Parallelizing passive Radio Frequency Identification (RFID) reading is an arguably crucial, yet unsolved challenge in modern IoT applications. Existing approaches remain limited to time-division operations and fail to read multiple tags simultaneously. In this paper, we introduce QuinID, the first frequency-division multiple access (FDMA) RFID system to achieve fully parallel reading. We innovatively exploit the frequency selectivity of the tag antenna rather than a conventional digital FDMA, bypassing the power and circuitry constraint of RFID tags. Specifically, we delicately design the frequency-selective antenna based on surface acoustic wave (SAW) components to achieve extreme narrow-band response, so that QuinID tags (i.e., QuinTags) operate exclusively within their designated frequency bands. By carefully designing the matching network and canceling various interference, a customized QuinReader communicates simultaneously with multiple QuinTags across distinct bands. QuinID maintains high compatibility with commercial RFID systems and presents a tag cost of less than 10 cents. We implement a 5-band QuinID system and evaluate its performance under various settings. The results demonstrate a fivefold increase in read rate, reaching up to 5000 reads per second.

In IoT applications such as environmental monitoring and industrial security surveillance, audio sensors are increasingly used, among which wireless sensors are preferred. In order to achieve a sustained transmission, low-power wireless technology such as backscatter has been widely considered. However, existing backscatter systems encounter difficulties in audio transmissions due to the high power consumption from the complicated digital processing and fast frequency-shifting clocks. In this paper, we propose Satori, the first-of-its-kind in-band analog backscatter system for audio transmission with ultra-low power consumption. Satori eliminates the need for in-place digital processing by directly embedding analog audio voltages into backscattered WiFi symbols through analog modulation. It also avoids the power consumption of the frequency-shifting clock by transmitting the audio within the excitation WiFi signal's band. We implement the Satori prototype and evaluate it under various settings. The results indicate that Satori can transmit audio at a sampling rate of 41.67 kHz and achieve a SNR exceeding 18 dB.

mmWave-based activity recognition technology has attracted widespread attention as it provides the ability of device-free, ubiquitous and accurate sensing. Recognition of human activities intrinsically demands to be real-time and continuous, but the state of the arts is still far limited with the capacity in this regard. The main obstacle lies in activity sequence segmentation, i.e., locating the boundaries between consecutive activities in an activity sequence. This is a daunting task, due to the unclear activity boundaries and the variable activity duration. In this paper, we proposeZuMa, the first mmWave-based approach to real-time continuous activity recognition. When resorting to a machine learning model for activity recognition, our insight is that the recognition confidence of the recognition model is highly correlated to the accuracy of activity sequence segmentation, so that the former can be utilized as a feedback metric to finely adjust the segmentation boundaries. Based on this insight,ZuMais a coarse-to-fine grained approach, which includes the fast coarse-grained activity chunk extraction and the find-grained explicit segmentation adjustment and recognition. We have implementedZuMawith the commercial mmWave radar and evaluated its performance under various settings. The results demonstrate thatZuMaachieves an average recognition error of 12.67%, which is 65.08% and 71.87% lower than that of the two baseline methods. The average recognition delay ofZuMais only 1.86 s.

Backscatter is an enabling technology for battery-free sensing in today’s Artificial Intelligence of Things (AIOT). Building a backscatter sensing system, however, is a daunting task, due to two obstacles: the unaffordable power consumption of the microprocessor and the coexistence with the ambient carrier’s traffic. In order to address the issues, we present Leggiero, the first-of-its-kind analog WiFi backscatter with payload transparency, and its enhanced version, Leggiero+. A specially designed circuit based on the varactor diode directly converts fast-varying analog sensor signals into the RF (radio frequency) signal phase, eliminating the need for a microprocessor to interface between the radio and the sensor. By precisely locating the WiFi packet’s extra long training field (LTF) section and carefully designing the reference circuit, Leggiero embeds the analog phase into the channel state information (CSI). A commodity WiFi receiver without hardware modification can simultaneously decode the WiFi and the sensor data. We implement and evaluate Leggiero and Leggiero+ under varied settings. Results show the tag’s power consumption (excluding the power of the peripheral sensor module) is$30\mu $W at a 400Hz sampling rate,$4.8\times $and$4\times $lower than the state-of-the-art WiFi backscatter schemes. Leggiero+ demonstrates enhanced throughput, communication range, and analog signal reproduction accuracy. Our design supports a variety of sensing applications, while maintaining the WiFi carrier’s throughput performance.

