ISAC-Assisted Channel Knowledge Map Generation for Physical Layer Authentication Luca Bonaventura*, Edoardo Gardin, Alessia Barison, Francesco Ardizzon, and Stefano Tomasin Department of Information Engineering, University of Padova, Italy
arXiv:2607.20176v1 [eess.SP] 22 Jul 2026
⋆
Corresponding author, email: [email protected]
Abstract—Integrated sensing and communication (ISAC) enables the acquisition of environmental information by leveraging wireless signals transmitted for communication purposes. In this paper, we utilize this capability to reconstruct the layout of objects surrounding multiple receivers. Ray tracing is then applied to the reconstructed environment to infer the propagation channels for various transmitter positions, thereby constructing a channel knowledge map (CKM). The CKM is then used to verify the position of a legitimate transmitter, authenticating it against an adversarial device attempting to impersonate it from a different location. This physical layer authentication (PLA) mechanism utilizes the approximate known position of the legitimate transmitter, obtained, for instance, from the network as in cross-layer authentication, to compare the channel estimated from the received signal with the corresponding CKM data. We evaluate the impact on the PLA performance of both ISACinduced CKM reconstruction errors and receiver-side channel estimation noise, in terms of false alarm and missed detection probabilities. Finally, the proposed approach is validated using an ISAC dataset from the literature. Index Terms—Integrated Sensing and Communications, Channel Knowledge Map, Physical-layer Authentication.
I. I NTRODUCTION Integrated sensing and communication (ISAC) is expected to provide new services in sixth generation (6G) networks [1], and it can be used to reconstruct the propagation environment in which communication occurs, [2]. In this paper, we exploit ISAC to obtain a novel physical layer authentication (PLA) mechanism that enables the base station (BS) of a 6G network to authenticate received signals, i.e., to confirm that they come from a specific legitimate source. To this end, we exploit ISAC to first reconstruct the environment and then to obtain a channel knowledge map (CKM) [3] that enables the network to know in advance the channel expected for user equipments (UEs) in any position. By verifying real-time channel observations against those obtained from the CKM, the resulting ISAC-based PLA mechanism provides lightweight security with zero communication overhead, making it uniquely ideal for energy-constrained or rate-limited devices. However, establishing this required a priori model remains highly challenging for mobile users due to rapid temporal variations, as well as in complex indoor settings where non-line-of-sight (LoS) components and dynamic physical obstructions predominate. This work was supported by Agenzia per la cybersicurezza nazionale under the programme for promotion of XL cycle PhD research in cybersecurity C96E24000010005. The views expressed are those of the authors and do not represent the funding institution.
While CKMs have been applied to optimize unmanned aerial vehicle (UAV) networks [4] and enable training-less beamforming [5], and can even be constructed dynamically using ISAC [6], their exploitation for physical layer security remains largely unexplored. The few existing CKM-based authentication strategies, e.g., in [7], rely on the highly restrictive assumption that the legitimate user follows a trajectory predefined a priori by the verifier, limiting practical, uncoordinated deployments. In [8], we designed a PLA mechanism for authentication with CKM. However, we did not account for the errors and challenges of an actual ISAC-derived CKM. In this work, we design a framework that also addresses these challenges. Among other aspects, we consider the sensingbased map derivation and PLA to occur at different carrier frequencies and thus may be affected by different noises. Furthermore, we consider that part of the environment may not be reconstructed correctly due to obstructions or the shape of the target. This requires a CKM generation pipeline passing through point cloud reconstruction, three-dimensional (3D) environment reconstruction, and ray tracing. To overcome these limitations, this paper introduces a novel, environment-aware PLA framework leveraging ISAC-driven CKMs without requiring predefined user trajectories, but only partial information, e.g. having a coarse position from the upper layers in cross-layer authentication, or knowing the previous position of the user, as in [8]. The key contributions of this work are summarized as follows: ISAC-Based Environment Reconstruction: We utilize ISAC signals across multiple receivers to dynamically reconstruct the layout of surrounding objects, mapping the localized environment without dedicated sensing infrastructure using Poisson [9] with spatial tapering [10]. Ray Tracing-Based CKM Generation: We apply a deterministic ray tracing engine to the reconstructed object layout to predict site-specific propagation channels across various locations, establishing a robust, location-dependent CKM. Position-Based PLA and Refinement: We design a verification mechanism that authenticates a legitimate transmitter and detects spoofing attacks from alternative locations by comparing estimated channels with CKM entries, subsequently refining the authenticated transmitter’s position estimate. Performance Evaluation under Impairments: We evaluate, through Monte Carlo simulations, the impact of ISAC reconstruction errors and receiver-side channel estimation noise
on false alarm and missed detection probabilities, validating the framework using a literature-sourced channel state information (CSI) database. The remainder of the paper is organized as follows. Section II details the system model. Section III describes the CKMs derivation via ISAC. The considered PLA mechanism is introduced in Section IV. Section V presents the numerical results. Section VI draws the conclusion.
