Passive optical-to-RF conversion for secure eavesdropping on optical wireless communication systems

Abstract

An example surveillance system includes an antenna configured to reflect an RF signal; a photodiode coupled to the antenna, where the photodiode is configured to receive an optical-wireless communication signal, and where the photodiode is configured to output a modulated backscattered RF signal by the antenna by switching the antenna between a low reflection state and a high reflection state; and a transceiver comprising: an RF transmitter configured to transmit the RF signal; and a receiver configured to receive the modulated backscattered RF signal, and where the modulated backscattered RF signal comprises a frame of optical-wireless communication data of the optical-wireless signal.

Description

PASSIVE OPTICAL-TO-RF CONVERSION FOR SECURE EAVESDROPPING ON OPTICAL WIRELESS COMMUNICATION SYSTEMS CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of U. S. provisional patent application No.63 / 644,897, filed on May 9, 2024, and titled “PASSIVE OPTICAL-TO-RF CONVERSION FOR SECURE EAVESDROPPING ON OPTICAL WIRELESS COMMUNICATION SYSTEMS,” the disclosure of which is expressly incorporated herein by reference in its entirety.STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

[0002] This invention was made with government support under 1652669 and 2305246 awarded by National Science Foundation. The government has certain rights in the invention.BACKGROUND

[0003] Optical wireless communication (OWC) utilizes light emitted from light-emitting diodes (LEDs) to establish efficient networked communication. OWC is commonly taken for granted as highly secure with inherent advantages such as being sniff-proof. This is because light propagates directionally and cannot penetrate physical barriers like walls. As a result, recent work explored the use of non-optical media for eavesdropping purposes.

[0004] Open-source platforms do not need to adhere to electromagnetic compatibility (EMC) regulations that require minimization of electromagnetic leakage. Specifically, an attacker was able to eavesdrop on an open-source OWC research platform by detecting leaked electromagnetic signals, which stemmed from current fluctuations in the LED connection cable. One example uses two long unshielded wires as the LED connection cable, arranged at an angle of 180 degrees. This arrangement effectively forms a dipole antenna, amplifying the leaked electromagnetic signals. As the wire length increases, the efficiency of the antenna system also increases.

[0005] However, the eavesdropping method above may not apply to commercial off-the-shelf (COTS) OWC products that are subject to EMC regulations. In these designs, various techniquesare used to minimize electromagnetic leakage in order to comply with EMC regulations.Consequently, the combination of impenetrable physical barriers and adherence to EMC regulations seems to offer a reasonable degree of security for OWC systems.SUMMARY

[0006] In some aspects, implementations of the present disclosure include a device including: an antenna configured to reflect RF signals; a photodiode coupled to the antenna, wherein the photodiode is configured to modulate reflected RF signals from the antenna by switching the antenna between a low reflection state and a high reflection state.

[0007] In some aspects, implementations of the present disclosure include a device, wherein the antenna is directly soldered to the photodiode

[0008] In some aspects, implementations of the present disclosure include a device, wherein the antenna is coupled to the photodiode without an intervening active component.

[0009] In some aspects, implementations of the present disclosure include a device, wherein the photodiode is configured to change impedance based on an intensity of incident light on the photodiode.

[0010] In some aspects, implementations of the present disclosure include a device, wherein the photodiode is configured with a reverse bias voltage

[0011] In some aspects, implementations of the present disclosure include a device, wherein the photodiode is configured with a forward bias voltage.

[0012] In some aspects, implementations of the present disclosure include a device, wherein the antenna and photodiode are configured to operate without an external power source.

[0013] In some aspects, implementations of the present disclosure include a device, wherein the antenna is a dipole antenna.

[0014] In some aspects, implementations of the present disclosure include a device, further including a plurality of photodiodes coupled in parallel, wherein each photodiode of the plurality of photodiodes has a different peak responsivity wavelength.

[0015] In some aspects, implementations of the present disclosure include a surveillance system including: an antenna configured to reflect an RF signal, a photodiode coupled to the antenna, wherein the photodiode is configured to receive an optical -wireless communication signal, and wherein the photodiode is configured to output a modulated backscattered RF signal by the antenna by switching the antenna between a low reflection state and a high reflection7state.; and a transceiver including: an RF transmitter configured to transmit the RF signal; and a receiver configured to receive the modulated backscattered RF signal, and wherein the modulated backscattered RF signal includes a frame of optical-wireless communication data of the optical-wireless signal.

[0016] In some aspects, implementations of the present disclosure include a surveillance system, wherein the receiver is further configured to recover the frame of optical-wireless communication data by demodulating the modulated backscattered RF signal.

[0017] In some aspects, implementations of the present disclosure include a surveillance system, wherein the antenna is coupled to the photodiode without an intervening active component.

[0018] In some aspects, implementations of the present disclosure include a surveillance system, wherein the photodiode is configured to change impedance based on an intensity of incident light on the photodiode.

[0019] In some aspects, implementations of the present disclosure include a surveillance system, wherein the antenna and photodiode are configured to operate without an external power source,

[0020] In some aspects, implementations of the present disclosure include a surveillance system, wherein the antenna is a dipole antenna.

[0021] In some aspects, implementations of the present disclosure include a surveillance system, further including a plurality of photodiodes coupled in parallel, wherein each photodiode of the plurality of photodiodes has a different peak responsivity wavelength.

[0022] In some aspects, implementations of the present disclosure include a method of surveilling an OWC signal including: providing an antenna and a photodiode configured to modulate a signal reflected by the antenna; determining a center frequency of a predetermined radio frequency (RF) band, transmitting a continuous wave (CW) at the center frequency at the antenna to receive a reflected signal; and processing the reflected signal to recover data transmitted by an optical-wireless communications source.

[0023] In some aspects, implementations of the present disclosure include a method, wherein the predetermined RF band is between 902 and 928 MHz.

[0024] In some aspects, implementations of the present disclosure include a method, wherein the reflected signal is a BPSK signal that results from a multiplication of the continuous wave (CW) and square waves with two distinct phases (0 and π).

[0025] In some aspects, implementations of the present disclosure include a method, wherein the processing includes: down-converting the reflected signal to baseband using a quadrature down-conversion mixer, focusing on a first harmonic frequency, i.e., fc + fo; eliminating a DC offset; applying a low-pass filter to reduce high-frequency noise and unwanted components in the reflected signal; employing a timing recovery method to accurately recover a symbol clock to identify sampling points; estimating and correcting a phase of the reflected signal and an amplitude of the reflected signal during a symbol detection stage; performing a cross-correlation analysis on recovered data with preamble codes to establish frame synchronization; and recovering the data while parsing a frame structure of the optical-wireless communications source.

[0026] Other systems, methods, features and / or advantages will be or may become apparent to one with skill in the art upon examination of the following drawings and detailed description. It is intended that all such additional systems, methods, features and / or advantages be included within this description and be protected by the accompanying claims.BRIEF DESCRIPTION OF THE. DRAWINGS

[0027] The components in the drawings are not necessarily to scale relative to each other. Like reference numerals designate corresponding parts throughout the several views.

[0028] FIG. 1 illustrates an example system for surveillance of optical-wireless communications (OWC), according to an example implementation of the present disclosure.

[0029] FIG. 2 illustrates an example circuit diagram of a tag for OWC surveillance, according to implementations of the present disclosure.

[0030] FIG. 3A illustrates an example method of obtaining OWC data from a modulated backscattered signal according to a study of an example implementation of the present disclosure.

[0031] FIG. 3B illustrates an example method of signal processing that can optionally be used with the method of FIG. 3 A, according to a study of an example implementation of the present disclosure.

[0032] FIG. 4 illustrates an example computing device.

[0033] FIG. 5 illustrates an example implementation of the present disclosure used for surveillance of OWC.

[0034] FIG. 6A illustrates a design that requires digital processing in a tag, and FIG. 6B illustrates the example implementation of a tag without digital processing for comparison.

[0035] FIGS. 7A and 7B illustrates the operation of photodiodes and characteristic currentvoltage curves of photodiodes.

[0036] FIG. 8 illustrates on-off keying (OOK) encoded by OWC.

[0037] FIG. 9 A illustrates the principle of operation for a backscatter tag with digital logic.

[0038] FIG. 9B illustrates the principle of operation of an example implementation of the present disclosure.

[0039] FIG. 10A illustrates an example experimental setup used in a study of an example implementation of the present disclosure.

[0040] FIG. 10B illustrates an example implementation including a tag including an antenna and photodiode, used in a study of an example implementation of the present disclosure.

[0041] FIG. 10C illustrates a transceiver configured to read the tag of FIG. 10B, according to a study of an example implementation of the present disclosure.

[0042] FIG. 11 illustrates a plot of laser diode current vs. power according to a study of an example implementation of the present disclosure.

[0043] FIG. 12 illustrate an example laser diode current waveform vs. light intensity waveform, according to a study of an example implementation of the present disclosure.

[0044] FIG. 13 illustrates an FFT spectrum of received RF signals, according to a study of an example implementation of the present disclosure.

[0045] FIGS. 14A-14D illustrate plots of signal strength vs. incident light power for four example laser diodes and photodiodes. FIG. 14A illustrates a blue laser diode and blue photodiode, FIG. 14B illustrates a green laser diode and green photodiode, FIG. 14C illustrates a red laser diode and red photodiode, FIG. 14D illustrates an infrared laser diode and infrared photodiode.

[0046] FIGS. 15A-15D illustrates plots of signal strength vs. incident light power. FIG. 15A illustrates results from a blue photodiode, FIG. 15B illustrates results from a green photodiode,FIG. 15C illustrates results from a red photodiode. FIG. 15D illustrates results from a blue photodiode.

[0047] FIG. 16 illustrates example spectral power distributions for cool and warm white LEDs, according to a study of an example implementation of the present disclosure.

[0048] FIGS. 17A-17D illustrate an example implementation of the present disclosure. FIG. 17A illustrates an LED Lamp, FIG. 17B illustrates an LED driver, FIG. 17C illustrates an OWC receiver, and FIG. 17D illustrates an OWC spatial layout diagram.

[0049] FIGS. 18A-18B illustrate distance vs. signal strength. FIG. 18A illustrates an office partition wall, FIG. 18B illustrates drywall.

