Polarization-Shift Backscatter Identification for SWIPT-Based Battery-Free Sensor Nodes

Abstract

Battery-Free Sensor Nodes (BFSNs) used in Simultaneous Wireless Information and Power Transfer (SWIPT) systems often rely on lightweight communication protocols with minimal security overhead due to strict energy constraints. As a result, conventional protocol-dependent security mechanisms cannot be employed, leaving BFSNs vulnerable to replay, spoofing, and other security threats. This paper explores a protocol-independent security mechanism that enhances BFSN security by exploiting the power wave for controlled backscattering. The method introduces a Manchester-encoded digital private key generated by the BFSN’s low-power microcontroller and backscattered through a polarization-shifting module enabled by a fail-safe RF switch, thereby avoiding the need for a dedicated backscattering rectifier. A LoRaWAN-based BFSN integrating this add-on module was implemented to experimentally validate the approach. Results show successful extraction of the backscattered key with minimal energy overhead (approximately 95 µJ for a 3 ms identification sequence), while the original high-efficiency RF rectifier used for harvesting remains unmodified. The orthogonal polarization between the incoming and backscattered waves additionally reduces clutter and cross-jamming effects. These findings demonstrate that secure identification can be seamlessly incorporated into existing BFSNs without altering their core architecture, offering an easy-to-integrate and energy-efficient solution for improving security in SWIPT-based sensing systems.

1. Introduction

Battery-free wireless sensing has emerged as a promising solution for resource-constrained environments, enabling sustainable and long-term operation without the need for conventional power sources [1]. This paradigm offers new opportunities for reliable and maintenance-free sensing applications, particularly in scenarios where frequent battery replacement is impractical or costly. One of the key enablers for battery-free sensing is Wireless Power Transfer (WPT) [2], which provides a controlled and predictable source of wireless energy within the framework of Simultaneous Wireless Information and Power Transfer (SWIPT). Unlike solutions that rely on ambient energy sources, such as solar, thermal, or ambient microwave harvesting, SWIPT ensures reliable power delivery while supporting data communication [3].

SWIPT architectures can generally be categorized into two types. The first is the single-wave approach, where the same incident RF wave is used both to power the battery-free sensor and to enable backscatter communication for data transmission. The second is the dual-wave architecture, in which one wave is dedicated to delivering power while another is used exclusively for communication. The dual-wave approach provides significant advantages, including the ability to operate onboard processing units such as microcontrollers (MCUs), interface with a wider variety of low-cost sensors, and transmit data over longer distances using transceivers that support established communication protocols [4,5,6].

In the context of dual-wave SWIPT, Battery-Free Sensor Nodes (BFSNs) impose strict constraints on communication protocols, limiting them to only basic or lightweight encryption schemes. This energy-saving restriction introduces significant security vulnerabilities such as Denial-of-Service (DoS), replay, and flooding attacks. For example, in LoRaWAN deployments, Activation by Personalization (ABP) is used because it is more energy-efficient; however, it relies on static session keys, making the system highly susceptible to replay attacks [7,8]. Similarly, in Bluetooth Low Energy (BLE), energy limitations often lead to favoring connectionless broadcasting without pairing or handshake procedures, which increases exposure to spoofing, eavesdropping, and packet injection [9].

Multiple security mechanisms have been investigated in the context of SWIPT. Jamming-based defenses enhance secrecy but require full-duplex radios and effective self-interference cancellation, which limits their practicality for low-power nodes [10]. Direct-Sequence Spread Spectrum (DSSS) embeds security at the physical layer, yet it is tied to specific standards and offers limited portability across IoT protocols [11]. Intelligent reflecting surface (IRS) schemes improve secrecy through controllable reflections but rely on additional infrastructure and deployment overhead [12]. Optimization-based physical-layer security methods for heterogeneous networks depend on complex signal processing and accurate Channel State Information (CSI), reducing their adaptability to other protocols and dynamic scenarios [13]. Deep-learning-based solutions can enhance security performance, but they require training with changing channel conditions and significant computational resources [14,15].

