A “Dataless” Wi-Fi Positioning System

Blair Wyatt

2

SUBPOS IS ENABLED IN THIS VERY TENT!

Download the Android Monitor Demo*:

http://subpos.org/apk.htm

* Now with 200% more bugs!

WHAT IS SUBPOS?

SubPos is an open source Wi-Fi positioning standard that can be used anywhere

GPS or data connectivity doesn’t exist.

3

4

WHY WAS SUBPOS DEVELOPED?

▸ The initial concept came about during a caving expedition.

▸ SubPos was created fill a gap in the market for open source indoor positioning, that doesn’t require data connectivity.

▸ No longer have to send your position to big data, while maintaining backwards compatibility with many devices on the market.

5

CONCEPT ▸ How can you enable GPS like positioning in a subterranean environment?*

▸ SubPos is based on a Microsoft Research paper about transmitting data over SSIDs; “Beacon-Stuffing: Wi-Fi Without Associations”.

▸ Send your position without having to associate to the AP, by encoding your position in the SSID.

* SubPos – Subterranean Positioning

6

HOW IT WORKS

7

BEACON FRAME (SSID) ENCODING

* Unique to an area, not necessarily the entire world. Generally unique for an Application ID (unless 0x0).

~ Should be height of floor relative to height of mean sea level, not where the node/access point is mounted, unless 3D location is enabled.

^ Decimal value is offset by +100.0 to create unsigned value (dBm; -100bDm is the minimum 802.11 receive strength, 23dBm is the maximum; note, this doesn't relate to RSSI maximums and minimums).

Beacon frames must be sent at a minimum rate of 1mbps and 802.11b to normalise RSSI across all devices.

8

WHAT IT IS ▸ SubPos is a standard for transmitting position information via Wi-Fi, for use in client side trilateration.

▸ Extensible (for adding functionality such as time-of-flight).

▸ Designed to work with most Wi-Fi hardware (AP, embedded IoT devices, clients).

9

WHAT IT ISN’T

▸ It isn’t used for client tracking. You would need to develop a client side application to do this or use an alternative analytics platform (Cisco’s CMX).

▸ It isn’t a calibrated positioning system for use with tight positioning requirements (the SubPos Node helps provides a solution to this however).

10

DEVELOPMENT ISSUES

11

31 OCTETS ▸ Some embedded platforms only allow 31 octets of data in SSID (e.g. ESP8266).

▸ This is probably why:

#include <string.h>

char ssid[] = "Get off my LAN!"; char ssid_buf[32]; strcpy(ssid_buf, ssid);

12

ONLY ALLOW ASCII CHARS

▸ This is what happens when you use non ASCII SSID chars in the Android ScanResult class: Hex:

0x000x000x630x3b0x150x0b0x070x3b0x760xff0x310x070x5b0xcd0x150x9c0x800x07

SSID Value:

13

ONLY ALLOW ASCII CHARS

▸ Android handles SSID characters as UTF-8?!

▸ This is NOT as per the Wi-Fi standard:▹ SSIDs are NOT a string of

human-readable chars terminated by a NUL char.

▹ SSIDs MUST be treated as they are, a series of 0 to 32 OCTETS!

▸ How do we work around this?

14

ONLY ALLOW ASCII CHARS

▸ We could utilise the hidden wifiSsid object by enabling a hidden API*:

*https://github.com/android/platform_frameworks_base/blob/master/wifi/java/android/net/wifi/WifiSsid.java

15

ONLY ALLOW ASCII CHARS

16

ONLY ALLOW ASCII CHARS

▸ However, hidden APIs are difficult for developers to implement.

▸ Instead, SubPos omits octets whose hex values are >0x7f, for greater cross platform compatibility.

17

INVALIDCHARS

▸ Some access points don’t allow certain characters.

ESP8266:LF - 0x0ACR - 0x0D

" - 0x22+ - 0x2B

OpenWRT:nul- 0x00

sp - 0x20

18

INVALID CHARS

▸ If invalid char is present, increment octet value:

http://ascii-table.com

19

INVALID CHARS

▸ This allows different invalid chars for different access points and still allow it to be decoded by any device.

