IEEE Solid-States Circuits Magazine - Fall 2022 - 29

environmental changes in communication
channels. A lightweight
convolutional neural network (CNN)
classifier demonstrates the possibility
of accurate and fast inference of
unique features in the IoT environment,
which our approach exploits
to enable on-chip time-varying
RF fingerprints.
The State of the Art
With the growth of the IoT, network
security is becoming an increasingly
significant concern. In addition to
the ever-higher stakes at play due to
the increasing integration of the IoT
into critical infrastructure, industrial
systems, and health-care devices via
sensors, power meters, and so on
[1], the expansive nature of the IoT
makes it possible for attackers to collect
large amounts of information.
This information can be used for the
purpose of defeating security protocols,
enabling attackers to observe or
guess at security parameters used in
conventional authentication protocols,
such as Wi-Fi Protected Access
[2]. This points to a need for security
protocols that serve to authenticate
actual devices within a network, as
opposed to the data being transmitted
from them.
RFF has been investigated as a
software-based device authentication
mechanism that may be implemented
without requiring the redeployment
of physical IoT devices with better
security systems [3], [4], [5], [6]. RF
fingerprints consist of signal features
imprinted upon a radio's transmit
waveform by its inherent hardware
characteristics [e.g., PA nonlinearity,
carrier frequency offset, in-phase/
quadrature (I/Q) imbalance, and so
on] [6] and can serve as unique physical
signatures for their associated radio
when extracted. Approaches that
require some form of data preprocessing,
such as a Gabor transform (GT) or
fast Fourier transform to explicitly
extract RF fingerprints prior to feeding
them into a machine-learning (ML)
classifier [3], [4], [6], and approaches
that simply feed raw I/Q samples to
an ML block for directly distinguishing
radios [5] have both been reported
in the literature.
Many works have contributed to
the RFF literature. These include a
CNN-based RFF system tested on a dataset
of IEEE 802.11a frames collected
from Universal Software Radio Peripheral
SDR transmitters [7], a drone
detection and identification system
using a database of RF signals collected
from drones [8], and a database
of recorded Bluetooth signals for testing
RFF methods [9]. In these studies,
the hardware impairments associated
with each recorded radio that yield RF
fingerprints remain fixed over time.
However, a mixture of security
and user capacity concerns motivates
the study of configurable and timevarying
RFF systems. For instance,
it is possible for attackers to replay
signals from legitimate radios to impersonate
trusted devices and thus
penetrate the RFF authentication [10].
The introduction of a time-varying
aspect to an RFF system would add
another dimension of complexity to
the measures required to successfully
engage in such a replay attack. Furthermore,
the configurability could
be applied to enhance the variability
of RF fingerprints within the system
and thus improve user capacity, such
as in the case of [11].
This work presents an ML-assisted
RF fingerprint classification with a
transmit-side reconfigurable PA for
BLE IoT applications, as illustrated
in Figure 1. PA configurability is
achieved by selecting combinations
of sliced PA transistor elements, altering
the RF fingerprints imparted
upon the transmitted signal in correspondence
with the transistor parameters
associated with the selected
elements. Data recordings are included
for different SNRs to facilitate the
analysis of the impact of noise on RFF
system performance.
The recorded data represent a far
greater assortment of distinct hardware
impairment-induced RF fingerprints
than those presented in the
datasets published in [7], [8], and [9],
the largest of which encompassed
oscilloscope samples from 86 different
Bluetooth-enabled smartphones.
Measurements were conducted
across 220 PA configurations, each
producing a distinct RF fingerprint.
Furthermore, as a result of the RF fingerprints
originating from within the
same device, our dataset represents
a more challenging classification task
and can serve as a stricter validation
tool for RFF systems. Unlike the
works of [7] and [8], a direct RF sampling
transceiver with digital downconversion
(DDC) to minimize the
impact of receiver impairments has
been investigated, so the impact of
custom receiver nonidealities using
RFF1
Tx1
PA
RFF2
Tx2
PA
Adversarial
RF Fingerprints
Rx ML
ML
Module for
Authentication
Tx3
PA
RFF3
Adversarial
RF Fingerprints
FIGURE 1: The RF fingerprint classification with the ML module for authentication. The RF
fingerprints are augmented with a configurable PA in the transmitter.
IEEE SOLID-STATE CIRCUITS MAGAZINE
FALL 2022
29
Authorized RF
Fingerprints
IEEE Solid-States Circuits Magazine - Fall 2022

Table of Contents for the Digital Edition of IEEE Solid-States Circuits Magazine - Fall 2022
