Wi-Fi Backscatter: Internet Connectivity for RF-Powered Devices

Bryce Kellogg, Aaron Parks, Shyamnath Gollakota, Joshua R. Smith, and David Wetherall
University of Washington
{kellogg, anparks, gshyam, jrsjrs, djw}@uw.edu

Abstract– RF-powered computers are small devices that com-

pute and communicate using only the power that they harvest from
RF signals. While existing technologies have harvested power from
ambient RF sources (e.g., TV broadcasts), they require a dedicated
gateway (like an RFID reader) for Internet connectivity.
We present Wi-Fi Backscatter, a novel communication system
that bridges RF-powered devices with the Internet. Specifically,
we show that it is possible to reuse existing Wi-Fi infrastructure
to provide Internet connectivity to RF-powered devices. To show
Wi-Fi Backscatter’s feasibility, we build a hardware prototype and Figure 1—Wi-Fi Backscatter at a high level. The figure shows a
demonstrate the first communication link between an RF-powered Wi-Fi Backscatter tag (an RF-powered device) communicating with
a Wi-Fi enabled mobile device. On the uplink, the Wi-Fi Backscat-
device and commodity Wi-Fi devices. We use off-the-shelf Wi-Fi ter tag conveys information by modulating the CSI and RSSI mea-
devices including Intel Wi-Fi cards, Linksys Routers, and our or- surements received at the Wi-Fi device. On the downlink, the Wi-
ganization’s Wi-Fi infrastructure, and achieve communication rates Fi device conveys information by encoding bits in the presence or
of up to 1 kbps and ranges of up to 2.1 meters. We believe that silence of Wi-Fi packets. The Wi-Fi Backscatter tag uses its low-
this new capability can pave the way for the rapid deployment and power Wi-Fi packet detector circuit to decode this information.
adoption of RF-powered devices and achieve ubiquitous connectiv-
ity via nearby mobile devices that are Wi-Fi enabled. they create an isolated network disconnected from the Internet. A
naïve solution is to develop and deploy special-purpose powered
infrastructure devices, along the lines of RFID readers, that can
C ATEGORIES AND S UBJECT D ESCRIPTORS
connect the two networks. But deploying new support infrastruc-
C.2.1 [Network Architecture and Design]: Wireless communi- ture adds cost and, more importantly, diminishes the key value-
cation proposition of RF-powered systems — an ability to operate without
dedicated power infrastructure.
K EYWORDS In this paper, we ask if it is possible to reuse existing infrastruc-
Backscatter; Internet of Things; Energy harvesting; Wireless ture to connect these devices to the Internet. Specifically, we seek
to design RF-powered devices that communicate directly with com-
1. I NTRODUCTION modity Wi-Fi devices. A positive answer would pave the way for a
It is increasingly becoming feasible to perform low-end comput- rapid and simple deployment of the RF-powered Internet of Things
ing, sensing, and more recently communication [17] by harvesting by letting these devices connect to existing mobile phones and Wi-
power from ambient RF signals including TV, cellular, and Wi-Fi Fi APs. It would also expand the functionality of Wi-Fi networks
transmissions [26, 27, 22]. This technology is intriguing because it in a new direction: from providing connectivity to existing Wi-Fi
may be embedded inexpensively into everyday objects to help real- clients to a whole new class of battery-free devices.
ize the pervasive vision of the “Internet of Things” [9]: objects that Achieving this capability, however, is challenging since conven-
operate and communicate with each other when they are nearby, all tional low-power Wi-Fi transceivers require much more power than
without the need to ever plug them in or maintain batteries. is available from ambient RF signals. Thus, it is not feasible for RF-
Existing technologies, however, lack the central component in powered devices to literally speak the Wi-Fi protocol. Conversely,
this vision of an RF-powered Internet of Things: an ability to con- since existing Wi-Fi devices are specifically designed to receive Wi-
nect RF-powered devices to the Internet. Using conventional radio Fi signals, it is unclear how they would decode other kinds of sig-
communication to achieve this connectivity is challenging, since it nals from RF-powered devices.
consumes orders of magnitude more power than is available in am- We introduce Wi-Fi Backscatter, a novel communication system
bient RF [23]. Communication techniques like ambient backscat- in which RF-powered “things” can communicate with off-the-shelf
ter [17] enable these devices to communicate with each other; but Wi-Fi devices. At a high level, a Wi-Fi Backscatter tag communi-
cates with a Wi-Fi device by modulating its Wi-Fi channel. Since
channel information including CSI and RSSI is widely available
Permission to make digital or hard copies of all or part of this work for personal or
on commodity Wi-Fi devices, the Wi-Fi receiver can extract the
classroom use is granted without fee provided that copies are not made or distributed modulated information by measuring the changes in its channel. To
for profit or commercial advantage and that copies bear this notice and the full citation understand this in more detail, consider the Wi-Fi Backscatter tag
on the first page. Copyrights for components of this work owned by others than ACM and Wi-Fi enabled mobile device in Fig. 1. The Wi-Fi Backscatter
must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, tag communicates by modulating the Wi-Fi channel as seen by the
to post on servers or to redistribute to lists, requires prior specific permission and/or a
mobile device. Specifically, it conveys a ‘1’ and a ‘0’ bit by either
fee. Request permissions from [email protected].
SIGCOMM’14, August 17–22, 2014, Chicago, IL, USA.
reflecting or absorbing the Wi-Fi packets received by the mobile
Copyright 2014 ACM 978-1-4503-2836-4/14/08 ...$15.00. device. The reflected signals change the per-packet CSI and RSSI
measurements, which the mobile device uses to decode messages
from the Wi-Fi Backscatter tag.
We also enable downlink communication to the Wi-Fi Backscat-
ter tag. While the mobile device can send Wi-Fi packets directly
to the tag, the latter cannot decode Wi-Fi transmissions. Instead,
Wi-Fi Backscatter relies on low-power circuit designs that can de-
tect energy corresponding to a Wi-Fi packet (see §4.2). Specifically,
as shown in the figure, the mobile device sends a pattern of short
Wi-Fi packets — the presence (absence) of the short Wi-Fi packet
encodes the ‘1’ (‘0’) bit. The Wi-Fi Backscatter tag decodes this in-
formation by using our low-power energy detector to differentiate Figure 2—Wi-Fi Backscatter Overview. It has three actors: a
between the presence and absence of Wi-Fi packets. In §4, we de- Wi-Fi reader, a Wi-Fi helper, and a RF-powered device (Wi-Fi
Backscatter tag). The reader and helper can be any commodity Wi-
velop the above ideas further and design Wi-Fi Backscatter to work Fi device, including routers and mobile devices. The Wi-Fi reader
in the presence of multiple Wi-Fi devices in the network. leverages the channel information from the Wi-Fi helper’s packets
To show the feasibility of our designs, we build prototype de- to decode the transmissions from the tag.
vices that are optimized to backscatter and harvest Wi-Fi signals at
frequencies spanning the entire 2.4 GHz Wi-Fi band. We evaluate actors: a Wi-Fi reader, a Wi-Fi helper, and an RF-powered Wi-Fi
our prototype in various scenarios with commodity Wi-Fi devices Backscatter tag. In principle, the reader and helper can be any com-
including Intel Wi-Fi cards and the Wi-Fi infrastructure in our or- modity Wi-Fi device, including routers and mobile devices. How-
ganization. We use the RSSI information that is widely available ever, for ease of exposition, we consider a Wi-Fi client, such as a
on commodity Wi-Fi devices. We also use the Intel CSI toolkit [13] mobile phone, to be the reader and a Wi-Fi AP to be the helper
to extract the finer grained CSI information. Our results show the device. We envision the RF-powered devices to be wireless sensor
following. nodes that are embedded in everyday objects. The Wi-Fi Backscat-
ter tags do not require any batteries and can harvest energy from
• The Wi-Fi devices can reliably decode information on the uplink ambient RF signals including TV, cellular, and Wi-Fi. We also note
at distances of up to 65 cm and 30 cm using CSI and RSSI in- that Wi-Fi Backscatter can also be used to provide Internet connec-
formation respectively. This is achieved at bit rates ranging from tivity to battery-free devices with other power harvesting sources
100 bps to 1 kbps. The uplink range can be increased to more including solar and mechanical energy.
than 2.1 meters by performing coding at the Wi-Fi device. Wi-Fi Backscatter’s communication has two main components:
• The uplink can operate using only the ambient Wi-Fi transmis- an uplink from the Wi-Fi Backscatter tag to the Wi-Fi reader and a
sions in the network. Specifically, the Wi-Fi device can use RSSI downlink from the Wi-Fi reader to the Wi-Fi Backscatter tag. Wi-
information extracted from all the packets transmitted by the AP Fi Backscatter follows a request-response model, similar to RFID
in our organization to achieve uplink bit rates between 100 bps systems. Specifically, the Wi-Fi reader asks the Wi-Fi Backscatter
and 200 bps, depending on the network load. tag for information on the downlink and receives a response on the
• The prototype can detect Wi-Fi packets as short as 50 µs at dis- uplink. In the presence of multiple Wi-Fi Backscatter tags in the
tances of up to 2.2 meters; this translates to a bit rate of 20 kbps vicinity, the interrogator can use protocols similar to EPC Gen-2 [2]
on the downlink. The downlink range can be further extended to to identify these devices and then query each of them individually.
about 3 meters by reducing the bit rate to 5 kbps. In this paper, however, we focus on establishing a communication
link with a single Wi-Fi Backscatter tag.
Contributions: We make the following contributions: At a high level, Wi-Fi Backscatter imitates RFID communication
• We introduce a novel communication system that connects RF- using a Wi-Fi device. Specifically, the Wi-Fi Backscatter tag com-
powered devices (Wi-Fi Backscatter tags) to the Internet via ex- municates by modulating the transmissions from the Wi-Fi helper.
isting Wi-Fi infrastructure. The Wi-Fi reader decodes these transmissions by using the channel
• We design an uplink communication channel that allows Wi-Fi changes that are created on the received Wi-Fi packets. In princi-
Backscatter tags to convey information to Wi-Fi devices by mod- ple, Wi-Fi Backscatter can have multiple Wi-Fi helper devices (e.g.,
ulating the Wi-Fi channel information including CSI and RSSI. multiple APs or other Wi-Fi client); in this paper, however, we focus
• We design a downlink communication channel where Wi-Fi de- on using a single Wi-Fi helper device. For the downlink, the Wi-Fi
vices encodes information in the presence or absence of Wi-Fi reader transmits directly to the Wi-Fi Backscatter tag by encoding
packets; the Wi-Fi Backscatter tags use low-power circuits to de- information in short Wi-Fi packets interspersed by silence. The tag
tect Wi-Fi packets and decode this information. decodes these transmissions using a low-power circuit design that
• Finally, we build a hardware prototype for Wi-Fi Backscatter can detect energy from Wi-Fi packets.
and demonstrate the first communication link between a Wi-Fi In the rest of this paper, we describe the design of the Wi-Fi
Backscatter tag and commodity Wi-Fi devices. Backscatter uplink in §3 and the downlink in §4. We then generalize
our description to work in the presence of multiple Wi-Fi devices
While the bit rates demonstrated in this paper are not high, we in §5. Finally, we evaluate our prototype in various scenarios.
believe that the ability to communicate at even low rates between
RF-powered devices and existing Wi-Fi infrastructure is a signifi-
cant capability that would be critical for the commercial adoption 3. W I FID U PLINK
of an RF-powered Internet of Things. Wi-Fi Backscatter enables communication on the uplink from an
RF-powered device to the Wi-Fi reader. This is challenging how-
2. W I -F I BACKSCATTER OVERVIEW ever because it is not feasible for these devices to speak the Wi-Fi
Wi-Fi Backscatter is a novel communication system that enables protocol. Instead we transmit data by modulating the Wi-Fi channel
RF-powered devices to communicate directly with commodity Wi- as seen in the Wi-Fi reader channel state information. In this section
Fi devices. As shown in Fig. 2, Wi-Fi Backscatter has three main we describe the Wi-Fi Backscatter uplink in more detail.
 6.5 0.5
6 0.45
0.4
5.5
CSI amplitude

