LoWS Lo cation-based W i-Fi S ervices A Complete Open Source - PowerPoint PPT Presentation

LoWS Lo cation-based W i-Fi S ervices A Complete Open Source Solution for Wi-Fi Beacon Stuffing Based Location-based Services WMNC 2016 Sven Zehl , Niels Karowski, Anatolij Zubow and Adam Wolisz Telecommunication Networks Group Technische Universität Berlin

Motivation  IEEE 802.11 is the standard technology for wireless networks especially in providing wireless Internet access  IEEE 802.11 Access Points are widely deployed Source: gowex.com TKN Telecommunication LoWS - WMNC 2016 2 Networks Group

Motivation  Access points are announcing their presence using IEEE 802.11 beacon frames  IEEE 802.11 capable devices in the vicinity receive these beacon frames  To accelerate this process, clients can trigger the AP to send out the information contained in the beacon frames immediately using IEEE 802.11 probe requests TKN Telecommunication LoWS - WMNC 2016 3 Networks Group

Motivation  To accelerate the collection process, IEEE 802.11 clients can trigger the AP to send out the information contained in the IEEE 802.11 beacon frames immediately TKN Telecommunication LoWS - WMNC 2016 4 Networks Group

Motivation  Beacon frames are built up using fixed length parameters and variable length fields (tagged parameters)  The variable length fields are called IEEE 802.11 information elements (IE) and are used e.g. for the SSID or the supported rates  The IEEE 802.11 standard defines vendor-specific information elements to transport custom data TKN Telecommunication LoWS - WMNC 2016 5 Networks Group

Motivation  The term IEEE 802.11 beacon stuffing means to embed additional information within beacon frames  This enables to broadcast location-based information from access points to clients without the need of:  Clients to associate  Clients to have Internet access  Clients sharing their intents  New hardware on sender or receiver side TKN Telecommunication LoWS - WMNC 2016 6 Networks Group

Location-based WiFi Services Motivation - Example Scenarios TKN Telecommunication LoWS - WMNC 2016 7 Networks Group

Motivation - Scenarios  Emergency Propagation System  Warn people in the emergency area and give them instructions (fire emergency, shooting-rampage, earthquake, etc.) TKN Telecommunication LoWS - WMNC 2016 8 Networks Group

Motivation - Scenarios  Physical service announcements and advertisements  Waiting ticket number broadcasting  Train-station or airport announcements TKN Telecommunication LoWS - WMNC 2016 9 Networks Group

Location-based WiFi Services The Location based WiFi Services System TKN Telecommunication LoWS - WMNC 2016 10 Networks Group

The Location based WiFi Services System (LoWS System) TKN Telecommunication LoWS - WMNC 2016 11 Networks Group

The LoWS System – Global Codebook Approach TKN Telecommunication LoWS - WMNC 2016 12 Networks Group

The LoWS System – The Dichotomous Code  Combining the global codebook approach and the local codebook approach  Divide the code in a location independent part (LIC, global codebook) and a location dependent part (LDC, local codebook)  Global codebooks are preinstalled in the LoWS receiver applications, local codebooks are distributed via local codebook-servers and downloaded by the LoWS receiver application when a location is entered the first time TKN Telecommunication LoWS - WMNC 2016 13 Networks Group

The LoWS System – Global Address Server and Local Codebook Servers TKN Telecommunication LoWS - WMNC 2016 14 Networks Group

The LoWS System – LoWS Control Access Point Adapter Interface  Considering the heterogeneity of the  Wireless LAN architectures, e.g. an autonomous or a centralized architecture  Wireless LAN hardware, e.g. hardware from Cisco, Aerohive, Huawei or OpenWRT based APs  Embedding of additional data within beacon frames is hardware specific  LoWS Control Access Point Adapter Interface enables to interoperate with different access point types by defining a uniform interface  Designed an Access Point Adapter for OpenWRT based APs (autonomous architecture) and Cisco lightweight APs (centralized architecture) TKN Telecommunication LoWS - WMNC 2016 15 Networks Group

The LoWS System Architecture TKN Telecommunication LoWS - WMNC 2016 16 Networks Group

The LoWS System Architecture TKN Telecommunication LoWS - WMNC 2016 17 Networks Group

The LoWS System Architecture TKN Telecommunication LoWS - WMNC 2016 18 Networks Group

The LoWS System Architecture TKN Telecommunication LoWS - WMNC 2016 19 Networks Group