[0050] FIG. 19A illustrates bit-error-rate performance of an example implementation, according to a study of an example implementation of the present disclosure.

[0051] FIG. 19B illustrates throughput of an example implementation, according to a study of an example implementation of the present disclosure.

[0052] FIG. 20 illustrates a plot of light intensity’ vs. angle, according to a study of an example implementation of the present disclosure.

[0053] FIG. 21 illustrates the impact of the particle diffusion on reflected RF signal strength, according to a study of an example implementation of the present disclosure.

[0054] FIG. 22 illustrates the operating characteristics of example laser diodes and photodiodes, according to a study of an example implementation of the present disclosure.DETAILED DESCRIPTION

[0055] Optical-wireless communication (OWC) is an innovative method that utilizes light emitted from light-emitting diodes (LEDs) to establish efficient networked communication. Compared to traditional RF communication links, OWC boasts numerous advantages, including lower implementation costs and reduced energy consumption, primarily attributed to the affordability and energy-saving characteristics of LEDs. These benefits elevate OWC as a promising and viable alternative to RF communication, propelling the OWC market towards an impressive compound annual growth rate of 101% through 2026 [8], With rapid market expansion and the proliferation of applications, addressing the critical security concerns associated with OWC products has become increasingly vital.

[0056] However, OWC is commonly taken for granted as highly secure with inherent advantages such as being sniff-proof [45, 46], This is because light propagates directionally and cannot penetrate physical barriers like walls. As a result, recent work

[0015] has explored the use of non-optical media for eavesdropping purposes. For example, a conventional approach includes monitoring leaked electromagnetic signals that are caused by current fluctuations in the LED connection cable. The eavesdropping method proposed in

[0015] proves challenging to apply to secure OWC products. This is because many OWC products are subject to stringent EMC regulations [4-6], requiring the minimization of electromagnetic leakage. In contrast, open-source platforms like the one used in

[0015] can circumvent these restrictions. For example,

[0015] employs two long unshielded wires as the LED connection cable, arranged at an angle of 180°. This arrangement effectively forms a dipole antenna [3], amplifying the leaked electromagnetic signals. As the wire length increases, the efficiency of the antenna system also increases. In practice, engineers consistently employ various techniques to minimize electromagnetic leakage in order to comply with EMC regulations. Consequently, the combination of impenetrable physical barriers and adherence to EMC regulations offer a reasonable degree of security for OWC systems and limit OWC surveillance systems that rely on surveilling the cables of the OWC system.

[0057] Additionally, active attacks, like an RF signal generator deployed inside the victim’s room, have additional limitations. Generating RF signals is energy expensive, demanding a power cord, a battery, or solar cells to supply power, increasing the exposure risk of eavesdropping or allowing for only short-lived eavesdropping.

[0058] Implementations of the present disclosure overcome the limitations these surveillance systems by instead capturing the OWC signal itself and reflecting a backscattered signal that is modulated by the OWC signal. Unlike solutions that require unshielded EM waves from a cable of the O WC system, or an active receiver in view of the OWC system, implementations of the present disclosure include a passive optic-to-RF conversion that directly receives the OWC signal. Implementations of the present disclosure take advantage of common methods of O WC, including IEEE Std 802.15.7, which use On-Off Keying (OKK) modulation to transmit data, where the On and Off states of the light represent the data bits ' 1 ' and ' O '. Implementations of the present disclosure use the OKK modulation to change the impedance of a photodiode (PD) coupled to an antenna configured for backscattering, resulting in a modulated backscatteredsignal that can be used to surveil the OWC signal. Additionally, implementations of the present disclosure include methods for demodulating the resulting signals to obtain the data from the OWC signal. Thus, implementations of the present disclosure include systems, devices, and methods of optically surveilling OWC signals without external power sources, without requiring the monitoring of EM signals from the OWC devices (allowing uses against shielded OWC devices), and / or without requiring an active transmitter circuit to broadcast a captured OWC signal.

[0059] FIG. 1 illustrates an example implementation of a surveillance system according to implementations of the present disclosure. The system includes a tag 102 for optically surveilling the OWC signal and a transceiver 120 configured to read the tag 102. The OWC signal can be a signal from any OWC system. While the present disclosure discusses OWC systems generally that operate in the visual spectrum, the O WC system can use visible, infrared, near infrared, and / or any other form of light, regardless of whether it is visible light.

[0060] The tag 102 includes an antenna 104 and one or more photodiodes 106a, 106b coupled to the antenna 104. The present disclosure contemplates that different types of antenna 104 can be used. As a non-limiting example, the antenna 104 can be a dipole antenna. Alternatively or additionally, patch or loop antennas can also be used. The antenna can optionally be formed on substrate (e.g., a flexible substrate, plastic, glass, paper, fabric, etc.).

[0061] The antenna 104 can be optionally be coupled to the photodiodes 106a, 106b directly. For example, the tag 102 can have no active components or no active components coupled between the tag 102 and photodiodes 106a, 106b, in some implementations of the present disclosure. Alternatively or additionally, the photodiodes 106a, 106b can be soldered to the antenna 104 directly. As yet another non-limiting example, the photodiodes 106a, 106b can be coupled to the antenna 104 by a single passive component (e.g., a wire).

[0062] The types of photodiodes 106a, 106b can be selected based on the spectrum of the O WC signal that is being surveilled by the tag 102. For example, in the implementation shown in FIG. 1, photodiode 106a is a red photodiode and photodiode 106b is a blue photodiode. In FIG.1, two photodiodes 106a, 106b are used, but the present disclosure contemplates that any numberof photodiodes can be used. The present disclosure contemplates that any number of photodiodes can be arranged various combinations (series, parallel, sensor grids, etc.).

[0063] In some implementations of the present disclosure, the photodiode can be replaced with another light-sensitive circuit component or combination of circuit components. For example, photoresistors, phototransistors, perovskite photoconductors, etc. can all be used in addition to, or as alternatives to, the photodiode, by providing variable impedances coupled to the antenna 104.

[0064] The antenna 104 can be configured as a backscatter antenna, where the impedance of the antenna 104 affects the amount of electromagnetic energy backscattered by the antenna 104. The photodiodes 106a, 106b are coupled to the antenna 104 so that the impedance of the antenna 104 changes based on the impedance of the photodiodes 106a, 106b. When two terminals of the PD couple two branches of the antenna, it is equivalent to a backscatter circuit. Because of the intensity change of the incoming light, the PD impedance can also change significantly.Therefore, the photodiode can behave like an RF switch to change the antenna's impedance. The light intensity (which is the OWC data in a system using On-off keying) determines the amount of the reflected RF signals. For example, when no light is incident on a photodiode, the impedance can be high, and when the light on the photodiode increases, the impedance of the photodiode can drop as the photodiode generates current.

[0065] When the photodiodes 106a, 106b are conducting, they form a short between the antenna 104 and the ground 108, which can put the antenna 104 in a high reflection state, and when the photodiodes 106a, 106b are not conducting, the antenna 104 can be in a low reflection state. Thus, the light incident on the photodiodes 106a, 106b can modulate a backscattered signal from the antenna by changing the amount of backscattering. When light from an OWC system (an OWC signal) is incident on the photodiodes 106a,106b, the modulated backscattered signal from the antenna 104 is modulated based on the OWC signal. This allows for a receiver to capture the modulated backscattered signal and reconstruct the OWC signal.

[0066] Because the photodiodes are controlled by the OWC light source, implementations of the present disclosure do not include any logic circuits, batteries, and / or other external power supplies in the tag 102. This allows for surveillance by the tag 102 to continue indefinitely. Insum, implementations of the present disclosure enable optic- to-RF conversion using only two passive components, eliminating the complicated baseband circuit and the energy harvester of digital-logic-based systems for OWC surveillance.

[0067] FIG. 2 illustrates an example circuit of a tag 102 with a photodiode 106a. The photodiode 106a is represented as a current source, junction capacitance, shunt resistance, and series resistance. FIG. 2 shows the photocurrent path in the photodiode 106a. The photodiode 106a can be represented by a current source ( lph), a parallel junction capacitance (Cj), a parallel shunt resistance (Rsh), a series resistance ( Rs), and a parallel normal p-n junction ( D ). The current source represents the current generated by the incident light, which is given by:

[0068]

[0069] where P is the total power radiated from a light source, and d.phis the distance between the PD and the light source. R is the responsivity of a PD. It measures the effectiveness of the conversion of the light power into a photocurrent at a given light wavelength. It varies with the light wavelength. Additional description of the circuit model is provided in the Example, herein.

[0070] Again with reference to FIG. 1, the system further includes a transceiver 120. The transceiver 120 can optionally include separate receiver 124 and transmitter 122 circuits.Alternatively or additionally, the transceiver 120 can be configured as an integrated transceiver system. The transmitter 122 can transmit, an RF signal at a frequency that the tag 102 is configured to backscatter. The receiver can be configured to receive the modulated backscattered signal backscattered by the antenna 104.

[0071] The transceiver can further include a controller 126. The controller 126 can be configured to reconstruct the OWC signal and / or its data using the modulated backscattered signal. Optionally, the controller 126 can be a separate computing device from the transceiver 120 (e.g., both the transceiver 120 and controller 126 can include computing devices). An example computing device that can be used in the transceiver 120 and / or controller 126 is shown in FIG. 4.

[0072] With reference to FIG. 3A, implementations of the present disclosure include computer-implemented methods that can be performed by the controller 126 to obtain the OWCdata from the modulated backscattered signal, for example by demodulating the modulated backscatered signal to obtain a data frame of the OWC data. Because OWC adopts a different physical layer operating mode from RF signals, the present disclosure includes demodulation methods to decode OWC data from the reflected RF signals.

[0073] At step 302, the method includes providing an antenna and a photodiode configured to modulate a signal reflected by the antenna.

[0074] At step 304, the method includes, determining a center frequency of a predetermined radio frequency (RF) band. As non-limiting examples, the predetermined frequency band can be between 902 and 928 MHz. The present disclosure contemplates that the predetermined frequency used as a carrier can be any frequency. For example, the carrier frequency may be below 500 kHz or above 3 GHz, or between 500 kHz and 3 GHz. The carrier frequency can optionally be selected to penetrate structures (e.g., walls).

