Wireless device identification with radiometric signatures

Abstract

We design, implement, and evaluate a technique to identify the source network interface card (NIC) of an IEEE 802.11 frame through passive radio-frequency analysis. This technique, called PARADIS, leverages minute imperfections of transmitter hardware that are acquired at manufacture and are present even in otherwise identical NICs. These imperfections are transmitter-specific and manifest themselves as artifacts of the emitted signals. In PARADIS, we measure differentiating artifacts of individual wireless frames in the modulation domain, apply suitable machine-learning classification tools to achieve significantly higher degrees of NIC identification accuracy than prior best known schemes.We experimentally demonstrate effectiveness of PARADIS in differentiating between more than 130 identical 802.11 NICs with accuracy in excess of 99%. Our results also show that the accuracy of PARADIS is resilient against ambient noise and fluctuations of the wireless channel.Although our implementation deals exclusively with IEEE 802.11, the approach itself is general and will work with any digital modulation scheme. *

On the Practicality of UHF RFID Fingerprinting: How Real is the RFID Tracking Problem?

“…Besides the mentioned works on UHF RFID tags, physical-layer fingerprinting has been explored on different platforms such as VHF [10,30,32], Bluetooth [15], IEEE 802.11 [5,14,16,33], IEEE 802.15.4 (ZigBee) [7,24], and GSM [25,26]. Physical-layer identification has also been considered for inductive coupled HF RFID devices [6,27,28], especially for detecting cloned or counterfeit HF RFID smart cards and electronic passports.…”

Extrinsic Channel-Like Fingerprint Embedding for Authenticating MIMO Systems

“…Inversion for the case when ∕ = is obtainable via a number of methods such as the pseudoinverse, however this topic is beyond the scope of this paper . An estimate for the intrinsic channel responseĤ[ 0 ] is produced via (10), and thus the data signal can be recovered by pre-multiplying (13) by the inverse of the normalized channel estimate produced by the MMSE estimator, orĤ…”

“…A further advantage to the proposed system is that channel estimates obtained during (10) and (11), and subsequent channel equalization steps preformed in (15) and (17) are identical steps taken by an unmodified/unaware receiver. Thus, we have demonstrated that the fingerprinted signal is received by unaware receivers without modification to the receiver, channel estimation procedure, or equalization device when generalized pilot embedding and channel estimation are employed.…”

“…We note that when the data symbol D[ ] is equalized and decoded according to current CSI, (10) and (11), the intrinsic and extrinsic channel distortions will be corrected when decoding the symbols D[ 0 ] and D [ 1 ]. Thus, when channel model mismatch error during the fingerprinted symbol (14) is omitted, D[ ] will be recovered using the MMSE channel estimate according to (16) and (17).…”

“…In [8] and in [9] multiresolution approaches are considered for narrowband signals, where a low-power fingerprint constellation is superimposed onto the main signal constellation. In [10] the innate characteristics of radio hardware are used for device identification, and in [11] general fingerprinting through superposition is discussed.…”