Backscatter is a key technology for battery-free sensing in industrial IoT applications. To fully cover numerous tags in the deployment area, one often needs to deploy multiple readers, each of which communicates with tags within its communication range. However, the actual backscattered signals from a tag are likely to reach a reader outside its communication range and cause interference. Conventional TDMA or CSMA based approaches for interference avoidance separate readers’ media access in time, leading to limited network throughput. In this paper, we propose Trident, a novel backscatter design that enables interference avoidance via frequency-space division. By incorporating a tunable bandpass filter and multiple terminal loads, a Trident tag can detect its channel condition and adaptively adjust the frequency and the power of its backscattered signals. We further propose a frequency assignment algorithm for the readers. With these designs, all the readers in the network can operate concurrently without being interfered. We implement Trident and evaluate its performance under various settings. The results demonstrate that Trident enhances the network throughput by$3.18\times $, compared to the TDMA-based scheme.

WiFi-based device localization is a key technology for smart applications, while most of which rely on LoS signals to work. However, in real-world indoor environments, very few LoS signals are usable for accurate localization. This article presents Bifrost , a novel hardware-software co-design to cope with this practical problem. The core idea of Bifrost is to reinvent WiFi signals to provide sufficient LoS signals. Specifically, we present a low-cost plug-in design of leaky wave antenna (LWA) that can generate orthogonal polarized signals: On the one hand, LWA disperses signals of different frequencies to different angles, thus providing AoA information for the localized target. On the other hand, the target further leverages the antenna polarization mismatch to distinguish AoAs from different LWAs. Besides, fine-grained information in CSI is exploited to mitigate multipath and noise. Besides, a dedicated Kalman filter is proposed to facilitate the cooperation of Bifrost and SpotFi, a state-of-the-art approach, to enhance the availability and accuracy of SpotFi. The evaluation results show that the median localization error of Bifrost is 0.81 m, 52.35% less than that of SpotFi. When combined with Bifrost to work in realistic settings, SpotFi can reduce the localization error by 33.54%.

Backscatter is an enabling technology for battery-free sensing in industrial IoT applications. For the purpose of full coverage of numerous tags in the deployment area, one often needs to deploy multiple readers, each of which is to communicate with tags within its communication range. But the actual backscattered signals from a tag are likely to reach a reader outside its communication range, causing undesired interference. Conventional approaches for interference avoidance, either TDMA or CSMA based, separate the readers’ media accesses in the time dimension and suffer from limited network throughput. In this paper, we propose Trident, a novel backscatter tag design that enables interference avoidance with frequency-space division. By incorporating a tunable bandpass filter and multiple terminal loads, a Trident tag is able to detect its channel condition and adaptively adjust the frequency band and the power of its backscattered signals, so that all the readers in the network can operate concurrently without being interfered. We implement Trident and evaluate its performance under various settings. The results demonstrate that Trident enhances the network throughput by 3.18×, compared to the TDMA based scheme.