Rx signal
r(t, θ, ϕ) = h̃(t) ∗ s(t, θ, ϕ) + w(t) ,
Channel Estimation
Feature Extraction
...
...
Rx signal
Channel Estimation
ISAC
Point Cloud Reconstr.
II. S YSTEM M ODEL
...
We consider a cellular network comprising N BSs performing ISAC transmissions to simultaneously communicate with the UEs and sense the surrounding environment for the construction of a CKM, as described in the following. A monostatic ISAC architecture is assumed, in which each BS is equipped with two distinct uniform rectangular arrays (URAs): one transmit URA with Nt × Nt antenna elements and one receive URA with Nr × Nr antenna elements. The BSs are assumed to be loosely synchronized, and their connections to the core network are considered secure. Channel Characteristics: To capture the essence of our PLA mechanism based on CKMs, we consider a static environment, where the surrounding scene is assumed to remain stationary during the observation interval. Thus, the propagation characteristics are time-invariant. Transmissions are narrowband. The symbol period is denoted as Ts . Each BS periodically transmits a known probing waveform, with the delay applied across its URA as a function of the azimuth θ and elevation ϕ angles, respectively, denoted by s(t, θ, ϕ). The signal s has carrier frequency fI and bandwidth BI . The signal propagates through the environment and is subsequently reflected by surrounding scatterers. The receiver is assumed to be affected by additive white Gaussian noise 2 . The received signal is (AWGN) noise with variance σM (1)
where ∗ denotes convolution, h̃(t) is the channel impulse response (CIR) of the reflection channel and w(t) is complex 2 Gaussian distributed with zero mean and variance σM , i.e., 2 w(t) ∼ CN (0, σM ). A. Security Scenario For the design and evaluation of our PLA mechanism, we consider that a legitimate UE, Alice, is moving in the environment, communicating with the BSs. An attacker, Trudy, is instead a UE transmitting messages that aim at impersonating (or spoofing) Alice. On the basis of the signals received by all the BSs, the network will decide if the received signals come from Alice or Trudy. The UE positions are represented on a two-dimensional horizontal plane describing the environment. The plane is discretized into square cells of side length WM . Each position p = (x, y) corresponds to the center of one cell, and the set of all admissible positions is denoted by P.
Decision
ISAC-Assisted PLA
ISAC
Point Cloud Reconstr.
ϕ̂1 ...
ϕ̂N Feature Extraction
ϕN (p) Hypothesis ... Testing CKM
Ray Tracing ...
Feature Extraction
3D Env. Rec.
PA ISAC-Based CKM
Fig. 1. Schematic representation of the proposed ISAC-based PLA mechanism.
