ISAC-Assisted Channel Knowledge Map Generation for Physical Layer Authentication

Source: arXiv:2607.20176 · Published 2026-07-22 · By Luca Bonaventura, Edoardo Gardin, Alessia Barison, Francesco Ardizzon, Stefano Tomasin

TL;DR

This paper addresses the challenge of physical layer authentication (PLA) in wireless networks by leveraging Integrated Sensing and Communication (ISAC) systems. The key problem is authenticating a legitimate transmitter based on its location-dependent channel characteristics, despite the transmitter possibly moving and the environment being complex and partially unknown. The authors propose to reconstruct the physical environment using ISAC sensing signals received at multiple base stations (BSs), generating a detailed 3D point cloud via range-angle estimation and Poisson surface reconstruction. Ray tracing is then applied on the reconstructed environment to generate a channel knowledge map (CKM) predicting the expected wireless channel features (path loss and angle of arrival) for transmitters at any given position. By comparing real-time channel state information (CSI) from an unknown transmitter with the CKM entries corresponding to the approximate known position of the legitimate transmitter (obtained from upper-layer location information), the system performs hypothesis testing to authenticate the signal and detect location-spoofing attacks. The paper thoroughly evaluates the impact of ISAC sensing errors and channel estimation noise on PLA performance using the Sensiverse dataset, demonstrating false alarm and missed detection probabilities below 1%. These results validate that ISAC-assisted environment reconstruction combined with ray tracing can enable robust, low-overhead PLA in complex, static indoor scenarios.

Key findings

• ISAC sensing across multiple BSs can reconstruct main environmental features, including walls and obstacles, despite limited coverage, enabling geometry-aware PLA.
• Ray tracing applied to the ISAC-based reconstructed map produces a channel knowledge map (CKM) that approximates the reference CKM from the true environment, preserving main spatial channel variations (Fig. 3).
• ISAC-induced reconstruction noise (KM) has a greater negative impact on authentication performance than receiver-side channel estimation noise (KC), suggesting prioritizing pilot efforts during CKM estimation (Fig. 4).
• False alarm and missed detection probabilities below 10^-2 are achievable despite ISAC reconstruction errors and channel estimation noise.
• Authentication performance degrades gracefully as uncertainty in the legitimate transmitter's position (WA) increases, which can be partially mitigated by improving feature estimation quality (Fig. 5).
• The PLA decision threshold and partial knowledge of legitimate user position enable practical operation without requiring trajectory predefinition or full position information.
• The framework operates at different frequencies for sensing (fI=26GHz) and communication (fA=3.5GHz), demonstrating robustness to multi-carrier operation.
• Monte Carlo simulations with 10^6 trials provide statistically significant evaluation of detection error tradeoffs.

Threat model

The adversary is an impersonation/spoofing transmitter capable of transmitting the same protocol signals and pilots as the legitimate user but from a different physical location. They have full knowledge of the authentication protocol and signals but cannot replicate the legitimate user's location-dependent channel characteristics. They cannot physically collocate with the legitimate user or attack the sensing infrastructure.

Methodology — deep read

The authors assume an adversary that fully knows the authentication protocol, including pilot sequences, but cannot physically mimic the legitimate transmitter's exact location. The legitimate user’s exact position is unknown but is approximately known within a region defined by location uncertainty WA. The cellular network includes N=4 base stations, each equipped with separate Tx and Rx uniform rectangular arrays (URAs) for integrated sensing and communication. The sensing signals (ISAC) operate at 26 GHz with 400 MHz bandwidth, while authentication transmissions operate at 3.5 GHz. Each BS transmits probe waveforms with beamforming to scan azimuth and elevation angles, measuring the time-of-arrival (TOA) and intensity peaks of the reflections. This generates a point cloud per BS representing detected scatterers. To reduce sidelobe-induced artifacts, spatial tapering with a 2D Hann window is applied to antenna arrays. The N point clouds are merged and processed via Poisson surface reconstruction to create a 3D mesh representation of the environment. The authors then perform a point cloud pruning step to remove outliers using centroid and vertex distance heuristics. Using this reconstructed environment, a Matlab-based ray tracing engine simulates site-specific propagation channels for a grid of transmitter positions. Key channel features extracted per position include path loss (PL) and angle of arrival (AoA) of the dominant path, which form the channel knowledge map (CKM) vector aggregated across BSs. For PLA, the network receives pilot transmissions from an unknown UE and estimates the channel state information (CSI) at each BS, extracting PL and AoA features. A generalized likelihood ratio test (GLRT) compares the noisy observed features to CKM entries corresponding to the possible legitimate user region. The test decides if the user is legitimate or an impostor transmitting from another position. Evaluation uses the Sensiverse ISAC dataset with known environment and BS positions. The authors run Monte Carlo simulations with 1 million trials across varying noise levels on both CKM estimation (KM) and channel estimation during PLA (KC). They also test sensitivity to user location uncertainty WA. Simulation parameters include 32x32 antenna arrays, 10 pilot symbols per authentication transmission, UE Tx power of 26 dBm, and 1-meter grid squares for CKM discretization. Figures 2 and 3 show environment reconstruction and PL comparison between ground truth and ISAC-based CKM, while Figures 4 and 5 present detection error tradeoff (DET) curves under noise and location uncertainty. The framework is reproducible given the provided detailed parameter tables and referenced open datasets, though the ray tracing toolbox and code were implemented in Matlab and no explicit open source release is mentioned.

