# Polarization-Shift Backscatter Identification for SWIPT-Based Battery-Free Sensor Nodes

Taki Eddine Djidjekh, Alexandru Takacs

► To cite this version:

Taki Eddine Djidjekh, Alexandru Takacs. Polarization-Shift Backscatter Identification for SWIPT-Based Battery-Free Sensor Nodes. Electronics, 2025, 15 (1), pp.186. 10.3390/electronics15010186. hal-05490892

HAL Id: hal-05490892

https://laas.hal.science/hal-05490892v1

Submitted on 3 Feb 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
Article

# Polarization-Shift Backscatter Identification for SWIPT-Based Battery-Free Sensor Nodes

Taki E. Djidjekh <fnref n="1" />,* and Alexandru Takacs <fnref n="2" />

## Abstract

Battery-Free Sensor Nodes (BFSNs) used in Simultaneous Wireless Information and Power Transfer (SWIPT) systems often rely on lightweight communication protocols with minimal security overhead due to strict energy constraints. As a result, conventional protocol-dependent security mechanisms cannot be employed, leaving BFSNs vulnerable to replay, spoofing, and other security threats. This paper explores a protocol-independent security mechanism that enhances BFSN security by exploiting the power wave for controlled backscattering. The method introduces a Manchester-encoded digital private key generated by the BFSN's low-power microcontroller and backscattered through a polarization-shifting module enabled by a fail-safe RF switch, thereby avoiding the need for a dedicated backscattering rectifier. A LoRaWAN-based BFSN integrating this add-on module was implemented to experimentally validate the approach. Results show successful extraction of the backscattered key with minimal energy overhead (approximately 95 µJ for a 3 ms identification sequence), while the original high-efficiency RF rectifier used for harvesting remains unmodified. The orthogonal polarization between the incoming and backscattered waves additionally reduces clutter and cross-jamming effects. These findings demonstrate that secure identification can be seamlessly incorporated into existing BFSNs without altering their core architecture, offering an easy-to-integrate and energy-efficient solution for improving security in SWIPT-based sensing systems.

**Keywords:** backscattering; identification; authentication; Internet of Things (IoT); LoRaWAN; physical layer security; Simultaneous Wireless Information and Power Transfer (SWIPT); Wireless Power Transfer (WPT); Wireless Sensor Network (WSN)

<figure><img src="image_2.png" /></figure>

Check for updates

Academic Editor: Dimitris Kanellopoulos

Received: 24 November 2025

Revised: 28 December 2025

Accepted: 29 December 2025

Published: 31 December 2025

**Copyright:** © 2025 by the authors.
Licensee MDPI, Basel, Switzerland.
This article is an open access article
distributed under the terms and
conditions of the [Creative Commons Attribution (CC BY) license](https://creativecommons.org/licenses/by/4.0/).

## 1. Introduction

Battery-free wireless sensing has emerged as a promising solution for resource-constrained environments, enabling sustainable and long-term operation without the need for conventional power sources [1]. This paradigm offers new opportunities for reliable and maintenance-free sensing applications, particularly in scenarios where frequent battery replacement is impractical or costly. One of the key enablers for battery-free sensing is Wireless Power Transfer (WPT) [2], which provides a controlled and predictable source of wireless energy within the framework of Simultaneous Wireless Information and Power Transfer (SWIPT). Unlike solutions that rely on ambient energy sources, such as solar, thermal, or ambient microwave harvesting, SWIPT ensures reliable power delivery while supporting data communication [3].

<footnote n="1">1 LAAS-CNRS, Université de Toulouse, CNRS, 31400 Toulouse, France</footnote>

<footnote n="2">2 LAAS-CNRS, UPS, Université de Toulouse, CNRS, 31400 Toulouse, France; alexandru.takacs@laas.fr</footnote>

<footnote>* Correspondence: taki.djidjekh@laas.fr</footnote>
SWIPT architectures can generally be categorized into two types. The first is the single-wave approach, where the same incident RF wave is used both to power the battery-free sensor and to enable backscatter communication for data transmission. The second is the dual-wave architecture, in which one wave is dedicated to delivering power while another is used exclusively for communication. The dual-wave approach provides significant advantages, including the ability to operate onboard processing units such as microcontrollers (MCUs), interface with a wider variety of low-cost sensors, and transmit data over longer distances using transceivers that support established communication protocols [4–6].

