WiFi Backscatter (How to do research using concepts from EE102b?)

Sachin Katti

1

2

Num

ber o

f Dev

ices

(B

illion

s)

0

2.25

4.5

6.75

9

Year

2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

Internet of Things Smartphone, Tablet, PC

we are here

IoT surpasses

Internet of Things (IoT) — First-class Citizen of Future Internet!

3

Vision — Ubiquitous Deployment of IoT Devices

4

Limiting Factor One — Battery Energy Density

Battery Energy Density

mW

h/c

m3

0

0.15

0.3

0.45

0.6

Year

1990 1992 1994 1996 1998 2000 2002 2004 2006 2008 2010 2012

Slow improvement — 3x over 22 years!

3x

5

Pow

er (u

W)

1.0010.00

100.001,000.00

10,000.00100,000.00

1,000,000.00

Accel MCU SRAM BLE Bluetooth Ant ZigBee WiFi

wireless radios

Wireless communication consumes orders of magnitude higher power compared to computation, storage, and sensing.

Limiting Factor Two — Wireless Radio Power Consumption

104x102x

5x

6

How should we communicate with IoT devices?

7

How about redesigning the communication system?

data source encoding

channel encoding modulator

channel

decoded data

source decoding

channel decoding demodulator

8

How about redesigning the communication system?

data source encoding

channel encoding modulator

channel

decoded data

source decoding

channel decoding demodulator

wireless research is hard?!

9

How should we communicate with IoT devices?

10

Insight — Leverage reflected wireless signals!

wall wallWiFi AP

reflected signals

Static reflection does not consume power. Can we leverage reflected wireless signals and embed information there?

Backscatter — An Ultra Low Power Communication Primitive

Backscatter enables ultra low-power wireless communication.

Backscatter reader Backscatter deviceCarrier Wave

Reflected Signal

TX AMP

LNARX

logicRF

harvester

12

What are challenges of using backscatter for IoT devices?

Challenge — Do not have reader infrastructure!

Backscatter deviceCarrier Wave

Reflected Signal

logicRF

harvester

Backscatter reader

TX AMP

LNARX

The lack of reader infrastructure prevents the wide deployment of backscatter systems.

Can we leverage WiFi signals for backscatter?

Backscatter deviceCarrier Wave

Reflected Signal

logicRF

harvester

Can we embed backscatter bits on an existing WiFi traffic?

15

XoRFi — enabling backscatter communication among commodity WiFi radios

16

XoRFi — embed backscatter bits on 802.11b WiFi

802.11b packets: 01100110…

tag bits: 10011010…

tag bits: 10011010…

802.11b WiFi Primer

802.11b packets: 01100110…

modulation

I

Q

I

QDBPSK DQPSK

wireless signal

802.11b — a WiFi protocol that supports 11Mbps transmission at 2.4GHz band. Most smartphones/tablets/laptops support 802.11b today

+1+1+1-1-1-1+1-1-1+1-1 -1-1-1+1+1+1-1+1+1-1+1

0 1

codeword

802.11b WiFi Primer

802.11b packets: 01100110…

+1+1+1-1-1-1+1-1-1+1-1 -1-1-1+1+1+1-1+1+1-1+1

0 1

codeword

802.11b WiFi uses a finite set of codewords to encode data 0 and data 1.

1Mbps: code 0/1, 2Mbps: code 0/1/2/3…

19

Key technique — codeword translation

A tag can translate a codeword from transmitter into another codeword within the same codebook.

code i

code j

tag data

code i —> code j

20

Key technique — codeword translation

A tag can translate a codeword from transmitter into another codeword within the same codebook.

code i

code j

tag data

tag data 0: don't translate tag data 1: translate

21

Codeword translation in 1Mbps 802.11b

code 0

code 1

+1+1+1-1-1-1+1-1-1+1-1 -1-1-1+1+1+1-1+1+1-1+1

code 0 code 1

= * -1

code 0 = code 1 * -1, code 1 = code 0 * -1

tag data

22

A tag can translate code 0/1 to code 1/0 by multiplying -1.

code 0 —> code 1 code 1 —> code 0

Codeword translation in 1Mbps 802.11b

code 0

code 1

tag data

23

What does * -1 mean for a wireless signal?

s(t)

s(t)*-1

How should we interpret -1?

