Physical Layer Authentication With Channel Knowledge Maps in Indoor Environments Luca Bonaventura⋆ , Francesco Ardizzon, and Stefano Tomasin University of Padova and National Inter-University Consortium for Telecommunications (CNIT), Italy
arXiv:2606.27044v1 [cs.CR] 25 Jun 2026
⋆
Corresponding author, email:[email protected]
Abstract—Physical layer authentication (PLA) allows to authenticate the user by comparing measurements over time, assuming their time consistency or by modeling their evolution. However, these assumptions become problematic when devices are in motion and in indoor environments due to multipath propagation and obstructions. In this paper, we propose a PLA mechanism for moving devices in indoor environments, where multiple access points (APs) estimate the dominant channel tap path loss (PL) and angle of arrival (AoA) from the received signals and compare them with previously collected channel knowledge maps (CKMs). Specifically, the measurements are compared to those in the neighborhood of the previously known position obtained from CKMs. A comprehensive security analysis is conducted under both random and optimal attacks. Numerical results in a representative indoor scenario, with CKM obtained via ray tracing, validate the effectiveness of the proposed PLA approach. Index Terms—Physical layer authentication, channel knowledge map, indoor localization.
I. I NTRODUCTION Sixth generation (6G) networks are expected to have a dense deployment, allowing both user performance improvements and the development of new services. A new feature is environmental-aware communication, in which the service is improved by leveraging prior knowledge of the environment, embedding it into the communication system via channel knowledge map (CKM) [1]. Motivated by the growing attention to security, in this paper, we exploit the CKMs for physical layer authentication (PLA). An overview of the PLA techniques is presented in [2], which surveys both device fingerprinting and channel-based authentication. In this work, we focus on the latter, where the unique properties of the channel and, in particular, the propagation medium, are used to provide security. The key idea behind PLA verification is to determine whether a set of features extracted from channel observations matches an a priori analytical measurement model [3]. Compared with its cryptographic counterparts, PLA requires limited computational resources and does not introduce additional communication overhead; thus, it is suitable for rate-limited communication scenarios or energy-constrained devices. However, obtaining the required a priori analytical model for verification is challenging when the user device is mobile or This work was supported by Agenzia per la cybersicurezza nazionale under the programme for promotion of XL cycle PhD research in cybersecurity C96E24000010005. The views expressed are those of the authors and do not represent the funding institution.
located in indoor environments. Indeed, in mobile scenarios, the measurement statistics vary over time, and therefore PLA the test should be adjusted accordingly. Moreover, in indoor environments, the non-line-of-sight (LoS) component, which is harder to model and predict than the LoS component, often becomes predominant, further complicating the model design. Signal obstructions, e.g., due to furniture or people moving in the room, further complicate this task. Concerning environmental communications, the concept of CKM is deliberately general, to include maps of different natures for different applications. CKMs include physical environment maps, i.e., models of the 3D environment [4], as well as channel feature maps. These maps relate quantities such as angle of arrival (AoA) [5], channel gains [6], [7], or beams to receiver (or user) locations [8]. A first example of the CKM application includes unmanned aerial vehicle (UAV) networks [9], where drone positions are chosen to maximize the sum of the rates between UAV and the base station. Next, in [8], a beam index CKM is used by a mmWave system to achieve training-less beamforming, considering also non-LoS and dynamic conditions. A parallel research trend investigates techniques to build the CKMs. In [10], integrated sensing and communication (ISAC) is employed to estimate the position of a moving user in the room. The user transmits continuously while moving around the room. In turn, the receiver estimates the channel from the received signal, and combines it with the ISAC-estimated user position to construct the CKM. In [5], two algorithms are proposed to improve the CKMs based on AoA. Finally, to the best of the authors’ knowledge, only a few works explore the use of CKM for authentication. A strategy in which the verifier performs PLA by verifying the consistency between the position reported by the user under verification and the position estimated by the verifier from the channel state information (CSI) is proposed in [11]. However, the protocol assumes that the legitimate user trajectory is defined (a priori) by the verifier. In this work, we combine the concepts of CKM and PLA to design a novel PLA protocol for moving devices in indoor environments. In particular, the use of CKM eliminates the need for an a priori analytical CSI model. Specifically, we consider multiple access points (APs) estimating path loss (PL) and AoA from the dominant channel tap, i.e., the tap with the highest amplitude. Then, an authentication mechanism verifies, through likelihood test (LT) or generalized likelihood ratio test
(GLRT), whether the estimates match those stored in CKM, looking at those within the area surrounding the previously estimated location. We design different attack strategies against the proposed mechanism. These include both random and informed attacks, i.e., where the attacker exploits knowledge about the CKM and past positions of the target user. The numerical results in a reference indoor environment confirm the effectiveness of the proposed protocol PLA. The remainder of the paper is organized as follows. Section II details the system model. Section III describes the proposed mechanism. Section IV reports the numerical results. Finally, Section V draws the conclusions.
