Description
Access decisions based on physical proximity can be defeated by relaying the exchange
between devices. Distance bounding times a challenge, and its response, so the roundtrip
bounds how far away the prover can be. Two ESP32-C3 devices timed that exchange
over a fixed 10m report, ranging from 16.84m to 36.66m at twelve positions in one
corridor. Within a single position, the measurement is stable to within 1.03m to 1.36m,
so the error is due to the position rather than the device, and no single constant
calibrates it away.
This thesis asks whether such a corrupted measurement can be recognized from
the channel state information of the frames used to compute it. The timestamping
firmware this work builds on was extended to report that information alongside every
distance measurement Six scorers reduce each channel measurement to a single number,
evaluated against labels derived from the measured range, and each scorer and its gate
were fixed in one corridor and applied unchanged elsewhere.
Measurements were recorded at about ten positions in each of three environments.
All six scorers separate the inflated distance measurements from the rest of their
environment, reaching AUCs between 0.811 and 0.947, and filtering with the strongest
reduces the pooled standard deviation in a corridor from 5.36m to 1.94m against a
noise floor of 1.20m. Filtering buys precision, not accuracy, because an offset shared by
every position in an environment survives it. Thus, a measurement that passes the gate
is not thereby accurate.
|
