Kyle  Jamieson  Networks  Research  Group  Department  of  Computer  Science  University  College  London    

“Should I Work on Wireless Networks?”

We gratefully acknowledge funding from the European Research Council “Ideas” Program and Proof of Concept grant

© 2008 The New Yorker Collection from cartoonbank.com. All Rights Reserved.

Some things are well understood… Q:  What’s  the  capacity  of  a  point-­‐to-­‐point  link?    •  Before  Shannon:  The  only  way  to  make  P(error)  arbitrarily  small  is  to  reduce  the  rate  of  communication.    •  Shannon:  No!    Up  to  some  rate  C,  coding  can  make  P(error)  arbitrary  small!  

C = B log2 1+SNR( ) bits/second

…others aren’t understood well at all!

Q:  What’s  the  capacity  of  a  wireless  network?    

A:  (information  theory)  …  A:  (CS  community)  let’s  build  a  better  medium  access  protocol!  

The growing wireless toolbox

Link  Layer  and  above  •  MAC  protocols  •  Routing  and  handoff  

Physical  Layer  •  Successive  Interference  Cancellation  •  Transmit  beamforming  •  Receive  beamforming  •  MIMO  spatial  multiplexing  •  Space-­‐time  coding  •  Amplify-­‐and-­‐forward  

Wireless network system structure

•  Optimization  across  layers  •  Optimization  across  the  network,  at  each  layer  

Application Transport Network

Link Physical

Network Link

Physical

Application Transport Network

Link Physical

Host A Host B Router

Heuristic #1: Solve it better

Given  a  solved  problem,  ask  yourself:    Can  I  take  a  fresh  look  at  solving  this  problem?    Is  there  anything  about  the  way  the  researchers  solve  this  problem  that  I  perhaps  think  can  be  improved,  or  even  outright  disagree  with?  

Embrace collisions in RF backscatter networks

and rateless nature of the code to enable fast identification and dis-tributed rate adaptation, as described below.

Node Identification: We would like to identify the K nodes thatwant to transmit in a network of N nodes, where K ! N (e.g.,20 items in a customer’s shopping cart among one million itemsin a Wal-Mart store). We can model the scenario as an N-elementsparse binary vector x that is zero everywhere except inK locations.Let all K nodes that have data transmit concurrently, where a nodei transmits a known binary pattern Ai. The signal received by thereader, y, can be represented as:

y = [A1 . . .Ai . . .AN ]x

= Ax(1)

Eq. 1 is a standard compressive sensing problem, where one wantsto retrieve a sparse vector x using linear combinations y = Ax.Thus, we can use a compressive sensing solution to efficiently re-cover x with a small number of linear combinations.However, traditional compressive sensing algorithms are com-

putationally infeasible to apply in this setting because A has asmany columns as the number of nodes in the network (e.g., onemillion items in a Wal-Mart store). To develop a practical solution,we exploit the sparsity in x to eliminate large chunks of columnsin A. In particular, we hash the elements of x into buckets. All idsthat hash to empty buckets can be eliminated while ids that hashto non-empty buckets can be disambiguated using a much smallerscale compressive sensing solution. In §5, we incorporate the effectof the wireless channel and extend this idea to form a full-fledgedidentification protocol for backscatter networks.

Distributed Bit Rate Adaption: In contrast to traditional rateadaptation, which focuses on point-to-point communication, Buzzlooks at the network as a whole and adapts the aggregate bit rate ofall backscatter nodes to channel conditions. Fig. 1(a) shows the ex-isting system where backscatter nodes transmit sequentially. In thisdesign, each node’s share of the medium is the same. A node witha good channel probably does not need the amount of share it gets,while another node with a bad channel would not be able to de-liver its data within its share. In contrast, backscatter nodes in Buzzrandomly collide in different time slots and keep doing so until thereader signals that it has correctly received their data, as shown inFig. 1(b). These collisions act as a rateless code across nodes inthe network and allow us to implicitly redistribute the mismatchednetwork resources.However, decoding these collisions to recover the transmitted

bits is an expensive joint optimization problem [51]. To addressthis issue, in Buzz each node contributes to only a small randomsubset of the collisions so that the resulting code is sparse, i.e., hasa low density. Similar to LDPC codes, such low density codes canbe decoded using a linear time decoder based on belief propaga-tion. However, in contrast to LDPC codes, which are centralizedblock codes, Buzz’s code is both distributed (i.e., it operates acrossthe bits of many nodes) and rateless (i.e., the reader collects colli-sions until it has enough to decode). Using these properties, Buzzprovides automatic bit rate adaptation to backscatter networks.