[0075] At step 306, the method includes, transmitting a continuous wave (CW) at the center frequency at the antenna to receive a reflected signal (e.g., the modulated backscattered signal described with reference to FIG. 1). Optionally the reflected signal is a BPSK signal that results from a multiplication of the continuous wave (CW) and square waves with two distinct phases (0 and rr).

[0076] At step 308, the method includes processing the reflected signal to recover data transmitted by an optical-wireless communications source. Optionally, processing the data can included the steps of FIG. 3B.

[0077] FIG. 3B illustrates example processing steps that can be used to recover data from the OWC communications source based on a reflected signal (e.g., the modulated backscattered signal described with reference to FIG. 1).

[0078] At step 350, the method includes down-converting the reflected signal to baseband using a quadrature down-conversion mixer, focusing on a first harmonic frequency, i.e., fc + fo.

[0079] At step 352, the method includes eliminating a DC offset.

[0080] At step 354, the method includes applying a low-pass filter to reduce high-frequency noise and unwanted components in the reflected signal.

[0081] At step 356, the method includes employing a timing recovery method to accurately recover a symbol clock to identify sampling points.

[0082] At step 358, the method includes estimating and correcting a phase of the reflected signal and an amplitude of the reflected signal during a symbol detection stage.

[0083] At step 360, the method includes performing a cross-correlation analysis on recovered data with preamble codes to establish frame synchronization.

[0084] At step 362, the method includes recovering the data while parsing a frame structure of the optical-wireless communications source.

[0085] The construction and arrangement of the systems and methods as shown in the various implementations are illustrative only. Although only a few implementations have been described in detail in this disclosure, many modifications are possible (e.g., variations in sizes, dimensions, structures, shapes, and proportions of the various elements, values of parameters, mounting arrangements, use of materials, colors, orientations, etc.). For example, the position of elements may be reversed or otherwise varied, and the nature or number of discrete elements or positions may be altered or varied. Accordingly, all such modifications are intended to be included within the scope of the present disclosure. The order or sequence of any process or method steps may be varied or re-sequenced according to alternative implementations. Other substitutions, modifications, changes, and omissions may be made in the design, operating conditions, and arrangement of the implementations without departing from the scope of the present disclosure.

[0086] It should be appreciated that the logical operations described herein with respect to the various figures may be implemented (1) as a sequence of computer implemented acts or program modules (i.e., software) running on a computing device (e.g., the computing device described in FIG. 4), (2) as interconnected machine logic circuits or circuit modules (i.e., hardware) within the computing device and / or (3) a combination of software and hardware of the computing device. Thus, the logical operations discussed herein are not limited to any specific combination of hardware and software. The implementation is a matter of choice dependent on the performance and other requirements of the computing device. Accordingly, the logical operations described herein are referred to variously as operations, structural devices, acts, or modules. These operations, structural devices, acts and modules may be implemented in software, in firmware, in special purpose digital logic, and any combination thereof. It shouldalso be appreciated that more or fewer operations may be performed than shown in the figures and described herein. These operations may also be performed in a different order than those described herein.

[0087] Referring to FIG. 4, an example computing device 400 upon which the methods described herein may be implemented is illustrated. It should be understood that the example computing device 400 is only one example of a suitable computing environment upon which the methods described herein may be implemented. Optionally, the computing device 400 can be a well-known computing system including, but not limited to, personal computers, servers, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, network personal computers (PCs), minicomputers, mainframe computers, embedded systems, and / or distributed computing environments including a plurality of any of the above systems or devices. Distributed computing environments enable remote computing devices, which are connected to a communication network or other data transmission medium, to perform various tasks. In the distributed computing environment, the program modules, applications, and other data may be stored on local and / or remote computer storage media.

[0088] In its most basic configuration, computing device 400 typically includes at least one processing unit 406 and system memory' 404. Depending on the exact configuration and type of computing device, system memory 404 may be volatile (such as random access memory (RAM)), non-volatile (such as read-only memory (ROM), flash memory', etc.), or some combination of the two. This most basic configuration is illustrated in FIG. 4 by box 402. The processing unit 406 may be a standard programmable processor that performs arithmetic and logic operations necessary for operation of the computing device 400. The computing device 400 may also include a bus or other communication mechanism for communicating information among various components of the computing device 400.

[0089] Computing device 400 may have additional features / functionality. For example, computing device 400 may include additional storage such as removable storage 408 and nonremovable storage 410 including, but not limited to, magnetic or optical disks or tapes.Computing device 400 may also contain network connection(s) 416 that allow the device to communicate with other devices. Computing device 400 may also have input device(s) 414 such as a keyboard, mouse, touch screen, etc. Output device(s) 412 such as a display, speakers, printer, etc. may also be included. The additional devices may be connected to the bus in order tofacilitate communication of data among the components of the computing device 400. All these devices are well known in the art and need not be discussed at length here.

[0090] The processing unit 406 may be configured to execute program code encoded in tangible, computer-readable media. Tangible, computer-readable media refers to any media that is capable of providing data that causes the computing device 400 (i.e., a machine) to operate in a particular fashion. Various computer-readable media may be utilized to provide instructions to the processing unit 406 for execution. Example tangible, computer-readable media may include, but is not limited to, volatile media, non-volatile media, removable media and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. System memory 404, removable storage 408, and non-removable storage 410 are all examples of tangible, computer storage media. Example tangible, computer-readable recording media include, but are not limited to, an integrated circuit (e.g., field-programmable gate array or application-specific IC), a hard disk, an optical disk, a magneto-optical disk, a floppy disk, a magnetic tape, a holographic storage medium, a solid-state device, RAM, ROM, electrically erasable program read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVT)) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices.

[0091] In an example implementation, the processing unit 406 may execute program code stored in the system memory 404. For example, the bus may carry data to the system memory 404, from which the processing unit 406 receives and executes instructions. The data received by the system memory 404 may optionally be stored on the removable storage 408 or the nonremovable storage 410 before or after execution by the processing unit 406.

[0092] It should be understood that the various techniques described herein may be implemented in connection with hardware or software or, where appropriate, with a combination thereof. Thus, the methods and apparatuses of the presently disclosed subject matter, or certain aspects or portions thereof, may take the form of program code (i.e., instructions) eml bodied in tangible media, such as floppy diskettes, CD-ROMs, hard drives, or any other machine-readable storage medium wherein, when the program code is loaded into and executed by a machine, such as a computing device, the machine becomes an apparatus for practicing the presently disclosed subject matter. In the case of program code execution on programmable computers, thecomputing device generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. One or more programs may implement or utilize the processes described in connection with the presently disclosed subject matter, e.g., through the use of an application programming interface (API), reusable controls, or the like. Such programs may be implemented in a high level procedural or object-oriented programming language to communicate with a computer system. However, the program(s) can be implemented in assembly or machine language, if desired. In any case, the language may be a compiled or interpreted language and it may be combined with hardware implementations.0093] Although the figures show a specific order of method steps, the order of the steps may differ from what is depicted. Also, two or more steps may be performed concurrently or with partial concurrence. Such variation will depend on the software and hardware systems chosen and on designer choice. All such variations are within the scope of the disclosure. Likewise, software implementations could be accomplished with standard programming techniques with rule-based logic and other logic to accomplish the various connection steps, processing steps, comparison steps and decision steps.

[0094] It is to be understood that the methods and systems are not limited to specific synthetic methods, specific components, or to particular compositions. It is also to be understood that the terminology used herein is for the purpose of describing particular implementations only and is not intended to be limiting.

[0095] , As used in the specification and the appended claims, the singular forms “a,” “an” and “the” include plural referents unless the context clearly dictates otherwise. Ranges may be expressed herein as from “about” one particular value, and / or to “about” another particular value. When such a range is expressed, another implementation includes from the one particular value and / or to the other particular value. Similarly, when values are expressed as approximations, by use of the antecedent “about,” it will be understood that the particular value forms another implementation. It will be further understood that the endpoints of each of the ranges are significant both in relation to the other endpoint, and independently of the other endpoint.

[0096] “Optional” or “optionally” means that the subsequently described event or circumstance may or may not occur, and that the description includes instances where said event or circumstance occurs and instances where it does not.

[0097] Throughout the description and claims of this specification, the word “comprise” and variations of the word, such as “comprising” and “comprises,” means “including but not limited to,” and is not intended to exclude, for example, other additives, components, integers or steps. “Exemplary” means “an example of’ and is not intended to convey an indication of a preferred or ideal implementation. “Such as” is not used in a restrictive sense, but for explanatory purposes.

[0098] Examples

[0099] The following examples are put forth so as to provide those of ordinary skill in the art with a complete disclosure and description of how the compounds, compositions, articles, devices and / or methods claimed herein are made and evaluated, and are intended to be purely exemplary and are not intended to limit the disclosure. Efforts have been made to ensure accuracy with respect to numbers (e.g., amounts, temperature, etc.), but some errors and deviations should be accounted for. Unless indicated otherwise, parts are parts by weight, temperature is in degrees C or is at ambient temperature, and pressure is at or near atmospheric.

[0100] EXAMPLE 1

[0101] An example implementation, referred to herein as “LightThief ’ was designed and tested in a study. The example implementation includes systems and methods for a battery-free optical-based eavesdropping approach. Battery-free eavesdropping allows for indefinite eavesdropping duration while reducing maintenance and minimizing the exposure risk of the attacker. The example implementation enables eavesdropping attacks that are efficient to deploy and simple to conceal.

[0102] An advantage of the example implementation includes enabling the transmissi on of surveilled OWC data through walls. A design feature is to leverage RF signals to smuggle OWC data through walls. The example implementation leverages the backscatter technology that reflects different amounts of ambient RF signals to transmit data. Since reflecting RF signals only consumes micro-watts’ level of power, the backscatter system can enable battery-less wireless communication. By using the backscatter technology, LightThief piggybacks OWC data onto the RF signals through a wall, allowing batteryless and unlimited lasting eavesdropping.

[0103] Another improvement of the example implementation includes methods for “piggybacking” OWC data onto RF signals. To piggyback OWC data from optical signals onto RF signals, the example implementation conducts an optic-to-RF conversion.

