FUTURE WIRELESS APPLICATIONS

PAWNS: SATISFYING THE NEED FOR UBIQUITOUS SECURE CONNECTIVITY AND LOCATION SERVICES PARAMVIR BAHL, WILF RUSSELL, AND YI-MIN WANG, RESEARCH ANAND BALACHANDRAN AND GEOFFREY M. VOELKER, UNIVERSITY OF CALIFORNIA ALLEN MIU, MIT

university networks, into public spaces like air- Policy ABSTRACT manager ports, malls, hotels, parks, arenas, and so on; those The dawning of the 21st century has seen places where individuals spend a considerable unprecedented growth in the number of wireless amount of their time outside of private networks. users, applications, and network access technolo- In this article we argue that the substantial per- gies. This trend is enabling the vision of perva- formance benefits of wireless LANs make them sive ubiquitous computing where users have ideal for public area wireless networks (PAWNs). n network access anytime, anywhere, and applica- Although next-generation cellular networks will tions are location-sensitive and context-aware. undoubtedly play a role in providing wide-area To realize this vision, we need to extend network long-range service, advances in indoor short-range connectivity beyond private networks, such as wireless communication technology and the prolif- corporate and university networks, into public eration of lightweight handheld devices with built- spaces like airports, malls, hotels, parks, arenas, in high-speed radio access have made wireless and so on — those places where individuals LAN deployments increasingly common. Based on Wireless subnet spend a considerable amount of their time out- the IEEE 802.11 standard [1], wireless LANs are side private networks. emerging as the ideal solution for providing high- Implementing and In this article we argue that wireless LAN speed connectivity in private networks and, to a technologies are the ideal mechanism for extend- limited extent so far, public places. As a result, deploying public-area ing network connectivity to these public places, network connectivity at 11 Mb/s is becoming com- and enabling location and context-aware applica- monplace, and this data rate is expected to grow wireless networks tions in them. However, implementing and tenfold in the next three years [2]. deploying public area wireless networks However, wireless LANs alone are not suffi- present a number of (PAWNs) present a number of practical chal- cient for implementing public-area wireless net- lenges, including network security, privacy, works, and there are a number of challenges in practical challenges, authentication, mobility management, and provi- making them a viable platform for PAWNs. First, sioning of key services. We discuss these chal- network access in public places must be able to including network lenges as a general problem for PAWNs, and support a wide range of service models, from free then describe a PAWN we have designed, imple- access to paid connectivity to differentiated quali- security, privacy, mented, and deployed called CHOICE that ty of service. As a result, PAWNs must support addresses them. We describe the architecture mechanisms that enable providers to implement a authentication, and components of CHOICE, the service models wide range of policies for providing user access to it supports, and the location services and con- the wireless network. For policies that restrict mobility management, text-aware applications we have implemented user access (i.e., nonfree access), PAWNs must and deployed in it. authenticate users before providing them service, and provisioning and must secure the network against unautho- INTRODUCTION rized and malicious access. For policies that of key services. require payment, PAWNs must provide mecha- The dawning of the 21st century has seen nisms for implementing accounting and billing unprecedented growth in the number of wireless services. Second, to support location-sensitive and users, applications, and network access technolo- context-aware applications, PAWNs must also gies. This trend is enabling the vision of pervasive provide mechanisms for both determining and ubiquitous computing where users have network disseminating location and other contextual infor- access anytime, anywhere, and applications are mation about users to their applications. Finally, location-sensitive and context-aware. To realize PAWNs must keep all personal information, such this vision, we need to extend network connectivity as communication traffic and contextual informa- beyond private networks, such as corporate and tion like user location, private and secure.

