Concurrent OFDM backscatter is promising for enabling efficient connectivity of soaring ultra-low power IoT devices. However, the existing designs rely on frequency-domain division, suffering from short synchronization distance, poor interference robustness and incompatibility with commercial Wi-Fi receivers. We present C2Scatter, the first concurrent OFDM backscatter system that decodes the tags' data in parallel with a single commercial OFDM Wi-Fi receiver. It is enabled by two key techniques. (1) A pulling-driven synchronization scheme on tags that achieves long-distance synchronization by exploiting the injection-pulling capacity rather than amplifying the received signal, thereby resolving the sensitivity-power trade-off in the prior works. (2) A lightweight delay-domain division scheme that deliberately introduces a unique time offset (TO) used as each tag's signal characteristic to separate concurrent tags' signals in the delay domain. The constructed delay-domain characteristics also tolerate frequency-domain distortion, enabling robust decoding with commercial Wi-Fi receivers. We prototype and test C2Scatter. Our design achieves 37dB higher sensitivity with 131.1× lower power consumption than the amplification-driven synchronization schemes, and is compatible with commercial 802.11n Wi-Fi NICs with the BER reduced by 179.1× and 75.6× at no cost of throughput compared with the SOTA NanoScatter and ConcurScatter, respectively.

Ambient LoRa backscatter enables long-range communication due to its long-period symbol. Most of the existing works struggle to balance range and throughput: systems with symbol-level modulation offers long transmission range at the cost of low data rate, while systems with high modulation efficiency suffer from limited transmission distance due to weak signals. We propose SubLoRa, which significantly improves throughput while maintaining long-range communication. SubLoRa achieves the high-rate modulation by the proposed Subchirp Frequency Offset Modulation (SFOM), which divides a chirp into multiple subchirps each being shifted by frequency. We propose a prewaveform sampling strategy that enables SFOM with low power. For decoding, we propose a Frequency-Difference Recombination of Chirp (FDRC) demodulation based on time-domain correlation, which enables reliable decoding of low-power signals in long-range links. We implement SubLoRa and conduct extensive evaluation. The results show SubLoRa can achieve up to 29.66× throughput gain and 7.54× throughput gain compared with the State-Of-The-Art (SOTA) LoRa backscatter system PLoRa and Pacim, respectively.

Physical layer steganography plays a key role in physical layer security. Yet most works are strongly modulation-sensitive and have to modify the modulation at the baseband. However, these methods cannot work with wireless devices whose baseband modulations cannot be software-defined. To overcome these drawbacks, we propose an analog solution that uses a symbiotic hardware component designed, called Pluggable Cloak, connecting to the radio frequency front end (RFFE) to establish a steganographic symbiotic channel (SSC) over constant envelope physical layer (CE-PHY) in 2.4GHz ISM band, such as Bluetooth, ZigBee and 802.11b Wi-Fi, to hide information. The advantage lies in enabling secure transmission of the deployed devices that are not software-defined with this pluggable hardware. Specifically, Pluggable Cloak analogously modulates the amplitude of CE-PHY, so that sensitive information can be securely sent to a customized receiver without being detected by regular CE receivers. To further protect hidden information from the detection of a malicious adversary, we propose methods to randomize the SSC. We develop a lightweight prototype to evaluate symbiosis, undetectability, and throughput. The results show that the symbol error rates (SERs) of the sensitive data received and regular CE data are lower than$10^{-5}$at the customized receiver. In contrast, the SER of the sensitive data is close to 1 in the adversary, confirming the effectiveness of the SSC technique.

Most of the existing OFDM backscatter systems adopt phase-modulated schemes to embed tag data, suffering from symbol-level modulation limitation, heavy synchronization accuracy reliance, and small tolerability to symbol time offset (STO) / carrier frequency (CFO) offset. We introduce SubScatter, the first subcarrier-level frequency-modulated OFDM backscatter which is able to tolerate bigger synchronization errors, STO, and CFO. The unique feature of SubScatter is our subcarrier shift keying (SSK) modulation. This method pushes the modulation granularity to the subcarrier by encoding and mapping tag data into different subcarrier patterns. We also design a tandem frequency shift (TFS) scheme that enables SSK with low cost and low power. Furthermore, we design SubScatter+ that shows these advantages while providing an even higher throughput without requiring more subcarrier patterns. We prototype and test SubScatter and SubScatter+, and the results show that our systems outperforms prior works in terms of effectiveness and robustness. Specifically, SubScatter has 743 kbps throughput that is 3.1 times and 14.9 times higher than RapidRider and MOXcatter, respectively. It also has a lower BER under noise and interferences which is over 6 times better than RapidRider or MOXcatter. Moreover, our proposed SubScatter+ could increase the throughput of SubScatter by 30%.

