Ethernet card discrimination using unintentional cable emissions and constellation-based fingerprinting

Abstract

Improved network security is addressed using device dependent physical-layer (PHY) based fingerprints from Ethernet cards to augment traditional MAC-based ID verification. The investigation uses unintentional Ethernet cable emissions and device fingerprints comprised of Constellation-Based, Distinct Native Attribute (CB-DNA) features. Near-field collection probe derivative effects dictated the need for developing a twodimensional (2D) binary constellation for demodulation and CB-DNA extraction. Results show that the 2D constellation provides reliable demodulation (bit estimation) and device discrimination using symbol cluster statistics for CB-DNA. Bit Error Rate (BER) and Cross-Manufacturer Discrimination (CMD) results are provided for 16 devices from 4 different manufactures. Device discrimination is assessed using both Nearest Neighbor (NN) and Multiple Discriminant Analysis, Maximum Likelihood (MDA/ML) classifiers. Overall results are promising and include CMD average classification accuracy of %C = 76.73% (NN) and %C = 91.38% (MDA/ML).

Conditional Constellation Based-Distinct Native Attribute (CB-DNA) fingerprinting for network device authentication

“…Earlier related work in CB-DNA [18], [19] shows the development of a binary constellation from unintentional 10BASE-T Ethernet cable emissions and verified using bit error rate testing. The generation of a constellation for each device was accomplished through a symbol projection mechanism that transformed each communication symbol into a constellation point for a given burst (Ethernet frame).…”

“…The first limitation in [8] was addressed in [18], [19] by using signal response transformation, alternate feature types, and conditional fingerprint features. Specifically, the classification work in [18] introduced a Constellation-Based Distinct Native Attribute (CB-DNA) feature generation method that projects unintentional Ethernet cable emissions (communication symbols) into a binary constellation space that enables both bit estimation and CB-DNA feature extraction from binary symbol clusters. Work in [18] was expanded in [19] to include classification using CB-DNA features extracted from conditional constellation sub-clusters, with improvements of 15% to 20% in average percent correct classification realized.…”

“…To motivate the device ID verification work here, background information is first provided on prior CB-DNA device discrimination works [18], [19] given that results herein are a direct extension. The section describes the signal collection process and construction of the device fingerprints.…”

Securing ZigBee Commercial Communications Using Constellation Based Distinct Native Attribute Fingerprinting

“…The CB-DNA Fingerprinting method developed here differs considerably and exploits features extracted from full-burst responses, including regions where variant (data dependent) symbols are transmitted. The CB-DNA Fingerprinting development here is motivated by concepts first used in [13] to discriminate Ethernet cards but it fundamentally differs in that work in [13] is based on features extracted from a contrived (nonconventional) binary constellation while the development here is for any application using conventional M-QAM signaling as introduced in Section 2.1. The development for unconditional and conditional fingerprinting is supported by the process depicted in Figure 3.…”

“…The Constellation Based DNA (CB-DNA) development here is motivated by concepts introduced in [13] used to discriminate Ethernet cards with features extracted from a contrived (nonconventional) binary constellation. The extension to this earlier work includes (1) formal analytic development of CB-DNA Fingerprinting for systems using conventional M-ary Quadrature Amplitude Modulation (M-QAM) signaling, (2) demonstration of CB-DNA Fingerprinting applicability to ZigBee and related 802.15.4 communication protocols, and (3) proposition of a network device ID process that incorporates mechanisms of localised RF air monitors that have been vetted for other wireless networks [14][15][16][17] while achieving security benefits of verification-based Multifactor Authentication (MFA).…”