Haoze Chen

The real-time knowledge of mmWave device orientation offers dual benefits for wireless networks and Internet of Things (IoT) applications: it enhances communication and localization performance through link diagnosis, and it enables context inference with asset and wearable tracking. This article presents metasurface-assisted polarization sensing (MetaPol), a novel system architecture that augments commodity mmWave access points (APs) with a carefully designed ultralow-cost anisotropic metasurface to noninvasively extract the orientation of client devices, without hindering data reception or modifying hardware. MetaPol leverages the polarization of transmitted electromagnetic (EM) waves as an accurate indicator of the orientation of linearly polarized antenna arrays, prevalent in commercial mmWave mobile and IoT devices. Yet, polarization sensing is rarely supported by commodity APs due to the need for two orthogonally polarized antenna arrays to capture the incident electric field. Instead, MetaPol creates virtual polarization channels to characterize impinging electric fields, through the conversions of wave polarization on the fly as it interacts with the metasurface. To design MetaPol, we model and exploit the properties of a unique anisotropic metamaterial based on C-shaped split-ring resonators (SRRs). We discover that, when grouped in certain configurations, these meta-elements can convert the incident polarization in a deterministic way. We show that three polarization channels are sufficient for unambiguous orientation sensing, and we provide a corresponding three-shot noncoherent protocol that extracts user orientation by comparing the power received from distinct surface areas. Through extensive over-the-air experiments with more than 1000 measurements in the mmWave band, we demonstrate that MetaPol achieves a mean error of 2.6° across practical settings with negligible compromise to the underlying data communication link.

MmWave antenna array calibration is a necessary yet tedious and costly process in manufacturing to capture the non-idealities in phased arrays, in order to obtain codebooks for accurate and stable beam steering. Unfortunately, predefined codebooks provided by manufacturers to steer beams in a given set of directions do not support the arbitrary beam shapes required for various mmWave communication, sensing, and security applications. To create arbitrary beam patterns, one needs to first find the unknown calibration vector for the particular phased array in use. In this paper, we introduce EiCal, a novel zero-shot technique that leverages the beamforming codebook advertised by the manufacturer to extract the calibration vector at zero cost (i.e., with no additional measurements). The key idea is that the unknown desired calibration vector can be obtained via an appropriately designed eigen-decomposition of the given codebook. We experimentally demonstrate the efficacy of EiCal on a 60 GHz mmWave array for two scenarios: angle estimation using compressive pseudorandom beams, and simultaneous steering of beams and nulls. Our results also point to potential simplifications in the calibration process at the manufacturer.

Reconfigurable surfaces enable on-demand manipulation of electromagnetic wave properties in a controllable manner. These surfaces have been shown to enhance mmWave wireless networks in many ways, including blockage recovery. In this paper, we investigate the security vulnerabilities associated with the deployment of reconfigurable surfaces, i.e., an adversary may deploy new rogue surfaces or tamper with already-deployed surfaces to maliciously engineer the reflection pattern. In particular, we introduceMetasurface-enabled Sideband Steering (MeSS), a new metasurface-in-the-middle attack in which the spectral-spatial properties of the reflected wavefront are manipulated such that a concealed sideband channel is created in the spectral domain and steered toward the eavesdropper location, while maintaining the legitimate link toward the victim intact. We fabricate a custom reconfigurable surface prototype and evaluate MeSS through theoretical analysis as well as over-the-air experiments at the 60 GHz band. Our results indicate that MeSS significantly reduces empirical secrecy capacity (up to 81.7%) while leaving a small power penalty at the victim that can be masked under normal channel fluctuations.