Passive Steady State RF Fingerprinting: A Cognitive ... · Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable Deployment of Co-channel Femto Cell Underlays

Passive Steady State RF

Fingerprinting: A Cognitive Technique

for Scalable Deployment of Co-channel

Femto Cell Underlays

Presenter: Irwin O. Kennedy, Bell Labs Ireland

Patricia Scanlon: Bell Labs Ireland

Milind Buddhikot: Bell Labs New Jersey

2 | Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

Deployment of Co-channel Femto Cell Underlays | DySPAN October 2008

All Rights Reserved © Alcatel-Lucent 2008

Introduction

• Motivation: Femto signalling storm

• What is an RF Fingerprint?

• Previous work

• Our method

• Experimental setup

• Results

• Conclusions




Motivation: Signalling storm

Introduction of femtocells

• Excellent in-home cellular coverage and capacity

• Household exclusive access

• In range handset will request access to femto

• Core signalling required to resolve tempory ID provided by handset

• 5x-40x (Ho PIMRC 2007) signalling increase due to femto




Motivation: Signalling storm

•FemtoBSR

H1

•Macro-cellBS

A

B

FM1FM2 FM3

FM4 FM5 FM6 FM7

L




Research Overview

What is an RF Fingerprint?

Unique characteristics imbued on a signal

as it passes through the analogue transmit chain.

What is the goal?

Radio transmitter identification.

What is the technical challenge?

To invent low cost techniques that consistently and accurately detect the

transmitters unique RF Fingerprint at the receiver.




A bottom up look at the RF Fingerprint

Implementation may vary within boundaries set by standards.

• Power Amplifier: Linearity.

Local Oscillator: Noise level and stability.

Filters: Shape.

DSP DAC

Mixer

IF RF

LO

Filter

Antenna

Amplifier




Previous Work: Transient Signal

Transient signal: Radiated upon transmitter power on.

Difficulties determining start and end of the transient burst

Not always able to distinguish between same manufacturer/model

Requires high over sampling rates: Non standard receiver architecture

– E.g. 5GSsamples by Serinken et al.

•Transient signal




Our approach: Steady State Frequency DomainApproach

• Transient appeal is its independence from the message content.

• Insight: Digital communications preamble signal is also independent of the

message.

•Steady state signal




Our approach: Processing Chain

Signalanalyser

MATLAB




Our approach: Feature formed from mean power ofspectral slice.

bins

Graph shows power spectral density of identicalpreamble as transmitted by two different radios.

Connected to receiver via cable.

FFT




Our approach: k Nearest Neighbour Classifier (kNN)

•k Nearest Neighbour

•Simple but powerfulclassifier

•Distinguish between linearlyseparable classes.

•Euclidean distance +majority vote of k nearestneighbours (where k is odd)

Feature 2

Feature 1

?Class 1

Class 2

t=1

t=2

kNNClassifier

Training

Testing

instance

class label

instance class

label

t=0

Train

Test

kNNClassifier




Measurement Apparatus: Basestation and analyser

Agilent PSA SignalAnlayser

Laptop for commandingFSQ26 in C via SCPIinterface and Ethernet

UMTS UE – 1 of 20

UL Antenna DL Antenna

ALU 2100MHz UMTSBase Station

Laboratory environment

UMTS downlink broadcastSystem Information Blocks

(SIBs) edited so that the samepreamble is transmitted by

phones.




Measurement apparatus: UMTS Handsets and PCMCIAcards




Results: Model classification performance againstnumber of bins under different SNR




Result: Best classification performance against SNR for all 7UMTS handset models




Result: Confusion matrix for all 20 UMTS handsets at15dB SNR

Merlin U530




Result: Handset classification performance against number ofbins under different SNR




Conclusions

•Radio identification using frequency domain features and a k-NNclassifier

•91% classification accuracy on 7 UMTS models

•85% classification accuracy on 20 UMTS handsets/cards

•Confusion matrix analysis suggests performance improvementsfeasible

Future

•Extend to a larger number of phone models

• Investigate the effects of a multipath wireless channel

• Investigate the effects of temperature

Documents

Passive Steady State RF Fingerprinting: A Cognitive ... · Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable Deployment of Co-channel Femto Cell Underlays