Summary of Results: We built a prototype of Buzz and evalu-ated it in a testbed of 16 computational UHF RFIDs and a USRPbackscatter reader. We compared Buzz with TDMA and CDMAbased schemes in a wide range of channel conditions, which leadsto the following findings:

• Averaged across experiments with different numbers of con-current tags and over 600 traces in different channel condi-tions, Buzz improved the overall communication efficiency of

h1

h5

h4

h2

h3

b1

b2

b3

b4

b5

y1

y2

y3

y4Tim

eSlots

y5

Messages ofthe k nodes

Receivedsymbols

(a) Avoiding Collisions

Messages ofthe k nodes

b1

b2

b3

b4

b5

y1

y2

y3

y4

TimeSlots

Receivedsymbols

(b) Allowing Collisions

Figure 1—(a) Current systems try to avoid collisions by havingnodes sequentially transmit. (b) In Buzz a random subset of nodescollide in each time slot, forming a distributed rateless code.

backscatter networks by 3.5". This gain is the combination oftwo factors: First, Buzz reduced the time spent in the identifica-tion phase by 5.5", compared to the Framed Slotted Aloha pro-tocol used in the EPC Gen-2 standard; Second, during the datatransmission phase, Buzz’s bit rate adaptation on average deliv-ered a throughput gain of 2" over TDMA and CDMA.

• Buzz enables backscatter networks to work in far more challeng-ing channel conditions than previously possible. In challengingconditions, TDMA and CDMA systems experienced a messageloss rate as high as 50% and 100% respectively whereas Buzz’sloss rate was zero due to its rateless code.

Contributions: This paper makes the following contributions:

• It introduces the concept of using randomized collisions as a dis-tributed code across the bits of multiple transmitters.

• It presents a new low-complexity compressive sensing algorithmthat enables fast backscatter node identification.

• It presents the first automatic rate adaptation protocol that adaptsthe collective bit rate of multiple transmitters, which do not indi-vidually change their transmission bit rate.

• It demonstrates a working system that provides a severalfold im-provement to the efficiency and reliability of backscatter net-works.

2. BACKSCATTER COMMUNICATION

In backscatter networks, the reader transmits a high power con-tinuous waveform. Backscatter nodes transmit their signal by re-flecting back the continuous waveform using ON-OFF keying. Thenodes transmit a “1” bit by changing the impedance on their anten-nas to reflect the reader’s signal and a “0” bit by remaining in theirinitial silent state [16].There are four main distinctions between backscatter networks

and the more familiar WiFi networks.

• There is no carrier frequency offset!fc between different nodes’transmissions since nodes do not generate their own RF signalbut rather reflect the reader’s signal [16].

• Backscatter nodes transmit and receive in a narrow bandwidthdue to their power limitation [14]. As a result, the multipath ef-fect of wireless communication is negligible and the system canbe modeled as a single tap channel (one complex number) [46].

• Nodes are naturally synchronized by the reader’s query and smallsynchronization errors do not matter since they transmit at verylow bit rates (tens to hundreds of kbps) [14]. In §8.1, we presentmeasurement results for commercial passive RFID tags and com-putational RFID tags.

62

•  “Efficient and reliable low-power backscatter networks,” Wang et al., SIGCOMM 2012

Software-defined radio opens up the network to innovation

More on-board processing è

ç

Fast

er b

us to

PC

Ettus Research USRP1

Ettus Research USRP2 Rice WARP v2 Rice WARP v3

MSR Asia Sora

Heuristic #3: Take the next step

Given  a  solved  problem,  ask  yourself:    What’s  the  next  step  in  realizing  the  solution,  and  are  there  any  interesting  challenges  in  doing  so?  

SoftPHY: Change perspective from packets to symbols

Physical layer

SoftPHY interface

Packet:

Confidence

•  Cross-layer information flow from PHY up •  Extract use from high-confidence parts of packets

Link layer Network layer

•  Maintain layered architecture (PHY-independent use)

3rd pkt., 1st tx.

Data bits

1st pkt., 1st tx.

