计算机科学与技术（参考文献）Probing into the Physical Layer - Moving Tag Detection for Large-Scale RFID Systems

This article has been accepted for publication in a future issue of this journal,but has not been fully edited.Content may change prior to final publication.Citation information:DOI 10.1109/TMC.2019.2907244.IEEE Transactions on Mobile Computing Probing into the Physical Layer:Moving Tag Detection for Large-Scale RFID Systems Chuyu Wang,Student Member,IEEE,Lei Xie,Member,IEEE,Wei Wang,Member,IEEE, Yingying Chen,Senior Member,IEEE,Tao Xue,and Sanglu Lu,Member,IEEE Abstract-Logistics monitoring is a fundamental application that utilizes RFID systems to manage numerous tagged-objects.Due to the frequent rearrangement of tagged-objects,a fast RFID-based tracking approach is highly desired for accurate logistics distribution. However,traditional RFID systems usually take tens of seconds to interrogate hundreds of RFID tags,not to mention the time delay involved to locate all the tags,which severely prevents from in-time tracking.To address this issue,we reduce the problem domain by first distinguishing the motion status of the tagged-objects,i.e.."stationary"or"moving",and then tracking the moving objects with the state-of-the-art localization schemes,which significantly reduces the efforts of tracking all the objects.Toward this end,we propose a moving tag detection mechanism,which achieves the time efficiency by exploiting the useless collision signal in RFID systems.In particular,we extract two kinds of physical-layer features(namely phase profile and backscatter link frequency)from the collision signal received by the USRP to distinguish tags at different positions.We further develop the Graph Matching(GM)method and Coherent Phase Variance(CPV)method to detect the moving tagged-objects.Experiment results show that our approach can accurately detect the moving objects while reducing 80%inventory time compared with the state-of-art solutions. Index Terms-RFID,Collision Decoding,Tag Inventory 1 INTRODUCTION WimdutryD.ml h -300 Decode collision signal 3600 in I-Q plane ployed in increasingly large numbers to facilitate the smart 3800 management.For example,in the logistic monitoring,there are usually more than hundreds of objects attached with 200 RFID tags in the monitoring area.Due to the frequent 400 Recovery rearrangement of the tagged-objects,the RFID systems are 4500 500 4 )e)1 Inphase required to track the movement of all tags timely to prevent Backscatter link frequency Phase profiles extraction the target objects from mistakenly rearranging.However, extraction a Commercial-Of-The-Shelf (COTS)RFID system usually Fig.1.Illusion of extracting physical-layer features from collision signal. takes tens of seconds to interrogate hundreds of RFID based schemes 3-5,14]leverage the Frame-Slotted- tags [1],[2],not to mention the time delay to track all the Aloha (FSA)protocol to identify the tags,which usually tags.This severely hinders the system from tracking the takes tens of seconds to interrogate hundreds of RFID tags in movement of tagged-objects in time.Since only some of the real RFID systems.The main cause of such time inefficiency objects are moved at a certain moment,to reduce the efforts is the waste of the collision slots,which usually occupy a of tracking all the objects,one possible solution is to first large proportion of the overall time slots.Recently,some identify the motion status of the objects,i.e.,"stationary"or emerging work try to make use of the collision slots to "moving",and then only track the"moving"objects.For the improve time efficiency of tag inventory [6]-[9]and further stationary"objects,since they are presumed to be statically detect the missing tags from the collision signals [3],[10]. placed in a specific location,we do not need to track them. However,different from a missing tag,a moving tag can For the "moving"objects,we can leverage the existing still be interrogated by the reader,thus these methods localization techniques to track them.Since the "moving" are not suitable to detect the moving tags.In addition, objects only occupy a small part of the total number,we can for the positioning schemes,the state-of-the-art localization save a lot of time by only focusing on tracking the moving schemes [11]-[13]usually locate the tags one by one,and objects,instead of wasting time in tracking the stationary they usually take up to several hundreds of milliseconds to objects,which makes it possible to perform the fast large- locate a unique tag.Therefore,it is difficult to concurrently scale monitoring. locate all tags timely using existing solutions,when dealing To track the moving tags in the monitoring area,exist- with hundreds of tags. ing studies [3]-[14]usually involve two steps,i.e.,a fast In this paper,we propose a fast moving tag detection tag inventory scheme to interrogate tags,and an effective scheme for large-scale RFID systems,which works as a positioning scheme to determine the motion status of the fundamental premise to support the tracking applications tags,which would be hard to perform large-scale moving of tagged-objects.The main idea is to extract the physical- RFID monitoring in a timely manner.Specifically,for the layer features of each tag from the collision signal to achieve tag inventory schemes in RFID systems,traditional polling- the time efficiency.Fig.1 uses the collision signal of three 1536-1233(c)2018 IEEE Personal use is permitted,but republication/redistribution requires IEEE permission.See http://www.ieee.org/publications_standards/publications/rights/index.html for more information

1536-1233 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMC.2019.2907244, IEEE Transactions on Mobile Computing 1 Probing into the Physical Layer: Moving Tag Detection for Large-Scale RFID Systems Chuyu Wang, Student Member, IEEE, Lei Xie, Member, IEEE, Wei Wang, Member, IEEE, Yingying Chen, Senior Member, IEEE, Tao Xue, and Sanglu Lu, Member, IEEE Abstract—Logistics monitoring is a fundamental application that utilizes RFID systems to manage numerous tagged-objects. Due to the frequent rearrangement of tagged-objects, a fast RFID-based tracking approach is highly desired for accurate logistics distribution. However, traditional RFID systems usually take tens of seconds to interrogate hundreds of RFID tags, not to mention the time delay involved to locate all the tags, which severely prevents from in-time tracking. To address this issue, we reduce the problem domain by first distinguishing the motion status of the tagged-objects, i.e., “stationary” or “moving”, and then tracking the moving objects with the state-of-the-art localization schemes, which significantly reduces the efforts of tracking all the objects. Toward this end, we propose a moving tag detection mechanism, which achieves the time efficiency by exploiting the useless collision signal in RFID systems. In particular, we extract two kinds of physical-layer features (namely phase profile and backscatter link frequency) from the collision signal received by the USRP to distinguish tags at different positions. We further develop the Graph Matching (GM) method and Coherent Phase Variance (CPV) method to detect the moving tagged-objects. Experiment results show that our approach can accurately detect the moving objects while reducing 80% inventory time compared with the state-of-art solutions. Index Terms—RFID, Collision Decoding, Tag Inventory ✦ 1 INTRODUCTION WITH the rapid proliferation of IoT (Internet of Things) industry, RFID, as a key technology, has been de￾ployed in increasingly large numbers to facilitate the smart management. For