sequences, used by Bob for channel estimation purposes. Both the user and the AP operate with symbol period Ts . Alice and Trudy move in a horizontal plane modeling the room, sampled in squares of side WM . Then, each 2D position p = (x, y), represents the center of one of these squares, and is collected in P. We model the channel from p to the n-th AP using Rn (p) distinct rays, where the i-th ray is characterized by time of arrival, Ti,n (p), AoA measured in radians, Di,n (p), and PL, Li,n (p). Thus, considering a transmitted power PT , the user and AP antenna gains, GT and GR , respectively, the power received at the AP from the i-th ray is
II. S YSTEM M ODEL
PT GT GR , PR Li,n (p) = Li,n (p) LD
We consider the indoor authentication scenario shown in Fig. 1, where N APs have publicly known fixed positions and operate under centralized control, denoted as Bob. Two user devices move within the area covered by the network, namely Alice and Trudy. We consider an authentication problem where the verifier Bob aims at deciding whether the received signal has been transmitted by Alice or by the attacker Trudy, who pretends to be Alice to intrude on the system. The APs are loosely synchronized and are equipped with an uniform linear array (ULA) of NA antenna elements, equally spaced by d. In turn, Alice and Trudy are single-antenna devices. We assume that the communication between the APs controlled by Bob is authenticated and integrity-protected; therefore, the attacker cannot manipulate the information shared between the APs and Bob. Being the APs static, this can be achieved by using a wired or fiber connection.
(1)
where LD accounts for all other losses not included in the PL. The impulse response of the broadband channel for the a-th element of the ULA with a ∈ {0, 1, . . . , NA − 1} of the AP n, is h̃a,n (t, p) = Rn (p) (2) 1 X Ba Li,n (p), Ti,n (p), Di,n (p) δ(t − Ti ) , 2 i=1 p where Ba (L, T, D) = PR (L) exp (−j2π fc T ) αa (D), αa (D) = exp (−j2π d sin (D) a/λ), and δ(·) is the Dirac delta function [12]. Assuming that both user and AP employ a root raise cosine (RRC) filter for interpolation and decimation, characterized by a roll-off factor ρ and a modulation interval Ts [13, Ch. 7], the equivalent base-band channel is
=
Rn (p)
Bob
AP
ha,n (t, p) =
1 X Ba (Li,n (p), Ti,n (p), Di,n (p)) 2 i=1
(3)
rcos(t − Ti,n (p), Ts , ρ) ,
Alice WA
where rcos(t, Ts , ρ) denotes the raised cosine function [13, Ch. 7]. We assume that the first ray, i.e., with i = 1, is the one with the highest received power. This ray will be later used by the APs for synchronization. B. CSI Estimation
Trudy
Fig. 1. Schematic representation of the security scenario involving Alice, Bob, and Trudy.