▸ The chance that there are two invalid character octets next to each other for a given device are very slim.

▸ If there is, the AP isn’t supported.

20

▸ ASCII Mask (24 bits)

if char > 0x7f then:

Change MSB to 0 and add bit to mask.

▸ Invalid Char Mask (32 bits)

if char == [item in forbidden list] then:

Increment char by 1 and add bit to mask.

HOW DO WE ACHIEVE CODING?

Note that the masks, mask themselves. The mask wastes 7 bits to always encode as ASCII (MSB is always 0) and the last 4 bits are used to apply the invalid char mask to itself. More info - http://wiki.subpos.org/index.php?title=Coding_Mask_Calculation

21

WHY CUSTOM ENCODE?

Why encode and not just store strings or use base64/other encoding?

Well you could use each character to store fixed digit string representations:

SPS:-11999999+111999999-1199999

But you don’t maximise the space to store things.

Plus, some of those characters “could” be invalid (e.g. + on the ESP8266).

22

Android API

23

EASY TO USE

To integrate SubPos into an existing Android positioning application, all you need to do is initialise the API like so:

Then to get your position, call:

24

INTEGRATE INTO MAPPING APPS

25

SUBPOS USING ESP8266

26

ESP8266 CONFIG

27

THE SUBPOS NODE

28

Features:

▸ Easy Config Menu

▸ USB Power▸ USB to UART

Built In▸ USB Firmware

Updates▸ Frequency

Shifting

THE SUBPOS NODE

29

NODE ACCURACY

30

NODE ACCURACY

▸ +-0.5m Accuracy

31

FREQUENCY HOPPING

32

POSITIONING DEMONSTRATION

33

DEMO

34

WHAT DOESN’T WORK

35

NON JAILBROKEN iOS SUPPORT

▸ The Wi-Fi scanning API is a private framework and apps that use it are not allowed in the Apple App Store.

▸ Enterprise distribution can however use private APIs.

36

FUTURE WORK

37

PURE RF SOLUTION – TIME OF FLIGHT

▸ Shift away from ESP8266 modules.

▸ Closed ESP8266 source limits tight beacon control.

▸ Pure RF solution will generate raw beacon frames.

▸ Much lower power.

38

▸ Remotely configure SubPos Nodes.

▸ Nodes scan for config frame.

▸ Android application for config.

▸ Auto tweak path loss selection.

▸ Config with smartphone position if available.

CONFIG MODE

39

SUBPOS RECEIVER

▸ Implement time of flight.▸ Highly accurate.▸ Low cost.▸ Connect to drones or

robots with NMEA data.

40

▸ Ability to zone an area to increase accuracy in tight spaces.

▸ Ignore nodes not in the client’s current zone.

ROOM ZONING

41

IMPROVED POSITIONING API

▸ Dead reckoning for improved path accuracy.

▸ Better averaging and trilateration.

▸ Error circle indication.

42

SELF POSITION LEARNING MODE

▸ Access points or nodes can be placed into learning mode.

▸ Enables them to determine their position from other Nodes over time, for easy deployment of new beacon sources.

▸ Learning should only be enabled on a beacon source when there are sufficient Nodes to create a reference position from.

43

BREAD-CRUMB MODE

▸ Use the SubPos Node like breadcrumbs.

▸ Can be used to tag rooms or areas and combined with topological maps (approximate placement) to provide course positioning data.

44

WHY SUBPOS?

▸ SubPos is designed to be backwards compatible with a vast majority of devices.

▸ Very fast acquisition time (~2 secs).

▸ Low location latency (client side trilateration, so no connecting to server to work out position).

▸ No data connectivity required, so no giving your position to big data (unless you want to).

45

COMPARED TO iBEACON AND OTHERS

▸ No (even offline) database required, positioning is performed client-side in real-time.

▸ No need to labouriously profile an area.

▸ Works with existing Wi-Fi infrastructure.

▸ Wi-Fi’s larger range and filtering can offer better performance.

▸ No hardware or vendor lock-in.▸ Open source!

[insert thankyou]!

Any feedback or questions?

▸ @BleckyWhat

▸ blaircwyatt@gmail.com

▸ http://www.subpos.org