0.35
5 0.3

PDF
4.5 0.25
4 0.2
0.15
3.5
0.1
3 0.05
2.5 0
0 500 1000 1500 2000 2500 3000 -3 -2 -1 0 1 2 3
Packet Number Normalized CSI

Figure 3—Raw CSI measurements for a single Wi-Fi sub- Figure 4—PDF of normalized channel values for the 30 Wi-Fi
channel in the presence of the Wi-Fi Backscatter tag 5 centime- sub-channels. The plot shows diversity between sub-channels.
ters away. The plot clearly shows a binary modulation on top of
the CSI measurements.
Wi-Fi Backscatter tag. We configure the tag to modulate an alter-
3.1 Modulating Wi-Fi Channel at the tag nating sequence of zero and one bits. The Wi-Fi reader downloads
The Wi-Fi Backscatter tag conveys information by modulating a 1 GB media file from a Linksys WRT54GL AP, which acts as a
the Wi-Fi channel. To do this, it uses a low power switch that al- Wi-Fi helper. The helper is placed 5 meters away from the Wi-Fi
lows the antenna impedance to be modulated by a transmitted bit Backscatter tag. Fig. 3 plots the CSI in Wi-Fi sub-channel 19 as
stream. The antenna’s impedance affects the amount of signal that a function of the packet number. The plot clearly shows a binary
is reflected by the tag. By modulating this impedance, the tag can modulation on top of the captured channel measurements.
convey ‘1’ and ‘0’ bits. These switches consume less than 1 µW Our decoding algorithm extracts this modulated information in
of power, which is negligible. Our prototype design optimizes the three main steps: (1) Signal conditioning to remove the variations in
choice of the switch to operate well at frequencies spanning the the channel measurements due to mobility in the environment, (2)
entire 2.4 GHz Wi-Fi band. Leveraging frequency diversity across the Wi-Fi sub-channels, and
The Wi-Fi Backscatter tag can in principle use a variety of an- (3) Decoding the backscattered bits from the channel information.
tennas including monopoles and dipoles. For our prototype, we de- (1) Signal Conditioning. The goal of this step is two-fold: 1) re-
signed a special-purpose antenna for the Wi-Fi Backscatter tag that move the natural temporal variations in the channel measurements
is capable of both impedance modulation as well as Wi-Fi energy due to mobility in the environment, and 2) normalize the chan-
harvesting. Specifically, we design a microstrip “patch” antenna, as nel measurements to map to -1 and +1 values. In particular, to re-
the gain of this antenna can be relatively high with respect to its move the temporal variations, we subtract a moving average from
size. Our antenna design takes into consideration a key factor of the channel measurements at the Wi-Fi reader; the moving aver-
system performance: the extent of radar cross section changes that age is computed over a duration of 400 ms in our experiments. The
the antenna is capable of achieving. The radar cross-section refers above operation creates zero-mean channel measurements without
to the amount of incident Wi-Fi signals that can be reflected by an the temporal variations. Next, we normalize these measurements
antenna; the contrast between the radar cross-section when the tag such that the channel corresponding to a one bit from the Wi-Fi
is reflecting versus not reflecting will determine the impact of the Backscatter tag maps to a +1 and that corresponding to a zero bit
tag on a nearby Wi-Fi receiver. To improve the radar cross-section, maps to a -1. Since we do not know the actual bits transmitted, we
we design an array of microstrip patches, each of which resonates at instead perform this normalization by computing the absolute val-
2.4 GHz, but which act together to collaboratively scatter incident ues of the zero-mean channel measurements and then taking their
RF and therefore produce a larger change in the radar cross-section. average. We then divide the zero-mean channel measurements with
Wi-Fi antenna design is a broad topic and one can use other antenna this computed average to get the normalized channel values.
topologies that can significantly reduce the size of the antenna [18].
(2) Exploiting Wi-Fi Frequency/Spatial Diversity. Wi-Fi trans-
This, however, is not in the scope of this paper.
missions span a bandwidth of 20 MHz. At such a wide bandwidth, it
Finally, the minimum period with which our tag changes its
is well known that the signals experience frequency diversity where
impedance is larger than the duration of a Wi-Fi packet. That is,
the amplitude and the phase of the channel measurements vary sig-
the duration of each transmitted bit is greater than the time it takes
nificantly with the Wi-Fi OFDM subcarriers. Similarly, multipath
to transmit a few Wi-Fi packets. This ensures that the act of modu-
issues result in similar variations across antennas. Thus, one would
lating does not change the channel within every Wi-Fi packet, thus
expect that some of the Wi-Fi subcarriers and antennas experience
allowing nearby Wi-Fi communication to proceed with minimal in-
a stronger effect due to the reflections from the Wi-Fi Backscat-
terference. We also note that the Wi-Fi Backscatter tag modulates
ter tag. To empirically check this effect, Fig. 4 plots the probabil-
the Wi-Fi channel only when queried by the reader. Further, the tag
ity density functions (PDF) of the normalized channel values for
can adapt the modulation rate by increasing the duration of each
each adjacent pair of the 60 Wi-Fi subcarriers (resulting in 30 “sub-
bit, enabling our tag to adapt the resulting data rate to the Wi-Fi
channels”) available from the Intel card. The PDF is computed over
network traffic conditions (see §5).
channel measurements taken across 42,000 Wi-Fi packets. Fig. 4
shows three main points: First, for about 30 percent of the Wi-Fi
3.2 Decoding algorithm at the Wi-Fi reader sub-channels, we see two Gaussian signals centered at +1 and -1;
Next, we describe how the Wi-Fi reader extracts the modulated these represent the two-reflection states at the tag. Secondly, the
Wi-Fi channel corresponding to the packets from the helper. To un- variance in the channel measurements, i.e., noise, changes signifi-
derstand how the reflections at a Wi-Fi Backscatter tag affect the cantly with the sub-channel being used. Finally, some of the sub-
Wi-Fi channel, we run the following experiment. We place an In- channels do not see two distinct Gaussian signals. This corresponds
tel Wi-Fi Link 5300 card, which acts as a Wi-Fi reader, next to a to frequencies where the effect of backscatter is very weak, due to
Wi-Fi Sub-Channel 30 computes the following summation:
25
XG
CSIi
20 CSIweighted =
i=1
σi2
15