40 1070-9916/02/$17.00 © 2002 IEEE IEEE Wireless Communications • Feburary 2002 Over the past year, we have designed, imple- cating entity must be privy to personal informa- A new set of mented, and deployed a PAWN called CHOICE tion such as username, password, credit card that addresses these challenges in one integrated numbers, and so on. transactional and system [3]. CHOICE is a service platform on Furthermore, public networks are exposed to which any number of network providers can malicious users and are thus vulnerable to many collaborative offer network services, enabling users to choose kinds of attacks. Therefore, in order to secure the kind of service that best fits their needs. It the host organization, there is a need to perform applications that supports two kinds of service models, one that access control in addition to user authentication enables free access to local intranet services like to prevent unauthorized users from accessing the exploit the a local Web server, and a second enhanced ser- network. The access control mechanism should vice model that supports billed access with full guard against the most common modes of attack, knowledge of user Internet connectivity with various quality of ser- like dictionary attacks on passwords, replay vice options. It uses a network admission server attacks, and IP and MAC address spoofing. locations can be in conjunction with a global authentication A third aspect that differentiates PAWNs database to authenticate users and grant them from private networks is that of service differen- deployed in the access to the wired network. It uses a traffic con- tiation. In other words, since access is provided trol gateway to perform per-packet verification in an “individual-centric” manner, it is possible public setting to enforce authorized access, quality of service to offer enhanced services to users who are will- policies, and accounting constraints. Finally, it ing to pay extra to get better network service. according to the supports various mechanisms for determining For example, service providers may offer higher user location and propagating that information bandwidth connections and privileged access to a users’ needs and to location-sensitive and context-aware applica- local music/entertainment repository for the tions. Altogether, CHOICE demonstrates that savvy user willing to pay more for such service. preferences. In other wireless LANs are a compelling technology for Also, a new set of transactional and collabora- providing high-performance wireless network tive applications that exploit the knowledge of words, users can access in public places. user locations can be deployed in the public set- The rest of this article is organized as follows. ting according to the users’ needs and prefer- “shop” for multiple We discuss the deployment considerations for ences. In other words, users can “shop” for implementing a PAWN, particularly one that multiple levels of network services. We describe levels of network supports context-aware applications. We describe the aspects of service differentiation and loca- the architecture, service models, and location tion-based services in the next two subsections. services. services and applications of CHOICE, a PAWN we have implemented and deployed. We explain ACCESS SERVICES WITHIN PAWNS why a PAWN such as CHOICE is practical and A PAWN is built under the premise that as long a commercially viable alternative to other net- as a user’s identity can be established by the host work architectures such as cellular networks. organization and he/she agrees to the payment Finally, we summarize the article. options for the services received, the network should grant access to the user. However, treat- PUBLIC AREA WIRELESS NETWORKS ing every individual independently offers new potential for the host organization to offer In this section we begin by discussing the deploy- enhanced services to users who desire them. We ment issues that make PAWNs different from describe these services in more detail below. network deployments in home and enterprise settings. We then describe the types of access Bandwidth Allocation — Bandwidth in the wireless services PAWNs can be expected to provide. domain is a scarce shared resource. This scarcity Finally, we discuss the issues in providing loca- is accentuated by the fact that the demand for tion services in PAWNs. bandwidth is hard to predict in a public setting, which is characterized by a very transient user DEPLOYMENT ISSUES population. In order to satisfy the bandwidth PAWNs present many challenges to the network demands of all users, the host organization will designer. First and foremost among them is the have to implement a quality of service (QoS) lack of an implicit trust relationship between the policy to manage and allocate the bandwidth in users and the public network. In contrast, home a scalable manner. Alternatively, bandwidth allo- and enterprise networks have prearranged trust cation could be handled through service policies relationships with their users, so access to the that may have been prenegotiated between the network can be conveniently granted through a host organization and other corporations, effec- preconfigured common key. Public networks tively dividing users into various service classes. need to provide access to unknown users who may not have visited the network before. This Security Provisioning — In the above section, we necessitates the use of a formal authentication stated that one of the issues in deploying mechanism that enables users to identify them- PAWNs is securing the host organization against selves to the network. Authentication also makes malicious attackers. Additionally, a PAWN may users accountable for the services they use in the also provide security services to the user for the network, thereby providing a convenient means purposes of data integrity. Authorized users of billing. Also, all users may not prefer the should be able to choose varying levels of securi- same mode of authentication. Hence, the net- ty for their data. Again, as in the case of band- work must have a provision to support multiple width, this could also be configured via a policy authentication options. Finally, the authentica- where users belonging to a particular organiza- tion process must be end-to-end secure. In other tion would be ensured a certain level of encryp- words, no one except the user and the authenti- tion of their data for a prenegotiated cost.

IEEE Wireless Communications • Feburary 2002 41 cally configured to operate properly when switch- 40 ing among public and private networks. 35 CONTEXT AND LOCATION SERVICES 30 WITHIN PAWNS 25 A PAWN is typically characterized by users who 20 are mobile but often crowd around areas of interest (restaurants, mall rest areas, airport ter- 15 minals, etc.). This gives the potential to the host 10 organization to offer users services that exploit Signal strength (mW) knowledge of their geographic location. Such 5 location-aware services enable users to interact 0 with their immediate environment and the sys- 0 5 10 15 20 25 30 35 40 tem to mirror the surrounding environment intelligently to user devices. Distance (m) Issues and Differences — Context- and location- Figure 1. An empirically recorded profile of signal strength as a function of aware applications have been well researched distance between transmitter and receiver. but generally in enterprise settings [5, 6]. Typi- cally, these systems have relied on technologies such as badges and emitters (based on IR tech- Billing and Accounting — The goal of the billing and nology) attached to users, equipment, and build- accounting service is to: ing walls that enable the system to create a • Enable the host organization to create flexible “location map” of the environment using a net- charging plans and bill users accurately for the work of IR sensors. amount of bandwidth they use PAWNs open up a new environment to sup- • Estimate aggregate system demand from mem- port location-aware applications for the follow- bers of various organizations that have negotiat- ing reasons. First, a PAWN is characterized by ed service packages for their members, thereby users who are previously unknown to the system. segregating users into different service classes Therefore, we cannot often expect these users to based on the extent of use of network resources be equipped with special devices for determining If the demand from users of a certain organiza- location information. Second, PAWNs generally tion is particularly high, it could change the span large areas where range-limited sensor users to a higher service level and negotiate a technologies like IR scale poorly. Thus, provid- new agreement with the organization. ing extensive coverage would involve high instal- lation and maintenance costs. Mobility Management — One of the inherent char- Ideally, a PAWN would implement and acteristics of a PAWN is that users are mobile. deploy location-aware services that require limit- A user may set her mobile device to hibernate at ed user intervention so that location services can home, and then move to a public area serviced be provided transparently. One way to do this is by a PAWN. After such a migration, the user’s to complement the already useful data-network- device may have to be reconfigured for network ing capability provided by RF wireless LANs access in the PAWN. This is due, for example, to with a location capability so that the users the changes in security and authentication mod- require no extra hardware to use the service. els in PAWNs vs. private networks. Although the Further, the granularity and accuracy of location user may use Mobile IP [4] to handle network- information needed in a PAWN is very different layer mobility, the host still needs to be dynami- from that in enterprise settings, where location information is typically used for indoor surveil- lance applications and online collaboration between users. Since PAWNs are characterized 20 by frequently roaming users, the location infor- 18 Mean Median mation has to be updated at a corresponding 16 90th percentile higher rate. Also, some of these applications 14 (see below) may involve financial transactions. Therefore security of location information and 12 privacy of users is an essential consideration. 10 8 Determining Location — As already mentioned, cen- tral to each location-aware application is the 6 Error distance (m) ability to determine user locations with a useful 4 degree of accuracy. There are multiple ways one 2 could use an RF data network to determine user 0 location. Below we describe three algorithms 0 1 2 3 4 5 that can compute location information with vary- ing levels of accuracy: Number of access points Association with the Access Point — The naïve approach is to determine the access point Figure 2. The effect of the number of access points on the error in the location (AP) in the wireless network that the user is estimate. associated with. Upon entering the network, the

