Service Discovery and Device Identification in Cognitive Radio - PowerPoint PPT Presentation

B A WiFi T Bluetooth Bluetooth WiFi F W C E Cognitive Radio D Service Discovery and Device Identification in Cognitive Radio Networks 21 May 2007 WINLAB Research Review

Overview • Cognitive Radio Introduction • Can we use Physical Layer info for: – Service Discovery – Device Identification • Conclusions

Cognitive Radio • Key Features – Adaptive protocols – Complete PHY/MAC Layer control • Motivations – Higher efficiency/throughput – Interference Avoidance Spectral Sensing is Important

Spectral Sensing Options • Multi-dongle solution (Non-CR approach) • Multi-protocol full SW stack solution • Multi-protocol cooperative SW solution

Spectral Sensing Options • Multi-dongle solution (Non-CR approach) • Multi-protocol full SW stack solution • Multi-protocol cooperative SW solution – Processing re-use (+) – Implement partial protocols (+) – Full PHY Layer access (+) • Security advantages

CR Platform • USRP – 64 Msps A/D – USB 2.0 interface • 16-bit I/Q • 8 MHz BW* • RFX-2400 Transceiver • GNU Radio *USB 2.0 Controller limits us to 4 MHz

Service Discovery • Goal: Obtain a reliable estimate of the services operating in the region. 2465 2465.5 2466 Frequency (MHz) 2466.5 2467 Periodic 2467.5 Broadband Bursts 2468 2468.5 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 Time (s)

Service Discovery • 802.11g (Wi-Fi) Beacon Frames – 20 MHz BW (OFDM) – Periodic (102.4 ms default) 2465 2465.5 2466 Frequency (MHz) 2466.5 2467 Wi-Fi Beacon 2467.5 Frames 2468 2468.5 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 Time (s)

Service Discovery Narrowband • ISM Band Spectrogram Bursts – 50 ms snapshot

Service Discovery • 802.15.1 (Bluetooth) – 1 MHz Instantaneous BW (GFSK) – Frequency hops over 79 MHz Wi-Fi Bluetooth

Classification Service Discovery Algorithm Collection Analysis

Device Identification • Goal: Supplement service discovery findings with device and network specific information. – How many Bluetooth Piconets exist? – How many Wi-Fi networks exist? – Is a spoofed AP in the region?

Device Identification • Bluetooth Piconets – 1 Master – Maximum 7 Active Slaves – Synchronized to the Master’s clock • Timeslots (TS) are 625 µs • All transmissions begin on timeslot boundaries – Specification allows for 20 µs of jitter

Device Identification • Bluetooth Piconet Identification – Method 1: Time-binning approach • Collapse all leading-edge times into a single TS – Perform clustering analysis to determine # of Piconets • Partition a TS into time-bins – Choose a time-bin resolution of 25 µs » 625/25 µs = 25 bins – Single Piconet tests resulted in only +/- 250 ns jitter! 25us Piconet # 1 2 3 4 5 6 25 1 TS = 625 µs

Device Identification • Bluetooth Piconet Identification – Method 2: Bit-comparison approach • Demodulate detected bursts • Compare Channel Access Codes (CACs) – CACs are derived from Master address – Use it as a Piconet identifier CAC

Device Identification • Bluetooth Piconet Identification – Method 2: Bit-comparison approach 2465 Burst 1 2465.5 ← Bluetooth 2466 Frequency (MHz) 2466.5 WiFi → 2467 Burst 2 2467.5 2468 2468.5 0.09 0.095 0.1 0.105 0.11 0.115 0.12 0.125 0.13 0.135 Time (s)

Bluetooth Burst Demodulation Magnitude 1 0.5 Normalized Burst Power 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 1 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 2 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Magnitude 1 0.5 Bitwise Exclusive−or 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Sample Number

Bluetooth Burst Demodulation Magnitude 1 0.5 Normalized Burst Power 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 1 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 2 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Magnitude 1 0.5 Bitwise Exclusive−or 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Sample Number