Location-based WiFi Services Embedding additional Data in IEEE 802.11 Beacon Frames TKN Telecommunication LoWS - WMNC 2016 20 Networks Group

Embedding Data in Beacons Centralized WLAN Autonomous WLAN Architecture: Architecture: Cisco CAP-3502 AP OpenWRT based AP  Leader in IEEE 802.11  Support of about 600 different enterprise deployments IEEE 802.11 autonomous APs from over 100 distinct vendors  APs are managed by centralized controller using the  Open source Linux-based CAPWAP protocol operating system  Proprietary software, no modification possible TKN Telecommunication LoWS - WMNC 2016 21 Networks Group

Embedding Data in Beacons - Cisco Access Points  Cisco APs embed their hostname within every broadcasted beacon frame within a special IE:  Hostname of AP can be set via SNMP on the WLAN controller.  Enables the embedding of 15 ASCII characters TKN Telecommunication LoWS - WMNC 2016 22 Networks Group

Embedding Data in Beacons – OpenWRT based APs  OpenWRT utilizes open source access point software hostapd:  hostapd can be controlled via daemon hostapd_cli  Patching of hostapd and hostapd_cli enables adding of additional IE(s) to beacon frames during AP runtime  OpenWRT supports radiotap frame injection:  Enables the sending of additional beacon frames beside hostapd and setting of transmission rate for the broadcasted beacon frames TKN Telecommunication LoWS - WMNC 2016 23 Networks Group

Location-based WiFi Services Retrieving the additional embedded Information TKN Telecommunication LoWS - WMNC 2016 24 Networks Group

Receiving the embedded Data – Enabling to retrieve IEEE 802.11 IE(s) without root access on Android  Challenge: no solution exists that enables the retrieval of information elements out of the Wi-Fi scan results without patching the operating system or root privileges  We enabled this possibility by combining the Android WiFi API with direct driver communication via Netlink sockets  Using the Android standard API to start a new WiFi scan  Sending Netlinks commands to driver to retrieve the IEEE 802.11 scan results from kernel TKN Telecommunication LoWS - WMNC 2016 25 Networks Group

Location-based WiFi Services Prototype of the LoWS System TKN Telecommunication LoWS - WMNC 2016 26 Networks Group

LoWS System Prototype TKN Telecommunication LoWS - WMNC 2016 27 Networks Group

LoWS System Prototype TKN Telecommunication LoWS - WMNC 2016 28 Networks Group

LoWS System Prototype TKN Telecommunication LoWS - WMNC 2016 29 Networks Group

LoWS System Prototype  Implemented prototypes of the LoWS Control, the local codebook-server and the global address-server using PHP and MySQL.  Implemented the LoWS Receiver Application for Android devices that can be used on COTS Android devices without root privileges.  Implemented Access Point Adapter for OpenWRT based APs and Cisco lightweight APs.  Currently supported LoWS services:  Beacon Emergency Propagation System  Physical Service Announcement  Waiting Ticket Number TKN Telecommunication LoWS - WMNC 2016 30 Networks Group

LoWS System Prototype Evaluation – Energy Consumption of the LoWS Receiver Application  LoWS receiver devices are mostly mobile devices that are battery powered  LoWS receiver application consists of a background scan service which is executed periodically and therefore permanently consumes energy  Evaluation of the energy consumption:  Used IEEE 802.11 active scan energy consumption estimation from Lin et. al 2010 for the energy consumption of the IEEE 802.11 hardware per scan  Measured LoWS Background Scan Service energy consumption using the Power Tutor application from the University of Michigan (Zhang et. al 2010) TKN Telecommunication LoWS - WMNC 2016 31 Networks Group

LoWS System Prototype – Energy Consumption Estimation LBSS = LoWS Background Scan Service TKN Telecommunication LoWS - WMNC 2016 32 Networks Group

Conclusion  Design and Implementation of the Location based WiFi Services System (LoWS System) that supports:  Utilization of already deployed sending COTS hardware  Easy integration of new sending hardware  Installation of the LoWS receiving application on COTS Android devices  Utilization of IEEE 802.11 Information Elements to transport additional data broadcasted within beacon and probe response frames  Supports the sending of predefined codes (Dichotomous Code)  LoWS prototype is published as open-source on Github: https://github.com/lows TKN Telecommunication LoWS - WMNC 2016 33 Networks Group

Thank you! https://github.com/lows TKN Telecommunication LoWS - WMNC 2016 34 Networks Group