Cross-Technology Communication (CTC) is an emerging technology that enables physical-layer direct communication from a WiFi sender to other Internet of Things (IoT) receivers via waveform emulation. Previous research has primarily relied on the reverse engineering to identify the suitable WiFi payloads capable of emulating waveforms similar to desired IoT packets (e.g., ZigBee). However, this approach has several limitations, including irreversibility, scalability challenges, symbol misalignment, and an over-reliance on empirical methods. In this work, we present XiTuXi, a one-size-fits-all solution to automatically achieve the CTC by taking advantage of the neural machine translation (NMT). Inspired by the task comparability between CTC and homophony-based cross-linguistic communication, we employ a well-known NMT model called Transformer to learn the rationale behind translating bit sequences for CTC without human intervention. Specifically, we introduce forward engineering as a solution to tackle the challenge of acquiring training datasets. By utilizing XiTuXi, we effortlessly achieved CTC across 30 protocol combinations (including 802.11b, g, n, ax, ah → Zig-Bee, Bluetooth, LoRa, and Sigfox), ultimately freeing experts from the tedious tasks they faced previously.

The emergence of high-precision indoor backscatter tag tracking in GPS-deprived environments has advanced applications from virtual reality to factory automation. Despite this, the high-precision tracking range remains limited to just a few meters, restricting the use of backscatters to the vicinity of checkpoints in warehouses, even though they possess a communication range of 50 m. We have identified that this limited localization range primarily originates from the butterfly effect in localization systems, where a slight phase measurement error gradually escalates into a substantial localization error. This article introduces two innovative phase estimation protocols to address the intrinsic challenges in achieving high-accuracy phase estimation over long-distance communication. The first, consistent phase estimator (CPE), resolves the$\boldsymbol {\pi }$-ambiguity commonly encountered with commercial radio-frequency identification readers. Building on this, CPE+ is designed to cancel flicker noise, neutral white noise, and restore spatial and temporal imbalances. Our experimental results demonstrate that CPE+ extends the range of accurate Angle of Arrival (AoA) estimation and centimeter-level localization from 8 to 15 m in stationary scenarios. It maintains decimeter-level accuracy across the entire 50-m communication range for CPE+ with two or more gateways. In dynamic scenarios, the error of CPE+ increases with tag speed, reaching a median localization error of 11.7 cm at 5 m for tag speeds of 50 cm/s.

Radio Frequency IDentification (RFID) is emerging as a vital technology of the Internet of Things (IoT). Billions of RFID tags have been deployed to locate daily objects such as equipment, pharmaceuticals, vehicles, and so on. Unlike previous solutions that focus on localizing tagged objects in the world coordinate system in reference to reader antennas, this work exploits a system, called RFCamera, that can identify and locate RFID-tagged objects in images with pixel dimensions. Our core insight is that an image is a visual AoA profile in terms of lights, which is resulted from the pinhole camera model. Similarly, we generate an RF image derived from the AoA profile of a tag using the same pinhole model as the camera. Consequently, the locations of visual entities corresponding to tagged objects are highlighted by comparing two types of images. To this end, we customized a camera system equipped with a pair of rotatable reader antennas. Our experimental evaluation demonstrates that RFCamera enables a mean error of 5.7∘ and 2.9∘ at azimuth and elevation angle estimation, respectively. It can locate a visual entity with a mean error of 51 pixels (i.e., ≈1.3 cm at 96 dpi) in a 640× 480 image.

This work enhances the machine-to-human communication between electronic toll collection (ETC) systems and drivers by providing an AM broadcast service to deployed ETC systems. This study is the first to show that ultra-high radio frequency identification signals can be received by an AM radio receiver due to the presence of the nonlinearity effect in the AM receiver. Such a phenomenon allows the development of a previously infeasible cross-technology and cross-frequency communication, called Tagcaster, which converts an ETC reader to an AM station for broadcasting short messages (e.g., charged-fees and traffic forecast) to drivers at tollbooths. The key innovation in this work is the engineering of Tagcaster over off-the-shelf ETC systems using shadow carrier and baseband whitening without the need for hardware nor firmware changes. This feature allows zero-cost rapid deployment in the existing ETC infrastructure. Two prototypes of Tagcaster are designed, implemented, and evaluated over four general and five vehicle-mounted AM receivers (e.g., Toyota, Audi, and Jetta). Experiments reveal that Tagcaster can provide good-quality (PESQ>2) and stable AM broadcasting service with a 30 m coverage range. Tagcaster remarkably improves user experience at ETC stations, and two-thirds of volunteer drivers rate it with a score of 4+ out of 5.