Bluetooth Burst Demodulation Magnitude 1 0.5 Normalized Burst Power 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 1 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 2 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Magnitude 1 0.5 Bitwise Exclusive−or 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Sample Number

Bluetooth Burst Demodulation Magnitude 1 0.5 Normalized Burst Power 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 1 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 2 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Magnitude 1 0.5 Bitwise Exclusive−or 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Sample Number

Bluetooth Burst Demodulation Magnitude 1 0.5 Normalized Burst Power 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 1 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Inst Freq 200 0 Inst Freq (KHz) − Burst 2 −200 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Magnitude 1 0.5 Bitwise Exclusive−or 0 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Sample Number Same CACs

Device Identification • Wi-Fi Access Points – Method 1: Beacon Frame Periodicity • Analyze leading edge-times • Leverage standard deinterleaving algorithms time 100ms 2 APs present time 50ms 50ms 1 AP ? 2 APs? 3 APs? …

Device Identification • Wi-Fi Access Points – Method 1: Beacon Frame Periodicity • Analyze leading edge-times • Leverage standard deinterleaving algorithms time 100ms 2 APs present time 50ms 50ms 1 AP? 2 APs ? 3 APs? …

Device Identification • Wi-Fi Access Points – Method 1: Beacon Frame Periodicity • Analyze leading edge-times • Leverage standard deinterleaving algorithms time 100ms 2 APs present time 50ms 50ms 1 AP? 2 APs? 3 APs ? …

Device Identification • Wi-Fi Access Points – Method 2: Channel Estimation • Beacon-Frame TS ES data – 20 MHz OFDM » 64 sub-channels (= 312.5 KHz spacing) • First 8 µs used for Training (TS) – Every 4 th sub-channel is active • Next 8 µs used for Equalization (ES) – Every sub-channel is modulated with equal power

Device Identification • Wi-Fi Access Points – Method 2: Channel Estimation 5 Magnitude (dB) 0 −5 −10 −15 −20 Beacon Frame: −25 −30 2410 2410.5 2411 2411.5 2412 2412.5 2413 2413.5 8 µs Training Sequence Frequency (MHz) 8 µs Equalization Sequence 5 Magnitude (dB) 0 −5 −10 −15 −20 Channel Sounding Waveform −25 −30 2410 2410.5 2411 2411.5 2412 2412.5 2413 2413.5 Frequency (MHz)

Channel Estimation s(t) = transmitted signal n(t) = channel noise h(t) = channel response r(t) = received signal Channel Spectrum Estimate:

Channel Estimation • Given K known APs, correlate against new channel estimates as device identifiers: – If AP i exceeds threshold, update profile – Else, declare a new AP (K+1) • But, should not incorporate phase in our channel estimate for bursty transmissions

Channel Estimation • So, only use magnitude: Note: Correlation range is now [0,1]

Channel Estimation (Beacon 3, AP1) (Beacon 1, AP1) (Beacon 4, AP2) • Experiment: (Beacon 2, AP2) – 2 Wi-Fi Access Points 1 – Identical settings 0.9 (e.g. Channel, 0.8 Normalized Magnitude SSID, PRI, 0.7 name, etc.) 0.6 0.5 0.4 0.3 0.2 0.1 0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Time (s)

Channel Estimation • Experiment: – 2 Wi-Fi Access Points – Identical settings 1 (e.g. Channel, SSID, PRI, 0.8 name, etc.) XCorr 0.6 0.4 1 Beacon back 2 Beacons back 0.2 0 4 6 8 10 12 14 16 18 Beacon Number

Final Comments • Service Discovery and Device Identification plausible even given our narrowband snapshot • Bluetooth and Wi-Fi only used as illustrations of protocol-specific techniques – Extend methodology to other protocols • Security Concerns – Full PHY/MAC control can be dangerous – Framework developed to mitigate these risks

Acknowledgements • Dr. Wade Trappe • Wenyuan Xu • Pandurang Kamat

Questions and Comments? • Contact info: Rob Miller rdmiller@winlab.rutgers.edu