mmHawkeye: Passive UAV Detection with a COTS mmWave Radar

Small Unmanned Aerial Vehicles (UAVs) are becoming potential threats to security-sensitive areas and personal privacy. A UAV can shoot photos at height, but how to detect such an uninvited intruder is an open problem. This paper presents mmHawkeye, a passive approach for UAV detection with a COTS millimeter wave (mmWave) radar. mmHawkeye doesn't require prior knowledge of the type, motions, and flight trajectory of the UAV, while exploiting the signal feature induced by the UAV's periodic micro-motion (PMM) for long-range accurate detection. The design is therefore effective in dealing with low-SNR and uncertain reflected signals from the UAV. mmHawkeye can further track the UAV's position with dynamic programming and particle filtering, and identify it with a Long Short-Term Memory (LSTM) based detector. We implement mmHawkeye on a commercial mmWave radar and evaluate its performance under varied settings. The experimental results show that mmHawkeye has a detection accuracy of 95.8% and can realize detection at a range up to 80m.Comment: 9 pages, 14 figures, IEEE SECON202

A Handheld Fine-Grained RFID Localization System with Complex-Controlled Polarization

There is much interest in fine-grained RFID localization systems. Existing systems for accurate localization typically require infrastructure, either in the form of extensive reference tags or many antennas (e.g., antenna arrays) to localize RFID tags within their radio range. Yet, there remains a need for fine-grained RFID localization solutions that are in a compact, portable, mobile form, that can be held by users as they walk around areas to map them, such as in retail stores, warehouses, or manufacturing plants. We present the design, implementation, and evaluation of POLAR, a portable handheld system for fine-grained RFID localization. Our design introduces two key innovations that enable robust, accurate, and real-time localization of RFID tags. The first is complex-controlled polarization (CCP), a mechanism for localizing RFIDs at all orientations through software-controlled polarization of two linearly polarized antennas. The second is joint tag discovery and localization (JTDL), a method for simultaneously localizing and reading tags with zero-overhead regardless of tag orientation. Building on these two techniques, we develop an end-to-end handheld system that addresses a number of practical challenges in self-interference, efficient inventorying, and self-localization. Our evaluation demonstrates that POLAR achieves a median accuracy of a few centimeters in each of the x/y/z dimensions in practical indoor environments

Performance Evaluation of a Metasurface-enabled Wearable Quasi-Yagi Antenna with End-fire Radiation Pattern on Textile Substrate

We present the performance evaluation of a wearable quasi-Yagi RFID reader antenna fabricated using a 2mm thick flexible Ethylene Propylene Diene Monomer (EPDM) foam substrate, exhibiting end-fire radiation properties along the human body surface. The designed antenna operates for Wireless Body Area Networks (WBAN) and UHF RFID reader applications at 915MHz frequency. The quasi-Yagi antenna comprises the Yagi-type radiator, a periodic surface that launches a surface-wave to achieve the end-fire radiation properties, and a ground plane that provides isolation between the radiating element of the antenna and the human body. In a full-wave EM simulator, the wearable antenna achieved the end-fire directivity of 5.9dBi, when mounted on a homogenous cylindrical body model. The relative size of the quasi-Yagi antenna is 0.22 lambda {o} times 0.33 lambda {o} with an overall thickness of 4mm. The cording to the theory of transformation acoustics and its performance of the wearable antenna is evaluated at various locations of the human body i.e., on the head, the shoulder, and the back, and also under different bending scenarios. The results show that the antenna is robust towards these variations and retains its impedance matching under the bending scenarios that can be expected in the application. We also measured the realized gain of the antenna using a dipole UHF RFID test tag with a gain of 0dBi at 915MHz frequency. The wearable antenna shows realized gain of-6.7 dBi for the head,-6.9 dBi for the shoulder, and-7.6 dBi for the back of the human body. Overall, the antenna shows promising results for the wearable WBAN and UHF RFID reader applications.acceptedVersionPeer reviewe

