IEEE/ACM TRANSACTIONS ON NETWORKING 1

Acquiring Bloom Filters across Commercial RFIDsin Physical Layer

Zhenlin An, Student Member, IEEE, Qiongzheng Lin, Member, IEEE Lei Yang, Member, IEEE,Wei Lou, Member, IEEE and Lei Xie, Member, IEEE

Abstract—Embedding Radio-Frequency IDentification (RFID)into everyday objects to construct ubiquitous networks has beena long-standing goal. However, a major problem that hinders theattainment of this goal is the current inefficient reading of RFIDtags. To address the issue, the research community introducesthe technique of Bloom Filter (BF) to RFID systems. This workpresents TagMap, a practical solution that acquires BFs acrosscommercial off-the-shelf (COTS) RFID tags in the physical layer,enabling upper applications to boost their performance by ordersof magnitude. The key idea is to treat all tags as if they werea single virtual sender, which hashes each tag into differentintercepted inventories. Our approach does not require hardwarenor firmware changes in commodity RFID tags - allows forrapid, zero-cost deployment in existing RFID tags. We design andimplement TagMap reader with commodity device (e.g., USRPN210) platforms. Our comprehensive evaluation reveals that theoverhead of TagMap is 66.22% lower than the state-of-the-artsolution, with a bit error rate of 0.4%.

Index Terms—RFID; Bloom Filter; Physical layer

I. INTRODUCTION

Today’s largest and fastest growing market of the Internetof Things (IoT) by unit sale comes from the Radio FrequencyIDentification (RFIDs) [1]. In RFID systems, a device calledthe reader transmits a continuous high-power RF signal.Nearby tags can modulate the reader’s signal by changingthe impedance match state of antenna to convey a messageof zeros and ones back to the reader. Such communicationallows tags to work without batteries; they operate solely byharvesting the energy from reader’s RF signal [2].

A fundamental operation in RFID systems is to scan andread 96-bit or 128-bit Electronic Product Codes (EPCs, akaID) from tags, wherein time efficiency is a crucial performancemetric, especially when dealing with large volumes of RFIDtags. Many RFID-based applications like sensing [3] andlocalization [4] also highly rely on reading rates. The challengeis that tags can collide and cancel each other out, resultingin wastage of bandwidth and an increase in the total delay.Many existing work made efforts to design more efficientanti-collision inventory protocols [5]–[13]. However, the lackof traditional transceivers [2] prevents tags from utilizinga suitable channel to transmit additional bits per symboland increasing the bandwidth efficiency. Other sophisticated

Lei Yang and Lei Xie are the co-corresponding authors. Zhenlin An,Qiongzheng Lin, Lei Yang and Wei Lou are with the Department of Comput-ing, The Hong Kong Polytechnic University, Hong Kong SAR, China, e-mail:{an, young, lin}@tagsys.org, csweilou@comp.polyu.edu.hk. Lei Xie is withthe State Key Laboratory for Novel Software Technology, Nanjing University,e-mail: lxie@nju.edu.cn.

0 1 0 0 1 0 1 1 0 1 0 0

t1 t2 · · · · · ·

1 2 3 4 5 6 7 8 9 10 11 12

Reader h1(t1) h2(t1)h3(t1)

h2(t2)h2(t2) h3(t2)

(a) Acquisition of a Bloom filter

0 1 0 0 1 0 0 1 0 1 0 1

t1 t2 · · · · · · tn+1

1 2 3 4 5 6 7 8 9 10 11 12

Acquired BF:

(b) Presence test with an acquired BF

Fig. 1: Acquisition of a Bloom filter in an RFID system. (a)Initially, the M -bit BF bitmap begins as an array of zeros. The readerdivides the acquisition procedure into M time slots corresponding tothe M bits. Each tag in the set T = {t1, t2, . . . , tn} is hashed Ktimes using the hash functions of {h1, h2, . . . , hK} into K slots,in each of which the tag yields a short presence signal to show itspresence. The reader sets a bit to 1 if any signal is detected in thecorresponding slot. (b) To check if a tag is present, hash it K timesand check the corresponding bits in the acquired BF. For example,the t2 cannot be on the spot, since a ‘0’ is found at one of the bits;a new tag (e.g., tn+1) must arrive since unwanted ‘1’ is found.

communication mechanisms (e.g., CDMA or FDMA [14],[15]) are unsuitable due to their high energy demand. Worsely,tags merely rely on the reader to schedule their medium accesswith the framed-slotted ALOHA protocol because they cannot“hear” from each other. These limitations force the reader togo through a time-consuming inventory procedure.

To address the issue, the research community introduces thetechnique of Bloom Filter (BF) to RFID systems [16]–[33].Unlike previous anti-collision protocols that avoid collisions,these works embrace collisions as informative feedbacks. ABloom filter is a space- (or time-) efficient probabilistic datastructure that is used to represent a set. It can tell whetheran element is a member of the set that it represents. Fig. 1demonstrates how the reader acquires a BF across tags andhow the acquired BF is utilized to test the presence of a tag.The upper layer can employ the acquired BF to explore manynotable applications. For example, consider a warehouse thatstores a large number of high-valued commercial productsor a military base that stocks a large number of guns andammunition packages [16]. How can a staff immediatelydetermine if anything is missing? The BF naturally fits thedemand of this application because it is an exact representationof the current tag set. Specifically, all tags are hashed K times

IEEE/ACM TRANSACTIONS ON NETWORKING 2

and the corresponding bits in the acquired BF are verified.One tag is considered to have been definitely moved out ormissing when a ‘0’ is found; otherwise, it is assumed to bestill present, although this assumption may be incorrect witha low probability.

Yet, RFID-oriented protocols or applications that appeal toBFs are actually NOT available to today’s RFID systems,because translating the idea of acquiring BFs across RFIDsinto a practical system faces three major challenges:• First, the primary challenge arises from the hardware con-

straint. The core of BF is the on-tag hash functionality,which allows each tag to select time slots according tothe hash value of its EPC, making results predicable -exactly knowing which bits a desired tag is mapped into.Current pseudo-random generators of tags cannot meet thedemand of predictability. One option is to supplement newlydesigned hash functions to tags [34]–[41]. However, theyrequire new hardware (thousands of gate equivalents [42])for RFID tags, making them significantly more expensive.

• Second, transmitting and receiving presence signals is non-compliant with today’s RFID air protocols. These non-standard operations would leave out the billions of RFIDsalready deployed in the today’s world, some of which wereeven installed a decade ago.

• Third, our prior work named Tash [43] takes a step towardsdesigning hash primitives in the application layer, whichmight be explored for our purpose. Unfortunately, applica-tions have no control of the physical-layer inventory proce-dure. Thus the application-layer Tash still requires the time-consuming anti-collision processing, without unleashing fullefficiency potentials of embracing collisions.In this work, we present TagMap, a practical solution that

acquires BFs across commercial off-the-shelf (COTS) RFIDtags in the physical layer, enabling upper applications to boosttheir performance by orders of magnitude. TagMap introducesmultiple innovations that enable it to deal with the abovechallenges. First, TagMap shifts the computation loads forhashing from tag side to the reader side by an emulated hashfunction. Specifically, it pre-stores the hash values of tags’EPCs inside their memory banks. When running, it treats aportion of the pre-stored hash values as a new hash value.Second, for each bit of a BF, TagMap reader initiates anintercepted inventory, which forces all tags that are hashedinto this bit to transmit their RN16 replies in the first singleslot. It regards a detected RN16 reply as the presence evidenceof a tag and skips the remaining anti-collision phase. Third,TagMap defines the Modulo operation, allowing to acquirearbitrarily sized BFs.

Summary of Results. TagMap offers a new and interestingtradeoff point on the spectrum between feasibility and effec-tiveness. We implement a prototype of the TagMap reader byusing a USRP N210 and 1000 commercial UHF RFID tagsdeployed in our office building. Our experiments reveal thefollowing findings:• TagMap is compatible with the EPCglobal Gen2 protocol

and can serve 97.5% types of commercial tags in today’smarket, even some were deployed 13 years ago.

• TagMap reduces the acquisition overhead by 74.73% and66.22% compared with commercial readers (e.g., ImpinJR420) and Tash [43] respectively. TagMap has a mean biterror rate of less than 0.4%.

• TagMap can accurately find out 97.1 ± 0.4% of missingevents within 2 seconds when 20% of tags are removed,whereas a commercial reader requires more than 15 secondsto know these events.Key Contributions. This work presents a system that can

acquire BFs across COTS RFID tags in the physical layer.Our design presents three key innovations. First, it emulateson-tag hash and modulo functionality; second, it intercepts aninventory to test if any tags are hashed into the correspondingbit; finally, this work also presents a prototype implementationand reveals the utility of BFs in typical application scenarios.

II. MOTIVATION

In this section, we introduce the performance limitations ofthe current RFID systems firstly, and then present two typicalapplication scenarios that show the outperformance of Bloomfilter for RFID systems. Finally, we point out our advantagesover the the state-of-the-art solutions.

A. Performance Bottleneck in Current RFID Systems

One of the key performance indicators for the RFID systemsis the Individual Reading Rate (IRR), which is defined asthe number of readings obtained from a particular tag persecond. IRR highly depends on the efficiency of the anti-collision protocol, which is used to avoid signal collisionsthat occur when multiple tags reply their ID simultaneously.Today’s commercial RFID systems adopt Q-Adaptive protocol,which adjusts the frame adaptively. Specifically, The readerdivides time into several slots, which are further organizedinto frames. As shown in Fig. 2, the reader starts an inventoryby broadcasting a Select command for choosing a group oftags to join in the incoming inventory (select all by default).Then the command Query or QueryAdjust follows to starta new frame, in which each unidentified tag randomly selectsa time slot to reply. The command QueryRep indicates a newbeginning of a slot. During a slot, the tag transmits a 22-bitshort reply (called RN16) firstly for collision detection. Then,either of the following two cases occurs on the reader side:• RN16 is successfully decoded, which indicates that only one

tag was transmitting (i.e., singleton slot). The reader thenrequests its 128-bit long reply (i.e., PC + EPC+ CRC) byissuing an ACK command.

• Otherwise, the situation indicates either a collision or non-reply (i.e., called collision slot and empty slot). In this case,the reader proceeds to the next slot without requesting anylong reply. Thus, singleton slots are longer than other slots.

