# RF-Access: Barrier-Free Access Control Systems with UHF RFID
## 3 RF-Access
### Tag-Array Based Intrusion Detection  
In addition to motion direction detection, intrusion detection is another fundamental function of access control. Illegal intrusion generally falls into two categories: independent intrusion and tailgating intrusion. The former means the attacker individually goes through the access control system, and the latter indicates the attacker closely follows the legal users in the passageway. Since the attacker does not carry any RFID tags, the reader cannot obtain anything from the attacker directly for intrusion detection. RF-Access boils down the issue to a counting-people problem. The idea is to estimate the number of people in the passageway and compare it with that of legal tags queried by the reader. If these two numbers are different, an intrusion event has happened. It is worth noting that if an intruder is detected, the access control system can raise a warning alarm and push this abnormal  
Figure 7: An illustration of time-slot-based detection. information to the security guard. The follow-up procedure is application-defined, which is out of the scope of this work. Since a smart intruder must not carry any tags, we need to design a device-free way to count the number of people. If the intruder carries one or more illegal tags, we can easily figure out the intrusion by reading these tags. In RF-Access, we use a tag array to perform people counting. As shown in Figure 8, we deploy one or more RFID antennas on one side of the passageway and a tag array on the other side. Since the RF signals are vulnerable to the human body, we can take advantage of this inference as the vehicle to people count. We use a group of experiments to validate this idea. We invite three volunteers to walk through the passageway. To mimic a real attack, we ask for the volunteers to try to be close to each other. Meanwhile, the reader keeps collecting the backscattered signals from all tags. Two parameters are measured, including RSSI and Doppler frequency offset. As shown in Figure 9, 1000 RSSI values obtained from a \(6\times 10\) tag array are plotted in a polar coordinate system in a random direction, where the radius of each point represents the real RSSI value. We can learn from this figure: (1) When no one walks by, the RSSI distribution forms a thin circle, which indicates that RSSI signals remain relatively stable. (2) RSSI values start to spread out as the number of users increases. The above results demonstrate that there is a potential to use the RSSI distribution to estimate the number of people. Similarly, we test the Doppler shifts of all tags under different numbers of people. In Figure 10, we randomly select and plot 500 Doppler frequency offset values. Ideally, the Doppler frequency offset should be close to zero when the tag and antenna keep stationary and the Doppler frequency offset increases as the tag moves toward the antenna. However, due to the noise, the Doppler frequency offsets reported by the commercial RFID reader level off at 0 with positive values and negative values, which are shown in Figure 10a. Similar to RSSI, the Doppler frequency offsets become more and more dispersed as the number of people increases. Figure 8: Tag-array-based intrusion detection. With the signal features, we can treat the counting problem as a classification problem using machine learning. More specifically, we view RSSI as a random variable and use the entropy of RSSI to measure how the RSSI data spread. Assume that the minimum value of RSSI in all samples is \(r_{min}\), and the maximum value is \(r_{max}\). The value domain of RSSI is the interval \([r_{min},\ r_{max}]\). Afterward, we divide the interval into \(N\) bins with the size \(\Delta\) of each:  
\[N=\lceil\frac{r_{max}-r_{min}}{\Delta}\rceil. \tag{9}\]  
Let \(m_{i}\) be the number of RSSI values falling into the \(i\)th bin.