In the context of dual-wave SWIPT, Battery-Free Sensor Nodes (BFSNs) impose strict constraints on communication protocols, limiting them to only basic or lightweight encryption schemes. This energy-saving restriction introduces significant security vulnerabilities such as Denial-of-Service (DoS), replay, and flooding attacks. For example, in LoRaWAN deployments, Activation by Personalization (ABP) is used because it is more energy-efficient; however, it relies on static session keys, making the system highly susceptible to replay attacks [7,8]. Similarly, in Bluetooth Low Energy (BLE), energy limitations often lead to favoring connectionless broadcasting without pairing or handshake procedures, which increases exposure to spoofing, eavesdropping, and packet injection [9].

Multiple security mechanisms have been investigated in the context of SWIPT. Jamming-based defenses enhance secrecy but require full-duplex radios and effective self-interference cancellation, which limits their practicality for low-power nodes [10]. Direct-Sequence Spread Spectrum (DSSS) embeds security at the physical layer, yet it is tied to specific standards and offers limited portability across IoT protocols [11]. Inteligent reflecting surface (IRS) schemes improve secrecy through controllable reflections but rely on additional infrastructure and deployment overhead [12]. Optimization-based physical-layer security methods for heterogeneous networks depend on complex signal processing and accurate Channel State Information (CSI), reducing their adaptability to other protocols and dynamic scenarios [13]. Deep-learning-based solutions can enhance security performance, but they require training with changing channel conditions and significant computational resources [14,15].

As summarized in Table 1, despite their potential energy efficiency, existing SWIPT security solutions are often hardware-dependent, computationally complex, and protocol-specific, with most validated only via simulations, highlighting the need for a lightweight, protocol-agnostic, and hardware-efficient security mechanism suitable for practical deployments.

This work focuses on an alternative and practical solution for securing BFSNs by leveraging the WPT Power wave (P-wave) to backscatter a device identification signal. This mechanism introduces an additional, protocol-independent and energy-efficient authenti-cation layer that operates regardless of the communication protocol used for the data wave (e.g., BLE, LoRaWAN). Previous works have demonstrated the feasibility of this concept by replacing the original BFSN rectifier with a dedicated backscattering rectifier [16,17]. While these experiments validated the functional operation of backscattering-based identification, the backscattering rectifier is inherently less efficient than the original harvesting rectifier. Moreover, replacing the original rectifier requires modifying the BFSN circuitry, which can be impractical for already deployed nodes.

The original approach proposed for the first time in this paper removes the need for a dedicated backscattering rectifier by incorporating a fail-safe RF switch with two antennas into the BFSN as an add-on module. Controlled backscattering is achieved by switching between antennas with orthogonal polarizations, enabling a seamless and non-intrusive integration into existing BFSN architectures. A direct comparison is provided in Table 1 (highlighted rows). The key advantages of this design are summarized as follows:
1. Non-intrusive integration:

The proposed solution preserves the original RF rectifier already integrated into the BFSN for energy harvesting. The backscattering functionality is provided through an external add-on module containing the fail-safe RF switch and polarized antennas, avoiding any modification to the existing rectification circuitry.

2. Improved robustness through polarization shifting:

By backscattering the identification signal using an orthogonal polarization relative to the incoming WPT power wave, the proposed method reduces the impact of environmental reflections, clutter, and cross-jamming, improving the reliability of identification retrieval at the Communication Node.

3. Cost-effective deployment:

The use of an add-on module enables retrofitting of already deployed BFSNs, which is significantly less costly than redesigning and replacing sensor nodes or modifying their RF front-end to include dedicated backscattering rectifiers.

4. High energy efficiency:

The backscattered identification is controlled solely by a low-power microcontroller via simple GPIO toggling, without activating the RF transceiver. In addition, unlike backscattering rectifier, which is typically less efficient than the original standard harvesting rectifier, the fail-safe RF switch remains passive in its default state, introducing only a minimal insertion loss of ≤0.4 dB and consuming energy only during brief switching intervals.