A. Channel model The channel is narrow-band with the user transmitting signals at frequency fc and wavelength λ = c/fc , with c the speed of light. Alice transmits Np publicly known pilot
The proposed PLA mechanism is based on the CSI estimated by the APs, which is obtained as follows. Let us consider the a-th antenna of n-th AP, performing estimation using the m-th received pilot signal, with m ∈ {0, . . . , Np − 1}. Then, the dominant channel tap, i.e., the one arriving at time T1,n (p), ha,n T1,n (p), p , for the transmitter in position p is estimated as (m) (4) ĝa,n (p) = ha,n T1,n (p), p + w , where w ∼ CN (0, σ 2 ) is the additive white Gaussian noise (AWGN), independent at different antennas. More in detail, the estimation noise standard deviation is σ = K σ0 where K and σ02 denote the noise scaling factor
and the unscaled noise power, respectively. Hence, over(m) all, ĝa,n (p) ∼ CN ha,n (T1,n (p), p), σ 2 , and the AP can then estimate the dominant channel tap, later used to infer PL and AoA, by collecting different estimations (m) (m) of ĝa,n (p). |ĝa,n (p)| follows a Rician distribution with 2 shape Kr,n (p) = h2a,n T1,n (p),2 p /σ , and scale parameter 2 Ωn (p) = ha,n T1,n (p), p + σ that depends on (3) and, in turn, the location of the user. Then, we can estimate the PL as [14] r̂n (p) =
PT GT GR , LD |µ̂n (p)|2
(5)
where NX p −1 A −1 N X 1 (m) 2 |µ̂n (p)| = |ĝ (p)| − σ 2 . NA Np a=0 m=0 a,n 2
(6)
Thus, the estimated PL at the n-th AP, r̂n (p), can be modeled as a random variable with mean rn (p), i.e., the true PL, 2 (p). In particular, by averaging over NA Np and variance σr,n d
measurements, we can leverage distribution convergence − → via the central limit theorem, i.e., p d 2 Np NA (r̂n (p) − rn (p)) − → N 0, σr,n (p) . (7) 2 Thus, r̂n (p) ∼ N rn (p), σr,n (p) . The maximum likelihood estimate of the AoA can be obtained by considering an angular sampling interval ζ ∈ {0, . . . , π} and evaluating [15] θ̂n (p) = arg max ζ
a=0
(m) ĝa,n (p) αa∗ (ζ) ,
pk = pk−1 + vk−1 T∆ ,
(10)
where vk = (vx,k , vy,k ), with vx,k , vy,k ∼ U[−ν, ν], ν is the maximum user velocity. Alice’s trajectory, and thus position pk , is unknown to both Bob and Trudy. However, both leverage Alice’s maximum velocity, ν, discovering that her next position must lie within a square window of side WA = ν T∆ , centered at pk−1 . The set of Alice’s possible positions in such a window is denoted by Pk ⊆ P. D. Security Assumptions and Attacker Capabilities
NX p −1 A −1 N X
We assume Alice’s starting position, i.e., at time t0 , to be authenticated, e.g., by using an upper-layer authentication protocol. Then, at time tk = k T∆ , she moves to
(8)
m=0
where ∗ denotes the complex conjugate. Assuming that the angular sampling is dense, σ is small, and Np is large enough, the AoA in the n-th AP can be approximated as 1 p d 2 Np θ̂n (p) − θn (p) − → N 0, σθ,n (p) , (9) where θn (p) is the AoA of the first ray, i.e., the one associated with the highest received power. To improve notational clarity, we denote the estimated PL and AoA at AP n during the authentication phase, correspond(k) (k) ing to the position pk at time tk , as r̂n and θ̂n , respectively, (k) (k) (k) and collected them as ϕ̂n = {r̂n , θ̂n }. Finally, we concatenate all APs’ observations collected at time tk into the vector (k) (k) ϕ̂(k) = [ϕ̂1 , . . . , ϕ̂N ]⊤ . C. Channel Knowledge Map We assume Bob to be provided with a CKM [5]–[7] derived using any method described in Section I, where, for each AP n, a user location p is mapped to ϕn (p) = {rn (p), θn (p)}. The vector of CKM at Bob is ϕ(p) = [ϕ1 (p), . . . , ϕN (p)]⊤ . The CKMs are considered to be noiseless, e.g., computed by averaging over an arbitrarily large set of measurements. 1 For larger σ values, a folded Gaussian distribution may be more appropriate to account for the wrapping of the angular domain.