10 where G is the total number of good sub-channels, and σi2 is the

5
noise variance in the ith sub-channel. Effectively, the above equa-
tion gives a larger weight to Wi-Fi sub-channels where the noise
0
0 10 20 30 40 50 60 70 variance is low (and hence a higher confidence). The above compu-
Distance between Wi-fi reader and prototype (in cm) tation is similar to maximum ratio combining techniques [7] used in
traditional communication that are known to be optimal for Gaus-
Figure 5—Wi-Fi sub-channels with BER < 10−2 at various dis- sian noise. In scenarios where the Wi-Fi reader has multiple anten-
tances. For each Wi-Fi sub-channel, the figure shows the experi- nas, the above computation can be performed for each antenna and
ments where decoding using only that sub-channel achieves a bit the summation can be taken across all the antennas.
error rate less than 10−2 . The plot shows that the set of good sub-
channels varies significantly with the position (and therefore multi- (3) Decoding bits from the Wi-Fi Backscatter tag. To do this,
path profile) of the Wi-Fi Backscatter tag. the Wi-Fi reader can use a simple thresholding mechanism on
CSIweighted . Specifically, if CSIweighted is greater than zero, the re-
ceiver outputs a ‘1’ and a ‘0’ otherwise. We note the following:
multipath effects. Thus, we observe significant frequency diversity
within the 30 Wi-Fi sub-channels even when the Wi-Fi Backscatter • The CSI information provided by the off-the-shelf Wi-Fi devices
tag is placed next to the Wi-Fi reader. is inherently noisy. To account for these noisy measurements, we
We exploit this frequency diversity to increase the reliability of add redundancy to our transmissions. Specifically, each bit trans-
Wi-Fi Backscatter’s uplink communication. Specifically, the Wi-Fi mitted by the tag corresponds to multiple channel measurements
reader performs the following two steps: (i.e., received Wi-Fi packets) at the receiver. The Wi-Fi reader
Step 1: Identify the good Wi-Fi sub-channels/antennas. Ideally, if repeats the above procedure for all these channel measurements
the combination of a set of Wi-Fi sub-channels and antennas that and uses a simple majority vote to compute the transmitted bits.
have a strong signal from the Wi-Fi Backscatter tag is consistent • Since the Wi-Fi medium is shared and bursty in nature, it is un-
across locations, then we could decode the information from the likely that every bit transmitted by the tag sees the same number
tag using only that combination. The challenge however is that the of Wi-Fi packets (and the corresponding channel measurements).
set of “good” sub-channels and antennas varies significantly with To account for this, we use the timestamp that is in every Wi-Fi
the position of the tag. To empirically see this, we place the Wi-Fi packet header to accurately group Wi-Fi packets belonging to the
Backscatter tag at different distances from the Wi-Fi reader and same bit transmission. We then perform majority voting over the
measure the channel information on all the Wi-Fi sub-channels. corresponding channel measurements.
Fig. 5 shows the sub-channels where the Wi-Fi reader could de- • Finally, the Intel cards used in our experiments report spurious
code the modulated information with a BER of less than 10−2 at a changes in the CSI once every so often. We see this behavior
given distance. The figure shows that, in general, there are no Wi- even in a static network with no mobility. To account for this spu-
Fi sub-channels that are consistently good. Thus, the Wi-Fi reader rious behavior, we use a hysteresis mechanism. Specifically, we
should independently extract the good sub-channel information for use two thresholds, Thresh0 and Thresh1 , corresponding to the 0
each uplink transmission. and 1 bits. The receiver outputs a one (zero) bit only when the re-
To do this, the Wi-Fi reader uses correlation with a known pream- ceived channel value is greater (smaller) than Thresh1 (Thresh0 ).
ble from the tag; the preamble is used by the tag at the beginning We set the threshold values to be µ ± σ 2 , where µ and σ are the
of each of its message transmission. Specifically, the Wi-Fi reader mean and standard deviation of CSIweighted computed across pack-
correlates with the preamble along every sub-channel (treating mul- ets. The above heuristic works effectively in our experiments.
tiple antennas as additional sub-channels), while waiting for an
incoming transmission from the tag. When a transmission arrives 3.3 Decoding Using RSSI
(which is identified by a peak in the correlation), the Wi-Fi reader While the 802.11n Wi-Fi specification requires per-subchannel
sorts the sub-channels based on the correlation value. In particu- channel state information to be made available on newer Wi-Fi
lar, the sub-channels that correlate well with the preamble have a chipsets, most existing chipsets only provide the RSSI informa-
better signal from the Wi-Fi Backscatter tag than those that corre- tion [5]. RSSI is a single metric that provides a measure of the cu-
late poorly. The Wi-Fi reader picks the top ten “good” sub-channels mulative Wi-Fi signal strength across all the sub-channels. In this
based on this correlation method. section, we describe how the Wi-Fi reader can decode the reflected
Step 2: Combining information across the good Wi-Fi sub- information from the Wi-Fi Backscatter tag using only RSSI.
channels. A naive approach to do this is to simply add up the in- To do this, we employ a decoding algorithm similar to that de-
formation across all the sub-channels. This is, however, not op- scribed earlier. Specifically, we perform signal conditioning, hys-
timal because the noise variance may vary even across the good teresis, and thresholding to decode the information exactly as in the
sub-channels. Instead the Wi-Fi reader combines the information algorithm from §3.2. We note that depending on the Wi-Fi chipset,
across the sub-channels by computing a weighted average where the RSSI information available is either a single value per packet or
sub-channels with low noise variance are given a higher weight, an RSSI value per antenna in the case of MIMO receivers. In sce-
while those with higher noise variance are given a lower weight. narios with multiple RSSI channels (e.g., multiple antennas), we
More formally, say CSIi is the normalized CSI computed on the select the best RSSI channel using the maximum correlation mech-
ith good Wi-Fi sub-channel. The Wi-Fi reader performs a linear anism. In particular, the receiver correlates with the packet pream-
combination of the normalized CSI across these sub-channels by ble and picks the RSSI channel that has the maximum correlation
weighting them with the noise variance. Specifically, the reader value. Finally, we note that since RSSI is a single value that repre-
 16.5
16
CSI amplitude

