You are on page 1of 55

A Dataless Wi-Fi

Positioning System
Blair Wyatt (@BleckyWhat)
SUBPOS IS
ENABLED IN
THIS VERY
ROOM!
Download the Android Demo*:
http://subpos.org/apk.htm

2
* Now with 312% more intentional features!
WHAT IS
SUBPOS?

SubPos is an extensible, open


source Wi-Fi positioning
standard that can be used
anywhere GPS or data
connectivity doesnt exist.

3
WHY WAS The initial concept came about during a
SUBPOS
caving expedition.
DEVELOPED?

SubPos was created to fill a gap in the


market for open source indoor
positioning, that doesnt require data
connectivity.

No longer have to send your position to


big data, while maintaining backwards
compatibility with many devices on the
market.
4
CONCEPT How can you enable GPS like
positioning in a subterranean
environment?*

The coding scheme is based on a


Microsoft Research paper about
transmitting data over SSIDs; Beacon-
Stuffing: Wi-Fi Without Associations.

Send your position without having to


associate to the AP, by encoding your
position in the SSID.
5
* SubPos Subterranean Positioning
WHAT IT SubPos is a standard for
PROVIDES
transmitting position information via
Wi-Fi, for use in client side
trilateration.

Extensible (for adding functionality


such as time-of-flight).

Designed to work with most Wi-Fi


hardware (APs, embedded IoT
devices, clients/receivers).
6
WHAT IT It isnt used for client tracking. You
DOESNT
would need to develop a client side
application to do this or use an
alternative analytics platform
(Ciscos CMX).

It isnt a calibrated system for use


with tight positioning requirements
(the SubPos Node helps provide a
solution to this however).
7
HOW IT
WORKS

8
BEACON
FRAME
(SSID)
ENCODING

* Unique to an area, not necessarily the entire world. Generally unique for an
Application ID (unless 0x0).

~ Should be height of floor relative to height of mean sea level, not where
the node/access point is mounted, unless 3D location is enabled.

^ Decimal value is offset by +100.0 to create unsigned value (dBm; -100bDm


is the minimum 802.11 receive strength, 23dBm is the maximum; note, this
doesn't relate to RSSI maximums and minimums).

Beacon frames must be sent at a minimum rate of 1mbps and 802.11b to


9 normalise RSSI across all devices.
TRI- Trilateration is (not triangulation):
LATERATION
The process of determining absolute or
relative locations of points by
measurement of distances, using the
geometry of circles. Wikipedia

Distance calculation through RSSI:


Knowledge of the transmitter output
power, cable losses, and antenna gains as
well as the appropriate path loss model
allows you to solve for the distance
between two stations. Cisco
10
TRI- RSSI distance calculations uses the free
LATERATION
space path loss formula:
4 2
= 1010 ( )

If = then:
4
1010
10
= 10 20

in this instance is a constant derived from


empirical modelling.
11
TRI- Once distance is determined, a circular
LATERATION
area around the access point can be
plotted (distance == radius). With a
single access point, the location of the
device is believed to be somewhere on
this circular plot.

R1

T1

12
TRI-
LATERATION

R2

T2
R1

T1

T3 R3

Intersection

13
DEVELOPMENT ISSUES

14
31 OCTETS
Some embedded platforms
only allow 31 octets of data in the
SSID (e.g. ESP8266).

This is probably why:

#include <string.h>

char ssid_buf[32]; //SSID is 32 bytes


char ssid[] = "Get off my LAN!";
strcpy(ssid_buf, ssid);
15
ONLY
ALLOW
This is what happens when you
ASCII CHARS use non ASCII SSID chars in the
Android ScanResult class:
Hex: SSID Value:
0x00
0x00
0x63
0x3b
0x15
0x0b
0x07
0x3b
0x76
0xff
0x31
0x07
0x5b
0xcd
0x15
0x9c
16 0x80
0x07
ONLY
ALLOW
Android handles SSID
ASCII CHARS
characters as UTF-8?!?!?!
This is NOT as per the Wi-Fi
standard:
SSIDs are NOT a string of human-
readable chars terminated by a NUL
char.
SSIDs MUST be treated as they are, a
series of 32 OCTETS!

17 How do we work around this?


ONLY
ALLOW
We could utilise the wifiSsid
ASCII CHARS object in Android by enabling a
hidden API*:

18
*https://github.com/android/platform_frameworks_base/blob/master/wifi/java/android/net/wifi/WifiSsid.java
ONLY
ALLOW
ASCII CHARS

19
ONLY
ALLOW
However, hidden APIs are
ASCII CHARS painful for developers to
implement and could become
deprecated.

Instead, SubPos encodes out


octets whose hex values are
greater than 0x7f, for better
cross platform compatibility and
20 to ignore this issue altogether.
ACCOUNT
FOR INVALID
Some access points dont
CHARS handle/accept certain
characters in the SSID.
ESP8266:
LF - 0x0A
CR - 0x0D
" - 0x22
+ - 0x2B
OpenWRT:
nul- 0x00*
sp - 0x20
21
* I smell a strcpy
ACCOUNT
FOR INVALID
If invalid character is present,
CHARS increment octet value:

22
http://ascii-table.com
ACCOUNT
FOR INVALID
This permits different invalid
CHARS character sets for different
access points and still allows it to
be decoded by any client device.
The chance that there are two
invalid character octets adjacent
to each other for a given device
are very slim.
If there are, the access point
isnt supported.
23
HOW DO WE ASCII Mask Invalid Char Mask
ACHIEVE
CODING? (24 bits) (32 bits)

if char > 0x7f then: if char == invalid then:

Change MSB to 0 Increment char by 1


and set and set
corresponding bit in corresponding bit in
mask. mask.
Note that the masks, mask themselves. The masks waste 7 bits to
always encode as ASCII (MSB is always 0) and the last 4 bits are
used to apply the invalid char mask bits to itself.
More info -
24 http://wiki.subpos.org/index.php?title=Coding_Mask_Calculation
WHY Why encode and not just store strings
CUSTOM
ENCODE? or use base64/other encoding?