In the end of each frame, if any collision slot is detected or anylong reply is corrupted, then the reader restarts a new frameusing QueryAdjust for these tags. QueryAdjust is ableto adjust the frame length based on the number of collisionsin the previous frame. This procedure terminates till all tagsare identified.

IEEE/ACM TRANSACTIONS ON NETWORKING 3

Reader Select Query

RN16

ACK

PC+EPC+CRC

QueryRep

RN16Tag 1

1st slot(Collision)

2nd slot(Empty reply) 1st slot

(Successful reply)

1st frame

RN16Tag 2 PC+EPC+CRC

2nd slot(Successful reply)

QueryAdjust QueryRep

2nd frameFiltering

ACK

RN16

Collide slot Empty slotSingleton slot

Singleton slot

Fig. 2: Gen2 inventory procedure. The reader starts an inventory procedure with a Select command, which selects a group of tags tojoin. Each inventory is composed of many frames, which are initiated by either a Query or QueryAdjust command. Further, the readerdivides a frame into many time slots with QueryRep. Tags (e.g., tag 1 and tag 2) randomly selects a time slot to reply. In particular, ashort reply called RN16 must be transmitted for collision avoidance before the transmission of a long reply.

0 5 10 15 20 25 30 35 40Number of Tags(#)

10

15

20

25

30

35

40

45

50

55

Rea

ding

Rat

e(H

z)

TheoryQ=0Q=1Q=2Q=3Q=4Q=5

Q=0

Q=1

Q=5

Q=2

Q=4

Q=3

Theory84% drop

Fig. 3: Individual reading rate. The reading rate decreases as thenumber of tags increases rapidly.1

Empirical Study. In our prior work [44], we practicallymeasure the reading rates of the ImpinJ R420 reader across1 ∼ 40 Alien tags, with various frequencies (920 ∼ 926MHz),including 16 channels. We try 7 settings of Q in the ex-periments where Q is the length of the first frame. Foreach setting, we repeat the experiment 50 times and reportthe average value. The Fig. 3 shows the results. For thesake of comparison, we also presents the theoretical rate ofoptimized ALOHA protocol. Clearly, we wish each tag canbe scanned as many times as possible per second. The studysuggests that the reading rate rapidly decreases by 80% abovewhen the number of tags is more than 30, compared withthe single-tag scenario. This finding shows that the channelcompetitions among tags seriously and significantly degradesthe time efficiency in practice. Meanwhile, we would observethat the current anti-collision algorithm, i.e., Q-adaptive, isalready a good algorithm approaching the optimal solution.Thus, current system leaves very limited space to improve theefficiency by designing better anti-collision protocols underthe rigorous hardware constraint. This is mainly because thetag is battery-free and powerless to support sophisticated anti-collision algorithms.

B. BF-Aware Application Scenario

Why and how would the BF boost the performance of anRFID system? To further derive our design, we show twotypical usage scenarios of BF as follows.

BF-Aware Continuous Scanning. We use the asset man-agement as a typical example, which requires an RFID readerto periodically and continuously scan all of the present RFID

1This figure is from our prior work [44].

tags’ EPCs to maintain a fresh record. With the help of BFs,we can design an incremental scanning algorithm. Initially,the reader collects all tags’ EPCs. In the following inventoryrounds, the reader quickly acquires a BF from these tags only.With the BF, we can check if all the bits that a known tag ishashed into in the acquired BF are set to ‘1’ - a negative resultimplies that the test tag is gone (or missing); or check if new‘1’s emerge - a positive result implies the presence of one ormore new tags. Then, we can dynamically adjust the tag setby removing left tags and/or adding new tags. Note that thenew tags can be selectively read as shown in [45].

BF-Aware Missing Detection. We consider a warehousethat stores a large number of high-valued commercial productsor a military base that stocks a large number of guns andammunition packages [16]. We assume that each object isattached with an RFID tag. To detect missing objects that mayhave been stolen from the warehouse in a timely manner, anRFID reader must periodically scan all of the present RFIDtags to maintain a fresh record. It is reasonable to assumeall EPCs are known ahead of time; otherwise, we cannot tellwhich tag is missing. BF naturally fits such needs because it isan exact representation of the current tag set [19]–[33], [43].We can check if all the bits that a test tag is hashed into inthe acquired BF are set to 1. A negative result implies that thetest tag is missing.

Utilizing BF is time-efficient for two main aspects at least.First, collisions are now allowable and informative, whichimply the presence of the corresponding hashed tags. This re-moves the time-consuming process of dealing with collisions.Second, each tag only requires to transmit a few bits (e.g.,16-bit RN16 in our design) to show its presence instead of awhole 144-bit long reply, saving transmission time by ordersof magnitude for each time slot.

C. Comparison with our Prior Work

This work enhances our prior design [43], which emulatesa group of hash primitives in the application layer. However,our solution is more efficient and practical prior to [43] atleast in two aspects.• Practicality: As an application-layer emulation technique,

Tash highly depends on a Gen2 command, i.e., Truncate,which forces tags to transmit truncated EPCs. These in-complete EPCs are viewed as the presence evidence of

IEEE/ACM TRANSACTIONS ON NETWORKING 4

tags. Unfortunately, to our best knowledge and investigation,we have not found any Truncate-available tags on themarket. Actually, this issue has been claimed in [43]. Thisis also the reason that the performance of Tash [43] relatedto this command is evaluated with simulations, instead ofreal tags. On the contrary, our solution uses RN16 reply aspresence evidence. As a fundamental reply, the RN16 replyis completely serviceable in today’s Gen2 tags.

• Efficiency: The anti-collision processing is actually un-avoidable in Tash, because there is no way to control theinventory procedure in the application layer. No relevantAPIs are provided by commercial readers so far. Our ap-proach intercepts an inventory in the physical layer to skipthe anti-collision processing.

In short, TagMap is highly advantageous due to its physical-layer performance boost and full compatibility with COTStags.

III. OVERVIEW

Although we present our acquisition approach with theEPCglobal Gen2 air interface protocol, which has beenadopted globally, our approach also works with other similarprotocols, such as ISO18000-6C. In this section, we firstlyformulate the Bloom filter and then sketch the overall solution.

A. Formulation of Bloom Filter

A BF represents a set T = {t1, t2, . . . , tn} with n tags. It isdescribed by an array of M bits, which are initially set to 0.We can use K hash functions, {h1, h2, . . . , hK} to map eachtag in the universe to a number within the range {1, . . . ,M}.For each tag t ∈ T , the bits of {h1(t), . . . , hK(t)} are set to1. A bit can be set to 1 multiple times (e.g., collisions), butits value remains 1. To check if a tag t is in T , we check ifall bits of {h1(t), . . . , hK(t)} are set to 1. If not, then t is notin the tag set. If all bits are set to 1, we assume that t is inT , although this assumption may be wrong with sufficientlylow probability, namely, yielding a false positive. The falsepositive rate depends on parameter selection: using many hashfunctions equates to a high probability of finding ‘0’ bits foreach tag that is not in the set; using a few hash functionsincreases the fraction of ‘0’ bits in the map. Here, we presenttwo useful Lemmas as follows:

Lemma 1. Given a tolerance ε (i.e., upper bound of falsepositive rate), BF length M ≥ dn log2 e · log2(1/ε)e =d1.44n log2(1/ε)e.Lemma 2. The false negative rate is minimized whenthe number of hash functions K = dln 2 · (M/n)e =d0.9981 log2(1/ε)e.

Their proofs are similar in nature to the standard analysisof the Bloom filter as shown in [46]. The number of tags n isassumed to be known already. It can be discovered through apreliminary inventory or stored in backend.

Intercepted Inventory · · · Intercepted

Inventory

Select Query RN16Select· · · ⌧2 ⌧3

K

⌧1 ⌧1

0 1 0 1 0 1 0 0

Intercepted Inventory · · ·

M

BF bitmap:

Fig. 4: Acquisition solution. To acquire an M -bit BF, TagMapreader initiates M intercepted inventories, each of which containsK Selects, one Query and a time window for RN16 reply.

B. Solution Sketch

The features and usage of the Bloom filter have been widelystudied in various fields [46]. They are not our focus in thiswork. Instead, we more concern about the way to acquire aBF across RFID tags, which must be tightly integrated withthe standard EPCglobal Gen2 RFID air protocol [47], makingbillions of tags serviceable. The whole solution consists of twophases as follows:• In offline phase, we compute the hash value of each tag’sEPC and store it inside the tag’s non-volatile memory bankfor future use. The storing can be accomplished by usingthe standard Gen2 command of Write. This phase is onlyinitiated once. For example, it is initiated when the userwrites EPCs to tags.

• In online phase, the reader acquires a BF bit by bit. TheTagMap reader initiates an intercepted inventory for eachbit. The inventory is used to answer the question of presencethat if any tag is hashed into the corresponding bit. If answeris positive, the bit is set to one; otherwise, it is set to zero.Fig. 4 shows the acquisition procedure from a high-level.

To acquire an M -bit BF, the reader initiates M interceptedinventories, each of which corresponds to a bit in the BF. Ineach inventory, the reader broadcasts K Select commandsand one Query command; the tags matching the hash rulesare forced to transmit their RN16 replies in the first slot. Inthe end of the intercepted inventory, the reader determines thevalue of the corresponding bit.

IV. ACQUISITION OF BLOOM FILTER

In this section, we introduce the technical details ofTagMap.

A. TagMap in a Nutshell

The subsequent sections progressively introduce the acqui-sition approach by discussing the following issues:• Emulating hash function. Commercially available tags at

present do not support hash functions. Thus, our first task isto emulate a hash function that works as if it was embeddedon each tag.

• Answering the question of presence. With the emulated hashfunctions, a TagMap reader initiates an intercepted inventoryto suggest whether any tag that can output a given hash valueis present or not.

IEEE/ACM TRANSACTIONS ON NETWORKING 5

Tag Memory Model

0 1 1 1 0 1 0 1 1 1 0 0 0 1 1 0 H(t)

1 0 1 0 1 1 1 0 1 1 0 1 0 0 1 0 tMemBank1:

MemBank3:

10102

1 0 1 0

l = 4

bitmaskr = 5

r = 5, l = 4

Fig. 5: Illustration of a hash function. The figure shows a tag’s twomemory banks: MemBank1 and MemBank3, which store the tag’sEPC t and the real hash value H(t) respectively. Given an input ofr = 5 and l = 4, the output of h(4)(t, 5) equals 10102, which exactlyis the sub-bitstring of H(t) within [5, 9) bits stored in MemBank3.

