⚡ electrical engineering

Physical Layer Authentication With Channel Knowledge Maps in Indoor Environments

This paper proposes a physical layer authentication mechanism for moving devices in indoor environments that leverages channel knowledge maps to validate dominant channel tap path loss and angle of arrival measurements against historical data, demonstrating its effectiveness and security against various attacks through numerical simulations.

Original authors: Luca Bonaventura, Francesco Ardizzon, Stefano Tomasin

Published 2026-06-26

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Luca Bonaventura, Francesco Ardizzon, Stefano Tomasin

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to verify that a friend is who they say they are, but you can't see them. Instead, you have to guess their location based on how their voice sounds in a specific room.

This paper presents a new way to do exactly that for wireless devices (like smartphones) moving around inside a building. Here is the breakdown using simple analogies:

The Problem: The "Echo Chamber" Challenge

In the old days, to prove you are who you are, you needed a password (like a digital key). But passwords can be stolen or guessed.

This paper suggests using Physical Layer Authentication (PLA). Instead of a password, the system uses the unique "fingerprint" of the radio waves traveling through the air.

The Analogy: Imagine shouting in a specific room. The way your voice bounces off the walls, the furniture, and the people creates a unique echo pattern. If you move to a different spot in the room, the echo changes.
The Issue: In a busy indoor environment (like an office with desks and people walking by), these echoes are chaotic and change constantly. It's hard to predict exactly what the "echo" should sound like if you are moving. Traditional methods get confused when the signal gets blocked by a chair or a person.

The Solution: The "Digital Map" (Channel Knowledge Map)

The authors propose a solution called a Channel Knowledge Map (CKM).

The Analogy: Think of the CKM as a highly detailed, pre-drawn treasure map of the room. This map doesn't just show where the walls are; it predicts exactly what the radio "echo" (signal strength and angle) should look like from every single square inch of the floor.
How it works:
1. The Map: Before the security check, the system builds this map using computer simulations (ray tracing) that mimic how radio waves bounce around the room.
2. The Check: When a device (let's call her "Alice") sends a signal, the system measures the actual echo.
3. The Comparison: The system looks at the map. It asks: "Alice was here a second ago. Based on her speed, she could only be in this small square area now. Does the echo she is sending right now match the echo predicted by the map for that specific square?"
4. The Verdict: If the echo matches the map, it's Alice. If the echo sounds like it's coming from a different part of the room (or doesn't match the map at all), it's an imposter.

The Villain: The "Imposter" (Trudy)

The paper tests this system against a hacker named "Trudy" who wants to pretend to be Alice. The authors tested three ways Trudy might try to fool the system:

The Random Guess: Trudy stands somewhere random in the room and shouts. (This is like guessing a password randomly).
The Informed Cheat: Trudy has a copy of the map. She knows where Alice was, so she tries to stand in a spot nearby that has a similar echo pattern to Alice's.
The Super-Imposter: Trudy has the map and can teleport instantly to anywhere in the room to find the perfect spot that mimics Alice's echo.

The Results: How Well Did It Work?

The researchers ran computer simulations of a room with furniture and walls to see if their "Map Check" could catch Trudy.

Against Random Guesses: The system was very good at catching Trudy. It could tell the difference between Alice and a random guesser almost perfectly (with very few mistakes).
Against the Super-Imposter: Even when Trudy had the map and tried to find the perfect hiding spot, the system was still quite effective. It successfully identified the fake signal most of the time.
The "Worst-Case" Defense: The authors also tested a stricter version of the test (called GLRT) that assumes Trudy is a genius. While this made the system slightly more sensitive to random noise, it was still very good at catching the smartest attackers.

The Bottom Line

This paper shows that by using a pre-made "radio echo map" of a room, we can securely verify that a moving device is who it claims to be, even in a messy indoor environment with furniture and people. It doesn't need complex passwords; it just needs to know how the room sounds.

What the paper does NOT claim:

It does not say this technology is ready for your phone today.
It does not discuss using this for medical devices or critical life-support systems.
It does not claim to solve all security problems, only the specific problem of verifying a moving user's location via radio waves in a building.

Technical Summary: Physical Layer Authentication With Channel Knowledge Maps in Indoor Environments

Problem Statement
Physical Layer Authentication (PLA) typically authenticates users by comparing channel measurements over time, relying on assumptions of time consistency or modeled evolution. However, these assumptions become problematic for mobile devices in indoor environments. In such settings, multipath propagation and signal obstructions (e.g., furniture, people) cause non-line-of-sight (NLoS) components to dominate, making the channel statistics time-varying and difficult to model analytically. Existing PLA methods struggle to obtain the necessary a priori analytical models for verification when users are mobile or in complex indoor spaces. Furthermore, while Channel Knowledge Maps (CKMs) have been proposed for environmental-aware communication, their application to authentication remains under-explored, particularly for moving devices where the verifier does not know the user's exact trajectory in advance.