42 IEEE Wireless Communications • Feburary 2002 user can detect the identity of this AP (IP or MAC address) from the MAC-level beacons periodically sent by all APs. In this approach, the wireless device of the user is programmed to associate with the AP from which the strongest signal is heard. However, knowledge of the AP- level association merely indicates that the user is within communication range of the AP, and at best gives the radius of the largest circle around the AP within which the user could be located. Using Signal Strength of AP Beacons — In order to improve the location estimate obtained from AP association, the identity of the AP can be used in conjunction with the strength of the beacon signal from the AP. The beacon signal strength can be used to estimate the user’s radial distance from Figure 3. A user of the CHOICE network at a the AP using a simple radio propagation model mall in Bellevue, Washington. that characterizes how the signal strength varies with distance in a radio channel. Indoor signal propagation characteristics can be affected by the presence of walls and obstructions; consequently, Policy the radio propagation model has to take these into manager account before estimating the user’s location. The location estimate could be obtained using either theoretically computed or empirically determined models [7]. As an example, Fig. 1 shows the varia- tion of signal strength as a function of the separa- Global Network authenticator Internet admission tion between transmitter and receiver in an Aironet server 802.11 wireless LAN [8]. Using Signal Strength From Multiple APs — The estimate from the above method can be fur- ther improved by using the signal strength values from a network of APs. The idea is that, as a user moves about the network, there is a clear trend in Traffic Wireless subnet the observed signal strength of the beacons at the control receiver, and this trend is independently observed Local services server for every AP within range. As the user moves, the location estimation algorithm computes a tuple Figure 4. The architecture of the CHOICE public area wireless network. (ss1, ss2, ss3) of the signal strength received from multiple APs. An algorithm then matches this set with the closest set in a precomputed sig- service provisioning, and location services in a nal strength database that lists the measured sig- lightweight hardware- and protocol- agnostic nal strengths at various fixed locations in the manner. We describe the system components, network. The coordinates corresponding to the access services, and location-aware services of closest matching set are guessed to be the user’s the CHOICE network below. location. Figure 2 shows that the error distance between the actual and estimated locations SYSTEM ARCHITECTURE AND COMPONENTS improves considerably as more APs are consid- Figure 4 illustrates an organization of the ered in the estimation process, but the effect CHOICE network, a wireless network we have tapers off beyond three APs. There are many proposed for large public areas such as airports, enhancements to the above technique that university campuses, shopping malls, and con- account for dynamic user mobility and dynamic vention centers. This network consists of a glob- changes in the RF environment, which consider- al authenticator, an admission server, one or ably reduce the error in the location estimate. For more traffic control gateways, a client module, these enhancements we refer readers to [9]. and a policy manager. We briefly describe the functions of each component below. For a more THE CHOICE NETWORK detailed system-level description of this public area network architecture and all of its compo- Over the past two years we have designed, imple- nents and interactions, we refer readers to [13]. mented, and deployed a PAWN called CHOICE at a public mall. Figure 3 shows a user using the Global Authenticator — One way of authenticating CHOICE network in the Crossroads Shopping unknown users in a public network is to use a Center in Bellevue, Washington. trusted database that is globally available. The We are aware of some recent work in the global authenticator maintains a database of all areas of user registration [4], authentication and valid users who subscribe to its service, and is authorization [10], and security [11, 12] in for- used to establish the identity of users in an end- eign networks. However, to the best of our to-end secure manner. Users can choose one of knowledge, the CHOICE architecture is the first many available authenticators like e-cash sys- working system that integrates the tasks of tems, credit card organizations (e.g., Master- authentication, access verification, policy-based Card), digital certificate agencies, or databases

