Multi-Access Point Collaboration (MAPC) envisioned in future Wi-Fi standards has the potential to provide reliable connectivity for time-critical IoT applications. The joint transmission (JT) concept strengthens the signals at the station transmitted from distributed APs, increasing its resilience against interference and multi-path fading to improve reliability and latency performance. There is no commercially available WiFi device capable of doing this since individual APs must be synchronized for time, RF carrier and packet data, and are required to share the medium access with each other. We present an experimental study of distributed dual-AP Wi-Fi network prototype with SDR platforms with openwifi. By synchronizing the clock source, packet transmission control and data, we demonstrate a successful constructive overlap of transmitted WiFi signals at the receiver from distributed APs. Specifically, we observe a 6 dB received signal power gain and a 4.4 dB SNR improvement from the decoded packets with two APs compared to a standalone transmission in the experiment.

Field-Programmable Gate Array (FPGA)-based Software-Defined Radio (SDR) is well-suited for experimenting with advanced wireless communication systems, as it allows to alter the architecture promptly while obtaining high performance. However, programming the FPGA using a Hardware Description Language (HDL) is a time-consuming task for FPGA developers and difficult for software developers, which limits the potential of SDR. High-Level Synthesis (HLS) tools aid the designers by allowing them to program on a higher layer of abstraction. However, if not carefully designed, it may lead to a degradation in computing performance or significant increase in resource utilization. This work shows that it is feasible to design modern Orthogonal Frequency Division Multiplex (OFDM) baseband processing modules like channel estimation and equalization using HLS without sacrificing performance and to integrate them in an HDL design to form a fully-operational FPGA-based Wi-Fi (IEEE 802.11a/g/n) transceiver. Starting from no HLS experience, a design with limited overhead in terms of latency and resource utilization as compared to the HDL approach was created in less than one month. The FPGA design generated by HLS achieved the same performance as compared to its HDL counterpart when deployed on a System-on-Chip (SoC)-based SDR, as verified by a professional wireless connectivity tester.

Investigating the security of Wi-Fi devices often requires writing scripts that send unexpected or malformed frames, to subsequently monitor how the devices respond. Such tests generally use Linux and off-the-self Wi-Fi dongles. Typically, the dongle is put into monitor mode to get access to the raw content of received Wi-Fi frames and to inject, i.e., transmit, customized frames. In this paper, we demonstrate that monitor mode on Linux may, unbeknownst to the user, mistakenly inject Wi-Fi frames or even drop selected frames instead of sending them. We discuss cases where this causes security testing tools to misbehave, making users to believe that a device under test is secure while in reality it is vulnerable to an attack. To remedy this problem, we create a script to test raw frame injection, and we extend the Radiotap standard to gain more control over frame injection. Our extension is now part of the Radiotap standard and has been implemented in Linux. We tested it using commercial Wi-Fi dongles and using openwifi, which is an open implementation of Wi-Fi on top of software-defined radios. With our improved setup, we reproduced tests for the KRACK and FragAttack vulnerabilities, and discovered previously unknown vulnerabilities in three smartphones.

Software Defined Radio (SDR) platforms are valuable for research and development activities or high-end systems that demand real-time adaptable wireless protocols. While low latency can be achieved using the dedicated digital processing unit of a state-of-the-art SDR platform, its Radio Frequency (RF) front-end often poses a limitation in terms of turnaround time (TT), the time needed for switching from the receiving to the transmitting mode (or vice versa). Zero Intermediate Frequency (ZIF) transceivers are favorable for SDR, but suffer from self-interference even if the device is not currently transmitting. The strict MAC-layer requirements of Time Division Duplex (TDD) protocols like Wi-Fi cannot be achieved using configurable ZIF transceivers without having to compromise receiver sensitivity. Using a novel approach, we show that the TT using the AD9361 RF front-end can be as low as 640 ns, while the self-interference is at the same level as achieved by the conventional TDD mode, which has a TT of at least 55 μs. As compared to Frequency Division Duplex (FDD) mode, a decrease of receiver noise floor by about 13 dB in the 2.4 GHz band and by about 4.5 dB in the 5 GHz band is achieved.