Methodology
The paper proposes a PLA mechanism for moving devices in indoor environments that leverages pre-collected Channel Knowledge Maps (CKMs) to eliminate the need for an analytical channel model.

System Model: The scenario involves a verifier (Bob) controlling multiple Access Points (APs) with Uniform Linear Arrays (ULAs), and two single-antenna users: a legitimate user (Alice) and an attacker (Trudy). The APs estimate the dominant channel tap's Path Loss (PL) and Angle of Arrival (AoA) from received pilot signals.
Channel Knowledge Map (CKM): Bob possesses a noiseless CKM derived (e.g., via ray tracing) that maps user locations $p$ to expected channel features $\phi(p) = \{r(p), \theta(p)\}$ , where $r$ is PL and $\theta$ is AoA.
Movement Constraints: Alice's exact trajectory is unknown to Bob and Trudy. However, both know Alice's maximum velocity $\nu$ . Consequently, at any time step $k$ , Alice's position is constrained to a square window $P_k$ centered at her previous estimated position.
Authentication Mechanism:
1. Bob estimates the current channel features $\hat{\phi}^{(k)}$ from the received signal.
2. Bob performs a hypothesis test to decide if the signal originates from Alice ( $H_0$ ) or Trudy ( $H_1$ ).
3. Two testing approaches are evaluated:
  - Likelihood Test (LT): Computes the maximum likelihood of the observation given that the user is within the valid movement window $P_k$ .
  - Generalized Likelihood Ratio Test (GLRT): Compares the maximum likelihood within $P_k$ against the maximum likelihood outside $P_k$ (representing the worst-case attack).
4. If the test statistic exceeds a threshold $\xi$ , the signal is authenticated, and Alice's position is updated via a Maximum A Posteriori (MAP) procedure.
Attack Strategies: The authors analyze three attack vectors:
1. Random Position: Trudy transmits from a random location in the room.
2. Informed Attack: Trudy knows the CKM and Alice's previous position, moving to the optimal location within a limited window $W_T$ to maximize spoofing success.
3. Full Map Attack: Trudy has full knowledge of the CKM and can instantly move to any position in the room (excluding $P_k$ ) to maximize the likelihood of the spoofed signal.

Key Contributions

Novel Protocol: The paper designs a PLA protocol specifically for moving devices in indoor environments that utilizes CKMs to bypass the need for complex analytical channel modeling.
Security Analysis: A comprehensive security analysis is conducted under both random and optimal (informed/full map) attack scenarios.
Comparative Testing: The study compares the performance of LT and GLRT, analyzing their respective vulnerabilities to different attack types.
Validation: The approach is validated using numerical results in a representative indoor scenario where CKMs are generated via ray tracing.

Numerical Results
Simulations were conducted in an $8 \times 5 \times 3$ m $^3$ room with 4 APs and 4 antennas each, using MATLAB ray-tracing tools.

Impact of APs and Noise: Authentication performance (measured by Missed Detection vs. False Alarm) improves with an increasing number of APs and decreasing estimation noise. Fewer APs lead to more obstructions and "plateau" behavior in detection performance.
Attack Performance:
- The Random Position Attack yields the worst performance for the attacker.
- The Full Map Attack provides the best performance for the attacker, serving as an upper bound.
- The Informed Attack performance scales with the attacker's movement window ( $W_T$ ). When the attacker moves as much as Alice ( $W_T = W_A$ ), the Missed Detection probability ( $P_{MD}$ ) is approximately $2 \cdot 10^{-2}$ at a False Alarm rate ( $P_{FA}$ ) of $10^{-2}$ .
LT vs. GLRT: Switching from LT to GLRT makes the detector more vulnerable to random position attacks (as the denominator in the GLRT ratio can become small for random measurements) but reduces the success rate of the Full Map Attack. However, GLRT does not completely eliminate the threat of the Full Map Attack.
Overall Effectiveness: In a random-position attack scenario, the system achieves $P_{MD} = P_{FA} = 3 \cdot 10^{-3}$ . Under a full-map attack, the system guarantees $P_{MD} = P_{FA} = 6 \cdot 10^{-3}$ .

Significance and Claims
The authors claim that the proposed approach effectively validates PLA for moving devices in indoor environments by removing the dependency on a priori analytical models. The use of CKMs allows the system to verify consistency between observed channel features and the spatial neighborhood of the user's previously known location. The paper concludes that the protocol is effective against the considered attacks, with numerical results confirming its viability in a ray-tracing simulated indoor environment. The work is presented as a step toward environmental-aware communication in 6G networks, leveraging prior environmental knowledge for security. The authors note that the study focuses on single-step authentication and leaves the analysis of performance over subsequent trajectory steps as future work.