As summarized in

Table 1. Comparison with state-of-the-art security approaches for SWIPT/BFSNs.

Approach	Extra Hardware	Invasive to Circuitry	Protocol-Independent	Energy Efficiency Impact	Validation	Ref.
Jamming-based PHY security	High (full-duplex + self-interference cancellation)	Yes	Limited (only for power-splitting schemes)	High, due to full-duplex and self-interference cancellation (energy cost typically non-negligible)	Mostly simulation	[10]
DSSS/spread-spectrum PHY security	Medium (spreading/coding support)	Yes	Limited (only DSSS-based schemes)	Medium (time switching between energy harvesting and decoding)	Mostly simulation	[11]
Intelligent Reflecting Surfaces (IRS)	High (additional infrastructure: IRS panels and control)	No	Limited (only for IRS-assisted SWIPT with power splitting)	Low at node, but requires external infrastructure	Mostly simulation	[12]
Secure energy optimization	Low extra hardware but high processing complexity	No	Limited (only for SWIPT-aided Het-Nets with beamforming and power splitting)	Low, but with high signal-processing burden and dependence on CSI	Mostly simulation	[13]
Deep-learning-based security	Low extra hardware, high computation requirements	No	Often limited (training and CSI dependence)	Low, but requires training, CSI, and is environment-sensitive	Mostly simulation	[14,15]
Backscattering rectifier (BR) identification	Low (dedicated backscattering rectifier)	Yes	Yes (protocol-independent)	Low, ~84 µJ overhead for a ~10 mJ cycle, with harvesting efficiency loss >10%	Experimental proof of concept	[16,17]
Polarization-Shift Backscatter Identification	Low, dedicated polarization backscattering add-on module	No	Yes (protocol-independent)	Very low, ~96 µJ overhead for a ~10 mJ cycle, with low harvesting efficiency loss (~5%)	Experimental proof of concept	This work

, despite their potential energy efficiency, existing SWIPT security solutions are often hardware-dependent, computationally complex, and protocol-specific, with most validated only via simulations, highlighting the need for a lightweight, protocol-agnostic, and hardware-efficient security mechanism suitable for practical deployments.

This work focuses on an alternative and practical solution for securing BFSNs by leveraging the WPT Power wave (P-wave) to backscatter a device identification signal. This mechanism introduces an additional, protocol-independent and energy-efficient authentication layer that operates regardless of the communication protocol used for the data wave (e.g., BLE, LoRaWAN). Previous works have demonstrated the feasibility of this concept by replacing the original BFSN rectifier with a dedicated backscattering rectifier [16,17]. While these experiments validated the functional operation of backscattering-based identification, the backscattering rectifier is inherently less efficient than the original harvesting rectifier. Moreover, replacing the original rectifier requires modifying the BFSN circuitry, which can be impractical for already deployed nodes.

The original approach proposed for the first time in this paper removes the need for a dedicated backscattering rectifier by incorporating a fail-safe RF switch with two antennas into the BFSN as an add-on module. Controlled backscattering is achieved by switching between antennas with orthogonal polarizations, enabling a seamless and non-intrusive integration into existing BFSN architectures. A direct comparison is provided in Table 1 (highlighted rows). The key advantages of this design are summarized as follows:

• Non-intrusive integration:

The proposed solution preserves the original RF rectifier already integrated into the BFSN for energy harvesting. The backscattering functionality is provided through an external add-on module containing the fail-safe RF switch and polarized antennas, avoiding any modification to the existing rectification circuitry.

2.

Improved robustness through polarization shifting:

By backscattering the identification signal using an orthogonal polarization relative to the incoming WPT power wave, the proposed method reduces the impact of environmental reflections, clutter, and cross-jamming, improving the reliability of identification retrieval at the Communication Node.

