Recent advances in backscatter communication have exhibited great advantages on uplink, both in power consumption and communication performance. However, their downlink tends to lag far behind due to stringent on-device power constraints. This paper presentsSisyphus, a novel communication paradigm designed to empower backscatter devices with LoRa downlink. To achieve this, we propose a novel receiver design for passive coherent demodulation of LoRa. In this design, we creatively couple LoRa’s down-conversion with de-chirping (dc2), leveraging the processing gain brought by chirp spread spectrum (CSS) modulation to boost communication range without the need for additional power supply. Moreover, we exploit the cyclical time-frequency feature intrinsic to LoRa for demodulation, and a low-power analog-digital signal processing circuit with negligible power is devised to replace the existing power-intensive sampling and costly digital computation. We prototype Sisyphus for proof-of-concept, and comprehensive experimental results demonstrate that Sisyphus can achieve significant power savings compared to legacy LoRa receiver while retaining the anti-interference ability of legacy LoRa. We envision that the design of Sisyphus can unlock the potential for broader applications of LoRa-based backscatter devices.

The Internet of Things (IoT) can only thrive if IoT sensor nodes can be effortlessly deployed and maintained without compromising their general-purpose nature. However, existing low-power sensor systems fail to strike a balance between these two issues, leaving the widespread of IoT sensor nodes as an open problem. In this paper, we propose LEGO+ as a minimalist yet general-purpose sensing edge-end architecture. Instead of running embedded software on a redundant general-purpose microprocessor, LEGO+ can directly construct the desired control functionality for various IoT sensing applications through hardware-level logic orchestration. To achieve this, we first conduct an in-depth analysis of the underlying unit behaviors within IoT sensor systems and, based on this, abstract a uniform logic orchestration model. Next, to enable sensor nodes to comprehend and execute the generated logic, we devise a hierarchical atomic control circuit with negligible overheads. Finally, we develop a task state prediction scheme to further improve the overall operation efficiency among multiple nodes. We prototype LEGO+ for proof-of-concept and conduct comprehensive experiments, and the results demonstrate that LEGO+ can reduce the overall power consumption of sensor nodes by 86% and enhance task efficiency by 49%, thereby facilitating a wider array of IoT sensing applications.

Large-scale IoT sensor deployment calls for inexpensive, low-power sensor nodes that still perform long-range, large-scale networking at the system level. However, current sensor nodes are constructed according to the 'one-size-fits-all’ embedded design, where the processor and RF transceiver are indispensable but underutilized in low-duty cycles, resulting in overwhelmingly significant unit price and run-time power. In this paper, we propose a novel processor-sharing IoT architecture that converts the vast majority of sensor nodes from embedded computers to low-end RF peripherals. The conventional full-fledged sensor nodes are smashed into the air, and the scattered chips are scaled well with negligible overheads through a virtual I$^{2}$C bus calledRFBus. Specifically, RFBus interface is designed to be backward compatible with the I$^{2}$C bus interface, and thus, RFBus network inherits versatile link layer services transparently from the well-established I$^{2}$C link layer protocol. We design RFBus with joint consideration of system-level performance and deployment costs and evaluate the prototypes both indoors and outdoors. The result indicates that the proposed architecture achieves 6.09 × (indoor) and 6.69 × (outdoor) energy saving and reduces the unit price of sensor nodes by 23.5% (indoor) and 33.5% (outdoor).

Legacy LoRa receiver adopts a superheterodyne architecture with a runtime power consumption of up to 100mW, resulting in its low-power promise can only be delivered in low duty-cycle mode. This paper presents Sisyphus as an ultra-low-power LoRa receiver, ensuring around-the-clock LoRa availability while extending battery life significantly. To achieve this, we propose a novel receiver design for passive coherent demodulation of LoRa. In this design, we creatively couple LoRa's down-conversion with de-chirping (dc2), leveraging the processing gain brought by chirp spread spectrum (CSS) modulation to boost communication range without the need for additional power supply. Moreover, we exploit the cyclical time-frequency feature intrinsic to LoRa for demodulation, and a low-power analog-digital signal processing circuit with negligible power is devised to replace the existing power-intensive sampling and costly digital computation. We prototype Sisyphus for proof-of-concept, and comprehensive experimental results demonstrate that Sisyphus can achieve significant power savings compared to legacy LoRa receiver while retaining the anti-interference ability of legacy LoRa. We envision that the design of Sisyphus can unlock the potential for broader applications of LoRa.