Assumptions on Alice and Bob: We assume Bob to have partial information about Alice, e.g., by knowing Alice’s previous position or by receiving such information from the upper layer in a cross-layer authentication setting. Thus, while Alice’s true position pA , is unknown to both Bob and Trudy, Bob knows that Alice position lies in the region PA = {p ∈ P|∥p − pA ∥ ≤ WA }, where WA represents the accuracy on the Alice’s reported position. Bob shall then combine such knowledge about Alice’s position with the CKMs at all the BSs to test whether the received signals are authentic or not. Authentication in particular is performed on the estimated channel from Alice’s transmissions, obtained through publicly known Np pilot sequences, exploited by Bob for channel estimation. It is worth remarking that Alice’s transmission occurs at carrier frequency fA , while the map derivation occurs via sensing at carrier frequency fI ≥ fA . Assumptions on Trudy: We assume that Trudy has full knowledge of the authentication protocol, including signal format and pilot symbols. III. ISAC-BASED C HANNEL K NOWLEDGE M AP E STIMATION The scheme of the proposed ISAC-based PLA mechanism is shown in Fig. 1. It comprises two main parts: the lower part performs the CKM estimation, while the upper part performs the PLA by exploiting the CKM and the CSI estimated from the received signal to be authenticated. This section describes the operations performed in the lower part to obtain the CKM from the environment reconstructed from the ISAC signals. Section IV will instead detail the PLA part. The CKM estimation comprises several blocks: first, the ISAC signal is processed to obtain a point cloud of the obstacle present in the environment. Then, a 3D reconstruction of the environment is obtained by using Poisson reconstruction. Such reconstruction is used to predict the channel conditions in the position of Alice, using a ray-tracer, thus providing the CKM. In the following, we describe the various blocks in detail.
A. Point Cloud Reconstruction To reconstruct the environment, we resort to a range-angle (RA) reconstruction [11]. Following [10], we first compute time of arrival (TOA) and the intensity of the highest peak at the n-th BS as Tn (θ, ϕ) = arg max rn (t, θ, ϕ) ∗ s(t, θ, ϕ) , Z t In (θ, ϕ) = rn (t, θ, ϕ) s⋆ (t − Tn (θ, ϕ), θ, ϕ) dt .
(2) (3)
The distance of an object from the BS is then dn (θ, ϕ) = cTn (θ, ϕ)/2 ,
(4)
where c denotes the speed of light in vacuum. The point cloud is then defined as the set of tuples Cn = {(dn (θi , ϕi ), θi , ϕi )}. The reconstructed point cloud exhibits spurious points distributed along spherical surfaces that surround strong reflectors. These artifacts originate from the finite angular resolution of the antenna array and, more specifically, from the presence of spatial sidelobes in the beamforming response. The reconstruction algorithm estimates the position of a scatterer by identifying, for each steering direction, the strongest peak of the channel impulse response (2). However, when a reflection is captured through a sidelobe, the estimated range remains approximately equal to that of the actual target, while the associated angular coordinates correspond to the current steering direction rather than the true one. As a result, the reconstruction becomes sidelobe-interference limited, since the same physical reflector may be repeatedly detected across adjacent steering directions. As the beam sweeps across neighboring angles, multiple points are therefore reconstructed at the same distance but with incorrect angular coordinates, producing circular arcs or spherical caps centered on the sensing BS. To suppress these artifacts, we use spatial tapering [12] prior to beamforming. Spatial tapering consists of weighting the antenna elements with a non-uniform amplitude distribution, thereby reducing the sidelobe levels of the array pattern. Unlike the conventional rectangular weighting, where all antennas contribute equally, tapering assigns smaller weights to elements near the array boundaries and larger weights to those near the center. This reduces the URA sensitivity to signals arriving from undesired directions, significantly attenuating reflections captured through sidelobes [13]. In this work, a Hann window is adopted due to its favorable sidelobe suppression characteristics and smooth transition to zero at the array edges [14]. In particular, since the sensing platform employs a Nr × Nr URA, we consider a 2D Hann window obtained as W2D = wθ wϕ⊤ , where wθ and wϕ are the 1D Hann windows. B. 3D Environment Reconstruction The N point clouds estimated at the individual BSs are merged into a single unified point cloud. To obtain a 3D representation from the point clouds, a mesh representation was adopted, i.e., a geometric structure composed of vertices,