3.

Cost-effective deployment:

The use of an add-on module enables retrofitting of already deployed BFSNs, which is significantly less costly than redesigning and replacing sensor nodes or modifying their RF front-end to include dedicated backscattering rectifiers.

4.

High energy efficiency:

The backscattered identification is controlled solely by a low-power microcontroller via simple GPIO toggling, without activating the RF transceiver. In addition, unlike backscattering rectifier, which is typically less efficient than the original standard harvesting rectifier, the fail-safe RF switch remains passive in its default state, introducing only a minimal insertion loss of ≤0.4 dB and consuming energy only during brief switching intervals.

The remainder of this paper is organized as follows. Section 2 presents the proposed polarization-shift backscattering concept and the fail-safe RF switch-based architecture. Section 3 describes the experimental setup, measurement methodology, and experimental outcomes, including backscattering performance, RF-to-DC efficiency, and energy consumption analysis. Section 4 discusses the obtained results and their implications. Finally, Section 5 concludes the paper and outlines directions for future work.

2. The Polarization-Shift Backscattering Security

In a standard dual-wave SWIPT architecture, a P-wave is generated by the RF source at the Communication Node (CN) to wirelessly supply energy to the BFSN, while a separate wave is used for data communication through the BFSN’s transceiver. The proposed concept leverages the P-wave (normally used solely for energy harvesting) to introduce an additional security layer by enabling the BFSN to backscatter an identification signal even when its transceiver is turned off to conserve energy. This backscattered identification is controlled by a digital private key (PvK) generated by the BFSN’s low-power microcontroller, using minimal energy through simple General-Purpose Input/Output (GPIO) pin toggling. At the CN level, where no power constraints exist and a single CN can manage multiple BFSNs, a P-wave monitor is incorporated to detect and verify the backscattered identification signals. The key innovation contributed by this work lies in transmitting the backscattered wave (uplink from the BFSN to the P-wave monitor) with an orthogonal polarization relative to the incoming P-wave, thereby mitigating clutter and cross-jamming effects typically observed in real-world environments. As a result, an extra authentication layer is added without modifying the data communication protocol (see Figure 1), and with minimal additional power consumption.

The proposed concept is demonstrated using a LoRaWAN-based BFSN designed beforehand and described in [18], which is built around the CMWX1ZZABZ-091 LoRa module (Murata, Kyoto, Japan). The node incorporates a Power Management Unit (PMU) and an RF rectifier for energy harvesting and regulation, along with a 2.2 mF capacitor for energy buffering and an RF circulator to separate the transmitted data wave and the received P-wave from the same antenna. A temperature and humidity sensor is also integrated. In its original operation, the BFSN remains inactive until sufficient energy is accumulated in the capacitor; once the required threshold is reached, the node initiates a cycle of sensing and subsequently transmits the measured data. The choice of a LoRaWAN-based BFSN was motivated primarily by its availability (this home-built node had been previously developed for civil engineering applications).

A fail-safe Single Pole Double Throw (SPDT) RF switch (GRF6011, Guerrilla RF, Greensboro, NC, USA) was added to the BFSN (see Figure 2) without modifying its original RF rectifier [18]. Two monopole antennas (gain: 2.5 dBi) with orthogonal linear polarizations (horizontal and vertical) were connected to the switch. In the absence of power or control signals, the fail-safe switch remains in its default state, connecting the BFSN to the V-polarized antenna and introducing only minimal insertion loss (≤0.4 dB) at the RF input. When sufficient energy is stored in the capacitor, the LoRa module is configured to toggle the switch control signal, redirecting the received P-wave toward the H-polarized antenna. This operation enables controlled backscattering in the opposite polarization, determined by the digital PvK. The PvK consisted of a 16-bit preamble (0xAAAB) followed by 16 bytes of key Manchester encoded at a frequency up to 50 kHz.