[0104] This presents improvements over systems that use complicated baseband processing circuit to conduct the conversion. For example, such systems may first use a threshold circuit to digitize the optical signals and then uses a micro-controller to recover OWC data from the threshold output. Finally, such systems may use an RF switch to control the antenna to reflect ambient RF signals. However, since the power consumption and circuit size (including solar cells) increase as the data rate increases, these systems may not be suitable for surveillance..

[0105] Unlike these solutions, LightThief uses passive optic-to-RF conversion based on On-Off Keying modulation which is often used by OWC to transmit data, where the On and Off states of the light represent the data bits ‘1’ and ‘O’, which can significantly change the impedance of a PD. When a PD is coupled to an antenna, it is equivalent to a backscatter system, allowing the antenna to reflect different amounts of RF signals according to the incident light intensity. Therefore, the optic-to-RF conversion of the present disclosure is realized using only two passive components, eliminating the complicated baseband circuit and the energy harvester.

[0106] Yet another consideration is how to decode OWC data from RF signals. Since OWC adopts a different physical layer operating mode from RF signals, the example implementation includes a new demodulation scheme to decode OWC data from the reflected RF signals. In this example implementation, the reflected RF signals are demodulated on a software defined radio platform with specified physical layer operating modes, such as modulation scheme, clock rate, and bandwidth,

[0107] Thus, implementations of the present disclosure may be summarized as follows. The present disclosure presents a new class of OWC eavesdropping, LightThief, that can eavesdrop on OWC systems without resistance by EMC regulations. The present disclosure also presents a hardware prototype of LightThief, which is composed of only two passive components and can directly convert OWC data from optical signals to RF signals. It is lightweight, unlimited lasting, and easy to disguise. The present disclosure presents an evaluation the effectiveness of LightThief on a COTS OWC product, and the experiment results show the vulnerability ofcurrent OWC systems. To defend against Light Thief, the present disclosure also provides defense strategies and suggestions to enhance the security of OWC systems.

[0108] Example Non-Limiting Advantages of the Implementations of the Disclosure

[0109] I. Power -Free Operation: Utilizes the reflection of ambient RF signals to operate without a battery, ensuring an indefinite eavesdropping duration and minimal maintenance requirements.

[0110] 2. Simplified Deployment: Requires only two passive components (a photodiode and an antenna), avoiding complex baseband processing circuits or power-consuming components, facilitating easy deployment.

[0111] 3. Enhanced Concealment: Its minimalist design facilitates concealment, reducing the risk of detection. Innovative Optical to RF Conversion: Achieves efficient signal conversion through a simplified hardware design, circumventing traditional EMC regulatory limitations.

[0112] Example Non-Limiting Characteristics of the Implementations of the Disclosure

[0113] I. Intensity Modulation: Employs intensity modulation (IM) to transmit data, where the on and off states of light represent the data bits T and 'O'.

[0114] 2. Backscatter Technology: Reflects ambient RF signals using intensity modulated light to transmit data, establishing a novel form of battery-free wireless communication.

[0115] 3. Simplified Optical to RF Conversion: Inspired by hybrid fiber-coaxial cable TV sy stems and the Great Seal Bug, this approach achieves passive optical to RF conversion without the need for pov / er.

[0116] Example Non-Limiting Industry Applications of the Implementations of the Disclosure

[0117] 1. Security Analy sis and Testing: Provides tools for security researchers and professionals to identify and mitigate vulnerabilities in current and future OWC systems.

[0118] 2. Wireless Network Infrastructure: As 5G and forthcoming 6G networks evolve, there is an increasing demand for communications with higher speed and reduced latency. The invention provides a critical bridge between varying wireless communication technologies, which is particularly valuable in environments with high density and traffic, such as stadiums,large-scale events, and commercial centers. Enhancing the performance of current wireless network infrastructure with this invention meets the growing demands of future communication networks.

[0119] 3. Remote Sensing and Environmental Monitoring: Empowers devices in remote or hard-to-access areas to operate indefinitely without the need for battery replacement, crucial for long-term environmental light data collection and monitoring.

[0120] In contrast to prior non-optical-based attacks, the example implementation includesa battery-free optical-based eavesdropping approach, LightThief. Battery-free eavesdropping allows for indefinite eavesdropping duration while reducing maintenance and minimizing the exposure risk of the attacker. Furthermore, the new eavesdropping attack should be efficient to deploy and simple to conceal.

[0121] The study included a hardware prototype of LightThief, which can include only two passive components and can directly convert OWC data from optical signals to RF signals. It is lightweight, unlimited lasting, and easy to disguise.

[0122] The study evaluates the effectiveness of LightThief on an example commercial-off-the-shelf (COTS) OWC product, and the experiment results show' the vulnerability of current OWC systems. The example implementation further includes methods of defense to enhance the security of OWC systems.

[0123] System Model. The example design considers scenarios consisting of OWC systems, such as conference room or cubicle arrangements. In these scenarios, a typical OWC system can comprise of OWC senders and receivers to support various applications (e.g., high-speed communication

[0039] , smart sensing

[0030] , localization

[0024] , etc.). Specifically, the sender uses light-emitting diodes (LEDs) to support lighting applications and leverage the intensity modulation scheme to embed the data into the visible light. The receiver is placed in the line of sight with the sender to receive the OWC data.

[0124] FIG. 5 shows an example, in an office environment, an OWC sender, such as an LED ceiling light, which not only provides illumination for the office space but also serves as a data transmiter using intensity modulation. The modulated light carries the data to be transmitted and is then received by an OWC receiver integrated into the target device, such as a laptop or asmartphone. In tins smart office, the OWC system can be utilized to enable a secure and highspeed wireless network for employees to connect their devices, as well as for indoor localization or smart sensing applications. The example implementation functions despite not having control over the OWC system or other wireless communication systems (e.g., WiFi, Bluetooth, ZigBee, FM, LTE, 5G, etc.) working in these scenarios.

[0125] This example considers an adversary (Eve) whose primary objective is to eavesdrop on OWC between legitimate devices - Alice (OWC transmitter) and Bob (OWC receiver) while concealing its presence without resistance from EMC regulations. To orchestrate such an attack, the example assumes that the attacker is fully a ware of the characteristics of the target OWC device, such as the physical operating mode and the peak wavelength. The attacker can get such knowledge by acquiring a model of the target device and analyzing the model device before launching attacks.

[0126] The example also assumes that the attacker can deploy LightThief in shared areas, such as conference rooms or cubicles to convert the OWC signal into RF signal. For example, as shown in FIG. 5, the attacker can deploy the LightThief on the victim's desktop, or on the victim's shelf in advance. Then, since the converted RF signal can be detected through the wall, the attacker can easily eavesdrop on the ongoing communication without being seen by the legitimate user. Moreover, the example LightThief tag is very small and battery-free. It can harvest the energy from the OWC signal and passively convert the OWC signal into RF signal, which makes the legitimate user even less likely to notice the ongoing attack.

[0127] Finally, the study did not impose any restrictions on the OWC applications that the legitimate user is using nor on the work schedules of the legitimate OWC senders. The study also did not impose any restrictions on the light (i.e., diffuse light or direct light) that the OWC system will use. As long as the OWC system uses intensity' modulation scheme, LightThief can to eavesdrop on the ongoing communication between legitimate OWC senders and receivers.

[0128] Variable Impedance in PD. A PD is a semiconductor p-n junction device that converts light into a photocurrent. As shown in FIG. 7A, when incident photons fall on the PD, the depletion region absorbs most of the photon energy because of its broad width. The photon hits the atom with high energy, resulting in free electrons and holes in the atom structure. Because of the electric field formed by an applied bias voltage, free electrons move towards the n -side,whereas holes move towards the p -side, generating photocurrents. Higher light intensity means that more photons are hitting the depletion region, resulting in a higher photocurrent.

[0129] Since the photocurrent changes depending on the light intensity, it enables the PD to be used as a light-intensity-based variable-impedance device. FIG. 7B shows the typical characteristic I- V curves of PDs. For a fixed bias voltage, when the PD is in reverse biased mode, an increase in light intensity E will induce growth in photocurrent I. The impedance is negative linear to the light intensity. When there is no incident light, the photocurrent is almost negligible and introduces a large impedance. When a forward bias mode is applied to the PD, there is an exponential increase in the photocurrent. Although it reveals a non-linear property, a variable impedance feature can be seen. As a result, the PD can be used as a variable impedance device with either reverse bias voltage or forward bias voltage.

[0130] Intensity’ Modulation for OWC. Light Thief can eavesdrop on IEEE standard-based OWC because IEEE Std 802.15.7 mainly adopts an intensity modulation scheme - On-Off Keying (OOK). Due to the physical properties of LEDs, it is difficult for OWC to transmit data by modulating the phase of the light. In contrast, OWC can only encode data in the light intensity

[0037] . Moreover, OOK modulation can be easily achieved by turning LEDs on and off. Therefore, the data is transmitted as two states of light intensity: bright and dark.

[0131] Besides the intensity modulation, OWC standards encode OOK with Manchester code to achieve a balanced lightness (50%). As shown in FIG. 8, the long OOK stream of "0" or "1" produces dimming or flicker, which is not acceptable for lighting purposes. Manchester code encodes each OOK data bit either low then high or high then low, for equal time, creating a balanced lightness. This balanced lightness improves the visual quality of the transmitted light while also making the eavesdropping more effective, as the attacker can more easily distinguish between the “ 0 ’’ and " 1 " bits based on the light intensity. Moreover, Manchester code is essentially a binary phase-shift keying (BPSK) modulation scheme

[0032] , which has been widely-adopted by backscatter techniques [48-51], The attacker can leverage similar backscatter techniques to demodulate the reflected RF signals to obtain the OWC data.

[0132] The example implementation leverages backscatter technology to convey the OWC data by reflecting RF signals. As shown in FIG. 9 A, a conventional RF backscatter tag controls an RF switch to change the antenna’s impedance. When the antenna picks up RF signals, it can convert the RF signals to an electromagnetic wave traveling through the antenna. When thecontrol signal is ' 1 ', the switch is on, which shorts the antenna and the ground. Since the wave encounters an impedance discontinuity between the antenna and the ground, part of the wave is reflected out of the antenna, which can then be picked up by another antenna. When the control signal is ' 0 the switch is off, and the antenna's impedance are matched, limiting the reflected wave. Using this approach, the backscatter tag controls the RF switch toggling between the reflection and non-reflection states of the RF signals to transmit data.