edges, and faces that approximates the surface of the real object. Poisson reconstruction [9] is used to this end, due to its robustness to noise and the capability of reconstructing surfaces without imposing constraints on their shapes. On the other hand, one limitation of the Poisson reconstruction is the possible generation of spurious faces in regions where no points were measured, e.g., due to the presence of sparse outliers in such areas. To address this, we performed a point cloud selection procedure where we first computed the centroid of each triangular mesh. Then we compute the distance between the centroid and each vertex, and we eliminate the most distant points up to a fraction of 1% of the overall points. The reconstructed scenario is saved in the common STL format to aid cross-portability and visualization. C. Ray Tracing In the considered framework, the ISAC system is employed to sense the surrounding environment and reconstruct a geometric representation of the scene, including the locations of relevant reflecting objects and scatterers. The extracted environmental information is then incorporated into a channel modeling stage based on ray tracing, implemented using the MATLAB ray tracing toolbox, to estimate the propagation channel CIR between BS and the UE. We denote the CIR from the UE in position p to the a-th antenna of the n-th BS as ga,n (p). From our previous work [8] we have that ga,n (p) 2 . is Gaussian distributed with variance σM D. Feature Estimation To perform PLA, we consider two characterizing features of the CSI, namely the angle of arrival (AoA) and the path loss (PL) of the dominant path. For transmit (receive) antenna gains GT (GR ), and transmit power PT , the PL estimate can then be obtained as [15] r̂n (p) =
PT GT GR , LD |µ̂n (p)|2
(5)
where LD represents additional attenuation factors that are not captured by the path-loss term, and NA −1 1 X 2 |µ̂n (p)|2 = |ga,n (p)|2 − σM . (6) NA a=0 The maximum likelihood (ML) estimate of the AoA is obtained by scanning a discrete angular grid ζ ∈ Z = {0, . . . , π}, and computing [16] Nr2 −1
θ̂n (p) = arg max ζ∈Z
X
ga,n (p)αa (ζ) ,
(7)
a=0
where αa (ζ) = exp (−j2πd sin (ζ) a/λ), d is the antenna spacing and λ is carrier wavelength. Following the results of our previous work [8], we can show that for a sufficiently large number of antennas Nr2 , r̂n (p) can be approximated as real Gaussian distributed, i.e., 2 r̂n (p) ∼ N rn (p), σr,n (p) . (8)
Analogously, the resulting AoA estimate at the n-th BS can be approximately distributed as 2 θ̂n (p) ∼ N θn (p), σθ,n (p) , (9) where θn (p) denotes the angle of arrival associated with the strongest propagation path, i.e., the first ray. n For each BSon, we define, for a given position p, ϕn (p) = r̂n (p), θ̂n (p) . The CKM is obtained by aggregating the estimates from all the BSs, obtaing for each position p the map vector ϕ(p) = [ϕ1 (p), . . . , ϕN (p)]⊤ . (a) Ground truth.
IV. ISAC- BASED PLA M ECHANISM The upper part of the proposed ISAC-based PLA mechanism, shown in Fig. 1, is executed for every message received by the network. It aims at checking if the received message comes from Alice or not, and it is based on the CSI estimated at each BS. Features relevant for PLA are extracted from the CSI, similarly to what is done to build the CKM. Then, a hypothesis testing block compares the extracted features with those available in the CKM and makes a decision on the authenticity of the received message. In the following, we detail the operations performed in each block. A. Channel Estimation Following the results of our previous work [8], using the m-th received pilot signal, with m ∈ {0, . . . , Np − 1}, the BS (m) obtains an estimate ĝa,n of the channel from the transmitter in position p that can be modeled as Np −1
ĝa,n =
X
(m) ĝa,n = ha,n T1,n (p), p + w,
(10)
m=0
where T1,n (p) is the TOA of the dominant path and w ∼ 2 ). CN (0, σC B. Feature Extraction The BS extracts the features using the same procedure illustrated in Section III-D, applied to the actual received signal ĝa,n (p). Also in this case, the AWGN model (8) holds; 2 . however, now the noise variance is σC Thus, each BS obtains PL and AoA estimates ϕ̂n = {r̂n , θ̂n }, that Bob combines into the global feature vector ϕ̂ = [ϕ̂1 , . . . , ϕ̂N ]⊤ . C. Hypothesis Testing-based PLA Check The PLA uses the CKMs (Section III) and the partial knowledge about Alice’s position, PA as prior information to check whether observation ϕ̂ (Section IV-B) is legitimate, thus authenticating the received signal. The authentication test is based on binary hypothesis testing. We call H0 and H1 the legitimate and under attacker hypotheses, i.e., when Alice or Trudy is the transmitter, respectively. We assume that the legitimate party has no knowledge about Trudy. Additionally, only partial information about Alice is available. Thus, instead of the (optimal) likelihood ratio test (LRT) we resort to a generalized likelihood ratio test (GLRT),
(b) Reconstructed.