<table><caption>**Table 1.** Comparison with state-of-the-art security approaches for SWIPT/BFSNs.</caption><thead><tr><td>Approach</td><td>Extra Hardware</td><td>Invasive to Circuitry</td><td>Protocol-Independent</td><td>Energy Efficiency Impact</td><td>Validation</td><td>Ref.</td></tr></thead><tbody><tr><td>Jamming-based PHY security</td><td>High (full-duplex + self-interference cancellation)</td><td>Yes</td><td>Limited (only for power-splitting schemes)</td><td>High, due to full-duplex and self-interference cancellation (energy cost typically non-negligible)</td><td>Mostly simulation</td><td>[10]</td></tr><tr><td>DSSS/spread-spectrum PHY security</td><td>Medium (spread-ing/coding support)</td><td>Yes</td><td>Limited (only DSSS-based schemes)</td><td>Medium (time switching between energy harvesting and decoding)</td><td>Mostly simulation</td><td>[11]</td></tr><tr><td>Intelligent Reflecting Surfaces (IRS)</td><td>High (additional infrastructure: IRS panels and control)</td><td>No</td><td>Limited (only for IRS-assisted SWIPT with power splitting)</td><td>Low at node, but requires external infrastructure</td><td>Mostly simulation</td><td>[12]</td></tr><tr><td>Secure energy optimization</td><td>Low extra hardware but high processing complexity</td><td>No</td><td>Limited (only for SWIPT-aided Het-Nets with beamforming and power splitting)</td><td>Low, but with high signal-processing burden and dependence on CSI</td><td>Mostly simulation</td><td>[13]</td></tr><tr><td>Deep-learning-based security</td><td>Low extra hardware, high computation requirements</td><td>No</td><td>Often limited (training and CSI dependence)</td><td>Low, but requires training, CSI, and is environment-sensitive</td><td>Mostly simulation</td><td>[14,15]</td></tr><tr><td>Backscattering rectifier (BR) identification</td><td>Low (dedicated backscattering rectifier)</td><td>Yes</td><td>Yes (protocol-independent)</td><td>Low, ~84 µJ overhead for a ~10 mJ cycle, with harvesting efficiency loss >10%</td><td>Experimental proof of concept</td><td>[16,17]</td></tr><tr><td>Polarization-Shift Backscatter Identification</td><td>Low, dedicated polarization backscattering add-on module</td><td>No</td><td>Yes (protocol-independent)</td><td>Very low, ~96 µJ overhead for a ~10 mJ cycle, with low harvesting efficiency loss (~5%)</td><td>Experimental proof of concept</td><td>This work</td></tr></tbody></table>
The remainder of this paper is organized as follows. Section 2 presents the proposed polarization-shift backscattering concept and the fail-safe RF switch-based architecture. Section 3 describes the experimental setup, measurement methodology, and experimental outcomes, including backscattering performance, RF-to-DC efficiency, and energy consumption analysis. Section 4 discusses the obtained results and their implications. Finally, Section 5 concludes the paper and outlines directions for future work.

## 2. The Polarization-Shift Backscattering Security

In a standard dual-wave SWIPT architecture, a P-wave is generated by the RF source at the Communication Node (CN) to wirelessly supply energy to the BFSN, while a separate wave is used for data communication through the BFSN's transceiver. The proposed concept leverages the P-wave (normally used solely for energy harvesting) to introduce an additional security layer by enabling the BFSN to backscatter an identification signal even when its transceiver is turned off to conserve energy. This backscattered identification is controlled by a digital private key (PvK) generated by the BFSN's low-power microcontroller, using minimal energy through simple General-Purpose Input/Output (GPIO) pin toggling. At the CN level, where no power constraints exist and a single CN can manage multiple BFSNs, a P-wave monitor is incorporated to detect and verify the backscattered identification signals. The key innovation contributed by this work lies in transmitting the backscattered wave (uplink from the BFSN to the P-wave monitor) with an orthogonal polarization relative to the incoming P-wave, thereby mitigating clutter and cross-jamming effects typically observed in real-world environments. As a result, an extra authentication layer is added without modifying the data communication protocol (see Figure 1), and with minimal additional power consumption.

<figure><img src="image_3.png" /><figcaption>**Figure 1.** Architecture of the dual-wave SWIPT system integrating the polarization-shift backscatter security layer, illustrating the additional key components (RF Switch and P-wave Monitor).</figcaption></figure>

The proposed concept is demonstrated using a LoRaWAN-based BFSN designed beforehand and described in [18], which is built around the CMWX1ZZABZ-091 LoRa module (Murata, Kyoto, Japan). The node incorporates a Power Management Unit (PMU) and an RF rectifier for energy harvesting and regulation, along with a 2.2 mF capacitor for energy buffering and an RF circulator to separate the transmitted data wave and the received P-wave from the same antenna. A temperature and humidity sensor is also integrated. In its original operation, the BFSN remains inactive until sufficient energy is accumulated in the capacitor; once the required threshold is reached, the node initiates a cycle of sensing and subsequently transmits the measured data. The choice of a LoRaWAN-based BFSN
was motivated primarily by its availability (this home-built node had been previously
developed for civil engineering applications).