Small Unmanned Aerial Vehicles (UAVs) are becoming potential threats to security-sensitive areas and personal privacy. A UAV can shoot photos at height, but how to detect such an uninvited intruder is an open problem. This article presents mmHawkeye, a passive approach for non-cooperative UAV detection and identification with a commercial off-the-shelf millimeter wave (mmWave) radar. mmHawkeye does not require prior knowledge of the type, motions, and flight trajectory of the UAV, while exploiting the signal feature induced by the UAV’s periodic micro-motion (PMM) for long-range accurate detection. The design is therefore effective in dealing with low signal-to-noise ratio and uncertain reflected signals from the UAV. After analyzing the theoretical model of the PMM feature, mmHawkeye can further track the UAV’s position containing range, azimuth and altitude angle with dynamic programming and particle filtering and then identify it with a Long Short-Term Memory–based detector. We implement mmHawkeye on a commercial mmWave radar and evaluate its performance under varied settings. The experimental results show that mmHawkeye has a detection accuracy of 95.8% and can realize detection at a range up to 80 m.

Backscatter is an enabling technology for battery-free sensing in today's Artificial Intelligence of Things (AIOT). Building a backscatter-based sensing system, however, is a daunting task, due to two obstacles: the unaffordable power consumption of the microprocessor and the coexistence with the ambient carrier's traffic. In order to address the above issues, in this paper, we present Leggiero, the first-of-its-kind analog WiFi backscatter with payload transparency. Leveraging a specially designed circuit with a varactor diode, this design avoids using a microprocessor to interface between the radio and the sensor, and directly converts the analog sensor signal into the phase of RF (radio frequency) signal. By carefully designing the reference circuit on the tag and precisely locating the extra long training field (LTF) section of a WiFi packet, Leggiero embeds the analog phase value into the channel state information (CSI). A commodity WiFi receiver without hardware modification can simultaneously decode the WiFi and the sensor data. We implement Leggiero design and evaluate its performance under varied settings. The results show that the power consumption of the Leggiero tag (excluding the power of the peripheral sensor module) is 30μW at a sampling rate of 400Hz, which is 4.8× and 4× lower than the state-of-the-art WiFi backscatter schemes. The uplink throughput of Leggiero is suficient to support a variety of sensing applications, while keeping the WiFi carrier's throughput performance unaffected.

Small Unmanned Aerial Vehicles (UAVs) are becoming potential threats to security-sensitive areas and personal privacy. A UAV can shoot photos at height, but how to detect such an uninvited intruder is an open problem. This paper presents mmHawkeye, a passive approach for UAV detection with a COTS millimeter wave (mmWave) radar. mmHawkeye doesn’t require prior knowledge of the type, motions, and flight trajectory of the UAV, while exploiting the signal feature induced by the UAV’s periodic micro-motion (PMM) for long-range accurate detection. The design is therefore effective in dealing with low-SNR and uncertain reflected signals from the UAV. mmHawkeye can further track the UAV’s position with dynamic programming and particle filtering, and identify it with a Long Short-Term Memory (LSTM) based detector. We implement mmHawkeye on a commercial mmWave radar and evaluate its performance under varied settings. The experimental results show that mmHawkeye has a detection accuracy of 95.8% and can realize detection at a range up to 80m.

WiFi-based device localization is a key enabling technology for smart applications, which has attracted numerous research studies in the past decade. Most of the existing approaches rely on Line-of-Sight (LoS) signals to work, while a critical problem is often neglected: In the real-world indoor environments, WiFi signals are everywhere, but very few of them are usable for accurate localization. As a result, the localization accuracy in practice is far from being satisfactory. This paper presents Bifrost, a novel hardwaresoftware co-design for accurate indoor localization. The core idea of Bifrost is to reinvent WiFi signals, so as to provide sufficient LoS signals for localization. This is realized by exploiting the dispersion effect of signals emitted by the leaky wave antenna (LWA). We present a low-cost plug-in design of LWA that can generate orthogonal polarized signals: On one hand, LWA disperses signals of different frequencies to different angles, thus providing Angle-of-Arrival (AoA) information for the localized target. On the other hand, the target further leverages the antenna polarization mismatch to distinguish AoAs from different LWAs. In the software layer, fine-grained information in Channel State Information (CSI) is exploited to cope with multipath and noise. We implement Bifrost and evaluate its performance under various settings. The results show that the median localization error of Bifrost is 0.81m, which is 52.35% less than that of SpotFi, a state-of-the-art approach. SpotFi, when combined with Bifrost to work in the realistic settings, can reduce the localization error by 33.54%.