Fig. 2. Ground truth (a) and ISAC-reconstructed environment (b), and BS positions in the scene.
where denoting with ϕ the noiseless channel feature vector we have γ = max p ϕ̂ ϕ = ϕ(p) = p∈PA
= max
p∈PA
N Y
(11) p (r̂n |rn = rn (p)) p θ̂n |θn = θn (p) .
n=1
Thus, we test whether the features ϕ̂ from the signal to authenticate match ones potentially received from a transmitter in PA and thus, legitimate. In detail, likelihood (11) has been factored by leveraging the independence between the PL and AoA measurements at different BSs. Leveraging (8) and (9), it yields that both features are Gaussian distributed. Thus, considering for instance, the PL, the likelihoods are p r̂n |rn = rn (p) = P∅,n , if r̂n = rn (p) = ∅ , 0, (12) if r̂n ̸= rn (p) = ∅ , = 0, if rn (p) ̸= r̂n = ∅ , (1 − P∅,n )f (r̂n ; rn (p), σr,n (p)), otherwise, where f (x; µ, σ) is the pdf of the Gaussian distribution with mean µ and standard deviation σ, and P∅,n counts the fraction of how many positions in PA have signal obstructions for BS analogous to (12) is computed for n. An expression p θ̂n |θn = θn (p) . Finally, the authenticity is decided by the test function Ĥj = H0 if γ ≥ ξm and Ĥj = H1 if γ < ξ, where ξ is a suitable threshold. As customary, we evaluate the test performance by computing false alarm, i.e., the probability of labeling as fake the legitimate signal, Pfa = P [Ĥ1 |H0 ] and the missed detection, i.e., the probability of labeling as legitimate a signal transmitted by Trudy, Pmd = P [Ĥ0 |H1 ]. V. N UMERICAL R ESULTS In this Section, we evaluate the proposed ISAC-based CKMbased PLA framework. In particular, we use the Sensiverse dataset [17], specifically developed for the evaluation of ISAC systems, e.g., [18]. Positions of the BSs and area size are
400
400
350
350
300
300
100 95
400
400
350
350
300
300
100 95
90
450
500
250 350
400
400
350
350
300
300
80
400
450
500 75
250 350
400
450
500
250 350
400
400
350
350
300
300
85 80
400
450
500 75
70
250 350
400
450
500
250 350
65 60 55
400
450
500
(a) Ground truth.
PL (dB)
400
85
PL (dB)
250 350
90
70
250 350
400
450
500
250 350
65 60 55
400
450
500
(b) CKM.
Fig. 3. PL maps: (a) ground truth CKM, obtained from ray tracer on the true map (Fig. 2a) and (b) ISAC PL CKM estimated on the ISAC-reconstructed map (2b), at the four BSs (red dots).
A. CKM Reconstruction Performance
TABLE I D EFAULT S IMULATION PARAMETERS Parameter
Description
Value
N Nr Nt Np (PT )dBm (GT )dBi (GR )dBi (σ02 )dBm fA fI BI d WM WA
Number of BSs Number of BS Rx antennas Number of BS Tx antennas Number of pilots symbols UE Tx power UE antenna gain BS single antenna element Unscaled noise power BS UE carrier frequency ISAC carrier frequency ISAC bandwidth Antenna elements spacing CKM squares size Alice location uncertainty
4 32 × 32 1×1 10 26 dBm 2 dBi 5 dBi −55 dBm 3.5 GHz 26 GHz 400 MHz λ/2 1m 2 WM
Pmd
10-2
K M = 1, K C = 1 K M = 1, K C = 10 K M = 10, K C = 1 K M = 10, K C = 10
10
-3
10-3
10-2
Pfa Fig. 4. DET curve for different levels of noise KM and KC , for W = 2 m.
shown in Fig. 2, and simulation parameters are reported in Table I. We note in particular that sensing and channel estimation are performed at two different frequencies.