A fail-safe Single Pole Double Throw (SPDT) RF switch (GRF6011, Guerrilla RF, Greensboro, NC, USA) was added to the BFSN (see Figure 2) without modifying its original RF rectifier [18]. Two monopole antennas (gain: 2.5 dBi) with orthogonal linear polarizations (horizontal and vertical) were connected to the switch. In the absence of power or control signals, the fail-safe switch remains in its default state, connecting the BFSN to the V-polarized antenna and introducing only minimal insertion loss (≤0.4 dB) at the RF input. When sufficient energy is stored in the capacitor, the LoRa module is configured to toggle the switch control signal, redirecting the received P-wave toward the H-polarized antenna. This operation enables controlled backscattering in the opposite polarization, determined by the digital PvK. The PvK consisted of a 16-bit preamble (0xAAAB) followed by 16 bytes of key Manchester encoded at a frequency up to 50 kHz.

<figure><img src="image_4.png" /><figcaption>**Figure 2.** (a) Fail-safe SPDT RF switch assembled on an FR4 0.8 mm substrate with SMA connectors; (b) LoRaWAN-based BFSN integrating the RF switch, connected to two antennas arranged in a cross-polarized configuration; the inset illustrates the schematic of the proposed add-on polarization-shift backscatter module.</figcaption></figure>

Manchester encoding was chosen because its self-clocking property guarantees a transition at the center of each bit period, enabling robust clock recovery at the receiver even under amplitude variations induced by polarization switching, multipath effects and environmental reflections. Moreover, its DC-balanced characteristic avoids long steady states, ensuring regular polarization transitions and predictable energy consumption. In contrast, encoding schemes such as OOK, NRZ or Miller may introduce long sequences without transitions, which can impair synchronization and reduce the reliability of polarization-based backscatter detection.

**3. Experiments and Results**

To evaluate the proposed polarization-shift backscattering concept, an experimental
system was deployed in a real-world environment consisting of a LoRaWAN-based BFSN
equipped with a fail-safe RF switch and a corresponding Communication Node (CN).
The CN integrated an Anritsu MG3694B RF signal generator used as the continuous-
wave RF power source and a Tektronix RSA306B USB spectrum analyzer to monitor the
backscattered signal, in addition to a LoRaWAN gateway for conventional data reception.
## 3.1. Antenna and Polarization Configuration

The RF source was connected to a vertically polarized monopole antenna identical to that of the BFSN (gain: 2.5 dBi), while the spectrum analyzer employed an identical monopole antenna oriented for horizontal polarization. The two monopole antennas at the CN were thus orthogonally polarized and directly oriented, such that the radiation minimum of the horizontally polarized receiving antenna was aligned toward the vertically polarized transmitting antenna. This configuration minimizes direct coupling between the transmit and receive chains at the CN. The vertical polarization was used to efficiently transfer energy from the RF source to the vertically polarized BFSN harvesting antenna, while the horizontally polarized spectrum analyzer antenna was dedicated to receiving the polarization-shifted backscattered signal from the BFSN's horizontal backscattering antenna, thereby enhancing isolation between the P-wave and backscattered wave components.

## 3.2. Operating Conditions

The BFSN was positioned at a distance of 2 m from the CN, as illustrated in Figure 3, providing a representative deployment scenario. The RF source transmitted a continuous P-wave at 868 MHz with an output power of 22 dBm, corresponding to an EIRP of 24.5 dBm and remaining within European regulatory transmission limits.

<figure><img src="image_5.png" /><figcaption>**Figure 3.** Experimental setup showing the Communication Node (comprising the RF source, LoRaWAN gateway, and spectrum analyzer) and the BFSN with the fail-safe switch, using orthogonal polarizations for the P-wave and the backscattered P-wave.</figcaption></figure>

## 3.3. Backscattering Identification

The BFSN successfully backscattered the identification PvK by alternating between vertically and horizontally polarized antennas through the fail-safe RF switch. Specifically, switching the RF path redirected the received incident P-wave from the harvesting antenna to the orthogonally polarized backscattering antenna port, thereby modulating the polarization of the reradiated signal. This polarization switching produced a Manchester-encoded amplitude variation that was detected by the spectrum analyzer (P-wave monitor) prior to the transmission of temperature and humidity data via the LoRaWAN gateway. As shown in Figure 4, the PvK was reliably extracted from the received backscattered P-wave and verified at the CN, despite the presence of a visible noise floor originating from residual cross-polarization leakage, scene reflections, and polarization changes, confirming the feasibility of the proposed secure identification mechanism. Importantly, this PvK-based authentication layer is achieved using only an additional polarization switching module, without requiring any modification to the original BFSN circuitry.
<figure><img src="image_6.png" /><figcaption>**Figure 4.** Polarization-shift backscattered private key captured by the spectrum analyzer, showing all 18 bytes (16-bit preamble 0xAAAB and 16-byte PvK) annotated, with a zoomed-in view of one byte illustrating the bit-level structure.</figcaption></figure>