15.5
15
14.5
14
13.5 Figure 7—Encoding information on the downlink. the reader en-
codes a ‘1’ bit with presence of a Wi-Fi packet and a ‘0’ bit with
13 silence (i.e., the absence of Wi-Fi packets). The duration of the si-
0 500 1000 1500 2000 2500 3000
lence period is set to be equal to that of the Wi-Fi packet. To enforce
Packet Number
other Wi-Fi devices in the vicinity to not transmit during the silence
periods, the Wi-Fi reader transmits a CTS_to_SELF packet before
Figure 6—Raw CSI measurements for a single Wi-Fi sub- transmitting the message. The message consists of both the pream-
channel in the presence of the Wi-Fi Backscatter tag one meter ble bits and the payload bits (including the CRC).
away. The figure shows that at larger ranges, there are no longer
two distinct levels in the CSI measurements. Thus, we need to de- 4.1 Encoding at the Wi-Fi reader
sign a different decoding mechanism to achieve higher ranges.
The Wi-Fi reader encodes information using the presence or ab-
sence of a Wi-Fi packet. Specifically, as shown in Fig. 7, the reader
sents all Wi-Fi sub-channels and the RSSI bit resolution is limited, encodes a ‘1’ bit with presence of a Wi-Fi packet and a ‘0’ bit with
the BER performance is better with CSI information than RSSI. silence (i.e., the absence of Wi-Fi packets). The duration of the si-
lence period is set to be equal to that of the Wi-Fi packet. To force
3.4 Increasing Uplink Communication Range other Wi-Fi devices in the vicinity to not transmit during the silence
The algorithm described so far assumes that the reflections from periods, the Wi-Fi reader transmits a CTS_to_SELF packet [10] be-
the Wi-Fi Backscatter tag create a distinctive difference in the chan- fore transmitting the encoded bits. CTS_to_SELF is a Wi-Fi mes-
nel values between a one and a zero bit. While such an algorithm sage that forces 802.11-compliant devices to refrain for a specified
is effective at small distances from the Wi-Fi reader (in our experi- time period. Wi-Fi Backscatter leverages this message to reserve
ments up to 65 centimeters), it breaks down at larger distances. To the medium for the duration of its transmission to ensure that other
see this, consider the channel measurements in Fig. 6, at a distance Wi-Fi devices, unaware of the Wi-Fi Backscatter protocol, do not
of two meters between the Wi-Fi Backscatter tag and the Wi-Fi sense the medium as idle and transmit during the silence periods.
reader. The figure shows that there are no two distinct levels in the We note the following key points:
channel measurements, which is in contrast to Fig. 3. • The current 802.11 standard only allows Wi-Fi devices to reserve
Wi-Fi Backscatter uses coding to increase its uplink communi- the channel for up to a duration of 32 ms using the CTS_to_SELF
cate range. Specifically, the tag transmits two orthogonal codes of packet. Thus, to maximize the number of bits transmitted within
length L each, to represent the one and the zero bits. The Wi-Fi this duration, the Wi-Fi reader reduces the size of each Wi-Fi
reader correlates the channel measurements with the two codes and packet and the corresponding silence period. The smallest packet
outputs the bit corresponding to the larger correlation value. size possible on a Wi-Fi device is about 40 µs at a bit rate of
• Wi-Fi Backscatter repeats the above correlation operation on all 54 Mbps. Our receiver design in §4.2 can reliably detect Wi-Fi
the frequency sub-channels and picks the Wi-Fi sub-channels packets as small as 50 µs to a distance of more than two meters.
that provide the maximum correlation peaks. Thus, the Wi-Fi reader can transmit a 64-bit payload message
• The communication range of the system can be increased by in- with a 16-bit preamble in 4.0 ms. We can transmit more bits by
creasing the code length, L. This is because correlation with a splitting them across multiple CTS_to_SELF packets.
L bit long code provides an increase in the SNR that is propor- • Since we assume a query-response model in this paper, if the Wi-
tional to L. Our evaluation shows that with a correlation length of Fi Backscatter tag does not respond to the Wi-Fi reader’s query,
20 bits, the communication range can be increased to 1.6 meters. the reader re-transmits its packet until it gets a response. More
The uplink communication range can be further increased to 2.1 generally, the Wi-Fi Backscatter tag could also transmit ACK
meters by increasing the correlation length to 150 bits.. packets back to the Wi-Fi reader using the uplink communication
• Since the tag still only transmits bits (now the bit duration ex- in §3. The Wi-Fi Backscatter tag can reduce the overhead of the
panded by L) and does not perform any decoding operations, ACK packet by dropping the preamble and the address fields, and
the power consumption of the tag does not increase. The Wi- transmitting a single bit message.
Fi reader on the other hand is a powered device and can perform • One may be worried that since Wi-Fi Backscatter’s downlink
the above correlation operations. messages occupy a considerable amount of time, they could af-
fect the efficiency of Wi-Fi networks. While this certainly is
4. W I -F I BACKSCATTER D OWNLINK a factor to be considered, there is growing evidence that Wi-
Fi networks in typical home and office scenarios are under-
Next, we describe how Wi-Fi Backscatter enables communica- utilized [24]. Thus, we believe that the spare Wi-Fi bandwidth
tion on the downlink from the Wi-Fi reader to a Wi-Fi Backscat- can be used to communicate with Wi-Fi Backscatter devices.
ter tag. The challenge in achieving this is that, on one hand, the
reader can only transmit Wi-Fi packets; on the other hand, a Wi-
Fi Backscatter tag cannot decode Wi-Fi transmissions. Instead, we 4.2 Wi-Fi Backscatter tag receiver design
design a novel circuit for the tag that can detect the energy during The goal of our receiver is to differentiate between the presence
a Wi-Fi packet from a nearby transmitter. We then have the Wi-Fi and absence of a Wi-Fi packet and decode the bits transmitted by
reader encode information in the presence and absence of Wi-Fi the Wi-Fi reader. At a high level, we design a low-power Wi-Fi en-
packets. In the rest of this section, we describe the encoding mech- ergy detection circuit that leverages the RF harvesting capabilities
anism at the Wi-Fi reader and the receiver design at the tag. of our device. Traditional energy detection approaches compute the
average energy in the received signal and use a highly sensitive re-
ceiver to detect the presence of energy on the wireless medium. This
approach however is not suitable in our scenario since the receiver
is low power in nature and hence has a very low sensitivity. Further,
Wi-Fi transmissions are modulated using OFDM, which is known
to have a high peak to average ratio [20]. Said differently, the av-
erage energy in the Wi-Fi signal is small, with occasional peaks
spread out during the transmission. Figure 8—Receiver circuit at the tag to decode the transmis-
Thus, the Wi-Fi Backscatter tag leverages a specially designed sions in Fig. 7. The receiver has four main components: an en-
RF energy detector based on peak detection to decode information velope detector to remove the 2.4 GHz carrier frequency, a peak
from the Wi-Fi Backscatter reader. As shown in Fig. 8, our receiver finder that stores the peak energy value of the Wi-Fi signals in its
circuit has four main components: an envelope detector, a peak capacitor, a set-threshold circuit that halves the threshold values,
finder, a set-threshold circuit and a comparator. The role of the en- and a comparator that outputs a one bit when the received energy is
greater than the threshold value and a zero bit otherwise.
velope detector circuit is to remove the carrier frequency (2.4 GHz)
of the Wi-Fi transmissions. This is a standard circuit design similar as framing and CRC checks for the Wi-Fi Backscatter messages
to that used in RFID systems. We however tune the circuit elements transmitted on the downlink.
to be optimal over the whole 2.4 GHz Wi-Fi frequency ranges.
The peak detector circuit captures and holds the peak amplitude
of the received signal. It uses a diode, an operational amplifier, and
5. W I -F I BACKSCATTER IN A G ENERAL W I -F I
a capacitor that can store the peak amplitudes as its charge. In order
to adapt to time-varying channel conditions, it however does not N ETWORK
hold this peak value indefinitely; the resistor network that is part of Typical Wi-Fi networks have multiple Wi-Fi devices that all
the set-threshold circuit allows the charge on the capacitor to slowly share the same wireless medium; most of these devices are likely to
dissipate, effectively “resetting” the peak detector over some rela- be unaware of the Wi-Fi Backscatter protocol. Wi-Fi Backscatter’s
tively long time interval. The output of this peak-detection circuit is downlink design addresses the problem of multiple Wi-Fi devices
halved to produce the actual threshold; this is performed by the ca- by using a CTS_to_SELF packet that prevents other Wi-Fi devices
pacitor element in the set-threshold circuit. Finally, the comparator from interfering with its transmissions. The presence of multiple
takes two inputs: the threshold value and the received signal, and Wi-Fi devices, however, is problematic for the uplink design in §3.
outputs a one bit whenever the received signal is greater than the In particular, the Wi-Fi reader uses the channel measurements
threshold value and a zero bit otherwise. from the helper’s packets to decode the information send by the Wi-
We note that the receiver circuit described above can detect pack- Fi Backscatter tag. The assumption, however, is that for every bit
ets as small as 50 µs. Thus, it can differentiate Wi-Fi packet lengths sent by the Wi-Fi Backscatter tag, the Wi-Fi reader receives channel
up to that resolution. Specifically, since longer packets can be in- measurements from at least a few helper packets. Since Wi-Fi uses
tuitively thought of as multiple small packets sent back-to-back a random access MAC protocol, the number of packets per second
without any gap, the Wi-Fi Backscatter tag outputs a continuous transmitted from the Wi-Fi helper depends on the traffic in the net-
sequence of ones corresponding to each long packet. By counting work. Ideally, if the Wi-Fi Backscatter tag can identify the helper
the number of ones, Wi-Fi Backscatter can resolve the length of a packets, it can ensure that there are an equal number of helper pack-
Wi-Fi packet to a resolution of 50µs. ets for each transmitted bit. This is however difficult since our Wi-Fi
Further, the above circuit requires only a very small amount of Backscatter tags cannot decode the Wi-Fi headers and hence cannot
power to operate (around 1 µW), and can therefore be left ON at accurately identify the helper packets.
all times. However, the microcontroller requires a relatively large Wi-Fi Backscatter addresses this problem by having the Wi-Fi
amount of power (several hundred µW) in its active mode. To re- Backscatter device adapt its transmission rate for different network
duce overall power consumption, the Wi-Fi Backscatter tag keeps traffic loads. Specifically, the Wi-Fi reader computes the average
the microcontroller in a sleep state as much as possible by operating number of packets the helper (e.g., an AP) can transmit for the cur-
under two main modes: rent network conditions. Suppose the Wi-Fi helper can transmit, on
average, N packets per second given the current network load and
suppose the Wi-Fi reader requires the channel information from M
• Preamble detection mode. The receiver spends most of its time packets to reliably decode each bit. Given these parameters, the rate
N
in this mode detecting preambles at the beginning of potential at which the Wi-Fi Backscatter tag sends bits is given by M bits per
reader transmissions. To reduce the power consumption of doing second. The Wi-Fi reader computes this bit rate and transmits this
this, we leverage that there is no information in between the tran- information in the query packet addressed to the Wi-Fi Backscatter
sitions of bits output by our receiver circuit. Thus, we keep the tag. The latter uses this bit rate while transmitting bits on the uplink
microcontroller asleep until a new transition occurs at the com- to the Wi-Fi reader. We note the following key points:
parator’s output. We then correlate the intervals between these
transitions with the reference intervals for the preamble. If the • Dealing with bursty traffic. While the above computation is based
transition intervals match the preamble, the receiver knows that on the average statistics, Internet traffic in general is known for
a packet is about to begin and thus enters the next mode. its bursty nature. Thus, it is unlikely that every bit from the Wi-
• Packet decoding mode. In this mode, the microcontroller again Fi Backscatter tag affects the same number of helper packets.
reduces the power consumption by sampling the signal only in To address this problem, the Wi-Fi reader uses the timestamp
the middle of each transmitted bit. Specifically, the microcon- information in the Wi-Fi header to bin the channel measurements
troller wakes up briefly to capture each sample, then sleeps until to the correct bit boundaries. Further, the Wi-Fi reader provides
the next bit, thus saving considerable power. After the known conservative bit rate estimates to the Wi-Fi Backscatter device
packet length has expired, the microcontroller fully wakes up to minimize the probability of not receiving channel information
and attempts to decode the packet by performing operations such for some of the transmitted bits.
 0
10
30 pkts/bit
6 pkts/bit
3 pkts/bit
-1
10

