## 5 Increasing Robustness with Location Verification and Computation
### Distance Ranging  
Distance ranging is used to enable location verification via distance bounding, _i.e._, distance ranging is the foundation of the location verification. In a distance bounding location verification system, one device (a verifier) asserts that another device (a prover) is within a preset distance from it. Below, we provide some insight into the methodologies used to carry out distance ranging.  
**Time of Flight** (TOF) ranging methods entail precise measurement of the travel time \(t\) of data between two devices, \(A\) and \(B\)[62]. A ranging system can calculate the maximum distance from \(A\) to \(B\) by knowing the communication medium's transmission speed and an estimate \(h\) of hardware induced delays. In the case of radio transmissions, where the transmission speed is \(c\) (the speed of light), the maximum distance would be \(c(t-h)/2\).  
**Time Difference of Arrival** (TDOA) ranging systems use multiple TOF verifiers to triangulate the location of a verifier in a process known as _multilateration_[63, 64]. Ranging via TOF does not require bidirectional communication; a unidirectional data transmission is sufficient for the receiver (e.g. verifier) to calculate its distance from the sender (e.g. prover) provided packets are appended with their send time and clocks are synchronized.  
Malicious parties can abuse TOF ranging in both the unidirectional and bidirectional cases. In the unidirectional message case, the receiver cannot guarantee that the send time appended to the received packet is accurate. In the bidirectional message case (a message from \(A\) to \(B\), then from \(B\) to \(A\)), \(A\) cannot guarantee that \(B\) did not delay its return message unnecessarily. As \(B\) can only increase the range estimates by delaying the return message, verification systems can still function [65, 66]. Evenoperating under the assumption that both parties are trusted, TOF ranging requires highly precise timing measurements, and is thus subject to large discretization error [67]. A clock accurate to millisecond precision will allow for up to 300 kilometers of error in distance calculated during a round trip transmission (assuming radio transmissions are used). It is possible, though costly, to use alternative communication mediums with a slower propagation speed in order to allow for lesser clock accuracy. The use of ultrasound in one direction of communication lowers the error term by about the order of \(10^{6}\). Major problems with the usage of such slower mediums include their high cost and their susceptibility to _wormhole attacks_.  
**Received Signal Strength** (RSS) ranging utilizes the fact that radio or ultrasound signals decay with distance; receipt of a weak signal indicates either a weak transmitter or a large distance from the sender. Knowing the transmitter's output power in advance allows for ranging by mapping the received signal power through a function to distance. Many technologies exist to utilize existing 802.11 WiFi or Bluetooth infrastructure to carry out RSS ranging. Unfortunately, a malicious node can defeat RSS ranging by varying its transmit power in different directions (e.g. by using directional antennas), or by changing its transmit power with time. In addition, off-the-shelf, commodity hardware often does not make available an accurate measure of received signals' power. 802.11 WiFi device drivers are not required to provide access to this information through device drivers. Rather, the drivers must specify a RSSI value, which need not linearly map to received signal power in decibels [68].