Manchester encoding was chosen because its self-clocking property guarantees a transition at the center of each bit period, enabling robust clock recovery at the receiver even under amplitude variations induced by polarization switching, multipath effects and environmental reflections. Moreover, its DC-balanced characteristic avoids long steady states, ensuring regular polarization transitions and predictable energy consumption. In contrast, encoding schemes such as OOK, NRZ or Miller may introduce long sequences without transitions, which can impair synchronization and reduce the reliability of polarization-based backscatter detection.

3. Experiments and Results

To evaluate the proposed polarization-shift backscattering concept, an experimental system was deployed in a real-world environment consisting of a LoRaWAN-based BFSN equipped with a fail-safe RF switch and a corresponding Communication Node (CN). The CN integrated an Anritsu MG3694B RF signal generator used as the continuous-wave RF power source and a Tektronix RSA306B USB spectrum analyzer to monitor the backscattered signal, in addition to a LoRaWAN gateway for conventional data reception.

3.1. Antenna and Polarization Configuration

The RF source was connected to a vertically polarized monopole antenna identical to that of the BFSN (gain: 2.5 dBi), while the spectrum analyzer employed an identical monopole antenna oriented for horizontal polarization. The two monopole antennas at the CN were thus orthogonally polarized and directly oriented, such that the radiation minimum of the horizontally polarized receiving antenna was aligned toward the vertically polarized transmitting antenna. This configuration minimizes direct coupling between the transmit and receive chains at the CN. The vertical polarization was used to efficiently transfer energy from the RF source to the vertically polarized BFSN harvesting antenna, while the horizontally polarized spectrum analyzer antenna was dedicated to receiving the polarization-shifted backscattered signal from the BFSN’s horizontal backscattering antenna, thereby enhancing isolation between the P-wave and backscattered wave components.

3.2. Operating Conditions

The BFSN was positioned at a distance of 2 m from the CN, as illustrated in Figure 3, providing a representative deployment scenario. The RF source transmitted a continuous P-wave at 868 MHz with an output power of 22 dBm, corresponding to an EIRP of 24.5 dBm and remaining within European regulatory transmission limits.

3.3. Backscattering Identification

The BFSN successfully backscattered the identification PvK by alternating between vertically and horizontally polarized antennas through the fail-safe RF switch. Specifically, switching the RF path redirected the received incident P-wave from the harvesting antenna to the orthogonally polarized backscattering antenna port, thereby modulating the polarization of the reradiated signal. This polarization switching produced a Manchester-encoded amplitude variation that was detected by the spectrum analyzer (P-wave monitor) prior to the transmission of temperature and humidity data via the LoRaWAN gateway. As shown in Figure 4, the PvK was reliably extracted from the received backscattered P-wave and verified at the CN, despite the presence of a visible noise floor originating from residual cross-polarization leakage, scene reflections, and polarization changes, confirming the feasibility of the proposed secure identification mechanism. Importantly, this PvK-based authentication layer is achieved using only an additional polarization switching module, without requiring any modification to the original BFSN circuitry.

3.4. RF-to-DC Conversion Efficiency Comparison

To provide a fair comparison between the proposed add-on module (fail-safe RF switch with orthogonally polarized antennas) and backscattering-rectifier-based approaches, RF-to-DC conversion efficiency measurements were performed on three prototypes: (i) the original BFSN rectifier, (ii) the backscattering rectifier, and (iii) the proposed fail-safe switch port feeding the original rectifier. All measurements were conducted at the operating frequency of 868 MHz, which corresponds to the best-matched frequency for all three prototypes, using a 10 kΩ load, while sweeping the RF input power applied to each prototype. This evaluation framework allows a direct assessment of the impact of the backscattering mechanisms on energy-harvesting efficiency, results illustrated in Figure 5.

