Wi-Fi positioning system

Wi-Fi positioning system (WPS, WiPS or WFPS) is a geolocation system that uses the characteristics of nearby Wi‑Fi access points to discover where a device is located.^[1]

It is used where satellite navigation such as GPS is inadequate due to various causes including multipath and signal blockage indoors, or where acquiring a satellite fix would take too long. ^[2] Such systems include assisted GPS, urban positioning services through hotspot databases, and indoor positioning systems.^[3] Wi-Fi positioning takes advantage of the rapid growth in the early 21st century of wireless access points in urban areas.^[4]

The most common technique for positioning using wireless access points is based on a rough proxy for the strength of the received signal (received signal strength indicator, or RSSI) and the method of "fingerprinting".^[5][6][7] Typically a wireless access point is identified by its SSID and MAC address, and these data are compared to a database of supposed locations of access points so identified. The accuracy depends on the accuracy of the database (e.g. if an access point has moved its entry is inaccurate), and the precision depends on the number of discovered nearby access points with (accurate) entries in the database and the precisions of those entries. The access point location database gets filled by correlating mobile device location data (determined by other systems, such as Galileo or GPS) with Wi‑Fi access point MAC addresses.^[8] The possible signal fluctuations that may occur can increase errors and inaccuracies in the path of the user. To minimize fluctuations in the received signal, there are certain techniques that can be applied to filter the noise.

In the case of low precision, some techniques have been proposed to merge the Wi-Fi traces with other data sources such as geographical information and time constraints (i.e., time geography).^[9]

Motivation and applications

Accurate indoor localization is becoming more important for Wi‑Fi–based devices due to the increased use of augmented reality, social networking, health care monitoring, personal tracking, inventory control and other indoor location-aware applications.^[10][11]

In wireless security, it is an important method used to locate and map rogue access points.^[12][13]

The popularity and low price of Wi-Fi network interface cards is an attractive incentive to use Wi-Fi as the basis for a localization system and significant research has been done in this area in the past 15 years.^[5][7][14]

Problem statement and basic concepts

The problem of Wi‑Fi–based indoor localization of a device is that of determining the position of client devices with respect to access points. Many techniques exist to accomplish this, and these may be classified based on the four different criteria they use: received signal strength indication (RSSI), fingerprinting, angle of arrival (AoA) and time of flight (ToF).^[14][15]

In most cases the first step to determine a device's position is to determine the distance between the target client device and a few access points. With the known distances between the target device and access points, trilateration algorithms may be used to determine the relative position of the target device,^[11] using the known position of access points as a reference. Alternatively, the angles of arriving signals at a target client device can be employed to determine the device's location based on triangulation algorithms.^[14]

A combination of these techniques may be used to improve the precision of a system.^[14]

Techniques

Signal strength

RSSI localization techniques are based on measuring rough relative signal strength at a client device from several different access points, and then combining this information with a propagation model to determine the distance between the client device and the access points. Trilateration (sometimes called multilateration) techniques can be used to calculate the estimated client device position relative to the expected position of access points.^[11][14]

Though one of the cheapest and easiest methods to implement, its disadvantage is that it does not provide very good precision (median of 2–4m), because the RSSI measurements tend to fluctuate according to changes in the environment or multipath fading.^[5]

Cisco uses RSSI to locate devices through its access points. Access points collect the location data and update the location on the Cisco cloud called Cisco DNA Spaces.^[16]

Monte Carlo sampling

Monte Carlo sampling is a statistical technique used in indoor Wi-Fi mapping to estimate the location of wireless nodes. The process involves creating wireless signal strength maps using a two-step parametric and measurement-driven ray-tracing approach. This accounts for the absorption and reflection characteristics of various obstacles in the indoor environment.^[17]

The location estimates are then computed using Bayesian filtering on sample sets derived by Monte Carlo sampling. This method has been found to provide good location estimates of users with sub-room precision using received signal strength indication (RSSI) readings from a single access point.^[18]