IEEE Wireless Communications • Feburary 2002 43 The policy manager maintained by particular businesses and clubs airport such that, whenever any of its employees (e.g., Gold Club Frequent Fliers). access the airport wireless LAN, the airport pro- maintains entries in vides a certain level of bandwidth at a fixed cost. Network Admission Server — The network admis- The policy manager maintains entries in its policy its policy table to sion server (NAS) restricts access to the public table to enable differentiated bandwidth alloca- network until the user is authenticated and tion for each organization that has negotiated enable differentiated allows authorized access through the traffic con- such a service. Alternatively, the policy manager trol gateway (described below) upon successful can also maintain general policies that segregate bandwidth allocation completion of authentication. When a user first users into different classes based on access cost. enters a PAWN, the DHCP server running on When users visit the PAWN, they may be able to for each organization the NAS provides an IP address, and the local choose the best available access package after Web server redirects the connection to the glob- assessing them against the criteria of security, that has negotiated al authentication service of her choice. The bandwidth, and cost. user’s client detects the existence of the such a service. CHOICE network service through service broad- ACCESS SERVICES WITHIN CHOICE casts (see a later section). If not already present, We now describe how the CHOICE architecture Alternatively, the the client module needed to detect this service enables the implementation of differentiated ser- can be downloaded from the CHOICE Web vices introduced in an earlier section. These ser- policy manager can server, which is always identified by the URL vices are fulfilled at a cost to the user and are http://choice/. At this point, the NAS performs based on a differentiated charging model, which also maintain IP-address filtering on every incoming packet; varies according to the level of service the user any packet with a destination address other than requires. general policies the DHCP server, the Web server, or the authen- ticator is dropped. Differentiated Bandwidth Allocation — We envision that segregate users Upon authentication, the NAS provides the that each user who subscribes to the differentiat- user and the traffic control gateway with a (key, ed bandwidth service in CHOICE indicates her into different classes token) pair and a key_id, which are valid for a range of bandwidth expectation (bmin, bmax) to finite amount of time and renewable afterward. the network. The resource allocation algorithm based on access cost. The key_id is an index into an array of valid (key, tries to provide every user with her bmin require- token) pairs that have been handed out to users. ment and shares the remaining available resource The key is used for encryption/decryption and the equally among all users. In order for the network token is the value that is tagged to every packet to honor the data rate requirements of users, the before encrypting it with the key. Thus, the host organization has to meet two requirements: encrypted tag provides a cryptographic binding • Ensure that users are provided with their between the user and the packet so that the net- negotiated data rate during their sessions work can identify the source of the packet and • Ensure that no user consumes more than their determine the packet’s access rights and privileges. allocated share of bandwidth After obtaining the (key, token) pair from the To ensure the first requirement, the host organi- NAS, the user has authorized access to the net- zation performs admission control on new con- work resources; the system then redirects all user nections and ideally implements a fair scheduling communication through the traffic control gateway. algorithm on admitted connections [14]. The lat- ter requirement is achieved at the TCG, which Traffic Control Gateway and Client Module — The traf- performs per-packet verification and thus keeps fic control gateway (TCG) handles verification track of the bandwidth consumed by each user and enforces policies on a per-packet basis for over time. Users can also change their band- users authorized by the NAS. In addition to width requirements during a session by renegoti- checking whether each packet is encrypted with ating the service with the host organization. the correct key and tagged with the correspond- ing token, the TCG also interacts with the poli- Security Provisioning — In CHOICE, we support cy manager (see below) to implement policies multiple levels of security embodied in basic, that may be negotiated between users and the medium, and enhanced modes of security. The host organization. The TCG may either be locat- basic mode provides minimum encryption of the ed one hop into the access network (at the bor- security token that is tagged to every outgoing der router) or can be built into the wireless APs. packet. Medium encryption encrypts packet The client module is a software component headers as well, and full encryption encrypts the resident on user devices that tags all outgoing entire packet. The client module running on the packets with the (key, token) pair obtained from user’s wireless device can dynamically change the NAS. The client module can be downloaded the encryption algorithm used to encrypt the from the host organization’s Web server. This fea- packet. Our architecture does not preclude the ture in our architecture enables users to freely use of alternative higher-layer security mecha- access the Internet from any PAWN without nisms like IPSec [12]. requiring any additional support on their devices or any modifications to the protocol stack. Billing and Accounting — While the TCG imple- ments per-packet verification for purposes of Policy Manager — The goal of the policy manager is security, it automatically incorporates per-packet to enable service differentiation. The policy man- accounting for each user. Accounting for the ager allows the host organization to set policies amount of bandwidth used by each user is that may be prenegotiated with other corpora- achieved as a result of per-packet processing at tions. For example, a corporation may negotiate a the TCG. The accounting information gathered service package with a PAWN deployed in a local at the per-packet level can then be handed to

44 IEEE Wireless Communications • Feburary 2002 third-party accounting and charging systems that

Graphical Statistics: Port 4 would then be responsible for billing [15]. We File View Measurements