Bit Error Rate

-2
10

-3
10

-4
Figure 9—Wi-Fi Backscatter prototype antenna. The prototype 10
0 10 20 30 40 50 60 70
antenna is designed to operate across the 2.4 GHz Wi-Fi channels
Distance between Wi-Fi reader and Wi-Fi Backscatter prototype (in cm)
and can both modulate the Wi-Fi channel as well as harvest RF
signals. Our antenna consists of an array of six small micro-strip (a) CSI
patch elements, each with dimensions 40.6 by 30.9 mm. We note 0
that in principle, one can decrease the size of this antenna by using 10
a number of other topologies that can achieve similar qualities. We
use this topology due to its fabrication simplicity. -1
10

Bit Error Rate

• Leveraging traffic from all Wi-Fi devices. In general, the Wi-Fi -2
10
reader can leverage transmissions from all Wi-Fi devices in the
network and combine the channel information across all of them
-3
to achieve a high data rate in a busy network. Since most of the 10
30 pkts/bit
traffic in a wireless network is downlink traffic [16], using the 6 pkts/bit
AP as a helper and leveraging its transmissions can eliminate the -4
3 pkts/bit
10
need for introducing additional traffic. 0 10 20 30 40 50 60 70
• Using the AP’s beacon packets. The Wi-Fi reader can use the Distance between Wi-Fi reader and Wi-Fi Backscatter prototype (in cm)
periodic beacon packets transmitted by Wi-Fi APs to decode (b) RSSI
the bits from the tag. Such an approach, while reducing the
data rates, would have minimal overhead on the Wi-Fi network Figure 10—Effect of distance on the uplink Bit Error Rate. Fig-
throughput. In §7.5, we evaluate the feasibility of this approach. ure (a) and (b) show the results when the Wi-Fi reader decodes
using the CSI and RSSI information respectively. The figure also
plots the BER for different number of packets per transmitted bit.
6. P ROTOTYPE IMPLEMENTATION The plots show that as the average number of Wi-Fi packets per bit
increases, both the BER and the range improve. Further, the CSI
We build a prototype of our Wi-Fi Backscatter tag that is opti- measurements perform better than the RSSI. Finally, the receiver
mized to operate across the 2.4 GHz Wi-Fi channels. The prototype can decode with BERs less than 10−2 up to ranges of about 65 cm
has a 2.4 GHz antenna, shown in Fig. 9, that can both modulate the and 30 cm using CSI and RSSI respectively.
Wi-Fi channel and harvest RF signals. The harvesting circuit we
use is similar to those proposed in prior systems [12, 26, 23]. Our
of around 50% at a distance of 10 km from a TV broadcast tower,
antenna is comprised of an array of six elements, each of which is
independent of the distance from the Wi-Fi reader.
a small micro-strip patch that is connected to both an RF switch
and a full-wave diode rectifier that provides RF-to-DC power con-
version. The ADG902 RF switch [1] from Analog Devices was se- 7. U PLINK E VALUATION
lected for its broad bandwidth, low power, and good switching iso- First, we evaluate Wi-Fi Backscatter’s uplink communication
lation at 2.4 GHz. Skyworks SMS7630 RF detector diodes [4] were from our prototype device to the Wi-Fi reader. We measure the
selected for their high rectification efficiency at low RF power lev- impact of various parameters including the distance between our
els. The antenna is connected to an MSP430G2553 running custom prototype and the Wi-Fi reader, the transmission rate of the Wi-Fi
firmware with receive and transmit logic implementations. helper, and its distance from the prototype device.
On the uplink, a hardware timer module of the TI MSP430
microcontroller is used to generate a bit clock and drives a sim- 7.1 Uplink BER versus Distance
ple firmware module. Each packet consists of a Wi-Fi Backscatter
preamble, payload and a postamble. The reader uses the preamble We compute the uplink bit error rate (BER) observed at the Wi-
and postamble to recover the bit clock from the transmitted sig- Fi reader as a function of the distance from the prototype device. In
nals. We use a 13-bit Barker code that is known for its good auto- this section, we focus on the efficiency of our decoding algorithm
correlation properties [6]. For the downlink, we implement the cir- from §3.2 that is designed to operate at short ranges. Later in §10,
cuit design in §4.2 that allows us to identify the presence of Wi-Fi we evaluate the long range uplink communication design from §3.4.
packets. We implement the energy saving mechanisms as described Experiments. We use Intel Link 5300 cards as both our Wi-Fi
in §4.2. Each packet has a preamble, a payload, and a postam- helper and reader devices. The devices are configured to run on
ble. We note that the power consumption of our transmit circuit Wi-Fi channel 6 in the 2.4 GHz range. The results for the other
is 0.65 µW, while that of the receiver circuit is 9.0 µW. Our results 2.4 GHz Wi-Fi channels are similar and are not presented for lack
show that the Wi-Fi power harvester can continuously run both the of space. We inject traffic from the Wi-Fi helper and configure the
transmitter and receiver from a distance of one foot from the Wi-Fi Wi-Fi reader to be in monitor mode. The helper is placed three me-
reader. Additionally, in a dual-antenna system with both Wi-Fi and ters away from the prototype device. The reader collects the CSI in-
TV harvesting, the full system could be powered with a duty cycle formation for the helper’s packets, using the Intel CSI Tool toolkit
 1
10
Our Algorithm
Random Frequency 1000

Achieveable Bit Rate (bps)

0
10
800
Bit Error Rate

-1
10
600
-2
10 400

-3
10 200

-4 0
10
0 10 20 30 40 50 60 70 500 1000 1500 2000 2500 3000
Distance between Wi-Fi reader and Wi-Fi Backscatter prototype (in cm) Helper Tranmission Rate (pkts/s)

Figure 11—Effect of frequency diversity on BER. The figure Figure 12—Uplink Bit rate versus transmission rate at the Wi-
shows the BER for two algorithms: one that randomly picks a Wi- Fi helper. The average achievable bit rate is the maximum bit rate,
Fi sub-channel and decodes, and the second is Wi-Fi Backscatter’s amongst the tested rates of 100, 200, 500, and 1000 bits/s, that can
algorithm that leverages frequency diversity to combine informa- be decoded at the Wi-Fi reader with a BER less than 10−2 . The plot
tion across all the sub-channels. The figure shows that leveraging shows that the bit rate is around 100 bps and 1 kbps with transmis-
frequency diversity provides substantial benefits. sion rates of 500 and 2070 packets/second.

