Tracking WiFi Signals to Passively See Through Walls

University College London (UCL) researchers are investigating passive radar technologies that can see through walls using WiFi radio waves. The novel research required a real-time, passive (non-cooperative) wireless target detection demonstration system capable of tracking moving bodies through walls and obstacles. Much like traditional radar systems, the approach still relies on detecting the Doppler shifts in radio waves as they reflect off moving objects. However, unlike traditional radar systems that actively transmit radio waves, the passive system relies on the existing WiFi signals that already swamp our airwaves. The complete lack of spectrum occupation and power emission ensures the radar is undetectable, making it ideal for military or security surveillance in urban settings.

Figure 1. Hostage situation monitoring using the radar system.
Aside from public defense applications, the passive detection could be applied in a broad range of scenarios, including crowd and traffic monitoring and human-machine interfacing. Different types of wireless signals can be applied to different situations. For example, the system could acquire IEEE 802.11x signals to detect indoor moving targets for security purposes such as hostage situations. Alternatively, the same system could monitor cellular signals such as Global System for Mobile Communications (GSM) or Long-Term Evolution (LTE) to detect direction and velocity of moving vehicles before triggering an appropriate machine response to the detected movement.

Maximizing the versatility of the radar system requires multiple channels for compatibility with multiple frequency bands. The system should be flexible enough to work with almost any type of WiFi signal, as well as FM and cellular signals. This relies on flexible RF hardware that can accommodate wide frequency ranges, in addition to easily reconfigured signal-processing software.

Passive Wireless Detection System Based on USRPs

In order to accurately capture target movement, at least two receiver channels were required for frequency-time processing, known as ambiguity analysis. One channel locks onto the base radio signal from the direct path to a local wireless signal transmitter (such as a WiFi router) — this becomes the reference channel. The other receiver channel measures the reference signal as it reflects off a moving target — this is the surveillance channel. At the simplest level, the reference and surveillance signals can be compared to ascertain velocity and position of a detected target. However, in reality, this requires advanced ambiguity analysis, cross-correlation, Fourier transformation, and intelligent error detection.

Figure 2. Detecting a walking person through a wall (scenario 1).
For the research, a two-channel demonstration system was built that used any available WiFi (IEEE 802.11x) signal to detect moving objects or bodies behind closed doors. At the heart of the system were two USRP-2921 RF transceivers used to receive the reference and surveillance signals. Not only did the USRPs meet accuracy and frequency range requirements, but their software-defined nature helped rapidly iterate algorithm designs.

From a software perspective, Lab-VIEW from National Instruments (Austin, TX) was chosen. The required ambiguity analysis, which includes indepth vector calculations and visualization, required complex, multithreaded processing operations, which would be difficult to implement in traditional textual languages. Since LabVIEW is an inherently multithreading development tool, it reduced code complexity. This, combined with other features, including intuitive graphical programming and built-in design patterns, reduced development time by weeks.

The NI USRP platform is available on multiple frequency bands, covering 50 MHz to 5.9 GHz, so the passive radar system could cover a range of wireless signals including FM, GSM, LTE, IEEE 802.11x, IEEE 802.16, and digital audio broadcasting (DAB) or digital video broadcasting (DVB). On each frequency band, a 20-MHz baseband I/Q bandwidth streaming at 25 MS/s was used for host-based processing with LabVIEW. The bandwidth is large enough to capture the widest communication signals used for the passive target detection demo.

Besides wide-frequency band coverage, another advantage of USRP is that it includes a dedicated port for daisy-chaining and synchronizing advanced multiple input, multiple output (MIMO) systems. This will be very useful as the radar system is extended for future research.

Figure 3. Detecting a body gesture of a human subject through a wall (scenario 2).
To program the USRP, LabVIEW provides an API that enabled researchers to open, configure, and initiate receiver sessions; set parameters such as center frequency, IQ sampling rate, channel gain, and length of samples; and receive data from the air. The API offers complex double and half-precision floating-point data for adapting to different processing accuracy and speed requirements. Once acquired, ambiguity processing is applied to IQ data using the mathematics and signal processing tools in LabVIEW.

With USRP and LabVIEW, the passive wireless detection demo was built and tested very quickly. Using functions built into LabVIEW, a series of vector operations, such as array subset, indexing array, array reshaping and analysis, could be implemented efficiently in a single block. Tailored fast Fourier transforms using built-in LabVIEW signal processing functions saved computing and programming time.

Following time-frequency ambiguity analysis, a threshold was applied that dynamically changes with the environment to processed signals to determine whether the detected result is a real target or false alarm.

Proving the Concept

Two detection scenarios were used to demonstrate the capabilities of the designed system. The first scenario was to detect a walking person using WiFi signal emissions from a common WiFi access point (AP) that has 15 dBm. In the experimental setup, a 25-cm-thick brick wall separated the reference and surveillance antenna from the person and the WiFi AP (Figure 1). Both reference and surveillance signals are digitized by the USRPs and processed in LabVIEW.

The second scenario was to detect body gestures through the wall using the same experimental environment. The difference between these two scenarios is type and magnitude of human target movement. In order to detect the small movement in the second scenario, different software processing parameters are used for longer integration time and lowered detection thresholding.

Figure 2 shows the detection results for scenario 1, where a person is walking back and forth. The LabVIEW front panel presents the instant Doppler surface results (upper left), determined target (upper middle), spectrum of the target range bin (upper right), Doppler record showing a 60-minute detection history (bottom left), and target intensity index record (bottom right). The threshold is applied on the target intensity index, so when a detected signal exceeds a certain level, the system will treat the current detection as a valid target. The Doppler record graph (bottom left) shows clear positive and negative Doppler shifts, which correspond to forward and backward walking directions.

Figure 3 shows the detection results of smaller body movements as a person transitions from squatting to standing stances. In this case, the system can recognize less than 1 Hz Doppler discrepancies caused by the small disturbance. Each periodic wave represents a detected squatting-standing gesture cycle, where a positive Doppler shift means that a certain body part is approaching the surveillance antenna. The radar system has progressed to detect even smaller movements, such as hand gestures.

Experimental results gained via the USRP-based radar system have definitely proven the concept of throughwall passive WiFi sensing. In addition, with the high sensitivity of the NI solution, smaller movements than we initially thought possible can be detected.

This article was written by Bo Tan of University College London using software and hardware from National Instruments. For more information, Click Here .