Low Earth Orbit (LEO) satellite communication is essential for wireless communication. While manufacturing and launching LEO satellites have become efficient and cost-effective, ground stations remain expensive due to complex designs for handling severe path losses and precise beam tracking. Hence, it is important to develop low cost and high-performance ground stations for widespread adoption of LEO satellite communication. Towards realizing this goal, we design a passive metasurface-enhanced LEO ground station system, named PMSat, combining metasurface's fine-grained beamforming capability with a small-size phased array's adaptive steering and focusing. For uplink, we jointly optimize the phase array codebook and uplink metasurface phase profile, and realize electronic steering by switching the codeword. We further jointly optimize the downlink metasurface phase profile to improve the focusing performance and enhance the received signal strength (RSS) over a wide range of incident angles. Our PMSat prototype consists of a single passive metasurface with 21 × 21 elements for uplink and 22 × 22 for downlink, along with 1 × 4 receiving and 1 × 4 transmitting phased array antennas. The effectiveness of our proposed PMSat is validated through extensive experiments, and results demonstrate that the optimized metasurface improves the SNR by 8.32 dB and 16.57 dB for uplink and downlink, respectively.

We propose here a fully-passive wireless liquid sensor using a harmonic transponder, which comprises a dual-band microstrip antenna reconfigured by different types of liquids injected in a fluidic cavity. Different from traditional radio-frequency (RF) backscatter sensors, the proposed harmonic-transponder sensor (or harmonic sensor) receives frequency-hopped RF monotones and backscatters their second harmonics, with the peak frequency shifted by dielectric properties of liquid mixtures. This microstrip antenna has a hybrid-feed structure, of which an outer split-ring patch exhibits a narrow-band TM ₃₁₀ mode at the fundamental frequency ( ${f}_{0}$ ) and an inner elliptical patch displays a wideband resonance centered at the second-harmonic frequency ( $2{f}_{0}$ ), achieved with hybridization of TM $_{e110}$ and TM $_{o110}$ modes. In particular, the outer split-ring patch is loaded with a fluidic channel system to tune the resonance frequency of the TM $_{3}10$ mode ( ${f}_{0}$ ). We demonstrate that the type of liquid mixture filling in the fluidic cavity can be clearly perceived by reading the peak received signal strength indicator (RSSI) in the spectrum of second harmonics. Our results show the potential for deploying this passive wireless sensor in noisy environments that include clutters, multiple reflections, jamming, and crosstalks.

Eavesdropping on human voice is one of the most common but harmful threats to personal privacy. Glasses are in direct contact with human face, which could sense facial motions when users speak, so human speech contents could be inferred by sensing the movements of glasses. In this paper, we present a live voice eavesdropping method, RF-Mic, which utilizes common glasses attached with a low-cost RFID tag to sense subtle facial speech dynamics for inferring possible voice contents. When a user with a glasses, which is attached an RFID tag on the glass bridge, is speaking, RF-Mic first collects RF signals through forward propagation and backscattering. Then, body motion interference is eliminated from the collected RF signals through a proposed Conditional Denoising AutoEncoder (CDAE) network. Next, RF-Mic extracts three kinds of facial speech dynamic features (i.e., facial movements, bone-borne vibrations, and airborne vibrations) by designing three different deep-learning models. Based on the extracted features, a facial speech dynamics model is constructed for live voice eavesdropping. Extensive experiments in different real environments demonstrate that RF-Mic can achieve robust and accurate human live voice eavesdropping.

Global Navigation Satellite System (GNSS) is extensively utilized for outdoor positioning and navigation. However, achieving high-precision indoor positioning is challenging due to the significant attenuation of GNSS signals indoors. To address this issue, we propose an innovative indoor GNSS positioning system called GPMS, which uses passive metasurface technology to redirect GNSS signals from outdoors into indoor spaces. These passive metasurfaces are strategically optimized for indoor coverage by steering and scattering the GNSS signals across a wide range of incident angles. We further develop a novel localization algorithm that can determine which metasurface the signal goes through and localize the user using the set of metasurfaces as anchor points. A distinct advantage of our localization algorithm is that it can be implemented on existing mobile devices without any hardware modifications. We implement the prototype of GPMS, and deploy six metasurfaces in two indoor environments, a 10×50 m² office floor and a 15×20 m² lecture room, to evaluate system performance. In terms of coverage, our GPMS increases the C/N0 from 9.1 dB-Hz to 23.2 dB-Hz and increases the number of visible satellites from 3.6 to 21.5 in the office floor. In terms of indoor positioning accuracy, our proposed system decreases the absolute positioning error from 30.6 m to 3.2 m in the office floor, and from 11.2 m to 2.7 m in the lecture room, demonstrating the feasibility and benefits of metasurface-assisted GNSS for indoor positioning.

Acoustic imaging is attractive due to its ability to work under occlusion, different lighting conditions, and privacy-sensitive environments. Existing acoustic imaging methods require large transceiver arrays or device movement, which makes it challenging to use in many scenarios. In this paper, we develop a novel acoustic imaging system for low-cost devices with few speakers and microphones without any device movement. To achieve this goal, we leverage a 3D-printed passive acoustic metasurface to significantly enhance the diversity of the measurement data, thereby improving the imaging quality. Specifically, we jointly design the transmission signal, transceivers' beamforming weights, metasurface, and imaging algorithm to minimize the imaging reconstruction error in an end-to-end manner. We further develop a scheme to dynamically adapt the imaging resolution based on the distance to the target. We implement a system prototype. Using extensive experiments, we show that our system yields high-quality images across a wide range of scenarios.

Eavesdropping on human sound is one of the most common but harmful ways to threaten personal privacy. As one of the most essential accessories, headsets have been widely used in common online conversations, such as online calls, video meetings, etc. The metal coil vibration patterns of headset speakers/microphones have been proven to be highly correlated with the speaker-produced/microphone-received sound content. This paper presents an online conversation eavesdropping system, RFSpy, which uses only one RFID tag attached on a headset to alternately sense the metal coil vibrations of headset speaker and microphone for eavesdropping on speaker-produced and microphone-received sound. In some accessible scenarios, such as meeting rooms, offices, etc., assuming attackers secretly attach a small, battery-free RFID tag under one ear cushion of an eavesdropped user's headset without being noticed. Meanwhile, RFID readers are camouflaged as decorations placed in/out of rooms to transmit and receive RF signals. When the eavesdropped user talks with other users online by using the headset, RFSpy first activates the RFID tag attached on the headset to capture the metal coil vibration patterns of headset speaker and microphone upon RF signals. Then, RFSpy reconstructs sound spectrograms from the RF signal-based vibration patterns for not only trained words but also untrained (i.e., out-of-vocabulary) words by utilizing a designed Sound Spectrogram Reconstruction (SSR) network. Finally, RFSpy converts the sound spectrograms to conversation content through a sound recognition API. Extensive experiments in real environments demonstrate that RFSpy can eavesdrop on online conversations with out-of-vocabulary (OOV) words effectively.