Checksum (32-bit)

“Good” data bits “Bad” data bits

1st pkt., 3rd tx.

2nd pkt., 1st tx. 1st pkt., 2nd tx.

Partial Packet-ARQ

“Partial Packet Recovery,” Jamieson and Balakrishnan, SIGCOMM ‘07

Maranello: Practical Partial Packet Recovery

correct bits at the end of packets that lack a good pream-ble. PPR was implemented and evaluated on an 802.15.4(ZigBee) protocol stack.

Driven by per-bit confidence from the PHY Layer,SOFT [27] combines several received versions of a cor-rupted frame to produce a correct frame. To repair pack-ets sent to an AP, several APs share bit confidence overa wired link. To repair packets sent to a client, the clientcombines per-bit confidence from a corrupted transmis-sion and one or more retransmissions.

Due to performance limitations of software radio plat-forms, these protocols are evaluated only at low bitrates. In contrast, Maranello is implemented using read-ily available commercial 802.11 hardware, and thus itcan be immediately realized at speed and deployed.We also show that Maranello provides increased perfor-mance even with the encodings used for high bit rates.

2.4 Wireless Communication Diversity

Correcting errors with wireless diversity complementsMaranello’s packet repair. Diversity approaches attemptto correct packets by observing different copies of thesame packet, either as received at different stations oras received in (corrupt) retransmissions. When failurehappens, MRD [20] combines many received versions ofa given packet at different APs, which may have errorbits at different locations, to recreate the original packet.If the original packet cannot be recovered through framecombining, a retransmission protocol, called Request ForAcknowledgment (RFA), is proposed to retransmit thewhole packet. SPaC [4] exploits the spatial diversityof multihop wireless sensor networks to combine sev-eral corrupted receptions of a packet at its destination.These corrupted receptions may be retransmitted by dif-ferent neighboring nodes to repair the original transmis-sion. PRO [16] is an opportunistic retransmission pro-tocol for 802.11 wireless LANs that allows overhearingrelay nodes to retransmit on behalf of the source nodeafter they know that a transmission failed.

Other protocols can benefit from wireless communi-cation diversity, but these are typically evaluated onlyby theoretical analysis or simulation study. For exam-ple, MRQ [24] keeps all the erroneous receptions of agiven packet and recovers the original packet by com-bining these receptions. Like PRO, HARBINGER [28]improves the performance of Hybrid ARQ, by exploitingretransmitted packets from relays that overhear the com-munication. The approach of Choi et al. [3] uses the errorcorrection bits transmitted in data packets to recover cor-rupted blocks. It retrieves uncorrected blocks from laterretransmissions of the packets and combines them withprevious blocks to recover the original packets.

Correct Time

Correct:Frame

SIFSAck

802.11 &Maranello

CorruptCorrupt:

Corrupt framex x Ack Timeout

DIFS & Backoff Retransmission802.11

CorruptCorrupt:

Corrupt framex x

1 2 3 4 5SIFS

Nack DIFS & Backoff Repair

3 5

Maranello

Figure 1: Maranello reacts to packet corruption by send-ing a NACK when the sender awaits an ACK. The timeto repair should decrease relative to retransmission. (Di-agram not to scale.)

3 Maranello DesignIn this section, we present an overview of Maranello, de-scribe how it achieves the key design goals of a practicalpartial packet recovery scheme, and justify the choicesof block-based recovery and the Fletcher-32 checksumcomputation. We analyze this design in isolation in thefollowing section (4) before presenting implementationdetails (Section 5) and evaluating the implementation onreal hardware.

3.1 OverviewFigure 1 presents an overview of the Maranello proto-col, compared to 802.11. When a Maranello-supportingdevice receives a frame with errors, it divides the frameinto 64-byte blocks (the last block may be smaller) andcomputes a separate checksum for each block. Thenit replies to the transmitter with a NACK that includesthese checksums. It saves the corrupted original packetin a buffer, waiting for the sender to transmit correctblocks. This negative acknowledgment is sent whenthe transmitter expects to receive a positive acknowl-edgment. A Maranello-supporting transmitter will thenmatch the receiver-supplied checksums to those of theoriginal transmission and send a repair packet with onlythose blocks of the original transmission that were cor-rupted. Once the repair packet is received correctly, thereceiver sends a normal 802.11 ACK.