Fingerprinting

Traditional fingerprinting is also RSSI-based, but it simply relies on the recording of the signal strength from several access points in range and storing this information in a database along with the known coordinates of the client device in an offline phase. This information can be deterministic^[5] or probabilistic.^[7] During the online tracking phase, the current RSSI vector at an unknown location is compared to those stored in the fingerprint and the closest match is returned as the estimated user location. Such systems may provide a median accuracy of 0.6m and tail accuracy of 1.3m.^[14][19]

Its main disadvantage is that any changes to the environment, such as adding or removing furniture or buildings, may change the "fingerprint" that corresponds to each location, requiring an update to the fingerprint database. However, integration with other sensors such as cameras can be used in order to deal with a changing environment.^[20]

Angle of arrival

Linear array of antennas receiving a signal. The phase-shift difference of the received signal arriving at antennas equally separated by a "d" distance is used to compute the angle of arrival of the signal.^[14]

With the advent of MIMO Wi-Fi interfaces, which use multiple antennas, it is possible to estimate the AoA of the multipath signals received at the antenna arrays in the access points, and apply triangulation to calculate the location of client devices. SpotFi,^[14] ArrayTrack^[10] and LTEye^[21] are proposed solutions which employ this kind of technique.

Typical computation of the AoA is done with the MUSIC algorithm. Assuming an antenna array of ${\displaystyle M}$ antennas equally spaced by a distance of ${\displaystyle d}$ and a signal arriving at the antenna array through ${\displaystyle L}$ propagation paths, an additional distance of ${\displaystyle d\sin \theta }$ is traveled by the signal to reach the second antenna of the array.^[14]

Considering that the ${\displaystyle k}$-th propagation path arrives with angle ${\displaystyle \theta _{k}}$ with respect to the normal of the antenna array of the access point, ${\displaystyle \gamma _{k}}$ is the attenuation experienced at any antenna of the array. The attenuation is the same in every antenna, except for a phase shift which changes for every antenna due to the extra distance traveled by the signal. This means that the signal arrives with an additional phase of

${\displaystyle -2\pi \cdot d\cdot \sin(\theta )\cdot (f/c)\cdot (2-1)}$

at the second antenna and

${\displaystyle -2\pi \cdot d\cdot \sin(\theta )\cdot (f/c)\cdot (m-1)}$

at the ${\displaystyle m}$-th antenna.^[14]

Therefore, the following complex exponential can be used as a simplified representation of the phase shifts experienced by each antenna as a function of the AoA of the propagation path:^[14]

$${\displaystyle \phi (\theta _{k})=\exp(-j\cdot 2\pi \cdot d\cdot \sin(\theta _{k})\cdot f/c)}$$

The AoA can then be expressed as the vector ${\displaystyle {\vec {a}}(\theta _{k})\gamma _{k}}$ of received signals due to the ${\displaystyle k}$-th propagation path, where ${\displaystyle {\vec {a}}(\theta _{k})}$ is the steering vector and given by:^[14]$${\displaystyle {\vec {a}}(\theta _{k})=[1,\ \phi (\theta _{k}),\ \dots ,\ \phi (\theta _{k})^{M-1}]^{T}}$$There is one steering vector for each propagation path, and the steering matrix ${\displaystyle \mathbf {A} }$ (of dimensions ${\displaystyle M\cdot L}$) is then defined as:^[14]$${\displaystyle \mathbf {A} =[{\vec {a}}(\theta _{1}),\dots ,{\vec {a}}(\theta _{L})]}$$and the received signal vector ${\displaystyle {\vec {x}}}$ is:^[14]$${\displaystyle {\vec {x}}=\mathbf {A} {\vec {\Gamma }}}$$where ${\displaystyle {\vec {\Gamma }}=[{\vec {\gamma }}_{1}\dots {\vec {\gamma }}_{L}]}$ is the vector complex attenuations along the ${\displaystyle L}$ paths.^[14] OFDM transmits data over multiple different sub carriers, so the measured received signals ${\displaystyle {\vec {x}}}$ corresponding to each sub carrier form the matrix ${\displaystyle \mathbf {X} }$ expressed as:^[14]$${\displaystyle \mathbf {X} =[{\vec {x}}_{1}\dots {\vec {x}}_{L}]=\mathbf {A} [{\vec {\Gamma }}_{1}\dots {\vec {\Gamma }}_{L}]=\mathbf {AF} }$$The matrix ${\displaystyle \mathbf {X} }$ is given by the channel state information (CSI) matrix which can be extracted from modern wireless cards with special tools such as the Linux 802.11n CSI Tool.^[22]