First, Fig. 2 compares the reconstructed environment with the ground-truth. The ISAC system can effectively detect walls and obstacles facing the BS. However, as expected, it encounters difficulties when reconstructing the surface and areas that are not directly visible from the BS. Since the BSs are deployed around the environment rather than uniformly covering the entire scene, the system is not always able to recover the full shape of the structures. Nevertheless, the reconstructed environment still provides sufficient geometric information to capture the main characteristics of the propagation scenario. B. Authentication Performance Next, we assess the impact of environmental reconstruction on the quality of CKM, i.e., verify whether ISAC can be used to generate reliable CKMs. To this end, Fig. 3 compares in reference PL CKMs, obtained from the ray tracer applied in the true environment, with the PL CKMs generated from the reconstructed scene, at different BSs. The results show that the reconstructed CKM struggles to accurately predict the channel in the regions between buildings, mainly due to imperfections in the underlying 3D environment reconstruction. However, outside these critical areas, the reconstructed maps provide a good approximation of the reference CKM, preserving the main spatial variations of the channels throughout the environment. Now, we evaluate the authentication performance of the proposed ISAC-based PLA scheme. The authentication decision is made using the GLRT test described in Section IV, which combines CKM and the partial knowledge of Alice’s position, e.g., obtained from the network, to decide whether the received signals are authentic. The performance is evaluated in terms of detection error trade-off (DET), thus showing the missed detection probability Pmd as a function of the false alarm
numerical results demonstrate that our framework maintains robust security even under non-ideal conditions, achieving false alarm and missed detection probabilities below 10−2 . This confirms the viability of combining environmental sensing with channel-aware positioning to secure future wireless networks.
P md
10-2
R EFERENCES WA=2m WA=3m WA=4m
10
-3
10-3
10-2
P fa Fig. 5. DET curve for different WA values. KM = 1 and KC = 1.
probability Pfa . The results are obtained through Monte Carlo simulations with 106 independent trials. Let the power of the AWGN noises for the CKM reconstruction and PLA channel estimation be σM = KM σ0 and σC = KC σ0 respectively. Then Fig. 4 shows the DET for different pairs of (KM , KC ), controlling the noise on the CKM feature estimation and on PLA feature estimation, respectively. The KM affecting the quality of the CKM appears to have a more relevant impact than KC , thus suggesting that it is worthwhile to devote more effort (e.g., increase the number of pilots) during the ISAC-assisted CKM estimation phase. On the other hand, once the CKM are estimated, we can have a lightweight and reliable PLA check, e.g., even with a relatively low amount of transmitted pilot signals. Fig. 5 reports the DET for different values of WA with KC = KM = 0 dB, to evaluate the impact of accuracy on the Alice position on the overall PLA scheme. As expected, higher WA values, and thus higher uncertainty, lead to worse results. Still, the decrease is controlled and can be countered by improving the quality of the estimated features, e.g., increasing KM . It is worth remarking that the perfect knowledge case was tested (i.e., with WA = 1 m), but has been omitted in the plot, as it achieved performance much lower than working point, i.e., PMD ≪ 10−3 for the considered range of PFA values. VI. C ONCLUSIONS In this paper, we proposed an ISAC-enabled framework that reconstructs the physical environment to build a data-driven CKM via ray tracing for PLA applications. By comparing real-time estimated channels with location-dependent CKM entries, the system effectively authenticates a legitimate transmitter and detects spoofing devices from alternative locations. Furthermore, we analyzed how ISAC reconstruction errors and receiver-side channel estimation noise impact system performance. Validated against a literature-sourced CSI dataset,
