Bluetooth Low Energy (BLE) is a prevalent technology in various applications due to its low power consumption and wide device compatibility. Despite its numerous advantages, the encryption methods of BLE often expose devices to potential attacks. To fortify security, we investigate the application of Physical-layer Key Generation (PKG), a promising technology that enables devices to generate a shared secret key from their shared physical environment. Although extensively investigated, PKG is generally discussed in the context of Wi-Fi, and existing solutions for BLE demonstrate significantly lower performance. To bridge this gap, we propose a distinctive approach that capitalizes on the inherent characteristics of BLE to facilitate efficient PKG. We utilize the constant tone extension within BLE protocols to extract comprehensive physical layer information and introduce an innovative method that employs Legendre polynomial quantization for PKG. This method facilitates the exchange of secret keys with a high key matching rate and a high key generation rate. The efficacy of our approach is validated through extensive experiments on a software-defined radio platform, underscoring its potential to enhance security in the rapidly expanding field of BLE applications. A pilot study on commercial off-the-shelf BLE devices further validates the system's practicality, revealing important trade-offs between performance and hardware constraints in real-world deployments.

Backscatter sensing has emerged as a significant technology within the Internet of Things (IoT), prompting extensive research interest. This paper presents LoMu, the first long-range multi-target backscatter sensing system designed for low-cost tags operating under ambient LoRa. LoMuintroduces an orthogonal sensing model that processes backscatter signals from multiple tags to extract motion information. The design addresses several practical challenges, including near-far interference among multiple tags, phase offsets from unsynchronized transceivers, and phase errors due to frequency drift in low-cost tags. To overcome these issues, we propose a conjugate-based energy concentration method to extract high-quality signals and a Hamming-window-based method to mitigate the near-far problem. Additionally, we exploit the relationship between excitation and backscatter signals to synchronize the transmitter (TX) and receiver (RX) and combine double sidebands of backscatter signals to eliminate tag frequency drift. Furthermore, a novel joint estimation algorithm is introduced to exploit both amplitude and phase information in target signals, enhancing frequency sensing results and robustness. Our implementation and extensive experiments demonstrate that LoMucan accurately sense up to 35 tags simultaneously and achieve an average frequency sensing error of 0.5% at a range of 400 meters, which is$4\times$the range of the state-of-the-art.

Backscatter sensing has shown great potential in the Internet of Things (IoT) and has attracted substantial research interest. We present LoMu, the first long-range multi-target backscatter sensing system for low-cost tags under ambient LoRa. LoMu analyzes the received low-SNR backscatter signals from different tags and calculates their phases to derive the motion information. The design of LoMu faces practical challenges including near-far interference between multiple tags, phase offsets induced by unsynchronized transceivers, and phase errors due to frequency drift in low-cost tags. We propose a conjugate-based energy concentration method to extract high-quality signals and a Hamming-window-based method to alleviate the near-far problem. We then leverage the relationship between the excitation signal and backscatter signals to synchronize TX and RX. Finally, we combine the double sidebands of backscatter signals to cancel the tag frequency drift. We implement LoMu and conduct extensive experiments to evaluate its performance. The results demonstrate that LoMu can accurately sense 35 tags at the same time. The average frequency sensing error is 0.7% at 400m, which is 4× distance of the state-of-the-art.

Bluetooth Low Energy (BLE) is a prevalent technology in various applications due to its low power consumption and wide device compatibility. Despite its numerous advantages, the encryption methods of BLE often expose devices to potential attacks. To fortify security, we investigate the application of Physical-layer Key Generation (PKG), a promising technology that enables devices to generate a shared secret key from their shared physical environment. We propose a distinctive approach that capitalizes on the inherent characteristics of BLE to facilitate efficient PKG. We harness the constant tone extension within BLE protocols to extract comprehensive physical layer information and introduce an innovative method that employs Legendre polynomial quantization for PKG. This method facilitates the exchange of secret keys with a high key matching rate and a high key generation rate. The efficacy of our approach is validated through extensive experiments on a software-defined radio platform, underscoring its potential to enhance security in the rapidly expanding field of BLE applications.