[0133] In the example implementation, shown in FIG. 9B, when two terminals of PD couple two branches of the dipole antenna, the PD behaves like an RF switch for the antenna.Meanwhile, the antenna acts like a bias voltage for the PD. FIG. 2 shows the equivalent circuit of LightThief, which is formed by coupling the equivalent circuit of the antenna to the equivalent circuit of the PD. FIGS. 6A and 6B illustrate a comparison of a design that requires digital processing in a tag (FIG. 6A), with the example implementation of a tag without digital processing shown in FIG. 6B.

[0134] Antenna Side. The study identified related parameters to increase the eavesdropping range of LightThief. Specifically, the eavesdropping range can be defined as the maximum distance from which the attacker equipped with the LightThief receiver can detect the reflected RF’ signals. The range can be modeled by the Friis path loss formula

[0034] :

[0135] This formula has three essential parts: the term in the first parenthesis models the signal propagation from the RF transmitter with the transmitted power Ptand the transmitting antenna’s gain Gtto LightThief's antenna at a transmission distance dtaway. Similarly, the third part models the signal propagation from LightThief's antenna to the attacker's receiver with the receiving antenna's gain Grand the signal strength threshold Pth. In this part, c represents the speed of light and fcrepresents the center frequency of the RF signal. At a lower center frequency, the eavesdropping range can increase. Finally, the middle parenthesis models the RF signal that LightThief reflects with an antenna gain Grass;ve. iAFH is the backscatter coefficient which is a measurement of the efficiency. alossmodels the energy loss due to backscattering. Itconsiders half of the power lost due to the side lobes generated by backscattering (detailed in Sec. 4.5).

[0136] The example implementation utilizes a continuous wave (CW) as the RF signal to validate the proof-of-concept. When the RF signals are ambient, Pt, Gt, and dtare almost fixed. Moreover, the attacker can tune Grand Pthat the receiver side during eavesdropping. Therefore, the most critical factors in determining the eavesdropping range are the LightThief antenna's gain Gpassiveand the backscatter coefficient |ΔΓ|2. In principle, one can achieve a more extended eavesdropping range by designing LightThief's antenna with a high gain. In this study, an omnidirectional antenna was used as LightThief's antenna without loss of generality. The study considers the backscatter coefficient |ΔΓ|, which is given by

[0023] :

[0137] where Γonand Γoffare the complex conjugates of the reflection coefficients corresponding to the two impedance states when the switch is on and off. Consider the equivalent circuit of an antenna shown in FIG. 2, representing a generator-load circuit with a complex generator and a complex load impedance. The equivalent circuit of the PD is just the load impedance. The reflection coefficient between a complex generator and a complex load impedance is given by:

[0138] is the complex PD impedance corresponding to the two impedance states when the light is on and off, and Zsis the complex antenna impedance. Therefore, the example implementation can improve the backscatter coefficient |ΔΓ|2, by maximizing the difference between the two impedance states of the PD to increase the eavesdropping range.

[0139] PD Side. Optionally, the device can be configured to maximize the difference between the two impedance states of the PD. The study calculated the PD impedance using the ratio of the bias voltage to the photocurrent. The antenna provides the bias voltage.

[0140] The prominent noise of the PD is the dark current (Id), which is a relatively small photocurrent from background radiation that flows through the p-n junction when there is no incident light. It can be calculated by using:

[0141] where ISATis the reverse saturation when a reverse bias applies to the PD, q is the electron charge, VLis the applied bias voltage across the two terminals, kBis the Boltzmann Constant, and 7’ is the absolute temperature.

[0142] Thus, the PD impedance is:

[0143] Eqn. 6, shows that only a small dark current survives when there is no incident light (P = 0), and the corresponding impedance will be enormous. Therefore, to maximize the difference between the two impedance states, the example implementation can minimize the impedance when there is incident light (P 7= 0). In other words, the photocurrent generated by the incident lightshould be as large as possible. As shown in Eqn. 6, an increased responsivity or a reduced distance dphwill produce a high photocurrent and result in a small impedance.

[0144] As introduced in Eqn. 1 and 6, to increase the eavesdropping range, the attacker can either i) design LightThief's antenna with a high gain 6'passive, ii) select the RF signal with a lower center frequency fc, iii) increase the responsivity ℜ of LightThief's PD, or iv) reduce the distance,

[0145] The setup used in the study is shown in FIGS. 10A-10C. The study chose components with different parameters to compare the effects on LightThief. FIG. 10A illustrates an example experimental setup used in a study of an example implementation of the present disclosure.

[0146] FIG. 10B illustrates an example implementation including a tag including an antenna and photodiode, used in a study of an example implementation of the present disclosure. FIG. 10C illustrates a transceiver configured to read the tag of FIG. 10B, according to a study of an example implementation of the present disclosure.

[0147] Light Source. To accurately evaluate different parameters that affect LightThief, the study employed lasers as the light sources for controlled experiments. In the latter evaluation andapplications, the study used the most common lighting fixtures, such as LED and lamps, as the light sources.

[0148] As shown in FIG. 22, the study selected laser diodes (LDs) with -wavelengths corresponding to four different colors, which can cover most of the wavelength range used for OWC. To precisely control the light power incident on LightThief, the study uses a Thorlabs LDC205C laser current controller to provide a constant current for LDs and use a function generator Tektronix AFG1062 to modulate the controller to emulate OOK modulation. As described herein, since OOK encoded by Manchester code is essentially a square wave, the function generator can continuously modulate the controller with a square wave. The study selected the optical clock rate in IEEE Std 802.15.7 PHY V Mode 3 (4.4kHz) as the square wave frequency.

[0149] The study fixed the distance dphbetween the LD and LightThief and tune the incident light power with the controller to emulate the obscuration level. The study used the Thorlabs S130C PD power sensor to measure the incident light power. FIG. 11 shows the diode current vs. incident light power curves. The horizontal axis is the incident light power ranging from 10μW to 5000 μW, emulating the real-world light intensity'. Since the 3 dB bandwidth of the current controller is DC to 150 kHz based on a small signal, the output laser waveform may be distorted at the optical clock rate. Therefore, the study used a 2 GHz free space photo-detector with 400 ~ 1100 nm Thorlabs DET025A / M to observe the laser waveform. FIG. 12 shows the comparison of diode current waveform and incident laser waveform. Compared with the square wave from diode current, the laser waveform has some amount of distortion and is still acceptable to realize the OOK modulation.

[0150] RF Transmitter. LightThief's antenna can pick up RF signals in FM band ( 87,5 ~ 108.0MHz ) and license-free band ( 902 ~ 928MHz ). To prove the basic concept of passive optic-to-RF conversion, the study used USRP B210 to create CWs at 108 MHz and 915 MHz. As shown in FIG. 10A, the study fixed the distance dtbetween the transmitting antenna and LightThief at 3.28 ft.

[0151] LightThief Tag. The study implement four LightThieftags, each with a different PD to compare the effect of the responsivity 7?^. As shown in FIG. 22, although the sensiti vity wavelength ranges overlap, the responsivity differs from each other.

[0152] In this experiment, the study presents how LightThief leverages the frequency shift to avoid the self-interference. The RF transmitter transmits a CW with a central frequency fc.LightThief reflects the CW under laser irradiation. The laser is modulated using a square wave at an optical clock rate. FIG. 13 shows the FFT spectrum of the received RF signals at the receiver, LightThief creates reflected RF signals (the side marks) on both sides of the transmitting CW (the center mark). The reflected signals are copies of CW with the same modulation information as the laser (i.e., OWC data). The study shows that the minimum frequency gap between reflected RF signals and CW is 4.4 kHz, i.e., the optical clock rate. The minimum frequency gap among reflected RF signals is 8.8 kHz. Therefore, the attacker can demodulate the reflected RF signals to obtain the OWC data without self-interference.

[0153] LightThief realizes frequency shift. When the laser modulated by square waves changes the impedance of LightThief's antenna to reflect the RF signals, it essentially uses a square wave with the phase of 0 or n to modulate the phase of incoming RF signals

[0028] , The study used θnto represent the phase of each square wave. As described in Sec. 3.2, the phase of a square wave represents the transmitted OWC data bit. If the transmitted bit is ' 1 ' or ' 0 ', the phase is 0 or π, respectively. A square wave can be represented using Fourier series as follows

[0013] :COSsq(ω; θn) = 0.5 cos(2πmf0t + θn) (7)571=1, 3, 5...odd

[0154] Where, fois the square wave frequency, i.e., optical clock rate. The study assumes the transmitting CW as sin (2πfct). The reflected RF signal can be calculated by multiplying the CW and the harmonics of a square wave

[0048] :

[0155] From Eqn. 8, the reflected RF signals Srare shifted fc± m f0(m = 1,3,5 odd) away from the center frequency of the incoming CW, avoiding self-interference. Therefore, the reflected RF signals are at ±4.4kHz ( m = 1 ), ±13.2kHz(m = 3), and ±22kHz(m = 5) in FIG. 13. More importantly, the phase θnrepresenting OWC data is embedded into the reflectedRF signals. Since 0nis the only unknown value in Eqn. 8 and has only two states, it is easy for the attacker to demodulate the reflected RF signal to obtain θn.

[0156] The effect of the RF center frequency on the received signal strength is shown in FIGS.14A-14D. When the peak sensitivity wavelength of the PD is close to the peak wavelength of the LD, the received signal strength increases with the increase of the incident light power.Contrasting with FIG. 14A and 14Bb, FIG. 14D and 14C show LightThief implemented with the infrared and red PDs can create higher received signal strength even the incident light power is lower than 100g W. Specifically, when the incident light power increases from 10g W to 1000g W, the received signal strength increases. While the incident light power keeps increasing to 5000,u W, the corresponding received signal strengths are slightly decreasing. As shown, the received signal strengths range from —88 ~ —70 dB as long as the incident light power is higher than 100g W, which is sufficient for the attacker to eavesdrop on OWC outside the room.

