Service Discovery and Device Identification in Cognitive Radio Networks

Transcription

1 B WiFi A T Bluetooth F WiFi Bluetooth C W E Cognitive Radio D Service Discovery and Device Identification in Cognitive Radio Networks 21 May 27 WINLAB Research Review

2 Overview Cognitive Radio Introduction Can we use Physical Layer info for: Service Discovery Device Identification Conclusions

3 Cognitive Radio Key Features Adaptive protocols Complete PHY/MAC Layer control Motivations Higher efficiency/throughput Interference Avoidance Spectral Sensing is Important

4 Spectral Sensing Options Multi-dongle solution (Non-CR approach) Multi-protocol full SW stack solution Multi-protocol cooperative SW solution

5 Spectral Sensing Options Multi-dongle solution (Non-CR approach) Multi-protocol full SW stack solution Multi-protocol cooperative SW solution Processing re-use (+) Implement partial protocols (+) Full PHY Layer access (+) Security advantages

6 CR Platform USRP 64 Msps A/D USB 2. interface 16-bit I/Q 8 MHz BW* RFX-24 Transceiver GNU Radio *USB 2. Controller limits us to 4 MHz

7 Service Discovery Goal: Obtain a reliable estimate of the services operating in the region Frequency (MHz) Periodic Broadband Bursts Time (s)

8 Service Discovery 82.11g (Wi-Fi) Beacon Frames 2 MHz BW (OFDM) Periodic (12.4 ms default) Frequency (MHz) Wi-Fi Beacon Frames Time (s)

9 Service Discovery ISM Band Spectrogram 5 ms snapshot Narrowband Bursts

10 Service Discovery (Bluetooth) 1 MHz Instantaneous BW (GFSK) Frequency hops over 79 MHz Wi-Fi Bluetooth

11 Service Discovery Algorithm Collection Analysis Classification

12 Device Identification Goal: Supplement service discovery findings with device and network specific information. How many Bluetooth Piconets exist? How many Wi-Fi networks exist? Is a spoofed AP in the region?

13 Device Identification Bluetooth Piconets 1 Master Maximum 7 Active Slaves Synchronized to the Master s clock Timeslots (TS) are 625 µs All transmissions begin on timeslot boundaries Specification allows for 2 µs of jitter

14 Device Identification Bluetooth Piconet Identification Method 1: Time-binning approach Collapse all leading-edge times into a single TS Perform clustering analysis to determine # of Piconets Partition a TS into time-bins Choose a time-bin resolution of 25 µs» 625/25 µs = 25 bins Single Piconet tests resulted in only +/- 25 ns jitter! 25us Piconet # TS = 625 µs

15 Device Identification Bluetooth Piconet Identification Method 2: Bit-comparison approach Demodulate detected bursts Compare Channel Access Codes (CACs) CACs are derived from Master address Use it as a Piconet identifier CAC

16 Device Identification Bluetooth Piconet Identification Method 2: Bit-comparison approach Burst Bluetooth Frequency (MHz) WiFi Burst Time (s)

17 Bluetooth Burst Demodulation Magnitude 1.5 Normalized Burst Power Inst Freq 2 Inst Freq (KHz) Burst Inst Freq Magnitude Inst Freq (KHz) Burst Sample Number Bitwise Exclusive or

18 Bluetooth Burst Demodulation Magnitude 1.5 Normalized Burst Power Inst Freq 2 Inst Freq (KHz) Burst Inst Freq Magnitude Inst Freq (KHz) Burst Sample Number Bitwise Exclusive or

19 Bluetooth Burst Demodulation Magnitude 1.5 Normalized Burst Power Inst Freq 2 Inst Freq (KHz) Burst Inst Freq Magnitude Inst Freq (KHz) Burst Sample Number Bitwise Exclusive or

20 Bluetooth Burst Demodulation Magnitude 1.5 Normalized Burst Power Inst Freq 2 Inst Freq (KHz) Burst Inst Freq Magnitude Inst Freq (KHz) Burst Sample Number Bitwise Exclusive or

21 Bluetooth Burst Demodulation Magnitude 1.5 Normalized Burst Power Inst Freq 2 Inst Freq (KHz) Burst Inst Freq Magnitude Inst Freq (KHz) Burst Same CACs Sample Number Bitwise Exclusive or

22 Device Identification Wi-Fi Access Points Method 1: Beacon Frame Periodicity Analyze leading edge-times Leverage standard deinterleaving algorithms 1ms 2 APs present time time 5ms 5ms 1 AP? 2 APs? 3 APs?

23 Device Identification Wi-Fi Access Points Method 1: Beacon Frame Periodicity Analyze leading edge-times Leverage standard deinterleaving algorithms 1ms 2 APs present time time 5ms 5ms 1 AP? 2 APs? 3 APs?

24 Device Identification Wi-Fi Access Points Method 1: Beacon Frame Periodicity Analyze leading edge-times Leverage standard deinterleaving algorithms 1ms 2 APs present time time 5ms 5ms 1 AP? 2 APs? 3 APs?

25 Device Identification Wi-Fi Access Points Method 2: Channel Estimation Beacon-Frame 2 MHz OFDM TS ES data» 64 sub-channels (= KHz spacing) First 8 µs used for Training (TS) Every 4 th sub-channel is active Next 8 µs used for Equalization (ES) Every sub-channel is modulated with equal power

26 Device Identification Wi-Fi Access Points Method 2: Channel Estimation 5 Beacon Frame: 8 µs Training Sequence 8 µs Equalization Sequence Channel Sounding Waveform Magnitude (db) Magnitude (db) Frequency (MHz) Frequency (MHz)

27 Channel Estimation s(t) = transmitted signal h(t) = channel response n(t) = channel noise r(t) = received signal Channel Spectrum Estimate:

28 Channel Estimation Given K known APs, correlate against new channel estimates as device identifiers: If AP i exceeds threshold, update profile Else, declare a new AP (K+1) But, should not incorporate phase in our channel estimate for bursty transmissions

29 Channel Estimation So, only use magnitude: Note: Correlation range is now [,1]

30 Channel Estimation Experiment: 2 Wi-Fi Access Points 1 Identical settings.9 (e.g. Channel,.8 SSID, PRI,.7 name, etc.).6 Normalized Magnitude (Beacon 3, AP1) (Beacon (Beacon 1, AP1) 4, AP2) (Beacon 2, AP2) Time (s)

31 Channel Estimation Experiment: 2 Wi-Fi Access Points Identical settings 1 (e.g. Channel, SSID, PRI,.8 name, etc.) XCorr Beacon back 2 Beacons back Beacon Number

32 Final Comments Service Discovery and Device Identification plausible even given our narrowband snapshot Bluetooth and Wi-Fi only used as illustrations of protocol-specific techniques Extend methodology to other protocols Security Concerns Full PHY/MAC control can be dangerous Framework developed to mitigate these risks

33 Acknowledgements Dr. Wade Trappe Wenyuan Xu Pandurang Kamat

34 Questions and Comments? Contact info: Rob Miller