• Acquiring a Bloom filter. Finally, we show how the readerbuilds a whole BF bit by bit through a series of interceptedinventories in three cases.

Next, we introduce these issues with details.

B. Emulating Hash Functions

A hash function, denoted by h(l)(t, r), outputs an l-bit hashvalue when given a tag’s EPC t and a random number r. Ittakes three inputs: (1) an lt-bit tag’s EPC number t; (2) anlr-bit random number r; and (3) the bit length of the hashvalue l. Formally,

h(l)(t, r) : {0, 1}lt × {0, 1}lr → {0, 1}l (1)

where l is also called the dimension of the hash function. Theoutput is randomly distributed in [0, 2l). Following a commonpractice, we create K hash functions by shuffling the outputusing K different random numbers. The kth hash function isdenoted by h(l)k (t, rk). The superscript l is sometimes omitted,such as h(t, rk), hk(t) or hk, for clarity unless it should benoted.

Memory Banks. Before introducing the hash design, weneed to introduce some background about the memory bankof tag. The Gen2 air protocol specifies a simple tag memorymodel: each tag contains four types of non-volatile memoryblocks (called memory banks). The first three banks are usedto store the password, EPC number and TID number. The lastmemory bank (MemBank3) is reserved for user-defined data.Fig. 5 demonstrates the first and the third memory bank. TheRead or Write commands are used to read or write datafrom or into these banks respectively.

Hash Function. Initially, we compute the real hash value(denoted by H(t)) of a tag’s EPC by using SHA-1 for tag t,and then store H(t) in the tag’s MemBank3 for future use.Note both operations are performed once in the offline phase.We define a tag’s sub-bitstring within [r, r+ l) in MemBank3as its l-bit hash value challenged by the random number r.In other words, our hash value h(l)(t, r) is a portion of H(t)stored in MemBank3. Fig. 5 demonstrates the relation betweenthe real hash value and our hash value, where the tag’s 4-bithash value h(4)(t, 5) = 10102 (the (·)2 means a value in binaryformat.). Clearly, our design does not require a tag to equip areal hash function or gets its chip involved.

Discussion. Evidently, h(l)(t, r) is random and its random-ness is derived from H(t), which is supposed to have good

MemBank3

Reader Tags

Select

0 1 0 1 1 1 0 0

1 1 1 1 0 1 0 0

0 1 1 1 1 1 0 0

0 1 1 1 0 1 1 0

0 1 0 1 1 1 0 0

0 1 0 0 1 0 0 0

1 1 1 0 1 1 0 0

Select

t1t2t3

t4 t5t6 t7

Pointer = 4

Length = 3

Mask = 1102

S(4, 3, 1102)

Select Query RN16ReaderTime

Fig. 6: Illustration of selective reading in Gen2 protocol. 7 tagsare covered by a reader. The reader initiates a Select commandS(4, 3, 1102). As a result, tags of t2, t3, t5 and t6 (highlighted inred) are only selected to join in the incoming inventory because theirMemBank3s’ sub-bitstring (highlighted in red) within [4, 7) equals1102. Other tags do not meet the condition and remain silent.

0 2 4 6 8 10 12 14 16 18Time (ms)

0

0.2

0.4

0.6

0.8

1

1.2

Ampl

itude

(v)

Intercepted inventory

Select Query RN16

Preamble

⌧2 ⌧3⌧1

READER

TAG RN16P

Select Query Select

Time slot

Fig. 7: Baseband signals of an intercepted inventory. The inventorycontains a Select, a Query and an RN16 reply. τ1, τ2 and τ3 arekey timing parameters, which are specified in the Gen2 protocol.The reader detects the presence of RN16 reply to determine if anytag responds.

quality of randomness at each bit. If the upper applicationneeds a stronger randomness, one could store a truly ran-dom bitstring in the MemBank3 rather than the real hashvalue, meanwhile save the mapping between the EPC and thebitstrings in database for future query. In addition, to avoidthe dependence of K hash values, one can tactfully chooser1, . . . , rK such that [r1, r1 + l) ∩ · · · ∩ [rK , rK + l) = ∅.Secondly, The computation of H(t) is performed in a hostcomputer rather than on tags, so its workload is almostneglected. Storing H(t) is also performed once until the tag’sEPC is changed, which is unlikely to happen often in practice.Although writing data into memory bank usually takes a longertime than reading them, the writing is performed in offlinephase thereby its workload is not counted into the acquisitionoverhead. Thirdly, A possible concern is if today’s RFID tagsin the market can serve our design in terms of the operabilityof MemBank3. We investigate 40 tag chips from ImpinJ [48],Alien [49] and NXP [50], whose total market share exceeds80% [1]. The investigation result suggests that TagMap iscompletely compatible with the EPCglobal Gen2 air protocoland can serve 97.5% types of tags, except those that are read-only(More details refer to Sec.VI.).

C. Answering the Question of Presence

A simple way to obtain a tag’s hash value is to Readthe corresponding sub-bitstring from its MemBank3. However,

IEEE/ACM TRANSACTIONS ON NETWORKING 6

500 1000 1500 2000 2500Samples#

0.98

0.985

0.99

0.995

1

1.005

1.01

1.015

1.02

Am

plitu

de

Samples Offset

=1

(a) RN16

500 550 600 650 700 750 800 850Samples#

-2

-1

0

1

2

Am

plitu

de

Acuqired Desired

(b) Preamble

Fig. 8: Baseband signals of RN16 reply. (a) shows the signalsof a RN16 reply, which is composed of a 5-bit preamble and 16random bits. (b) shows zoomed-in preamble and its comparison withthe desired template.

keep in mind that our ultimate goal is to acquire a BF across alltags instead of their hash values. Here, we consider a question,named question of presence, that is, is there any tag whichcan output a wanted hash value? Formally, given the inputpair (r, l) and the hash value v, we determine if

∣∣∣{t|h(l)(t, r) = v}∣∣∣ > 0

for all t ∈ T , where | · | denotes the cardinality of a set. Sinceour hash value is a portion of the real one stored in a tag’sMemBank3, the question can be converted to a new form:

Problem 1. Is there any tag whose sub-bistring ∈ [r, r + l)in its MemBank3 is equal to v?

Selective Reading. Any inventory procedure must be startedwith a Select command. Gen2 protocol specifies thateach tag maintains a flag variable SL. The reader can usethe Select command to turn the SL flags of tags intoasserted (i.e., true) or deasserted (i.e., false). Only theasserted tags will respond to a Query (or QueryAdjust)command, participating the inventory. The Select commandis composed of 8 fields. For simplicity, we only introduce thefour fields, which will be employed in our design: MemBank,Pointer, Length and Mask.• Mask: it is a specific bitstring that should match the content

of a specific position in a MemBank.• Length: it defines the length of the mask in bits.• MemBank: it specifies which memory bank the mask will

be compared with. We consider MemBank3 only by defaultin our scenario.

• Pointer: it specifies the starting position in the MemBank

where the mask will be compared with.

These fields are combined to compose a selection rule. Weformally denote the rule as follows:

S( p︸︷︷︸Pointer

,

Length︷︸︸︷l , m︸︷︷︸

Mask

)

which implies that only tags whose MemBank3s’ sub-bitstring∈ [p, p + l) is equal to m will be selected. Fig. 6 shows anexample in which four tags are selected to join in the inventory.Note that multiple Selects are allowable (discussed later).

Intercepted Inventory. The function of selective readingoffers an opportunity to select the tags based on a mask. Ifthe reader broadcasts the following Select,

S(r, l, v)

, then only the tags whose sub-bitstring ∈ [r, r + l) in itsMemBank3 is equal to v, are selected to participate in theincoming inventory. Interestingly, the set of selected tagsexactly fit the question of presence! To know if its cardinalityis greater than zero, we let the reader afterwards broadcasta Query command to start a single-slot frame, by settingthe field of frame length to 1. All selected tags are forced toreply in the following slot immediately. As aforementioned,a tag must transmit an RN16 reply firstly before sending itsEPC reply. Our trick here is that the RN16 reply is regardedas the presence evidence of a tag, which has the given hashvalue. As long as the reader detects any RN16 reply signal,the answer to the question of presence is negative. Finally,the reader ignores the request of long reply even if a singletag responds and terminates the inventory procedure. We callthe above procedure intercepted inventory. The inventory is“intercepted” because an intact inventory is supposed to ACKthe tag’s RN16 reply and request the long reply subsequently(see Fig. 2). In contrast to the entire inventory, the intervalof an intercept inventory is kept constant regardless of howmany tags participate the procedure. Fig. 7 shows the basebandsignals of an intercepted inventory acquired by USRP N210.

Detecting Presence Signals. Each 22-bit RN16 reply con-tains a 6-bit preamble and 16 random bits. The reader candetect an RN16 reply by correlating its preamble templatewith the received signals. Considering that the 16-bit randomsignals are independent of the preamble, their correlation isnearly zero except when the preamble is perfectly aligned withthe beginning of an RN16. One or multiple spikes appearing atthe correlation result indicate the presence of one or multipletags possessing the given hash value. Fig. 8(a) shows anexample of RN16 reply sent from a single tag. Fig. 8(b) zoomsinto its preamble compared with the template. It is worthnoting that the final received signal is a combination of theline-of-sight propagation, the repetitive proportions from othernone-ling-of-sight paths, and the leakage of the continuouswave from the reader. The signals arrive at the receiverdifferent phase values due to the diversity of the propagationdistances. As a result, they might add up constructively ordestructively. In the second case, the received signal might beweaker than the power of reader continuous wave.

IEEE/ACM TRANSACTIONS ON NETWORKING 7

0 5 10 15 20 25 30Time(ms)

0.35

0.4

0.45

0.5

Amplitude

1 1 0 0 1 0 0 00 1 2 3 4 5 6 7

t3 t2

Query

Select

RN16 t1, t4

BFIndex

Fig. 9: Baseband signals of acquiring an 8-bit BF across 3 tags. The bitmap totally contains 8 bits, each of which corresponds to anintercepted inventory. The three tags reply in the 1st, 2nd and 5th inventory respectively, so the final BF equals [1, 1, 0, 0, 1, 0, 0, 0].