Effect of frequency diversity. Next we evaluate the benefits of

from [13] on its three antennas. The Wi-Fi reader is configured
leveraging frequency diversity across all the Wi-Fi sub-channels.
to perform the algorithm in §3.2 that first identifies the good Wi-
Specifically, we compare two main schemes:
Fi sub-channels, combines them using maximum-ratio combining,
and finally uses majority voting across channel measurements to 1. Random-Subchannel: We pick a random Wi-Fi sub-channel and
decode the bits. We note that one of the antennas on our Intel device use it to decode bits from the prototype device.
almost always reported significantly low CSI values. To avoid intro- 2. Our algorithm: We use the algorithm described in §3.2 which
ducing bias, we included the CSI measurements from this antenna picks the best Wi-Fi sub-channels, combines them using maximum-
in our algorithm. The prototype device is set to transmit at vari- ratio combining, and then decodes bits from the prototype device.
ous distances between five centimeters and 65 centimeters from the
Fig. 11 shows the BER results using the two algorithms for the
Wi-Fi reader. In each run of the experiment, the prototype device
case where we use 30 Wi-Fi packets per bit. The plot shows that
transmits a 90-bit payload message (including the Wi-Fi Backscat-
using a random Wi-Fi sub-channel performs poorly and does not
ter preamble). We repeat the experiment 20 times at each distance
operate reliably at distances greater than 15 centimeters. In contrast,
value and compute the bit error rate (BER) by comparing the re-
our algorithm significantly reduces the BER and also operates at
ceived bits with those transmitted across all the packet transmis-
much larger distances. This demonstrates that leveraging frequency
sions in the location. Since we transmit a total of 1800 bits, if we
diversity provides substantial benefits for our uplink channel.
do not see any bit errors, we set the BER to 5 × 10−4 . The bit error
rate depends on the average number of channel measurements for
each bit; thus, we measure the BERs for different average number 7.2 Data Rate Versus Helper’s Transmission Rate
of Wi-Fi packets from the helper we use to represent each bit. The above set of experiments analyzes the achievable bit rate
Results. Fig. 10(a) shows the BER as a function of the distance be- as a function of the average number of Wi-Fi packets required to
tween the Wi-Fi reader and the prototype device. Fig. 10 (b) shows represent each bit. The actual bit rate achieved, however, depends
the corresponding results when using the RSSI information at the on the packet transmission rate at the Wi-Fi helper device. In this
Wi-Fi reader, instead of CSI. The plots show the following: section, we measure the bit rate achieved by our system for different
transmission rates at the Wi-Fi helper device.
• The BER increases with the distance between the prototype de- Experiments. We fix the locations of the Wi-Fi reader (Intel Wi-
vice and the Wi-Fi reader. This is expected because as the dis- Fi Link 5300 card) and the prototype device to be five centimeters
tance increases, the reflections from the prototype device experi- away from each other. The Wi-Fi helper device (Intel Wi-Fi Link
ence higher attenuation and hence are more susceptible to noise. 5300 card) is again placed 3 meters away from the prototype de-
• As the number of packets per bit increases, the BER signifi- vice. We later present results for larger helper distance values. To
cantly reduces. This is because with more packets per bit, the change the number of packets transmitted per second at the helper
Wi-Fi reader receives more channel measurements and hence can device, we insert a delay between injected packets. In our network,
achieve higher reliability using the majority voting procedure. which is running on the same Wi-Fi channel as our organization’s
• The CSI information provides higher ranges and better BERs Wi-Fi device, this results in a transmission rate between 240 and
than the RSSI. This is because CSI gives us detailed channel in- 3070 packets per second. For each of these transmission rates, the
formation in each Wi-Fi OFDM sub-channel. In contrast, RSSI prototype device transmits at four different bit rates (100, 200, 500,
is a single value averaged across all the sub-channels. Thus, CSI and 1000 bits/sec). We measure the achievable bit rate by measur-
values have more information and hence achieve lower BERs. ing the maximum bit rate at which the computed average BER is
• Wi-Fi Backscatter can achieve distanced of up to 65 cms using less than 10−2 . We compute the average achievable bit rate by tak-
an average of 30 packets/bit, with the CSI information. The RSSI ing the mean of the achievable bit rates across multiple runs.
information, on the other hand, provides a range of about 30 cms Results: Fig. 12 plots the achievable bit rate as a function of the Wi-
assuming a target BER of 10−2 . In §10, we show how to increase Fi helper’s transmission rate (packets per second). The plot shows
this range further using our correlation mechanism. that as the number of packets transmitted per second at the helper
 250
Network Load
Uplink Bit Rate 1100

Achievable Bit Rate (bps)

Packets per Second

200 900

700
150

500
100
300

50 100
12:00 PM 2:00 PM 4:00 PM 6:00 PM 8:00 PM
Time of Day
Figure 13—Testbed with the tested locations.
Figure 15—Achievable uplink bit rate using ambient Wi-Fi
Probability of Correct Packet

1 packets in an office setting as a function of time. The figure

0.8
shows that the achievable bit rate is proportional to the number of
packets on the network.
0.6
50
0.4

Achievable Bit Rate (bps)

0.2 40

0 30
2 3 4 5
Helper Location
20

Figure 14—Probability of receiving a correct packet on the up- 10

link for the various helper locations shown in Fig. 13. The fig-
ure shows that the Wi-Fi reader can decode packets even when the 0
helper device is not in the same room (location 5). Further the up- 10 20 30 40 50 60 70
link is fairly independent of the Wi-Fi helper location. Wi-Fi AP Beacon Transmission Rate (beacons/s)

Figure 16—Achievable uplink bit rate using only the periodic

device increases, the achievable bit rate increases. The bit rate is beacons from the AP (Wi-Fi helper). The figure shows the feasi-
around 100 bits/s at a helper transmission rate of 500 packets/s and bility of using only the beacon packets to establish the uplink.
is 1 kbps when the transmission rate is about 3070 packets/s. We
note that these bit rates are more than sufficient for a majority of evaluate the feasibility of uplink communication without the need
the sensing and Internet of Things applications. for this additional traffic. Specifically, we run experiments in a lab
environment in our organization by configuring the Wi-Fi helper to
7.3 Bit Rate Versus Wi-Fi Helper Location be in monitor mode and capturing all the packets transmitted by the
Finally, we evaluate the effects of the Wi-Fi helper’s location organization’s AP. We place the Wi-Fi reader (an Intel Wi-Fi Link
on the probability of decoding correct packets from the Wi-Fi 5300 card) at a fixed distance of five centimeters away from the
Backscatter tag at the reader. To do this, we place the prototype prototype transmitter. We run experiments once every 10 minutes
device and the Wi-Fi reader (Intel Wi-Fi Link 5300 card) such and compute the achievable uplink bit rate (the maximum rate at
that they are 5 centimeters away from each other, in location 1 in which the bit error rate at the Wi-Fi helper is less than 10−2 ). We
Fig. 13. We then place the Wi-Fi helper device (Intel Wi-Fi Link also log the average number of Wi-Fi packets in the network as seen
5300 card) in locations 2-5 that span line-of-sight and non-line-of- by our Wi-Fi reader device.
sight scenarios and are at distances of 3-9 meters from the tag, as Fig. 15 plots the achievable bit rate as a function of time. For ref-
shown in Fig. 13. The average CSI values span 3-50 across these erence, we also plot the average number of all Wi-Fi packets as seen
locations. Note that location 5 is in a different room from our proto- by the Wi-Fi helper device. The figure shows that the achievable bit
type device. In each of our experiments, the prototype device trans- rate is proportional to the number of packets on the network. This
mits 20 packets at a bit rate of 100 bps. We compute the average is because the better the Wi-Fi network utilization, the more the
packet delivery probability, i.e., the fraction of packets received cor- opportunities for the Wi-Fi reader to receive packets from the AP.
rectly at the Wi-Fi reader, at each of the above locations. Since the uplink bit rate depends on the transmission rate of the
Fig. 14 plots the packet delivery probability as a function of dif- Wi-Fi helper device (which in our case is the AP), a better-utilized
ferent Wi-Fi helper device locations. The figure shows that this network results in higher data rates. The key point here is that we
probability is high across all the helper locations. We also note that can establish the uplink communication channel without introduc-
the Wi-Fi reader can successfully decode our packets even when the ing additional traffic on the network.
helper device is not in the same room as our prototype device. This
demonstrates that the communication capabilities on the uplink are 7.5 Using only Beacon Packets
fairly independent of the Wi-Fi helper location and depend only on
Finally, we check the feasibility of using only the periodic bea-
the distance between the Wi-Fi reader and the prototype device.
con messages from the AP. We use an Intel Wi-Fi Link 5300 card
configured as the AP and an Intel Wi-Fi Link 5300 card as a Wi-Fi
7.4 Using Only Traffic on the Network reader. The reader does not generate any traffic on the network and
Our experiments so far create additional traffic on the network passively listens to the beacon messages periodically transmitted by
to communicate from the prototype device to the Wi-Fi helper. We the access point. No other device is associated with the access point,
 0 30
10
20 kbps
10 kbps
-1 5 kbps 25

# false positives / hour

10
Bit Error Rate

20
-2
10
15
-3
10
10
-4
10 5

-5 0
10
0 50 100 150 200 250 300 350 10:00 AM 12:00 PM 2:00 PM 4:00 PM 6:00 PM
Distance between Wi-Fi reader and Wi-Fi Backscatter prototype (in cm) Time of Day

Figure 17—Downlink Bit Error Rate Versus distance between Figure 18—Downlink False-positive rate. The figure shows the
Wi-Fi Backscatter tag and Wi-Fi reader. The three bit rates cor- number of false positive events where the prototype receiver con-
respond to Wi-Fi packets of length 50 µs, 100 µs, and 200 µs. The fuses normal Wi-Fi traffic for a Wi-Fi Backscatter preamble.
figure shows that at a target BER of 10−2 , the prototype device can
achieve bit rates of 20 kbps at distances of 2.13 m. The range can
be increased to 2.90 m by decreasing the bit rate to 10 kbps. the two devices. The range can be increased to 2.90 meters by
decreasing the bit rate to 10 kbps.