MSR Wish Service note here that CHOICE does not advocate any File\ Grap particular pricing scheme; it only provides the File\ Grap Eventing mechanisms and flexibility to the host organiza- File\ http://wish Grap infrastructure tion for implementing different policies. WISH client Mobility Management Service — We have mentioned Every 2 minutes Every 30 seconds that users need to be able to seamlessly manage and configure their devices when they enter and WILIB Every WISH server leave a PAWN (see an earlier section). In 30 seconds CHOICE, we implement this using a network dis- covery service, where the network broadcasts bea- Device driver cons that contain a unique network identifier, and the IP addresses of the NAS and TCG. Thus, when the user first enters the PAWN, the client Every module uses the information contained in the 30 seconds Access point broadcast beacon to establish the initial connec- tion to the Web server and prompts the user to Figure 5. The WISH service architecture. begin authentication [16]. After the authentica- tion succeeds, the client module receives and stores the (key, token) pair, enables packet tag- ging, and sets the default gateway to the adver- from its radio frequency (RF) wireless network tised TCG. When the user returns to the home card the identity of the AP with which the device network, the client module no longer receives any is associated and the strength of the signals beacons and, after a timeout, disables packet tag- received from the AP (see an earlier section). It ging and restores the host’s default network set- then sends this information along with the user’s tings to gain access in the home network. Note name and activity status to a WISH server. The that the client module still has the un-expired WISH server maintains an RF signal propaga- (key, token) pair stored in a table indexed by the tion model and a table that maps APs to a physi- advertised network identifier. Should the user cal location. Using the information provided by decide to return to the same PAWN again, the the client, the WISH system is able to determine client module can simply re-enable packet tagging the user’s real-time location to within a few and provide seamless network access without the meters of where he/she is. A confidence percent- need for another authentication. age is associated with each estimate. Note that for ease of deployment, we do not use the tech- LOCATION-SENSITIVE AND nique of extracting signal strength from multiple APs in order to determine the user location (see CONTEXT-AWARE APPLICATIONS IN CHOICE an earlier section). In this section we describe some of the location applications built to use the CHOICE network. Location-Based Buddy List — Buddy lists are fairly The applications use a combination of the tech- common these days. For example, both AOL niques described earlier for determining user and MSN messengers provide a buddy list ser- location. Our purpose in building, deploying, and vice in their instant messaging software [17, 18]. describing these applications is to show how busi- We have taken this concept a step further by nesses can use PAWNs to offer additional ser- including the notion of location into buddy lists. vices over and beyond basic Internet access and Location-based buddy lists are best explained how the CHOICE network enables such services. with the help of an example. Say two friends liv- ing in different parts of the country arrive at a WISH (Where IS Harry) — WISH is an application common airport the same time. They are sched- deployed on the CHOICE network that enables uled to take their connecting flights in a few CHOICE users to look for other people who are hours. They are traveling on different airlines and in their vicinity and have allowed their name and arrive at different gates, so they are not initially in location to be made publicly available to the sys- contact with each other. Normally, unless they tem. The URL http://wish/ always resolves to a had chatted earlier, they would have passed each Web page on the CHOICE Web server that other and not met. However, with CHOICE and includes the names of WISH users, their inter- the location-based buddy list software they get an ests, tag lines, and so on, and a map pointing out alert that notifies them that their buddy is in the the location of each user. The idea is to encour- vicinity with directions on how to find him. Sever- age social interaction between people who may al similar examples can be described, but suffice it not know each other but who may share several to say that location is a fairly useful addition to an common interests. Subscription to this service is already popular buddy list service. completely voluntary. Figure 6 shows the architecture for our loca- The WISH system, shown in Fig. 5, consists tion-based buddy list service. When a user first of a client software module that sits on a library connects to the PAWN via CHOICE, her pre- customized for wireless devices (WiLIB) and a configured buddy list is extracted and sent to a stateless server module. The control of location backend eventing server [19]. The eventing serv- information dissemination is left solely with the er already knows who the user is (via CHOICE user. The WISH client software, running on the authentication), so it stores this information in a user’s handheld device, periodically extracts local database. Additionally, the WISH client

IEEE Wireless Communications • Feburary 2002 45 OOKING INTO THE Mall buddy L client CRYSTAL BALL OF PAWN DEPLOYMENT Wilf Buddy

Graphical Statistics: Port 4 File View Measurements list File\ Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Grap Graphical Statistics: Port If PAWNs are to become ubiquitous, there has 4 Graphical File\ Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Grap Graphical Statistics: Port 4 GraphicalGraphical Statis File\ 4 Graphical Statistics: Port 4\ Graphical Statistics: Port Grap 4 Graphical Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Graphical Statistics: Port to be a business model that generates revenue 4 Graphical "Victor is in the mall." and thus encourages businesses to install them Mall on premises. As mentioned in the introduction, buddy server we firmly believe that the growing need of users Victor Mall buddy client to stay connected will drive PAWN deployment. Initially PAWNs will be deployed in large hotels, Buddy