Well you could use each character to


store fixed digit string representations:
SPS:-11999999+111999999-1199999

But you dont maximise the space to


store things.

Plus, some of those characters could


25 be invalid (e.g. + on the ESP8266).
Android API

26
EASY TO USE To integrate SubPos into an existing Android positioning
application, all you need to do is initialise the API like so:

public class yourClass extends Activity {


SubPos subpos;
@Override public void onCreate(Bundle
savedInstanceState)
{
super.onCreate(savedInstanceState);
setContentView(R.layout.main); //Create new SubPos service
subpos = new SubPos(this); //"this" passes the
//activity's context
}

Then to get your position, call:


subpos.getPosition();

This class could be used to provide data to a Network


27 Location Provider.
INTEGRATE
INTO
MAPPING Node
Details
APPS

Error
Indication
Position

28
SUBPOS USING ESP8266

29
ESP8266
CONFIG
4 AP/Node setup for about $12
inc. shipping.
Works with default AT firmware.
New firmware created to only
generate beacon frames (secure,
lower power) using recently
released (and subsequently
removed) function:

wifi_send_pkt_freedom()
30
ESP8266
CONFIG

AT+CWSAPID="[ssid]",[channel_num]

AT+CWSAPID="\x53\x50\x53\x01\x01\x01\x69\x43\x79\x
31 5a\x56\x0b\x43\x4e\x01\x01\x01\x01\x01\x7a\x04\x2c
\x40\x01\x08\x10\x14\x60\x07\x65\x01,1
THE SUBPOS NODE

32
THE SUBPOS
NODE

The SubPos Node is


a low cost, low
power, calibrated
beacon source for
use where Wi-Fi
constellations* are
sparse or non
existent.

33
* Collection of access points in a given area.
THE SUBPOS Features:
NODE

Easy Config Menu


USB Power
USB to UART
USB Firmware
Updates
Frequency Shifting
Secure (only
generates beacon
frames).
34 Open Source
NODE
ACCURACY

35
NODE
ACCURACY
~a few meters-ish accuracy

36
NODE
FREQUENCY
HOPPING

37
POSITIONING
DEMONSTRATION

38
DEMO

39
WHAT DOESNT WORK

40
iOS
SUPPORT
The Wi-Fi scanning API is a
private framework and Apps
that use it are not allowed in
the Apple iOS App Store .

However, enterprise
distribution Apps can use
private APIs.

41
SUBPOS RANGER

42
SUBPOS
RANGER
The SubPos Ranger is a ranging
system based on 802.15.4 for use
with the SubPos Positioning
System.

The Ranger extends on to any


SubPos enabled access point or
Node for enhanced distance
calculations and better
positioning accuracy (+-10cm).
43
RANGER
HARDWARE
Based on Atmel AT86RF233.

Supports distance calculation


through Time of Flight Module or
Phase Measurement Unit.

Supports antenna/phase
diversity with multiple antennas,
for mitigation of multipath
44 effects (when no Line Of Sight).
RANGE Range Module Receiver
MODULE
AND
RECEIVER

45
EXTENDED
DISTANCE
RECEIVER
CALC

46
RANGING
CURRENTLY
RUNNING
ON ATMEL
ZIGBIT

47
FUTURE WORK

48
ROOM Ability to zone an
ZONING
area to increase
accuracy in tight
spaces.

Ignore nodes not


in the clients
current zone
(specified cutoff
value).

49
SELF Access points or nodes can be
POSITION
LEARNING placed into learning mode.
MODE
Enables them to determine their
position from other Nodes over time,
for easy deployment of new beacon
sources.

Learning should only be enabled on a


beacon source when there are
sufficient Nodes to create a reference
50
position from.
BREAD- Use the SubPos Node like
CRUMB
MODE breadcrumbs.

Can be used to tag rooms or areas


and be combined with topological
maps (approximate placement) to
provide course positioning data.

51
CONFIG Remotely configure
MODE
SubPos Nodes.
Nodes scan for
config frame.
Android application
for config.
Auto tweak path
loss selection.
Config with
smartphone position
if available.

52
COMPARED
TO iBEACON
No (even offline) database
AND required, positioning is performed
OTHERS
passively client-side in real-time.
No need to labouriously profile
Wi-Fi signals in an area (plug and
play).
Works with most existing Wi-Fi
infrastructure.
No hardware or vendor lock-in.
Open source!
53
WHY SubPos is designed to be backwards
SUBPOS?
compatible with a vast majority of existing
devices.

Very fast acquisition time (<~2 secs).

Low location latency (client side


trilateration, so no connecting to server to
work out position).

No data connectivity/association
required, so you arent giving your position
54 away to big data (unless you want to).
0x74 0x68 0x61 0x6e 0x6b
0x79 0x6f 0x75
Any feedback or questions?

@BleckyWhat
blecky@subpos.org
http://www.subpos.org
http://github.org/subpos

You might also like