Wi-attack: Cross-technology Impersonation Attack against iBeacon Services

iBeacon protocol is widely deployed to provide location-based services. By receiving its BLE advertisements, nearby devices can estimate the proximity to the iBeacon or calculate indoor positions. However, the open nature of these advertisements brings vulnerability to impersonation attacks. Such attacks could lead to spam, unreliable positioning, and even security breaches. In this paper, we propose Wi-attack, revealing the feasibility of using WiFi devices to conduct impersonation attacks on iBeacon services. Different from impersonation attacks using BLE compatible hardware, Wi-attack is not restricted by broadcasting intervals and is able to impersonate multiple iBeacons at the same time. Effective attacks can be launched on iBeacon services without modifications to WiFi hardware or firmware. To enable direct communication from WiFi to BLE, we use the digital emulation technique of cross technology communication. To enhance the packet reception along with its stability, we add redundant packets to eliminate cyclic prefix error entirely. The emulation provides an iBeacon packet reception rate up to 66.2%. We conduct attacks on three iBeacon services scenarios, point deployment, multilateration, and fingerprint-based localization. The evaluation results show that Wi-attack can bring an average distance error of more than 20 meters on fingerprint-based localization using only 3 APs.Comment: 9 pages; 26 figures; 2021 18th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON), 202

Location estimation and collective inference in indoor spaces using smartphones

In the last decade, indoor localization-based smart, innovative services have become very popular in public spaces (retail spaces, malls, museums, and warehouses). We have state-of-art RSSI techniques to more accurate CSI techniques to infer indoor location. Since the past year, the pandemic has raised an important challenge of determining if a pair of individuals are ``social-distancing,'' separated by more than 6ft. Most solutions have used `presence'-if one device can hear another--- which is a poor proxy for distance since devices can be heard well beyond 6 ft social distancing radius and across aisles and walls. Here we ask the key question: what needs to be added to our current indoor localization solutions to deploy them towards scenarios like reliable contact tracing solutions easily. And we identified three main limitations---deployability, accuracy, and privacy. Location solutions need to deploy on ubiquitous devices like smartphones. They should be accurate under different environmental conditions. The solutions need to respect a person's privacy settings. Our main contributions are twofold -a new statistical feature for localization, Packet Reception Probability (PRP) which correlates with distance and is different from other physical measures of distance like CSI or RSSI. PRP can easily deploy on smartphones (unlike CSI) and is more accurate than RSSI. Second, we develop a crowd tool to audit the level of location surveillance in space which is the first step towards achieving privacy. Specifically, we first solve a location estimation problem with the help of infrastructure devices (mainly Bluetooth Low Energy or BLE devices). BLE has turned out to be a key contact tracing technology during the pandemic. We have identified three fundamental limitations with BLE RSSI---biased RSSI Estimates due to packet loss, mean RSSI de-correlated with distance due to high packet loss in BLE, and well-known multipath effects. We built the new localization feature, Packet Reception Probability (PRP), to solve the packet loss problem in RSSI. PRP measures the probability that a receiver successfully receives packets from the transmitter. We have shown through empirical experiments that PRP encodes distance. We also incorporated a new stack-based model of multipath in our framework. We have evaluated B-PRP in two real-world public places, an academic library setting and a real-world retail store. PRP gives significantly lower errors than RSSI. Fusion of PRP and RSSI further improves the overall localization accuracy over PRP. Next, we solved a peer-to-peer distance estimation problem that uses minimal infrastructure. Most apps like aarogya setu, bluetrace have solved peer-to-peer distances through the presence of Bluetooth Low-Energy (BLE) signals. Apps that rely on pairwise measurements like RSSI suffer from latent factors like device relative positioning on the human body, the orientation of the people carrying the devices, and the environmental multipath effect. We have proposed two solutions in this work---using known distances and collaboration to solve distances more robustly. First, if we have a few infrastructure devices installed at known locations in an environment, we can make more measurements with the devices. We can also use the known distances between the devices to constrain the unknown distances in a triangle inequality framework. Second, in an outdoor environment where we cannot install infrastructure devices, we can collaborate between people to jointly constrain many unknown distances. Finally, we solve a collaborative tracking estimation problem where people audit the properties of localization infrastructure. While people want services, they do not want to be surveilled. Further, people using an indoor location system do not know the current surveillance level. The granularity of the location information that the system collects about people depends on the nature of the infrastructure. Our system, the CrowdEstimator, provides a tool to people to harness their collective power and collect traces for inferring the level of surveillance. We further propose the insight that surveillance is not a single number, instead of a spatial map. We introduce active learning algorithms to infer all parts of the spatial map with uniform accuracy. Auditing the location infrastructure is the first step towards achieving the bigger goal of declarative privacy, where a person can specify their comfortable level of surveillance