. A simple feedback scheme is also considered. We study the performance of a Gaussian change-of-mean detection system using this hierarchical censoring scheme, with and without feedback. We show that good detection performance can be achieved while significantly reducing sensor transmissions compared to the optimal detection system.

In the study of the multipoint-to-multipoint (M2M) radio channel, the physical backbone of wireless ad hoc networks, has direct application in the simulation and design of multi-hop routing protocols. The ad hoc network radio channel differs from the point-to-point or point-to-multipoint channels previously investigated, since each device may communicate with any other device. First, this paper presents a M2M measurement campaign conducted in an open-plan office area at 925 MHz. The measurements are analyzed to demonstrate spatial correlation between neighboring hops in the network. Then, the measurements are used to numerically characterize the effectiveness of a minimum-energy routing scheme. These measurements show that using existing models in the simulation of ad hoc networks can result in inaccurate results. Observations are made about the performance of a minimum-energy routing protocol in a real M2M radio channel. Finally, a channel model is suggested to more accurately represent the M2M radio channel.

A DS-CDMA receiver requires accurate timing information to synchronize the receiver PN code correlator with the received signal. When utilized for position location applications, the DS-CDMA receiver must further provide accurate timing information to the location algorithm. Typically, DS-CDMA timing estimation algorithms require the transmission of a training sequence to establish timing lock. In addition, the carrier frequency drift encountered in many wireless communication applications adversely effects the performance of these algorithms. This paper introduces a new DS-CDMA code-timing estimation algorithm that operates without a training sequence and provides robustness to carrier frequency drift.