S(t) is inverted S(t) is delayed

500uW power for a phase shifter 1uW for a 5ns delay

24

How to build codeword translation in 1Mbps 802.11b?

code i

code j

code i delay code j

tag data

25

Why the process of translating codewords is XOR?

tag data 0: code j = code i tag data 1: code j = code i * -1

code i

code j

code j = tag data XOR code i

tag data

26

How to decode the tag data?

code j XOR code i = tag data XOR code i XOR code i = tag data

Tag data decoding can be done by performing XOR with the data transmitted by the 802.11b transmitter.

code i

code j

tag data

27

Are we done? Not yet…

28

We cannot hear the backscattered signal…

We cannot hear the backscattered signal because the primary 802.11b WiFi signal is much louder!

29

Why the primary WiFi signal is much louder?

Because the primary WiFi signal and the backscattered signal share the same spectrum.

WiFi signal

backscatterPower

frequency

30

How to deal with the self-interference from the WiFi?

Power

frequency

We can move the backscattered signal away from the primary WiFi signal.

WiFi signal

backscatter

31

How to achieve such frequency shift at the tag?

Power

frequency

WiFi signal

backscatter

w(t)

We can multiply the primary WiFi signal w(t) with a square wave s(t) during backscatter.

w(t)*s(t)

32

How to decode the backscatter signal?

PowerWiFi signal

backscatter

w(t) w(t)*s(t) frequency

rx channel

802.11b receiver is able to reject interference outside of the channel.

33

Are we done? Not yet…

34

We actually have double side-band backscatter

PowerWiFi signal

backscatter

w(t) w(t)*s(t)

rx channel

frequency

interference to other WiFi traffic

35

How to eliminate one side of backscatter?

PowerWiFi signal

backscatter

w(t) w(t)*s(t)

rx channel

frequency

interference to other WiFi traffic

36

Signal that has a reversed polarity at one side?

PowerWiFi signal

backscatter

w(t) w(t)*s(t) frequency

+=

Putting Everything Together

802.11b packets: 01100110…

tag bits: 10011010…

tag bits: 10011010…

802.11b WiFi transmitter backscatter tag backscatter receiver

38

XoRFi system deployment

52m

16m

WiFi TX

Tag

WiFi RX

WiFi RX

WiFi TXTag

52m

16m

WiFi TX

Tag

WiFi RX

WiFi RX

WiFi TXTag

Packard building

line-of-sight deployment

non-line-of-sight deployment

39

Performance

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

0 10 20 30 40 50Th

roug

hput

(Mbp

s)

Distance (m)

30MHz25MHz

0 0.05

0.1 0.15

0.2 0.25

0.3 0.35

0 2 4 6 8 10 12 14 16

Thro

ughp

ut (M

bps)

Distance (m)

line-of-sight deployment

non-line-of-sight deployment

Applicationsa b c

Figure 2—Potential applications of Interscatter communication. (a) Active contact lens systems can backscatter Bluetooth transmissionsfrom a watch to generate Wi-Fi signals to a phone, (b) implantable brain interfaces can communicate by using Bluetooth headsets andsmartphones, and (c) credit cards can communicate with each other by backscattering Bluetooth transmissions from a smartphone.

ters Bluetooth packets on channel 38 to generate standards-compliant 802.11b packets on Wi-Fi channel 11.

Realizing this idea is challenging for at least three reasons.

• Wi-Fi and Bluetooth have different physical layer specifi-cations — Wi-Fi has a 20 MHz bandwidth and uses spreadspectrum coding. Bluetooth has a 1 MHz bandwidth anduses Gaussian Frequency Shift Keying (GFSK).

• Bluetooth operates at carrier frequencies that are differentfrom Wi-Fi. While sideband-backscatter modulation [20,29] could shift the carrier by tens of Megahertz, it createsa redundant copy on the other side of the carrier.2 This notonly wastes bandwidth but the redundant copy would alsolie outside the unlicensed ISM band (see §2.3.1).