Attacker Trudy aims to impersonate Alice to intrude on the system. The communication protocol’s parameters, e.g., the pilot sequence, are public and used by Trudy to generate the spoofing signals. Additionally, we assume that Trudy is synchronized with the legitimate devices and can overshadow Alice’s broadcast transmission. Thus, Bob cannot use inconsistencies between signals from different APs for PLA. Finally, we will analyze and design attacks considering scenarios where i) Trudy has not CKMs, and thus uses random position attacks, and ii) she has access to the maps, and therefore can select her position to increase the success probability of her attack. III. P ROPOSED AUTHENTICATION M ECHANISM We now describe the proposed PLA mechanism and the Trudy’s attack strategies, which will later used for the security analysis. A. Authentication Mechanism The authentication mechanism operates as follows. In a preliminary phase, Bob acquires the CKMs ϕ(p), as described in Section II-C. Bob also knows Alice’s position p0 at time t0 . At time tk , a message is received, and Bob must determine whether Alice or Trudy transmitted it. To this end, the message includes Np pilot sequences that allow Bob to estimate the dominant tap of the channel, as described in Section II-B, from which he obtains measurements ϕ̂(k) . Now, based on the current observation ϕ̂(k) and on the CKMs ϕ(p), Bob must assess the authenticity of the received signal. A hypothesistesting approach is adopted, later detailed in Section III-B. If the received signal is deemed authentic (i.e., originating from Alice), the Alice’s position is updated via a maximum a posteriori procedure as p̂k = arg max p ϕ̂(k) ϕ = ϕ(p) , (11) p∈Pk
and p̂k is the new position for the next authentication instant. If the received signal is deemed not authentic, i.e., originating from Trudy, an attack is detected, the message k is discarded, the estimate of Alice’s position remains unchanged.
B. Hypothesis Testing We frame the authentication problem using binary hypothesis testing, distinguishing between the legitimate H0 and alternative hypotheses H1 , i.e., when Alice or Trudy is the transmitter, respectively. The optimal test is the likelihood ratio test (LRT), which compares the likelihoods for H0 versus H1 [2]. Still, it requires knowledge about the observation model under both legitimate and alternative hypotheses. Therefore, such a test cannot be used in a security context, where no information is provided about the attacker to the verifier. The defender must then resort to either a LT or a GLRT [2]. The former uses the likelihood of being in a specific position in Pk as test function, i.e.,
p∈Pk
N Y = max p r̂n(k) |rn = rn (p) p θ̂n(k) |θn = θn (p) , n=1
(12) where we factored the terms by leveraging the independence between the PL and AoA measurements at different APs. When using the GLRT, the defender protects himself against the worst-case attack, i.e., the position more likely to be chosen by Trudy, and the test function becomes maxp∈Pk p ϕ̂(k) ϕ = ϕ(p) . γGLRT,k = (k) ϕ = ϕ(p) maxp∈P / k p ϕ̂
where f (x; µ, σ) is the pdf of the Gaussian distribution with mean µ and standard deviation σ, and P∅,n counts the fraction of how many positions in Pk have signal obstructions for AP n. An expression analogous to (15) is computed for p θ̂n |θn (p) . C. Attack Strategies
γLT,k = max p ϕ̂(k) ϕ = ϕ(p) =
p∈Pk
Gaussian distributed, thus considering for instance, the PL, p r̂n(k) |rn = rn (p) = (k) P∅,n , if r̂n = rn (p) = ∅ , (k) 0, if r̂n ̸= rn (p) = ∅ , (15) = (k) 0, if r̂n ̸= r̂n = ∅ , (k) (1 − P )f (r̂ ; r (p), σ (p)), otherwise, n n r,n ∅,n
(13)
Notice that the LT can be seen as a GLRT with an undefined alternative, where the maximum is taken over an arbitrarily large set of parameters [16]. Still, each approach has its advantages and disadvantages. In particular, GLRT patches the weakness of the LT by defending against the worst-case attack. On the other hand, this makes the test more vulnerable to all attacks that are different from the worst-case attack. These considerations will be confirmed by simulations in Section IV. In both cases, given that the test function γk , i.e., (12) or (13), the authenticity is verified by deciding between
