Heinrich Luecken

Attacks on physical-layer identification

Physical-layer identification of wireless devices, commonly referred to as Radio Frequency (RF) fingerprinting, is the process of identifying a device based on transmission imperfections exhibited by its radio transceiver. It can be used to improve access control in wireless networks, revent device cloning and complement message authentication protocols. This paper studies the feasibility of performing impersonation attacks on the modulation-based and transient-based fingerprinting techniques. Both techniques are vulnerable to impersonation attacks; however, transient-based techniques are more difficult to reproduce due to the effects of the wireless channel and antenna in their recording process. We assess the feasibility of performing impersonation attacks by extensive measurements as well as simulations using collected data from wireless devices. We discuss the implications of our findings and how they affect current device identification techniques and related applications.

UWB impulse radio based distance bounding

Today-s communication systems are often vulnerable to wormhole or relaying attacks, leading to severe security problems. Distance Bounding (DB) protocols are authentication protocols designed to protect against these attacks. They determine an upper bound on the physical distance between two communication parties — the verifier V (e.g. a door requiring an access key) and the prover P (e.g. a wireless key device). UWB technology promises an innovative wireless implementation of DB protocols, using low cost components. A crucial aspect for DB algorithms, besides a high temporal resolution, is the processing delay of P between receiving a challenge from V and transmitting the answer to V. Even current UWB transceivers may add a considerable processing delay, which decreases the provided security. We propose and analyze a novel analog UWB transceiver architecture which is able to both detect incoming UWB pulses and transmit answers with minimal delay.

Constrained maximum likelihood positioning for UWB based human motion tracking

In this paper, the problem of human motion tracking with ultra-wideband radio nodes is addressed. We provide a general maximum likelihood formulation of the positioning problem based on range measurements which can handle synchronous and asynchronous agents. Geometrical constraints on the node topology, which are imposed by the human body, are also taken into account. For a Gaussian ranging error model and the specific problem of arm motion tracking, we derive the maximum likelihood estimation rule and calculate an analytical expression for the unconstrained and constrained Cramér-Rao Lower Bound. With these results, we study analytically and via computer simulations under what circumstances the geometrical constraints lead to performance gains. It is found that the largest benefits are obtained in case of asynchronous agents and for certain arm positions. Intuitive reasons for this phenomenon are given. Finally, we verify these findings and evaluate the position location performance experimentally with range estimates obtained from measured ultra-wideband channel impulse responses including the impact of the human body.

ML timing estimation for generalized UWB-IR energy detection receivers

Timing estimation of the receive pulse is a crucial component for communication systems as well as localization with ultra wideband impulse radio. Standard timing estimation algorithms might not be applicable due to stringent requirements on complexity and power consumption of the receiver. Therefore, we consider maximum likelihood timing estimation at the output of a generalized energy detection receiver, that consists of a squaring device followed by an arbitrary post-detection filter and low rate sampler. Moreover, we assume only the statistics of the channel to be known at the receiver. To the best of our knowledge, this problem has not been treated so far in this generalized set up. Known approaches for specific post-detection filters rely on a Gaussian approximation of the detector output. We show that the estimation accuracy can be improved by using the exact marginal PDF of the energy detector output. This is verified by channel model and measurements. Towards reduced complexity, we approximate the ED detector output as multivariate normally or multivariate log-normally distributed. Verification based on channel model and measured channels favors the log-normal approximation and shows that the correlation is not relevant. Accuracy down to centimeter precision can be reached.

Synchronization scheme for low duty cycle UWB impulse radio receiver

Ultra-wide band (UWB) communication shows great potential for low-power communication for wireless sensor or body area network (BAN) applications. In particular, noncoherent receivers can be implemented with very low complexity. However, impulse radio and low duty cycle signaling involve stringent requirements on timing recovery. Standard synchronization algorithms might not be applicable due to constraints on memory capacity, clock accuracy and the sampling frequency of the receiver. Therefore, we present a scheme for burst detection and joint frame and symbol synchronization where both transmitter and receiver respect the low-duty cycle requirements. Furthermore, a subsampling analog-to-digital converter with a free running clock is assumed to meet low-power constraints. Burst detection is based on correlation with a known synchronization sequence. For symbol synchronization digital reconstruction of the symbol timing is applied, based on an FIR interpolation filter. Finally, it can be seen from performance results with real measured BAN channels that the presented synchronization algorithm is very well suited for the use in such applications.

