[Paper Review] Identifying the BLE Advertising Channel for Reliable Distance Estimation on Smartphones

Christian Gentner, Daniel Günther+1 more|arXiv (Cornell University)|Jun 16, 2020

Bluetooth and Wireless Communication Technologies4 citations

TL;DR

This paper proposes a novel method to detect the BLE advertising channel on which a smartphone receives a signal, overcoming a critical source of error in distance estimation caused by frequency-dependent transmit and receive gains. By exploiting the consistent reinitialization of BLE scanning to channel 37 after restarts, the technique achieves 100% channel detection accuracy on Google Pixel 2 and 3, significantly improving reliability for contact tracing and proximity-based applications.

ABSTRACT

As a response to the global COVID-19 surge in 2020, many countries have implemented lockdown or stay-at-home policies. If, however, the contact persons of every infected patient could be identified, the number of virus transmissions could be reduced, while the more incisive measures could be softened. For this purpose, contact tracing using smartphones is being considered as a promising technique. Here, smartphones emit and scan for Bluetooth Low Energy (BLE) signals for detecting devices in range. When a device is detected, its distance is estimated by evaluating its received signal strength. The main insight that is exploited for distance estimation is that the attenuation of a signal increases with the distance along which it has traveled. However, besides distance, there are multiple additional factors that impact the attenuation and hence disturb distance estimation. Among them, frequency-selective hardware and signal propagation belong to the most significant ones. For example, a BLE device transmits beacons on three different frequencies (channels), while the transmit power and the receiver sensitivity depend on the frequency. As a result, the received signal strength varies for each channel, even when the distance remains constant. However, the information on which wireless channel a beacon has been received is not made available to a smartphone. Hence, this error cannot be compensated, e.g., by calibration. In this paper, we for the first time provide a solution to detect the wireless channel on which a packet has been received on a smartphone. We experimentally evaluate our proposed technique on multiple different smartphone models. Our results help to make contact tracing more robust by improving the accuracy of distance estimation.

Motivation & Objective

• Address the challenge of inaccurate distance estimation in smartphone-based contact tracing due to frequency-dependent signal attenuation.
• Identify and resolve the issue that BLE smartphones do not expose the reception channel of received advertising packets.
• Develop a reliable, application-level technique to infer the reception channel without hardware modifications.
• Improve the accuracy of RSSI-based distance estimation by compensating for channel-dependent gains and propagation effects.
• Enable more robust contact tracing and proximity applications by making channel information accessible to software.

Proposed method

• Leverage the fact that BLE scanning on most Android smartphones restarts at channel 37 after a restart, creating a predictable starting point.
• Track the sequence of scan windows over time to infer the current scanning channel based on timing and sequence patterns.
• Use a time-based model to predict the scanning channel by analyzing the duration and order of scan windows in the sequence.
• Apply a classification algorithm that maps the observed scan window timing to the expected channel sequence, assuming a consistent scanning pattern.
• Validate the method across multiple smartphone models to ensure generalizability and robustness.
• Use the detected channel information to correct for frequency-dependent path loss and hardware sensitivity variations in RSSI-based distance estimation.

Experimental results

Research questions

• RQ1 Can the BLE advertising channel on which a smartphone receives a packet be reliably inferred without access to low-level radio information?
• RQ2 How consistent is the BLE scanning behavior across different smartphone models, particularly regarding channel order and restart behavior?
• RQ3 To what extent can channel detection accuracy be achieved using only application-level timing and sequence analysis?
• RQ4 How does the channel-dependent signal attenuation affect RSSI-based distance estimation, and can this error be mitigated using inferred channel information?
• RQ5 What are the limitations of this approach on iOS devices and non-compliant Android devices?

Key findings

• The proposed method achieves 100% channel detection accuracy on Google Pixel 2 and Pixel 3 smartphones by exploiting their consistent restart behavior at channel 37.
• On Samsung Galaxy M20 and Huawei P20, the scanning pattern deviates from the BLE standard, with non-deterministic channel switching and no reset on restart, reducing detection reliability.
• Apple iPhone 6s does not support predictable scanning behavior; it resumes scanning on the last channel used, making the proposed method inapplicable.
• The technique enables compensation for frequency-dependent gains $G_t$ and $G_r$, as well as free-space path loss variations across channels, improving distance estimation accuracy.
• The method is robust on compliant Android devices and provides a practical solution for improving contact tracing reliability across diverse smartphone hardware.
• The authors have launched a public website to collect and publish results from additional smartphone models, enhancing transparency and reproducibility.