Graphical Statistics: Port 4 Eventing conference centers, sports arenas, and airline File View Measurements list File\ Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Grap Graphical Statistics: Port 4 Graphical File\ Graphical Statistics: Port 4 Graphical Statistics: Port 4\ infrastructure Grap Graphical Statistics: Port 4 GraphicalGraphical Statis lounges. Once users become accustomed to their File\ 4 Graphical Statistics: Port 4\ Graphical Statistics: Port Grap 4 Graphical Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Graphical Statistics: Port 4 Graphical "Wilf is in the mall." availability, though, PAWNs will spread to other public places as well. Competitive pressures between building owners trying to attract busi- Figure 6. Location-based buddy list architecture. nesses and customers to their premises will drive PAWN deployment. So how will this deployment occur? One model running on the user’s machine periodically that is currently popular is that of small wireless updates the eventing server with the user’s loca- service provider (WSP) companies making deals tion information (see an earlier section). The with local businesses and deploying the PAWN process is repeated when a new user (the buddy) infrastructure in these locations. A potential connects to the same PAWN. The eventing serv- problem with this model is that the smaller WSPs er sees a match and dispatches an instant mes- generally do not have deep pockets; hence, the sage alert to both users notifying them that they number of places they are able to deploy PAWNs are near each other. It also sends them a map is limited to the point of not being attractive to showing them each other’s position. large sets of users. Due to the lack of a large cus- tomer base the subscriber fee is often high and OnSale Mall Buddy Server — A third application we cost-prohibitive for the average user. Additionally, have implemented on the CHOICE network is a with smaller WSPs there is a risk of Internet personalized sale announcement system based on access being offered by a confusing and unpre- location. This is a subject-based publish/subscribe dictable patchwork of providers. Roaming agree- eventing system based on user profiles and prod- ments between these WSPs can alleviate some uct categories. Figure 7 shows the service archi- issues but these have to be worked out and tecture for this system. Just as in the case of the progress is slow since no one knows which of the buddy list, after a user connects to a PAWN via smaller WSPs will survive over the longer term. CHOICE, his profile is extracted and sent to a A second model for deployment is similar to backend eventing server. In this case, a user pro- the one in the cellular world, in which a few very file includes his shopping interests, such as sports large cash-rich WSPs deploy thousands of goods, food, clothing and apparel, electronics, PAWNs worldwide. The advantage for the user is and so on. The back-end server stores this infor- that signing up with one large WSP provides mation for as long as the user stays connected.1 assurance that he/she will have access to enough When a local business owner decides to put an PAWNs to make their service useful. As of this item on sale, he/she goes to a local administra- writing, the adoption of this deployment model is tor’s Web page (a service provided by the build- unclear since it is not known whether or not the ing owner) and adds the sale information to this large WSPs will be willing to spend the money on Web page. The sale information includes the a wireless service that competes with cellular data name of the store, the name of the item, the orig- service. Having already spent billions of dollars in inal price and a sale price. The vendor then selects buying spectrum and installing the cellular infra- the category under which this item belongs. When structure, the larger WSPs are currently focused the vendor inputs the information, the Web serv- on recouping their expenses from subscribers. er synchronously invokes the variable-update Consequently, they may not be overly eager to application programming interface (API) of the spend more money in deploying PAWNs. eventing server, which causes the firing of a A third model, the one we prefer and think CHANGE event. On finding a category match has a good chance of success, is one where local between the sale item and user profiles, the event- businesses install their own PAWN and make ing server generates an instant messaging alert them available to all customers who visit their and sends this information to all interested users. premises. This model distributes the infra- For example, when an electronic item is put on structure cost while allowing users to connect to sale, users interested in electronics get an alert the Internet at a large number of places. User with the name of the item, its sale price, and the authentication can be carried out by a globally store that has put it on sale. A map containing available third party for a small fee to the local directions from where the user is to the store is business. However, for this model to succeed, provided with this notification. technology is needed that allows businesses to be 1 Connection status is Having discussed the Internet access and creative in how users are authenticated, how maintained via WISH location services aspect of CHOICE, we now they can generate revenues by offering personal- location updates, which turn our attention to how this technology pro- ized services, and how they can protect them- act as a keepalive signal motes different business models and encourages selves against malicious users. for the eventing server. the ubiquitous deployment of PAWNs. We believe that a building owner who has

46 IEEE Wireless Communications • Feburary 2002 deployed a PAWN would like to have finer- grained control on how his/her network is used. Toward this end, we consider two service models. msn Profiles Graphical Statistics: Port 4 File View Measurements

The basic service model includes free access to OnSale Mail Buddy Web Shopping local intranet services and resources like the orga- profiles Mall buddy nization’s Web portal page with links to resident client

Graphical Statistics: Port 4 businesses and services like an indoor navigation File View Measurements

File\ Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Grap Graphical Statistics: Port 4 Graphical File\ Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Grap Graphical Statistics: Port 4 GraphicalGraphical Statis File\ 4 Graphical Statistics: Port 4\ system that directs the user through the building. Graphical Statistics: Port Grap 4 Graphical Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Graphical Statistics: Port Such basic service does not require users to Wilf 4 Graphical authenticate themselves but does require the user to have a valid IP address. The second enhanced Mall OnSale buddy server server service model is used to generate revenues by Mall buddy charging the user according to a differentiated Victor client