D. Acquiring a Bloom Filter

So far, we have discussed how the TagMap reader deter-mines if any tag outputs a given hash value. Now, we start toacquire a whole BF by considering three cases progressively:

1) Case 1: Acquisition with a Single Hash: We firstlyconsider a simplified case, namely, acquiring a 2l-bit BF usinga single hash function: h(l)(t, r). Correspondingly, the bitmapsize M = 2l. The definition of hash bitmap indicates that: atag t is hashed into the mth bit of the bitmap if and only ifh(l)(t, r) = m for t ∈ T , where m = 0, . . . ,M − 1.

Namely, the index of the bitmap actually implies the hashvalue. We build a BF bit by bit, traversing the index from 0to M − 1. When building the mth bit, we ask the question ofpresence like this: is there any tag whose hash value is equalto m? To do so, the reader initiates an intercepted inventorywith the Select command of S(r, l,m). If the answer ispositive, the mth bit of the BF is set to ‘1’; otherwise, ‘0’.This procedure continues until M bits are all traversed.

Fig. 9 shows the baseband signals of acquiring an 8-bit BFacross 3 tags. From the figure, we can observe 8 interceptedinventories. Zooming into any one of them, three distinctsegments - Select, Query and RN16 - can be observed,exactly as same as a single intercepted inventory shown inFig. 7.

2) Case 2: Acquisition with K Hashes: Secondly, weconsider to acquire a 2l-bit BF using K hash functions:h(l)(t, r1), . . . , h

(l)(t, rK). In this case, the mth bit is set to‘1’ when any one tag is hashed into the bit by any one of theseK hash functions. Correspondingly, the question of presenceturns to∣∣∣{t|h(l)(t, r1) = m|| . . . ||h(l)(t, rK) = m}

∣∣∣ > 0

for all t ∈ T . With regard to our hash function, the questioncan be expressed as follows:

Problem 2. Is there any tag whose sub-bitstring ∈ [r1, r1 +l − 1), . . . , or ∈ [rK , rK + l − 1) in its MemBank3 is equalto m?

Since each range corresponds to a Select, answering theabove question requires K Selects. The result of multipleSelect commands is a union of the selected tags: if a tag’sSL variable is asserted multiple times, then the final valueremains asserted. The consequence is equivalent to combiningthe sets of selected tags. This is exactly the answer to theabove question of presence. Therefore, for the mth bit, the

26 28 30 32 34 36Time (ms)

0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

Ampl

itude

Select Select

RN16

Query Select Select Query

RN16

Intercepted Inventory Intercepted Inventory

Fig. 10: Acquiring an BF with 2 hashes. There are two interceptedinventories. The baseband signals fo each inventory contains twoSelects’ signals before the Query signals.

reader initiates an intercepted inventory, which contains KSelects as follows:

S(r1, l,m), S(r2, l,m), . . . , S(rK , l,m) (2)

Similarly, if any RN16 signal is detected after the Query, thecorresponding bit is set to ‘1’. Fig. 10 shows the baseband sig-nals of two consecutive intercepted inventories when acquiringa BF with 2 hashes. From the figure, we can exactly observetwo Select commands before the Query in an interceptedinventory.

3) Case 3: Acquisition with Arbitrary Size: The first twocases consider to generate BFs with size of M = 2l bit.The size M is a key parameter that directly determinesacquisition overhead, and thereby should be well optimized.Lemma 2 implies the minimal (and optimal) size. Apparently,the minimal size of BF might not be exactly an exponent of2. On the other hand, the hash values are stored in a binaryformat in the memory bank, so l must be an integer. As aresult, the actual size M has to be set to 2l and l = dlog2 Mesuppose M is the optimal size, such that M ≥ M and l isan integer. This setting is valid but might be extremely costly.For example, suppose the optimal size M = 257, we have toset actual size M = 2dlog2 257e = 512, which is almost doublethan the optimal one.

To enable an arbitrary size, we define the operation ofmodulo to shrink the size, as used in other applications [46].Apparently M ≥ M . Traversing the mth hash value wherem = 0, . . . ,M − 1, the reader forces tags hashed into mth

bits to reply at the

hl(t, r) mod M (3)

IEEE/ACM TRANSACTIONS ON NETWORKING 8

0 1 0 0 1 0 0 1 0 1 0

1

0 1 2 3 4 5 6 7 8 9 10

0 1 0

11 12 13 14

1 0 1 0 0

11 12 13 14 15

0

15Moving forward

Truncated bits

M bits

cM bits

Fig. 11: The design of modulo. Suppose the optimal size of theBF is 11, the reader builds 2dlog2 11e = 16 bit BF and moves the last5 bits to align with the first five.

-th intercepted inventory. In other words, if a tag is supposedto be hashed into the bit greater than or equal to M , thenthe tag is moved to reply at (m modM)th bit-inventory. Asillustrated in Fig. 11, the modulo moves the replies at thebits equal to or greater than M ahead to align with the firstbits. Correspondingly, the question of presence turns to:

Problem 3. Is there any tag whose sub-bitstring ∈ [r1, r1+l),. . . , or ∈ [rK , rK+l) in its MemBank3 is equal to m, m+M ,m+ 2M , . . . , or m+ bM

McM?

Therefore, for the mth bit, the reader initiates an interceptedinventory, which contains multiple Selects as follows:

S(r1, l,m), S(r2, l,m), . . . , S(rK , l,m)

. . . . . .

S(r1, l,m+ bM

McM), S(r2, l,m+ b

M

McM), . . . , S(rK , l,m+ b

M

McM)

It is worthing noting the modulo operation would increasethe number of tags hashed into the head bits, breaking therandomness of BF. If the upper-layer application requires astrong randomness, a good way is to move truncated bit (i.e.,indexes ≥ M ) forward to a random index less than M whilethe reader labels the mapping between the tags and bits so theapplication can predicate the hashing.

V. ANALYSIS

In this section, we give a comprehensive theoretical analysison the performance of TagMap compared with the traditionalQ-Adaptive protocol.

A. Overhead Analysis on Q-Adaptive Protocol

As aforementioned, the current mainstream RFID readersuse the Q-Adaptive protocol to collect all tags’ EPCs. TheQ-Adaptive is a variant of framed slotted ALOAH (FSA)protocol. Unlike the traditional FSA, it attempts to adjust theframe length adaptively to maintain a high probability that atag is successfully identified in a frame. We have already giventhe theoretical analysis of Q-Adaptive in our prior work [45].For clarity, we directly present the result as below.

Lemma 3. The protocol of Q-Adaptive requires aboutne ln(n) time slots to collect n tags’ EPCs in an optimalcondition.

The proof of the above lemma can be referred to our priorwork [45]. Specifically, keeping the optimal frame length,the protocol must start a new frame anytime when a tag

is identified. Thus, the whole procedure totally contains nframes, n long slots, and ne ln(n)− n short slots. As shownin Fig. 2, a long time slot in which only a single tag intendsto transmit is EPC, is reserved for the transmissions of aQueryAdjust, an RN16, an ACK, and an EPC; a short timeslot in which no tags respond or multiple tags’ signals arecollided, is reserved for the transmissions of a QueryAdjustand an RN16. Thus, the totally time overhead taken by Q-Adaptive, denoted by CQ-Adaptive, can be computed as follows:

CQ-Adaptive = nTL + (ne lnn− n)TS + nTDelay

TL = TQuery + TRN16 + TAck + TEPC

TS = TQueryAdjust + TRN16

(4)

where TL and TS are the sizes of a long time slot and a shorttime slot respectively. According to our prior study [45], thecommercial readers require to reserve TDelay seconds in thebeginning of each frame for some pre-arranged tasks, suchas synchronization, clearing tag states, adjustment of framelength, etc. Since n frames are required, the total extra timeconsumption is nTDelay. The other time symbols TXXX denotesthe time consumed on the corresponding reader commands orthe tag reply. For example, TQuery denotes the time cost fortransmitting a reader command of Query. Finally, the totaloverhead taken by the Q-Adaptive is given by

CQ-Adaptive(n) = n(TDelay + TQuery + TRN16 + TAck + TEPC)

+ (ne lnn− n)(TQueryAdjust + TRN16)

Cleary, the overhead is only related to the total number of tags(i.e., n) in the scanning field.

B. Overhead Analysis on TagMap

Unlike the Q-Adaptive, all time slots in TagMap are equalin size. The collection procedure totally contains M slots, eachof which is reserved for the transmissions of K Selects, aQuery and an RN16. Thus, the total time overhead taken byTagMap, denoted by CTagMap, can be computed as follows:

CTagMap =M(K · TSelect + TQuery + TRN16)

M = dn log2 e · log2(1/ε)e ≈ d1.44n log2(1/ε)eK = dln 2 · (log2 e · log2(1/ε))e ≈ d0.9981 log2(1/ε)e

(5)

Substituting M and K into CTagMap, the above equation canbe overwritten as follows:CTagMap(n, ε) = d1.44n log2(1/ε)e(d0.9981 log2(1/ε)e · TSelect

+ TQuery + TRN16)

Apart from the number of tags, the overhead of TagMap isalso related to the tolerance (i.e., ε).

