Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable Deployment of Co-Channel Femto Cell Underlays

Abstract

Recently, cellular operators have begun evaluating femto cells that aggressively reuse spectrum to cover a small spatial footprint (10m radius). A large-scale femto cell underlay network will increase an operator's total number of cells by two to three orders of magnitude and presents significant scaling problems in spectrum reuse. We argue that to achieve this scale and interoperability with the existing UMTS network and handsets, the femto cell must use novel yet simple cognitive techniques: sensing, smart handover and idle mode cell camping. We report in detail on the problem of signaling storms caused by increased core network-signaling load due to idle mode cell camping. We provide a novel passive RF fingerprinting technique as a solution to tackle the problem. The technique is based on frequency domain characteristics. Our technique detects the unique characteristics imbued in a signal as it passes through a transmit chain. We are the first to propose the use of discriminatory classifiers based on steady state spectral features. In laboratory experiments, we achieve 91% accuracy at 15dB SNR based on seven different models of UMTS user equipment. In the largest known laboratory experiment of its kind, we report an accuracy of 85% using our technique on twenty UMTS user equipment. This large test set includes 10 identical devices. Our technique can be implemented using today's low cost high-volume receivers and requires no manual performance tuning.

Steady State RF Fingerprinting for Identity Verification: One Class Classifier versus Customized Ensemble

“…Previous work on RF fingerprinting has focussed mainly on identifying different mobile phone handsets by manufacturer and by model [2,3]. While this work is relevant, the approach used is not sufficient for the five in the house problem.…”

“…When the classifier is tested it is shown both positive samples and negative samples. It has also been shown that handsets of the same model can be harder to distinguish than handsets of a different model [2,3]. The Tiered, Weighted and Double classifiers are constructed in such a way as to potentially allow one of the sub-classifiers to avoid having multiple identical handsets, or if unavoidable at least favor one over the other.…”

“…We extracted 177 features using the frequency domain binning algorithm described in [3]. These captured RACH preambles were used in two classification tasks using the SVM OCC setup.…”

“…The 3GPP UMTS standard recommends the uniquely identifying IMSI (International Mobile Subscriber Identifier) should not be sent in plain text over the air. We discuss this and other motivating aspects of the problem in more depth in papers published previously by the authors [2,3].…”

Analysis of impersonation attacks on systems using RF fingerprinting and low-end receivers

“…The errors introduced by the modulator of the transmitter are utilized in steady state-based (modulation based) RF fingerprinting. Many researchers have explored ways to form unique RF fingerprint from these errors [9,12,23,24,[33][34][35][36][37][38]. Mainly, the offset in Inphase/Quadrature (I/Q) components, frequency error, phase and magnitude errors of the frames, Power Spectral Density coefficients of preambles or variant of these features are used in the modulation-based fingerprinting.…”