Graphical Statistics: Port 4 charging plan based on the level of service the File View Measurements File\ Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Grap Graphical Statistics: Port 4 Graphical File\ Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Grap Graphical Statistics: Port 4 GraphicalGraphical Statis File\ 4 Graphical Statistics: Port 4\ Graphical Statistics: Port Eventing user opts for. This model includes services like Grap 4 Graphical Graphical Statistics: Port 4 Graphical Statistics: Port 4\ Graphical Statistics: Port Internet access, location-based buddy lists, notifi- 4 Graphical infrastructure cation of ongoing sales according to predefined "Electronics are on sale." preferences, and so on, all of which require the user to authenticate herself to the network. Figure 7. OnSale mall buddy service architecture. The CHOICE network technology we have built, deployed, and tested, and describe in this article supports both of these service models. less LANs as a basis for extending network connec- Furthermore, CHOICE ensures businesses a tivity to public places. However, using wireless nominal level of security. We believe customers LANs to implement public area wireless networks are concerned about the quality and security of raises a number of interesting challenges that must their connections, while businesses are con- be overcome to make such networks practical. We cerned about free riders who are pilfering band- discuss these issues, and describe a PAWN we width from their real customers. Businesses have designed, implemented, and deployed called would rather not offer any wireless connectivity CHOICE that addresses these challenges in one than offer connectivity that is low quality, inse- integrated system. Specifically we discuss: cure, and unreliable because then they risk los- Service Models — The network can provide ing a lot more angry, frustrated, and dissatisfied various types of service to users. CHOICE sup- customers who experience poor connections ports a wide range of service models, from free while in their store. CHOICE is designed to access to local services to paid connectivity, pos- avoid this kind of situation by giving business sibly with quality of service guarantees. owners a degree of control over how they allo- Authentication — The network must authen- cate and manage their network resources and ticate users to authorize access under a given maximize their customers’ satisfaction. It is a service model. CHOICE supports multiple self-contained software solution that is easy to authentication modes like E-cash systems, credit install and maintain, another important consid- cards, digital certificates, and so on. Once eration for business owners. authenticated, CHOICE returns a security token In summary, we claim that PAWNs with to the user’s mobile device for identification. CHOICE makes a compelling story from a busi- Access Enforcement — The network must ness perspective since everyone involved with it ensure that users can only access network con- benefits. In particular, end users benefit because nectivity and services for which they are autho- it gives them a viable choice of how they access rized. CHOICE uses per-packet filtering at the the Internet while giving them options for chang- access points to identify packets from authorized ing the amount of bandwidth and services they users and block unauthorized access. get from the network. Hardware vendors benefit, Policy Enforcement — Depending on the ser- since they are able to sell more wireless hardware vice model, the network might have to provide to businesses. Service providers benefit since their guarantees, such as minimal bandwidth. resources are bought and used. Building owners CHOICE uses the network admission server to benefit since they use PAWNs to stay competitive centrally control bandwidth allocation, and lever- while attracting more visitors or customers to ages the per-packet filtering mechanism to their buildings. With CHOICE they can offer enforce service policies. additional personalized services either free or for Billing and Accounting — To support service a nominal price to their customers. Finally, soft- models with charges, the network must account ware vendors benefit since they can sell new types and bill for access and service. Once again, of functionality over this network. For all these CHOICE leverages the per-packet filtering reasons we feel that the business case for deploy- mechanism to maintain fine-grained accounting ing a PAWN with CHOICE is a strong one, and of network utilization by users. it is in the interest of public building administra- Security and Privacy — Since it is a shared, tors to deploy this technology in their buildings. public medium, the network must support data integrity and security. CHOICE supports three SUMMARY levels of security negotiated during authentica- tion: encryption of the security token alone, the To further realize the vision of pervasive ubiquitous packet headers, or the entire packet. computing, we must extend high-speed network Location Services — To support location-sen- connectivity beyond private networks into public sitive applications, the network must be able to places. In this article we motivate the use of wire- determine user locations and disseminate loca-