Precision time protocol (PTP), a state-of-the-art clock synchronization protocol primarily designed for wired networks, has recently gained attention in the wireless community, due to the increased use of the IEEE 802.11 wireless local area networks (WLAN) in real-time distributed systems. However, all the existing WLAN-based PTP designs either incorporate software timestamping (TS) delivering poor clock synchronization accuracy, or hardware (HW) TS providing better synchronization accuracy at the cost of a significant amount of HW overhead. Moreover, the performance of the existing PTP solutions is mostly evaluated in single-hop wireless networks, while the performance across wired and wireless networks is taken for granted. In this article, a new software-defined-radio-based approach to implement PTP is introduced and validated for the IEEE 802.11 WLAN. Instead of using a dedicated HW clock, the solution utilizes the timing synchronization function clock, an existing clock in the IEEE802.11 standard for synchronization between access point and WLAN stations. The performance of the proposed solution is first investigated within a single-hop WLAN and then across wired–wireless networks. Experimental results unveil that 90% of the absolute clock synchronization error falls within 1.4$\mu \mathrm{s}$.

CSI (Channel State Information) of WiFi systems contains the environment channel response between the transmitter and the receiver, so the people/objects and their movement in between can be sensed. To get CSI, the receiver performs channel estimation based on the pre-known training field of the transmitted WiFi signal. CSI related technology is useful in many cases, but it also brings concerns on privacy and security. In this paper, we open sourced a CSI fuzzer to enhance the privacy and security of WiFi CSI applications. It is built and embedded into the transmitter of openwifi, which is an open source full-stack WiFi chip design, to prevent unauthorized sensing without sacrificing the WiFi link performance. The CSI fuzzer imposes an artificial channel response to the signal before it is transmitted, so the CSI seen by the receiver will indicate the actual channel response combined with the artificial response. Only the authorized receiver, that knows the artificial response, can calculate the actual channel response and perform the CSI sensing. Another potential application of the CSI fuzzer is covert channels based on a set of pre-defined artificial response patterns. Our work resolves the pain point of implementing the anti-sensing idea based on the commercial off-the-shelf WiFi devices.

This paper introduces a Non-Orthogonal Multiple Access (NOMA) scheme to support concurrent transmission of multiple IEEE 802.15.4 packets. Unlike collision avoidance Multiple Access Control (MAC), concurrent transmission supports Concurrent-MAC (C-MAC) where packet collision is allowed. The communication latency can be reduced by C-MAC because a user can transmit immediately without waiting for the completion of other users' transmission. The big challenge of concurrent transmission is that error free demodulation of multiple collided packets hardly can be achieved due to severe Multiple Access Interference (MAI). To improve the demodulation performance with MAI presented, we introduce an architecture with multiple switching antennas sharing a single analog transceiver to capture spatial character of different users. Successive Interference Cancellation (SIC) algorithm is designed to separate collided packets by utilizing the spatial character. Simulation shows that at least five users can transmit concurrently to the SIC receiver equipped with eight antennas without sacrificing Packet Error Rate.

Open source Software Defined Radio (SDR) project, such as srsLTE and Open Air Interface (OAI), has been widely used for 4G/5G research. However the SDR implementation of the IEEE802.11 (Wi-Fi) is still difficult. The Wi-Fi Short InterFrame Space (SIFS) requires acknowledgement (ACK) packet being sent out in 10μs/16μs (2.4GHz/5GHz) after receiving a packet successfully, thus the Personal Computer (PC) based SDR architecture hardly can be used due to the latency (≥ 100μs) between PC and Radio Frequency (RF) front-end. Researchers have to do simulation, hack a commercial chip or buy an expensive reference design to test their ideas. To change this situation, we have developed an open-source full-stack IEEE802.11a/g/n SDR implementation - openwifi. It is based on Xilinx Zynq Systemon-Chip (SoC) that includes Field Programmable Gate Array (FPGA) and ARM processor. With the low latency connection between FPGA and RF front-end, the most critical SIFS timing is achieved by implementing Physical layer (PHY) and low level Media Access Control (low MAC) in FPGA. The corresponding driver is implemented in the embedded Linux running on the ARM processor. The driver instantiates Application Programming Interfaces (APIs) defined by Linux mac80211 subsystem, which is widely used for most SoftMAC Wi-Fi chips. Researchers could study and modify openwifi easily thanks to the modular design. Compared to PC based SDR, the SoC is also a better choice for portable and embedded scenarios.

