Research Area

Batteryless Secure IoT Modules Using Energy Harvesting

We develop low-cost authentication techniques for batteryless IoT modules by using device-specific variations in energy-harvesting time caused by manufacturing differences.

Overview

Power supply and battery replacement are major challenges in large-scale Internet of Things (IoT) deployments. Energy harvesting addresses these challenges by collecting energy from sources such as sunlight, wind, water flow, vibration, radio waves, and heat, and converting it into electrical energy. This makes it possible to build IoT systems that require neither fixed power wiring nor periodic battery replacement.

This research proposes a new authentication method for energy-harvesting devices. The method focuses on differences in the time required by individual devices to harvest sufficient energy. These timing differences arise from manufacturing variations and can therefore serve as device-specific characteristics.

Unlike conventional physically unclonable function (PUF) approaches, the proposed method does not require an additional dedicated PUF circuit. It can therefore provide device authentication at lower hardware cost by reusing the normal charging and wireless-transmission behavior of the energy-harvesting IoT module.

Research Objective

Batteryless Operation

Support secure IoT operation without power wiring or regular battery replacement.

No Additional PUF Circuit

Authenticate devices using an inherent physical characteristic of the energy-harvesting module.

Practical Device Evaluation

Verify the method using real photovoltaic cells and TWELITE energy-harvesting devices.

Step 1
Variation in Energy-Harvesting Time

The proposed method uses differences in energy-harvesting time among nominally identical devices. The power generated by each energy-harvesting device varies because of small manufacturing differences. Consequently, the time required to charge the internal capacitor and restart the IoT module also varies from device to device.

Photovoltaic Power

The maximum power generated by a photovoltaic cell is expressed as:

Pmax = VOC ISC ff

where VOC is the open-circuit voltage, ISC is the short-circuit current, and ff is the fill factor.

The open-circuit voltage can be represented as:

VOC = (kT/q) ln[((NA + Δn)Δn) / ni2]

Here, kT/q is the thermal voltage, NA is the doping concentration, Δn is the excess carrier concentration, and ni is the intrinsic carrier concentration.

The doping concentration of the silicon semiconductor differs slightly because of process variation. This affects the open-circuit voltage and generated power, which in turn produces measurable differences in the charging or energy-harvesting time of each photovoltaic device.

Step 2

Authentication Based on Energy-Harvesting Time

The TWELITE energy-harvesting device used in this research turns on when the voltage of its internal capacitor reaches 2.9 V and then communicates wirelessly with a receiver. When the capacitor voltage falls below 2.0 V, the device turns off and returns to charging-only operation.

The proposed method measures the charging interval from the timing of received packets. Let t2 be the time at which the receiver obtains the final packet before the TWELITE device turns off. Let t1 be the time at which the receiver obtains the first packet after the device has harvested enough energy to turn on again. The energy-harvesting time is calculated as:

T = t1 − t2

A device with higher generated power has a shorter transmission interval, whereas a device with lower generated power has a longer interval.

Overview of the proposed authentication method
Figure 1. Overview of the proposed authentication method.

Registration and Authentication

During registration, the mean energy-harvesting time of each device, Tregister, is stored as its reference characteristic. During authentication, the mean time measured from the target device, Ttest, is compared with every registered value.

The difference is calculated as a Euclidean distance d. The registered device that produces the smallest distance is selected as the identity of the test device.

Authentication Decision

The method identifies the target device by finding the registered energy-harvesting profile that is closest to the measured test profile.

Step 3

Outlier Correction

Measured energy-harvesting times may contain outliers caused by temporary changes in illumination, communication timing, measurement noise, or other environmental factors. Such outliers can distort the mean value and reduce authentication accuracy.

To reduce this influence, the proposed method introduces a correction process. Values greater than an upper threshold, Thtop, and values lower than a bottom threshold, Thbottom, are removed before the mean energy-harvesting time is calculated.

Upper-Value Removal

Measurements exceeding Thtop are excluded as unusually long charging intervals.

Lower-Value Removal

Measurements below Thbottom are excluded as unusually short intervals.

Stable Device Profile

The corrected measurements provide a more stable value for device comparison.

Experimental Evaluation

Five photovoltaic cells were evaluated. For each test device, the Euclidean distance between its test data and the registration data of all five devices was calculated. Authentication was considered successful when the smallest distance corresponded to the same device number as the test data.

Table 1. Euclidean distances between test and registration data
Test Data Registration No. 1 Registration No. 2 Registration No. 3 Registration No. 4 Registration No. 5 Result
No. 1 7.64 50.6 163 82.5 183 Success
No. 2 31.4 11.6 124 43.5 144 Success
No. 3 158 115 1.83 82.7 17.9 Success
No. 4 81.5 38.5 74.2 6.59 94.0 Success
No. 5 133 90.0 22.8 58.0 42.6 Failure

Devices No. 1 through No. 4 were correctly authenticated. Device No. 5 was incorrectly identified as No. 3 because the energy-harvesting characteristics of these two photovoltaic cells were comparatively close.

Key Findings

Four of Five Devices Identified

The experiment achieved correct authentication for four of the five evaluated photovoltaic devices.

Low-Cost Authentication

Device identity was derived from ordinary energy-harvesting behavior without adding a dedicated PUF circuit.

Need for Better Separation

Authentication becomes difficult when two devices have similar generation-time distributions, motivating the use of additional features or repeated measurements.

Research Significance

Manufacturing variation in an energy-harvesting component can serve not only as an implementation constraint but also as a lightweight security characteristic for batteryless IoT modules.

Future Work

Future work includes evaluating more devices, analyzing the influence of illumination and temperature changes, improving threshold selection, combining multiple timing features, and introducing confidence thresholds that reject ambiguous authentication results rather than forcing a potentially incorrect match.

Keywords

Batteryless IoT Energy Harvesting Device Authentication Photovoltaic Cell Manufacturing Variation Physically Unclonable Function TWELITE Secure IoT Module

Related Publications

← Back to Research Areas