C. Overhead Comparison

According to Gen2, we have the following estimated pa-rameter settings:

TSelect = 91 bits, TQuery = 37 bits, TQueryAdjust = 15 bitsTRN16 = 22 bits, TAck = 25 bits, TEPC = 134 bits

It is worth noting that: (1) the bit rates in the uplink (Tag→Reader) and downlink (Reader→Tag) are not exactly same.Both are determined by the user settings. For the sake of

IEEE/ACM TRANSACTIONS ON NETWORKING 9

100 200 300 500 1000 2000 3000 5000 10000Number of tags (n)

0.05

0.1

0.15

0.2

0.25

0.3

Tole

ranc

e (

)

0

0.5

1

1.5

2

2.5

3

3.5G=0.5

G=1.0" = 0.13

<latexit sha1_base64="yRoNf0PpTgEqqHnyKceFqmXZG0M=">AAAB+3icdVDLSsNAFJ3UV62vWJduBovgqiS1DyMIBTcuK9gHtKFMppN26GQSZibFEvorblwo4tYfceffOGkjqOiBC2fOuZe593gRo1JZ1oeRW1vf2NzKbxd2dvf2D8zDYkeGscCkjUMWip6HJGGUk7aiipFeJAgKPEa63vQ69bszIiQN+Z2aR8QN0JhTn2KktDQ0i4MZEiSSlIUcXkGrbJ8PzZJVdhpOrVbXb2uJlFSqjlOHdqaUQIbW0HwfjEIcB4QrzJCUfduKlJsgoShmZFEYxJJECE/RmPQ15Sgg0k2Wuy/gqVZG0A+FLq7gUv0+kaBAynng6c4AqYn87aXiX14/Vv6Fm1AexYpwvPrIjxlUIUyDgCMqCFZsrgnCgupdIZ4ggbDScRV0CF+Xwv9Jp6LzKtduq6XmZRZHHhyDE3AGbNAATXADWqANMLgHD+AJPBsL49F4MV5XrTkjmzkCP2C8fQKjY5OD</latexit> " = 0.07<latexit sha1_base64="9ee/nSrK/RUJ7I5q0EV8Kn7H59Q=">AAAB+XicdVDLSsNAFJ34rPUVdelmsAiuQpLGpi6EghuXFewD2lAm00k7dDIJM5NCCf0TNy4UceufuPNvnLQVVPTAhTPn3Mvce8KUUals+8NYW9/Y3Nou7ZR39/YPDs2j47ZMMoFJCycsEd0QScIoJy1FFSPdVBAUh4x0wslN4XemREia8Hs1S0kQoxGnEcVIaWlgmv0pEiSVlCX82rZsf2BWbOuqXnO9GtRv23dcpyCu71U96GilQAWs0ByY7/1hgrOYcIUZkrLn2KkKciQUxYzMy/1MkhThCRqRnqYcxUQG+WLzOTzXyhBGidDFFVyo3ydyFEs5i0PdGSM1lr+9QvzL62Uqqgc55WmmCMfLj6KMQZXAIgY4pIJgxWaaICyo3hXiMRIIKx1WWYfwdSn8n7Rdy6lal3depVFbxVECp+AMXAAH+KABbkETtAAGU/AAnsCzkRuPxovxumxdM1YzJ+AHjLdP6aaTKQ==</latexit>

Fig. 12: The overhead ratio of TagMap to Q-Adaptive. Theperformance of TagMap is better than Q-Adaptive when the radioG < 1.0. Particularly, TagMap is always better than Q-Adaptiveregardless of how many tags participate when the tolerance > 0.13.

clarity, we assume they are approximately equal; (2) the lengthof an EPC is 96 bits but its transmission involves a 22-bitpreamble and a 16-bit CRC; (3) the guard intervals betweencommands and replies are ignored because they are extremelysmall compared with the intervals of data transmissions; (4)the lengths of some commands with variable fields (likeSelect and Query) are estimated using the average.

Approximately, it takes about 25µs for the transmissionof each bit. The delay (i.e., TDelay) in commercial readers(e.g., ImpinJ R420) is around 30 ms based on our empiricalmeasurements. Substituting the above parameters into Eqn. 5and Eqn. 6 respectively, the two precise cost formulas arefinally updated as follows:CQ-Adaptive(n) = (3000 + (37 + 22 + 25 + 134) · 25) · n

+ (37 + 25) · (ne lnn− n) · 25= 8450n + 1550(ne lnn− n)

CTagMap(n, ε) = d1.44n log2(1/ε)e (d0.9981 log2(1/ε)e · 91 + 37 + 22) · 25= d1.44n log2(1/ε)e (d0.9981 log2(1/ε)e · 91 + 59) · 25

To quantify how n and ε affect the performance of TagMap, wedefine the overhead ratio of TagMap to Q-Adaptive, denotedby G(n, ε), as follows:

G(n, ε) =CTagMap(n, ε)

CQ-Adaptive(n)

=d1.44n log2(1/ε)e (d0.9981 log2(1/ε)e · 91 + 59) · 25

8450n + 1550(ne lnn− n)

(6)

Apparently, TagMap performs better than Q-Adaptive onlywhen and only when the G(n, ε) < 1.0; otherwise, the bestsolution is to collect all tags one by one with the Q-Adaptive.

Fig. 12 shows the results of the overhead ratio as functionsof a variable number of tags (i.e., 100 ≤ n ≤ 10000) and avariable tolerance (i.e., 0 < ε < 1). From the figure, we havethe two important findings:

1) TagMap performs better than Q-Adaptive in the whitearea where the smallest tolerance is set to 0.07. Thissuggests that the tolerance cannot be too small. This resultis reasonable because the philosophy behind Bloom filteris to save the procedure in time or space at the cost ofaccuracy [46]. It is suitable for the application scenarioswhich can tolerate a relatively higher false positive rate.In our scenario like the detection of missing tags, thesystem would acquire the Bloom filter repeatedly. Evenusing a relatively higher tolerance (e.g., ε = 0.25), thetag can be identified within two rounds with an extremelyhigh probability (e.g., 1 − 0.25 ∗ 0.25 = 0.9375). Thus,the tolerance of 0.25 is acceptable. However, when a

high accuracy is required, the traditional per-tag collectionshould be used.

2) The tolerance is the leading factor that affects the per-formance of TagMap. Particularly, when the ε > 0.13,TagMap performs always better than the Q-Adaptive re-gardless of how many tags participate. By contrast, thenumber of tags has a relatively limited impact on theperformance than the tolerance. For example, TagMap isstill better than Q-Adaptive with a very small numberof tags (e.g., n < 100) when ε > 0.13. On the otherhand, the overhead ratio is linearly reduced approximatelyas the number of tags increases, namely, the earnings ofTagMap are higher in handling a large number of tags,when remaining the tolerance unchanged.

In summary, the use of Bloom filter with TagMap has theapplicable limits. The performance might be worse than col-lecting tags one by one when pursuing a higher accuracy. Inthis situation, we advise to automatically switch the systemback to the traditional mode .

VI. SYSTEM IMPLEMENTATION

A. TagMap Reader

We implement a prototype of TagMap reader by usinga USRP N210 software defined radio equipped with SBXdaughterboard [51] and two directional antennas. The imple-mentation is based on [52] and integrates TagMap’s designinto the EPC Gen2 protocol. We release the source code ofTagMap [53]. The architecture of the TagMap reader is shownin Fig. 13.

Architecture. The TagMap reader consists of the follow-ing components: USRP Source, Gate, Tag Decoder, ReaderEncoder and USRP Sink.• USRP Source: The first block is to acquire samples from

the USRP hardware. In our experiment, the ADC is set to2MS/s, resulting in 50 samples for each tag bit.

• Gate: The reader always provides continuous signals totags, thus is full duplex (i.e., transmitting and receivingsimultaneously). This block is used to track the Query andAck commands, and trigger the processing of tags’ replies.

• Tag Decoder: This block is to detect tags’ RN16 reply sig-nals like preamble correlation, synchronization and channelestimation.

• Reader Encoder: This block is to implement the readercommands. Depending on the output of the tag decoderblock, the reader create the next commands. Although thiswork only requires the commands of Select and Query,we implement all other Gen2 commands (i.e., QueryRep,QueryAdust, Ack), as well as the Q-adaptive algorithm.

• USRP Sink: This block is to propagate the reader commandto the USRP hardware. We set the UHD gain of USRP to 20dB at a frequency during 902 ∼ 928 MHz. We utilize a RFamplifier to increase the transmitting power to 30 dBm.TheADC rate is configured to 2 MS/s.Transmission. The EPC Gen2 requires a reader to contin-

uously generate a high-power CW. Two links are involved.The first link is data transmission from reader → tag, whichis often called downlink transmission. The second link is the

IEEE/ACM TRANSACTIONS ON NETWORKING 10

TABLE I: Summary of Gen2-compatible Tags

Approach Function ImpinJ Monza series Alien ALN series NXPTash Ours D E QT X-2K X-8K R6 9662 9610 9726 9820 9715 9716 U7xm I2C DNA

? ? M1 (bits) 128 496 128 128 128/96 96 128 96-480 128 128 128 128 448 160 224? ? M3 (bits) 32 128 512 2176 8192 × 512 512 128 128 128 128 2,048 3,328 3,072? ? W/S/Q/R X X X X X × X X X X X X X X X? – Truncate × × × × × × × × × × × × × × ×

(1) ‘?’ denotes this function is essential to Tash or TagMap; (2) ‘X’ or ‘×’ denote that this function is available or unavailable on tag; (3) W/S/Q/R denotes the commands ofWrite, Select, Query and RN16 respectively. (4) M1 and M3 denote memory bank 1 (EPC memory) and memory bank 3 (user defined memory).

Host

USRP Source

Matched Filter Gate USRP

SinkTag

DecoderReaderEncoder

BF Configure

Applications

Fig. 13: TagMap reader architecture. The reader allows upper-layerapplication to provide a JSON-like configuration file and outputs theacquired BF in result file.

opposite, which is called as uplink transmission. Both linksmodulate data by OOK (i.e., changing the amplitudes of theCW), but involve different channel coding methods.• Downlink (reader → tag): A reader encodes the data bits

using Pulse-Interval Encoding (PIE) for the downlink. ThePIE coding has three user-defined parameters: Tari, PW(Pulse Width) and X. The Tari is the reference intervalfor the downlink signaling. PW indicates the time durationof the lower edge, which can be set to a value between0.265Tari and 0.625Tari but is capped at 2µs. Theduration of the bit ‘1’ is X-µs longer than that of bit ‘0’and X must be between 0.5Tari and Tari. The downlinkrate varies between 27Kbps and 128Kbps with respect to theparameter choice. In our test, for the max-throughout, weset above three parameters to 6.25µs, 0.3Tari (1.875µs)and 0.5Tari (3.125µs).

• Uplink (tag → reader): A tag uses either FM0 or Millercoding [47], both of which are highly similar to PIE. Weomit their coding details because tags cannot be controlledin our design.