Devices that do not support Maranello interoperateeasily. Unmodified senders will treat the negative ac-knowledgment as garbage and retransmit as normal.Unmodified receivers will fail to transmit a MaranelloNACK, and cause a Maranello sender to retransmit aftertimeout.

At very low transmission rate, the NACK for a largepacket may be longer than other stations expect to deferto the acknowledgment (i.e., it may extend beyond the

4

“Maranello: Practical Partial Packet Recovery for 802.11,” Han et al., NSDI ‘11

To take away…

Great,  you’ve  decided  to  go  into  wireless  networks!  

�TODO: �1.  Solve it better�2.  Hack on new hardware�3.  Take the next step �4.  Solve a new problem�

ArrayTrack: Exploiting Angle-of-Arrival for Accurate and Responsive Indoor Location

Kyle  Jamieson  with  Jie  Xiong  Department  of  Computer  Science  

University  College  London  

We gratefully acknowledge funding from the European Research Council “Ideas” Program and Proof of Concept grant

Total Immersion Corp. with Intel

Mobile needs a good indoor location service

All  benefit  from  a  highly  accurate  (centimeter-­‐level)  and  responsive  (<  one  second  latency)  indoor  location  service  

iPhone

Google Goggles

Wikitude World Browser Augmented reality

Product information in retail stores and supermarkets

Location-based wireless security

Location-based bandwidth allocation

•  Map-­‐  and  radio  modeling-­‐based  approaches:  RADAR  [Bahl+00]  –  Require  calibration  to  build  signal  strength  map  –  RF  propagation  model  relates  signal  strength,  distance  –  Augmented  with  probabilistic  models:  Horus  [Youssef

+05]  (60  cm  accuracy)  –  Crowdsourcing  calibration:  EZ  [Chintalapudi+10]    

Indoor location systems today

IEEE Computer Graphics and Applications 33

degree of homogeneity, which means an individual feature isn’t uniquely identi!able. We can, however, use the pattern of image features to determine lo-cation by comparing them to known feature loca-tions. Our previous work describes our approach for both hallways and open spaces,2 but in this article we only discuss hallways because the step to match nonunique features requires extra analysis.

Our image-processing system locates these im-age microlandmarks and compares them to the building’s "oor plan. We use a building server to hold this "oor plan data as well as provide the computation cycles for extracting the microland-marks and performing the matching. The client and server communicate through a Wi-Fi connec-tion, which many newer cell phones support. We prune the search by using a Wi-Fi location sys-tem to coarsely locate the user. We only expect a location estimate that’s accurate to within 5 to 10 meters, and several of today’s Wi-Fi-based positioning systems can easily achieve this.3 Our system will support both indoor and outdoor navi-gation; in outdoor environments, we could use the GPS-based positioning that’s available on many newer cell phones.

Figure 2 summarizes how the current system works (see the sidebar on p. 34 for related work). Inputs to the system are a "oor plan with relevant features marked on it, a rough location estimate (which includes "oor information), and an im-age from the cell-phone camera. The system sends the image to the server along with Wi-Fi signal-strength information and the type of information requested. In a !ve-step process, the server

extracts the relevant features in the image,uses the location estimate to select the search area in the "oor plan,!nds the correspondence between the image fea-tures and the building’s "oor plan,computes the camera pose from this correspon-dence, and returns an information overlay for display on the phone client.

The method in open areas is similar but uses tex-tural landmarks and matches to previously cap-tured images rather than a "oor plan.2

Our challenge is to ensure performance on all this computation and communication that’s fast enough to support reasonable user interaction speeds. We currently do all the processing on the building’s server, although future work includes exploring different task partitions and evaluating their performance.

■

■

■

■

■

Figure 1. Information overlays on a camera-phone display image. The image shows both an overlaid navigation aid (the directional arrow) and a “magic lens”-type window for displaying dynamic information about the current surroundings.

(a) Floor plan

Inpu

ts

Steps

(b) Rough location

(1) Extractfeatures

(2) Selectsearch

area

(3) Findfeaturecorrespondence

(4) Determinecamerapose

(5) Augmentimage

(c) Camera image

Figure 2. System diagram for calculating camera pose and overlaying information on a camera-phone image. Three input sources generate the augmented image in a !ve-step process.