example, in the logistic monitoring, there are usually more than hundreds of objects attached with RFID tags in the monitoring area. Due to the frequent rearrangement of the tagged-objects, the RFID systems are required to track the movement of all tags timely to prevent the target objects from mistakenly rearranging. However, a Commercial-Of-The-Shelf (COTS) RFID system usually takes tens of seconds to interrogate hundreds of RFID tags [1], [2], not to mention the time delay to track all the tags. This severely hinders the system from tracking the movement of tagged-objects in time. Since only some of the objects are moved at a certain moment, to reduce the efforts of tracking all the objects, one possible solution is to first identify the motion status of the objects, i.e., “stationary” or “moving”, and then only track the “moving” objects. For the “stationary” objects, since they are presumed to be statically placed in a specific location, we do not need to track them. For the “moving” objects, we can leverage the existing localization techniques to track them. Since the “moving” objects only occupy a small part of the total number, we can save a lot of time by only focusing on tracking the moving objects, instead of wasting time in tracking the stationary objects, which makes it possible to perform the fast large￾scale monitoring. To track the moving tags in the monitoring area, exist￾ing studies [3]–[14] usually involve two steps, i.e., a fast tag inventory scheme to interrogate tags, and an effective positioning scheme to determine the motion status of the tags, which would be hard to perform large-scale moving RFID monitoring in a timely manner. Specifically, for the tag inventory schemes in RFID systems, traditional polling￾Decode collision signal in I-Q plane Backscatter link frequency Phase profiles extraction extraction Decode Recovery Fig. 1. Illusion of extracting physical-layer features from collision signal. based schemes [3]–[5], [14] leverage the Frame-Slotted￾Aloha (FSA) protocol to identify the tags, which usually takes tens of seconds to interrogate hundreds of RFID tags in real RFID systems. The main cause of such time inefficiency is the waste of the collision slots, which usually occupy a large proportion of the overall time slots. Recently, some emerging work try to make use of the collision slots to improve time efficiency of tag inventory [6]–[9] and further detect the missing tags from the collision signals [3], [10]. However, different from a missing tag, a moving tag can still be interrogated by the reader, thus these methods are not suitable to detect the moving tags. In addition, for the positioning schemes, the state-of-the-art localization schemes [11]–[13] usually locate the tags one by one, and they usually take up to several hundreds of milliseconds to locate a unique tag. Therefore, it is difficult to concurrently locate all tags timely using existing solutions, when dealing with hundreds of tags. In this paper, we propose a fast moving tag detection scheme for large-scale RFID systems, which works as a fundamental premise to support the tracking applications of tagged-objects. The main idea is to extract the physical￾layer features of each tag from the collision signal to achieve the time efficiency. Fig. 1 uses the collision signal of three

This article has been accepted for publication in a future issue of this journal,but has not been fully edited.Content may change prior to final publication.Citation information:DOI 10.1109/TMC.2019.2907244.IEEE Transactions on Mobile Computing 2 tags received by the USRP platform as an example to show with a small distance.The coexistence of these two physical- our basic idea.When we obtain the collision signal from layer features allows fine-grained tags and their locations the USRP,we can decompose them based on the signal discrimination to further determine their motion status.The distribution in the I-O plane.Then the channel coefficient third challenge is to extract the above physical-layer features of each tag can be represented as an arrow in the figure, from the collisions of multiple tag responses.To address this which is further used to extract the physical-layer features challenge,we investigate the geometrical characteristic of for moving detection.Particularly,we are able to extract two different kinds of collision signals in I-Q plane,and extract kinds of physical-layer features of RFID tags,i.e.,the phase the phase profile of each tag response based on the specific profile and the backscatter link frequency,to distinguish the geometrical characteristic.For each tag response,we further tags at different positions.The two physical-layer features leverage the special patterns(e.g.,preambles)to extract the then serve as the fingerprints of each tag to derive the backscatter link frequency from the signal length. motion status of all tags simultaneously,greatly improving This paper presents the first study of probing into the the overall time-efficiency.Toward this end,we design a physical-layer features to detect the moving tags for large two-phase tag-detection scheme,including the tag inventory scale RFID systems.Specifically,we make four main con- and confinuous polling,to determine the motion status of tributions (a preliminary version of this work appeared tags.In the tag inventory phase,the RFID reader identifies in [15]):First,we develop a mechanism to detect the motion each tag via a traditional inventory cycle and constructs status of RFID tags,which is a fundamental premise for the original distribution of the physical-layer features for all tracking the movement of RFID tags in large-scale RFID sys- the tags.It may take tens of seconds due to the waste of tems.Second,our approach is able to extract the physical- collision slots.In the continuous polling phase,the RFID layer features,including the phase profile and backscatter reader continuously monitors the motion status of each tag link frequency,from the collision signal for efficient moving by issuing multiple query cycles.Differing from the existing tag detection.Third,we develop a voting-based scheme solutions,which still identify the tags via the singleton to determine the moving objects from multiple attached slots,we focus on extracting the physical-layer features tags,which can tackle the measurement errors in real en- from the signal of collision slots.Thus we can save lots of vironments.Fourth,we evaluated our system in realistic inventory time by making use of the useless collision slots. settings and experiment results show that our solution can For each query cycle,we construct an updated distribution accurately detect the moving objects while reducing 80% of the physical-layer features from both the singleton and inventory time compared with existing approaches. collision slots.Then we can detect the moving objects from the two distributions based on the fact that a static tag has 2 RELATED WORK stable physical-layer features,while a moving tag has dif- ferent physical-layer features across the two distributions. Missing tag detection.There have been active studies on Particularly,a Graph Matching(GM)method is proposed to detecting the missing tags based on the RF signals [3],[5], detect the moving tags effectively based on the Hungarian [16].Yang et al.[5]propose to detect the missing tags based algorithm,and a Coherent Phase Variance(CPV)method is on the statistical signal information,which measures the RF proposed to determine the moving objects when we attach signal of tags for a fairly long time for data collection.Zheng multiple tags on one object for robustness.Since the fag et al.