## 3 Network Positioning  
### Wi-Fi Fingerprinting  
The NLP primarily utilizes Wi-Fi fingerprinting, a technique that constructs a radio map from network access points and the geolocations they were detected at, and then compares this radio map against the user's current available access points and respective signal strengths. If the true locations of the access points are known, they can be entered into the database instead. As Wi-Fi fingerprinting uses the constructed radio map for positioning, the accuracy of the map directly correlates to the performance of the NLP. The maps can be an open source of proprietary to the operating companies. One example of a public crowd-source database of Wi-Fi, cell, and Bluetooth access points is WIGLE. It has been collecting network access points and their locations from public users using their Android application since 2002, and has accumulated over 820 million Wi-Fi networks on its database [24]. It is possible for the users to access the information including the BSSID/MAC address, location, and updated date of the access point. On the other hand, large organizations, such as Google, are constantly collecting new fingerprints and updating their large databases to maintain an accurate NLP. Google went into greater detail regarding their fingerprinting methodology in a letter released to the Defense Priorities and Allocations System in 2010 [25]. Google tracks the media access control (MAC) address and the received signal strength (RSS) of each visible access point, along with the GPS location of the user's device. They use this information by comparing the visible MAC addresses with the stored MAC addresses in the database, from which a location is identified. Finally, using the RSS of each access point, a positioning algorithm from the server estimates the location of the user and the location is sent back to the device. Figure 1 illustrates this fingerprinting technique. By analyzing the information provided by the Android NLP engine, it is possible to gain greater insight into what additional information the device has in addition to the radio map database. Each Wi-Fi access point provides information, including the venue name, SSID/BSSID, signal level, and frequency. Most likely, the signal level is converted into a range by using the free space path loss equation as shown in Equation (1), and then processed for a navigation solution. \[R=\sqrt{\frac{P_{t}}{P_{r}}\cdot\frac{c}{4\pi f}} \tag{1}\]  
where \(R\) is the distance between the transmitter and the receiver, \(P_{t}\) is the transmitted power, \(P_{r}\) is the received power, \(c\) is the speed of light, and \(f\) is the frequency of the signal. However, the limitations of this approach include the lack of knowledge of the initial transmitted power, multipath and attenuation of signals, and difficulty in differentiating between the altitude and clock error when two-dimensional triangulation is used. Figure 1: Wi-Fi fingerprinting methodology. Access points are received by a user, and the corresponding identifier and location is saved to the database. When another device receives a set of identifier and the corresponding power, it is sent to a server to be converted to a location solution. Range ambiguity is being addressed in the next generation Wi-Fi positioning called Wi-Fi RTT ranging, which will be discussed further in the following sections. For the altitude resolution, it is possible to add an altitude value to the fingerprint database. In the case of indoor scenarios, a multi-story environment navigation resolution approach can be applied. For example, [PERSON] determines the floor of the device in a building by combining three-dimensional fingerprinting with a coarse clustering-based positioning algorithm using the difference of received MAC addresses in varying floors [26]. In another approach, [PERSON] uses the device's barometer to determine the altitude to assist in floor identification [27].