Technical innovations

• Use of ISAC signals for dynamic multi-BS reconstruction of the 3D environment without dedicated sensing hardware, enabling real-time CKM generation.
• Application of Poisson surface reconstruction with sidelobe suppression via 2D Hann window spatial tapering to produce accurate geometry for ray tracing-based channel modeling.
• Integration of CKM-based physical layer authentication leveraging partial location knowledge and a GLRT that jointly considers AoA and path loss features under noisy observations.
• Evaluation of the combined effect of ISAC-induced CKM reconstruction errors and channel estimation noise on PLA performance, highlighting tradeoffs and design priorities.

Datasets

• Sensiverse dataset — size unspecified — public ISAC channel sensing dataset used for environment and channel evaluation

Baselines vs proposed

• Ground-truth ray tracing CKM vs ISAC-reconstructed CKM: ISAC approximation preserves main channel spatial features but with distortions in occluded areas (Fig. 3).
• Authentication performance at KM=1, KC=1 noise level: False alarm and missed detection probabilities both below 10^-2.
• At higher ISAC noise KM=10 vs channel estimation noise KC=1, authentication errors increase more significantly, showing KM dominates system robustness (Fig. 4).
• Increased location uncertainty WA from 2 m to 4 m degrades detection error performance moderately, demonstrating graceful robustness (Fig. 5).

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.20176.

Fig 2: Ground truth (a) and ISAC-reconstructed environment (b), and BS

Fig 3: PL maps: (a) ground truth CKM, obtained from ray tracer on the true map (Fig. 2a) and (b) ISAC PL CKM estimated on the ISAC-reconstructed

Limitations

• The study assumes a static environment during observation intervals; results may degrade under dynamic or mobile scattering conditions.
• Reconstruction depends on sensing angle coverage and visibility; occluded or non-line-of-sight areas are imperfectly reconstructed leading to CKM inaccuracies.
• Simulations consider only 4 base stations; scalability to larger or more complex deployments needs further verification.
• Adversarial model assumes no physical relocation or jamming by attacker; more sophisticated attacks are not studied.
• No real-world measurement validations, only simulations using the Sensiverse dataset and Matlab ray tracing.
• Position uncertainty WA handling relies on partial knowledge which may not always be available or reliable in practice.

Open questions / follow-ons

• How does the framework perform in dynamic or time-varying environments with moving scatterers or users?
• Can multi-frequency ISAC sensing and communication operations be jointly optimized to improve CKM accuracy and authentication robustness?
• What is the impact of denser base station deployments or additional sensing modalities like mmWave radar integration on PLA reliability?
• How resilient is the system against attackers employing cooperative or multi-antenna spoofing strategies to mimic CKM features?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners focused on physical-layer based authentication, this work demonstrates a promising direction in leveraging environment sensing to bind wireless channel features to legitimate user location. The use of ISAC allows network infrastructure to create a detailed, site-specific channel knowledge map without dedicated hardware, enabling more secure authentication that resists impersonation from different locations. However, practical deployments must consider the impact of sensing inaccuracies, environment occlusions, and user location uncertainty on authentication decisions. This framework particularly suits scenarios where upper-layer location information is available and system overhead for continuous channel probing must be minimized. In CAPTCHA and bot-defense contexts, integrating environment-aware PLA as shown could add a robust physical barrier to spoofing attacks that rely on remote relay or signal replay. Future work should explore extending this approach to mobile and highly dynamic environments and investigate adversarial attack models simulating advanced attackers. Overall, this paper provides a technically detailed baseline for implementing ISAC-driven CKMs as part of a layered bot-defense mechanism founded on physical channel fingerprinting.

Cite

@article{arxiv2607_20176,
  title={ ISAC-Assisted Channel Knowledge Map Generation for Physical Layer Authentication },
  author={ Luca Bonaventura and Edoardo Gardin and Alessia Barison and Francesco Ardizzon and Stefano Tomasin },
  journal={arXiv preprint arXiv:2607.20176},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.20176}
}

Read the full paper

• arXiv:2607.20176 (abstract)
• arXiv:2607.20176 (PDF)