The rapid development of WiFi localization poses a serious privacy threat, as eavesdroppers can locate WiFi devices without their consent. In this paper, we present WiCloak, the first system that protects WiFi device location privacy while supporting normal WiFi communication simultaneously. The high-level idea of WiCloak is to inject a fake channel into WiFi CSI at the transmitter, which renders the CIR and time information obtained by eavesdroppers meaningless. We mathematically prove that the injected fake channel is effective in any wireless environment and can strictly protect the location privacy of WiFi devices. To simultaneously support communication for commercial WiFi receivers, we propose a method to cancel out the fake channel impacts in decoding and prove that the method should not impact communication performance. WiCloak can work on commercial WiFi devices without any hardware modification. We evaluate the communication performance of WiCloak on commercial WiFi receivers (e.g., MacBook and Mac Studio) and demonstrate that it achieves the same packet reception rate as normal WiFi. We show that WiCloak increases the localization error by 22× to normal WiFi.

WiFi backscatter localization is a promising technology for the Internet of Things. However, existing works cannot work well for large-scale and low-cost tags with commodity WiFi devices. We present Willow, which provides accurate localization for parallel backscatter tags with commodity WiFi devices. We design a packet-level orthogonal backscatter modulation method to generate multiple orthogonal backscatter signals and support in-band backscatter with ambient WiFi. We show that backscatter signals can be effectively extracted even under strong in-band interference. To work in real WiFi traffic, we propose adaptive packet selection-based modulation to guarantee the orthogonality of backscatter signals. For parallel localization, we propose an iterative inter-tag interference cancellation method and a location filtering method to remove location ambiguity. We theoretically analyze the effectiveness of our method in supporting parallel tags. We prototype Willow tags using low-cost hardware and implement Willow AP on commodity WiFi NIC AX200. Through extensive experiments, we show that Willow achieves a median localization error of 27 cm and supports 51 parallel tags, which is 2× and 17× better than the state-of-the-art method.

Long-range backscatter localization is a promising technology for the Internet of Things. Existing works cannot work well for distributed base stations and low-cost tags. We present LocRa, which provides accurate localization for long-range backscatter with distributed base stations. We present a novel method to extract accurate channel information and synchronize the phase of different base stations. To compensate for the frequency and phase error on low-cost tags, we combine multiple channel measurements and eliminate the error by aligning different channels. Finally, we exploit frequency domain characteristics of the backscatter signal to extend its bandwidth and improve the SNR, thereby enhancing the localization accuracy. We prototype LocRa tags using custom low-cost hardware and implement LocRa base stations on USRP. Through extensive experiments, we show that the localization error of LocRa is 6.8 cm and 88 cm when the tag is 5m and 50m away from the base station, which is 3.1× and 2.3× better than the state-of-the-arts methods.

LoRa backscatter is a promising technology to achieve low-power and long-distance communication for connecting millions of devices in the Internet of Things. We present P2LoRa, the first ambient LoRa backscatter system with parallel decoding and long-range communication. The high level idea of P2LoRa is to modulate data by shifting ambient LoRa packets with a small frequency. To achieve long distance communication, we enhance the SNR of the backscatter signal by concentrating leaked energy in both the frequency domain and time domain. We propose a method to accurately reconstruct and cancel the in-band excitation signal, which is orders of magnitude higher than the backscatter signal. For parallel decoding, we propose a method to cancel inter-tag interference with very low overhead and address the signal misalignment problem due to different time of flight. We prototype the P2LoRa tag with customized low-cost hardware and implement the P2LoRa gateway on USRP. Through extensive evaluations, we show that P2LoRa achieves a long communication distance of 2.2 km with ambient LoRa, and supports 101 parallel tag transmissions.