Large-scale IoT sensor deployment calls for inexpensive, low-power sensor nodes that still perform long-range, large-scale networking at the system level. However, current sensor nodes are constructed according to the `one-size-fits-all' embedded design, where the processor and RF transceiver are indispensable but underutilized in low-duty cycles, resulting in overwhelmingly significant unit price and run-time power. In this paper, we propose a novel processor-sharing IoT architecture that converts the vast majority of sensor nodes from embedded computers to low-end RF peripherals. The conventional full-fledged sensor nodes are smashed into the air, and the scattered chips are scaled well with negligible overheads through a virtual I2C bus called RFBus. Specifically, the RFBus interface is designed to be backward compatible with the I2C bus interface, and thus, the RFBus network inherits versatile link layer services transparently from the well-established I2C link layer protocol. We design the RFBus with a joint consideration of system-level performance and deployment costs and evaluate the prototypes in indoor and outdoor scenarios. The result indicates that the proposed architecture achieves 6.09 x (indoor) and 6.69 x (outdoor) energy saving and reduces the unit price of sensor nodes by 23.5% (indoor) and 33.5% (outdoor).

The rapid development of IoT applications calls for re-configurable IoT devices that can easily extend new functionality on demand. However, in the current architecture, updating chip functions on the end device is highly coupled with the local microprocessor in both hardware and software aspects, leading to inadequate flexibility. In this paper, we propose LEGO, a lightweight architecture with chip-level plug-and-play capabilities for IoT end devices. To achieve this, we first decoupling the control over heterogeneous chips from end devices to the gateway, and design a novel Unified Chip Description Language (UCDL) to access various types of functional chips uniformly. To supporting chips plug-and-play, we design a novel signal converting circuit on end devices to generate all required underlying signals for chip control. We also design a layered instruction orchestrator and hierarchical scheduler to minimize transmission overhead. The results show that our LEGO system can respond to chips plug-and-play within 0.13 seconds, and the lightweight architecture could reduce 49%$\sim$61% of power consumption in practical scenarios compared with traditional IoT end devices that are controlled by a microprocessor. The lightweight and easy-to-deploy features of LEGO makes it helpful to reduce deployment cost, thus conducive to accelerating large-scale applications.

USB flash drives are widely employed for data storage including sensitive personal or business data. Current defense strategies to protect those data mainly focus on preventing data theft when a USB drive plugs into a host computer that is infected with malware. This paper reveals a threat - attackers can produce spy USB flash drives that are able to leak the stored data via covert wireless communication without triggering security defenses on host computers. In this paper, we presentSpyUSB, a USB flash drive implanted with a backscatter-based data theft hardware to demonstrate the threat of covert data theft.SpyUSBcollects data from the physical layer of the communication between the host computer andSpyUSBdevice, which is transparent to the security mechanisms on the host computer.SpyUSBleverages backscatter communication to create a covert wireless channel. Furthermore, we explore the opportunity of covert data theft when theSpyUSBdevice is disconnected from the host computer using a tiny energy reservoir. Our experiment shows thatSpyUSBcan achieve a transmission bandwidth of up to 1,600 kbps. After unplugged from a computer, it can maintain standby for over 6 hours or continuously transmit data for 1.9 hours.

Versatile Internet of Things (IoT) applications call for re-configurable IoT devices that can easily extend new functionality on demand. However, the heterogeneity of functional chips brings difficulties in device customization, leading to inadequate flexibility. In this paper, we propose LEGO, a novel architecture for chip-level re-configurable IoT devices that supports plug-and-play with Commercial Off-The-Shelf (COTS) chips. To combat the heterogeneity of functional chips, we first design a novel Unified Chip Description Language (UCDL) with meta-operation and chip specifications to access various types of functional chips uniformly. Then, to achieve chips plug-and-play, we build up a novel platform and shift all chip control logic to the gateway, which makes IoT devices entirely decoupled from specific applications and does not need to make any changes when plugging in new functional chips. Finally, to handle communications overheads, we built up a novel orchestration architecture for gateway instructions, which minimizes instruction transmission frequency in remote chip control. We implement the prototype and conduct extensive evaluations with 100+ types of COTS functional chips. The results show that new functional chips can be automatically accessed by the system within 0.13 seconds after being plugged in, and only bringing 0.53 kb of communication load on average, demonstrating the efficacy of LEGO design.