### 3.4. RF-to-DC Conversion Efficiency Comparison

To provide a fair comparison between the proposed add-on module (fail-safe RF switch with orthogonally polarized antennas) and backscattering-rectifier-based approaches, RF-to-DC conversion efficiency measurements were performed on three prototypes: (i) the original BFSN rectifier, (ii) the backscattering rectifier, and (iii) the proposed fail-safe switch port feeding the original rectifier. All measurements were conducted at the operating frequency of 868 MHz, which corresponds to the best-matched frequency for all three prototypes, using a 10 kΩ load, while sweeping the RF input power applied to each prototype. This evaluation framework allows a direct assessment of the impact of the backscattering mechanisms on energy-harvesting efficiency, results illustrated in Figure 5.

<figure><img src="image_7.png" /><figcaption>**Figure 5.** Measured RF-to-DC conversion efficiency as a function of input RF power at 868 MHz (best-matched frequency for all prototypes) with a 10 kΩ load, comparing the original BFSN rectifier, the dedicated backscattering rectifier, and the proposed fail-safe RF switch port feeding the original rectifier.</figcaption></figure>

The efficiency comparison in Figure 5 shows that both the backscattering rectifier and the proposed add-on module exhibit lower RF-to-DC conversion efficiency than the original BFSN rectifier, as expected due to the additional losses. However, the proposed add-on module, which introduces a maximum insertion loss of only 0.4 dB, consistently outperforms the backscattering rectifier by at least 3% across the evaluated input power
range. Moreover, the efficiency curve of the add-on module closely follows the shape of the original rectifier, indicating that the intrinsic harvesting behavior of the BFSN is preserved. At higher input power levels, the proposed approach achieves more than 15% higher efficiency than the backscattering rectifier, demonstrating a clear advantage in energy-harvesting performance while avoiding any modification to the original BFSN circuitry.

### 3.5. Energy Consumption Comparison

After validating the backscattering capability and evaluating the harvesting efficiency, the energy consumption impact of the proposed identification mechanism was analyzed. In normal operation, the BFSN executes a periodic cycle consisting of system initialization, sensor acquisition, and data transmission via its LoRaWAN radio transceiver. In the proposed security concept, an additional 3 ms backscattering sequence via GPIO toggling is inserted immediately before radio transmission to identify the node. Current consumption measurements were performed for three configurations: (i) the original BFSN, (ii) the BFSN using a backscattering rectifier for identification, and (iii) the BFSN equipped with the proposed fail-safe RF switch add-on module. The measured current consumption profiles of these tasks as a function of time are presented in Figure 6, enabling a direct comparison of the overhead introduced by each identification approach.

<figure><img src="image_8.png" /><figcaption>**Figure 6.** Measured current consumption profiles versus time for the original BFSN, the BFSN with backscattering-rectifier-based identification, and the BFSN with the proposed add-on module-based identification. Each operational phase is annotated on the graph, and the corresponding energy consumption (in mJ) is indicated in the labels of each profile.</figcaption></figure>

As shown in Figure 6, the current consumption profiles of both backscattering-based identification mechanisms are temporally shifted with respect to the original BFSN operation due to the insertion of the 3 ms backscattering sequence immediately before radio transmission. The backscattering-rectifier-based approach introduces an additional energy consumption of approximately 84 µJ compared to the original BFSN, while the proposed fail-safe RF switch add-on module results in an energy overhead of about 95 µJ, exceeding the backscattering-rectifier solution by only 11 µJ. In both cases, the added energy consumption is negligible when compared to the total energy required for a complete BFSN operational cycle. These results demonstrate that the proposed identification mechanisms provide an additional security layer at a very low energy cost, with the fail-safe switch approach achieving this without modifying the original BFSN circuitry.
### 3.6. *Experimental Outcomes Summary*

The experiments confirm that identification can be achieved using orthogonal-polarization backscattering with omnidirectional monopole antennas at a distance of 2 m, without the need for directional antennas as required by backscattering-rectifier-based approaches [16,17].

RF-to-DC efficiency measurements show that the proposed fail-safe RF switch add-on preserves the efficiency profile of the original BFSN rectifier and consistently outperforms the backscattering rectifier by 5–15% while introducing only minimal insertion loss.