This is where the MUSIC algorithm is applied in, first by computing the eigenvectors of ${\displaystyle \mathbf {X} \mathbf {X} ^{H}}$ (where ${\displaystyle \mathbf {X} ^{H}}$ is the conjugate transpose of ${\displaystyle \mathbf {X} }$) and using the vectors corresponding to eigenvalue zero to calculate the steering vectors and the matrix ${\displaystyle \mathbf {A} }$.^[14] The AoAs can then be deduced from this matrix and used to estimate the position of the client device through triangulation.

Though this technique is usually more accurate than others, it may require special hardware in order to be deployed, such as an array of six to eight antennas^[10] or rotating antennas.^[21] SpotFi^[14] proposes the use of a superresolution algorithm which takes advantage of the number of measurements taken by each of the antennas of the Wi-Fi cards with only three antennas, and also incorporates ToF-based localization to improve its accuracy.

Time of flight

Figure showing a measuring station sending a DATA frame to a client station and waiting until receiving the ACK. ${\displaystyle \delta }$ is the scheduling delay (offset) originated at the target client device, and it depends on how much time it takes for the ACK to be scheduled. T_P is the signal propagation time between transmitter and receiver, and is usually assumed to be the same on the way to the target and back. T_ACK is the time needed to transmit the ACK frame. The time of flight corresponds to the T_MEASURED. Picture reproduced from ^[23]

Time of flight (ToF) localization approach takes timestamps provided by the wireless interfaces to calculate the ToF of signals and then use this information to estimate the distance and relative position of one client device with respect to access points. The granularity of such time measurements is in the order of nanoseconds and systems which use this technique have reported localization errors in the order of 2m.^[14] Typical applications for this technology are tagging and locating assets in buildings, for which room-level accuracy (~3m) is usually enough.^[24]

The time measurements taken at the wireless interfaces are based on the fact that RF waves travel close to the speed of light, which remains nearly constant in most propagation media in indoor environments. Therefore, the signal propagation speed (and consequently the ToF) is not affected so much by the environment as the RSSI measurements are.^[23]

Unlike traditional ToF-based echo techniques, such as those used in RADAR systems, Wi-Fi echo techniques use regular data and acknowledgement communication frames to measure the ToF.^[23]

As in the RSSI approach, the ToF is used only to estimate the distance between the client device and access points. Then a trilateration technique can be used to calculate the estimated position of the device relative to the access points.^[24] The greatest challenges in the ToF approach consist in dealing with clock synchronization issues, noise, sampling artifacts and multipath channel effects.^[24] Some techniques use mathematical approaches to remove the need for clock synchronization.^[15]

More recently, the Wi-Fi Round Trip Time standard has provided fine ToF ranging capabilities to Wi‑Fi.

