## 2 Selfish Configuration in Unauthorized Wi-Fi Tethering
### System Model and Assumption  
We consider a scenario where an unauthorized Wi-Fi tethering system creates a Wi-Fi hotspot within a multi-AP Wi-Fi network, as illustrated in Figure 1. The tethering consists of an Internet-connected (e.g., through 4G or 5G cellular connection) mobile device (e.g., a smartphone or a tablet) and a tethered Wi-Fi-enabled device, which forms a Wi-Fi tethering link. Henceforth, we will refer to the mobile device and the tethered Wi-Fi device as host and guest nodes, respectively; the host node shares its cellular Internet connection with the guest nodes via the tethered Wi-Fi link. These nodes contend for channel access with nearby Wi-Fi systems.  
Figure 2 describes the adversary model. We assume that an adversary user manipulates the CCA threshold (CST) of the host node's Wi-Fi interface in the tethering whereas the guest nodes (e.g., laptop, tablet, or etc.) are legitimate, i.e., guest nodes use the default CCA threshold. The CCA threshold controls the sensitivity of carrier sense, that is, a node with a higher CCA threshold can access channel with a higher interference/noise level [6, 7]. The channel is considered to be idle when the sensed energy is lower than the CCA threshold. We assume that the host node selects the maximum possible CCA threshold without losing the tethering connectivity, which is likely a little lower than the observed strength of received signals transmitted by the guest nodes.  
Recall a property of Wi-Fi tethering: in general, a tethered hotspot is formed for communication between personally owned devices that are placed close-by while in use and, thus, the link distance between the communicating devices is highly controllable and typically short (less than 10 m or 30 ft [8]).  
Figure 1: Illustration of the problem: a misbehaving unauthorized Wi-Fi tethering sets up the network in a managed multi-access point (AP) network.  
Figure 2: Adversary model: selfish behavior with Clear Channel Assessment (CCA) manipulation will not freeze its back-off counter even if other nodes are transmitting.  
When multiple independent transmissions occur simultaneously to a conventional receiver, the receiver is likely to fail to receive the signal of interest (SoI) due to severe interference. However, for a tethered link with a short distance, it is possible for its tethered receiver in order to successfully capture the Sol thanks to two well-known concurrent transmission technologies: PHY capture effect [9] and message-in-message (MIM) [10; 11].  
Figure 3 illustrates the main difference between PHY capture and MIM.  
The PHY capture effect is the property of 802.11 radios, where an Sol can be successfully decoded, even when the interference arrives at the same time, as long as the overlap within the preamble detection stage and the SoI is stronger than a specific threshold, which we call the capture threshold. MIM is an enhanced PHY-layer capability that enables a receiver to decode an SoI, even if the SoI arrives after the preamble time of the interference. Specifically, MIM allows for a receiver to disengage from the current on-going frame reception and re-engage in a new, stronger frame. However, MIM requires a higher received signal to interference ratio (SIR) than the PHY capture, which we call this SIR value the MIM threshold, \(\beta_{m}\), for modulation scheme \(m\) (e.g., \(m\) = BPSK, QPSK, 16 QAM, and 64 QAM), where we consider multiple data rates with various modulation and coding scheme (MCS) values as in 802.11 n/ac.  
Following the experimental results in [10], throughout the paper, we configure the SIR threshold \(\gamma_{m}\) and MIM threshold \(\beta_{m}\) for a given modulation scheme \(m\). We assume that the receiver can successfully decode a frame when the received \(SIR\) is consistently above \(\beta_{m}\), even when multiple independent transmissions occur simultaneously.