Assumed that there is a device manager who has a handhold smart terminal device (e.g., a mobile phone) and is in charge of assisting device registration during the registration phase and inputting basic information of the devices into the server database. The manager and server have a pair of public/private key (PKM,SKM) and (PKS,SKS), respectively.

In order to register a new device Devnew with ID IDDev in the system, the manager and the sever perform the following steps:

Step 1. The manager first transmits the identification number IDM (resp. IDDev) of the manager (resp. the device), time stamp T0, and basic information of device BasicInf (e.g., model, function, price, manufacturer, etc.) to the sever with the handhold smart terminal device by using symmetric encryption algorithm AES [42] and RSA-based signcryption scheme RSA-TBOS [43] as follows:

Defining M=<IDM‖IDDev‖T0‖BasicInf>, the manager sends encrypted registration information

(4)Reg=EncKsec(M)‖SignCry(Ksec‖hash(M))to the sever, where EncKsec is the encoding algorithm of AES with secret key Ksec, hash(⋅) is a hash function, and SignCry is the signcryption algorithm of RSA-TBOS.

Step 2. After receiving registration information Reg, the Sever performs the following steps to complete registration:

The sever checks the validity of SignCry(Ksec‖hash(M)).

Step 3. The device manager decrypts IDDev‖K0 from EncKsec(IDDev‖K0), and then transmits IDDev‖K0 to Devnew with an audio-based secure D2D communication [44,45]. The device Devnew stores the section key K0.

If a device Devi is moved from one room (room j1) to another room (room j2), it is required to report it's position to the Sever through the APj2 in the current room as follows:

Step 1. Devi first generates a randomness R0 and transmits the encrypted report information Rep to APj:

(5)Rep=IDDeci‖R0‖EncK0(MRep‖hash(MRep))where MRep=R0‖IDDeci‖IDAPj1‖Time, IDAPj1 is the ID of the AP in the last room, and Time is the time stamp. If Devi is in use for the first time, set IDAPj1 to null.

Step 2. After obtaining Rep from Devi, APj2 sends

(6)RepSign=IDAPj2‖Rep‖SignAPj2(hash(IDAPj2‖Rep))where IDAPj2 is the ID of the AP in the current room, and SignAPj2(⋅) is the signature algorithm [46] with it is private key.

Step 3. When the sever received RepSign from APj2, it performs the following step to complete the location report.

First of all, it verifies the validity of the signature SignAPj2(hash(IDAPj2‖Rep)) with APj2’s public key.

(7)EncSK=EncK0(IDDevi‖IDAPj2‖K1‖hash(IDAPj2‖K1))

Step 4. After receiving EncSK, Devi decrypts IDAPj2‖K1 and hash(IDAPj2‖K1) with session key K0, and checks the consistency between them. If so, Devi stores IDAPj2 and K1 (as the new session key), and sends response

(8)EncK1(R1‖IDAPj2‖hash(R1‖IDAPj2))to sever through APj2, in which, R1 is a random number; if not, it returns Failure to sever through APj2.

Step 5. The sever decrypts R1‖IDAPj2 and hash(R1‖IDAPj2) from Devi’s response, and verifies the consistency between them. If so, the sever stores IDAPj2 as Devi’s new position, K1 as the new session key, and Time as the time stamp; if not, it reports Failure to Devi through APj2.

If the device Devi has been moved in room j and finished the position report, APj needs to monitor if Devi has changed its position and report to the sever if a position change of Devi occurs. In our system, an audio-based location distinction method is proposed, and the framework of the proposed method is shown as follows:

Audio Signal Generation. After finishing the position report, Devi generates an audio signal AudSig and transmits it with it is loudspeaker to APj.

For the details of the audio-based location distinction method, please refer to the next section.

From the discussion above, the vector Φ generated from the received signal is strong correlated with audio-hardware and location. To verify the theoretic result in a real scenario, three experiments are conducted, in which the selected frequencies are from 10 to 16 KHz with the step length 0.2 KHz, and the transmitted audio signal AudSig is the sum of the sine wave at the selected frequencies (i.e., 10, 10.2, … , 16 KHz).

Hardware Signature. In the first experiment, three different smart phones are used to investigate the hardware differences, in which the phone i equipped with Loudspeakeri and Microphonei (i=1,2,3). Fig. 2 plots the vectors Φ(L1,M2), Φ(L2,M3) and Φ(L3,M3), where Φ(Li,Mj) is used to denote the obtained value of Φ with Loudspeakeri and Microphonej. As shown in Fig. 2, the hardware signatures of different loudspeaker and microphone pairs are very clear difference.

Location Signature. In the second experiment, two smart phones (i.e., Phone 1 and Phone 2) are used to study the location differences. Fig. 3 plots the vectors Φ(L1,M2) under four different distances between sender to receiver in the same direction, in which the distances are set to 20, 40, 60, and 80 cm. From Fig. 3, the obtained vectors are completely different in different distances at the same direction. Fig. 4 shows the vectors Φ(L1,M2) in three different directions from receiver in the same distance. It can be seen that the obtained vectors are also different for different directions in the same distances. In summary, location signature of different locations for the same loudspeaker and microphone pair are completely difference.

