Radio Frequency Fingerprinting for Low-end Wireless Devices

Abstract

RF fingerprinting is proposed as a means of providing an additional layer of security for wireless devices. A unique RF fingerprint can be used to establish the identity of a specific wireless transmitter in order to prevent masquerading or impersonation attacks. Unique RF fingerprints are attributable to the analog components (digital-to-analog converters, band-pass filters, frequency mixers and power amplifiers) present in the RF front ends of transmitters. Most of the previous research into RF fingerprinting has used high-end receivers (e.g. Giga-sampling rate oscilloscopes, spectrum and vector signal analysers) to validate the techniques proposed. Promising results, with up to 99% accuracy, have been reported in the literature. However, a receiver also suffers from impairments due to the presence of analog components in its front end, so the analysis and implementation of RF fingerprinting using low-end receivers are the focus of this research. The first contribution of this thesis is that the impairments of the receiver front end are introduced into the overall RF fingerprinting process. The low-end receivers used were “low-cost” and representative of consumer devices that might typically be deployed in future ubiquitous wireless networks. Several low-end identical (same-specification) receivers were used for experiments. Results obtained with low-end receivers were compared with the results from a high-end receiver setup to give an overview of performance comparison. Results have shown that classification accuracy is receiver-specific and less accurate than that achieved with highend receiver. However, the low-end receivers are able to provide useful transmitter classification results at receiver SNRs of 15dB or higher. High receiver SNRs yield good classification results for low-end receivers but high SNRs are not typical in real situations. The second contribution of this thesis is an investigation into the portability of an RF fingerprint across different receivers. The experimental results have shown that the RF fingerprint created with a high-end receiver cannot be used as a universal profile RF fingerprint of a specific transmitter. If a low-end receiver uses profile fingerprints obtained by any other receiver (high-end or low-end alike), the low-end receiver is likely to misclassify transmitters, because the receiver front end also suffers from imperfections in its analog components. Hence, every receiver forms a unique (receiver-specific) RF fingerprint of a given transmitter. Our analysis has shown that the profile fingerprints are specific to the transmitter-receiver pair and can be used only by the receiver that created the original profile. The third contribution is an analysis of RF fingerprinting accuracy in channels with different multipath, time-varying, fading. We simulated such a channel for an indoor environment in a MATLAB communication toolbox with different delay paths and Doppler shifts. Results showed that multipath, time-varying fading has limited effect on the accuracy of RF fingerprinting. Experiments using the CORNET test bed of Virginia Polytechnic Institute and State University tended to confirm these results. The final contribution of this thesis is an assessment, based on a realistic and practical test bed using low-end commodity hardware, of the vulnerability of RF fingerprinting to an impersonation attack. The analysis also took into account the impairments of the inexpensive analog components present in the impersonator’s receiver front end. Our experimental results showed that the uncertainty associated with the low-end hardware increases the challenge for the impersonator of creating a signal that would deceive a legitimate user. Interestingly, because the receiver impairments contribute towards the final RF fingerprint in the receiver, this helps to mitigate an impersonation attack on a system employing RF fingerprinting.