Ambient OFDM backscatter communication has attracted considerable research efforts. Yet the prior works focus on point-to-point backscatter from a single tag, leaving behind efficient backscatter networking of multiple tags. In this paper, we design and implement ConcurScatter, the first ambient OFDM backscatter system that scales to concurrent transmission of hundreds of tags. Our key innovation is building and using the subcarrier pattern diversity to distinguish concurrent tags. This would yield linear collision states rather than exponential ones in the prior works based on the IQ domain diversity, supporting more concurrent transmission. We concrete this by designing a suit of techniques including midair frequency synthesis that forms a unique subcarrier pattern for each concurrent tag, non-integer cyclic shift that contributes to support more concurrent tags, and subcarrier pattern reconstruction that creates virtual subcarriers to enable single-symbol parallel decoding. The testbed experiment confirms that ConcurScatter supports seven more concurrent tags with similar BER and 8.4× higher throughput than the point-to-point backscatter RapidRider. The large-scale simulation shows that ConcurScatter supports 200 tags which is 40× more than the state-of-the-art concurrent OFDM backscatter FreeCollision.

OFDM backscatter is crucial in passive IoT. Most of the existing works adopt phase-modulated schemes to embed tag data, which suffer from three drawbacks: symbol-level modulation limitation, heavy synchronization accuracy reliance, and small symbol time offset (STO) / carrier frequency (CFO) offset tolerability. We introduce SubScatter, the first subcarrier-level frequency-modulated OFDM backscatter which is able to tolerate bigger synchronization errors, STO, and CFO. The unique feature that sets SubScatter apart from the other backscatter systems is our subcarrier shift keying (SSK) modulation. This method pushes the modulation granularity to the subcarrier by encoding and mapping tag data into different subcarrier patterns. We also design a tandem frequency shift (TFS) scheme that enables SSK with low cost and low power. For decoding, we propose a correlation-based method that decodes tag data from the correlation between the original and backscatter OFDM symbols. We prototype and test SubScatter under 802.11g OFDM WiFi signals. Comprehensive evaluations show that our SubScatter outstands prior works in terms of effectiveness and robustness. Specifically, SubScatter has 743kbps throughput, 3.1× and 14.9× higher than RapidRider and MOXcatter, respectively. It also has a much lower BER under noise and interferences, which is over 6× better than RapidRider or MOXcatter.

This paper presents TiScatter, a timespan-based WiFi backscatter system that provides high-throughput communication with a single COTS receiver used. It outperforms the prior works that tradeoff between considerable data rate and practical deployment. To improve the data rate, TiScatter introduces a symbol-level times-pan modulation method that encodes tag data into the timespan between two modulated WiFi codewords in two successive WiFi packets. For decoding, TiScatter for the first time employs the injective feature between the checksum and the modulated codeword positions, which enables the demodulation of both the tag and original WiFi data using only one COTS receiver. This makes TiScatter more practical. Furthermore, we design TiScatter+ that shows these advantages while providing an even higher throughput under 802.11b excitations. We prototype our design, and comprehensive evaluations demonstrate that TiScatter shows a throughput over 100× higher than prior single-receiver backscatter systems like FS-Backscatter. It even has a better BER and throughput than the prior double-receiver backscatter systems like MOXcatter. Specifically, TiScatter provides 1) 2× higher peak throughput than MOXcatter and 2) an order of magnitude lower BER than MOXcatter with the presence of substantial interferences. In addition, TiScatter+ can deliver a throughput 3× higher than TiScatter under 802.11b ambient excitations. Our evaluation also confirms that TiScatter is generic and applicable to excitations under diverse WiFi standards (e.g., 802.11b/g/n).