Estimating the angle-of-arrival (AoA) of an RF source by using a large-sized antenna array is a classical topic in wireless systems. However, AoA tracking systems are not yet used for Internet of Things (IoT) in the real world due to their unaffordable cost. Many efforts, such as a time-sharing array, emulated array, and sparse array, were recently made to cut the cost. This work introduces a log-spiral antenna belt ( LSAB ), a new novel sparse “planar array” that could estimate the AoA of an IoT device in 3D space by using a few antennas connected to a single timeshare channel. Unlike the conventional arrays, LSAB deploys antennas on a log-spiral-shaped belt in a non-linear manner, following the theory of minimum resolution redundancy newly discovered in this work. One physical 8 × 8 uniform planar array (UPA) and four logical sparse arrays, including LSAB , were prototyped to validate the theory and evaluate the performance of sparse arrays. The extensive benchmark demonstrates that the performance of LSAB was comparable to that of a UPA, with similar degree of resolution; and LSAB could provide over 40% performance improvement than existing sparse arrays. We also prototyped a second LSAB adapted to an RFID system for localizing RFID tags at centimeter-level accuracy.

Backscatter networks are becoming a promising solution for embedded sensing. In these networks, backscatter sensors are deeply implanted inside objects or living beings and form a deep backscatter network (DBN). The fundamental challenges in DBNs are the significant attenuation of the wireless signal caused by environmental materials (e.g., water and bodily tissues) and the miniature antennas of the implantable backscatter sensors, which prevent existing backscatter networks from powering sensors beyond superficial depths. This study presents RiCharge, a turbocharging solution that enables powering up and communicating with DBNs through a single augmented RF source, which allows existing backscatter sensors to serve DBNs at zero startup cost. The key contribution of RiCharge is the turbocharging algorithm that utilizes RF surges to induce constructive power surges at deep backscatter sensors in accordance with the FCC regulations, for overcoming the turn-on voltage barrier. RiCharge is implemented in commodity devices, and the evaluation result reveals that RiCharge can use only a single RF source to power up backscatter sensors at 60 m distance in the air (i.e., 10x longer than a commercial off-the-shelf reader) and 50 cm-depth under water (i.e., 2x deeper than the previous record).

Barcodes and NFC have become the de facto standards in the field of automatic identification and data capture. These standards have been widely adopted for many applications, such as mobile payments, advertisements, social sharing, admission control, and so on. Recently, considerable demands require the integration of these two codes (barcode and NFC code) into a single tag for the functional complementation. To achieve the goal of "one tag, two codes" (OTTC), this work proposes CoilCode, which takes advantage of the printed electronics to fuse an NFC coil antenna into a QR code on a single layer. The proposed code could be identified by cameras and NFC readers. With the use of the conductive inks, QR code and NFC code have become an essential part of each other: the modules of the QR code facilitate the NFC chip in harvesting energy from the magnetic field, while the NFC antenna itself represents bits of the QR code. Compared to the prior dual-layer OTTC, CoilCode is more compact, cost-effective, flimsy, flexible, and environment-friendly, and also reduces the fabrication complexity considerably. We prototyped hundreds of CoilCodes and conducted comprehensive evaluations (across 4 models of NFC chips and 8 kinds of NFC readers under 13 different system configurations). CoilCode demonstrates high-quality identification results for QR code and NFC functions on a wide range of inputs and under different distortion effects.

An ultrasonic positioning system (UPS) has demonstrated its high accuracy for years. However, few of the developed solutions have been deployed in practice to satisfy the localization demand of today’s smart devices, which lack ultrasonic sensors and were considered as being “deaf” to ultrasound. A recent finding demonstrates that ultrasound may be audible to the smart devices under certain conditions due to their microphone’s nonlinearity. Inspired by this insight, this work revisits the ultrasonic positioning technique and builds a practical UPS, called UPS+, for ultrasound-incapable smart devices. The core concept is to deploy two types of indoor beacon devices, which will advertise ultrasonic beacons at two different ultrasonic frequencies respectively. Their superimposed beacons are downconverted to a low-frequency by exploiting the nonlinearity effect at the receiver’s microphone. This underlying property functions as an implicit ultrasonic downconverter without inflicting harm to the hearing system of humans. We demonstrate UPS+, a fully functional UPS prototype, with centimeter-level localization accuracy using custom-made beacon hardware and well-designed algorithms.