We consider three attack strategies: random position, informed, and full map attacks. Random Position Attack: Trudy is in a random position, pT , inside the room but not close to Alice, i.e., pT ∈ P but pT ∈ / Pk , and broadcasts pilot signals to the APs. Informed Attack: Trudy, initially placed in position pT , knows Alice’s position, the whole CKM, and takes advantage of the check (12) to adjust her position. However, we assume that she can pick only positions close to the current location, i.e., the positions in the set PT ⊂ P collecting the positions in the square of size WT × WT centered at pT . Thus, she moves to the best position in PT , calculated as p⋆T,k = arg max p ϕ(p) ϕ = ϕ(p) . (16) p∈PT
Full Map Attack: Trudy is capable of moving instantly and in advance to any position in the room, not in Pk . Thus, she selects the position from which the attack is more likely to succeed as pT,k = p⋆k = arg max p ϕ(p) ϕ = ϕ(p) . (17) p∈P / k
Notice that this represents an upper bound to attack (16), where PT is extended to the entire indoor environment. In turn, the random position attack is a trivial informed attack where WT = 1. IV. N UMERICAL R ESULTS
( Ĥk =
H0 H1
if γk ≥ ξ , if γk < ξ ,
(14)
where ξ is a user-defined threshold for labeling the signal as legitimate or false. The performance of the test is evaluated considering the false alarm, i.e., the probability of labeling as fake the legitimate signal, PFA = P [Ĥ1 |H0 ] and the missed detection, i.e., the probability of labeling as legitimate a signal transmitted by Trudy, PMD = P [Ĥ0 |H1 ]. In detail, the likelihoods in (12) and (13) are computed as follows. As discussed in Section II-B, both PL and AoA are
The CKM are generated using the MATLAB ray-tracing tool with the channel model of Section II-B. The ray-tracer considers a room with dimensions of 8 × 5 × 3 m3 , with the furniture shown in Fig. 1. A similar environment has been used in [17]. Next, we run a Monte Carlo simulation in which, for each set of the considered parameters, we 1) set pk−1 as a random (sampled) position in the room. 2) choose pk as a random position2 within Pk , i.e., square window of side WA centered at pk , 2 We include only feasible positions, e.g., outside walls.
TABLE I D EFAULT S IMULATION PARAMETERS Parameter
Description
Value
N NA Np (PT )dBm (GT )dBi (GR )dBi (LD )dB (σ02 )dBm fc d Ts ρ ζs WM WA WT
Number of APs Number of Rx antennas Number of pilots symbols User Tx power User antenna gain AP single antenna element Other attenuation losses Unscaled noise power AP Carrier frequency Antenna elements spacing Symbol period RRC roll-off factor Angular sampling interval CKM squares size Alice movement window Trudy movement window
4 4 10 15 dBm 2 dBi 2 dBi 5 dB −35 dBm 2 GHz λ/2 100 ns 0.9 0.1 ◦ 0.1 m 7 WM 7 WM
3) set pT using one of the attacks described in Section III-C, We remark that, in this work, we have simulated the authentication of a single step, i.e., from tk−1 to tk , rather than the whole trajectory, leaving the study, for instance, of the authentication performance at subsequent steps after the attack, as a future work. Table I collects the simulation parameters, chosen to be compliant with IEEE 802.11 for noise scaling factor K = 10−3 , considering an extra margin in the link budget LD to account for all the receiver non-idealities, e.g., device losses and array-antenna element misalignment. A. Authentication Results First, we investigate the effects of the number of available APs (Fig. 2a) and noise (Fig. 2b) on the authentication performance of the LT against the random position attack, by considering the detection error trade-off (DET) curves, i.e., the missed detection as a function of the false alarm probability. As expected, the detection improves as the estimation noise decreases and N increases. However, increasing N brings more benefits to authentication performance. Indeed, having fewer APs means having more obstructions, thus fewer matches between CKM and observations, which induces the plateaux-behavior in Fig. 2a. Next, Fig. 3 shows the DET curves for the informed attack (16), including also the random position and the full map attack (17) against the LT. From Trudy’s point of view, the worst performance is obtained by using the random position attack, whereas the best is obtained by the full map attack. As anticipated in Section III-C, these confirm to be lower and upper bounds of the informed attack, respectively. Focusing on the informed attack, the performance improves as WT increases. Still, when Trudy is moving as much as Alice, i.e., WT = WA , and knows Alice’s previous position pk−1 , only a limited improvement is shown, achieving PMD ≈ 2 · 10−2 instead of PMD ≈ 6 · 10−3 for PFA = 10−2 . Notice that, signal obstructions lead to a constant value on the test function, for both legitimate and under attack scenarios, e.g., see (14).
