Progress Meeting

On-board Radiometric Fingerprinting System

Mikolai-Alexander Gütschow

March 1, 2023

Overview

Three stages

  1. Obtain physical-layer signal measurements (I/Q samples) on SoC
  2. Implement lightweight feature extraction pipeline on SoC
  3. Deploy ML classifier on SoC

Stage 1: Obtain I/Q Samples

System on Chip: nRF52833

  • 64 MHz Arm Cortex-M4 with FPU
  • 512 KB Flash, 128 KB RAM
  • 2 Mbps, 1 Mbps, Long Range
  • BLE with Bluetooth Direction Finding
  • 802.15.4-2006
  • +8 dBm TX Power

BLE Direction Finding

  • high-accuracy indoor location services
  • two modes for determining signal direction
    • Angle of Arrival (AoA)
    • Angle of Departure (AoD)
  • leverage angular phase-shift information from antenna array
  • Constant Tone Extension (CTE): unwhitened sequence of modulated ones
  • I/Q sampling during CTE

Different Protocol Options

  • BLE: 1Mbit/s with GFSK, 2Mbit/s with DQPSK
  • nRF proprietary: 1Mbit/s, 2Mbit/s (unspecified modulation)
  • 802.15.4: data rate 250kbit/s, DSSS chip rate 2Mchip/s with O-QPSK

System Parameters

  • DFECTRL1.DFEINEXTENSION allows to start antenna switching/IQ sampling in payload
  • DFEMODE set to AoD disables antenna switching at receiver, samples continuously
  • DFECTRL1.TSAMPLESPACING allows for maximum sampling rate of 8MHz

System Constraints

  • DFEPACKET.MAXCNT restricts buffer size to 214 − 1 bytes
    • at 8MHz sampling rate corresponds to 16383B / 32us/B ⋅ 1/8us = 63B payload
  • DFECTRL1.NUMBEROF8US restricts IQ sampling time to (26−1) ⋅ 8us = 504us
    • at 250kbit/s which is 4us/bit = 32us/B corresponds to 15.75B payload

Fixed Setup

  • PHY layer: 802.15.4 @ 2.4GHz
  • PPDU without SHR: 1+12+2B PHR + PHY payload + MAC CRC
  • timing: roughly 32us/B ⋅ 15B = 500us for payload
  • sampling at 8MHz for 500us results in 4000 IQ samples

Analysis of Obtained Data

Next steps

Large-Scale Data Acquisition

  • Anechoic chamber
  • Rx: 2 nRF52833
  • Tx: 30 nRF52840 = 15 DK + 15 Dongle
  • 1000 frames per device pair @ 50 frames/s
    • need for fast data retrieval from SoC
  • Tx power: 0dBm
  • Distance 1..5 m depending on SNR

Transition to Stage 2

  • Look into time recovery and fine-frequency recovery
  • Offline feature extraction with Matlab/Python
  • Translate to C for on-board feature extraction, compare accurancy to offline approach

Thanks