Authorized licensed use limited to: University of Washington Libraries. Downloaded on January 14, 2010 at 15:06 from IEEE Xplore. Restrictions apply.

•  Radio  modeling-­‐based  approaches  –  No  calibration  needed,  but  accuracy  suffers  –  3  m  accuracy  [Lim+06],  5.4  m  accuracy  [Gwon+04]  

•  Vision-­‐based  approaches  –  Highly  accurate  (≈  20  cm)  [Hile+08]  but  

computationally  intensive  –  Light  conditions  aren’t  always  ideal,  humans  are  

humans  

[Hile

et a

l.]

Challenge: Tightly-packed multipath reflections

I

RAPPAPORT et al. : 900-MHz MULTIPATH PROPAGATION MEASUREMENTS

CSF5 -BO

I I I I I I I I n

I

137

Clf47

-95 i :: D i s p l a y Threshola - -107 5 dBn p e r 40 ns RHS Oelay Spread - 2 25 n lcroseconds T y p i c a l San F~ancIsco measuPeient

~ x c e s s Delay Time. [microsccondsl

Fig. 7. Multipath power delay profile measured in South San Francisco, CA, with mobile at Bayshore Drive and US-101, near San Francisco International Airport.

San Francisco. Transmitter-receiver separation was 8.5 km. It is clear from the figure that there are several multipath components arriving early in Fig. 6, which is typical of measurements made along open areas, such as a bridge or overpass, within a city. Scatterers appear specular and are easy to identify from topographical maps. It is well known that an ellipse is the locus of points that have equal time delays between the two foci. By replacing the transmitter and receiver at the foci, it is possible to distinguish the probable location of reflecting objects, assuming a single-hop path. The strong multipath component at 14.5-ps excess delay (which corres- ponds to 4.35-km excess travel distance) is deduced to be from the San Francisco skyline. This component undergoes deep fades as the mobile passes through suspension pillars that shadow the vehicle from the city. Using radar cross-section techniques and the model in [9], it is easy to show that a double-hop path, which goes from the mobile and travels twice between the San Francisco skyline and the Bay Bridge before going to Oakland, could produce a delayed signal within 15 dB of the LOS path. The component at 19 p s , which is 22 dB down from the LOS path, is probably due to a multiple-hop path between large buildings in San Francisco. It is also possible that the multipath component is induced by reflections from hills and mountains in the vicinity of the Oakland receiver, although mountain reflections usually disperse over several microseconds.

Figs. 7 and 8 result from measurements made in South San Francisco. Fig. 7 is an example of a measured profile that shows the existence of three multipath components within the first few microseconds and a specular component 15 dB down at 25 p s . Fig. 8 illustrates that in mountainous/hilly regions, multipath components can have excess delays greater than 100 p s . This is a staggering result when one considers that this implies a 30-km excess round-trip travel distance. The case of 100-ps excess delays appears to be quite rare, as it has not been reported before in the literature. Because the multipath components at 100 p s do not appear specular but dispersed, they are most likely due to mountains or a city skyline, which appear as rough scatterers from large distances. The Mansell Street hill is an unusual location since it has LOS to the San Francisco skyline, the Oakland skyline, the San Bruno

-85 I , I , , , , , ,

- -90

0

: -95 m - 2 -100

O i w l a y Threshold - -111.5 am per 40 ns RHS Delay Spread - 22.05 mlcroseconas Horst Case 5an F P ~ C I S C O measurement Hansel1 S t .

2 -105

:: -110

-115 0 20 40 60 80

Excess Delay T m e . [n lc roseconas l 0

Fig. 8. One of the worst case multipath power delay profiles measured during campaign. Mansell Street in San Francisco.

west c o a s t

1 Be hS: 2 t ---- i

Excess Delay TIN. Lmcroseconds l

Fig. 9. Probability that a multipath component has amplitude within 10 dB of maximum for excess delay greater than or equal to abscissa (West Coast measurements).

Mountains, Mount Davidson, and the Bay Bridge. These potential reflectors induce excess delays of approximately 50 p s , 100 p s , 35 p s , 20 p s , and 90 p s , respectively. The LOS path between base and mobile is partially obstructed by McLaren Park. Looking at Fig. 8, it appears that all of these scatterers are represented in the received profile. Worst case rms delay spreads are typically 10-25 p s at this location.