[10]employ an efficient method to detect the missing inventory phase and continuous polling phase are executed tags based on signal superposition principle on physical alternately,the time inefficiency of the tag inventory phase layer.Zhu et al.[16]try to identify the unknown tags in can thus be amortized by the subsequent multiple polling large-scale RFID system.Different from the above work, cycles,and the overall time-efficiency is achieved. which only consider the missing tags,we focus on detecting There are three main technical challenges in detecting the the moving tags,which still can be identified by the reader. moving tags.The first challenge is to achieve time efficiency in Moreover,in regard to a large-scale RFID system,we need large scale RFID systems.Due to the long duration of a tradi- to achieve the time efficiency by updating the motion status tional inventory cycle,it is difficult to continuously update in time,which is seldom discussed in the above works the motion status of all tags within limited time intervals Collision recovery.Many studies focus on recovering the in a large-scale RFID system.To address this challenge,a tag signal [7],[8]or estimating tag cardinality [17]from the two-phase monitoring scheme is proposed,which includes collision signals based on the dedicated instruments like a normal tag inventory phase and multiple fast tag polling USRP.With the Software Defined Radio based UHF-RFID phases.During the fast tag polling phases,we significantly reader designed by Buettner et al.[18],several methods are improve the time efficiency by exploiting the tag collisions proposed to deal with the collision problems [6]-[8],[19]. to extract the physical-layer features for the detection of Zheng et al.[19]use the Computational RFID tags and SDR moving tags.The second challenge is to detect the motion status reader to improve the data throughput.Wang et al.[6]view of all tags via the physical-layer features.Since the EPC ID is collisions as a code across the bits transmitted by the tags not even transmitted in the collision slot,it is difficult to to improve the bandwidth in RFID system.Hou et al.[17] determine the moving tags only based on the physical-layer investigate the collision signals in physical layer to estimate features.To solve this problem,we find that the backscatter cardinality of large scale RFID system.Other work [7],[8]try link frequency of the tag's response has high degree of to recovery the data from the collision signals by leveraging difference among different tags regardless of the motion the time-domain separations.Unlike these work,we try to status of the tags,whereas the phase profile from the tag's extract the tag position related physical features from the response changes accordingly even if a specific tag is moved collision signals to detect the moving tags. 1536-1233 (c)2018 IEEE Personal use is permitted,but republication/redistribution requires IEEE permission.See http://www.ieee.org/publications_standards/publications/rights/index.html for more information

1536-1233 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMC.2019.2907244, IEEE Transactions on Mobile Computing 2 tags received by the USRP platform as an example to show our basic idea. When we obtain the collision signal from the USRP, we can decompose them based on the signal distribution in the I-Q plane. Then the channel coefficient of each tag can be represented as an arrow in the figure, which is further used to extract the physical-layer features for moving detection. Particularly, we are able to extract two kinds of physical-layer features of RFID tags, i.e., the phase profile and the backscatter link frequency, to distinguish the tags at different positions. The two physical-layer features then serve as the fingerprints of each tag to derive the motion status of all tags simultaneously, greatly improving the overall time-efficiency. Toward this end, we design a two-phase tag-detection scheme, including the tag inventory and continuous polling, to determine the motion status of tags. In the tag inventory phase, the RFID reader identifies each tag via a traditional inventory cycle and constructs the original distribution of the physical-layer features for all the tags. It may take tens of seconds due to the waste of collision slots. In the continuous polling phase, the RFID reader continuously monitors the motion status of each tag by issuing multiple query cycles. Differing from the existing solutions, which still identify the tags via the singleton slots, we focus on extracting the physical-layer features from the signal of collision slots. Thus we can save lots of inventory time by making use of the useless collision slots. For each query cycle, we construct an updated distribution of the physical-layer features from both the singleton and collision slots. Then we can detect the moving objects from the two distributions based on the fact that a static tag has stable physical-layer features, while a moving tag has dif￾ferent physical-layer features across the two distributions. Particularly, a Graph Matching (GM) method is proposed to detect the moving tags effectively based on the Hungarian algorithm, and a Coherent Phase Variance (CPV) method is proposed to determine the moving objects when we attach multiple tags on one object for robustness. Since the tag inventory phase and continuous polling phase are executed alternately, the time inefficiency of the tag inventory phase can thus be amortized by the subsequent multiple polling cycles, and the overall time-efficiency is achieved. There are three main technical challenges in detecting the moving tags. The first challenge is to achieve time efficiency in large scale RFID systems. Due to the long duration of a tradi￾tional inventory cycle, it is difficult to continuously update the motion status of all tags within limited time intervals in a large-scale RFID system. To address this challenge, a two-phase monitoring scheme is proposed, which includes a normal tag inventory phase and multiple fast tag polling phases. During the fast tag polling phases, we significantly improve the time efficiency by exploiting the tag collisions to extract the physical-layer features for the detection of moving tags. The second challenge is to detect the motion status of all tags via the physical-layer features. Since the EPC ID is not even transmitted in the collision slot, it is difficult to determine the moving tags only based on the physical-layer features. To solve this problem, we find that the backscatter link frequency of the tag’s response has high degree of difference among different tags regardless of the motion status of the tags, whereas the phase profile from the tag’s response changes accordingly even if a specific tag is moved with a small distance. The coexistence of these two physical￾layer features allows fine-grained tags and their locations discrimination to further determine their motion status. The third challenge is to extract the above physical-layer features from the collisions of multiple tag responses. To address this challenge, we investigate the geometrical characteristic of different kinds of collision signals in I-Q plane, and extract the phase profile of each tag response based on the specific geometrical characteristic. For each tag response, we further leverage the special patterns (e.g., preambles) to extract the backscatter link frequency from the signal length. This paper presents the first study of probing into the physical-layer features to detect the moving tags for large scale RFID systems. Specifically, we make four main con￾tributions (a preliminary version of this work appeared in [15]): First, we develop a mechanism to detect the motion status of RFID tags, which is a fundamental premise for tracking the movement of RFID tags in large-scale RFID sys￾tems. Second, our approach is able to extract the physical￾layer features, including the phase profile and backscatter link frequency, from the collision signal for efficient moving tag detection. Third, we develop a voting-based scheme to determine the moving objects from multiple attached tags, which can tackle the measurement errors in real en￾vironments. Fourth, we evaluated our system in realistic settings and experiment results show that our solution can accurately detect the moving objects while reducing 80% inventory time compared with existing approaches. 