Manuel Flury

Interference Mitigation by Statistical Interference Modeling in an Impulse Radio UWB Receiver

Some impulse radio UWB (IR-UWB) networks may allow concurrent transmissions without power control (for example MAC protocols that do not use power control, or co-existing, non-coordinated piconets). In such cases, it has been proposed to mitigate multi-user interference (MUI) at the physical layer, but existing proposals for interference mitigation do not account for the multipath nature of UWB channels. We address this problem and propose a receiver that employs a combination of statistical interference modeling and thresholding to mitigate MUI. We find that in a multipath environment the proposed receiver significantly outperforms existing receiver designs that either completely neglect the effect of MUI or only use a simple threshold to reject samples from interfering users. Further, in contrast to successive interference cancellation schemes, our receiver does not require active decoding of each interferer. Thus there is no need to synchronize the receiver with all the interfering users, which would be impractical in an IR-UWB system that is likely to be run in ad hoc mode. To model MUI we consider a hidden Markov model (HMM) and a Gaussian mixture model (GMM). We find that the HMM models interference better than the GMM. However, the resulting performance difference is not huge and comes at the cost of increased receiver complexity

Performance Evaluation of an IEEE 802.15.4a Physical Layer with Energy Detection and Multi-User Interference

We evaluate the performance of an IEEE 802.15.4a ultra-wide band (UWB) physical layer, with an energy-detection receiver, in the presence of multi-user interference (MUI). A complete packet based system is considered. We take into account packet detection and timing acquisition, the estimation of the power delay profile of the channel, and the recovery of the encoded payload. Energy detectors are known to have a low implementation complexity and to allow for avoiding the complex channel estimation needed by a Rake receiver. However, our results show that MUI severely degrades the performance of the energy detection receiver, even at low traffic rate. We demonstrate that using an IEEE 802.15.4a compliant energy detection receiver significantly diminishes one of the most appealing benefits of UWB, namely its robustness to MUI and thus the possibility to allow parallel transmissions. We further find that timing acquisition and data decoding both equally suffer from MUI.

Distance Bounding with IEEE 802.15.4a: Attacks and Countermeasures

Impulse Radio Ultra-Wideband, in particular the recent standard IEEE 802.15.4a, is a primary candidate for implementing distance bounding protocols, thanks to its ability to perform accurate indoor ranging. Distance bounding protocols allow two wireless devices to securely estimate the distance between themselves, with the guarantee that the estimate is an upper-bound on the actual distance. These protocols serve as building blocks in security-sensitive applications such as tracking, physical access control, or localization. We investigate the resilience of IEEE 802.15.4a to physical-communication-layer attacks that decrease the distance measured by distance bounding protocols, thus violating their security. We consider two attack types: malicious prover (internal) and distance-decreasing relay (external). We show that if the honest devices use energy-detection receivers (popular due to their low cost and complexity), then an adversary can perform highly effective internal and external attacks, decreasing the distance by hundreds of meters. However, by using more sophisticated rake receivers, or by implementing small modifications to IEEE 802.15.4a and employing energy-detection receivers with a simple countermeasure, honest devices can reduce the effectiveness of external distance-decreasing relay attacks to the order of 10 m. The same is true for malicious prover attacks, provided that an additional modification to IEEE 802.15.4a is implemented.

Effectiveness of distance-decreasing attacks against impulse radio ranging

We expose the vulnerability of an emerging wireless ranging technology, impulse radio ultra-wide band (IR-UWB), to distance-decreasing attacks on the physical communication layer (PHY). These attacks violate the security of secure ranging protocols that allow two wireless devices to securely estimate the distance between them, with the guarantee that the estimate is an upper-bound on the actual distance. Such protocols serve as crucial building blocks in security-sensitive applications such as location tracking, physical access control, or localization. Prior works show the theoretical possibility of PHY attacks bypassing cryptographic mechanisms used by secure ranging protocols. They also demonstrates that for physical layers used in ISO 14443 RFID and wireless sensor networks, some PHY attacks are indeed feasible. IR-UWB was proposed as a possible solution, but we show that the de facto standard for IR-UWB, IEEE 802.15.4a, does not automatically provide security against such attacks. We find that with the mandatory modes of the standard an external attacker can decrease the measured distance by as much as 140 meters with a high probability (above 99%).

The cicada attack: Degradation and denial of service in IR ranging

We demonstrate that an interferer with malicious intentions can significantly degrade the performance of impulseradio (IR) ranging. The cicada attack we have developed can decrease the distance (degradation of service) measured by ranging algorithms designed to cope with weak NLOS conditions; it can also jam communication (denial of service). The attack is easy to mount and can be effective even against receivers designed to cope with benign multi-user interference. We also sketch possible countermeasures.