Road rage is a social problem that deserves attention, but few research has been done so far. In this paper, based on the biological topology of multi-channel electroencephalogram (EEG) signals, we propose a model which combines transferable attention (TA) and regularized graph neural network (RGNN). First, topology-aware information aggregation is performed on EEG signals, and complex relationships between channels are dynamically learned. Then, the transferability of each channel is quantified based on the results of the node-wise domain classifier, which is embedded into the emotion classifier as attention score. Importantly, we recruited 10 subjects and collected their EEG signals in pleasure and rage states in simulated driving conditions. We verify the effectiveness of our method on this dataset and compare it with other methods. The results indicate that our method is simple and efficient, with 85.63% accuracy in cross-subject experiments. It can be used to identify road rage.

Designing ultra-low power RFID sensor tags is a major challenge, especially when incorporating a micro-controller (MCU) to operate sensors. While simplifying MCU functionality can reduce power consumption, it has limited effect as the fundamental information transformation is necessary for communication between the RFID reader and the sensor. Unfortunately, information transformation requires baseband sampling and processing, which consumes significant power on passive RFID tags. This paper proposes a novel approach that enables the reader to communicate directly with the sensor, eliminating the need for information transformation of MCU. We address the unique challenges posed by the physical and link layers of the EPC Gen2 protocol and introduce GoodID, a cross-layer design for next-generation RFID sensor tags featuring ultra-low power consumption. We prototype the GoodID tag for proof-of-concept and demonstrate significant power benefits through experimental results.

Differing from tremendous existing works that mainly focus on optimizing backscatter communication, Radio-to-Bus (R2B) communication utilizes backscatter to offload processors from IoT devices to the gateway, achieving processor-free devices of significantly reduced power and hardware cost. However, R2B communication is not suitable for large-scale backscatter networks, since R2B cannot support parallel and long-range communication between the gateway and hundreds of R2B devices. In this article, we present Chipnet, a network that supports hundreds of long-range and concurrent connections between the gateway and multiple processor-free devices. The high-level design of Chipnet includes a parallel frequency-division uplink mechanism that can work on processor-free devices and a processor-free MAC layer protocol that supports gateway to broadcast downlink data and individually manage each processor-free device. This design addresses practical issues facing the processor-free device architecture, such as synchronizing hundreds of processor-free devices, assigning unique channel frequencies to every device, and realizing power-efficient processor-free signal conversion. The results demonstrate that a Chipnet network can achieve a task throughput of 2,400 tasks/s with a latency of 72.23 ms. Compared with the R2B network, Chipnet achieves 3×–5× improvements in network coverage range and two orders of magnitude improvement in both network throughput and network latency.

Distance bounding protocols guarantee a credible distance upper bound between the devices which require the spatial distance as a security parameter to defend Mafia Fraud attacks. However, in RF systems, the realization of distance bounding protocol faces obstacles due to low spectrum efficiency, since the distance bound estimation consumes a significant amount of frequency band in existing schemes. This hinders RF distance bounding from being practically deployed, especially in commonly used ISM bands. In this work, we propose an alternative, spectrum-efficient scheme for RF distance bounding. We build the physical layer as well as a protocol design based on SFCW signal and SFCW ranging. Thus, comparing existing schemes that consume many frequency bands, our scheme frees many spectrum resources. We propose solutions to the unique challenges facing such an SFCW-based scheme design, namely, data communication over unintelligent SFCW signals, and secure synchronization in the SFCW-based challenge-response exchange. We evaluate our scheme via the security analysis and physical layer simulations. The results show (i) its resistance to attacks commonly concerned in distance bounding, (ii) the feasibility of the physical layer design such as accurate ranging and data communication function, and (iii) the communication noise tolerance and the ability of multipath signal discrimination.

Energy consumption of Internet-of-Things end devices is a major constraint that limits their long-term and large-scale deployment. Conventionally, the radios and processors used in these end devices are major power consumption that drains at the level of milliwatts (mWs). However, in recent decades, backscatter communication has dramatically reduced the power consumed by the radios in end devices to microwatts (μWs), and thus the processor remains the major bottleneck for energy optimization.