2 RELATED WORK Missing tag detection. There have been active studies on detecting the missing tags based on the RF signals [3], [5], [16]. Yang et al. [5] propose to detect the missing tags based on the statistical signal information, which measures the RF signal of tags for a fairly long time for data collection. Zheng et al. [10] employ an efficient method to detect the missing tags based on signal superposition principle on physical layer. Zhu et al. [16] try to identify the unknown tags in large-scale RFID system. Different from the above work, which only consider the missing tags, we focus on detecting the moving tags, which still can be identified by the reader. Moreover, in regard to a large-scale RFID system, we need to achieve the time efficiency by updating the motion status in time, which is seldom discussed in the above works. Collision recovery. Many studies focus on recovering the tag signal [7], [8] or estimating tag cardinality [17] from the collision signals based on the dedicated instruments like USRP. With the Software Defined Radio based UHF-RFID reader designed by Buettner et al. [18], several methods are proposed to deal with the collision problems [6]–[8], [19]. Zheng et al. [19] use the Computational RFID tags and SDR reader to improve the data throughput. Wang et al. [6] view collisions as a code across the bits transmitted by the tags to improve the bandwidth in RFID system. Hou et al. [17] investigate the collision signals in physical layer to estimate cardinality of large scale RFID system. Other work [7], [8] try to recovery the data from the collision signals by leveraging the time-domain separations. Unlike these work, we try to extract the tag position related physical features from the collision signals to detect the moving tags

This article has been accepted for publication in a future issue of this journal,but has not been fully edited.Content may change prior to final publication.Citation information:DOI 10.1109/TMC.2019.2907244.IEEE Transactions on Mobile Computing 800 QUERY A Tag inventory Physical-layer phase Extract features 600 Singleton signal Fingerprints 400 inmmn Phase BLF 200 EPCID 10 Continuous pooling phase Extract features Fig3.A typicalingms. Collision signal 11 一LI Phase BLF Phase2 BLF2 to manufacturing imperfection,BLF varies among different tags.Therefore,it is suitable to combine the two features to Graph Matching Coherent Phase Variance detect the motion status of tags.Moreover,in order to satisfy the time efficiency,we recover each tag response according to the geometrical characteristic of the collision signals in I-Q plane,and extract the aforementioned physical-layer Fig.2.System Architecture. features from collision signals. Physical layer identification.Due to the hardware imper- Fig.2 presents the whole architecture of our system.We fection,leveraging the physical layer features to perform propose a two-phase monitoring scheme,including the tag tag identification or authentication has drawn widespread inventory and continuous polling phase,to efficiently detect attention recent years [20]-[23].Danev et al.[21]study the the motion status of all tags.In the tag inventory phase,the feasibility of physical-layer fingerprint in tag identification reader identifies each tag via a traditional inventory cycle in practical settings.Zanetti et al.[20]exploit the difference to extract the physical-layer features of all tags.Since the of backscattered link frequency caused by manufacturing tags are all static in this phase,the physical-layer features imperfection of tags to distinguish different tags.Further- of all tags construct an original distribution of the physical- more,Ma et al.[22]distinguish the tags by leveraging the layer features.In the continuous polling phases,the reader internal similarity among pulses of tags'RN16 preamble continuously monitors the motion status of all tag by issuing signals.Yang et al.[23]leverage the phase deviation of each multiple query cycles.For each query cycle,the reader tag and the specific geometric relationship among these tags constructs an updated distribution of the physical-layer fea- to authenticate the legal products.However,apart from the tures by effectively extracting the two features from both identification,we also need to detect the motion status of the singleton and collision signals.By comparing the up- each tag,which is a fundamental premise of tracking the dated distribution with the original distribution,we utilize movement of all the tags. a Graph Matching(GM)method to detect the moving tags in every query cycle.Moreover,based on the detected moving 3 SYSTEM DESIGN tags from the GM method,we further propose a Coherent 3.1 System Goals Phase Variance(CPV)method to detect the moving objects, In this paper,we propose a fast moving tag detection missing objects and inserting tags based on the multiple scheme for large scale RFID systems,so as to further sup- tags attached on one object.The multiple query cycles in port tracking the movement of all tagged-objects.Since the the continuous polling phase save lots of time from the tagged-objects in real RFID may be frequently moved in collision signals,and thus can amortize the time spent in and out for logistic distribution,we need to continuously the inventory phase,which takes more time due to the tra- ditional inventory cycle.Therefore,by efficiently extracting update the motion status within a limited time interval Therefore,our moving tag detection scheme should be able the position related features from the collision signal,we can to improve both the time efficiency in tag inventory and largely reduce the overall time in detecting the motion status the accuracy in detecting the motion status of all tags:1) compared with the existing C1G2 standard-based methods. The average duration for each cycle of tag inventory should 4 PHYSICAL-LAYER FEATURES CALCULATION be sufficiently reduced to achieve the time requirement for In this section,we demonstrate how to calculate our large scale RFID systems.2)There are two kinds of errors physical-layer features from the raw signal of tag response in the problem:a)False positive errors:the stationary tags via realistic experiments.We implement a software defined are detected as moving tags.b)False negative errors:the reader (SDR reader)according to the Gen2 project [18]. moving tags are detected as stationary tags.Both of the two Specifically,we operate the Gen2 project on our USRP errors should be effectively reduced in detecting the motion platform [24]with two FLEX-900 daughter boards and two status of all tags. Larid S9028 antennas on each board for transmitting and 3.2 System Architecture receiving,respectively.For the receiving module,we set the In this paper,two kinds of physical-layer features are inves- sampling rate to 2MHz,which represents 0.5us per sample. tigated to effectively detect the motion status of all tags 4.1 Tag Response in a Singleton Slot 1)Phase profile:it is the phase values of the RF signal, According to the EPC C1G2 standard [4],the RFID reader which describes the degree that the received signal offsets interrogates the tags based on the Frame-Slotted-Aloha from sent signal,ranging from 0 to 360 degrees.The phase (FSA)protocol.In the FSA protocol,each inventory cycle is value from the tag's response changes even if the tag is separated into several frames,while each frame is further moved with a small distance.2)Backscatter link frequency divided into multiple slots to identify the tags.For each (BLF):it is the frequency of the tag-to-reader link,which frame,the unidentified tags need to randomly select one slot indicates the data rate in the tag's response signal.Due for its data transmission.The reader starts a slot by sending 1536-1233(c)2018 IEEE Personal use is permitted,but republication/redistribution requires IEEE permission.See http://www.ieee.org/publications_standards/publications/rights/index.html for more information