[0157] Responsivity. Because of the overlapping responsivity, the PD can sense light in the adjacent spectrum. The closer the peak wavelength of the LD is to the peak sensitive wavelength of the PD, the stronger the received signal strength and vice versa. The study shows the effect of the responsivity for a blue PD in FIG 15A, with other responsivities plotted in FIGS. 15B-15D. Since the spectrums of blue and green light are close to each other, LightThief can reflect RF signals using a blue PD under the green LD irradiation. The corresponding signal strength is as high as -83 dB when the incident LD power reaches 5000g W. However, since the minimum emitted wavelengths of the red or infrared LD (640 and 840 nm ) are even greater than the maximum sensitive wavelength of the blue PD ( 460 nm ), the reflected signal strength under the irradiation from the red or infrared LD is lower than the noise floor ( -90 dB ).

[0158] Similarly, a PD with a larger sensitive area and wavelength range can help an attacker obtain a stronger received signal strength. As shown in FIG. 15C, LightThief with the red PD can reflect RF signals under the irradiation of a shorter wavelength LD (i.e., blue and green) and a longer wavelength LD (i.e., infrared). When the incident power reaches 5000 μW, the corresponding received signal strengths for the blue and infrared LD are -70 dB and -82 dB, respectively.

[0159] Therefore, to effectively reflect the RF signals, the example implementation can i) utilize the PD with the peak sensitivity wavelength closest to the strongest energy spectrum ofthe light source; ii) place LightThief with small sensitive-area PDs closer to the light source than that with large sensitive-area PDs.

[0160] Effect of Source-to-Light Thief Distance

[0161] The incident light power increases as the distance from the light source to LightThief decreases and vice versa. Therefore, the analysis of the effect of the source-to-LightThief distance is equivalent to analyzing the effect of the incident light power. As shown in FIGS. 14A-14D and 15 A- 15D, the received signal strength increases as the incident light power increases. Since the incident light power is negatively correlated with the source-to-LightThief distance, deploying LightThief close to the light source can increase the eavesdropping range.

[0162] PD Choice. As described herein, the attacker can use the PD with the peak sensitivity wavelength closest to the strongest energy spectrum of the light source. However, the LED light seen by humans, often perceived as white, comprises a multitude of wavelengths. An approach to generate white light is to incorporate phosphor in the body of a blue LED. Some of the blue light will be converted to yellow light by the phosphor. The remaining blue light, when mixed with the yellow light, results in white light. By making slight changes to the phosphor chemistry, manufacturers can alter the peak wavelength of a white LED. FIG. 16 shows typical cool and warm LEDs’ spectral power distributions (SPDs). A cool white LED with a peak wavelength is around 450 nm and a warm white LED with a peak wavelength around 650 nm. Therefore, LightThief uses dual optic wavelength technology to detect optical signals (e.g., OWC signals). The example tag used in the study integrates a blue PD (MTPD4400D) and a red PD (PDB-C156), which can sense most of LEDs.

[0163] RF Signal Choice. From the analysis herein, LightThief can reflect CW in FM band or license-free band ( 902 ~ 928MHz ). Since the opaque objects absorb a portion of RF signal energy as the signal passes through them, the example implementation can take advantage of a lower center frequency (FM band) to conduct the eavesdropping because its long wavelength tends to suffer less signal absorption.

[0164] RF Signal Demodulation

[0165] As described herein, the reflected RF signal is fundamentally a BPSK signal generated by the multiplication of a continuous wave (CW) and square waves with two distinct phases ( 0and n ). In order to recover the OWC data, the study uses signal processing techniques associated with BPSK demodulation [12,25], Initially, the example implementation can down-convert the signal to baseband using a quadrature down-conversion mixer, focusing on the first harmonic frequency, i.e., fc+ fo. Following this, the example implementation can eliminate the DC offset and apply a low-pass filter to reduce high-frequency noise and unwanted components in the signal. The example implementation can then employ the timing recovery method to accurately recover the symbol clock, which helps to identify the correct sampling points. During the symbol detection stage, the example implementation can estimate and correct the signal's phase and amplitude to improve the accuracy of the recovered data. Next, the example implementation can perform a cross-correlation analysis on the recovered data with the preamble codes to establish frame synchronization. Once the frame sync pulses have been identified, the example implementation can proceed to recover the OWC data while parsing the frame structure. This comprehensive approach ensures a more accurate and reliable recovery of the OWC data under various conditions, taking into account factors such as noise, interference, and signal distortion that might affect the data recovery process.

[0166] COTS OWC Device. To validate the effectiveness of LightThiefs eavesdropping capabilities, the study conducted experiments using a COTS OWC device, (i.e., HCCLS2023ODC [1]), in the example experimental setup. This device is considered ideal for providing secure, non-radio frequency wireless links in highly sensitive areas, effectively handling confidential information, and ensuring the integrity of critical communications [2],

[0167] The study used a COTS OWC device (HCCLS2023ODC), including a OWC transmitter and an OWC receiver to test the example implementation.

[0168] (1) OWC Transmitter. As shown in FIG. 17 A and FIG. 17B, the OWC transmitter comprises an LED lamp and an LED driver, respectively. The white LED lamp's power rating is 40 W and its size is 30 cm by 1 cm. The LED driver converts AC current into a constant current suitable for powering the LED. By controlling the current converter, the driver can employ OOK modulation to regulate the light intensity of the LED, allowing for simultaneous communication and illumination. By using UART communication software, the driver can set the physical layer transmission data rate to four different rates: 400kbps, 300kbps, 200kbps, and 100 kbps. Specifically, it goes through the following three steps: i) it converts thetransmitted data into 8-bit ASCII codes; ii) it transforms the 8 -bit ASCII codes into 12-bit Hamming codes and 1 -bit parity check code for error detection and correction; and iii) it converts the 13 -bit codes into 26-bit Manchester codes to ensure balanced lightness. To facilitate packet detection and synchronization, each packet consists of a 10-bit preamble with a fixed patern of "1111000010”.

[0169] (2) OWC Receiver. As shown in FIG. 17C, the OWC receiver can be powered by a USB interface, which is a 5 V DC power supply or a 5 V battery for mobile applications. The Power consumption of the receiver is less than 1 W. The OWC receiver contains a 3.7 mm by 3.7 mm photosensitive sensor, which is capable of detecting light wavelengths between 320 and 1050 nm. Same as the transmitter, the receiver also provides the UART interface. The receiver achieves a communication rate of approximately 400 kbps within a 2 -meter communication distance and a 1.5 -meter communication coverage diameter. While this confined coverage area restricts the communication range, it guarantees that the emitted light does not disrupt other ongoing optical communication systems, thus maintaining a reliable communication channel. Experiment Setup. The study performed the experiment in an office setting, simulating a real-world scenario, and established two separate communication links: one between the OWC transmitter and receiver, and another between LightThief and the attacker’s receiver.(1) Victim. The study established communication between the OWC transmitter and receiver. Using the UART interface, the study sent commands to the transmitter to control the data rate for various experimental scenarios. The performance of the communication link was then evaluated. This process provides baseline information, such as the limitations of communication distances and angles for OWC, allowing us to effectively assess the performance of LightThief. (2) Attacker. As shown in FIG. 17D, LightThief was placed on a desktop within a cubicle. To adjust the eavesdropping distance and angle, the study modified the distance between the lamp and the desktop, as well as the position of LightThief on the desktop. When the LED directly illuminates LightThief, the distance between the LED and LightThief is denoted as d_ph and the angle is 0 degrees. By changing the position of LightThief along a circular path with a radius r around a central point, the study can adjust the angle θ, which can be calculated as arctan(r / d_ph). The study can evaluate the eavesdropping performance at different positions with factors including signal strength, data rate, and reliability.

[0170] (3) Barriers. The study used two types of walls as barriers to evaluate the performance of LightThief under various conditions. The first type is an office partition wall, commonly used to divide workspace areas, while the second type is room drywall, typically found in residential and commercial buildings. These walls differ in material composition and structure, which allows us to assess the effectiveness of LightThief in different scenarios.

[0171] Since there may be particle diffusion in the victim's room, such as mist or smoke, the study also evaluated the impact of the particle diffusion on eavesdropping. The study emulated particle diffusion using mist created by a humidifier. To control the particle concentration, the LED, LightThief and the humidifier are placed in a cubicle. After the mist is sprayed from the humidifier, it spreads between the LED and LightThief.

[0172] The study comprehensively evaluated LightThief's performance across a range of scenarios and settings. Initially, the study investigated the detected signal strength on the attacker's side, taking into account various LED-to-LightThief and LightThief-to-attacker distances. The study proceeded to decode the received signal, disassemble the packet, and compute the bit error rate to verify the effectiveness of LightThief. Subsequently, the study considered the influence of multiple factors on eavesdropping performance, including the data rates, light source angle, and particle diffusion.

[0173] The study demonstrated LightThief's performance in smuggling OWC data through various opaque objects, considering different LED-to-LightThief and LightThief-to-attacker distances. These experiments are conducted with the LED light directly illuminating the LightThief. For these experiments, the study set the OWC data rate to 400 kbps.

[0174] FIG. 18A demonstrates the signal strength detected by the attacker when an office partition wall is positioned between the LightThief and the attacker. As the distance from LightThief to the attacker grows, the detected signal strength diminishes. However, even when the LightThief-to-attacker distance reaches approximately 10 m, the detected signal strength maintains a level above -80 dB. This ensures that the attacker can effectively eavesdrop on the communication while minimizing exposure risk.

[0175] Furthermore, when the LED-to-LightThief distance ( dph) extends from 0.2 to 0.6 m, the detected signal strength declines due to the reduction in incident light power. It is worthnoting that the OWC device itself only supports a communication range of up to 2 m, which subsequently limits the LED-to-LightThief distance.

[0176] FIG. 18B presents a similar trend in the reflected signal strength when room dry wall is placed in between. LightThief exhibits better performance in environments with office partition walls compared to those with room dry walls. This is attributed to the thinner structure and lower electromagnetic signal absorption properties of partition walls. From these experiments, increasing the signal strength can be achieved by reducing either the LED-to-LightThiefdistance or the LightThief-to-attacker distance. To effectively eavesdrop on OWC while remaining covert, an attacker can decrease the LED-to-LightThief distance, thereby allowing for an increased LightThief-to-attacker distance.

