1. Localization with witnesses
Arun Saha, Mart Molle
University of California, Riverside
9/19/2018
University of California, Riverside

2. Position Verification
Other nodes(s) verify the position claimed by the prover, relative to:
Global co-ordinate system e.g. GPS, or
Local co-ordinate system
Proximity to a designated point
Position verification is orthogonal to Identity verification.
Finding the position of a node is known as Localization
9/19/2018
University of California, Riverside

3. Range-based localization
Range-based localization finds distance bounds between nodes.
Distance bounding is the process by which the verifier entity establishes an upper bound on the distance to the prover entity.
Multiple distance bounds are geometrically combined to constrain the prover’s location.
9/19/2018
University of California, Riverside

4. “Timed Echo” Distance Bounding
The message RTT is converted to distance bound:
Verifier sends a random number and starts a timer,
Prover echoes the number back to verifier
Verifier receives the response and stops timer.
Limitations to accuracy:
Measurement error at the verifier,
Variability in the response delay at prover
ECHO protocol
Challenge – Response Paradigm
9/19/2018
University of California, Riverside

5. Conflict between required and achievable timing accuracy
To localize objects within a room or building
distance errors must be in meters
timing errors must be in tens of nanoseconds.
Such fine grained time measurement is impossible in software.
There are delays in the layers of the protocol stack.
Experiment with sending 1 byte payload in TCP/IP over local LAN [ZBcF05]
Sending latency = 8.39 microsecond
Receiving latency = microsecond
Informal experiment “ping –c 1000 localhost” gives
1000 packets transmitted, 1000 received, 0% packet loss, time ms
rtt min/avg/max/mdev = 0.034/0.056/0.100/0.010 ms.
9/19/2018
University of California, Riverside

6. Wireless Localization Model
A group of nodes in an ad-hoc or sensor network
Mutually trusted
Mutually co-operative
A new node in the neighborhood, not in the network yet, i.e. untrusted
The group of nodes want to find out the location of the new node
If there are (at least) three independent distance measurements to the prover, then the location of the prover can be found as the intersection of the three curves.
9/19/2018
University of California, Riverside

7. Localization via time-difference of arrival with multiple verifiers
Multilateration: Time-Differences of signal arrival from a single source (prover) to multiple known locations (verifiers) can localize the source of the signal.
Existing solutions:
Assume verifiers are already time synchronized, and
can record the Time-of-Arrival for a particular signal
Our solution:
Verifiers get time synchronized by acquiring the clock rate of the challenge signal, and
can record the time difference between a pair of consecutive signals
9/19/2018
University of California, Riverside

8. One dimensional localization with witnesses
9/19/2018
University of California, Riverside

9. Messages between the lead-verifier and the prover
9/19/2018
University of California, Riverside

10. Difference of Distances
Known difference
of distance lead to
Hyperbola with foci
At W and W’
Note that the hyperbola
does not depend
on Response Delay tau_U
9/19/2018
University of California, Riverside

11. University of California, Riverside
Realizations
Any verifier-pair can form the locus of the prover
Any verifier-triplet can localize the prover
The location found by the triplet is independent of the response delay (tau_U) at the prover
9/19/2018
University of California, Riverside

12. University of California, Riverside
Tackling Delays
Measurement Delay takes place at the verifier.
The PHY of verifier helps to minimize measurement delay as:
Start a timer as soon as the SFD (or SSD) of the challenge frame is transmitted
Stop the timer as soon as the SFD (or SSD) of the subsequent frame, i.e. the response frame, is received.
Response Delay happens at the prover.
A verifier cannot expect co-operation from an untrusted Prover
Even a honest prover cannot maintain or report exact delay!
As a result of combining results from multiple witnesses, the locus of the prover does not depend on the Response Delay 
As a matter of fact,
9/19/2018
University of California, Riverside

13. University of California, Riverside
Measuring tau_W
The witnesses measure the delay in three steps:
The lead-verifier sends a DummyChallenge; the witnesses “acquire” the transmission clock rate and locks to that, transceiver is kept in “ready-to-receive” state.
The lead-verifier sends the (real) challenge; the witnesses starts a timer on reception of SFD of the challenge
The prover sends the response; The witness stops the timer on reception of SFD of the subsequent frame i.e. the response
The witnesses report (through some application specific protocol) the delay measured at the timer to the lead-verifier.
The delay measured at the lead-verifier itself is stored in the PHY, and reported when requested from higher layer localization application.
9/19/2018
University of California, Riverside

14. Measurement Errors in tau_W
If there are no errors in measurement of tau_W’s, then all hyperbolas will intersect at the true location of the prover.
There might be other intersection points too.
However, if there are errors, the intersection points will not exactly be at the true location of the prover
If the measurement errors are like random noise with zero mean, then the intersection points will be clustered around the true location point.
9/19/2018
University of California, Riverside

15. An over-determined system
Let there be n verifiers:
There will be h = (n choose 2) hyperbolas
There will be approx. N = (h choose 2) intersection points.
How can we combine the N solution points into one single estimate?
9/19/2018
University of California, Riverside

16. Combining multiple solution points
2D median of the solution points:
Peel Off the outermost points forming the minimum enclosing convex hull
Imagine all solution points are different measurements of the same signal and use them to make the final estimate
One way to do that is Kalman filtering
We obtained all solution points by pairwise solving all hyperbolas
Then we passed the solution points one-by-one through the Kalman Filter
After sufficient number of steps, the solution converges.
9/19/2018
University of California, Riverside

17. Results from Kalman Filtering
The order in which we different solution points are considered significantly effect the final estimate.
The same set of solution points processed in different order by the filtering algorithm produces different final estimate.
Some solution points are more significant than others
Points should be processed in decreasing order of significance.
If the solution point is inside the triangle formed by the corresponding verifier triplet, then it is more significant than others which are outside
The solution point whose sum of normal distances to all hyperbolas is minimum is the most significant one.
9/19/2018
University of California, Riverside

18. Sensitivity w.r.t. to verifier triplet
If the solution point lies outside the verifier triplet, then it is more sensitive to measurement errors
9/19/2018
University of California, Riverside

19. University of California, Riverside
Error
Sensitivity
9/19/2018
University of California, Riverside

20. Regions of uncertainty around Prover location
9/19/2018
University of California, Riverside

21. Regions are greater for Provers located out of the verifier triangle
9/19/2018
University of California, Riverside

22. (Selected) References
9/19/2018
University of California, Riverside

23. Thanks for your presence and patience
Questions?