1536-1233 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMC.2019.2907244, IEEE Transactions on Mobile Computing 3 Tag inventory phase Singleton signal Continuous pooling phase Extract features θ θ Extract features θ Phase BLF Graph Matching Physical-layer Fingerprints Coherent Phase Variance Missing Inserting Phase1 BLF 1 Phase2 BLF2 Collision signal Fig. 2. System Architecture. Physical layer identification. Due to the hardware imper￾fection, leveraging the physical layer features to perform tag identification or authentication has drawn widespread attention recent years [20]–[23]. Danev et al. [21] study the feasibility of physical-layer fingerprint in tag identification in practical settings. Zanetti et al. [20] exploit the difference of backscattered link frequency caused by manufacturing imperfection of tags to distinguish different tags. Further￾more, Ma et al. [22] distinguish the tags by leveraging the internal similarity among pulses of tags’ RN16 preamble signals. Yang et al. [23] leverage the phase deviation of each tag and the specific geometric relationship among these tags to authenticate the legal products. However, apart from the identification, we also need to detect the motion status of each tag, which is a fundamental premise of tracking the movement of all the tags. 3 SYSTEM DESIGN 3.1 System Goals In this paper, we propose a fast moving tag detection scheme for large scale RFID systems, so as to further sup￾port tracking the movement of all tagged-objects. Since the tagged-objects in real RFID may be frequently moved in and out for logistic distribution, we need to continuously update the motion status within a limited time interval. Therefore, our moving tag detection scheme should be able to improve both the time efficiency in tag inventory and the accuracy in detecting the motion status of all tags: 1) The average duration for each cycle of tag inventory should be sufficiently reduced to achieve the time requirement for large scale RFID systems. 2) There are two kinds of errors in the problem: a) False positive errors: the stationary tags are detected as moving tags. b) False negative errors: the moving tags are detected as stationary tags. Both of the two errors should be effectively reduced in detecting the motion status of all tags. 3.2 System Architecture In this paper, two kinds of physical-layer features are inves￾tigated to effectively detect the motion status of all tags. 1) Phase profile: it is the phase values of the RF signal, which describes the degree that the received signal offsets from sent signal, ranging from 0 to 360 degrees. The phase value from the tag’s response changes even if the tag is moved with a small distance. 2) Backscatter link frequency (BLF): it is the frequency of the tag-to-reader link, which indicates the data rate in the tag’s response signal. Due !"#$% $&'( )*+ #,*-. /////////01234256 ///////7 ////'8 ////'7 )29:1;<=3 Fig. 3. A typical singleton slot in RFID systems. to manufacturing imperfection, BLF varies among different tags. Therefore, it is suitable to combine the two features to detect the motion status of tags. Moreover, in order to satisfy the time efficiency, we recover each tag response according to the geometrical characteristic of the collision signals in I-Q plane, and extract the aforementioned physical-layer features from collision signals. Fig. 2 presents the whole architecture of our system. We propose a two-phase monitoring scheme, including the tag inventory and continuous polling phase, to efficiently detect the motion status of all tags. In the tag inventory phase, the reader identifies each tag via a traditional inventory cycle to extract the physical-layer features of all tags. Since the tags are all static in this phase, the physical-layer features of all tags construct an original distribution of the physical￾layer features. In the continuous polling phases, the reader continuously monitors the motion status of all tag by issuing multiple query cycles. For each query cycle, the reader constructs an updated distribution of the physical-layer fea￾tures by effectively extracting the two features from both the singleton and collision signals. By comparing the up￾dated distribution with the original distribution, we utilize a Graph Matching (GM) method to detect the moving tags in every query cycle. Moreover, based on the detected moving tags from the GM method, we further propose a Coherent Phase Variance (CPV) method to detect the moving objects, missing objects and inserting tags based on the multiple tags attached on one object. The multiple query cycles in the continuous polling phase save lots of time from the collision signals, and thus can amortize the time spent in the inventory phase, which takes more time due to the tra￾ditional inventory cycle. Therefore, by efficiently extracting the position related features from the collision signal, we can largely reduce the overall time in detecting the motion status compared with the existing C1G2 standard-based methods. 4 PHYSICAL-LAYER FEATURES CALCULATION In this section, we demonstrate how to calculate our physical-layer features from the raw signal of tag response via realistic experiments. We implement a software defined reader (SDR reader) according to the Gen2 project [18]. Specifically, we operate the Gen2 project on our USRP platform [24] with two FLEX-900 daughter boards and two Larid S9028 antennas on each board for transmitting and receiving, respectively. For the receiving module, we set the sampling rate to 2MHz, which represents 0.5µs per sample. 4.1 Tag Response in a Singleton Slot According to the EPC C1G2 standard [4], the RFID reader interrogates the tags based on the Frame-Slotted-Aloha (FSA) protocol. In the FSA protocol, each inventory cycle is separated into several frames, while each frame is further divided into multiple slots to identify the tags. For each frame, the unidentified tags need to randomly select one slot for its data transmission. The reader starts a slot by sending