Based on the discussion above, a novel location distinction scheme are proposed by using the AFR. Besides being able to determine whether a node is moving with location signature, the proposed scheme can also resist node impersonation attacks with the audio hardware signature. The details of the proposed scheme is shown as follows:

Audio Signal Generation. When Devi is moved from roomi to roomj, Devi selects a sequence (α1,α2,…,αN) from [0,1] uniformly at random. And then, Devi generates an audio signal

(9)AudSig=∑n=0Nαn∑s=0Nαssin⁡(2π(φ0+nfΔ)t)for t∈(0,T], where φ0 is the initial frequency, and f△ is the length of step. Here {f0,f1,…,fN} is the set of selected frequencies, in which fn=φ0+nfΔ for n=0,1,…,N.

Hybrid Signature Extraction. After completing the location report phase, Devi transmits audio signals

AudSig‖Chirp‖AudSig‖Chirp‖AudSigwith its loudspeaker to APj, where Chirp is a chirp signal. Note that, a chirp is a signal in which the frequency increases (called up-chirp) or decreases (called down-chirp) with time. When receiving the audio signals

AudSig^0‖Chirp^0‖AudSig^1‖Chirp^1‖AudSig^2with the microphone, APj first extract AudSig^0, AudSig^1, and AudSig^2. Then, APj computes

(10)Φi=20log⁡(FFT(AudSig^i))=<20log⁡Pr(d,f1i),…,20log⁡Pr(d,fni)>for i=0,1,2, where FFT(⋅) is fast discrete Fourier transform algorithm, which transforms the signals from time-domain to frequency domain. Finally, APj obtains the hybrid signature as follows:

Φ=13∑iΦi=<ϕ1,…,ϕn>

Movement Detection. When Devi sends the same audio signal AudSig‖Chirp‖AudSig‖Chirp‖AudSig to APj, APj first extracts the corresponding hybrid signature

Φ′=13∑iΦi′=<ϕ1′,…,ϕn′>where Φi′ is the FFT result from AudSig^i (i=0,1,2). Then APj compares the current signature Φ′ with the previous signatures Φ′ with Euclidean distance:

(11)d(Φ,Φ′)=∑i=1n(ϕi−ϕi′)2

If d(Φ,Φ′) is less than a threshold Δ, then Devi is considered to be static; otherwise, Devi is considered to be moved.

Hypothesis testing is used to decide two hypotheses H0 or H1 is true when the outcome of the measurements is given [47]. Here, a kind of evaluation methodology based on hypothesis testing is discussed to analyse the accuracy of the proposed algorithm. We conduct an experiment to show the distribution of statistics of the Euclidean distance between signature Φ0 of Devi at time slot t0 and Φν at time slot tν in the same location, where ν=1,…,300, and the distance between Devi and APj is 60 cm. From Fig. 5, we can see that the result of this frequency statistic is approximately conforming to Gaussian distribution.

Supposed that G(μ1,δ02) is the distribution of probability of the distance d(Φloc0(0),Φloc0(ν)) between the signature at time slot t0 in location loc0 and the signature at other time slot tν in location loc0, and G(μ1,δ12) is the distribution of probability of the distance d(Φloc0(0),Φloc1(ν)) between the signature at time slot t0 in location loc0 and the signature at other time slot tν in location loc1. Note that, the signature of Devi at location loc0 is different from the signature of Devi at location loc0 and location loc1, where loc0≠loc1. Accordingly, we have μ1>μ0. The location change detection test can be viewed then as a choice between two events H0 and H1.

(12)H0:d(Φloc0(0),Φloc0(ν))≥ΔH1:d(Φloc0(0),Φloc1(ν))<Δ

Then, the false negative probability PFN and false positive probability PFP can be expressed as

(13)PFN=∫−∞x=Δ12πe−(x−μ1)2/2σ12dxPFP=∫x=Δ+∞12πe−(x−μ0)2/2σ02dx

In order to evaluate the performance of the proposed scheme, we design an evaluation methodology as follows:

(14)F1=2/(1/Recall+1/Precision)where Precision=TP/(TP+FP), Recall=TP/(TP+FN), TP means the number of accurate detection with no movement, and FP and FN are the number of false positive error and false negative error, respectively. Specifically, when F1 is calculated to be 1, it means there is no false negative alarm.

In our experiments, several mobile phones (i.e., HUAWEI Mate 40, HUAWEI nova 9pro, and HUAWEI nova 9SE) are used as devices and APs. Note that, due to the limitation of hardware, the maximum frequency of sound produced by a mobile phone is about 16 KHz. Therefore, it selected 31 frequency points ranging from 10 to 16 KHz with steps length of 0.2 KHz in our experiments.

The position change diagram of the device in the experiments is shown in the Fig. 6. We consider the changing of starting position of the device from the 20 to 100 cm with step-length 20 cm in four different directions, where the AP is on the central position. In other words, there are five points for each direction, and each point is 20, 40, 60, 80, and 100 cm away from the central position. The AP records the sound signal from the device to get the 31 results after FFT transformation for each period of time, and then, calculates the Euclidean distance of link signature according to the obtained value. Moreover, we found that the fading of high frequency band is too fast. In order to average the granularity of each frequency, we refer to the experimental test and influence factors of acoustic attenuation model, and change the frequency weight to exponential growth from low frequency to high frequency.