Time-Slotted Channel Hopping (TSCH) is a popular link-layer pro-tocol defined in the IEEE 802.15.4e standard that improves the reli-ability and throughput of wireless sensor networks by exploiting diversity in both time and frequency. Despite the body of literature proposing several scheduling schemes for TSCH, a gap yet to be filled is the design of an effective way to deal with internal and external interference, which are both known to strongly affect communication performance. In fact, existing works either make use of a fixed schedule (and hence cannot cope with interference), or re-quire extra control traffic (and hence increase energy consumption). In this paper, we present SmarTiSCH, an interference-aware en-gine for IEEE 802.15.4e-based networks that retains the simplicity and energy-efficiency of autonomous scheduling, while increasing the awareness as well as robustness to both internal and external interference. With SmarTiSCH, the nodes in the network infer the presence of interference and react to it without the need of extra control traffic. Specifically, SmarTiSCH enables each node to infer the interference by passively observing existing data exchanges. It then lets a pair of nodes exchange information and mutually agree on a proper strategy to mitigate interference without the need of extra transmissions. We implement SmarTiSCH in Contiki-NG and evaluate its performance on a testbed of 20 off-the-shelf IEEE 802.15.4 devices based on the nRF52840. Our results show that SmarTiSCH increases the reliability of transmissions by up to 2.9 times compared to state-of-the-art approaches in the presence of interference, while even lowering the duty cycle by 54.3%.

Cross-Technology Communication (CTC) emerges as a technology to enable direct communication across different wireless technologies. The state of the art on CTC employs physical-level emulation. Due to the protocol incompatibility and the hardware restriction, there are intrinsic emulation errors between the emulated signals and the legitimate signals. Unresolved emulation errors hurt the reliability of CTC and the achievable throughput, but how to improve the reliability of CTC remains a challenging problem. Taking the CTC from WiFi to BLE as an example, this work first presents a comprehensive understanding of the emulation errors. We then propose WEB, a practical CTC approach that can be implemented with commercial devices. The core design of WEB is split encoding: based on the probabilistic distribution of emulation errors, the WiFi sender manipulates its payload to maximize the successful decoding rate at the BLE receiver. We implement WEB and evaluate its performance with extensive experiments. Compared to two existing approaches, WEBee and WIDE, WEB reduces the SER (Symbol Error Rate) by 54.6% and 42.2%, respectively. For the first time in the community, WEB achieves practically effective CTC from WiFi to BLE, with an average throughput of 522.2 Kbps.

iBeacon protocol is widely deployed to provide location-based services. By receiving its BLE advertisements, nearby devices can estimate the proximity to the iBeacon or calculate indoor positions. However, the open nature of these advertisements brings vulnerability to impersonation attacks. Such attacks could lead to spam, unreliable positioning, and even security breaches. In this paper, we propose Wi-attack, revealing the feasibility of using WiFi devices to conduct impersonation attacks on iBeacon services. Different from impersonation attacks using BLE compatible hardware, Wi-attack is not restricted by broadcasting intervals and is able to impersonate multiple iBeacons at the same time. Effective attacks can be launched on iBeacon services without modifications to WiFi hardware or firmware. To enable direct communication from WiFi to BLE, we use the digital emulation technique of cross technology communication. To enhance the packet reception along with its stability, we add redundant packets to eliminate cyclic prefix error entirely. The emulation provides an iBeacon packet reception rate up to 66.2%. We conduct attacks on three iBeacon services scenarios, point deployment, multilateration, and fingerprint-based localization. The evaluation results show that Wi-attack can bring an average distance error of more than 20 meters on fingerprint-based localization using only 3 APs.