This article has been accepted for publication in a future issue of this journal,but has not been fully edited.Content may change prior to final publication.Citation information:DOI 10.1109/TMC.2019.2907244.IEEE Transactions on Mobile Computing 400 Backscattered 0. signal 06 00 0.4 Leakage 0.2 signal -10 .5 0 400 0 80 Phase variation(degree) Transmitting distance(cm) Fig.4.Received signal model of a single tag.The baseband signal (a)Phase variance (b)Phase comparison received by the reader consists of the leakage signal and the backscat- tered signal.The phase profile can thus be extracted from these two Fig.5.Distinctiveness of phase profile.(a)shows the stability of the signal parts. extracted phase profile 6.(b)compares the extracted phase profile 6 from the USRP reader with the phase value from ImpinJ reader a QUERY/ORep command.Any tag that selects this slot strength.As for the phase value of the received signal in will respond the reader with a 16-bit random number RN16 Fig.4,it can be represented as: for channel probing.If the reader successfully decodes the 8=Φ-B, (2) RN16 bits,it responds the tag with an ACK,that tells the tag to transmit its EPC-ID.Otherwise,the reader will start which is the angle difference between the carrier signal the next slot,because there are multiple tags or none tag phase B and the backscattered signal phase We call 0 transmitting in this slot.Therefore,there are two kinds of the phase profile of the tag in this work. tag responses generally:1)RN16,where the tag responds We further carry out trace-driven evaluations to study the QUERY or QRep command,2)EPC-ID,where the tag the property of the phase profile.Firstly,we evaluate the answers the ACK command.During the tag response,the stability by conducting an empirical experiment on 50 tags reader keeps transmitting Continuous Wave(CW)to supply with random deployments.For each setting,we deploy power for the tags.Fig.3 presents a typical singleton slot each RFID tag 1m in front of the SDR reader [18]based on in RFID systems,which is collected from USRP.We note USRP platform,and measure 100 phase profiles by querying that the time of the EPC-ID is about 4 times longer than each tag 100 times with the USRP reader.The results are that of the RN16,because the data length of EPC-ID is normalized by subtracting the average phase value of each much longer than RN16.Meanwhile,since the time interval result set.Therefore,5000 normalized phase profiles are between the two responses,i.e.,the length of ACK,is so measured to evaluate the stability.As shown in Fig.5(a), small,the position and wireless environment of both RN16 the phase profile varies from-5°to5°，following a typical and EPC-ID can be regarded unchanged.Hence,instead of Gaussian distribution.So we can treat the phase profile as a extracting the physical-layer features from the EPC-ID,we stable feature for motion detection. can directly extract the feature from the RN16 signal,and Secondly,we compare the phase profile of SDR reader then skip the EPC-ID signal to save the inventory time. with the phase value of commercial reader (Impinj R420) by issuing the same tag.We vary the distance between 4.2 Phase Profile the antenna and the tag,which ranges from 20cm to 70cm Next,we demonstrate how to calculate the phase profile stepping by 1cm.For each step we measure 100 phase values from the RN16 signals via the signal transmitting model.In individually.As shown in Fig.5(b),the phase profile of SDR RFID systems,the tag transmits data using backscattering reader is almost the same as the phase value of commer- modulation.Hence,the baseband signal received by the cial reader,where the correlation coefficients calculated on reader can be represented as: MATLAB is 0.9979.Therefore,the phase profile is sensitive to any tiny movements,e.g.,Icm movement,which guarantees the s(t)=AeiB+x(1)Bei)+(t). (1) distinctiveness of the phase profile in the motion detection Here,Aei is the carrier signal(i.e.,Continuous Wave,CW), 4.3 Backscattered Link Frequency where A indicates the amplitude,j is v-1 and B is the In regard to the backscatter link frequency (BLF)of the corresponding phase value.Bej)is the backscattered response signal,it can be represented as fi in Eq.(1).Due signal of the tag,where B indicates the amplitude of the to the manufacturing imperfection,the BLF varies among backscattered signal and fi indicates the corresponding fre- different tags,which is used to distinguish tags [20],[22]. quency of the backscattered signal.x(t)is the binary bits In fact,fi determines the data rate of the tag's response.In sent by the tag,which is equal to either '0'or '1'.f(t)is regard to a typical encoding scheme Miller-4 of RFID system the ambient noise.Therefore,the actual baseband signal in Fig.6(a),fi determines the duration of a binary symbol, received by the reader is a superposition of the carrier signal i.e.,bit-0 or bit-1.Therefore,both bit-0 and bit-1 have the and the backscattered signal. same signal duration according to the Miller-4 encoding Intuitively,the baseband signal received from a single scheme.Since the binary length of RN16 signal is fixed tag response can be expressed in I-Q plane as shown in including the same preambles,a 16 bits random number Fig.4.The received signal consists of two parts:1)leakage and 1 check bit,it is reasonable to use the corresponding signal:the constant carrier signal (i.e.,CW),2)backscat- signal length of RN16 to represent the BLF.Meanwhile,we tered signal:the modulated tag signal.Formally,we define can also convert the signal length of RN16 to the BLF based the channel coefficient of the tag's backscattered signal as on the actual symbols in RN16.In regard to other encoding h =Bejft+),which expresses the channel information schemes in RFID system,e.g.,FMO,we can similarly use the of the backscattered signal,i.e.,the phase value and signal signal length of RN16 to represent the BLF. 1536-1233(c)2018 IEEE Personal use is permitted,but republication/redistribution requires IEEE permission.See http://www.ieee.org/publications_standards/publications/rights/index.html for more information

1536-1233 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMC.2019.2907244, IEEE Transactions on Mobile Computing 4 ! " #$%&%'$( )*'+%,  -%.&).%//$0$1( )*'+%,    Fig. 4. Received signal model of a single tag. The baseband signal received by the reader consists of the leakage signal and the backscat￾tered signal. The phase profile can thus be extracted from these two signal parts. a QUERY/QRep command. Any tag that selects this slot will respond the reader with a 16-bit random number RN16 for channel probing. If the reader successfully decodes the RN16 bits, it responds the tag with an ACK, that tells the tag to transmit its EPC-ID. Otherwise, the reader will start the next slot, because there are multiple tags or none tag transmitting in this slot. Therefore, there are two kinds of tag responses generally: 1) RN16, where the tag responds the QUERY or QRep command, 2) EPC-ID, where the tag answers the ACK command. During the tag response, the reader keeps transmitting Continuous Wave (CW) to supply power for the tags. Fig. 3 presents a typical singleton slot in RFID systems, which is collected from USRP. We note that the time of the EPC-ID is about 4 times longer than that of the RN16, because the data length of EPC-ID is much longer than RN16. Meanwhile, since the time interval between the two responses, i.e., the length of ACK, is so small, the position and wireless environment of both RN16 and EPC-ID can be regarded unchanged. Hence, instead of extracting the physical-layer features from the EPC-ID, we can directly extract the feature from the RN16 signal, and then skip the EPC-ID signal to save the inventory time. 4.2 Phase Profile Next, we demonstrate how to calculate the phase profile from the RN16 signals via the signal transmitting model. In RFID systems, the tag transmits data using backscattering modulation. Hence, the baseband signal received by the reader can be represented as: s(t) = Aejβ + x(t)Bej(2π fl t+Φ) + nˆ(t). (1) Here, Aejβ is the carrier signal (i.e., Continuous Wave, CW), where