B. Statistical Results Root mean square delay spread and excess delay statistics

have been compiled based on the experimental data. After threshold screening, we have a data pool of 5706 measured profiles. Cumulative distribution functions (CDF's) have been plotted to show percentiles for particular values of rms delay spread and excess delay spread (10 dB). It must be remem- bered that the following results are based on measurements that have emphasized worst case characteristics along typical roadways in representative U. S. markets.

Figs. 9 and 10 show CDF's of the largest excess delay in a profile at which a multipath component has an amplitude within 10 dB of the main component for both West Coast measurements and the entire data pool, respectively. West Coast measurements give data that are probably representative for near-worst-case markets, whereas the entire ensemble

I 1

−90

20 0

Signal strength (dBm)

Delay (µs)

Outdoor multipath Indoor multipath

50 60 70 80 90 100 lime (nsec)

A better example of this "pulse overlap" phenomenon in narrow confinements is found by comparing Figures 2b and 2c. The receiver is shifted 6 inches horizontally in figure 2c with respect to figure 2b. Although the LOS path is clearly present at both locations, the data indicate the presence of a line-of-sight component in figure 2b, but the possibility of an obstructed path in figure 2c. A geometric analysis of the measurement location indicates that at least three multipath components exist within 5 ns excess delay (4.5 ns for the floor and 1.8 ns for each side wall). Although the amplitudes of these components do not change considerably from one location to the other, their relative phases do (6 inches is -0.75X at 1.33 GHz). This offers a potential explanation for the discrepancy at the time of the expected LOS path arrival.

J w. arJmE V U \\\\\\\\\\\\\\\ \\\\\\\\

Tx Rx Doors

............................ ........................... 0-

c d /////////////// ........................

DRlyKL YITH El# SMIS

Figure 3. Top view of preliminary measurement location.

VI. FUTUREWORK A propagation measurement system and

impending experiments have been described. This research will give insight into the design and installation limitations of indoor portable digital radio communication systems by providing a better understanding of indoor channel characteristics. The effects that antenna diversity, frequency scaling, and topography have on m u b a t h characteristics will be quantified through

This experiment is the first of a. continuing series of projects directed towards gaming a sound understanding of indoor radio propagation. A long-term objective of this research is to eventually develop a hybrid geometric and statistical modeling technique for indoor radio communications. This objective offers the potential for the accurate determination, a priori, of the multipath characteristics and development of appropriate system designs for specified building topographies.

Figure 2. Examples of preliminary power profiles at f = 1.3 GHz with (a) Fire doors closed. (b) Fire doors open. (c) Receiver moved 6 inches horizontally with respect to (b).

ACKNOWLEDGEMENTS The authors gratefully acknowledge the support of

AICOMM, Inc. of Raleigh, NC and Virginia's Center for Innovative Technology. The authors thank Joe Liberti and Scott Seidel for their assistance.

Delay (ns) 20 0

[Hawbaker+ ’90]

Normalized signal strength

40 40

Direct path

Multipath reflections

Direct path

Multipath reflections −100

−110

1.0

0

[Rappaport ’90]

1.  Ever-­‐increasing  number  of  antennas  for  MIMO,  SDMA  

2.  High  WiFi  access  point  density:  usually  many  nearby    

Two observations about WiFi access points

Cou

nt

0

5

10

15

Number of APs overheard 2 4 6 8 10 12

•  UCL  Department  of  CS  •  Client  at  a  random  location  sends  a  packet  

•  How  many  APs  overhear  it?  

ArrayTrack: High-level view

•  Client  sends  a  single  packet  over  the  air  •  Each  access  point  (AP)  computes  the  physical  angles-­‐of-­‐

arrival  of  a  client’s  transmission:  a  pseudospectrum  •  Aggregate  pseudospectra  at  backend  server  for  location  

AP 2

AP 1

Backendserver

0-0

.3-0

.6-0

.30

Rela

tive p

ow

er

(dB

)

0-0.3-0.6-0.30

Relative power (dB)

Phased antenna array: Principle of operation

π sin θ 2πd/λ

I

Q x1

x2

Client

d

Access point

Client

λ/2

θ d θ ½λ sin θ

Access point 1 2

1

λ

Baseband constellation

a θ( ) = 1e jπΔcosθ

"

#$$

%

&''

Array steering vector

Generalizing to many antennas

•  Input:  complex  baseband  signals  x1,  x2,  x3  from  antennas  1,  2,  and  3,  respectively  

•  Examine  array  correlation  matrix:  

•  Expectation  is  a  time-­‐average  of  the  baseband  signals  

•  Need  just  ≈  100  samples  (≈  2  μs)  from  an  802.11  packet  –  802.11g  ERP-­‐OFDM  preamble  =  20  μs  

Rxx = Ex1x1

* x1x2* x1x3

*

x2x1* x2x2

* x1x3*

x3x1* x3x2

* x3x3*

!