The efficiency comparison in Figure 5 shows that both the backscattering rectifier and the proposed add-on module exhibit lower RF-to-DC conversion efficiency than the original BFSN rectifier, as expected due to the additional losses. However, the proposed add-on module, which introduces a maximum insertion loss of only 0.4 dB, consistently outperforms the backscattering rectifier by at least 3% across the evaluated input power range. Moreover, the efficiency curve of the add-on module closely follows the shape of the original rectifier, indicating that the intrinsic harvesting behavior of the BFSN is preserved. At higher input power levels, the proposed approach achieves more than 15% higher efficiency than the backscattering rectifier, demonstrating a clear advantage in energy-harvesting performance while avoiding any modification to the original BFSN circuitry.

3.5. Energy Consumption Comparison

After validating the backscattering capability and evaluating the harvesting efficiency, the energy consumption impact of the proposed identification mechanism was analyzed. In normal operation, the BFSN executes a periodic cycle consisting of system initialization, sensor acquisition, and data transmission via its LoRaWAN radio transceiver. In the proposed security concept, an additional 3 ms backscattering sequence via GPIO toggling is inserted immediately before radio transmission to identify the node. Current consumption measurements were performed for three configurations: (i) the original BFSN, (ii) the BFSN using a backscattering rectifier for identification, and (iii) the BFSN equipped with the proposed fail-safe RF switch add-on module. The measured current consumption profiles of these tasks as a function of time are presented in Figure 6, enabling a direct comparison of the overhead introduced by each identification approach.

As shown in Figure 6, the current consumption profiles of both backscattering-based identification mechanisms are temporally shifted with respect to the original BFSN operation due to the insertion of the 3 ms backscattering sequence immediately before radio transmission. The backscattering-rectifier-based approach introduces an additional energy consumption of approximately 84 µJ compared to the original BFSN, while the proposed fail-safe RF switch add-on module results in an energy overhead of about 95 µJ, exceeding the backscattering-rectifier solution by only 11 µJ. In both cases, the added energy consumption is negligible when compared to the total energy required for a complete BFSN operational cycle. These results demonstrate that the proposed identification mechanisms provide an additional security layer at a very low energy cost, with the fail-safe switch approach achieving this without modifying the original BFSN circuitry.

3.6. Experimental Outcomes Summary

The experiments confirm that identification can be achieved using orthogonal-polarization backscattering with omnidirectional monopole antennas at a distance of 2 m, without the need for directional antennas as required by backscattering-rectifier-based approaches [16,17].

RF-to-DC efficiency measurements show that the proposed fail-safe RF switch add-on preserves the efficiency profile of the original BFSN rectifier and consistently outperforms the backscattering rectifier by 5–15% while introducing only minimal insertion loss.

Finally, energy consumption analysis demonstrates that the additional 3 ms backscattering-based identification sequence introduces a negligible overhead (≤95 µJ) compared to the total BFSN operational cycle (>10 mJ), with the proposed add-on module consuming only 11 µJ more than the backscattering-rectifier approach, while enabling secure identification without modifying the original BFSN circuitry.

4. Discussion

The experimental results demonstrate the feasibility of introducing a secure identification layer in BFSNs by exploiting polarization-shift backscattering controlled through a fail-safe RF switch. The identification PvK was retrieved seamlessly at the CN, confirming that a reliable backscattered signal can be generated without the need for a dedicated backscattering rectifier. This is a notable outcome, as it enables the BFSN to retain its original and more efficient RF rectifier for harvesting, thereby avoiding circuit modifications and facilitating integration into existing BFSN designs. Additionally, backscattering the PvK using an orthogonal polarization relative to the incoming waveform reduces clutter and cross-jamming effects.