Privacy concerns

Citing the specific privacy concerns arising out of WPS, Google suggested a unified approach for excluding a particular access point from taking part in determining location using WPS, supposedly by every access point owner deliberately opting out for each access point to be excluded.^[25] Appending "_nomap" to a wireless access point's SSID excludes it from Google's WPS database.^[26] Mozilla honors _nomap as a method of opting out of its location service.^[27]

Public Wi-Fi location databases

A number of public Wi-Fi location databases are available (only active projects):

Name	Unique Wi-Fi networks	Observations	Free database download	SSID lookup	BSSID lookup	Data License	Opt-out	Coverage map	Comment
Combain Positioning Service[28]	>2,400,000,000[29]	>67,000,000,000[29]	No	Yes	Yes	Proprietary	_nomap	Map Archived 2015-07-06 at the Wayback Machine	Also Cell ID database.
LocationAPI.org by Unwired Labs [30]	>1,500,010,000[31]	>4,100,000,000	No	No	Yes	Proprietary	No	Map	Also Cell ID database
Mylnikov GEO[32]	860,655,230[32]		Yes[33]	No	Yes	MIT[34]	— (aggregator)	Map Archived 2017-09-14 at the Wayback Machine	Also Cell ID database[35]
Navizon[36]	480,000,000	21,500,000,000	No	No	Yes	Proprietary	No	Map Archived 2015-06-22 at the Wayback Machine	Based on crowd-sourced data. Also Cell ID database.[37]
radiocells.org[38]	13,610,728		Yes[39]	No	Yes[40]	ODbL[41]	_nomap	Map Archived 2016-02-08 at the Wayback Machine	Based on crowd-sourced data. Also Cell ID database. Including raw data
WiGLE[42]	1,205,634,974[43]	16,460,980,303[43]	No	Yes[44]	Yes[44]	Proprietary	_nomap,[45] request	Map	Also Cell ID and Bluetooth databases.
BeaconDB[46]	11,049,092[47]		No	No	Yes[47]	Proprietary	_nomap	Map	Based on crowd-sourced data. Plans to publish data with public domain license. Also Cell ID and Bluetooth databases.

See also

• Automatic vehicle location
• Hybrid positioning system
• Indoor positioning system
• MAC address
• Mobile phone tracking

