ORF: Onboard Radiometric Fingerprinting System

Mikolai-Alexander Gütschow

June 15, 2023

Radiometric Fingerprinting

Photo by Benjamin Suter at Unsplash

Photo by dcbel at Unsplash

Photo by Austrian National Library at Unsplash

Photo by Karsten Würth at Unsplash

Effects of Hardware Imperfections

  • IQ modulation: combination of two baseband signals \(I(t)\) and \(Q(t)\)

  • carrier frequency offset \(CFO = f_{rx} - f_{tx}\)
  • also mismatch in phase and (sampling) time
  • IQ plot: 2D-representation of \(I(t)\) and \(Q(t)\)

  • distortions in constellation diagram

Outline

  • Background
  • Implementation
    • Stage 1: IQ Sampling
    • Stage 2: Feature Extraction
    • Stage 3: Fingerprint Classifier
  • Evaluation

Implementation

Platform: nRF52833 SoC

  • 64 MHz Arm Cortex-M4 with FPU
  • 512 KB ROM, 128 KB RAM
  • PHY protocols:
    • BLE with Bluetooth Direction Finding
    • 802.15.4-2006

Stage 1: IQ Sampling

Onboard IQ Sampling

  • available thanks to BLE DFE

BLE DFE

  • two modes:
    • Angle of Arrival (AoA)
    • Angle of Departure (AoD)
  • direction estimation over CTE (max \(160 \mu s\))
  • sampling during reference period (1 MHz) and once per sample slot (500/250 kHz)

Challenges for ORF

  • IQ sampling at single antenna: AoD
  • high IQ sampling rate: up to 8MHz
  • IQ sampling over whole frame: after ADDRESS event
  • long IQ sampling duration: up to \(504 \mu s\)
  • continuous IQ sampling: investigated for 802.15.4

Stage 2: Feature Extraction

ORF Features

  • synchronization-based and constellation-based
  • typical coherent-receiver pipeline following [1]
    • challenges: device constraints, limited amount of IQ samples
  • Carrier Frequency Offset (CFO)
  1. Rice, Michael. Digital Communications - A Discrete-Time Approach. 1st ed. New York, NY: Prentice Hall, 2008.

Constellation-based Features

  • IQ Offset (IQO)
  • IQ Skew (IQS)
  • Constellation Cloud Shape (CCS)
  • Error Vector Magnitude (EVM)

Stage 3: Fingerprint Classifier

Background: Classification

  • goal: attribute single feature observation \(\vec{f_j}\) to one out of \(M\) classes \(C_i, \; i \in 1, ..., M\)
  • common method: supervised Machine Learning (ML)
    • trained and tested on labeled data \((\vec{f_j}, C_i)\)

ORF Classifier

  • algorithm: Random Forest Classifier
    • simple ML model suitable for classification
    • ensemble learning method combining output of several decision-trees
  • implementation:
    • offboard training, onboard deployment
    • hyperparameters affecting model size and performance

Outline

  • Background
  • Implementation
    • Stage 1: IQ Sampling
    • Stage 2: Feature Extraction
    • Stage 3: Fingerprint Classifier
  • Evaluation

Evaluation

Experimental Setup

  • ideal conditions in anechoic chamber
    • distance 1.3m, SNR: 50dB
  • 802.15.4 frame without SHR: 15B = \(480 \mu s\)
  • sampling frequency: 8MHz → 3800 IQ samples
  • random payload
  • 1 receiver, 32 transmitter devices:
Device Type Tx Rx Amount Tag Year (approx.)
nRF52833 DK X 1 2023
nRF52840 DK X 8 dk* 2020
nRF52840 Dongle X 8 dongle* 2020
Thunderboard Sense 2 X 8 gecko* 2019
Tmote Sky X 8 sky* 2009
  • 1000 frames per transmitter device

Feature Quality

Classification Performance

  • memory/performance tradeoff
  • considered hyperparameters: \(N_\textrm{trees}, N_\textrm{train}\)

\(N_\textrm{trees} = 40, N_\textrm{train} = 20\)

precisionmacro 90.9244
recallmacro 90.9392
accuracy 90.9499
precisionwc 53.5789
recallwc 49.7886

\(N_\textrm{trees} = 20, N_\textrm{train} = 160\)

precisionmacro 92.6734
recallmacro 92.6893
accuracy 92.7005
precisionwc 57.6835
recallwc 54.2184

\(N_\textrm{trees} = 20, N_\textrm{train} = 160\), reduced dataset

precisionmacro 99.0599
recallmacro 99.0564
accuracy 99.0567
precisionwc 92.7294
recallwc 92.4411

Resource Consumption

Delay [ms] Energy [μJ] ROM [B] RAM [B]
Frame Reception 0.5
Feature Extraction 1192.6
Classifier 0.4
Delay [ms] Energy [μJ] ROM [B] RAM [B]
Frame Reception 0.5 10.3
Feature Extraction 1192.6 11895.5
Classifier 0.4 2.7
Delay [ms] Energy [μJ] ROM [B] RAM [B]
Frame Reception 0.5 10.3 682 15200
Feature Extraction 1192.6 11895.5 106465 63168
Classifier 0.4 2.7 210373 0
  • total classification delay: 1.2s
  • energy consumption roughly equivalent to reception of 1000 frames
  • memory-efficient implementation
    • 50% RAM, 75% ROM

Conclusion

  • ORF first onboard radiometric fingerprinting system
  • 92% accuracy under ideal conditions
  • real-world deployment possible:
    • less than 75% memory footprint
    • fast onboard classification: 1.2s
    • total energy consumption: 1.2mJ

Thanks