First of all, we discuss how to determine the threshold of the proposed location distinction method. From Figs. 2–4, we have the conclusion that the location signatures have two properties: the aggregation with time difference and the separation with space difference. The conclusion shows that finding a threshold of movement detection is possible.

An experiment is conducted to obtain the Euclidean distance of two signatures under different distance change between device and AP with 20 cm as the step length in each direction. As shown in Fig. 7, the solid black dot means the Euclidean distance of two signatures of the starting position; the red square means the Euclidean distance of two signatures in the starting position and the position at 20 cm, respectively; the red star means the Euclidean distance of two signatures in the starting position and the position at 40 cm, respectively; the blue triangle means the Euclidean distance of two signatures in the starting position and the position at 60 cm, respectively; the green diamond means the Euclidean distance of two signatures in the starting position and the position at 80 cm, respectively; the black circle means the Euclidean distance of two signatures in the starting position and the position at 100 cm, respectively. From this figure, we can find that the Euclidean distance of two signatures increases as the distance between measured positions increases.

In order to obtain a fixed threshold suitable for all distances, the F1 score is studied over a varying threshold under different starting positions. As shown in Fig. 8, we plot the effect of different threshold increments on F1 score under different starting positions. From this figure, it can be seen that, when Δ=15, F1 scores are 1 for different starting positions. It should be noted that, when Δ=15, the false positive alarm is likely to happen. If Δ is set to be 30, there is only one false positive alarm in all the tests. However, the proposed scheme will be less sensitive to movement perception. For instance, in case that the starting position is 40 cm in direction 1, the proposed scheme can detect a movement when the movement distance is up to 40 cm.

Now we discuss the adversary’s replay attacks with an experiment. Assumed that a legitimate device is located 20, 40, and 60 cm in direction 1, and an adversary is located at 5 cm before and after these three points. In this experiment, the adversary records and replays the sound of the legitimate device. The experimental result is shown in Fig. 9, in which the threshold is set to 15. The blue line combination is the sum of the signature of the legitimate device. We can see in the figure that its separation from the purple and black lines from the recording playback of the adversary. By comparing the threshold with the Euclidean distance between signatures from the legitimate device and adversary, it is found that the attack inefficiency is 100%. This test verifies the proposed scheme can against recording replay attacks.

Assumed that the adversary can obtain the original position and the original audio from the legitimate device, an experiment is conduct as follows. A mobile phone is used as the legitimate device at the position 20 cm in direction 1, and another mobile phone is used as the adversary at the position 20 and 2 cm before and after, and 2 cm around. Fig. 10 plots the Euclidean distance of the signature of legitimate device and the signature of adversary at different positions in different time slots. In this figure, the middle red line is the threshold. The experimental results show that all attacks failed, although the Euclidean distance between the signature of legitimate device and the signature of adversary at the original position is the closest one to the threshold.

In order to study the performance of the proposed scheme, an experiment is conducted, in which, the distance between the device and the AP is ±20, ±40 and ±60 cm, the movement distance is 5, 10 and 20 cm, and the threshold is set to 25, where −20, −40 and −60 cm means the opposite direction of distance 20, 40 and 60 cm between the device and the AP, respectively. The experimental results are shown in Fig. 11. It can be seen that, the difference of signatures at the same position over different time slots can be confirmed with 100% accuracy. It can also be seen that the accuracy gradually increases with the increasing movement distance, i.e., a larger movement distance means a more accuracy movement detection. Specifically, it is found that when the movement distance is up to 60 cm, all the device movement can be accurately detected.

To further discuss the performance, we test the proposed scheme by selecting three places that are very common in daily life, and the noise level ranged from high to low: restaurants, supermarkets and classrooms. In this experiment, the AP is 100 cm away from the device in the direction 1, and 1000 groups of tests are performed for each place, in which the first 500 groups of talking phones do not move and the last 500 groups of talking phones move 30 cm away. The test results are shown in the Fig. 12. It can be seen that, whether in a noisy restaurant or a quiet classroom, the proposed scheme can identify whether a device to move with a 100% probability, which is perfectly in line with the expectation.

Finally, we conduct an experiment to evaluate the energy consumption compared with several common APPs on mobile phones in the Fig. 13. In this experiment, all applications are turned off except the test software. We measure the power consumption of the proposed scheme and other applications (i.e., NetEases could music, QQ music, QQ, and Microblog) within one hour to verify the efficiency of the software. We can see that the power consumption of the proposed scheme is more than 30 times lower than that of similar music playing software, 18 times lower than that of chat tool software, and 40 times lower than that of video and picture browsing software.

Discussion. The disadvantage of the proposed scheme is that the transmission of high-frequency sound waves may disturb nearby people. Possible solutions include replacing mixed sine-wave signals with melodious mid-to-high frequency music or using ultrasonic frequencies to send and receive acoustic signals.