Finally, energy consumption analysis demonstrates that the additional 3 ms backscattering-based identification sequence introduces a negligible overhead ($\le 95$ µJ) compared to the total BFSN operational cycle (>10 mJ), with the proposed add-on module consuming only 11 µJ more than the backscattering-rectifier approach, while enabling secure identification without modifying the original BFSN circuitry.

## 4. Discussion

The experimental results demonstrate the feasibility of introducing a secure identification layer in BFSNs by exploiting polarization-shift backscattering controlled through a fail-safe RF switch. The identification $PvK$ was retrieved seamlessly at the CN, confirming that a reliable backscattered signal can be generated without the need for a dedicated backscattering rectifier. This is a notable outcome, as it enables the BFSN to retain its original and more efficient RF rectifier for harvesting, thereby avoiding circuit modifications and facilitating integration into existing BFSN designs. Additionally, backscattering the $PvK$ using an orthogonal polarization relative to the incoming waveform reduces clutter and cross-jamming effects.

The use of a 16-byte (128-bit) $PvK$ was deliberately chosen to align with AES-128, which is already implemented in most low-power IoT communication protocols and hardware platforms. AES-128 provides a well-established security level while operating on 128-bit blocks, thereby avoiding additional memory, computational, or energy overhead at the BFSN. This choice ensures seamless integration of the proposed identification layer without modifying the existing cryptographic infrastructure of the node. For long-term deployments, security can be further enhanced without increasing BFSN resource consumption by combining the private key with complementary mechanisms such as a public key embedded in the incident RF waveform that can be modulated through polarization-based backscattering using the $PvK$, enabling freshness and replay protection while preserving the ultra-low-power operation of the BFSN.

For demonstration purposes, the backscattering module was implemented using two antennas with orthogonal linear polarizations. A more compact alternative could be achieved by replacing the two antennas with a single two-port dual-polarization antenna, which reduces footprint and simplifies integration while providing co-located orthogonal ports. Numerous dual-polarized antennas have been reported for sub-GHz and IoT bands, including meandered or miniaturized dipole designs [19] and other representative works [20–23], demonstrating high port isolation and good polarization purity. These results confirm the feasibility of employing a single dual-polarized antenna for orthogonal-polarization backscattering. However, further work on antenna miniaturization is required to fully meet the size and integration constraints of BFSNs. The use of circularly polarized antennas in future implementations may further enhance robustness, as circular polarization is inherently more resilient to polarization changes and orientation mismatch.

The fail-safe SPDT switch introduced into the BFSN exhibited minimal impact on system performance. In its default state (for most of the operational time and while harvesting), it consumes no power and introduces only a maximum insertion loss of 0.4 dB,
which affects the normal operation and harvesting efficiency of the BFSN significantly less (5–15%) than a dedicated backscattering rectifier, as confirmed by the RF-to-DC efficiency measurements. When switching polarization, the switch draws at most 1.8 mA (1 mA supply plus 800 µA control current). Given that switching occurs only during the brief interval required to encode the Manchester-balanced PvK sequence, the resulting energy overhead is minimal. For the 3 ms backscattered sequence shown in Figure 4, the theoretically additional energy consumption due to the RF switch is approximately 8.9 µJ, corresponding to the effective ON time imposed by the Manchester encoding. The energy $E_{switch}$ is computed as:

$$E_{switch} = I_{switch} \times V_{switch} \times t_{on} \qquad (1)$$

where

$$I_{switch} = 1.8 \text{ mA}, V_{switch} = 3.3 \text{ V}, t_{on} = 1.5 \text{ ms} \qquad (2)$$

Yielding

$$E_{switch} = 1.8 \times 10^{-3} \times 3.3 \times 1.5 \times 10^{-3} \approx 8.9 \mu J \qquad (3)$$

This theoretical value considers only the RF switch operation. When the small and well-defined additional consumption of the microcontroller during the switching interval is taken into account, the total energy overhead becomes predictable and consistent with the experimentally measured value of approximately 95 µJ. In all cases, this overhead remains negligible compared to the total BFSN operational cycle energy (>10 mJ), confirming that the proposed identification mechanism introduces a very low and controlled energy cost.