"

####

$

%

&&&&

MUSIC: Geometric interpretation (Three antennas, two signals)

x1

x2

x3

a(θ1)

a(θ2)

Signal e-vector e1

Signal e-vector e2

Noisee-vector e3

Signal subspace

a(θ) continuum

[Adapted from Schmidt, “Multiple Emitter Location and Signal Parameter Estimation”]

•  MUSIC  algorithm  [Schmidt  ‘79]  and  variants  [Shan  ‘85]  analyze  the  eigenstructure  of  Rxx  

0 -0.3 -0.6 -0.3 0

Relative power (dB)

θ

P(θ)

•  Multipath  is  a  challenge  in  two  distinct  ways:  

1.  MUSIC  takes  time-­‐averages,  gets  confused  when  signals  are  coherent  

Challenge: Multipath propagation

Receiver (AP)

Transmitter (Client)

Solution (1): Spatial smoothing

•  Well-­‐known  technique  [Shan+85]  to  average  across  spatially  diverse  groups  of  antennas:  

   •  Tradeoff:  Fewer  effective  number  of  antennas  

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

SSP 8x1

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

SSP 7x1

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

SSP 6x1

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

SSP 5x1

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

ESPRIT

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

4 antenna without SSP

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

4 antenna SSP 3x1

Antenna G1 G2 G3

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

SSP 8x1

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

SSP 7x1

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

SSP 6x1

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

SSP 5x1

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

ESPRIT

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

4 antenna without SSP

0.5

1

30

210

60

240

90

270

120

300

150

330

180 0

4 antenna SSP 3x1

•  Multipath  is  a  challenge  in  two  distinct  ways:  

1.  MUSIC  takes  time-­‐averages,  gets  confused  when  signals  are  coherent  

 2.  Obstacles  may  block  the  direct  line  of  sight  

Challenge: Multipath propagation

Receiver (AP)

Transmitter (Client)

Multipath fools naïve approach 18% of the time

1

23

4

AP

5678

9

31

1112

0˚90

180270

13

Circular:

0˚90

0–90

Linear:

14 1516

2625

1819

212233

32

23 24 30

27

36

3217

910

37

3938

3440 28

350-0.3-0.6-0.30

Relative power (dB)

−100 −50 0 50 100−100

−50

0

50

100

Ground−truth angle (degrees)

Estim

ated

ang

le (d

egre

es)

Pick the maximum peak

Client

AP

Combining bearing likelihoods for a location likelihood at the backend server

0 -0.3 -0.6 -0.3 0

Relative likelihood (dB)

0-0

.3-0

.6-0

.30

Re

lativ

e li

kelih

oo

d (

dB

)

x

θ2

θ1

AP 1

AP 2

•  Given  N  AP  bearing  likelihoods  P1(θ1(x)),  P2(θ2(x)),  …,  PN(θN(x))  

1.   Compute  location  likelihood  P(x)  for  a  given  location  x:  

   2.   Search  for  most  likely  location  

with  sampling  and  hill  climbing  

P1(θ)

P2(θ)

P x( ) = Pl θl x( )( )l=1

N

∏

= logPl θl x( )( )l=1

N

∑

Sampling and gradient search

Additional APs can worsen the location estimate

One AP Two APs Three APs

Four APs Five APs Six APs

Figure 6: Heat maps showing the location likelihood of client A in Figure 4 with di↵ering numbersof APs computing its location. We denote the ground truth location of client A in each heat mapwith a small dot.

5. RELATED WORKThe most widely used RF-based approach for loca-

tion uses average received signal strength (RSS) frompackets, usually measured in units of whole decibels.While readily available from commodity WiFi hardwareat this granularity, the resulting RSS measurements arevery coarse compared to the physical-layer informationwe use in ArrayTrack, and so incur an amount of quan-tization error, especially when few readings are present.