[0177] FIG. 19A demonstrates the eavesdropping performance at a LightThief-to-attacker distance of 10 m. As observed from the left figure, the attack with an office partition wall in between exhibits the best performance. At a data rate of 400 kbps, the BER is around 0.1%, indicating that the proposed attack method can effectively eavesdrop on OWC systems with high data rates.

[0178] The BER reduces when the data rate increases. This can be attributed to the fact that the maximum data rate of 400 kbps approaches the response limit of the LED. As the optical clock rate increases, the time allocated for powering the LED decreases, leading to a reduced response time for the LED to reach its maximum brightness. Consequently, when the optical clock rate approaches or falls below the response time, the LED cannot achieve its highest brightness, resulting in a lower light intensity entering the LightThief.

[0179] The study also assessed the throughput at the attacker's receiver under varying data rates. As illustrated in FIG. 19B, the throughput rises as the data rates of the OWC transmitter increase, closely approaching the data rates themselves. It's worth noting that LightThief has a straightforward design, consisting of only two passive analog components: an antenna and a photodiode. With the photodiode's response speed exceeding MHz, LightThief is well-equipped to eavesdrop on communication with higher data rates.

[0180] Impact of Light Source Angle. In this experiment, the study altered the position of LightThief along a circular path with a radius r around the central point of the LED light spot on the desktop (shown in FIG. 17D). The study maintained the LED-to-LightThief distance at 0.2 m, enabling us to adjust the angle θ. The study measured the reflected signal strength to evaluate the impact of the light source angle. The study observed that the light intensity is not uniformly distributed around the circle's center. As illustrated in FIG. 20, to obtain the same light intensity, measurements must be taken at varying radii from the center.

[0181] The uneven light intensity distribution can be attributed to the arrangement of multiple LEDs in the COTS LED lamp. These LEDs are placed in a radial pattern, and when they have non-identical characteristics such as brightness, beam angle, or color temperature, they can cause uneven light distribution when illuminated simultaneously. Manufacturing tolerances and the aging of individual LEDs can also result in slight performance differences. When combined in a single lighting fixture, these discrepancies can lead to an irregular light distribution pattern, as seen in the experiment. Although a white LED diffuser helps distribute the light more evenly, its effectiveness is limited.

[0182] The maximum radius LightThief can reach corresponds to an angle of 11 degrees, while the OWC device supports up to 20 degrees. Consequently, LightThief can utilize up to 48% of the available illumination range.

[0183] Impact of Particle Diffusion. The study set the optical clock rate of the OWC transmitter to 400 kbps and the LED-to-LightThief distance to 0.6 m with an office partition wall in between. The study turned on the humidifier and adjust the reflected signal strength to the same value as the previous experiment. A Thorlabs S130C PD power sensor is placed close to LightThief to measure the incident light power.

[0184] FIG. 21 shows the impact of the particle diffusion on reflected RF signal strength. As shown, the average reflected RF signal strength is reduced compared to the performance without particle diffusion shown in FIG. 18 A. This is because the particles tend to absorb and scatter light, disturbing the light environment. As a result, the incident light power reduces, lowering the reflected RF signal strength. As shown in FIG. 21, the detected signal strength with particle diffusion is around 5 dB lower than that without particle diffusion. The study set the threshold value as -83. Since particle diffusion is a slow process, the study combined the rate of change in the received signal strength and the threshold to ensure detection accuracy.

[0185] Defense Strategies. The present disclosure includes strategies to defend against the implementations of the present disclosure.

[0186] Light Source-Based Approach. Reducing the light scattering angle of the OWC product can serve as a defense against LightThief. Light Thiefcan exploit up to 48% of the illumination area. However, if the OWC product's scattering angle were even smaller, the available space to deploy LightThief would be extremely limited, even when taking advantage of the 48% area. If LightThief is placed between the LED and the OWC receiver, LightThief will block the light signal before it reaches the OWC receiver. Therefore, the OWC receiver cannot receive the photoelectric signal, which exposes the eavesdropping. Therefore, a highly directional light source, such as directional spotlight LED, can be used to conduct OWC and avoid being detected by LightThief. However, it is not suitable for free-space optics because they also need to illuminate the entire room.

[0187] Physical Barrier-Based Approach. It is possible to use a Faraday Cage to shield the reflected RF signals penetrating through walls from inside the room. However, completely enclosing a room with a Faraday Cage may not be practical. For example, the victim cannot receive the RF signals from outside the room anymore, such as FM radio and LTE. A more feasible approach is to apply electromagnetic shielding material to thinner walls or to the wall where the attacker is most likely to be hiding. This material can effectively block the transmission of RF signals, preventing the attacker from eavesdropping on the OWC communication while maintaining a more reasonable level of practicality in implementation.

[0188] RF Medium-Based Approach. Victims can actively create RF interference to defend against LightThief s eavesdropping. To improve the efficiency of LightThief, attackers choose clean frequency bands to transmit their continuous wave (CW), ensuring that the reflected RF signal also falls within a clean frequency band. This is easily achievable, as there are many vacant frequency bands within the RF spectrum. However, victims can proactively generate RF noise within these vacant bands, raising the noise floor without interfering with others' legitimate RF signals. This approach can effectively disrupt the attacker's eavesdropping while minimizing any negative impact on other users in the spectrum.

[0189] Encryption. Since the proposed eavesdropping captures optical signals in the physical layer, once the data is encrypted at a higher layer, the attackers cannot decode meaningful data from the raw signal.

[0190] Higher Data Rates. LightThief can eavesdrop on communication with high data rates. This is because LightThief has a design using passive analog components: an antenna and a one or more photodiodes. The photodiode can have a response speed exceeding MHz, enabling LightThief to sense data rates of multiple megabits per second. However, the attack scenario focuses on OWC systems that deliver both illumination and communication. Due to the high-power nature of illumination systems, achieving MHz-level optical clock rates is challenging. The OWC product used in the study is a COTS OWC product with a moderate illumination power of 40 W. Moreover, the evaluation results demonstrate that the throughput of LightThief is closely approaching the data rates of the targeted OWC product. Ambient Light Interference. It is possible for LightThief to eavesdrop in the presence of strong ambient light. Because the ambient light is also essentially noise for OWC, OWC needs to choose a specific wavelength to increase the SNR. LightThief can eavesdrop by selecting PDs with a similar peak wavelength. However, the performance of LightThief working in strong ambient light is bound to degrade.

[0191] By transferring OWC's OOK modulation onto a sine wave, LightThief essentially creates a BPSK RF signal. Thus, implementations of the present disclosure can use any BPSK processing techniques including modulation, demodulation, and self-interference avoidance techniques.

[0192] The example implementation includes a battery-free optical-based eavesdropping, LightThief, which directly transfers OWC data to RF signals without requiring complex circuits and power consumption, making OWC vulnerable to eavesdropping by attackers outside the room. The structure and deployment of LightThief can be exceptionally simple, and can boasts high sensitivity, longevity, ease of disguise, and near-zero maintenance. The study demonstrates the effecti veness of the example approach by building a LightThief prototype and conducting extensive evaluations on commercial OWC products under various real-world settings. The study shows that LightThief can successfully eavesdrop on OWC through physical room boundaries such as walls, emphasizing the need for enhanced security measures in OWC systems.

[0193] Disclosed are components that can be used to perform the disclosed methods and systems. These and other components are disclosed herein, and it is understood that when combinations, subsets, interactions, groups, etc. of these components are disclosed that while specific reference of each various individual and collective combinations and permutation ofthese may not be explicitly disclosed, each is specifically contemplated and described herein, for all methods and systems. This applies to all aspects of this application including, but not limited to, steps in disclosed methods. Thus, if there are a variety of additional steps that can be performed it is understood that each of these additional steps can be performed with any specific implementation or combination of implementations of the disclosed methods.

[0194] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above.Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0195] References

[0196] [1] Broad coverage visible light communication system.http: / / www.hccltech.com / products-detail / i-50.html.[2] Commercial application of hccltech communication. http: / / www.hccltech.com / application-detail / i-69 / .[3] Dipole antenna, https: / / en.wikipedia.org / wiki / Dipole_antenna.[4] IEC 1000-3-5, electromagnetic compatibility, part 3: Lim-its-section 5: Limitation of voltage fluctuations and flicker in low-voltage power supply systems for equipment with rated current greater than 16 a.1994.[5] IEC EN 61000-3-3, electromagnetic compatibility (emc) part 3: Limits-section 3: Limitation of voltage fluctuations and flicker in low voltage supply systems for equipment with rated current 16 a and smaller, international electrotechnical commission, 1994.[6] IEC / TS 61000-3-5, ed. 2.0b, cor.2:2010, corrigendum 2-electromagnetic compatibility (EMC)-part 3-5: Limits-limitation of voltage fluctuations and flicker in low-voltage power supply systems for equipment with rated current greater than 75 a.[7] https: / / www.microchip.com / developmenttools / ProductDetails / PartNO / ADM00641.[8] https: / / www.mordorintelligence.com / industry-reports / visible-light-communication-market.[9] IEEE standard for local and metropolitan area networks part 15.7: Short-range optical wireless communications. IEEE Std 802.15.7-2018 (Revision of IEEE Std 802.15.7-2011) (2019).

[0010] Bharadia, D., Joshi, K. R., Kotaru, M., and Katti, S. Backfi: High throughput wifibackscatter. In ACM SIGCOMM (2015).

[0011] Chi, Z., Li, Y., Liu, X., Wang, W., Yao, Y., Zhu, T., and Zhang, Y. Countering crosstechnology jamming attack. In ACM WiSec (2020).

[0012] Chi, Z., Li, Y., Liu, X., Yao, Y., Zhang, Y., and ZHU, T. Parallel inclusive communication for connecting heterogeneous tot devices at the edge. In ACM SenSys (2019).

[0013] Chi, Z., Liu, X., Wang, W., Yao, Y., and Zhu, T. Leveraging ambient Ite traffic for ubiquitous passive communication. In ACM SIGCOMM (2020).

[0014] Chi, Z., Yao, Y., Xie, T., Liu, X., Huang, Z., Wang, W., and Zhu, T. Ear: Exploiting uncontrollable ambient rf signals in heterogeneous networks for gesture recognition. In ACM SenSys (2018).

