Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable Deployment of Co-channel Femto Cell Underlays

Transcription

1 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable Deployment of Co-channel Femto Cell Underlays Presenter: Irwin O. Kennedy, Bell Labs Ireland Patricia Scanlon: Bell Labs Ireland Milind Buddhikot: Bell Labs New Jersey

2 Introduction Motivation: Femto signalling storm What is an RF Fingerprint? Previous work Our method Experimental setup Results Conclusions 2 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

3 Motivation: Signalling storm Introduction of femto cells Excellent in-home cellular coverage and capacity Household exclusive access In range handset will request access to femto Core signalling required to resolve tempory ID provided by handset 5x-40x (Ho PIMRC 2007) signalling increase due to femto 3 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

4 Motivation: Signalling storm A Macro-cell BS B Femto BSR FM1 FM2 FM3 H1 L FM4 FM5 FM6 FM7 4 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

5 Research Overview What is an RF Fingerprint? Unique characteristics imbued on a signal as it passes through the analogue transmit chain. What is the goal? Radio transmitter identification. What is the technical challenge? To invent low cost techniques that consistently and accurately detect the transmitters unique RF Fingerprint at the receiver. 5 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

6 A bottom up look at the RF Fingerprint Mixer Amplifier Filter DSP DAC IF RF Antenna LO Implementation may vary within boundaries set by standards. Power Amplifier: Linearity. Local Oscillator: Noise level and stability. Filters: Shape. 6 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

7 Previous Work: Transient Signal Transient signal Transient signal: Radiated upon transmitter power on. Difficulties determining start and end of the transient burst Not always able to distinguish between same manufacturer/model Requires high over sampling rates: Non standard receiver architecture E.g. 5GSsamples by Serinken et al. 7 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

8 Our approach: Steady State Frequency Domain Approach Transient appeal is its independence from the message content. Insight: Digital communications preamble signal is also independent of the message. Steady state signal 8 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

9 Our approach: Processing Chain Signal analyser MATLAB 9 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

10 Our approach: Feature formed from mean power of spectral slice. bins FFT Graph shows power spectral density of identical preamble as transmitted by two different radios. Connected to receiver via cable. 10 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

11 Our approach: k Nearest Neighbour Classifier (knn) k Nearest Neighbour Simple but powerful classifier Distinguish between linearly separable classes. t=0 Train Feature 1 Euclidean distance + majority vote of k nearest neighbours (where k is odd) Training t=1 instance class label Test knn Classifier Class 1 Class 2? Testing t=2 instance knn Classifier class label Feature 2 11 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

12 Measurement Apparatus: Basestation and analyser Laptop for commanding FSQ26 in C via SCPI interface and Ethernet Agilent PSA Signal Anlayser Laboratory environment ALU 2100MHz UMTS Base Station UL Antenna UMTS UE 1 of 20 DL Antenna UMTS downlink broadcast System Information Blocks (SIBs) edited so that the same preamble is transmitted by phones. 12 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

13 Measurement apparatus: UMTS Handsets and PCMCIA cards 13 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

14 Results: Model classification performance against number of bins under different SNR 14 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

15 Result: Best classification performance against SNR for all 7 UMTS handset models 15 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

16 Result: Confusion matrix for all 20 UMTS handsets at 15dB SNR Merlin U Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

17 Result: Handset classification performance against number of bins under different SNR 17 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable

18 Conclusions Radio identification using frequency domain features and a k-nn classifier 91% classification accuracy on 7 UMTS models 85% classification accuracy on 20 UMTS handsets/cards Confusion matrix analysis suggests performance improvements feasible Future Extend to a larger number of phone models Investigate the effects of a multipath wireless channel Investigate the effects of temperature 18 Passive Steady State RF Fingerprinting: A Cognitive Technique for Scalable