UWB radar imaging based multipath delay prediction for NLOS position estimation

Conventional Time-of-Arrival (ToA) based Ultra-Wideband (UWB) positioning suffers strongly from multipath. Harsh propagation environments or non-line-of-sight (NLOS) situations lead to biased position estimates with high estimation errors. To overcome this problem, we propose a radar imaging based method to predict delays of dominant propagation paths. This is done in a three-step approach: First, a radar image of the environment is created using measured training data. We generate a scattering coefficient map with the large synthetic aperture of distributed and moving antennas. The training data can easily be obtained from channel estimates of a UWB communication system with mobile nodes. Second, the radar image is used to reconstruct path gains and path delays. Thus, the channel response is predicted for arbitrary transmitter and receiver positions. Finally, dominant multipath delays are extracted using WRELAX. The proposed algorithm is validated by anechoic chamber measurements with controlled reflectors. Moreover, an extensive measurement campaign in a laboratory/office environment shows that strong paths can be predicted with nanosecond accuracy in a real world scenario.

Location-aware adaptation and precoding for low complexity IR-UWB receivers

An environment is considered with many low complexity wireless mobile stations communicating to higher complexity stationary cluster heads. The cluster heads can determine the rough position of the mobile stations using geo-regioning. The mobile stations are not able to perform a channel estimation due to complexity reasons. We present two approaches to utilize regional channel knowledge available at the cluster head for improvement of the data detection performance at the mobile station. First, by feeding back the average power delay profile of the channel from the cluster head to the mobile station, the mobile station can adapt a filter according to this information. Second, at cluster head side the covariance matrix of the channel impulses response vectors is used for precoding optimization. Based on channel impulse responses measured in a realistic environment the performance of both approaches is evaluated. Performance gains of 1 to 3 dB compared to energy detection can be obtained.

UWB rapid-bit-exchange system for distance bounding

Distance bounding protocols enable one device (the verifier) to securely establish an upper bound on its distance to another device (the prover). These protocols can be used for secure location verification and detection of relay attacks, even in presence of strong attackers. The rapid-bit-exchange is the core of distance bounding protocols---the verifier sends single bit challenges, which the prover is expected to answer with minimal and stable processing delay. Based on the measured round trip time of flight, the verifier calculates its upper bound to the prover. Although several aspects of distance bounding implementations have been discussed in the past, no full implementation of a wireless distance bounding system has been presented so far. In this work, we present the first full realization of a rapid bit exchange system for distance bounding. Our system consists of an Ultra-Wideband (UWB) ranging radio and of an efficient digital processing implemented on an Field-Programmable-Gate-Array (FPGA) board; it achieves a ranging accuracy of 7:5 cm and a short processing delay at the prover (< 100 ns). This minimal processing delay is the lowest reported so far for provers that demodulate the challenge before responding.

Location-Aware UWB Communication with Generalized Energy Detection Receivers

Future wireless networks based on Ultra-Wideband (UWB) will offer localization capabilities with centimeter accuracy. We propose to use this inherently obtainable location knowledge to adapt the transceiver to the multipath channel conditions. This saves overhead for channel estimation and dissemination and enables low cost, low complexity and low power data transmission. In particular, we study the location-aware adaptation of generalized energy detection receivers for UWB impulse radio communication with binary pulse position modulation. Conventionally, these receivers are very vulnerable to narrowband interference. Therefore, we derive transmitter and receiver optimization schemes based on the Signal-to-Interference-plus-Noise-Ratio (SINR): First, we present the SINR optimization based on full channel knowledge. The location knowledge is then incorporated by means of a statistical channel model, which depends on the position of the nodes. Performance evaluation based on a simple channel model is used to give insight about the fundamental behavior of the derived optimization schemes. Moreover, an extensive measurement campaign in a rich scattering environment proves that location information can improve the data transmission and helps to successfully suppress narrowband interference. Performance gains of 2 to 5 dB compared to conventional energy detection can be obtained.

Multiuser precoding for UWB sensor networks

We consider the downlink of an Ultra-Wideband (UWB) sensor network, i.e. communication from a central unit to many sensor nodes. The key to achieve low-complexity, low-power and low-cost sensor nodes are non-coherent receivers. Conventionally, their detection performance strongly suffers from inter-symbol interference due to multipath, which substantially limits the data rate or requires expensive receiver post-processing. To overcome this problem, we propose a novel precoding scheme to transmit to several nodes simultaneously. This way the sum data rate can be increased, while low complexity of sensor nodes is maintained. Specifically, we consider nodes with generalized energy detection receivers and transmission of pulse position modulated data. First, precoding optimization is derived from a Signal-to-Interference-plus-Noise Ratio (SINR) expression for this setup based on full channel state information. To achieve the best sensor network coverage, the minimum SINR of all nodes is maximized. In a second step, optimization is extended to statistical channel knowledge, which depends on the position of the nodes. Performance evaluation based on an extensive measurement campaign shows that multiple nodes can efficiently be served simultaneously. Only marginal increase in transmit power is necessary compared to time-multiplexing.