Spectrum scarcity has been driving cellular operators to utilize unlicensed spectrum in conjunction with licensed bands to deliver mobile data to its Long-Term Evolution (LTE) users, offloading the fully allocated LTE bands. However, the use of LTE in unlicensed spectrum creates numerous challenges as the fair coexistence with other technologies. A myriad of experimental works tackles the problems involved in the coexistence of different radio access technologies (RAT) in unlicensed spectrum, however, they do not cover all aspects of the problem and fail to provide the framework adopted in the experiments for reproducible research. Therefore, in this demo we present a highly configurable packetized-LTE PHY open-source framework for coexistence experiments. The framework allows the evaluation and comparison of different coexistence techniques.

Wireless network deployments in industry often grow organically with new technologies added over time, among which many use the non-licensed spectrum to avoid licensing costs. As a result, technologies competing for the same spectrum end up deployed in the same area, causing coexistence problems to manifest themselves at a later stage. To avoid unexpected performance degradation, there is a need to evaluate the impact of additional wireless technologies on an existing network before the actual deployment. This paper proposes to simplify the impact assessment by emulating the signals of the potential wireless network with a single software-defined radio. To evaluate the emulator's performance, the impact of Bluetooth on Wi-Fi technology is considered as the reference scenario. A series of real-life experiments with configurable traffic load and network scale are conducted to estimate the impact of Bluetooth network on a Wi-Fi link, and the corresponding measurements are repeated with the emulated Bluetooth signals. To the best of the authors' knowledge, we are the first to propose such a solution, and it is shown that the use of our emulator gives a reliable indication of the expected impact at the location of the Wi-Fi link. As such, this paper provides an important step toward a simple, cost efficient, and reliable solution, to assess the impact of a wireless network prior to its deployment.

Wireless communication is an enabling technology for industrial automation. For mobile industrial devices operating in large areas, the performance of the wireless handover process is crucial. For the welfare of industrial processes short time communication outage must be ensured, especially for time-critical traffic. This paper assesses the handover performance for three industrial real-life use cases with different requirements. It covers handover performance under heavy interference, its impact on time-critical traffic and on broadcast traffic latency, followed by lessons learned and opportunities for further research.

In a modern conference room, various of video and audio devices are provided to ensure efficient communications. This is commonly referred to as a conferencing system. Compared to wired conferencing systems, wireless systems require less deployment effort, but may become unreliable when the selected radio spectrum is highly occupied. This demo focuses on improving the quality of service of a commercial wireless conferencing system using dynamic channel selection based on real-time spectrum sensing. The proposed solution is verified in a large-scale wireless testbed, and the result shows that the link of the conferencing system is indeed more robust against interference when cognitive solution is applied.

Cognitive radio systems have gathered a lot of research interest during the last decade. Accuracy of spectrum sensing and efficiency of free spectrum utilization are considered as the primary objectives in this emerging technology, which promises a boost in wireless network performance, through exploitation of underutilized licensed frequency bands. As the focus of researchers is usually on these two major challenges, other aspects have been in part underestimated. In this work, we consider two factors that are rather important for evaluation of cognitive platforms, namely sensing delay and energy efficiency. The first is related to the latency induced by the spectrum sensing process and its impact on sensing efficiency, which is tightly connected to both the QoS performance of secondary users and the protection of primary users. On the other hand, energy consumption is considered as a crucial issue in all types of wireless communications, due to restricted battery autonomy of mobile devices, as well as for moving towards "greener" solutions in telecommunications. Therefore, it is important to extend existing testbed experimentation tools and develop new ones, in order to equip cognitive testbeds with such advanced monitoring capabilities. In this work, we present a monitoring procedure that has been directly integrated in the experimentation tools of the CREW testbed federation and demonstrate how it aids in the online evaluation of four different cognitive platforms in terms of the aforementioned metrics.