but it operates on channel 6, which is the same frequency as our or-

ganization’s Wi-Fi network. We run experiments from 2-3 PM on 8.2 Downlink False-Positive Rate
a weekday. We place the Wi-Fi Backscatter tag 5 centimeters away Finally, we measure the false-positive rate experienced by our
from the reader and compute the achievable bit rate by measuring downlink communication channel. We define the false-positive rate
the maximum rate at which the reader can decode the tag’s trans- as the number of events per hour where, in the absence of a Wi-Fi
missions at a BER less than 10−2 . Since Intel cards do not currently Backscatter enabled Wi-Fi transmitter, our prototype device falsely
provide CSI information for beacon packets, we again use RSSI for detects the Wi-Fi Backscatter preamble in Fig. 7, and wakes up
these experiments. We repeat the experiments for different beacon the microcontroller to perform decoding. To measure this, we place
frequencies at the Wi-Fi AP. Fig. 16 shows that as expected the our receiver prototype 30 centimeters away from our network AP.
achievable bit rate increases with the beacon frequency. The key To ensure that there is consistent traffic on the network, we stream
takeaway from these results, however, is that Wi-Fi Backscatter can music from Pandora [3] from one of the connected clients for the
establish uplink communication using only the AP’s beacon packets whole duration of the experiment. The receiver prototype is con-
and hence need no additional traffic to be generated on the network. figured to log false-positive events, i.e., events when it detects the
known preamble. We run our experiments during peak hours and
8. D OWNLINK E VALUATION configure our prototype to detect preambles where each bit is 50 µs.
Fig. 18 shows the number of false positive events per hour at our
Next, we evaluate the performance of our downlink communica-
prototype receiver, as a function of the time of the day. The figure
tion channel. Here, the Wi-Fi reader conveys information by encod-
shows that the maximum false positive rate we observe in our setup
ing bits in the presence and absence of Wi-Fi packets. We evaluate
is less than 30/hour. These low numbers are expected, because it is
the BER performance as well as the false-positive rate.
unlikely that normal Wi-Fi traffic generates a structure that matches
the Wi-Fi Backscatter preamble in Fig. 7.
8.1 Downlink BER Versus Distance
We compute the bit error rate (BER) as a function of the distance 9. E FFECT OF REFLECTIONS ON W I -F I COMMU -
between the Wi-Fi Backscatter tag and the Wi-Fi reader. At each NICATION
distance, the Wi-Fi reader transmits a total of 200 kilobits to the
Wi-Fi Backscatter tag across multiple transmissions. The transmit Next, we evaluate the effects of the reflections created by our
power at the reader is set to +16 dBm (40 mW). In each transmis- prototype device on communication between a Wi-Fi transmitter-
sion, the reader encodes a ‘1’ bit as the presence of a packet and receiver pair. Specifically, we stress-test the system when the Wi-Fi
a ‘0’ bit as its absence. We run experiments with three different Backscatter tag is at close distances to the receiver.1 Note that in
packet sizes of 50 µs, 100 µs, and 200 µs at the reader, correspond- practice, a Wi-Fi Backscatter device modulates only when queried
ing to bit rates of 20 kbps, 10 kbps, and 5 kbps. The Wi-Fi Backscat- by a Wi-Fi reader. However to stress-test the system, we set Wi-Fi
ter tag uses its thresholding circuit as described in §4.2 to decode Backscatter to continuously send bits at two different data rates of
the transmitted bits. We then compute the BER by comparing the 1 kbps and 100 bps. Since Wi-Fi uses bit rate adaptation, we fix the
decoded bits with the transmitted bits. Wi-Fi receiver and the prototype in location 1 in Fig. 13 and move
Fig. 17 plots the BER as a function of the distance. The plot the Wi-Fi transmitter across the remaining locations. The devices
shows the following: use their default bit rate adaptation algorithms. We use built in Wi-
Fi of a Lenovo Thinkpad laptop as the transmitter and a Linksys
• As expected, the BER increases with the distance between the WRT54GL AP as the receiver. In each run of the experiment, the
Wi-Fi Backscatter tag and the reader. Similarly, the BER values Wi-Fi transmitter sends UDP packets for two minutes, and logs
are better at lower bit rates. the throughput observed every 500 ms. We compute the average
• Our prototype can efficiently identify Wi-Fi packets as small as 1
Note that we do not evaluate the effect of Wi-Fi Backscatter’s
50 µs from nearby devices. downlink design on Wi-Fi traffic. Experimental evaluation of the
• At a target BER of 10−2 , the Wi-Fi Backscatter downlink can effect of non Wi-Fi traffic on CTS_to_SELF and CTS_to_SELF on
achieve bit rates of 20 kbps at distances of 2.13 meters between Wi-Fi traffic has been explored in prior work [10].
 4 160
No Device

Correlation Length (bits)

3.5 100 bps 140
Data Rate (MB/s)

3 1 kbps 120
2.5 100
2 80
1.5 60
1 40
0.5 20
0 0
2 3 4 5 80 100 120 140 160 180 200 220
Helper Location Distance between Wi-Fi reader and Wi-Fi Backscatter prototype (in cm)
(a) Distance of 5 cm
Figure 20—Increasing the uplink range using the correlation
mechanism in §3.4. The figure shows that the range can be in-
4 creased to more than 2 m by using long sequences to represent each
No Device
3.5 100 bps transmitted bit and using correlation at the Wi-Fi reader.
Data Rate (MB/s)