B. Serviceability of Commercial Tags

We investigate mainstream RFID tags in today’s marketin terms of their serviceability to the Gen2 commands thatTagMap and Tash require. For commercial interests, readersand tags are usually designed separately and produced bydifferent manufactures. The Gen2 protocol is the glue thatadheres the two actors. We use our USRP reader to test 40types of tag chips from ImpinJ [48], Alien [49] and NXP [50],which occupy majority of today’s RFID market [1]. Due to thelimited space, we only list the results of 15 basic models inTable. I as example, and will release the entire white paper onour website soon (for anonymity). We have the observations:• Both TagMap and Tash require MemBank3 to store hash

values. The investigation suggests that 39/40 = 97.5% typesof tags serve to write to and read from their MemBank3.The exception is ImpinJ Monza R6, which is read only. Thememory size of MemBank3 fluctuates around 32 ∼ 3, 328

bits, but the de facto standard remains 128 bits. In particular,the Monza serials of tags from ImpinJ were firstly releasein 2005 [54].

• All query related commands such as Select, Query andRN16 are serviceable by all of the investigated tags. TheTruncate is dispensable to Tash. Our real tests suggestthat no Truncate-supportable tags in the market areavailable currently, even though this is a mandatory functionin the Gen2 protocol. This confines the effectiveness ofTash [43] in reality. However, TagMap leverages RN16 aspresence signals and does not rely on this function. Thus,TagMap is universally applicable to today’s commercialtags.

In summary, TagMap is perfectly compatible with the Gen2protocol and serves almost all of today’s commercial tags eventhose released 13 years ago.

C. Application Program InterfaceFor the sake of simplicity, the TagMap reader interacts

with upper applications through the file system. Applicationswrite parameters of each intercepted inventory into a JSON-formatted setting file Code 1. In particular, the codes betweenline 4 ∼ 13 define two Select commands with differentpointers (i.e., the random numbers). The reader encoder beginsto schedule the intercepted inventory based on the setting file,every time when it detects a change of the file. Majority ofsignal processing is performed in GNURadio host computer.The reader outputs decoded BFs into a “result” file, fromwhich the upper applications can obtain the bitmap and metadata (time stamp, etc).

1....2{//Settings of an intercepted inventory3 "Select": [{4 "MEMBANK":[1, 1], //MemBank35 "POINTER":[0, 0, 0, 0, 0, 0, 1, 1],6 "LENGTH":[0, 0, 0, 0, 0, 0, 1, 1],7 "MASK":[1, 0, 1]8 },{9 "MEMBANK":[1, 1],

10 "POINTER":[0, 0, 0, 0, 1, 0, 0, 1],11 "LENGTH":[0, 0, 0, 0, 0, 0, 1, 1],12 "MASK":[1, 0, 1]13 }],14 "Query": {15 "SEL":[1,1],//Query all selected tags16 "SESSION":[0,0],//Inventory session17 "Q":[0,0,0,1] //Set frame length to 118 }19}20...

Code 1: Program interface

IEEE/ACM TRANSACTIONS ON NETWORKING 11

USRP Reader

ImpinJ ReaderAntenna

Tags

Antenna

Fig. 14: Experimental scenario. Total 1, 000 tags are denselydeployed in a small area.

VII. EVALUATION

Our experiments are performed in our office lounge. A totalof 1000 tags are densely attached to plastic panels 1. The officesection has a size of 3×3×2.5m3, as shown in Fig. 14. Manysofas and tables are in the lounge. To fully cover numeroustags, we use a 12 dBi large antenna. The transmitting poweris fixed at 30 dBm. The USRP reader is connected to a 64-bitMacBook with 2.8GHz Intel Core i7 for running GNURadio.

Test Suite. We begin with a group of microbenchmark ex-periments to provide insights into the performance of TagMapwith comparison with commercial readers. All EPCs are storedin database and known to upper applications. This assumptionis reasonable and necessary because identifying if a tag ismissing or under tracking without any prior knowledge of itsexistence is impossible. The tolerance of BF is set to 0.25 bydefault.

Baselines. To be fair to TagMap, we only focus onpractical techniques without considering previous simulation-driven evaluation. We compare TagMap against two baselineschemes: a commercial reader (i.e., ImpinJ reader) [48] andTash [43]. As the commercial reader collects all tags in therange, its inventory results are used as the ground truth.

A. Reading Rate

To better understand how TagMap reader improves thereading rate, Fig. 15 shows a 10-second reading trace of atag. We totally deploy 140 tags in the surveillance region andrandomly select one tag to show it reading trace. These tags areinventoried by an ImpinJ and a TagMap reader respectively.In the figure, the red (higher) and gray (lower) bars indicatethe tag is identified by the ImpinJ and TagMap reader re-spectively. We can visually observe that the tag is much morefrequently identified by TagMap reader than the ImpinJ reader.In particular, TagMap reader achieves a mean reading rate of16Hz, outperforming ImpinJ (i.e., 0.8Hz) by 18× higher. Suchoutperformance is achieved because TagMap reader removesthe time-consuming processing for anti-collision. In addition,it can be seen that the tag is identified in a random manner bythe ImpinJ reader but regularly by the TagMap reader. This is

1The deployment mode (like grid) does not affect the performance as longas each tag can be identified.

TagMap

ImpinJ

0 1 2 3 4 5 6 7 8 9 10Time(s)

Fig. 15: Ten-second reading trace

because ImpinJ reader’s anti-collision processing uses a ran-domized algorithm (an ALOHA variant), while our approachis a deterministic algorithm (discuss later).

B. Acquisition Overhead

We are interested in evaluating the acquisition overhead asfunction of tag number (i.e., n). The overhead is defined asthe time consumed in acquiring tags or a data structure likeBF for representing them.

TagMap overhead across three cases. Although BF is arandomized data structure, the acquisition overhead is deter-ministic. The overhead depends on the bitmap size M andthe number of hashes K. Let TS , TQ and TRN denote thetime consumed on transmitting the Select, Query andRN16. As shown in Fig. 4, each intercepted inventory takesK ·(TS+τ1)+TQ+τ2+TRN +τ3 where τ1, τ2 and τ3 are theconstant spaces specified in Gen2. Thus, the total overhead Cis given by

C =M (K · (TS + τ1) + TQ + τ2 + TRN + τ3)

Thus, as long as two parameters are certain, the acquisitionoverhead of BF is a constant. This is why the tag is alwaysregularly identified by TagMap reader in Fig. 15. Next, wemeasure the overhead with respect to the three cases discussedin Sec.IV-D. The results are shown in Fig. 16(a) and under-stood as follows:• In the first case, the minimal size M = dn/ ln 2e when

keeping K = 1 (see Lemma 2) without using modulo. Itseems that the overhead should be linearly proportional ton, i.e., C ∼ dn/ ln 2e. Actually, the figure shows that theoverhead increases step by step. This is because the hash valueis represented in a binary form, we have to set the actual sizeM = 2dlog2 Me = 2dlog2(n/ ln 2)e, making C ∼ 2dlog2(n/ ln 2)e.We can exactly observe the turning points appearing at n =d2 ln 2e, d4 ln 2e, d8 ln 2e, · · · = . . . , 89, 178, 355, 719, . . . .• The second case considers using multiple hash func-

tion to lower the false positives. The Lemmas suggestthat M = dn log2 e · log2(1/0.3)e = d2.5ne and K =dln 2 log2(e) log2(1/0.25)e = 2. Thus, the actual sizeM = 2dlog2(2.5n)e. Similar to the first case, many stepsare observed when n = d2/2.5e, d4/2.5e, d8/2.5e, · · · =. . . , 103, 205, 410, 820, . . . . Compared with the first case, thiscase consumes about double time. These the extra time isconsumed on two Selects in each bit-driven interceptedinventory.• The third case adopts modulo to fit the optimal size.

Since this case adopts the same settings as that of the secondcase (i.e., M = 2dlog2(2.5n)e and K = 2), the turning points

IEEE/ACM TRANSACTIONS ON NETWORKING 12

0 200 400 600 800 1000Number of Tags(#)

0

0.5

1

1.5

2

2.5

3

Tim

e(s)

Case1Case2Case3

(a) Overheads across three cases

200 400 600 800 1000Number of Tags(#)

0

5

10

15

20

Tim

e(s)

ImpinJ Tash TagMap

(b) Overheads across solutions

Fig. 16: Acquisition overhead

are exactly observed as in the second case. However, wecould observe that the time consumed in this case is far lessthan the second case. This is because the modulo moves thetruncated bits ahead, reducing the total number of interceptedinventories. However, the overhead is still higher than thefirst case because two or four Selects must be broadcastedin each intercepted inventory. This case has a good linearitybecause it adopts the optimal size which is proportional ton. Hereafter, we use modulo by default unless it should benoted.

Overhead comparison to the-art-of-state. Next, we showthe overhead of TagMap compared with ImpinJ reader andTash. The results are shown in Fig. 16(b). From the figure, weobtain the following findings:• The ImpinJ reader adopts the Q-adaptive algorithm, whose

inventory time is randomized due to collisions. We configureImpinJ to work in the “max-throughput” mode, which can readtags as fast as possible [48]. The theoretical expected overheadof Q-adaptive is approximately equal to ne log(n) [45], i.e.,linearly increases with the tag number, which is exactlyconfirmed by our tests. These results are considered as theoverhead baseline (i.e., worst case).• Since no Truncate-supportable tags are available on

the market, the improvement that Tash can make is verylimited. Specifically, Tash can reduce the overhead by 20%on the average and achieve maximum overhead of 37% whenn = 1000. Real outperformance is lower than that in thesimulations shown in [43] due to the unavailability of theTruncate command.• TagMap can reduce the overhead by 74.73% and 66.22%

to ImpinJ and Tash on the average respectively. The reductionis almost linear to the number of tags. This is reasonable

0 0.05 0.1 0.15 0.2BER

0.2

0.4

0.6

0.8

1

CD

F

Fig. 17: Reliability

because more tags introduce more collisions. In particular,the outperformance is 86.69% and 83.96% when n = 1000.This superior outperformance is achieved mainly due to twounique techniques of TagMap: physical-layer acquisition (i.e.,intercepted inventory) and being free of anti-collision. In addi-tion, another distinct feature of TagMap is that its overhead isunbiased, i.e., the overhead is certain without fluctuation evenfacing numerous collisions. In contrast, both ImpinJ and Tashhave about 10% dynamics in time because of the uncertainanti-collision processding.