• For bi-directional communication, we need a receiver atthe interscatter device. Wi-Fi and Bluetooth receivers con-sume orders of magnitude higher power than backscatterand would offset its power saving. In fact, existing ultra-low power receiver designs rely on amplitude modulation(AM) [24], which is not supported by Wi-Fi or Bluetooth.

At a high level, we first transform a Bluetooth transmis-sion into a single tone signal and use backscatter to createstandards-compliant Wi-Fi packets on a single side of theresulting single tone Bluetooth signal. Specifically, we makethree key technical contributions to achieve this design.

• We show for the first time that Bluetooth can be used as anRF source for backscatter communication. To do this, wecreate single-tone transmissions using Bluetooth devices.We leverage that Bluetooth uses GFSK that encodes bitsusing two frequency tones. Thus, if we could transmit astream of constant ones or zeros, we can create a singletone transmission. In §2.2, we describe how to achievethis on commodity Bluetooth devices in the presence ofthe data whitening, CRC and headers.

• We present the first single-sideband backscatter designthat creates frequency shifts on a single side of the car-rier. This lets us create 2–11 Mbps Wi-Fi signals shiftedby tens of Megahertz on only one side of our single

2Say an RF source transmits a signal sinft, sideband modulationbackscatters at a frequency of �f , resulting in sin�ft, which wouldin turn create the multiplicative signal sinftsin�ft = sin(f +�f )t+sin(f��f )t. The two sines corresponding to a signal with a positivefrequency shift and its mirror copy with a negative shift.

tone Bluetooth transmissions. We achieve this using com-plex impedances at the backscatter switch, without usingpower-consuming 2.4 GHz oscillators (see §2.3).

• We transform OFDM Wi-Fi devices into AM modulators.At a high level, the Wi-Fi device in our design modulatesthe amplitude profile of each OFDM symbol to create anAM signal. We show that this can be achieved by just set-ting the appropriate data bits, without the need for anyhardware power control. §2.4 describes how we performthis in the presence of Wi-Fi scrambling, convolutionalencoding and interleaving.

We build prototype backscatter hardware on an FPGAplatform and experiment with various Bluetooth and Wi-Fi devices. Our evaluation shows that we can generate 2–11 Wi-Fi signals from Bluetooth transmissions. To estimatethe power consumption, we also design an integrated cir-cuit using Cadence and Synopsis [3,13], which backscattersBluetooth and creates Wi-Fi signals. Our results show thatbackscattering 2 Mbps Wi-Fi signals using Bluetooth con-sume only 28 µW. Finally, to demonstrate the generality ofour approach, we also show the feasibility of generating Zig-Bee signals by backscattering Bluetooth transmissions.

To show the potential of our design, we implement proof-of-concepts for the three applications shown in Fig. 2. Webuild a contact lens form-factor antenna and evaluate it in-vitro to demonstrate that it can communicate with commod-ity devices. We also build an implantable neural recordinginterface antenna and evaluate it in-vitro using muscle tis-sue. Finally, we create credit card form-factor devices thatcan communicate with each other using Bluetooth transmis-sions as an RF signal source for backscatter.

2. SYSTEM DESIGNWe use backscatter to transform transmissions from Blue-

tooth devices into Wi-Fi signals. In this section, we first pro-vide an overview of Bluetooth and Wi-Fi physical layers andthen describe how to create single-tone transmissions usingBluetooth devices. We then show how to create an 802.11bsignal from this single tone Bluetooth transmission. Finally,we outline our design for bi-directional communication us-ing OFDM Wi-Fi as an AM modulator.

2.1 Bluetooth Versus Wi-Fi

2

Many applications: a) Smart contact lens b) Brain implants c) Credit cards talking to each other

41

Takeaways

• This entire research can be done using concepts from this class

• XoRFi — a novel backscatter communication system that can be built using off-the-shelf components

• XoRFi — a system that is able to communicate with commodity WiFi radios with close to zero power consumption