3 1 kbps

2.5 and measure the correlation length at which the observed bit error
2 rate at the Wi-Fi reader is less than 10−2 .
1.5 Fig. 20 plots these correlation lengths as a function of the dis-
1 tance between the reader and our prototype. The figure shows
0.5 that as the correlation length increases, the range at which Wi-Fi
0 Backscatter’s uplink operates also increases. Specifically, using a
2 3 4 5
correlation length of 20 bits, we establish the uplink communica-
Helper Location
tion link at distances of about 1.6 meters between the Wi-Fi reader
(b) Distance of 30 cm and the prototype. The required correlation length increases signif-
icantly with the distances between the Wi-Fi reader and the pro-
Figure 19—Effect of Wi-Fi Backscatter Uplink on Wi-Fi data totype. Specifically, at distances of 2.1 meters, we need a correla-
rate. The figure plots the data rates for different locations for tion length of about 150 bits. While this would reduce the effective
the Wi-Fi transmitter placed in the testbed in Fig. 13. The Wi-Fi bit rates achieved on the uplink, we emphasize that establishing a
Backscatter prototype is configured to continuously modulate the communication link between Wi-Fi Backscatter tags with existing
Wi-Fi channel and the plots show the results for three scenarios:
without the prototype, with the prototype modulating at 100 bps Wi-Fi devices, albeit at a low rate, is beneficial for a large class of
and 1 kbps. The plots show that Wi-Fi rate adaptation can easily Internet-of-Things applications.
adapt to the variations caused by the prototype transmitter.
11. R ELATED W ORK
Wi-Fi Backscatter is related to work on RFID systems [8, 28,
throughput by computing the mean across the two minute dura- 29], which use dedicated powered infrastructure (RFID readers) to
tion. In each Wi-Fi transmitter location, we measure the average provide power and enable communication with battery-free tags.
throughput both in the presence and absence of our prototype. The cost of deploying and maintaining such an infrastructure has
Fig. 19 (a) and (b) shows the average data rate as a function of tempered the adoption of these systems. In contrast, the key value
the Wi-Fi transmitter location, for two different distance values be- proposition of RF-powered devices is that they can harvest ambi-
tween the prototype device and the Wi-Fi receiver. Each figure plots ent RF signals (e.g., TV, cellular, and Wi-Fi) and thus eliminate the
the data rates in three different scenarios: in the absence of the pro- need for dedicated infrastructure. Since traditional radio communi-
totype, and when the prototype transmits at 100 bps and 1 kbps. cation consumes significantly more power than is available in RF
The figures show that while there is variation in the observed data signals [23], it has thus far been challenging to connect these de-
rate across these scenarios (most notably in location 5 where the ex- vices to the Internet. Wi-Fi Backscatter addresses this problem with
periments were performed with heavy Wi-Fi utilization due to the a novel system that bridges RF-powered devices and the Internet.
presence of a class in the adjacent room), they are mostly within Wi-Fi Backscatter is also related to recent work on ambient
the variance. We believe this is because Wi-Fi uses rate adaptation backscatter communication [17] that enables two RF-powered de-
and can easily adapt for the small variations in the channel quality, vices to communicate by scattering ambient TV signals. While am-
resulting from the reflections from our prototype. bient backscatter can enable a network of RF-powered devices to
communicate with each other, it does not provide Internet connec-
tivity. A naive option is to deploy powered infrastructure devices
10. E VALUATING C ORRELATION E FFECTS ON that are equipped with both ambient backscatter communication
and traditional power-consuming radios, but this diminishes the key
W I -F I BACKSCATTER U PLINK R ANGE benefit of RF-powered systems; an ability to operate without ded-
Finally, we evaluate the feasibility of extending Wi-Fi Backscat- icated infrastructure. Wi-Fi Backscatter enables RF-powered de-
ter’s range on the uplink using the correlation technique in §3.4. vices to communicate with existing Wi-Fi infrastructure, bringing
Specifically, we place the Wi-Fi helper (an Intel Wi-Fi Link 5300 us closer to the vision of an RF-powered Internet of Things.
card) 3 meters away from the Wi-Fi reader (an Intel Wi-Fi Link Wi-Fi Backscatter also differs from both RFID and ambient
5300 card). The Wi-Fi Backscatter tag encodes zero and one bits backscatter systems in that these systems decode backscatter in-
using long code sequences of length N; the Wi-Fi reader correlates formation from a single continuous signal source, i.e., an RFID
with these code sequences to decode the bits as described in §3.4. reader or a TV tower. Further, the decoding is performed on cus-
We vary the distance between the Wi-Fi reader and the prototype tom hardware that is specially designed for this purpose. In con-
trast, this paper introduces a method to modulate the Wi-Fi channel 6th ACM Conference on Embedded Network Sensor Systems,
and demonstrates that we can perform decoding on off-the-shelf SenSys ’08, pages 393–394, New York, NY, USA, 2008. ACM.
Wi-Fi devices. Further, we show how to detect Wi-Fi packets and [9] N. Gershenfeld, R. Krikorian, and D. Cohen. The internet of things.
Scientific American.
communicate using such a capability.
[10] S. Gollakota, N. Ahmed, N. Zeldovich, and D. Katabi. Secure
Finally, recent work has demonstrated the ability to harvest in-band wireless pairing. In Proceedings of the 20th USENIX
power from ambient signals including TV [26, 19, 15, 25], and Conference on Security, SEC’11, pages 16–16, Berkeley, CA, USA,
cellular transmissions [27, 23]. More recently, researchers have 2011. USENIX Association.
demonstrated the ability to harvest energy from Wi-Fi transmis- [11] K. Gudan, S. Chemishkian, J. Hull, M. Reynolds, and S. Thomas.
sions [22, 21, 11]: [14] harvests and backscatters signals using Feasibility of wireless sensors using ambient 2.4ghz rf energy. In
Sensors, 2012 IEEE, pages 1–4, Oct 2012.
transmissions from Agilent 89600 custom 2.4 GHz transceiver
[12] J. Hagerty, F. Helmbrecht, W. McCalpin, R. Zane, and Z. Popovic.
hardware and [22, 11] show the feasibility of power harvesting us- Recycling ambient microwave energy with broad-band rectenna
ing signals from off-the-shelf Wi-Fi access points. Wi-Fi Backscat- arrays. Microwave Theory and Techniques, IEEE Transactions on,
ter builds on this work but is complimentary in that it transforms ex- 52(3):1014–1024, March 2004.
isting Wi-Fi signals into a communication medium for battery-free [13] D. Halperin, W. Hu, A. Sheth, and D. Wetherall. Tool release:
devices. Specifically, we are the first to establish a communication gathering 802.11 n traces with channel state information. ACM
SIGCOMM Computer Communication Review, 41(1):53–53, 2011.
link between RF-powered devices and commodity Wi-Fi devices.
[14] H. Ishizaki, H. Ikeda, Y. Yoshida, T. Maeda, T. Kuroda, and
M. Mizuno. A battery-less wifi-ber modulated data transmitter with
12. C ONCLUSION ambient radio-wave energy harvesting. In VLSI Circuits (VLSIC),
2011 Symposium on, pages 162–163, June 2011.
RF-powered devices hold the promise to realize a pervasive vi-
[15] Y. Kawahara, H. Lee, and M. M. Tentzeris. Sensprout: Inkjet-printed
sion of the “Internet of Things” where devices may be embedded soil moisture and leaf wetness sensor. In Proceedings of the 2012
into everyday objects and can achieve computation, sensing, and ACM Conference on Ubiquitous Computing, UbiComp ’12, pages
communication, all without the need to ever plug them in or main- 545–545, New York, NY, USA, 2012. ACM.
tain batteries. This paper provides the critical component in this [16] S. W. Kim, B.-S. Kim, and Y. Fang. Downlink and uplink resource
vision of RF-powered Internet of Things: an ability to connect RF- allocation in ieee 802.11 wireless lans. Vehicular Technology, IEEE
Transactions on, 54(1):320–327, 2005.
powered devices to the Internet.
[17] V. Liu, A. Parks, V. Talla, S. Gollakota, D. Wetherall, and J. R. Smith.
We present Wi-Fi Backscatter, a novel communication system Ambient backscatter: wireless communication out of thin air. In
that bridges RF-powered devices with the Internet. We show that it SIGCOMM, 2013.
is possible to reuse existing Wi-Fi infrastructure to provide Internet [18] D. Masotti, A. Costanzo, and S. Adami. Design and realization of a
connectivity to RF-powered devices. We show the feasibility of our wearable multi-frequency rf energy harvesting system. In Antennas
approach by building a hardware prototype and demonstrating the and Propagation (EUCAP), Proceedings of the 5th European
Conference on, pages 517–520, April 2011.
first communication link between an RF-powered device and com-
[19] C. Mikeka, H. Arai, A. Georgiadis, and A. Collado. Dtv band
modity Wi-Fi devices. We run experiments with off-the-shelf Wi-Fi micropower rf energy-harvesting circuit architecture and performance
devices and achieve communication rates of up to 1 kbps and ranges analysis. In RFID-Technologies and Applications (RFID-TA), 2011
of up to 2.1 m. We believe that this new capability is critical for the IEEE International Conference on, pages 561–567, Sept 2011.
commercial adoption of RF-powered Internet of Things. [20] H. Ochiai and H. Imai. On the distribution of the peak-to-average
power ratio in ofdm signals. Communications, IEEE Transactions on,
49(2):282–289, Feb 2001.
Acknowledgements. We would like to thank Ben Ransford, Vin-
[21] U. Olgun, C.-C. Chen, and J. Volakis. Wireless power harvesting with
cent Liu, Rajalakshmi Nandakumar, Donny Huang, our shepherd planar rectennas for 2.45 ghz rfids. In Electromagnetic Theory
Kyle Jamieson, and the anonymous SIGCOMM reviewers for their (EMTS), 2010 URSI International Symposium on, pages 329–331,
helpful comments. This research is funded in part by UW Commer- Aug 2010.
cialization Gap Fund, Qualcomm Innovation Fellowship, Washing- [22] U. Olgun, C.-C. Chen, and J. Volakis. Design of an efficient ambient
ton Research Foundation gift, NSF, and University of Washington. wifi energy harvesting system. Microwaves, Antennas Propagation,
IET, 6(11):1200–1206, August 2012.
[23] A. N. Parks, A. P. Sample, Y. Zhao, and J. R. Smith. A wireless
13. R EFERENCES sensing platform utilizing ambient RF energy. In IEEE Topical
[1] ADG902 RF switch datasheet. Meeting on Wireless Sensors and Sensor Networks (WiSNet 2013),
http://www.analog.com/static/imported- January 2013.
files/data_sheets/adg901_902.pdf. [24] R. Raghavendra, J. Padhye, R. Mahajan, and E. Belding. Wi-fi
[2] Epc class 1 generation 2 uhf rfid air interface specification. networks are underutilized. Technical report, Technical report, MSR,
http://www.gs1.org/gsmp/kc/epcglobal/uhfc1g2/uhfc1g2_1_2_0- 2009.
standard-20080511.pdf. [25] A. Sample and J. Smith. Experimental results with two wireless
[3] Pandora. www.pandora.com. power transfer systems. In Radio and Wireless Symposium, 2009.
[4] SMS7630 surface mount mixer and detector schottky diodes. RWS ’09. IEEE, pages 16 –18, jan. 2009.
http://www.skyworksinc.com/uploads/documents/Surface_Mount_ [26] R. Shigeta, T. Sasaki, D. M. Quan, Y. Kawahara, R. Vyas,
Schottky_Diodes_200041W.pdf. M. Tentzeris, and T. Asami. Ambient rf energy harvesting sensor
[5] Ieee standard for information technology– local and metropolitan device with capacitor-leakage-aware duty cycle control. Sensors
area networks– specific requirements– part 11: Wireless lan medium Journal, IEEE, 13(8):2973–2983, Aug 2013.
access control (mac)and physical layer (phy) specifications [27] H. Visser, A. Reniers, and J. Theeuwes. Ambient rf energy
amendment 5: Enhancements for higher throughput. IEEE Std scavenging: Gsm and wlan power density measurements. In
802.11n-2009 (Amendment to IEEE Std 802.11-2007 as amended by Microwave Conference, 2008. EuMC 2008. 38th European, pages
IEEE Std 802.11k-2008, IEEE Std 802.11r-2008, IEEE Std 721–724, Oct 2008.
802.11y-2008, and IEEE Std 802.11w-2009), pages 1–565, Oct 2009. [28] J. Wang, H. Hassanieh, D. Katabi, and P. Indyk. Efficient and reliable
[6] R. Barker. Group synchronizing of binary digital sequences. low-power backscatter networks. In SIGCOMM, 2012.
Communication Theory, pages 273–287, 1953. [29] P. Zhang and D. Ganesan. Enabling bit-by-bit backscatter
[7] D. Brennan. On the maximal signal-to-noise ratio realizable from communication in severe energy harvesting environments. In NSDI,
several noisy signals. Proc. IRE, 43(10):1530, 1955. Berkeley, CA, 2014. USENIX.
[8] M. Buettner, R. Prasad, A. Sample, D. Yeager, B. Greenstein, J. R.
Smith, and D. Wetherall. Rfid sensor networks with the intel wisp. In