OFDM-based JCAS under Attack: The Dual Threat of Spoofing and Jamming in WLAN Sensing

This study reveals the vulnerabilities of Wireless Local Area Networks (WLAN) sensing, under the scope of joint communication and sensing (JCAS), focusing on target spoofing and deceptive jamming techniques. We use orthogonal frequency-division multiplexing (OFDM) to explore how adversaries can exploit WLAN's sensing capabilities to inject false targets and disrupt normal operations. Unlike traditional methods that require sophisticated digital radio-frequency memory hardware, we demonstrate that much simpler software-defined radios can effectively serve as deceptive jammers in WLAN settings. Through comprehensive modeling and practical experiments, we show how deceptive jammers can manipulate the range-Doppler map (RDM) by altering signal integrity, thereby posing significant security threats to OFDM-based JCAS systems. Our findings comprehensively evaluate jammer impact on RDMs and propose several jamming strategies that vary in complexity and detectability.

Hybrid Fusion for 802.11ax Wi-Fi-based Passive Radars Exploiting Beamforming Feedbacks

Passive Wi-Fi-based radars (PWRs) are devices that enable the localization of targets using Wi-Fi signals of opportunity transmitted by an access point. Unlike active radars that optimize their transmitted waveform for localization, PWRs align with the 802.11 amendments. Specifically, during the channel sounding session preceding a multi-user multiple-input multiple-output downlink transmission, an access point isotropically transmits a null data packet (NDP) with a known preamble. From these known symbols, client user equipments derive their channel state information and transmit an unencrypted beamforming feedback (BFF) back to the access point. The BFF comprises the right singular matrix of the channel and the corresponding stream gain for each subcarrier, which allows the computation of a beamforming matrix at the access point. In a classical PWR processing, only the preamble symbols from the NDP are exploited during the channel sounding session. In this study, we investigate multiple target localization by a PWR exploiting hybrid information sources. On one hand, the joint angle-of-departure and angle-of-arrival evaluated from the NDP. On another hand, the line-of-sight angle-of-departures inferred from the BFFs. The processing steps at the PWR are defined and an optimal hybrid fusion rule is derived in the maximum likelihood framework. Monte-Carlo simulations assess the enhanced accuracy of the proposed combination method compared to classical PWR processing based solely on the NDP, and compare the localisation performance between client and non-client targets.

Maximum Likelihood Alternating Summation for Multistatic Angle-based Multitarget Localization

Recent advancements in Wi-Fi sensing have sparked interest in exploiting OFDM modulated communication signals for target detection and tracking. In this study, we address the angle-based localization of multiple targets using a multistatic OFDM radar. While the maximum likelihood approach optimally merges data from each radar pair comprised by the system, it entails a complex multi-dimensional search process. Leveraging pre-estimation of the targets' parameters obtained via the MUSIC algorithm, our method decouples this multi-dimensional search into a single two-dimensional estimator per target. The proposed alternating summation method allows the computation of a combined likelihood map aggregating contributions from each radar pair, enabling target detection via peak selection. Besides reducing computational complexity, the method effectively captures target interactions and accommodates varying radar pair localization abilities. Also, it requires transmitting only the estimated channel covariance matrices of each radar pair to the central processor. Numerical simulations demonstrate superior performance over existing approaches.

Multistatic OFDM Radar Fusion of MUSIC-based Angle Estimation

This study investigates the problem of angle-based localization of multiple targets using a multistatic OFDM radar. Although the maximum likelihood (ML) approach can be employed to merge data from different radar pairs, this method requires a high complexity multi-dimensional search process. The multiple signal classification (MUSIC) algorithm simplifies the complexity to a two-dimensional search, but no framework is derived for combining MUSIC pseudo-spectrums in a multistatic configuration. This paper exploits the relationship between MUSIC and ML estimators to approximate the multidimensional ML parameter estimation with a weighted combination of MUSIC pseudo-spectrum. This enables the computation of a likelihood map on which a peak selection is applied for target detection. In addition to reducing the computational complexity, the proposed method relies only on transmitting the estimated channel covariance matrices of each radar pair to the central processor. A numerical analysis is conducted to assess the benefits of the proposed fusion.

Deceptive Jamming in WLAN Sensing

Joint Communication and Sensing (JCAS) is taking its first shape in WLAN sensing under IEEE 802.11bf, where standardized WLAN signals and protocols are exploited to enable radar-like sensing. However, an overlooked problem in JCAS, and specifically in WLAN Sensing, is the sensitivity of the system to a deceptive jammer, which introduces phantom targets to mislead the victim radar receiver. Standardized waveforms and sensing parameters make the system vulnerable to physical layer attacks. Moreover, orthogonal frequency-division multiplexing (OFDM) makes deceptive jamming even easier as it allows digitally generated artificial range/Doppler maps. This paper studies deceptive jamming in JCAS, with a special focus on WLAN Sensing. The provided mathematical models give insights into how to design jamming signals and their impact on the sensing system. Numerical analyses illustrate various distortions caused by deceptive jamming, while the experimental results validate the need for meticulous JCAS design to protect the system against physical layer attacks in the form of deceptive jamming.