The use of a 16-byte (128-bit) PvK was deliberately chosen to align with AES-128, which is already implemented in most low-power IoT communication protocols and hardware platforms. AES-128 provides a well-established security level while operating on 128-bit blocks, thereby avoiding additional memory, computational, or energy overhead at the BFSN. This choice ensures seamless integration of the proposed identification layer without modifying the existing cryptographic infrastructure of the node. For long-term deployments, security can be further enhanced without increasing BFSN resource consumption by combining the private key with complementary mechanisms such as a public key embedded in the incident RF waveform that can be modulated through polarization-based backscattering using the PvK, enabling freshness and replay protection while preserving the ultra-low-power operation of the BFSN.

For demonstration purposes, the backscattering module was implemented using two antennas with orthogonal linear polarizations. A more compact alternative could be achieved by replacing the two antennas with a single two-port dual-polarization antenna, which reduces footprint and simplifies integration while providing co-located orthogonal ports. Numerous dual-polarized antennas have been reported for sub-GHz and IoT bands, including meandered or miniaturized dipole designs [19] and other representative works [20,21,22,23], demonstrating high port isolation and good polarization purity. These results confirm the feasibility of employing a single dual-polarized antenna for orthogonal-polarization backscattering. However, further work on antenna miniaturization is required to fully meet the size and integration constraints of BFSNs. The use of circularly polarized antennas in future implementations may further enhance robustness, as circular polarization is inherently more resilient to polarization changes and orientation mismatch.

The fail-safe SPDT switch introduced into the BFSN exhibited minimal impact on system performance. In its default state (for most of the operational time and while harvesting), it consumes no power and introduces only a maximum insertion loss of 0.4 dB, which affects the normal operation and harvesting efficiency of the BFSN significantly less (5–15%) than a dedicated backscattering rectifier, as confirmed by the RF-to-DC efficiency measurements. When switching polarization, the switch draws at most 1.8 mA (1 mA supply plus 800 µA control current). Given that switching occurs only during the brief interval required to encode the Manchester-balanced PvK sequence, the resulting energy overhead is minimal. For the 3 ms backscattered sequence shown in Figure 4, the theoretically additional energy consumption due to the RF switch is approximately 8.9 µJ, corresponding to the effective ON time imposed by the Manchester encoding. The energy E_switch is computed as:

E_switch = I_switch × V_switch × t_on

(1)

where

I_switch = 1.8 mA, V_switch = 3.3 V, t_on = 1.5 ms

(2)

Yielding

E_switch = 1.8 × 10⁻³ × 3.3 × 1.5 × 10⁻³ ≈ 8.9 µJ

(3)

This theoretical value considers only the RF switch operation. When the small and well-defined additional consumption of the microcontroller during the switching interval is taken into account, the total energy overhead becomes predictable and consistent with the experimentally measured value of approximately 95 µJ. In all cases, this overhead remains negligible compared to the total BFSN operational cycle energy (>10 mJ), confirming that the proposed identification mechanism introduces a very low and controlled energy cost.

5. Conclusions

This work demonstrated a practical and easy-to-implement method for enhancing the security of battery-free sensor nodes in the context of SWIPT by introducing protocol-independent authentication through polarization-shift backscattering controlled by a fail-safe RF switch. The approach enables the use of the existing high-efficiency RF rectifier for energy harvesting while adding minimal power overhead and requiring no modifications to the BFSN’s original circuitry. Compared to backscattering-rectifier-based solutions, the proposed add-on consumes only 11 µJ additional energy while achieving 5–15% higher RF-to-DC conversion efficiency. As a result, a complementary authentication layer was added without modifying the data communication protocol. Experimental results confirmed successful extraction of the backscattered private key, validating the feasibility of the concept. This lightweight and easily integrable add-on solution offers a promising pathway for securing BFSNs within dual-wave SWIPT architectures, with potential improvements achievable through optimized polarization schemes, including circular polarization and compact dual-port dual-polarized antennas. While a spectrum analyzer was used in this work to validate the concept, future work will focus on the design and evaluation of a low-cost practical reader (P-wave Monitor), such as an SDR-based receiver or an envelope detector, for real-time detection of backscattered identification signals.