ABSTRACT Title of dissertation TIME-BASED LOCATION TECHNIQUES USING INEXPENSIVE, UNSYNCHRONIZED CLOCKS IN WIRELESS NETWORKS Matthew Yew Mun Mah, Doctor of Philosophy, 2011 Dissertation directed by Professor Ashok Agrawala Department of Computer Science The ability to measure location using time of flight in IEEE 802.11 networks is impeded by the standard clock resolution, imprecise synchronization of the 802.11 protocol, and the inaccuracy of available clocks. To achieve real-time location with accuracy goals of a few meters, we derive new consensus synchronization techniques for free-running clocks. Using consensus synchronization, we improve existing time of arrival (TOA) techniques and introduce new time difference of arrival (TDOA) techniques. With this common basis, we show how TOA is theoretically superior to TDOA. Using TOA measurements, we can locate wireless nodes that participate in the location system, and using TDOA measurements, we can locate nodes that do not participate. We demonstrate applications using off-the-shelf 802.11 hardware that can determine location to within 3m using simple, existing optimization methods. The synchronization techniques extend existing ones providing distributed synchronization for free-running clocks to cases where send times cannot be controlled and adjusted precisely, as in 802.11 networks. These location and synchronization techniques may be applied to transmitting wireless nodes using any communication protocol where cooperating nodes can produce send and receive timestamps. TIME-BASED LOCATION TECHNIQUES USING INEXPENSIVE, UNSYNCHRONIZED CLOCKS IN WIRELESS NETWORKS by Matthew Yew Mun Mah Dissertation submitted to the Faculty of the Graduate School of the University of Maryland, College Park in partial fulfillment of the requirements for the degree of Doctor of Philosophy 2011 Advisory Committee: Professor Ashok Agrawala, Chair/Advisor Professor Bobby Bhattacharjee Professor Udaya Shankar Professor Charles Silio, Dean's Representative Professor Amitabh Varshney c Copyright by Matthew Yew Mun Mah 2011 Contents 1 Introduction1 1.1 Location Technologies..........................2 1.2 Time-based Location...........................4 1.2.1 Synchronization..........................5 1.2.2 Distance Measurements and Location..............6 1.3 Contributions...............................7 1.4 Notation.................................. 10 1.4.1 Distance.............................. 10 1.4.2 Time................................ 11 1.4.3 Wireless Nodes.......................... 12 2 Distance Measurement Primitives and the Location Problem 14 2.1 Time of Arrival (TOA).......................... 15 2.2 Time Difference of Arrival (TDOA)................... 15 2.3 Location Problem............................. 19 2.3.1 Trilateration............................ 20 2.3.2 Hyperbolic Location....................... 22 2.3.3 Alternate Names......................... 24 2.3.4 Anchor Node Geometry..................... 25 2.4 Comparison of TOA and TDOA..................... 26 2.5 Summary and Other Location Problems................ 27 3 Time Measurement 28 3.1 Synchronization.............................. 29 3.1.1 Cristian's Algorithm....................... 30 3.1.2 Simple Network Time Protocol (SNTP)............. 31 3.1.3 IEEE 1588............................. 32 3.1.4 Reference Broadcast Synchronization.............. 33 3.2 Basic Clock Model............................ 34 3.3 Empirical Clock Behavior........................ 35 3.3.1 Experiment Setup......................... 36 3.3.2 Nonlinear Results......................... 37 3.4 Piecewise Linear Clock Model...................... 38 3.4.1 Estimation of Offset....................... 39 3.4.2 Estimation of Clock Drift βb .................. 41 βa ii 3.5 Summary................................. 47 4 Consensus Clock Synchronization 48 4.1 Mathematical Background........................ 50 4.1.1 Matrix Digraphs......................... 51 4.1.2 Perron-Frobenius and Extensions................ 52 4.1.3 Power Method........................... 52 4.2 Clock Drift................................ 54 4.2.1 Clock Drift in Fully Connected Graph............. 54 4.2.2 Clock Drift General Graph.................... 55 4.3 Offset................................... 57 4.3.1 Offset in Fully Connected Graph................ 58 4.3.2 Offset in General Graph..................... 59 4.3.3 Offset Matrix Analysis...................... 59 4.4 Verification by Simulation........................ 64 4.5 Summary and Applications........................ 67 5 PinPoint 69 5.1 Implementation.............................. 71 5.1.1 Atheros Network Cards...................... 73 5.1.2 G2-based Devices......................... 74 5.2 Piecewise, Locally Linear Model..................... 