## 5. Conclusions

This work demonstrated a practical and easy-to-implement method for enhancing the security of battery-free sensor nodes in the context of SWIPT by introducing protocol-independent authentication through polarization-shift backscattering controlled by a fail-safe RF switch. The approach enables the use of the existing high-efficiency RF rectifier for energy harvesting while adding minimal power overhead and requiring no modifications to the BFSN’s original circuitry. Compared to backscattering-rectifier-based solutions, the proposed add-on consumes only 11 µJ additional energy while achieving 5–15% higher RF-to-DC conversion efficiency. As a result, a complementary authentication layer was added without modifying the data communication protocol. Experimental results confirmed successful extraction of the backscattered private key, validating the feasibility of the concept. This lightweight and easily integrable add-on solution offers a promising pathway for securing BFSNs within dual-wave SWIPT architectures, with potential improvements achievable through optimized polarization schemes, including circular polarization and compact dual-port dual-polarized antennas. While a spectrum analyzer was used in this work to validate the concept, future work will focus on the design and evaluation of a low-cost practical reader (P-wave Monitor), such as an SDR-based receiver or an envelope detector, for real-time detection of backscattered identification signals.

**Author Contributions:** Conceptualization, A.T.; methodology, A.T.; software, T.E.D.; validation, T.E.D. and A.T.; formal analysis, T.E.D.; investigation, T.E.D.; resources, A.T.; data curation, T.E.D.; writing—original draft preparation, T.E.D.; writing—review and editing, T.E.D. and A.T.; visualization, T.E.D.; supervision, A.T.; project administration, A.T.; funding acquisition, A.T. All authors have read and agreed to the published version of the manuscript.

**Funding:** This research was funded, in whole or in part, by the French National Research Agency (ANR) under the project "ANR-25-CE39-5853-01".

**Data Availability Statement:** The original contributions presented in this study are included in the article. Further inquiries can be directed to the corresponding author.
**Acknowledgments:** The authors express their gratitude to Gaël Loubet for designing the LoRaWAN-based battery-free sensor node and to Quentin Bernyer for his assistance during the experiments.

**Conflicts of Interest:** The authors declare no conflict of interest.

## References

1. Ni, T.; Sun, Z.; Han, M.; Xie, Y.; Lan, G.; Li, Z.; Gu, T.; Xu, W. REHSense: Towards Battery-Free Wireless Sensing via Radio Frequency Energy Harvesting. In Proceedings of the Twenty-Fifth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing, Athens, Greece, 1 October 2024; Association for Computing Machinery: New York, NY, USA, 2024; pp. 211–220.

2. Palazzi, V.; Correia, R.; Gu, X.; Hemour, S.; Wu, K.; Costanzo, A.; Masotti, D.; Fazzini, E.; Georgiadis, A.; Kazemi, H.; et al. Radiative Wireless Power Transfer: Where We Are and Where We Want to Go. *IEEE Microw. Mag.* **2023**, *24*, 57–79. [CrossRef]

3. de Almeida, J.V.; Gu, X.; Wu, K. SWIPT Base Stations for Battery-Free, Wirelessly Powered IoT Networks: A Review on Architectures, Circuits and Technologies. *IEEE Microw. Mag.* **2024**, *25*, 22–40. [CrossRef]

4. Yao, Y.; Sun, P.; Liu, X.; Wang, Y.; Xu, D. Simultaneous Wireless Power and Data Transfer: A Comprehensive Review. *IEEE Trans. Power Electron.* **2022**, *37*, 3650–3667. [CrossRef]

5. Huang, J.; Xing, C.-C.; Wang, C. Simultaneous Wireless Information and Power Transfer: Technologies, Applications, and Research Challenges. *IEEE Commun. Mag.* **2017**, *55*, 26–32. [CrossRef]

6. Jiang, T.; Zhang, Y.; Ma, W.; Peng, M.; Peng, Y.; Feng, M.; Liu, G. Backscatter Communication Meets Practical Battery-Free Internet of Things: A Survey and Outlook. *IEEE Commun. Surv. Tutor.* **2023**, *25*, 2021–2051. [CrossRef]

7. Tepecik, A.; Ağrak, A.F. Analysis of Lorawan Protocol and Attacks Against Lorawan-Based IoT Devices. *Int. J. Appl. Methods Electron. Comput.* **2024**, *12*, 33–39. [CrossRef]

8. Milarokostas, C.; Tsolkas, D.; Passas, N.; Merakos, L. A Comprehensive Study on LPWANs with a Focus on the Potential of LoRa/LoRaWAN Systems. *IEEE Commun. Surv. Tutor.* **2023**, *25*, 825–867. [CrossRef]

9. Morais, D.H. Bluetooth 5/6 Overview. In *5G/5G-Advanced, Wi-Fi 6/7, and Bluetooth 5/6: A Primer on Smartphone Wireless Technologies*; Morais, D.H., Ed.; Springer Nature: Cham, Switzerland, 2025; pp. 181–204, ISBN 978-3-031-82830-0.