Conventional vibration sensing systems, equipped with specific sensors (e.g., accelerometer) and communication modules, are either expensive or cumbersome to deploy. Recently research community revisits this classic topic by taking advantage of off-the-shelf RFIDs. However, limited by low reading rate and long wavelength, current RFID based solutions can only sense low-frequency (e.g., below 100 Hz) mechanical vibrations with larger amplitude (e.g., >5 mm). To address the issue, this work presents TagSound, an RFID-based vibration sensing system that explores a tag's harmonic backscattering to recover high-frequency and tiny mechanical vibrations accurately. The key innovations are in two aspects: harmonics based sensingand a newrecovery scheme. We implement TagSound with USRP platforms. Our comprehensive evaluation shows (i) TagSound can achieve a mean error of 0.37 Hz when detecting vibrations at frequencies below 100 Hz, and a mean error of 4.2 Hz even when the vibration frequency is up to 2500 Hz. (ii) TagSound can achieve a Hz-level frequency estimation even when the vibration amplitude is only 2 mm.

Recent advances in Cross-Technology Communication (CTC) have improved efficient cooperation among heterogeneous wireless devices. To date, however, even the most effective CTC systems require these devices to operate in the same ISM band (e.g., 2.4GHz) because of the conventional wisdom that wireless transceivers with different (fundamental) frequencies cannot communicate with one another. Our work, which is called TiFi, challenges this belief by allowing a 2.4GHz WiFi receiver (e.g., a smartphone) to identify UHF RFID tags, which operate at the spectrum between 840~920 MHz. TiFi does not require changing current smartphones or tags. Instead, it leverages the underlying harmonic backscattering of tags to open a second channel and uses it to communicate with WiFi receivers. We design and implement TiFi with commodity WiFi chipsets (e.g., Broadcom BCM43xx, Murata KM6D280 40, and Qualcomm WCN3990). Our comprehensive evaluation shows that TiFi allows WiFi receivers to identify UHF RFID tags within the range of 2 m and with a median goodput of 95%, which is comparable to today's mobile RFID readers.

This work enhances the machine-to-human communication between electronic toll collection (ETC) systems and drivers by providing an AM broadcast service to deployed ETC systems. This study is the first to show that ultra-high radio frequency identification signals can be received by an AM radio receiver due to the presence of the nonlinearity effect in the AM receiver. Such a phenomenon allows the development of a previously infeasible cross-technology and cross-frequency communication, called Tagcaster, which converts an ETC reader to an AM station for broadcasting short messages (e.g., charged- fees and traffic forecast) to drivers at tollbooths. The key innovation in this work is the engineering of Tagcaster over off-the-shelf ETC systems using shadow carrier and baseband whitening without the need for hardware nor firmware changes. This feature allows zero-cost rapid deployment in existing ETC infrastructure. Two prototypes of Tagcaster are designed, implemented and evaluated over four general and five vehicle-mounted AM receivers (e.g., Toyota, Audi, and Jetta). Experiments reveal that Tagcaster can provide good-quality (PESQ> 2) and stable AM broadcasting service with a 30 m coverage range. Tagcaster remarkably improves user experience at ETC stations and two- thirds volunteer drivers rate it with a score of 4+ out of 5.

In recent years, considerable effort has been recently exerted to explore the high-precision RF-tracking systems indoors to satisfy various real-world demands. However, such systems are tailored for a particular type of device (e.g., RFID, WSN or Wi-Fi). With the rapid development of the Internet of Things (IoT), various new wireless protocols (e.g., LoRa, Sigfox, and NB-IoT) have been proposed to accommodate different demands. The coexistence of multiple types of IoT devices forces users to deploy multiple tracking systems in a warehouse or a smart home where various IoT devices are running, which causes huge additional costs in installation and maintenance. To address this issue, this work presents iArk, which is a general-purpose tracking platform for all types of IoT devices working at the ultra high frequency band. Our innovation lies in the design of the "K+1"-model hardware, the protocol free middleware, and the multipath resistant learnware. By the virtue of decoupling from wireless protocols, iArk also allows researchers to concentrate on developing a new tracking algorithm without considering the protocol diversity. To date, the platform can support five mainstream types of IoT devices (i.e., NB-IoT, LoRa, RFID, Sigfox and Zigbee) and is scalable to other types with minimal effort.

Radio Frequency IDentification (RFID) is emerging as a vital technology of the Internet of Things. Billions of RFID tags have been deployed to locate daily objects such as equipment, pharmaceuticals, and vehicles, and so on. Unlike previous solutions that focus on localizing tagged objects in the world coordinate system in reference to reader antennas, this work exploits a system, called RFCamera, that can identify and locate RFID-tagged objects in images with pixel dimensions. Many applications would benefit from RFCamera. For instance, the RF-aware image annotation system is able to generate rich annotations for RFID-tagged entities in images at the pixel level for the deep learning; the RF-aware auto-focus allows surveillance camera to exactly focalize the burglar who carries the stolen tagged-property out of a crowd. Our core insight is that an image is a visual AoA profile in terms of lights, which is resulted from the pinhole camera model. Similarly, we generate an RF image, derived from the AoA profile of a tag using the same pinhole model as the camera. Consequently, the locations of visual entities corresponding to tagged objects are highlighted by comparing two types of images. To this end, we customized a camera system equipped with a pair of rotatable reader antennas. Our experimental evaluation demonstrates that RFCamera enables a mean error of 5.7° and 2.9° at azimuth and elevation angle estimation. It can locate a visual entity with a mean error of 51 pixels (i.e., ≈ 1.3 cm at 96 dpi) in a 640 × 480 image.

