arXiv subjects

Thiemo Voigt

Publications and source records attributed to Thiemo Voigt.

26 records · Page 2Linked to original sources

arXiv2021

The Dark (and Bright) Side of IoT: Attacks and Countermeasures for Identifying Smart Home Devices and Services

We present a new machine learning-based attack that exploits network patterns to detect the presence of smart IoT devices and running services in the WiFi radio spectrum. We perform an extensive measurement campaign of data collection, and we build up a model describing the traffic patterns characterizing three popular IoT smart home devices, i.e., Google Nest Mini, Amazon Echo, and Amazon Echo Dot. We prove that it is possible to detect and identify with overwhelming probability their presence and the services running by the aforementioned devices in a crowded WiFi scenario. This work proves that standard encryption techniques alone are not sufficient to protect the privacy of the end-user, since the network traffic itself exposes the presence of both the device and the associated service. While more work is required to prevent non-trusted third parties to detect and identify the user's devices, we introduce Eclipse, a technique to mitigate these types of attacks, which reshapes the traffic making the identification of the devices and the associated services similar to the random classification baseline.

cs.CR↗

arXiv2020

TunnelScatter: Low Power Communication for Sensor Tags using Tunnel Diodes

Due to extremely low power consumption, backscatter has become the transmission mechanism of choice for battery-free devices that operate on harvested energy. However, a limitation of recent backscatter systems is that the communication range scales with the strength of the ambient carrier signal(ACS). This means that to achieve a long range, a backscatter tag needs to reflect a strong ACS, which in practice means that it needs to be close to an ACS emitter. We present TunnelScatter, a mechanism that overcomes this limitation. TunnelScatter uses a tunnel diode-based radio frequency oscillator to enable transmissions when there is no ACS, and the same oscillator as a reflection amplifier to support backscatter transmissions when the ACS is weak. Our results show that even without an ACS, TunnelScatter is able to transmit through several walls covering a distance of 18 meter while consuming a peak biasing power of 57 microwatts. Based on TunnelScatter, we design battery-free sensor tags, called TunnelTags, that can sense physical phenomena and transmit them using the TunnelScatter mechanism.

cs.NI↗

arXiv2018

Visible Light Communication for Wearable Computing

Visible Light Communication (VLC) is emerging as a means to network computing devices that ameliorates many hurdles of radio-frequency (RF) communications, for example, the limited available spectrum. Enabling VLC in wearable computing, however, is challenging because mobility induces unpredictable drastic changes in light conditions, for example, due to reflective surfaces and obstacles casting shadows. We experimentally demonstrate that such changes are so extreme that no single design of a VLC receiver can provide efficient performance across the board. The diversity found in current wearable devices complicates matters. Based on these observations, we present three different designs of VLC receivers that i) are individually orders of magnitude more efficient than the state-of-the-art in a subset of the possible conditions, and i) can be combined in a single unit that dynamically switches to the best performing receiver based on the light conditions. Our evaluation indicates that dynamic switching incurs minimal overhead, that we can obtain throughput in the order of MBit/s, and at energy costs lower than many RF devices.

cs.NI↗

arXiv2017

LoRea: A Backscatter Architecture that Achieves a Long Communication Range

There is the long-standing assumption that radio communication in the range of hundreds of meters needs to consume mWs of power at the transmitting device. In this paper, we demonstrate that this is not necessarily the case for some devices equipped with backscatter radios. We present LoRea an architecture consisting of a tag, a reader and multiple carrier generators that overcomes the power, cost and range limitations of existing systems such as Computational Radio Frequency Identification~(CRFID). LoRea achieves this by: First, generating narrow-band backscatter transmissions that improve receiver sensitivity. Second, mitigating self-interference without the complex designs employed on RFID readers by keeping carrier signal and backscattered signal apart in frequency. Finally, decoupling carrier generation from the reader and using devices such as WiFi routers and sensor nodes as a source of the carrier signal. An off-the-shelf implementation of LoRea costs 70 USD, a drastic reduction in price considering commercial RFID readers cost 2000 USD. LoRea's range scales with the carrier strength, and proximity to the carrier source and achieves a maximum range of 3.4 kilometre when the tag is located at 1 meter distance from a 28 dBm carrier source while consuming 70 microwatts at the tag. When the tag is equidistant from the carrier source and the receiver, we can communicate upto 75 meter, a significant improvement over existing RFID readers.