An energy detection receiver robust to multi-user interference for IEEE 802.15.4a networks

Energy-detection receivers are appealing to IEEE 802.15.4a low data-rate networks because of their low complexity. With a reasonable energy consumption, these receivers can exploit the ranging capabilities and multipath resistance of impulse-radio UWB (IR-UWB). However, the performance of energy-detection receivers can be severely degraded by multi-user interference (MUI). One solution may be to coordinate access to the physical layer with an exclusion protocol. Unfortunately, this cannot prevent MUI due to uncontrolled activities in neighboring networks (e.g., several IEEE 802.15.4a piconets running in parallel). Hence, interference must be taken into account already in the design of the physical layer. In this paper, we present an IR-UWB receiver robust to MUI for IEEE 802.15.4a networks. Its architecture is based on energy detection. We also take into full account the different signaling structure between the preamble and the payload of IEEE 802.15.4a packets. In certain scenarios with MUI we found the packet error rate to be up to two orders of magnitude lower when compared to a traditional energy detection receiver that neglects MUI. Further, this significant performance improvement entails only a moderate increase in complexity.

On Secure and Precise IR-UWB Ranging

To provide high ranging precision in multipath environments, a ranging protocol should find the first arriving path, rather than the strongest path. We demonstrate a new attack vector that disrupts such precise Time-of-Arrival (ToA) estimation, and allows an adversary to decrease the measured distance by a value in the order of the channel spread (10-20 meters). This attack vector can be used in previously reported physical-communication-layer (PHY) attacks against secure ranging (or distance bounding). Furthermore, it creates a new type of attack based on malicious interference: This attack is much easier to mount than the previously known external PHY attack (distance-decreasing relay) and it can work even if secret preamble codes are used. We evaluate the effectiveness of this attack for a PHY that is particularly well suited for precise ranging in multipath environments: Impulse Radio Ultra-Wideband (IR-UWB). We show, with PHY simulations and experiments, that the attack is effective against a variety of receivers and modulation schemes. Furthermore, we identify and evaluate three types of countermeasures that allow for precise and secure ranging.

Synchronization for Impulse-Radio UWB With Energy-Detection and Multi-User Interference: Algorithms and Application to IEEE 802.15.4a

Energy-detection (ED) receivers can take advantage of the ranging and multipath resistance capabilities of impulse-radio ultra-wideband (IR-UWB) physical layers at a much lower complexity than coherent receivers. However, ED receivers are extremely vulnerable to multi-user interference (MUI). Therefore, the design of IR-UWB ED architectures must take MUI into account. In this paper, we present the design and evaluation of two complementary algorithms for reliable and robust synchronization of IR-UWB ED receivers in the presence of MUI: 1) power-independent detection and preamble code interference cancellation (PICNIC) and 2) detection of start-frame-delimiter through sequential ratio tests (DESSERT). PICNIC addresses packet detection and timing acquisition while DESSERT focuses on start-frame-delimiter (SFD) detection. Both algorithms are evaluated with the IEEE 802.15.4a IR-UWB physical layer, standardized for low data-rate networks. The performance evaluation with extensive simulations show that our algorithms outperform nonrobust synchronization algorithms by up to two orders of magnitude in the presence of MUI.

Robust non-coherent timing acquisition in IEEE 802.15.4a IR-UWB networks

Non-coherent energy-detection receivers are an attractive choice for IEEE 802.15.4a networks. They can exploit the ranging capabilities and the multipath resistance of impulseradio ultra-wide band (IR-UWB) at a low complexity. However, IEEE 802.15.4a receivers operate with interference created by uncontrolled piconets and an uncoordinated medium access control layer. The performance of an energy-detection IR-UWB receiver is greatly degraded in such scenarios, for both timing acquisition and decoding. In this paper, we focus on timing acquisition: we present PICNIC, a robust and low-complexity algorithm that allows for reliable timing acquisition with an IR-UWB energy-detection receiver in the presence of multiuser interference (MUI), even in near-far scenarios. At the cost of a negligible performance reduction in single-user scenarios, PICNIC outperforms classic timing acquisition algorithms by up to two orders of magnitude if MUI is present. Furthermore, PICNIC exhibits a near perfect capture property: if several transmitters compete for timing acquisition at the receiver, one signal will be acquired with practically no false detection.

Clock-offset tracking software algorithms for IR-UWB energy-detection receivers

We present a clock-offset tracking algorithm for impulse-radio ultra-wide band (IR-UWB) energy-detection receivers. There is a complexity versus performance trade-off for the design of IR-UWB energy-detection receivers: Extremely low-complexity energy-detection receivers are built with a large, constant integration duration; they are robust to clock drifts but are sensitive to noise enhancement effects and cannot adapt to channel variations. More sophisticated energy-detection receivers use a shorter integration duration and combine several weighted outputs of the energy collector; they are robust to noise enhancement effects, can adapt to channel variations and offer a much better performance than non-adaptive receivers. However, they become sensitive to clock offsets. Hence, there is a need for low-complexity clock-offset tracking solutions to support adaptive energy-detection receivers. Our solution is constructed around the Radon transform, an image processing tool traditionally used to detect line features in images. Our solution is fully compatible with the IEEE 802.15.4a standard, does not increase the hardware complexity of the receiver and reduces the performance loss due to clock offset to less than 0.5 dB.