Embedding Radio-Frequency IDentification (RFID) into everyday objects to construct ubiquitous networks has been a long-standing goal. However, a major problem that hinders the attainment of this goal is the current inefficient reading of RFID tags. To address the issue, the research community introduces the technique of Bloom Filter (BF) to RFID systems. This work presents TagMap, a practical solution that acquires BFs across commercial off-the-shelf (COTS) RFID tags in the physical layer, enabling upper applications to boost their performance by orders of magnitude. The key idea is to treat all tags as if they were a single virtual sender, which hashes each tag into different intercepted inventories. Our approach does not require hardware nor firmware changes in commodity RFID tags - allows for rapid, zero-cost deployment in existing RFID tags. We design and implement TagMap reader with commodity device (e.g., USRP N210) platforms. Our comprehensive evaluation reveals that the overhead of TagMap is 66.22% lower than the state-of-the-art solution, with a bit error rate of 0.4%.

Embedding Radio-Frequency IDentification (RFID) into everyday objects to construct ubiquitous networks has been a long-standing goal. However, a major problem that hinders the attainment of this goal is the current inefficient reading of RFID tags. To address issue, the research community introduces the technique of Bloom Filter (BF) to RFID systems. This work presents TagMap, a practical solution that acquires BFs across commercial off-the-shelf (COTS) RFID tags in the physical layer, enabling upper applications to boost their performance by orders of magnitude. The key idea is to treat all tags as if they were a single virtual sender, which hashes each tag into different intercepted inventories. Our approach does not require hardware nor firmware changes in commodity RFID tags -allows for rapid, zero-cost deployment in existing RFID tags. We design and implement TagMap reader with commodity device (e.g., USRP N210) platforms. Our comprehensive evaluation reveals that the overhead of TagMap is 66.22% lower than the state-of-the-art solution, with a bit error rate of 0.4%.

This work enhances the machine-to-human communication between electronic toll collection (ETC) systems and drivers by providing an AM broadcast service to deployed ETC systems. This demo is the first to show that ultra-high radio frequency identification signals can be received by an AM radio receiver due to the presence of the nonlinearity effect in the AM receiver. Such a phenomenon allows the development of a previously infeasible cross-technology communication, called Tagcaster, which converts an ETC reader to an AM station for broadcasting short messages (e.g, charged-fees and traffic forecast) to drivers at tollbooths. The prototype of Tagcaster is designed, implemented and evaluated over four general and five vehicle-mounted AM receivers (e.g, Toyota, Audi, and Jetta). Experiments reveal that Tagcaster can provide good-quality (PESQ>2) and stable AM broadcasting service with a 30m coverage range.

An ultrasonic Positioning System (UPS) has outperformed RF-based systems in terms of its accuracy for years. However, few of the developed solutions have been deployed in practice to satisfy the localization demand of today's smart devices, which lack ultrasonic sensors and were considered as being "deaf'' to ultrasound. A recent finding demonstrates that ultrasound may be audible to the smart devices under certain conditions due to their microphone's nonlinearity. Inspired by this insight, this work revisits the ultrasonic positioning technique and builds a practical UPS, called UPS+, for ultrasound-incapable smart devices. The core concept is to deploy two types of indoor beacon devices, which will advertise ultrasonic beacons at two different ultrasonic frequencies respectively. Their superimposed beacons are shifted to a low-frequency by virtue of the nonlinearity effect at the receiver's microphone. This underlying property functions as an implicit ultrasonic downconverter without throwing harm to the hearing system of humans. We demonstrate UPS+, a fully functional UPS prototype, with centimeter-level localization accuracy using custom-made beacon hardware and well-designed algorithms.