C. Acquisition Reliability

We evaluate acquisition reliability in terms of bit errorrate (BER), which is defined as the rate of erroneous bits ina BF, i.e., the percent of bits in BF that are flipped. Thismetric is different from wireless BER, which indicates howmany physical symbols are falsely decoded. Our BER is anapplication-layer indicator. Fig. 17 shows the CDF of BERwhen acquiring a BF across 1, 000 tags with tolerance of0.01. Lemma 3 suggests that the optimal size of BF is 2396bits at the least, so a 212-bit BF is the shortest dimensionthat can meet this demand (212 = 4096). The experiment isrepeated for 50 trials. As a result, TagMap achieves a medianBER of 0.004, i.e., 0.4% bits may be flipped. The size ofBF reaches 9585 bits in this case. 1000/9585 = 0.1043 tagsare hashed into each bit on the average. Thus, 3.9989 tags atthe most are affected by the flips. Considering the toleranceof 0.01 (i.e., 10 tags), these errors caused by the flipped bitscan be still tolerated. A USRP reader has difficulty processingover 50 M samples (i.e., 58 M in this test), many of whichoverflow because of the processing latency at the host side. Ifthe BF’s length is less than 5, 000 (sampling size is less thanabout 30 M), the median BER is < 0.001%. We believe theincapability of USRP mainly accounts for the 0.4% of BER.

D. Case Study: Finding Missing Tags

Finally, we consider the effectiveness of TagMap in findingmissing tags. We present the results of three cases, which arediscussed in Sec.IV-D. We consider the application in viewof the detection accuracy where the tolerance is set to 0.25.We wish to know the percentage of missing tags that are notfound out, i.e., defined as Error Rate. Accuracy is evaluatedas a function of the missing rate. In the experiment, a total of1000 tags are placed in the surveillance region and 5%, 10%,

IEEE/ACM TRANSACTIONS ON NETWORKING 13

5 10 15 20Missing Rate(%)

0

0.01

0.02

0.03

0.04

0.05

0.06

0.07E

rror

Rat

eCase1

Case2

Case3

Fig. 18: Detection accuracy

15% and 20% of tags are randomly taken away. We run 50experimental trials and plot the detection accuracy in Fig. 18.• Case 1: Using a single hash function. From the figure, it is

seen that 0.79% ± 0.3% to 5.2% ± 1.2% missing tags arefalsely detected when the missing rate increases from 5%to 20%. All results are lower than the predefined toleranceof 25%. None of the false negatives are reported since thenature of the Bloom filter yields zero false negative.

• Case 2: Using 3 hash functions. Lemma 2 suggests theappropriate number of hash functions k = 3. In this case, weuse 3 hash functions to create a 212-bit BF so that more ‘1’scan be found in the bitmap to prove the presence of tags.This is confirmed by our tests: the error rate is reduced to2.4% ± 0.5% even the missing rate equals 20%, removingalmost half (41.65%) false detections in Case 1.

• Case 3: Using modulo operation. We use the modulooperation to reduce the bitmap length from 4096 bits to 2396bits. The accuracy for Case 3 is quite similar to that for Case2 (e.g., 2.9%±0.4% vs. 2.4%±0.5% given missing rate of20%) because both adopt same number of hash functions.The about 0.5% difference derives from the fact that themodulo operation disturbs the randomness of bitmap, i.e.,moving trail bits to head bits.

Summary. Three acquisition overheads have been comparedin Fig. 16(b) (i.e., the scenario when n = 1000), whichimplies that TagMap and an ImpinJ reader takes 1.9s and 15sto acquire a BF or identify 1000 tags respectively. In otherwords, TagMap can accurately find out 1− (2.9%± 0.4%) =97.1%± 0.4% of missing events within 2 seconds, whereas acommercial reader requires 15 seconds to know these events.

VIII. RELATED WORK

TagMap is related to previous work in three areas.Design of Hash Function: Feldhofer and Rechberger [42]

stated that current common hash functions (e.g., MD5, SHA-1,etc), are not hardware friendly and are unsuitable for RFIDtags, which possess a constrained computing capability. Suchdifficulty has spurred considerable research [34]–[42]. De-spite these optimized designs, the majority of them are stillpresented in theory and none is available for COTS RFIDtags. Our work explores hash functions by leveraging selectivereading to emulate equivalent hash functions.

Design of Communication Protocols. Plenty of work focuson designing communication protocols to improve the effi-ciency of inventory and tag detection. Some [22], [43], [55]–

[58] try to design the protocol to fast search tag or estimatethe cardinality. [56] introduce bloom filter into the RFID tagsearching but doesn’t implement on commercial RFID system.Tash [43] first implement the bloom filter on commercial RFIDsystem but only implement on the application layer and its effi-ciency is limited. This work first enables the bloom filter on thephysical layer of commercial RFID system and dramaticallyimprove the collecting speed. The others [6]–[13], [59] aim onrecovering the collisions to improve the efficiency of inventory.Buzz [6] decodes tag collisions bit by bit. It assumes the linearcombination of the static channel coefficients of reflectingtags independent of coexisting tags. BiGroup [59] recoverscollisions without modifying COTS tags, but instead, changesthe readers. However, these works either require modifyingtags or work under specific conditions. Our work provides auniversal and fast inventory service on the commercial RFIDsystems.

BF Applications: The traditional inventory interrogates allthe tags, which makes it time-inefficient. These works [16]–[18] proposed continuous reading protocols that can incremen-tally collect tags in each step by using a BF. Sheng et al. [16]preserved the tags collected in the previous round and collectedonly unknown tags. Thereafter, many follow-up studies [19]–[33] investigated the issue of false positives resulting from theslots. TagMap provides a fundamental service to boost thesework.

IX. CONCLUSION

This work provides a fundamental service to today’s com-mercial RFID Gen2 tags, which is dispensable for prior Bloomfilter-based applications. A key innovation of this work isthe physical-layer acquisition approach, which is a significantstep in overcoming the performance bottleneck of currentRFID systems. Our work provides new exciting avenues forexploration in RFID system and its applications.

ACKNOWLEDGMENTS

Lei Yang and Lei Xie are the co-corresponding author. Theresearch is supported by NSFC for Young Scientists of China(NO. 61972331), NSFC General Program (NO. 61902331),NSFC Key Program (NO. 61932017) and UGC/ECS (NO.25222917). Lei Xie’s research is supported by the NationalNatural Science Foundation of China under Grant Nos.61872174, 61832008.

REFERENCES

[1] “RFID Forecasts, Players and Opportunities 2017-2017,” https://www.idtechex.com/research/reports/rfid-forecasts-players-and-opportunities-2017-2027-000546.asp.

[2] D. M. Dobkin, The RF in RFID: UHF RFID in Practice. Newnes,2012.

[3] J. Wang, L. Chang, O. Abari, and S. Keshav, “Are rfid sensing systemsready for the real world?” in Proc. of ACM MobiSys, 2019, pp. 366–377.

[4] L. Yang, Y. Chen, X.-Y. Li, C. Xiao, M. Li, and Y. Liu, “Tagoram: real-time tracking of mobile rfid tags to high precision using cots devices,”in Proc. of ACM MobiCom, 2014.

[5] D.-H. Shih, P.-L. Sun, D. C. Yen, and S.-M. Huang, “Taxonomyand survey of rfid anti-collision protocols,” Computer communications,vol. 29, no. 11, pp. 2150–2166, 2006.

[6] J. Wang, H. Hassanieh, D. Katabi, and P. Indyk, “Efficient and reliablelow-power backscatter networks,” in Proc. of ACM SIGCOMM, 2012.

IEEE/ACM TRANSACTIONS ON NETWORKING 14

[7] C. Angerer, R. Langwieser, and M. Rupp, “Rfid reader receivers forphysical layer collision recovery,” IEEE Transactions on Communica-tions, vol. 58, no. 12, pp. 3526–3537, 2010.

[8] D. Shen, G. Woo, D. P. Reed, A. B. Lippman, and J. Wang, “Separationof multiple passive rfid signals using software defined radio,” in Proc.of IEEE RFID, 2009.

[9] A. Bletsas, J. Kimionis, A. G. Dimitriou, and G. N. Karystinos,“Single-antenna coherent detection of collided fm0 rfid signals,” IEEETransactions on Communications, vol. 60, no. 3, pp. 756–766, 2012.

[10] P. Hu, P. Zhang, and D. Ganesan, “Leveraging interleaved signal edgesfor concurrent backscatter,” in Proc. of ACM HotWireless, 2014.

[11] R. S. Khasgiwale, R. U. Adyanthaya, and D. W. Engels, “Extractinginformation from tag collisions,” in Proc. of IEEE RFID, 2009.

[12] L. Kang, K. Wu, J. Zhang, H. Tan, and L. Ni, “Ddc: A novel scheme todirectly decode the collisions in uhf rfid systems,” IEEE Transactionson Parallel and Distributed Systems, vol. 23, no. 2, pp. 263–270, 2012.

[13] L. Kong, L. He, Y. Gu, M.-Y. Wu, and T. He, “A parallel identificationprotocol for rfid systems,” in Proc. of IEEE INFOCOM, 2014.

[14] R. Zhao, F. Zhu, Y. Feng, S. Peng, X. Tian, H. Yu, and X. Wang,“Ofdma-enabled wi-fi backscatter,” in Proc. of ACM MobiCom, 2019,pp. 1–15.

[15] X. Tong, F. Zhu, Y. Wan, X. Tian, and X. Wang, “Batch localizationbased on ofdma backscatter,” in Proc. of ACM UbiComp, vol. 3, no. 1,2019, pp. 1–25.

[16] B. Sheng, Q. Li, and W. Mao, “Efficient continuous scanning in rfidsystems,” in Proc. of IEEE INFOCOM, 2010.

[17] L. Xie, Q. Li, X. Chen, S. Lu, and D. Chen, “Continuous scanning withmobile reader in rfid systems: An experimental study,” in Proc. of ACMMobiHoc. ACM, 2013, pp. 11–20.

[18] H. Liu, W. Gong, X. Miao, K. Liu, and W. He, “Towards adaptivecontinuous scanning in large-scale rfid systems,” in Proc. of IEEEINFOCOM, 2014.

[19] T. Li, S. Chen, and Y. Ling, “Identifying the missing tags in a large rfidsystem,” in Proc. of ACM MobiHoc, 2010.

[20] W. Luo, S. Chen, T. Li, and S. Chen, “Efficient missing tag detectionin rfid systems,” in Proc. of IEEE INFOCOM, 2011.

[21] R. Zhang, Y. Liu, Y. Zhang, and J. Sun, “Fast identification of themissing tags in a large rfid system,” in Proc. of IEEE SECON, 2011.