75 5.3 PinPoint TOA............................... 76 5.4 PinPoint TDOA.............................. 77 5.4.1 TDOA Active Target....................... 77 5.4.2 No Send Times.......................... 79 5.4.3 Low Traffic Mobile Node..................... 80 5.5 Card Biases................................ 82 5.6 Error Estimation............................. 83 5.7 Outlier Filtering.............................. 86 5.7.1 Timestamp Stream Filtering................... 87 5.7.2 Distance Filtering......................... 90 5.8 TDOA Distance Measurement Experimental Results.......... 90 5.8.1 Experiment Setup......................... 90 5.8.2 Results............................... 91 5.9 Active Transmitter TDOA Experimental Results............ 92 5.9.1 Experiment Setup......................... 93 5.9.2 Results............................... 94 5.10 PinPoint TOA with G2-based RN-134................. 97 5.10.1 Experiment Setup......................... 97 5.10.2 Results............................... 98 5.11 Summary................................. 101 iii 6 Hybrid TOA-TDOA Analysis 103 6.1 PinPoint.................................. 105 6.2 Goodtry.................................. 108 6.3 Hybrid Information for Location..................... 109 7 PinPoint Usage Cases 111 7.1 Firefighters................................ 112 7.2 Retail Store................................ 113 7.3 Museums................................. 114 7.4 Rogue AP Problem............................ 114 7.4.1 Rogue AP Detection....................... 115 7.4.2 Existing Rogue AP Location................... 117 7.4.3 PinPoint for Rogue AP Location................ 117 7.5 Summary................................. 117 8 Conclusion 118 A Derivations 120 A.1 Point Clock Drift Error Estimation................... 121 A.2 Clock Offset θa!b in Consensus Time Scale............... 122 A.2.1 Consensus Clock Offset...................... 123 A.3 TOA.................................... 125 A.4 TDOA Variants.............................. 126 A.4.1 TDOA with Active Target.................... 126 A.4.2 TDOA without Send Times................... 127 A.4.3 TDOA for Low Traffic Mobile Node............... 128 A.5 Card Bias................................. 129 A.6 Alternate Clock Drift Notation..................... 130 B Existing Time-based Location Systems 131 B.1 Global Positioning System (GPS).................... 132 B.1.1 Assisted GPS (A-GPS)...................... 136 B.1.2 Differential GPS (DGPS)..................... 136 B.1.3 Planned GPS Enhancements................... 137 B.2 Pseudolites................................ 137 B.3 Long Range Aid to Navigation (LORAN), DECCA.......... 138 B.4 Goodtry.................................. 139 B.5 Mobile Phone Tracking.......................... 140 B.5.1 Enhanced Observed Time Difference (E-OTD)......... 140 B.5.2 Advanced Forward Link Trilateration (A-FLT)......... 141 B.5.3 GSM Uplink Time of Arrival (UL-TOA)............ 141 B.6 Combined RF and Ultrasound...................... 142 B.6.1 Cricket............................... 142 B.6.2 Active Bat............................. 142 iv C Sensor Network Localization Problem 144 C.1 Graph Rigidity Theory and Unique Localizability........... 146 C.2 Semidefinite Programming........................ 146 C.3 Spring-Mass Localization......................... 147 D 802.11 Implementation Considerations 149 D.1 Drivers................................... 150 D.1.1 Madwifi-ng............................ 150 D.1.2 ath5k............................... 153 D.2 RN-134.................................. 153 E The Hyperbola and Hyperboloid 156 E.1 Hyperbola................................. 156 E.2 Hyperboloid................................ 158 F Clock Oscillators 161 v Abbreviations ACK Acknowledgement AOA Angle Of Arrival AP Access Point CTS Clear To Send - response to RTS packet DOP Dilution Of Precision GPS Global Positioning System IEEE Institiute of Electrical and Electronics Engineers LBS location-based service LORAN Long Range Aid to Navigation LOS Line of sight MAC Medium Access Control MIMO Multiple-Input Multiple-Output NTP Network Time Protocol RBS Reference Broadcast Synchronization RF Radio Frequency RTS Request To Send SIFS Short InterFrame Spacing - minimum time between packets in 802.11 protocol SNTP Simple Network Time Protocol TDOA Time Difference of Arrival TOA Time of Arrival vi Chapter 1 Introduction The context-aware paradigm of computing exploits available context such as user preferences, time, and location by recognizing that context determines what informa- tion is relevant to a user [72, 31]. For example, if there is a traffic jam on the freeway, a car commuter may wish to adjust her route, but a subway rider may continue as usual. The general notion of context is intentionally vague to