Radio frequency identification technology has been recently employed as an effective solution for anti-counterfeiting. By attaching a tag on each product, a reader can provide a fast and automatic authentication. However, most of existing approaches adopt a per-tag approach to validate each product, which will incur a long scanning time and communication traffic when there are many products to be concurrently authenticated. To address these issues, batch authentication, e.g., SEBA, is proposed in recent literature. Batch authentication is an identification-free and probabilistic approach and aims to authenticate the validity of a batch of tags. Unfortunately, the existing batch authentication still suffers a serious scalability problem where the system cost linearly depends on the total number of genuine tags, e.g.,${\mathcal {O}(N)}$. Its efficiency will significantly decrease and even be worse than the per-tag approach when there is a large number of genuine tags in the system. This limitation hinders the batch authentication to be widely used in practice because there are up to millions of total genuine tags in usual. In this paper, we propose FISH, which is also probabilistic batch authentication-based, to overcome the scalability problem by reducing the dependence to${\mathcal {O}(\log (N))}$. Moreover, FISH owns the following two salient advantages: 1) FISH can identify the genuine products when there is no counterfeit product in the batch although it is identification-free in essence and 2) FISH can defend against silence attack by utilizing Pearson Chi-square test. Last, we also conduct the theoretical analysis and extensive simulation with the real logistics trace

Conventional spinning inspection systems, equipped with separated sensors (e.g., accelerometer, laser, etc.) and communication modules, are either very expensive and/or suffering from occlusion and narrow field of view. The recently proposed RFID-based sensing solution draws much attention due to its intriguing features, such as being cost-effective, applicable to occluded objects, auto-identification, etc. However, this solution only works in quiet settings where both the reader and spinning object remain absolutely stationary, as their shaking would ruin the periodicity and sparsity of the spinning signal, making it impossible to be recovered. To overcome such limitation, this work introduces Tagtwins, a robust spinning sensing system that can work in noisy settings. It addresses the challenge by attaching dual RFID tags on the spinning surface and developing a new formulation of spinning signal that is shaking-resilient, even if the shaking involves unknown trajectories. Our main contribution lies in two newly developed techniques. First, we propose relative spinning signal using dual tags' readings and analytically demonstrate its feasibility in various settings. Second, we introduce dual compressive reading to inspect high-frequency spinning with relatively low reading rate of RFIDs. We have implemented Tagtwins with commercial RFID devices and evaluated it extensively. Experimental results show that Tagtwins can inspect the rotation frequency with high accuracy and robustness.

Radio-frequency identification (RFID) systems, as major enablers of automatic identification, are currently supplemented with various interesting sensing functions, e.g., motion tracking. All these sensing applications forcedly require much higher reading rate (i.e., sampling rate) such that any fast movement of tagged objects can be accurately captured in a timely manner through tag readings. However, COTS RFID systems suffer from an extremely low individual reading rate when multiple tags are present, due to their intense channel contention in the link layer. In this work, we present a holistic system, called Tagwatch, a rate-adaptive reading system for COTS RFID devices. This work revisits the reading rate from a distinctive perspective: mobility. We observe that the reading demands of mobile tags are considerably more urgent than those of stationary tags because the states of the latter nearly remain unchanged; meanwhile, only a few tags (e.g., <; 20%) are actually in motion despite the existence of a massive amount of tags in practice. Thus, Tagwatch adaptively improves the reading rates for mobile tags by cutting down the readings of stationary tags. Our main contribution is a two-phase reading design, wherein the mobile tags are discriminated in the Phase I and exclusively read in the Phase II. We built a prototype of Tagwatch with COTS RFID readers and tags. Results from our microbenchmark analysis demonstrate that the new design outperforms the reading rate by 3:2× when 5 percent of tags are moving.

Deployment of billions of commercial off-the-shelf (COTS) radio frequency identification (RFID) tags has drawn much of the attention of the research community because of the performance gaps of current systems. In particular, hash-enabled protocol (HEP) is one of the most thoroughly studied topics in the past decade. HEPs are designed for a wide spectrum of notable applications (e.g., missing detection) without need to collect all tags. HEPs assume that each tag contains a hash function, such that a tag can select a random but predictable time slot to reply with a one-bit presence signal that shows its existence. However, the hash function has never been implemented in COTS tags in reality, which makes HEPs a ten-year untouchable mirage. This paper designs and implements a group of analog on-tag hash primitives (called Tash) for COTS Gen2-compatible RFID systems, which moves prior HEPs forward from theory to practice. In particular, we design three types of hash primitives, namely, tash function, tash table function, and tash operator. All of these hash primitives are implemented through the selective reading, which is a fundamental and mandatory functionality specified in Gen2 protocol, without any hardware modification and fabrication-a feature allowing zero-cost fast deployment on billions of Gen2 tags. We further apply our hash primitives in one typical HEP application (i.e., missing detection) to show the feasibility and effectiveness of Tash. Results from our prototype, which is composed of one ImpinJ reader and 3000 Alien tags, demonstrate that the new design lowers 70% of the communication overhead in the air. The tash operator can additionally introduce an overhead drop of 29.7%.