A indicates the amplitude, j is √ −1 and β is the corresponding phase value. Bej(2π fl t+Φ) is the backscattered signal of the tag, where B indicates the amplitude of the backscattered signal and fl indicates the corresponding fre￾quency of the backscattered signal. x(t) is the binary bits sent by the tag, which is equal to either 00 0 or 01 0 . ˆn(t) is the ambient noise. Therefore, the actual baseband signal received by the reader is a superposition of the carrier signal and the backscattered signal. Intuitively, the baseband signal received from a single tag response can be expressed in I-Q plane as shown in Fig. 4. The received signal consists of two parts: 1) leakage signal: the constant carrier signal (i.e., CW), 2) backscat￾tered signal: the modulated tag signal. Formally, we define the channel coefficient of the tag’s backscattered signal as h = Bej(2π fl t+Φ) , which expresses the channel information of the backscattered signal, i.e., the phase value and signal Phase variation(degree) -10 -5 0 5 10 CDF 0 0.2 0.4 0.6 0.8 1 (a) Phase variance Transmitting distance(cm) 20 40 60 80 100 Phase value(degree) 0 100 200 300 400 Phase of SDR reader Phase of ImpinJ Reader (b) Phase comparison Fig. 5. Distinctiveness of phase profile. (a) shows the stability of the extracted phase profile θ. (b) compares the extracted phase profile θ from the USRP reader with the phase value from ImpinJ reader. strength. As for the phase value of the received signal in Fig. 4, it can be represented as: θ = Φ − β, (2) which is the angle difference between the carrier signal phase β and the backscattered signal phase Φ. We call θ the phase profile of the tag in this work. We further carry out trace-driven evaluations to study the property of the phase profile. Firstly, we evaluate the stability by conducting an empirical experiment on 50 tags with random deployments. For each setting, we deploy each RFID tag 1m in front of the SDR reader [18] based on USRP platform, and measure 100 phase profiles by querying each tag 100 times with the USRP reader. The results are normalized by subtracting the average phase value of each result set. Therefore, 5000 normalized phase profiles are measured to evaluate the stability. As shown in Fig. 5(a), the phase profile varies from −5 ◦ to 5◦ , following a typical Gaussian distribution. So we can treat the phase profile as a stable feature for motion detection. Secondly, we compare the phase profile of SDR reader with the phase value of commercial reader (Impinj R420) by issuing the same tag. We vary the distance between the antenna and the tag, which ranges from 20cm to 70cm stepping by 1cm. For each step we measure 100 phase values individually. As shown in Fig. 5(b), the phase profile of SDR reader is almost the same as the phase value of commer￾cial reader, where the correlation coefficients calculated on MATLAB is 0.9979. Therefore, the phase profile is sensitive to any tiny movements, e.g., 1cm movement, which guarantees the distinctiveness of the phase profile in the motion detection. 4.3 Backscattered Link Frequency In regard to the backscatter link frequency (BLF) of the response signal, it can be represented as fl in Eq. (1). Due to the manufacturing imperfection, the BLF varies among different tags, which is used to distinguish tags [20], [22]. In fact, fl determines the data rate of the tag’s response. In regard to a typical encoding scheme Miller-4 of RFID system in Fig. 6(a), fl determines the duration of a binary symbol, i.e., bit-0 or bit-1. Therefore, both bit-0 and bit-1 have the same signal duration according to the Miller-4 encoding scheme. Since the binary length of RN16 signal is fixed, including the same preambles, a 16 bits random number and 1 check bit, it is reasonable to use the corresponding signal length of RN16 to represent the BLF. Meanwhile, we can also convert the signal length of RN16 to the BLF based on the actual symbols in RN16. In regard to other encoding schemes in RFID system, e.g., FM0, we can similarly use the signal length of RN16 to represent the BLF

This article has been accepted for publication in a future issue of this journal,but has not been fully edited.Content may change prior to final publication.Citation information:DOI 10.1109/TMC.2019.2907244.IEEE Transactions on Mobile Computing Example of preamble 7700 15000 咖肌 Sliding window 010111 0000 Ending of RN16 n几几nn几u 500 0 dummy 1 6 L几uu几4几几 760 0 10 20 30 10 (a)RN16 signal (b)Cross-correlation Tag ID Signal length deviation Fig.6.Calculate signal length through cross-correlation.(a)shows the (a)BLF measurement (b)BLF histogram preamble and ending part of the RN16 signal.(b)shows to measure the Fig.7.Distinctiveness of BLF (a)shows the distribution of the BLF signal length with the cross-correlation method. values of different tags.(b)uses the histogram to present the variance of the extracted BLF feature. We present a cross-correlation based technology to ex- tract the signal length by locating the starting and ending Binomial distribution and the probability of a c-collision slot point of RN16 signal.Specifically,we adopt a slide window can be expressed as: to calculate the cross-correlation value between the mea- Pr(c)- (3) sured samples in the window and the special data sequence, -引 i.e.,the preamble or the "dummy 1".Then we find the Fig.8 shows the theoretical probability distribution of window whose cross-correlation value is the maximum,and different slot types.In this figure,in regard to the slot types, record the position of the window.In Fig.6(b),we move the '0'indicates the empty slot,'1'indicates the singleton slot, slide window forward to locate the starting point of RN16 and '2','3','4+'indicates the collision slot with different based on the preamble sequence.Similarly we can locate the number of collided tags in one slot.We enumerate the ending point using the"dummy 1",while moving the slide values of f/N,which are the ratio between the frame size window from the end of RN16 signal backward.We use f and the total tag number N(N is set to 1000 as default), the number of samples between the starting and the ending and calculate the distribution of each slot type according point to represent the value of the BLF. to Eq.(3).In regard to the C1G2 protocol,since it only To validate the distinctiveness of BLF,we conduct ex- receives signal from the singleton slot,it need to maximize periments on 50 different tags at 9 random positions in Pr(1)to improve the time efficiency.As a result,at most front of the antennas.We repeat querying each tag 100 36.8%slots are singleton when f equals to N.Then,about times with our USRP reader,and then extract the signal 63.2%slots are wasted,which severely affects the inventory lengths in different positions.As shown in Fig.7(a),the time efficiency.In this case,2-collision and 3-collision slots average signal length of 50 tags is randomly distributed occupy 18.4%and 6.13%slots respectively,while only 1.89% from 7620 to 7690 samples.Since the sampling rate of the slots are remained in 4+-collisions.So if we can efficiently USRP reader is 2MHz,the signal length is around 3.81ms resolve all the tags in singleton,2-collision and 3-collision to 3.845ms.It indicates that even though the same model slots,we can identify 36.8%+2 x 18.4%+3 x 6.13%=92% tags are queried with the same settings and the actual data tags in a frame,which is 2.5 times compared with current rates are different due to the manufacturing imperfection. protocol,i.e.,36.8%.Hence,we focus on how to extract Therefore,the distinctive value of BLF can be regarded as physical-layer features from 2-collision and 3-collision slots a unique physical-layer feature to distinguish among tags. to improve the time efficiency. Furthermore,we draw the histogram of the normalized variance of the signal length in Fig.7(b).The normalized signal length is relatively stable with an average deviation of 2 samples,which is equal to lus according to the 2MHz sampling rate.Therefore,the BLF is relatively stable and distinctive even though the tags are at different positions.But some tags have similar BLF values,meaning BLF cannot be used to uniquely differentiate the tags. 2 4+ Slot types 5 PHYSICAL-LAYER FEATURES EXTRACTION Fig.8.Theoretical probability distribution.The probability distribution of different kinds of collision slots in regard to the ratio between the frame FROM COLLISION SIGNAL size f and the number of tags N.N is set to 1000 as default. In the previous section,we have shown how to calculate 5.1 Model of Collision Signal the physical-layer features in the singleton slots.Such cal- culations can be used to collect the physical-layer features Extending Eq.