IEEE Wireless Communications • Feburary 2002 47 CHOICE has been tion information to applications on the mobile puters Inc.) where he initiated, led, and delivered several device. CHOICE uses RF signal intensity maps seminal multimedia projects including the industry's first hardware and software implementations of audio/video available to users for of overlapping base stations, combined with pre- compression and rendering algorithms. He is co-founder dictive heuristics, to determine user location. and chair of the ACM Special Interest Group in Mobility over two years now CHOICE has been available to users for over (SIGMOBILE). He is the Founder and Editor-in-Chief of ACM two years now and has successfully demonstrated Mobile Computing and Communications Review; he serves on the editorial boards of IEEE Journal on Selected Areas in and has successfully that wireless LANs are a viable and compelling Communications and ACM Journal on Wireless Networking. technology for providing high-performance wire- He served as General Vice Chair of ACM MobiCom, and as demonstrated that less Internet access and personalized location Program Chair for the IEEE Symposium on Wearable Com- services in public places. puters and the ACM Workshop on Wireless Mobile Multi- media. He has served on the steering committees of wireless LANs are a several conferences and the Technical Program Committee REFERENCES of over 25 international conferences and workshops. He is [1] IEEE 802.11b/D3.0, “Wireless LAN Medium Access Control the author of more than three dozen scientific papers and viable and compelling (MAC) and Physical (PHY) Layer Specification: High Speed 27 pending and issued patent applications in the areas of Physical Layer Extensions in the 2.4 GHz Band,” 1999. wireless communications, digital signal processing, and technology for [2] R. V. Nee et al., “New High-rate Wireless LAN Stan- computer communications. He is the recipient of Digital's dards,” IEEE Commun. Mag., vol. 37, no. 12, Dec. doctoral engineering fellowship award and ACM's Distin- 1999, pp. 82–88. guished Service award. providing high- [3] The CHOICE Network Project, Sept. 1999, http:// www.mschoice.com ANAND BALACHANDRAN ([email protected]) is a Ph.D. stu- performance wireless [4] IETF Working Group on IP Routing for Wireless/Mobile dent in the and Engineering Department Hosts, http://www.ietf.org/html.charters/mobileip-char- at the University of California at San Diego. His research ter.html interests include wireless networking and mobile computing, Internet access and [5] A. Harter and A. Hopper, “A New Location Technique wireless networking protocols and performance, location- for the Active Office,” IEEE Pers. Commun., vol. 4, no. aware systems, and quality of service in next-generation personalized location 5, Oct. 1997. wireless systems. He received his M.S. degree from Columbia [6] R. Want et al., “The Active Badge Location System,” ACM University in 1997, and his B.Tech. degree from the Indian Trans. Info. Sys., vol. 40, no. 1, Jan. 1992, pp. 91–102. Institute of Technology, Madras, in 1995. services in public [7] S. Y. Seidel, and T. S. Rapport, “914 MHz Path Loss Pre- diction Model for Indoor Wireless Communications in ALLEN MIU is a Ph.D. student at the MIT Laboratory for places. Multi-floored buildings,” IEEE Trans. Antennas & Propa- Computer Science. His current research interest includes gation, Feb. 1992. mobile networking, location systems, and context-aware [8] P. Bahl and V. N. Padmanabhan, “RADAR: An In-Build- computing. He received his B.Sc. with Highest Honors dis- ing RF-based User Location and Tracking System,” Proc. tinction from UC Berkeley. IEEE INFOCOM 2000, Apr. 2000. [9] P. Bahl, V. N. Padmanabhan, and A. Balachandran, “A WILF RUSSELL has been designing and creating systems-level Software System for Locating Mobile Users: Design, software for the past 16 years. His contributions include Evaluation, and Lessons,” MSR-TR-2000-12, Feb. 2000. more than 10 software packages ranging from IBM PC/DOS [10] D. Estrin, J. C. Mogul, and G. Tsudik. “Visa Protocols to Microsoft Transaction Server and for Controlling Inter-Organization Datagram Flow,” IEEE 2000. Joining Microsoft Research three years ago, he is JSAC, vol. 7, no. 4, May 1989, pp. 486–98. now focused on home networking and creating systems [11] IEEE Draft P802.1x/D1, “Port Based Network Access infrastructure for a distributed home networking control Control,” Sept. 1999. solution as well as distributed pub/sub eventing mecha- [12] R. Atkinson, “Security Architecture for the Internet nisms. He earned a B.Sc. in computer engineering from the Protocol,” IETF RFC 2401, Nov. 1998. University of Manitoba. [13] P. Bahl, A. Balachandran, and S. Venkatachary, “The CHOICE Network – Wireless Internet Access GEOFFREY M. VOELKER is an assistant professor at the Univer- in Public Places,” MSR-TR-2000-21, Feb. 2000. sity of California at San Diego. His research interests [14] N. H. Vaidya, P. Bahl, and S. Gupta, “Distributed Fair include operating systems, networking and mobile comput- Scheduling in a Wireless LAN,” Proc. ACM MobiCom ing, and Internet distributed systems. He received a B.S. 2000, July 2000. degree in and Computer Science [15] B. Aboba, J. Arkko, and D. Harrington, “Introduction from the University of California at Berkeley in 1992, and to Accounting Management, IETF RFC 2975, Oct 2000. the MS and Ph.D. degrees in computer science and engi- [16] A. Miu and P. Bahl, “Dynamic Host Configuration for neering from the University of Washington in 1995 and Managing Mobility between Public and Private Net- 2000, respectively. In 2000 he was the first recipient of the works,” Proc. Usenix USITS 2001, Mar. 2001. CRA Digital Government Fellowship. [17] MSN Messenger Service, http://messenger.msn.com [18] AOL Instant Messenger, http://www.aol.com/aim/ YI-MIN WANG received his B.S. degree from the Department [19] Y.-M. Wang, P. Bahl, and W. Russell, “The SIMBA User of Electrical Engineering at National Taiwan University in Alert Service Architecture for Dependable Alert Deliv- 1986, where he graduated with top-ranked honors. He ery,” Int’l. Conf. Dep. Sys. and Networks, July 2000. received his Ph.D. degree from the Department of Electrical and Computer Engineering of the University of Illinois at BIOGRAPHIES Urbana-Champaign in 1993, where he received the Robert T. PARAMVIR (VICTOR) BAHL ([email protected]) holds a Ph.D. Chien Memorial Award from the Graduate College for excel- in computer systems engineering from the University of lence in research. From 1993 to 1997 he was with AT&T Bell Massachusetts Amherst. He is a researcher scientist at Labs and primarily worked on highly available distributed Microsoft Research where he is investigating problems systems, in both theory and practice. Since joining Microsoft related to Internet access, location determination, wireless- Research in 1998 he has expanded his research efforts into Web browsing and alerts, power aware networks, multi- the areas of home networking, distributed objects, sensor hop ad-hoc sensor networks, and real-time audio-visual networks, scalable eventing, and security/privacy. He has wireless communications. Prior to Microsoft, he was with served on the conference program committees of ACM Digital Equipment Corporation (now part of Compaq Com- PODC, IEEE FTCS/DSN, IEEE ICDCS, and WWW.

48 IEEE Wireless Communications • Feburary 2002