Conventional spinning inspection systems, equipped with separated sensors (e.g., accelerometer, laser, etc.) and communication modules, are either very expensive and/or suffering from occlusion and narrow field of view. The recently proposed RFID-based sensing solution draws much attention due to its intriguing features, such as being cost-effective, applicable to occluded objects and auto-identification, etc. However, this solution only works in quiet settings where the reader and spinning object remain absolutely stationary, as their shaking would ruin the periodicity and sparsity of the spinning signal, making it impossible to be recovered. This work introduces Tagtwins, a robust spinning sensing system that can work in noisy settings. It addresses the challenge by attaching dual RFID tags on the spinning surface and developing a new formulation of spinning signal that is shaking-resilient, even if the shaking involves unknown trajectories. Our main contribution lies in two newly developed techniques, relative spinning signal and dual compressive reading. We analytically demonstrate that our solution can work in various settings. We have implemented Tagtwins with COTS RFID devices and evaluated it extensively. Experimental results show that Tagtwins can inspect the rotation frequency with high accuracy and robustness.

Recent advances in Cross-Technology Communication (CTC) have improved efficient cooperation among heterogeneous wireless devices. To date, however, even the most effective CTC systems require these devices to operate in the same ISM band (e.g., 2.4 GHz) because of the conventional wisdom that wireless transceivers with different (fundamental) frequencies cannot communicate with one another. Our work, which is called TiFi, challenges this belief by allowing a 2.4 GHz WiFi receiver (e.g., a smartphone) to identify UHF RFID tags, which operates at the spectrum between 840 - 920 MHz. TiFi does not require changing current smartphones or tags. Instead, it leverages the underlying harmonic backscattering of tags to open a second channel and uses it to communicate with WiFi receivers. We design and implement TiFi with commodity WiFi chipsets (e.g., Broadcom BCM43xx, Murata KM6D280 40, and Qualcomm WCN3990). Our comprehensive evaluation shows that TiFi allows WiFi receivers to identify UHF RFID tags within the range of 2 m and with a median goodput of 95%, which is comparable to today's mobile RFID readers.

Recent advances in Cross-Technology Communication (CTC) have improved efficient cooperation among heterogeneous wireless devices. To date, however, even the most effective CTC systems require these devices to operate in the same ISM band (eg. 2.4GHz) because of the conventional wisdom that wireless transceivers with different (fundamental) frequencies cannot communicate with one another. In this demo, we present a practical CTC application, called øursystem, allowing a 2.4GHz WiFi receiver (eg. a smartphone) to identify UHF RFID tags, which operates at the spectrum between 840~920MHz. øursystem leverages the underlying harmonic backscattering of tags to open a second channel and uses it to communicate with WiFi receivers. We design and implement øursystem with commodity WiFi chipsets. Our comprehensive evaluation shows that øursystem allows WiFi receivers to identify UHF RFID tags within the range of $2$ m and with a median goodput of 95%, which is comparable to today's mobile RFID readers.

Recent years have witnessed the advance of RFID-based localization techniques that demonstrate high precision. Many efforts have been made locating RFID tags accurately with a mandatory assumption that the RFID reader's position is known in advance. Unfortunately, calibrating reader's location manually is always time-consuming and laborious in practice. In this paper, we present Tagspin, an approach using COTS tags to pinpoint the reader (antenna) quickly and easily with high accuracy. Tagspin enables each tag to emulate a circular antenna array by uniformly spinning on the edge of a rotating disk. We design an SAR-based method for estimating the angle spectrum of the target reader. Compared to previous AoA-based techniques, we employ an enhanced power profile modeling the relative signal power received from the reader along different spatial directions, which is more accurate and immune to ambient noise as well as measurement errors caused by hardware characteristics. Besides, we find that tag's phase measurements in practice are related to its orientation. To the best of our knowledge, we are the first to point out this fact and quantify the relationship between them. By calibrating the phase shifts caused by orientation, the positioning accuracy can be improved by 3:7×. We have implemented Tagspin with COTS RFID devices and evaluated it extensively. Experimental results show that Tagspin achieves mean accuracy of 7:3 cm with standard deviation of 1:8 cm in 3D space.

Radio-frequency identification (RFID) systems, as major enablers of automatic identification, are currently supplemented with various interesting sensing functions, e.g., motion tracking. All these sensing applications forcedly require much higher reading rate (i.e., sampling rate) such that any fast movement of tagged objects can be accurately captured in a timely manner through tag readings. However, COTS RFID systems suffer from an extremely low individual reading rate when multiple tags are present, due to their intense channel contention in the link layer. In this work, we present a holistic system, called Tagwatch, a rate-adaptive reading system for COTS RFID devices. This work revisits the reading rate from a distinctive perspective: mobility. We observe that the reading demands of mobile tags are considerably more urgent than those of stationary tags because the states of the latter nearly remain unchanged; meanwhile, only a few tags (e.g., < 20%) are actually in motion despite the existence of a massive amount of tags in practice. Thus, Tagwatch adaptively improves the reading rates for mobile tags by cutting down the readings of stationary tags. Our main contribution is a two-phase reading design, wherein the mobile tags are discriminated in the Phase I and exclusively read in the Phase II. We built a prototype of Tagwatch with COTS RFID readers and tags. Results from our microbenchmark analysis demonstrate that the new design outperforms the reading rate by 3.2x when 5% of tags are moving.