(1)from a single tag to multiple tags,the re- in the tag inventory phase,since we leverage the traditional ceived baseband signal of a c-collision slot can be expressed C1G2 protocol [4]to identify the tags from the singleton as: slots.However,it is still time inefficient because we cannot s(t)=AeiB+(t)hi+(t) (4) avoid the useless collisions in C1G2 protocol.If c tags select the same slot to transmit the data,a c collision happens and Here,xi(t)is the binary bits sent by tag i over time t. such slots are wasted in C1G2 protocol.In fact,when we Aei represents the leakage signal from the reader.hi is the interrogate N tags with an f-slot frame based on the C1G2 channel coefficient of tag i and can be written as: protocol,the N tags select slots randomly according to the hi =B:ei2nft+0+B) (5) 1536-1233(c)2018 IEEE Personal use is permitted,but republication/redistribution requires IEEE permission.See http://www.ieee.org/publications_standards/publications/rights/index.html for more information

1536-1233 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMC.2019.2907244, IEEE Transactions on Mobile Computing 5 0 5 1 0 dummy 1 dummy 1 0 1 0 1 1 1 Example of preamble Ending of RN16 (a) RN16 signal 1 0 1 1 1 Sliding window Cross correlation 0 1 0 1 1 1 (b) Cross-correlation Fig. 6. Calculate signal length through cross-correlation. (a) shows the preamble and ending part of the RN16 signal. (b) shows to measure the signal length with the cross-correlation method. We present a cross-correlation based technology to ex￾tract the signal length by locating the starting and ending point of RN16 signal. Specifically, we adopt a slide window to calculate the cross-correlation value between the mea￾sured samples in the window and the special data sequence, i.e., the preamble or the “dummy 1”. Then we find the window whose cross-correlation value is the maximum, and record the position of the window. In Fig. 6(b), we move the slide window forward to locate the starting point of RN16 based on the preamble sequence. Similarly we can locate the ending point using the “dummy 1”, while moving the slide window from the end of RN16 signal backward. We use the number of samples between the starting and the ending point to represent the value of the BLF. To validate the distinctiveness of BLF, we conduct ex￾periments on 50 different tags at 9 random positions in front of the antennas. We repeat querying each tag 100 times with our USRP reader, and then extract the signal lengths in different positions. As shown in Fig. 7(a), the average signal length of 50 tags is randomly distributed from 7620 to 7690 samples. Since the sampling rate of the USRP reader is 2MHz, the signal length is around 3.81ms to 3.845ms. It indicates that even though the same model tags are queried with the same settings and the actual data rates are different due to the manufacturing imperfection. Therefore, the distinctive value of BLF can be regarded as a unique physical-layer feature to distinguish among tags. Furthermore, we draw the histogram of the normalized variance of the signal length in Fig. 7(b). The normalized signal length is relatively stable with an average deviation of 2 samples, which is equal to 1µs according to the 2MHz sampling rate. Therefore, the BLF is relatively stable and distinctive even though the tags are at different positions. But some tags have similar BLF values, meaning BLF cannot be used to uniquely differentiate the tags. 5 PHYSICAL-LAYER FEATURES EXTRACTION FROM COLLISION SIGNAL In the previous section, we have shown how to calculate the physical-layer features in the singleton slots. Such cal￾culations can be used to collect the physical-layer features in the tag inventory phase, since we leverage the traditional C1G2 protocol [4] to identify the tags from the singleton slots. However, it is still time inefficient because we cannot avoid the useless collisions in C1G2 protocol. If c tags select the same slot to transmit the data, a c collision happens and such slots are wasted in C1G2 protocol. In fact, when we interrogate N tags with an f -slot frame based on the C1G2 protocol, the N tags select slots randomly according to the Tag ID 0 10 20 30 40 50 Signal length 7600 7620 7640 7660 7680 7700 (a) BLF measurement Signal length deviation -10 -5 0 5 10 Counts 0 5000 10000 15000 (b) BLF histogram Fig. 7. Distinctiveness of BLF. (a) shows the distribution of the BLF values of different tags. (b) uses the histogram to present the variance of the extracted BLF feature. Binomial distribution and the probability of a c-collision slot can be expressed as: Pr(c) =  N c   1 f  c  1 − 1 f  N−c . (3) Fig. 8 shows the theoretical probability distribution of different slot types. In this figure, in regard to the slot types, 00 0 indicates the empty slot, 01 0 indicates the singleton slot, and 02 0 , 03 0 , 04+ 0 indicates the collision slot with different number of collided tags in one slot. We enumerate the values of f /N, which are the ratio between the frame size f and the total tag number N (N is set to 1000 as default), and calculate the distribution of each slot type according to Eq. (3). In regard to the C1G2 protocol, since it only receives signal from the singleton slot, it need to maximize Pr(1) to improve the time efficiency. As a result, at most 36.8% slots are singleton when f equals to N. Then, about 63.2% slots are wasted, which severely affects the inventory time efficiency. In this case, 2-collision and 3-collision slots occupy 18.4% and 6.13% slots respectively, while only 1.89% slots are remained in 4+ -collisions. So if we can efficiently resolve all the tags in singleton, 2-collision and 3-collision slots, we can identify 36.8% + 2 × 18.4% + 3 × 6.13% = 92% tags in a frame, which is 2.5 times compared with current protocol, i.e., 36.8%. Hence, we focus on how to extract physical-layer features from 2-collision and 3-collision slots to improve the time efficiency. Slot types 0 1 2 3 4+ f/N 0 1 2 3 4 5 0 0.2 0.4 0.6 0.8 Fig. 8. Theoretical probability distribution. The probability distribution of different kinds of collision slots in regard to the ratio between the frame size f and the number of tags N. N is set to 1000 as default. 5.1 Model of Collision Signal Extending Eq. (1) from a single tag to multiple tags, the re￾ceived baseband signal of a c-collision slot can be expressed as: s(t) = Aejβ + Õc i=1 xi(t)hi + nˆ(t). (4) Here, xi(t) is the binary bits sent by tag i over time t. Aejβ represents the leakage signal from the reader. hi is the channel coefficient of tag i and can be written as: hi = Bie j(2π fl t+θi+β)) , (5)