[1] X. Luo, Q. Lin, R. Zhang, H.-H. Chen, X. Wang, and M. Huang, “ISAC — a survey on its layered architecture, technologies, standardizations, prototypes, and testbeds,” IEEE Commun. Surveys & Tutorials, vol. 28, pp. 485–526, 2026. [2] Y. Zeng, J. Chen, J. Xu, D. Wu, X. Xu, S. Jin, X. Gao, D. Gesbert, S. Cui, and R. Zhang, “A tutorial on environment-aware communications via channel knowledge map for 6G,” IEEE Commun. Surveys & Tutorials, vol. 26, no. 3, pp. 1478–1519, Mar. 2024. [3] O. Esrafilian, R. Gangula, and D. Gesbert, “Learning to communicate in UAV-aided wireless networks: Map-based approaches,” IEEE Internet Things J., vol. 6, no. 2, pp. 1791–1802, Nov. 2019. [4] H. Li, P. Li, G. Cheng, J. Xu, J. Chen, and Y. Zeng, “Channel knowledge map (CKM)-assisted multi-UAV wireless network: CKM construction and UAV placement,” J. Commun. Info. Netw., vol. 8, no. 3, pp. 256– 270, Sept. 2023. [5] Z. Dai, D. Wu, Z. Dong, K. Li, D. Ding, S. Wang, and Y. Zeng, “Prototyping and experimental results for environment-aware millimeter wave beam alignment via channel knowledge map,” IEEE Trans. Veh. Technol., vol. 73, no. 11, pp. 16 805–16 816, Nov. 2024. [6] C. Zhang, Z. Zhou, X. Xu, Y. Zeng, Z. Zhang, and S. Jin, “Prototyping and experimental results for ISAC-based channel knowledge map,” IEEE Trans. Veh. Technol., vol. 74, no. 7, pp. 10 719–10 731, Feb. 2025. [7] Q. Wang, W. Liang, J. Zhang, K. Wang, and X. Jiang, “Knowledgeenhanced physical layer authentication for mobile devices,” IEEE Trans. Consum. Electron., vol. 70, no. 4, pp. 7436–7448, Nov. 2024. [8] L. Bonaventura, F. Ardizzon, and S. Tomasin, “Physical layer authentication with channel knowledge maps in indoor environments,” in Proc. Veh. Techol. Conf. (VTC-Spring), 2026, in press, available at ArXiv. [9] M. Kazhdan, M. Bolitho, and H. Hoppe, “Poisson surface reconstruction,” in Proc. Eurographics Sympo. on Geometry Proc., 2006, p. 61–70. [10] M. Liu, S. Sun, R. Gao, and M. Tao, “Beamforming design for ISAC systems with suppressed range-angle sidelobes,” IEEE Wirel. Commun. Lett., vol. 14, no. 7, pp. 1989–1993, 2025. [11] H. Luo, T. Zhang, C. Zhao, Y. Wang, B. Lin, Y. Jiang, D. Luo, and F. Gao, “Integrated sensing and communications framework for 6G networks,” IEEE Wirel. Commun., vol. 32, no. 6, pp. 102–109, 2025. [12] I. Bekkerman and J. Tabrikian, “Target detection and localization using MIMO radars and sonars,” IEEE Trans. Signal Process., vol. 54, no. 10, pp. 3873–3883, Oct. 2006. [13] A. Ghosh, T. Wild, J. Du, J. Tan, A. Grudnitsky, D. Chizhik, S. Mandelli, Y. Xing, F. Schaich, and H. Viswanathan, “A unified future: Integrated sensing and communication (ISAC) in 6G,” IEEE J. of Sel. Topics in Electromagn., Antennas and Propag., vol. 1, no. 1, pp. 365–374, Aug. 2025. [14] F. D. Enggar, A. M. Muthiah, O. D. Winarko, O. N. Samijayani, and S. Rahmatia, “Performance comparison of various windowing on FMCW radar signal processing,” in Proc. Int. Symp. on Electron. and Smart Devices (ISESD), 2016, pp. 326–330. [15] J. Sijbers, A. den Dekker, P. Scheunders, and D. Van Dyck, “Maximumlikelihood estimation of Rician distribution parameters,” IEEE Trans. Med. Imag., vol. 17, no. 3, pp. 357–361, Jun. 1998. [16] P. Stoica and A. Nehorai, “MUSIC, maximum likelihood, and CramerRao bound,” IEEE Trans. Acoust., Speech, Signal Process., vol. 37, no. 5, pp. 720–741, May 1989. [17] J. Luo, B. Zhou, Y. Yu, P. Zhang, X. Peng, J. Ma, P. Zhu, J. Lu, and W. Tong, “Sensiverse: A dataset for ISAC study,” 2023, arXiv. [18] J. Song, R. He, Z. Zhang, M. Yang, B. Ai, H. Zhang, and R. Chen, “3D environment reconstruction based on ISAC channels,” in Proc. Int. Conf. on Ubiquitous Commun. (Ucom), 2024, pp. 487–491.