Millions of people nowadays share their television (TV) experience with other people through social media like Twitter or Facebook with mobile devices. It is generally believed that TV has been repurposed for social networks, called as social television. A key functionality of social television is that it allows the viewers to interchange their comments through mobile devices, thus creating the impression of watching TV like alongside a group of friends. To do so, mobile devices have to be aware of the current media context (identifier and progress) of what the TV is playing, known as synchronizing context from TVs to mobile devices. Unfortunately, most legacy systems are not able to track the playing progresses or need to upgrade TV devices. To address the issue, we design a purely software-based solution, called as TagScreen, which inserts a series of hidden sound markers into the audio of the content. TagScreen supports longrange or multipath-resistant synchronization at second-level, being independent of device diversity over severely frequency-selective acoustic channels. We implement TagScreen by using COTS TVs and mobile devices. The system has been extensively tested on 150 movies and 150 TV series across five different environments. Results show that TagScreen has a mean recognition accuracy of 98% up to 35m, and a mean tracking accuracy of 97%.

Deployment of billions of Commercial Off-The-Shelf (COTS) RFID tags has drawn much of the attention of the research community because of the performance gaps of current systems. In particular, hash-enabled protocol (HEP) is one of the most thoroughly studied topics in the past decade. HEPs are designed for a wide spectrum of notable applications (e.g., missing detection) without need to collect all tags. HEPs assume that each tag contains a hash function, such that a tag can select a random but predicable time slot to reply with a one-bit presence signal that shows its existence. However, the hash function has never been implemented in COTS tags in reality, which makes HEPs a 10-year untouchable mirage. This work designs and implements a group of analog on-tag hash primitives (called Tash) for COTS Gen2-compatible RFID systems, which moves prior HEPs forward from theory to practice. In particular, we design three types of hash primitives, namely, tash function, tash table function and tash operator. All of these hash primitives are implemented through selective reading, which is a fundamental and mandatory functionality specified in Gen2 protocol, without any hardware modification and fabrication. We further apply our hash primitives in two typical HEP applications (i.e., cardinality estimation and missing detection) to show the feasibility and effectiveness of Tash. Results from our prototype, which is composed of one ImpinJ reader and 3,000 Alien tags, demonstrate that the new design lowers 60% of the communication overhead in the air. The tash operator can additionally introduce an overhead drop of 29.7%.

Traditional vibration inspection systems, equipped with separated sensing and communication modules, are either very expensive (e.g., hundreds of dollars) and/or suffer from occlusion and narrow field of view (e.g., laser). In this paper, we present an RFID-based solution, Tagbeat, to inspect mechanical vibration using COTS RFID tags and readers. Making sense of micro and high-frequency vibration using random and low-frequency readings of tag has been a daunting task, especially challenging for achieving sub-millisecond period accuracy. Our system achieves these three goals by discerning the change pattern of backscatter signal replied from the tag, which is attached on the vibrating surface and displaced by the vibration within a small range. This paper introduces three main innovations. First, it shows how one can utilize COTS RFID to sense mechanical vibration and accurately discover its period with a few periods of short and noisy samples. Second, a new digital microscope is designed to amplify the micro-vibration-induced weak signals. Third, Tagbeat introduces compressive reading to inspect high-frequency vibration with relatively low RFID read rate. We implement Tagbeat using a COTS RFID device and evaluate it with a commercial centrifugal machine. Empirical benchmarks with a prototype show that Tagbeat can inspect the vibration period with a mean accuracy of 0.36ms and a relative error rate of 0.03%. We also study three cases to demonstrate how to associate our inspection solution with the specific domain requirements.

Traditional vibration inspection systems, equipped with separated sensing and communication modules, are either very expensive (e.g. hundreds of dollars) and/or suffer from occlusion and narrow field of view (e.g. laser). This demo brings forward a concept of 'communication is sensing', which is to make sense of the world purely based on communication carrier rather than specialized sensors. In this demo, we present an RFID-based solution, called Tagbeat, to inspect mechanical vibration using COTS RFID tags and readers. We implement our system using a COTS RFID device and evaluate it with a commercial centrifugal machine. Empirical benchmarks with a prototype show that our system can inspect the vibration period with a mean accuracy of 0.36ms and a relative error rate of 0.03%.