cs.NI↗

arXiv2017

Five-Nines Reliable Downward Routing in RPL

After a decade of research in low-power data collection, reaching arbitrary nodes has received comparatively little attention. The leading protocol for low-power IPv6 routing, RPL, is no exception, as it is often studied in multipoint-to-point scenarios. As a result, downward routing (from root to node) is still notoriously difficult, holding back the emergence of Internet of Things applications that involve actuation. In this paper, we focus on achieving industrial-grade reliability levels (1e-5 failure rate) in downward routing with RPL. We make every packet count, and classify the different causes of packet loss. We show how to mitigate each source of packet loss, by (1) introducing a gradient metric that favors reliable links, (2) increasing neighborhood awareness for accurate link selection, and (3) ensuring a robust routing state maintenance and packet forwarding. We demonstrate RPL downward routing with loss rates in the order of 1e-5 in four different testbeds up to 352 nodes, in both sparse and dense settings. We also validate our solution on top of a low-power TSCH scheduler, and achieve sub-percent low duty cycles and a channel utilization of 0.07% at every node, spread over 16 channels.

cs.NI↗

arXiv2016

Mitigating Inter-network Interference in LoRa Networks

Long Range (LoRa) is a popular technology used to construct Low-Power Wide-Area Network (LPWAN) networks. Given the popularity of LoRa it is likely that multiple independent LoRa networks are deployed in close proximity. In this situation, neighbouring networks interfere and methods have to be found to combat this interference. In this paper we investigate the use of directional antennae and the use of multiple base stations as methods of dealing with inter-network interference. Directional antennae increase signal strength at receivers without increasing transmission energy cost. Thus, the probability of successfully decoding the message in an interference situation is improved. Multiple base stations can alternatively be used to improve the probability of receiving a message in a noisy environment. We compare the effectiveness of these two approaches via simulation. Our findings show that both methods are able to improve LoRa network performance in interference settings. However, the results show that the use of multiple base stations clearly outperforms the use of directional antennae. For example, in a setting where data is collected from 600 nodes which are interfered by four networks with 600 nodes each, using three base stations improves the Data Extraction Rate (DER) from 0.24 to 0.56 while the use of directional antennae provides an increase to only 0.32.

cs.NI↗

arXiv2014

dRTI: Directional Radio Tomographic Imaging

Radio tomographic imaging (RTI) enables device free localisation of people and objects in many challenging environments and situations. Its basic principle is to detect the changes in the statistics of some radio quality measurements in order to infer the presence of people and objects in the radio path. However, the localisation accuracy of RTI suffers from complicated radio propagation behaviours such as multipath fading and shadowing. In order to improve RTI localisation accuracy, we propose to use inexpensive and energy efficient electronically switched directional (ESD) antennas to improve the quality of radio link behaviour observations, and therefore, the localisation accuracy of RTI. We implement a directional RTI (dRTI) system to understand how directional antennas can be used to improve RTI localisation accuracy. We also study the impact of the choice of antenna directions on the localisation accuracy of dRTI and propose methods to effectively choose informative antenna directions to improve localisation accuracy while reducing overhead. We evaluate the performance of dRTI in diverse indoor environments and show that dRTI significantly outperforms the existing RTI localisation methods based on omni-directional antennas.

cs.OH↗

arXiv2012

Jam-X: Wireless Agreement under Interference

Wireless low-power transceivers used in sensor networks such as IEEE 802.15.4 typically operate in unlicensed frequency bands that are subject to external interference from devices transmitting at much higher power. Communication protocols should therefore be designed to be robust against such interference. A critical building block of many protocols at all layers is agreement on a piece of information among a set of nodes. At the MAC layer, nodes may need to agree on a new time slot or frequency channel; at the application layer nodes may need to agree on handing over a leader role from one node to another. Message loss caused by interference may break agreement in two different ways: none of the nodes use the new information (time slot, channel, leader) and stick with the previous assignment, or - even worse - some nodes use the new information and some do not. This may lead to reduced performance or failures. In this paper we investigate the problem of agreement under interference and point out the limitations of the traditional message-based n-way handshake approach. We propose novel protocols that use jamming instead of message transmissions and show that they outperform the n-way handshake in terms of agreement probability, energy consumption, and time-to-completion both in the unicast case (two neighboring nodes agree) as well as in the broadcast case (any number of neighboring nodes agree).

cs.NI↗