Choosing a test threshold ξ lower than this value immediately leads to PMD = 0 and PFA = 1, thus inducing a step behavior in the linear domain, which translates into the saturation-like behavior of the PFA when in log scale, shown in Fig. 3. In Fig. 4, we test random position and full map attacks against both LT and GLRT checks. As expected, switching from the LT to the GLRT makes the detector more vulnerable to the random position attack. In fact, consider a measurement obtained by the random attack that has a low likelihood γLR (12), which would then be rejected by the LT. This measurement may differ from the one selected by the full map attack, thus leading to a low denominator in (13), and a higher overall test function, γGLRT . Nevertheless, the performance of the full map attack decreases when using the GLRT. Still, even if the GLRT is specifically designed for detecting such an attack, this is not always accomplished. The GLRT in fact cancels measurements that are similar to the ones selected by the full map attack, thus interfering with Alice’s measurements when ϕ(p⋆T ) is similar to ϕ̂(k) . V. C ONCLUSIONS We presented a novel PLA protocol that exploits the CKMs to authenticate a moving user in an indoor environment. Several attacks have been designed and include i) a random position attack, where the attacker randomly picks a position in the room and transmits from there, ii) an informed attack, where they exploit the CKM to set their position choosing among the ones close to their current position, and iii) a full map attack, where the attacker can move instantly to any position of their choice. Extensive numerical tests, with CKMs obtained via ray tracing, e.g., varying the number of available APs or testing different estimation noise values, highlight the effectiveness of the proposed approach against all the considered attacks. In detail, for the case of a random-position attack, the system can achieve up to PMD = PFA = 3 · 10−3 . In the case of a full-map attack, the system has been shown to guarantee up to PMD = PFA = 6 · 10−3 . R EFERENCES [1] Y. Zeng et al., “A tutorial on environment-aware communications via channel knowledge map for 6G,” IEEE Commun. Surveys Tuts., vol. 26, no. 3, pp. 1478–1519, Feb. 2024. [2] J. Zhang, F. Ardizzon, M. Piana, G. Shen, and S. Tomasin, “Physical layer-based device fingerprinting for wireless security: From theory to practice,” IEEE Trans. Inf. Forensics Security, vol. 20, pp. 5296–5325, May 2025. [3] P. Baracca, N. Laurenti, and S. Tomasin, “Physical layer authentication over MIMO fading wiretap channels,” IEEE Wireless Commun. Mag., vol. 11, no. 7, pp. 2564–2573, May 2012. [4] O. Esrafilian, R. Gangula, and D. Gesbert, “Learning to communicate in UAV-aided wireless networks: Map-based approaches,” vol. 6, no. 2, pp. 1791–1802, Nov. 2019. [5] T. Zhao, X. Wang, W. Yang, X. Xi, and J. Li, “On the common AOA error in CKM-based integrated sensing and communications,” IEEE Commun. Lett., vol. 27, no. 7, pp. 1859–1863, Jul. 2023. [6] E. Dall’Anese, S.-J. Kim, and G. B. Giannakis, “Channel gain map tracking via distributed kriging,” IEEE Trans. Veh. Technol., vol. 60, no. 3, pp. 1205–1211, Mar. 2011.
