To safeguard user data privacy, on-device inference has emerged as a prominent paradigm on mobile and Internet of Things (IoT) devices. This paradigm involves deploying a model provided by a third party on local devices to perform inference tasks. However, it exposes the private model to two primary security threats: model stealing (MS) and membership inference attacks (MIA). To mitigate these risks, existing wisdom deploys models within Trusted Execution Environments (TEEs), which is a secure isolated execution space. Nonetheless, the constrained secure memory capacity in TEEs makes it challenging to achieve full model security with low inference latency.

Bluetooth Low Energy (BLE) and LoRa are two dominant wireless protocols for the Internet of Things (IoT), each built with specific design goals, rendering them non-interoperable. Cross-Technology Communication (CTC) enables heterogeneous communication between BLE and LoRa. Despite these efforts, existing works suffer from low throughput and short communication range. In this paper, we present a novel system named BoRa, which enables bi-directional communication between the COTS BLE and COTS LoRa chips. The key idea of BoRa to emulate the linear frequency changes of the LoRa chirp is continuously tuning its Modulation Offset (MO), which is originally designed to compensate for the Carrier Frequency Offset (CFO) in BLE chips. BoRa can be readily run on COTS chips without any hardware modifications.

Bluetooth Low Energy (BLE) technology supports various Internet-of-Things (IoT) applications. However, because of their limited transmission power and channel interference, their performance is deficient over weak links. Extending physical layer symbols or using error correction code to the link layer is effective somehow. Introducing excessive BLE bits to both respectively can also decrease the network throughput. To optimize the BLE technology performance, we proposeCPL, a combining PHY and link layer optimization technology that adaptively allocates BLE bits to both the physical layer and link layer. Then we propose theCross-Layer BLE Bits Dynamic Allocation Modelthat unifies the gain of BLE bits in different layers. Finally, we propose aInterference-Aware Controlled CFO Fine-Tuning Methodthat calibrates the model according to different interference patterns. We implementCPLon Commercial-Off-The-Shelf (COTS) BLE chips and SDR. The experiment results show that under various interference conditions,CPLachieves 50× and 32.16% throughput improvement than RSBLE and Symphony.CPLreduces energy consumption by 60.42% to 97.95% compared to RSBLE, and 11.04% to 25.15% compared to Symphony.

In recent years, Bluetooth Low Energy (BLE) has become one of the most wildly used wireless protocols and it is common that users carry one or more BLE devices. With the extensive deployment of BLE devices, there is a significant privacy risk if these BLE devices can be tracked. However, the common wisdom suggests that the risk of BLE location tracking is negligible. The reason is that researchers believe there are no stable BLE fingerprints that are stable across different scenarios (e.g., temperatures) for different BLE devices with the same model. In this paper, we introduce a novel physical-layer fingerprint named Transient Dynamic Fingerprint (TDF), which originated from the negative feedback control process of the frequency synthesizer. Because of the hardware imperfection, the dynamic features of the frequency synthesizer are different, making TDF unique among different devices, even with the same model. Furthermore, TDF keeps stable under different thermal conditions. Based on TDF, we propose BTrack, a practical BLE device tracking system and evaluate its tracking performance in different environments. The results show BTrack works well once BLE beacons are effectively received. The identification accuracy is 35.38%-57.41% higher than the existing method, and stable over temperatures, distances, and locations.

Bluetooth Low Energy (BLE) is one of the most popular wireless protocols for building IoT applications because of its low energy, low cost, and wide compatibility nature. However, BLE communication performance can be easily affected by interference and blockages because of its low transmission power. This paper presents BLEW, a technique to improve the BLE communication performance over weak links by exploiting adaptive symbol extension and DNN-based demodulator to combat channel interference and maximize network throughput. First, we propose a phase peak clustering-based preamble detection method that coherently adds up the phase difference of preambles to combat the interference. We then propose a multi-domain DNN-based demodulator to fully extracts the temporal and spectrum features of the signal and enhance the demodulation performance. Finally, we model the throughput of Commercial Off-The-Shelf (COTS) BLE chips transmitting extended packets, which can be used to optimize the symbol length in an adaptive manner. We implement BLEW with USRP B210 and COTS nRF52840 platform. Experiments show that BLEW can increase throughput by up to 157.39 Kb/s compared with native BLE over typical weak links. Compared with existing approaches, BLEW has up to 25.70% higher preamble detection rate and up to 3.37 dB demodulation gain.