Traditional vibration inspection systems, equipped with separated sensing and communication modules, are either very expensive (e.g., hundreds of dollars) and/or suffer from occlusion and narrow field of view (e.g., laser). In this work, we present an RFID-based solution, Tagbeat, to inspect mechanical vibration using COTS RFID tags and readers. Making sense of micro and high-frequency vibration using random and low-frequency readings of tag has been a daunting task, especially challenging for achieving sub-millisecond period accuracy. Our system achieves these three goals by discerning the change pattern of backscatter signal replied from the tag, which is attached on the vibrating surface and displaced by the vibration within a small range. This work introduces three main innovations. First, it shows how one can utilize COTS RFID to sense mechanical vibration and accurately discover its period with a few periods of short and noisy samples. Second, a new digital microscope is designed to amplify the micro-vibration-induced weak signals. Third, Tagbeat introduces compressive reading to inspect high-frequency vibration with relatively low RFID read rate. We implement Tagbeat using a COTS RFID device and evaluate it with a commercial centrifugal machine. Empirical benchmarks with a prototype show that Tagbeat can inspect the vibration period with a mean accuracy of 0.36ms and a relative error rate of 0.03%. We also study three cases to demonstrate how to associate our inspection solution with the specific domain requirements.

For today's computer users, the mouse plays such an important role that it dominates the interaction interface in personal computer for nearly half a century since it was invented. However, the mouse is gradually unfit for the demand of modern 3D display techniques, e.g. 3D-projection or -screen, for the reason that the relevant interactions are confined in a surface. Although some new methods such as computer vision based techniques attempt to bridge the human-computer barrier, they suffer from many limitations such as ambiguity in multitargets and dependence on light. This paper presents a battery-free device called Tagball for 3D human-computer interaction via RFID tags. Tagball devises a control ball, on which N passive tags are attached, for users to generate two basic kinds of interactive commands: translation and rotation. Instead of locating N tags independently, we model the ball as a whole in a more cooperative way under the circumstance that their geometric relationships are known in advance. In addition, we consider the phase values measured by M RF antennas for these N tags as observations of the ball state. Our key innovations are the studies on motion behaviors of a group of tags by using Extended Kalman Filter, and the implementation based on purely Commercial Off-The-Shelf (COTS) RFID products. The systematical evaluation shows that Tagball traces the ball translation to 1.5cm and identifies ball orientation to 1.8° in 3D space.

Through-wall tracking has gained a lot of attentions in civilian applications recently. Many applications would benefit from such device-free tracking, e.g. elderly people surveillance, intruder detection, gaming, etc. In this work, we present a system, named Tadar, for tracking moving objects without instrumenting them us- ing COTS RFID readers and tags. It works even through walls and behind closed doors. It aims to enable a see-through-wall technology that is low-cost, compact, and accessible to civilian purpose. In traditional RFID systems, tags modulate their IDs on the backscatter signals, which is vulnerable to the interferences from the ambient reflections. Unlike past work, which considers such vulnerability as detrimental, our design exploits it to detect surrounding objects even through walls. Specifically, we attach a group of RFID tags on the outer wall and logically convert them into an antenna array, receiving the signals reflected off moving objects. This paper introduces two main innovations. First, it shows how to eliminate the flash (e.g. the stronger reflections off walls) and extract the reflections from the backscatter signals. Second, it shows how to track the moving object based on HMM (Hidden Markov Model) and its reflections. To the best of our knowledge, we are the first to implement a through-wall tracking using the COTS RFID systems. Empirical measurements with a prototype show that Tadar can detect objects behind 5" hollow wall and 8" concrete wall, and achieve median tracking errors of 7.8cm and 20cm in the X and Y dimensions.

RFID technology has been widely adopted in a variety of applications from logistics to access control. Many applications gain benefits from knowing the exact position of an RFID-tagged object. Existing localization algorithms in wireless network, however, can hardly be directly employed due to tag's limited capabilities in terms of energy and memory. For example, the RSS based methods are vulnerable to both distance and tag orientation, while AOA based methods put a strict constraint on the antennas' spacing that reader's directional antennas are too large to meet. In this paper, we propose BackPos, a fine-grained backscatter positioning technique using the COTS RFID products with detected phase. Our study shows that the phase is indeed a stable indicator highly related to tag's position and preserved over frequency or tag orientation, but challenged by its periodicity and tag's diversity. We attempt to infer the distance differences from phases detected by antennas under triangle constraint. Further, hyperbolic positioning using the distance differences is employed to shrink the tag's candidate positions until filtering out the real one. In combination with interrogation zone, we finally relax the triangle constraint and allow arbitrary deployment of antennas by sacrificing the feasible region. We implement a prototype of BackPos with COTS RFID products and evaluate this design in various scenarios. The results show that BackPos achieves the mean accuracy of 12.8cm with variance of 3.8cm.