References

1. Lindner, Thomas; Fritsch, Lothar; Plank, Kilian; Rannenberg, Kai (2004). Lamersdorf, Winfried; Tschammer, Volker; Amarger, Stéphane (eds.). "Exploitation of Public and Private WiFi Coverage for New Business Models". Building the E-Service Society. IFIP International Federation for Information Processing. 146. Springer US: 131–148. doi:10.1007/1-4020-8155-3_8. ISBN 978-1-4020-8155-2.
2. Magda Chelly, Nel Samama. Detecting visibility in heterogeneous simulated environments for positioning purposes. IPIN 2010 : International Conference on Indoor Positioning and Indoor Navigation, Sep 2010, Hoenggerberg, Switzerland. ⟨hal-01345039⟩
3. Magda Chelly, Nel Samama. New techniques for indoor positioning, combining deterministic and estimation methods. ENC-GNSS 2009 : European Navigation Conference - Global Navigation Satellite Systems, May 2009, Naples, Italy. pp.1 - 12. hal-01367483
4. Magda Chelly, Anca Fluerasu, Nel Samama. A universal and autonomous positioning system based on wireless networks connectivity. ENC 2011 : European Navigation Conference, Nov 2011, London, United Kingdom. hal-01302215
5. P. Bahl and V. N. Padmanabhan, “RADAR: an in-building RF-based user location and tracking system,” in Proceedings of 19th Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM ’00), vol. 2, pp. 775–784, Tel Aviv.Israel, March 2000.
6. Y. Chen and H. Kobayashi, “Signal strength based indoor geolocation,” in Proceedings of the IEEE International Conference on Communications (ICC ’02), vol. 1, pp. 436–439, New York, NY, USA, April–May 2002.
7. Youssef, M. A.; Agrawala, A.; Shankar, A. Udaya (2003-03-01). "WLAN location determination via clustering and probability distributions". Proceedings of the First IEEE International Conference on Pervasive Computing and Communications, 2003. (PerCom 2003). pp. 143–150. CiteSeerX 10.1.1.13.4478. doi:10.1109/PERCOM.2003.1192736. ISBN 978-0-7695-1893-0. S2CID 2096671.
8. "Wi-Fi Positioning System". Archived from the original on 2014-12-19. Retrieved 2014-12-19.
9. Danalet, Antonin; Farooq, Bilal; Bierlaire, Michel (2014). "A Bayesian approach to detect pedestrian destination-sequences from WiFi signatures". Transportation Research Part C: Emerging Technologies. 44: 146–170. Bibcode:2014TRPC...44..146D. doi:10.1016/j.trc.2014.03.015.
10. J. Xiong and K. Jamieson, “Arraytrack: A fine-grained indoor location system,” NSDI ’13.
11. Yang, Jie; Chen, Yingying (2009-11-01). "Indoor Localization Using Improved RSS-Based Lateration Methods". GLOBECOM 2009 - 2009 IEEE Global Telecommunications Conference. pp. 1–6. CiteSeerX 10.1.1.386.4258. doi:10.1109/GLOCOM.2009.5425237. ISBN 978-1-4244-4148-8. S2CID 2125249.
12. Wang, C.; Zheng, X.; Chen, Y.; Yang, J. (September 2017). "Locating Rogue Access Point Using Fine-Grained Channel Information". IEEE Transactions on Mobile Computing. 16 (9): 2560–2573. doi:10.1109/TMC.2016.2629473. ISSN 1558-0660.
13. "Cisco Prime Network Control System Configuration Guide, Release 1.0 - Chapter 6: Monitoring Maps [Cisco Prime Network Control System Series Appliances]". Cisco. Retrieved 19 December 2020.
14. Kotaru, Manikanta; Joshi, Kiran; Bharadia, Dinesh; Katti, Sachin (2015-01-01). "SpotFi". Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication. SIGCOMM '15. New York, NY, USA: ACM. pp. 269–282. doi:10.1145/2785956.2787487. ISBN 978-1-4503-3542-3. S2CID 8728165.
15. Youssef, Moustafa; Youssef, Adel; Rieger, Chuck; Shankar, Udaya; Agrawala, Ashok (2006-01-01). "PinPoint". Proceedings of the 4th international conference on Mobile systems, applications and services. MobiSys '06. New York, NY, USA: ACM. pp. 165–176. doi:10.1145/1134680.1134698. ISBN 978-1595931955. S2CID 232045615.
16. "Fast locate in Cisco" (PDF). Cisco Documents.
17. Zaruba, G.V.; Huber, M.; Kamangar, F.A.; Chlamtac, I. (2004). "Monte Carlo sampling based in-home location tracking with minimal RF infrastructure requirements". IEEE Global Telecommunications Conference, 2004. GLOBECOM '04. Vol. 6. IEEE. pp. 3624–3629. doi:10.1109/GLOCOM.2004.1379045. ISBN 978-0-7803-8794-2. S2CID 6875248.