[0015] Cui, M., Feng, Y., Wang, Q., and Xiong, J. Sniffing visible light communication through walls. In ACM MobiCom (2020).

[0016] FCC. Permitted forms of low power broadcast operation, "public notice 14089".

[0017] Galisteo, A., Varshney, A., and Giustiniano, D. Two to tango: Hybrid light and backscatter networks for next billion devices. In ACM MobiSys (2020).

[0018] Ghiasi, S. K., Zamalloa, M. A. Z., and Langendoen, K. A principled design for passive light communication. In ACM MobiCom (2021).

[0019] Giustiniano, D., Varshney, A., and Voigt, T. Connecting battery-free IoT tags using led bulbs. In ACM HotNets (2018).

[0020] Gummeson, J., Mccann, J., Yang, C. J., Ranasinghe, D., Hudson, S., and Sample, A. Rfid light bulb: Enabling ubiquitous deployment of interactive rfid systems.

[0021] Hatamian, M., and Bowen, E. G. Homenet: A broadband voice / data / video network on catv systems. AT T Technical Journal (1985).

[0022] Kellogg, B., Parks, A., Gollakota, S., Smith, J. R., and Wetherall, D. Wi-fi backscatter: Internet connectivity for rf-powered devices. In ACM SIGCOMM (2014).

[0023] Kellogg, B., Talla, V., Gollakota, S., and Smith, J. R. Passive wi-fi: Bringing low power to wi-fi transmissions. In USENIX NSDI (2016).

[0024] Koonen, T., Mekonnen, K. A., Cao, Z., Huijskens, F., Pham, N. Q., and Tangdiongga, E. Beam-steered optical wireless communication for industry 4.0. IEEE Journal of Selected Topics in Quantum Electronics (2021).

[0025] Li, Y., Chi, Z., Liu, X., and Zhu, T. Chiron: Concurrent high throughput communication foriot devices. In ACM MobiSys (2018).

[0026] Li, Y., Chi, Z., Liu, X., and Zhu, T. Passive-zigbee: Enabling zigbee communication in lot networks with 1000% + less power consumption. In ACM SenSys (2018).

[0027] Liu, V., Parks, A., Talla, V., Gollakota, S., Wetherall, D., and Smith, J. R. Ambient backscatter: Wireless communication out of thin air. In ACM SIGCOMM (2013).

[0028] Liu, X., Chi, Z., Wang, W., Yao, Y., Hao, P., and Zhu, T. Verification and redesign of ofdm backscatter. In USENIX NSDI (2021).

[0029] Liu, X., Chi, Z., Wang, W., Yao, Y., and Zhu, T. Vmscatter: A versatile mirno backscatter. In USENIX NSDI (2020).

[0030] Manie, Y. C., Yao, C.-K., Yeh, T.-Y., Teng, Y.-C., and Peng, P.-C. Laser-based optical wireless communications for internet of things (iot) application. IEEE Internet of Things Journal (2022).

[0031] Mir, M. S., Guzman, B. G., Varshney, A., and Giustiniano, D. PassiveLiFi: Rethinking LiFi for low-power and long range RF backscatter. In ACM MobiCom (2021).

[0032] [N. D.]. Manchester code. https: / / en. wikipedia. org / wiki / Manchester_code.

[0033] [N. D.]. Xlamp xm-12 leds. https: / / cree-led.com / media / documents / XLampXML2.pdf.

[0034] Nikitin, P., and Rao, K. Theory and measurement of backscattering from rfid tags. IEEE Antennas and Propagation Magazine (2006).

[0035] Sugawara, T., Cyr, B., Rampazzi, S., Genkin, D., and Fu, K. Light commands: Laser-based audio injection attacks on voice-controllable systems. In USENIX Security (2020).

[0036] Theremin, L. The thing (also known as the great seal bug). https: / / en.wikipedia. Org / w / index.php? title=The Thing (listening device) &oldid= 1043635720.

[0037] Tsonev, D., Videv, S., and Haas, H. Light fidelity (Li-Fi): towards all-optical networking. In Broadband Access Communication Technologies VIII (2014), International Society for Optics and Photonics, SPIE.

[0038] Wang, A., Iyer, V., Talla, V., Smith, J. R., and Gollakota, S. Fm backscatter: Enabling connected cities and smart fabrics. In USENIX NSDI (2017).

[0039] Wang, K., Nirmalathas, A., Lim, C., and Skafidas, E. High-speed optical wireless communication system for indoor applications. IEEE Photonics Technology Letters (2011),

[0040] Wang, Q., Giustiniano, D., and Puccinelli, D. An open source research platform for embedded visible light networking. IEEE Wireless Communications (2015).

[0041] Wang, W., Liu, X., Yao, Y., Pan, Y., Chi, Z., and Zhu, T. Crf: Coexistent routing and flooding using wifi packets in heterogeneous iot networks. In IEEE INFOCOM (2019).

[0042] Wang, W., Liu, X., Yao, Y., and Zhu, T. Exploiting wifi ap for simultaneous data dissemination among wifi and zigbee devices. In IEEE ICNP (2021).

[0043] Wang, W., Xie, T., Liu, X., and Zhu, T. Ect: Exploiting cross-technology concurrent transmission for reducing packet delivery delay in iot networks. In IEEE INFOCOM (2018).

[0044] Wang, W., Yao, Y., Liu, X., Li, X., Hao, P., and ZHU, T. I can see the light: Attacks on autonomous vehicles using invisible lights. In ACM CCS (2021).

[0045] Wu, Y., Wang, P., Xu, K., Feng, L., and Xu, C. Turboboosting visible light backscatter communication. In ACM SIGCOMM (2020).

[0046] Xu, X., Shen, Y., Yang, J., Xu, C., Shen, G., Chen, G., And NI, Y. Passivevic: Enabling practical visible light backscatter communication for battery-free iot applications. In ACM MobiCom (2017).

[0047] Yao, Y., Li, Y., Liu, X., Chi, Z., Wang, W., Xie, T., AND ZHU, T. Aegis: An interference-negligible rf sensing shield. In IEEE INFOCOM (2018).

[0048] Zhang, P., Bharadia, D., Joshi, K., and Katti, S. Hitchhike: Practical backscatter using commodity wifi. In ACM SenSys (2016).

[0049] Zhang, P., Josephson, C., Bharadia, D., and Katti, S. Freerider: Backscatter communication using commodity radios. In ACM CoNEXT (2017).

[0050] Zhao, J., Gong, W., and Liu, J. Spatial stream backscatter using commodity wifi. In ACM MobiSys (2018).

[0051] Zhao, J., Gong, W., and Liu, J. X-tandem: Towards multi-hop backscatter communication with commodity wifi. In ACM MobiCom (2018).

Claims

1. WHAT IS CLAIMED IS:

1. A device comprising:3.an antenna configured to reflect RF signals;4.a photodiode coupled to the antenna, wherein the photodiode is configured to modulate reflected RF signals from the antenna by switching the antenna between a low reflection state and a high reflection state.

2. The device of claim 1, wherein the antenna is directly soldered to the photodiode3. The device of claim 1, wherein the antenna is coupled to the photodiode without an intervening active component.

4. The device of claim 1, wherein the photodiode is configured to change impedance based on an intensity of incident light on the photodiode.

5. The device of claim 4, wherein the photodiode is configured with a reverse bias voltage6. The device of claim 4, wherein the photodiode is configured with a forward bias voltage.

7. The device of claim 1, wherein the antenna and photodiode are configured to operate without an external power source.

8. The device of claim 1, wherein the antenna is a dipole antenna.

9. The device of claim 1, further comprising a plurality of photodiodes coupled in parallel, wherein each photodiode of the plurality of photodiodes has a different peak responsivity wavelength.

10. A surveillance system comprising:14.an antenna configured to reflect an RF signal;15.a photodiode coupled to the antenna, wherein the photodiode is configured to receive an optical-wireless communication signal, and wherein the photodiode is configured to output a modulated backscattered RF signal by the antenna by switching the antenna between a low reflection state and a high reflection state.; and16.a transceiver comprising: an RF transmiter configured to transmit the RF signal; and a receiver configured to receive the modulated backscattered RF signal, and wherein the modulated backscatered RF signal comprises a frame of optical-wireless communication data of the optical- ireless signal.

11. The surveillance system of claim 10, wherein the receiver is further configured to recover the frame of optical- wireless communication data by demodulating the modulated backscattered RF signal.

12. The surveillance system of claim 10, wherein the antenna is coupled to the photodiode without an intervening active component.

13. The surveillance system of claim 10, wherein the photodiode is configured to change impedance based on an intensity of incident light on the photodiode.

14. The surveillance system of claim 10, wherein the antenna and photodiode are configured to operate without an external power source.

15. The surveillance system of claim 10, wherein the antenna is a dipole antenna.

16. The surveillance system of claim 10, further comprising a plurality of photodiodes coupled in parallel, wherein each photodiode of the plurality of photodiodes has a different peak responsivity wavelength.

17. A method of surveilling an OWC signal comprising:24.providing an antenna and a photodiode configured to modulate a signal reflected by the antenna;25.determining a center frequency of a predetermined radio frequency (RF) band; transmitting a continuous wave (CW) at the center frequency at the antenna to receive a reflected signal; and processing the reflected signal to recover data transmited by an optical- wireless communications source.

18. The method of claim 17, wherein the predetermined RF band is between 902 and 928 MHz.

19. The method of claim 17, wherein the reflected signal is a BPSK signal that results from a multiplication of the continuous wave (CW) and square waves with two distinct phases (0 and rr).

20. The method of claim 17, wherein the processing comprises:29.down-converting the reflected signal to baseband using a quadrature down-conversion mixer, focusing on a first harmonic frequency, i.e., fc + fo;30.eliminating a DC offset;31.applying a low-pass filter to reduce high-frequency noise and unwanted components in the reflected signal;32.employing a timing recovery' method to accurately recover a symbol clock to identify sampling points;33.estimating and correcting a phase of the refl ected signal and an amplitude of the reflected signal during a symbol detection stage;34.performing a cross-correlation analysis on recovered data with preamble codes to establish frame synchronization; and35.recovering the data while parsing a frame structure of the optical- wireless36.comm un ications source.

Images