10. Ma, R.; Wu, H.; Ou, J.; Yang, S.; Gao, Y. Power Splitting-Based SWIPT Systems with Full-Duplex Jamming. *IEEE Trans. Veh. Technol.* **2020**, *69*, 9822–9836. [CrossRef]

11. Gong, P.; Chen, T.M.; Xu, P.; Chen, Q. DS-SWIPT: Secure Communication with Wireless Power Transfer for Internet of Things. *Secur. Commun. Netw.* **2022**, *2022*, 2650474. [CrossRef]

12. Thien, H.T.; Tuan, P.-V.; Koo, I. A Secure-Transmission Maximization Scheme for SWIPT Systems Assisted by an Intelligent Reflecting Surface and Deep Learning. *IEEE Access* **2022**, *10*, 31851–31867. [CrossRef]

13. Xu, Y.; Xie, H.; Liang, C.; Yu, F.R. Robust Secure Energy-Efficiency Optimization in SWIPT-Aided Heterogeneous Networks with a Nonlinear Energy-Harvesting Model. *IEEE Internet Things J.* **2021**, *8*, 14908–14919. [CrossRef]

14. Ganapathy, V.; Ramachandran, R.; Ohtsuki, T. Deep Learning Methods for Secure IoT SWIPT Networks. *IEEE Internet Things J.* **2024**, *11*, 19657–19677. [CrossRef]

15. Jiang, W.; Wang, J.; Hsiung, K.-L.; Chen, H.-Y. GRNN-Based Detection of Eavesdropping Attacks in SWIPT-Enabled Smart Grid Wireless Sensor Networks. *IEEE Internet Things J.* **2024**, *11*, 37381–37393. [CrossRef]

16. Djidjekh, T.E.; Loubet, G.; Sanogo, L.; Sidibé, A.; Delai, G.; Dragomirescu, D.; Takacs, A. Backscattering Rectifier for Security and Identification in the Context of Simultaneous Wireless Information and Power Transfer. In Proceedings of the 2024 54th European Microwave Conference (EuMC), Paris, France, 24–26 September 2024; IEEE: Paris, France, 2024; pp. 300–303.

17. Djidjekh, T.E.; Loubet, G.; Takacs, A. Backscattering-Based Security in Wireless Power Transfer Applied to Battery-Free BLE Sensors. In Proceedings of the 2025 IEEE Wireless Power Technology Conference and Expo (WPTCE), Rome, Italy, 3–6 June 2025; IEEE: Rome, Italy, 2025; pp. 1–4.

18. Loubet, G.; Sidibe, A.; Herail, P.; Takacs, A.; Dragomirescu, D. Autonomous Industrial IoT for Civil Engineering Structural Health Monitoring. *IEEE Internet Things J.* **2024**, *11*, 8921–8944. [CrossRef]

19. Seo, D.-G.; Kim, J.-H.; Ahn, S.-H.; Lee, W.-S. A 915 MHz Dual Polarized Meandered Dipole Antenna with Dual Resonance. In Proceedings of the 2018 International Symposium on Antennas and Propagation (ISAP), Busan, Republic of Korea, 23–26 October 2018; pp. 1–2.

20. Wu, R.; Chu, Q.-X. A Wideband Dual-Polarized Antenna for LTE700/GSM850/GSM900 Applications. *IEEE Antennas Wirel. Propag. Lett.* **2017**, *16*, 2098–2101. [CrossRef]

21. Cui, G.; Zhou, S.-G.; Gong, S.-X.; Liu, Y. A compact dual-polarized antenna for base station application. *PIER Lett.* **2016**, *59*, 7–13. [CrossRef]
22. Miran, E.A.; Çiydem, M. A Low-Profile High Isolation Wideband Dual-Polarized Antenna for Sub-1 GHz Base Stations. *Gazi Univ. J. Sci.* **2024**, *37*, 677–686. [CrossRef]

23. Qiu, S.; Wu, C.; Qiu, J.; Denisov, O.; Molebny, V. A Dual-Polarized Crisscross-Shaped Antenna with Enhanced Front-to-Back Ratio for Base Stations. In Proceedings of the 2022 IEEE MTT-S International Microwave Workshop Series on Advanced Materials and Processes for RF and THz Applications (IMWS-AMP), Guangzhou, China, 13–15 November 2022; pp. 1–3.

**Disclaimer/Publisher's Note:** The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.