18. Zàruba, G. V.; Huber, M.; Kamangar, F. A.; Chlamtac, I. (April 2007). "Indoor location tracking using RSSI readings from a single Wi-Fi access point". Wireless Networks. 13 (2): 221–235. doi:10.1007/s11276-006-5064-1. ISSN 1022-0038. S2CID 9043157.
19. Youssef, Moustafa; Agrawala, Ashok (2007-01-04). "The Horus location determination system". Wireless Networks. 14 (3): 357–374. doi:10.1007/s11276-006-0725-7. ISSN 1022-0038. S2CID 62768948.
20. Wan Mohd Yaakob Wan Bejuri, Mohd Murtadha Mohamad, Maimunah Sapri and Mohd Adly Rosly (2012). Ubiquitous WLAN/Camera Positioning using Inverse Intensity Chromaticity Space-based Feature Detection and Matching: A Preliminary Result. International Conference on Man-Machine Systems 2012 (ICOMMS 2012), Penang, MALAYSIA. See publication here, or click here if broken link
21. Kumar, Swarun; Hamed, Ezzeldin; Katabi, Dina; Erran Li, Li (2014-01-01). "LTE radio analytics made easy and accessible". Proceedings of the 6th annual workshop on Wireless of the students, by the students, for the students. S3 '14. New York, NY, USA: ACM. pp. 29–30. doi:10.1145/2645884.2645891. hdl:1721.1/100518. ISBN 978-1-4503-3073-2. S2CID 53224063.
22. "Linux 802.11n CSI Tool". dhalperi.github.io. Retrieved 2015-11-10.
23. Marcaletti, Andreas; Rea, Maurizio; Giustiniano, Domenico; Lenders, Vincent; Fakhreddine, Aymen (2014-01-01). "Filtering Noisy 802.11 Time-of-Flight Ranging Measurements". Proceedings of the 10th ACM International on Conference on emerging Networking Experiments and Technologies. CoNEXT '14. New York, NY, USA: ACM. pp. 13–20. CiteSeerX 10.1.1.673.2243. doi:10.1145/2674005.2674998. ISBN 978-1-4503-3279-8. S2CID 11871353.
24. Lanzisera, S.; Zats, D.; Pister, K.S.J. (2011-03-01). "Radio Frequency Time-of-Flight Distance Measurement for Low-Cost Wireless Sensor Localization". IEEE Sensors Journal. 11 (3): 837–845. Bibcode:2011ISenJ..11..837L. doi:10.1109/JSEN.2010.2072496. ISSN 1530-437X. S2CID 15835286.
25. "Infosecurity Blogs". Infosecurity Magazine. Retrieved 2015-09-17.
26. Google Help - Location-based services - How do I opt out? Obtained 2012-05-30
27. "MLS-Opt-Out". mozilla.com. Retrieved 2 September 2014.
28. "Combain Positioning Service". Retrieved 2019-01-03.
29. "Wifi Positioning | Wifi Location | Cell ID - Combain". Retrieved 2019-01-03.
30. "Unwired LocationAPI Coverage". Retrieved 2017-06-06.
31. API, Unwired. "Unwired Labs Location API - Geolocation API and Mobile Triangulation API, Cell Tower database". Unwired Labs Location API - Geolocation & Mobile Triangulation API. Retrieved 2017-06-06.
32. "Mylnikov GEO Wi-Fi". Retrieved 2015-05-19.
33. "Mylnikov GEO Wi-Fi Database Download". Retrieved 2015-05-19.
34. "Mylnikov GEO license". Retrieved 2014-12-19.
35. "Mylnikov GEO Mobile Cells Database". Retrieved 2014-12-19.
36. "Navizon Global Positioning System". Archived from the original on 2021-01-19. Retrieved 2015-06-21.
37. "Navizon WiFi Coverage Map". Archived from the original on 2015-06-22. Retrieved 2015-06-21.
38. "Radiocells.org". Archived from the original on 2018-05-21. Retrieved 2018-07-06.
39. "Radiocells.org Database Download". Archived from the original on 2016-03-08. Retrieved 2018-07-06.
40. "Wifi Access Point finder". Archived from the original on 2016-02-08. Retrieved 2015-01-30.
41. "Radiocells.org license". Archived from the original on 2019-09-22. Retrieved 2018-07-06.
42. "WiGLE". Retrieved 2014-12-19.
43. "WiGLE Stats". www.wigle.net. Retrieved 2018-12-24.
44. "WiGLE Wireless Network Map". Retrieved 2014-12-19.
45. "On _nomap and _optout - WiGLE.net". www.wigle.net. Retrieved 2019-09-15.
46. "beaconDB". Retrieved 2024-11-15.
47. "beaconDB". Retrieved 2024-11-15.

General

• Anthony LaMarca, Yatin Chawathe, Sunny Consolvo, Jeffrey Hightower, Ian Smith, James Scott, Tim Sohn, James Howard, Jeff Hughes, Fred Potter, Jason Tabert, Pauline Powledge, Gaetano Borriello, Bill Schilit: Place Lab: Device Positioning Using Radio Beacons in the Wild. In Pervasive (2005)