There are two main lines of work using RSS; the first,pioneered by RADAR [3, 4] builds “maps” of signalstrength to one or more access points, achieving anaccuracy on the order of meters [18, 22]. Later sys-tems such as Horus [32] use probabilistic techniques toimprove localization accuracy to an average of 60 cen-timeters when an average of six access points are withinrange of every location in the wireless LAN convergearea, but require large amounts of manual calibration.While some work has attempted to reduce the calibra-tion overhead [9], mapping generally requires significantcalibration e↵ort. Other map-based work has proposedusing overheard GSM signals from nearby towers [25],or dense deployments of desktop clients [2]. In contrastto map-based techniques, the experimental results weshow here achieve better location accuracy from verysmall numbers of detected packets, with no calibrationsteps required.

The second line of work using RSS are techniquesbased on mathematical models. Some of these propos-als use RF propagation models [17] to predict distanceaway from an access point based on signal strengthreadings. By triangulating and extrapolating using sig-nal strength models, TIX [8] achieves an accuracy of5.4 meters indoors. Lim et al. [12] use a singular valuedecomposition method combined with RF propagation

models to create a signal strength map (overlappingwith map-based approaches). They achieve a localiza-tion error of about three meters indoors. EZ [5] is asystem that uses sporadic GPS fixes on mobiles to boot-strap the localization of many clients indoors. EZ solvesthese constraints using a genetic algorithm, resultingin a median localization error of two meters indoors,without the need for any explicit pre-deployment cali-bration.

AoA-based approaches. Niculescu and Nath [15]use a mechanically-rotated directional antenna to trian-gulate clients’ locations from packet-level RSS readingsas base stations rotate their antennas. Their systemachieves a 2.1 m median error with seven participatingbase stations. However, it requires an additional rotat-ing antenna to be added to the base station, and needsto overhear hundreds of packets from each client in or-der to get enough RSS data to achieve that accuracy.

Wong et al. [28] investigate the use of AoA andchannel impulse response measurements for localiza-tion. While they have demonstrated positive resultsat a very high SNR (60 dB), typical wireless LANs op-erate at significantly lower SNRs, and the authors stopshort of describing a complete system design of how theideas would integrate with a functioning wireless LANas ArrayTrack does. Niculescu et al. [14] simulate AoA-based localization in an ad hoc mesh network. AoA hasalso been proposed in CDMA mobile cellular systems[31], in particular as a hybrid approach between TDoAand AoA [6, 29], and also in concert with interferencecancellation and ToA [24].

Image processing based approaches. These ap-proaches match features extracted from images from amobile’s camera to localize a device. Examples includework by Hile et al. [10] and vSLAM [11]. The ap-

5

Mobile’s true location

✗ Worse estimate!

ArrayTrack achieves high localization accuracy

•  33  clients  on  one  floor  of  an  office  space  in  active  use  

•  Ground  truth  using  architectural  drawings  and  laser  measure  

•  Compare  with  optimal  AP  subset  of  any  size:  ArrayTrack  is  within  2×  –  Reasons  to  expect  even  further  

improvement  1 5 10 20 40 100 400 2500

0

0.2

0.4

0.6

0.8

1

Location error (cm)

CD

F

ArrayTrackOptimal subset of APs6 APs5 APs4 APs3 APs

[ACM HotMobile 2012]

Current work: A 16-antenna AP prototype

•  Three  independent  reasons  to  increase  the  number  of  antennas  at  an  AP  in  the  future:  1.  Antenna  diversity  2.  MIMO  on  a  single  link  3.  SDMA  to  multiple  clients  

•  Leverage  more  antennas  and  more  spatial  smoothing      

ArrayTrack: Latency

•  Ongoing  work;  real-­‐time  tracking  of  mobile  clients  •  Pseudospectrum  computation  latency:  tens  of  milliseconds  •  Heat  map  search  latency:  highly  parallel  problem  

Walking-speed client bearing to AP (real-time)

To take away…

•  ArrayTrack:  High  accuracy  (median  25  cm)  and  low  latency  indoor  location  system  from  WLAN  infrastructure  

•  SecureAngle:  Augmenting  WLAN  security  with  AoA  signatures  

Look  across  system  layers  for  an  improved  location  service  and  for  improved  network  security