[22] W. Luo, S. Chen, T. Li, and Y. Qiao, “Probabilistic missing-tag detectionand energy-time tradeoff in large-scale rfid systems,” in Proceedingsof the thirteenth ACM international symposium on Mobile Ad HocNetworking and Computing. ACM, 2012, pp. 95–104.

[23] Y. Zheng and M. Li, “P-mti: Physical-layer missing tag identification viacompressive sensing,” IEEE/ACM Transactions on Networking, vol. 23,no. 4, pp. 1356–1366, 2015.

[24] C. C. Tan, B. Sheng, and Q. Li, “Efficient techniques for monitoringmissing rfid tags,” IEEE Transactions on Wireless Communications,vol. 9, no. 6, pp. 1882–1889, 2010.

[25] T. Li, S. Chen, and Y. Ling, “Efficient protocols for identifying the miss-ing tags in a large rfid system,” IEEE/ACM Transactions on Networking,vol. 21, no. 6, pp. 1974–1987, 2013.

[26] X. Liu, K. Li, G. Min, Y. Shen, A. X. Liu, and W. Qu, “A multiplehashing approach to complete identification of missing rfid tags,” IEEETransactions on Communications, vol. 62, no. 3, pp. 1046–1057, 2014.

[27] W. Luo, S. Chen, Y. Qiao, and T. Li, “Missing-tag detection and energy–time tradeoff in large-scale rfid systems with unreliable channels,”IEEE/ACM Transactions on Networking, vol. 22, no. 4, pp. 1079–1091,2014.

[28] C. Ma, J. Lin, and Y. Wang, “Efficient missing tag detection in a largerfid system,” in Proc. of IEEE TrustCom, 2012.

[29] W. Xie, L. Xie, C. Zhang, Q. Wang, J. Xu, Q. Zhang, and C. Tang,“Rfid seeking: Finding a lost tag rather than only detecting its missing,”Journal of Network and Computer Applications, vol. 42, pp. 135–142,2014.

[30] M. Shahzad and A. X. Liu, “Expecting the unexpected: Fast and reliabledetection of missing rfid tags in the wild,” in Proc. of IEEE INFOCOM,2015.

[31] J. Yu, L. Chen, R. Zhang, and K. Wang, “On missing tag detectionin multiple-group multiple-region rfid systems,” IEEE Transactions onMobile Computing, 2016.

[32] J. Yu, L. Chen, and K. Wang, “Finding needles in a haystack: Missingtag detection in large rfid systems,” arXiv preprint arXiv:1512.05228,2015.

[33] M. Shahzad and A. X. Liu, “Fast and reliable detection and identifi-cation of missing rfid tags in the wild,” IEEE/ACM Transactions onNetworking, vol. 24, no. 6, pp. 3770–3784, 2016.

[34] A. Poschmann, G. Leander, K. Schramm, and C. Paar, “New lightweightdes variants suited for rfid applications,” in FSE, vol. 4593, 2007, pp.196–210.

[35] H. Yoshida, D. Watanabe, K. Okeya, J. Kitahara, H. Wu, O. Kucuk,and B. Preneel, “Mame: A compression function with reduced hardwarerequirements,” in International Workshop on Cryptographic Hardwareand Embedded Systems. Springer, 2007, pp. 148–165.

[36] A. Bogdanov, L. R. Knudsen, G. Leander, C. Paar, A. Poschmann, M. J.Robshaw, Y. Seurin, and C. Vikkelsoe, “Present: An ultra-lightweightblock cipher,” in CHES, vol. 4727. Springer, 2007, pp. 450–466.

[37] C. Rolfes, A. Poschmann, G. Leander, and C. Paar, “Ultra-lightweightimplementations for smart devices–security for 1000 gate equivalents,”in CARDIS, vol. 5189. Springer, 2008, pp. 89–103.

[38] C. H. Lim and T. Korkishko, “mcrypton-a lightweight block cipher forsecurity of low-cost rfid tags and sensors,” in WISA, vol. 3786. Springer,2005, pp. 243–258.

[39] Y. Yu, Y. Yang, Y. Fan, and H. Min, “Security scheme for rfid tag: Auto-id labs white paper wp-hardware-022,” http://www.autoidlabs.org/.

[40] D. Hong, J. Sung, S. Hong, J. Lim, S. Lee, B. Koo, C. Lee, D. Chang,J. Lee, K. Jeong et al., “Hight: A new block cipher suitable for low-resource device,” in CHES, vol. 4249. Springer, 2006, pp. 46–59.

[41] T. Good and M. Benaissa, “Hardware results for selected stream ciphercandidates,” State of the Art of Stream Ciphers, vol. 7, pp. 191–204,2007.

[42] M. Feldhofer and C. Rechberger, “A case against currently used hashfunctions in rfid protocols,” in On the move to meaningful internetsystems 2006: OTM 2006 workshops. Springer, 2006, pp. 372–381.

[43] L. Yang, Q. Lin, C. Duan, and Z. An, “Analog on-tag hashing: Towardsselective reading as hash primitives in gen2 rfid systems,” arXiv preprintarXiv:1707.08883, 2017.

[44] Q. Lin, L. Yang, C. Duan, and Y. Liu, “Revisiting reading rate withmobility: Rate-adaptive reading of cots rfid systems,” IEEE Transactionson Mobile Computing, 2018.

[45] Q. Lin, L. Yang, H. Jia, C. Duan, and Y. Liu, “Revisiting readingrate with mobility: Rate-adaptive reading in cots rfid systems,” in Pro-ceedings of the 13th International Conference on emerging NetworkingEXperiments and Technologies. ACM, 2017, pp. 199–211.

[46] A. Broder and M. Mitzenmacher, “Network applications of bloom filters:A survey,” Internet Mathematics, vol. 1, no. 4, pp. 485–509, 2004.

[47] “EPCglobal Gen2 Specification,” www.gs1.org/epcglobal, 2004.[48] “ImpinJ, Inc,” http://www.impinj.com/, 2017.[49] “Alien,” http://www.alientechnology.com, 2017.[50] “NXP,” https://nxp-rfid.com/products/ucode/.[51] “USRP,” https://www.ettus.com/.[52] N. Kargas, F. Mavromatis, and A. Bletsas, “Fully-coherent reader with

commodity sdr for gen2 fm0 and computational rfid,” IEEE WirelessCommunications Letters, vol. 4, no. 6, pp. 617–620, 2015.

[53] “Source Code,” https://github.com/Anplus/TagMap.[54] “ImpinJ Inc. History,” https://en.wikipedia.org/wiki/Impinj.[55] C. Qian, H. Ngan, Y. Liu, and L. M. Ni, “Cardinality estimation for

large-scale rfid systems,” IEEE transactions on parallel and distributedsystems, vol. 22, no. 9, pp. 1441–1454, 2011.

[56] Y. Zheng and M. Li, “Fast tag searching protocol for large-scale rfidsystems,” IEEE/ACM Transactions on Networking (TON), vol. 21, no. 3,pp. 924–934, 2013.

[57] S. Chen, M. Zhang, and B. Xiao, “Efficient information collection proto-cols for sensor-augmented rfid networks,” in Proc. of IEEE INFOCOM,2011.

[58] L. Yang, J. Han, Y. Qi, C. Wang, T. Gu, and Y. Liu, “Season: Shelvinginterference and joint identification in large-scale rfid systems,” in 2011Proceedings IEEE INFOCOM. IEEE, 2011, pp. 3092–3100.

[59] J. Ou, M. Li, and Y. Zheng, “Come and be served: Parallel decodingfor cots rfid tags,” in Proceedings of the 21st Annual InternationalConference on Mobile Computing and Networking. ACM, 2015, pp.500–511.

IEEE/ACM TRANSACTIONS ON NETWORKING 15

Zhenlin An received the BS degree from theSchool of Information Communicating Engineeringat Dalian University of Technology, China, in 2017.He is now a PhD Student of Department of Comput-ing at The Hong Kong Polytechnic University. Hisresearch interest includes the Wireless and Backscat-ter Communication and Mobile Computing. He is astudent Member of IEEE and ACM.

Qiongzheng Lin received the BS degree and Ph.Ddegree from the School of Software at TsinghuaUniversity, China. He is currently working as aPost Doctor Fellow with the Department of Com-puting, The Hong Kong Polytechnic University. Hisresearch interests include radio frequency identifica-tion (RFID) and sensor network, mobile sensing andpervasive computing. He is a member of IEEE andACM.

Lei Yang received the B.S. and Ph.D degree fromthe School of Software and the Department ofComputer Science and Technology at Xi’an JiaotongUniversity. He is currently working as an AssistantProfessor with the Department of Computing, TheHong Kong Polytechnic University. Previously, hewas a postdoc fellow at the School of Software ofTsinghua University. His research interests includeInternet of Things, RFID and backscatters, Wirelessand Mobile computing.

Wei Lou Dr. Wei Lou is currently an associate pro-fessor in the Department of Computing, The HongKong Polytechnic University, Hong Kong, China. Hereceived the B.Eng. degree in Electrical Engineer-ing from Tsinghua University, China in 1995, theM.Eng. degree in Telecommunications from BeijingUniversity of Posts and Telecommunications, Chinain 1998, and the Ph.D. degree in Computer Engineer-ing from Florida Atlantic University, USA in 2004.Dr. Lou’s current research interests are in the areasof wireless networking, mobile ad hoc and sensor

networks, peer-to-peer networks, and mobile cloud computing. He has workedintensively on designing, analyzing and evaluating practical algorithms withthe theoretical basis, as well as building prototype systems. His research workis supported by several Hong Kong GRF grants and Hong Kong PolytechnicUniversity ICRG grants.

Lei Xie received his B.S. and Ph.D. degrees fromNanjing University, China in 2004 and 2010, re-spectively, all in computer science.He is currently anassociate professor in the Department of ComputerScience and Technology at Nanjing University. Hehas published over 70 papers in ACM/IEEE Trans-actions on Networking, IEEE Transactions on Mo-bile Computing, IEEE Transactions on Parallel andDistributed Systems, ACM Transactions on SensorNetworks, ACM MobiCom, ACM UbiComp, ACMMobiHoc, IEEE INFOCOM, IEEE ICNP, IEEE

ICDCS, etc.