## 3 Second Step of One-Bounce Scattering Signal Identification Algorithm
### Localization of Scatterer  
Assuming there are \(W\) one-bounce scattering signals from target scatterer S to BSs after the first step of the identification algorithm. Clearly, the number of one-bounce scattering signal \(W\) is less than twice the number of scattering signal combinations of target scatterer S, because some scattering signal combinations have the same scattering signal. Accordingly, there are \(W\) BSs receiving one-bounce scattering signals from target scatterer S, assuming that the coordinate of scatterer S is \((x_{s},y_{s})\), the distance from the scatterer S to the \(i\)th BS is:  
\[d_{i}=\sqrt{\left(x_{i}-x_{s}\right)^{2}+\left(y_{i}-y_{s}\right)^{2}}\,i=1,2, \ldots,W \tag{8}\]  
Suppose the distance between MS and scatterer S is \(d\), then the TOA distance from \(i\)th BS to MS denoted by \(r_{i}\) satisfies \(r_{i}=d_{i}+d\). With regarding 1 st BS as a reference BS, the difference between \(r_{i}\) and \(r_{1}\) can be written as \[r_{i,1}=r_{i}-r_{1}=(d_{i}+d)-(d_{1}+d)=d_{i}-d_{1}=d_{i,1}, \tag{9}\]  
where \(d_{i,1}\) is the difference between the distance from the scatterer S to the \(i\)th BS and that of 1 st BS. Moreover, we can get  
\[d_{i,1}=\sqrt{\left(x_{i}-x_{s}\right)^{2}+\left(y_{i}-y_{s}\right)^{2}}-\sqrt {\left(x_{1}-x_{s}\right)^{2}+\left(y_{1}-y_{s}\right)^{2}} \tag{10}\]  
Linearizing Equation (10) and simplifying it gives  
\[-x_{i,1}x_{s}-y_{i,1}y_{s}-d_{i,1}d_{1}=\frac{d_{i,1}^{2}-K_{i}+K_{1}}{2}, \tag{11}\]  
where \(x_{i,1}=x_{i}-x_{1}\), \(y_{i,1}=y_{i}-y_{1}\) and \(K_{i}=x_{i}^{2}+y_{i}^{2}\). When the number of BS, that is, \(W\) equals three, there are two BSs in addition to the 1 st BS, from Equation (11) we can obtain two equations. Exploiting the two equations, the coordinate of scatterer S can be written in terms of \(d_{1}\)  
\[ \begin{bmatrix}x_{s}\\ y_{s}\end{bmatrix} =- \begin{bmatrix}x_{2,1}&y_{2,1}\\ x_{3,1}&y_{3,1}\end{bmatrix} ^{-1}\Bigg{\{} \begin{bmatrix}d_{2,1}\\ d_{3,1}\end{bmatrix} d_{1}+\frac{1}{2} \begin{bmatrix}d_{2,1}^{2}-K_{2}+K_{1}\\ d_{3,1}^{2}-K_{3}+K_{1}\end{bmatrix} \Bigg{\}}. \tag{12}\]  
Putting Equation (12) into Equation (8) yields a quadratic in \(d_{1}\), and then substituting the positive root of the quadratic in \(d_{1}\) into Equation (12), \(\left(x_{s},y_{s}\right)\) can be obtained. When \(W\) is more than three, Equation (11) yields more than two equations, combining Equation (8) gives more than three equations with three variables, \(x_{s}\), \(y_{s}\) and \(d_{1}\), the proper answer is the \(\left[x_{s},y_{s},d_{1}\right]\) that best fits these equations, which can be solved using two steps weighted least square (TSWLS) of [34]. Let \(z=\left[x_{s},y_{s},d_{1}\right]^{T}\), and assuming that \(x_{s}\), \(y_{s}\) and \(d_{1}\) are independent, we can obtain  
\[z=argmin\{\left(h-Gz\right)^{T}\varphi^{-1}(h-Gz)\}=\left(G^{T}\varphi^{-1}G \right)^{-1}G^{T}\varphi^{-1}h, \tag{13}\]  
where \(\varphi=c^{2}BQB\), \(B=diag\{d_{2}^{0},d_{3}^{0},\ldots,d_{N}^{0}\}\), the superscript \(\left\{*\right\}^{0}\) denotes the noise-free value, \(Q\) is covariance matrix of TDOA, \(c\) is signal propagation speed, and  
\[G=- \begin{bmatrix}x_{2,1}&y_{2,1}&d_{2,1}\\ x_{3,1}&y_{3,1}&d_{3,1}\\ \vdots&\vdots&\vdots\\ x_{N,1}&y_{N,1}&d_{N,1}\end{bmatrix} ,\quad h= \begin{bmatrix}d_{2,1}^{2}-K_{2}+ K_{1}\\ d_{3,1}^{2}-K_{3}+K_{1}\\ \vdots\\ d_{N,1}^{2}-K_{N}+K_{1}\end{bmatrix} . \tag{14}\]  
When the scatterer is far away from BSs, Equation (13) can be approximated as  
\[z\approx\left(G^{T}Q^{-1}G\right)^{-1}G^{T}Q^{-1}h. \tag{15}\]  
When the scatterer is close to BSs, \(z\) can be solved with Equation (13) on the basis of the initial solution provided by Equation (15).