100
100
10−1
PMD
PMD
10−1
10−2
10−3
10−4 10−4
K= 0.001 0.05 0.2
N =1 N =2 N =3 N =4 10−3
0.01 0.1 0.5
10−2
10−3
10−2
10−1
100
10−4 10−4
10−3
PFA
10−2
10−1
100
PFA
(a) K = 0.1, varying N .
(b) Varying K, fixed N = 4.
100
100
10−1
10−1
PMD
PMD
Fig. 2. DET curves against the random position attack for various estimation noises values, σ = Kσ0 , and available APs, N .
10−2
10−3
10−4 10−4
WT = 1 WT = 3 WT = 7 WT = 21 Optimal Att. 10−3
10−2
10−3 Full Map Att., LT Rand. Pos. Att., LT 10−2
10−1
100
PFA
10−4 10−4
10−3
Full Map Att., GLRT Rand. Pos. Att., GLRT 10−2
10−1
100
PFA
Fig. 3. DET curve for K = 0.05 for considering random position attack, the informed attack with various values of WT , and the full map attack.
Fig. 4. DET comparing LT and GLRT against random position and full map attack for K = 0.05.
[7] K. Li, P. Li, Y. Zeng, and J. Xu, “Channel knowledge map for environment-aware communications: EM algorithm for map construction,” in Proc. of Wireless Commun. and Netw. Conf. (WCNC). IEEE, 2022, pp. 1659–1664. [8] Z. Dai et al., “Prototyping and experimental results for environmentaware millimeter wave beam alignment via channel knowledge map,” IEEE Trans. Veh. Technol., vol. 73, no. 11, pp. 16 805–16 816, Nov. 2024. [9] H. Li, P. Li, G. Cheng, J. Xu, J. Chen, and Y. Zeng, “Channel knowledge map (CKM)-assisted multi-UAV wireless network: CKM construction and UAV placement,” J. Commun. Info. Netw., vol. 8, no. 3, pp. 256– 270, Sept. 2023. [10] C. Zhang, Z. Zhou, X. Xu, Y. Zeng, Z. Zhang, and S. Jin, “Prototyping and experimental results for ISAC-based channel knowledge map,” IEEE Trans. Veh. Technol., vol. 74, no. 7, pp. 10 719–10 731, Feb. 2025. [11] Q. Wang, W. Liang, J. Zhang, K. Wang, and X. Jiang, “Knowledgeenhanced physical layer authentication for mobile devices,” IEEE Trans. Consum. Electron., vol. 70, no. 4, pp. 7436–7448, Nov. 2024. [12] N. P. Waweru, D. B. O. Konditi, and P. K. Langat, “Performance analysis of MUSIC, root-MUSIC and ESPRIT DOA estimation algorithm,” Int.
J. Electr. Comput. Energ. Electron. Commun. Eng., vol. 8, pp. 209–216, Mar. 2014. [13] N. Benvenuto, G. Cherubini, and S. Tomasin, Algorithms for Communications Systems and their Applications. John Wiley & Sons, 2021. [14] J. Sijbers, A. den Dekker, P. Scheunders, and D. Van Dyck, “Maximumlikelihood estimation of Rician distribution parameters,” IEEE Trans. Med. Imag., vol. 17, no. 3, pp. 357–361, Jun. 1998. [15] P. Stoica and A. Nehorai, “MUSIC, maximum likelihood, and CramerRao bound,” IEEE Trans. Acoust., Speech, Signal Process., vol. 37, no. 5, pp. 720–741, May 1989. [16] F. Ardizzon and S. Tomasin, “On the relation between OC-LSSVM and likelihood test for physical layer authentication,” IEEE Commun. Lett., vol. 29, no. 12, pp. 2865–2869, Oct. 2025. [17] A. H. Hamza, S. A. Hussein, G. A. Ismaeel, S. Q. Abbas, M. M. A. Zahra, and A. H. Sabry, “Developing three dimensional localization system using deep learning and pre-trained architectures for IEEE 802.11 Wi-Fi,” East.-Eur. J. Enterp. Technol., vol. 4, no. 9(118), p. 41–47, Aug. 2022.