© The Author(s) 2024. Published by EDP Sciences and China Science Publishing & Media Ltd.

1. Introduction

Amidst the rapid development of beyond fifth generation (B5G) and low power wide area network (LPWA) technologies, the Internet of Things (IoT) technology has effectively bridged the gap between technological innovations and human interactions [1]. The extensive array of services offered by 5G has seamlessly integrated people, devices, and networks, heralding the arrival of a new era–the Internet of Everything [2]. Notably highlighted in the Ericsson Mobility Report, is the unparalleled deployment speed of 5G, making it the swiftest adopted mobile communication technology in history. Projections from this report indicate that the count of 5G user equipment will reach 4.4 billion by 2027 [3]. However, the pervasive concern of inherent safety and security (ESS) within wireless communication persists. As information propagates wireless free space through broadcasting, the structure of wireless networks remains susceptible to illegal attacks. The current security authentication method employed within the 5G network is based on key technologies, such as methods reliant on USIM or memory-stored keys. Yet, this approach poses vulnerabilities wherein data leakage and network security breaches can transpire should these keys be compromised [4]. Given that the forthcoming 5G-driven vertical industries are poised to deploy a multitude of IoT devices, the necessity to devise more streamlined access authentication mechanisms tailored for IoT devices becomes evident. In addition, the 5G network confronts a distinctive challenge in the form of air interface denial-of-service (DOS) and distributed denial-of-service (DDoS) attacks. The attackers persistently initiate random access requests to deplete the resources of next-generation NodeB (gNB) [5].

Radiofrequency fingerprinting (RFF), a critical technology in wireless physical layer security, is considered a promising candidate to complement the existing wireless network security problems [6, 7]. Currently, RFF is widely used in protocols such as ZigBee [8, 9], WiFi [10], Automatic Dependent Surveillance-Broadcast (ADS-B) [11, 12] and LoRa [13], and has achieved excellent performance. Due to the non-ideal nature of the device parameters, the actual transmitted wireless signal will be locally overlaid with small-scale RF fingerprint distortions. At the receiver side the unavoidable, stable and unique device hardware difference features coupled to the transmit signal are analyzed and extracted as the device identity. The RFFI method is lightweight and flexible, working at the physical layer. It not only works alone but can also be quickly extended to existing 5G network architectures to aid and enhance network security authentication.

The RFFI method can be roughly divided into feature engineering-based methods and deep learning (DL)-based methods. The latter utilizes state-of-the-art deep learning algorithms to identify transmitters, for example, convolutional neural network (CNN) [14, 15], ResNet [16], long short-term memory (LSTM) [17], inception [18] etc. Liu et al. [19] proposed a distributed sensor fusion-based scheme for RF fingerprint recognition. The received signals are fused into a four-channel image representation and a convolutional neural network is trained. Subsequent incremental learning is achieved by fine-tuning. Zhang et al. [20] proposed a data-and-knowledge dual-driven scheme for RF fingerprint recognition using the multi-scale attentional convolutional network. The protocol knowledge of the signal is exploited to provide higher-level signal semantic information and has the best performance in recognition accuracy at low SNR.

There are few studies on RFF-based cellular network security. On the one hand, due to the challenges of data acquisition in real mobile cellular networks, UEs need to access gNB and the communication parameters are limited by the high-level configuration of gNB. On the other hand, unlike WiFi systems, the frame structure of 5G does not have a preamble. The UE obtains uplink synchronization through the physical random access channel (PRACH) and uses the sounding reference signal (SRS) for uplink channel estimation. In [21], the author uses a triple loss convolutional neural network to perform RFFI on the base station data of the POWDER-measured platform, and the accuracy rate reaches 99.86%. Yin et al. [22] extract differential constellation trajectories from the PRACH preamble to identify 6 LTE UEs. Wu et al. [23] extract the wavelet coefficients of the LTE physical random access channel preamble and input the autoencoder to achieve rogue terminal detection.

In summary, this paper aims at the RFFI for 5G applications and constructs a 5G link-level simulation platform. This platform exhibits the capability to dynamically adjust component impairments, thereby enabling the generation of diverse UE. Specifically, the main RF impairments of direct conversion transmitters [24], include carrier frequency offset (CFO), phase noise (PN), in-phase (I) and quadrature (Q) imbalance, as well as power amplifier nonlinearity [25–27]. The overarching goal of this endeavour is to establish an effective and dependable RFFI simulation platform, fostering a comprehensive exploration of the distinct and interdependent impacts posed by various factors on both transmitters and channels. To the best knowledge of the authors, this is the first undertaking dedicated to the fusion of RFF-based methodologies with 5G UE authentication, concurrently with an evaluation of transmitter attributes. Our detailed contributions are as follows:

• For 5G UE authentication, a comprehensive link-level simulation platform including transmitters and channels is proposed. This platform boasts the ability to independently manipulate transmitter component impairments and channel parameters. Furthermore, a quantitative assessment of the overall transmitter impairment characteristics is conducted, relying on metrics such as Error Vector Magnitude (EVM) and Adjacent Channel Power Ratio (ACPR);

• Within the construction of the simulation dataset, meticulous attention is devoted to capturing both intra-class and inter-class disparities within transmitters. These differences are rooted in elements such as IQ imbalance, power amplifier nonlinearity, and phase noise, acting as distinguishing features for between-class UE impairments. Meanwhile, the CFO is harnessed as a distinctive marker of within-class instability [25, 28]. Further extensive simulations were performed on the number of transmitter devices, signal length, types of impairment and channel effects;

• A thorough evaluation of DL-based RFFI models is undertaken, thereby establishing a benchmark for the simulated dataset. The DNN model achieves more than 91% performance across varied channel settings at an SNR of 15 dB, where the attention module can significantly improve the performance of RFFI at low SNR.

Figure 1. System overview

The rest of this paper is organized as follows. Section 2 introduces the 5G link-level simulation platform, including an overview, transmitter impairment, and transmitter characterization. In Section 3, we present the simulation setup for transmitter and channel impairment with the 3GPP agreement. Section 4 describes the RFFI algorithm based on deep learning. Section 5 presents the RFFI performance analysis for the DNNs model and simulation dataset. Finally, the conclusions are drawn in Section 6.

2. Simulation system and characteristics

This part is the description of the 5G simulation system. It first introduces the overview of the system, then focuses on the modeling of common impairments in direct conversion transmitters, and finally illustrates the characteristics of the transmitters defined by the 3GPP protocol.

2.1. Overview

The RFF-based 5G User Equipment Identification system is shown in Figure 1. For research convenience, this system considers only Single-Input Single-Output (SISO) systems, which is consistent with most research [28, 29] assumptions and facilitates us to better focus on the effect of device impairments on fingerprints. There are N_UE UEs with different component impairments, such as PN, IQ imbalance, and PA nonlinearity. The ith UE will emit an SRS signal, w_i(t), which will be captured by gNB. Based on the received signal, y(t), the gNB performs the authentication key agreement (AKA) and uses RFFI for UE-assisted access authentication to further improve network security.

For the UE, the digital symbol A_k undergoes orthogonal frequency division multiplexing (OFDM) modulation (u[n]), digital-to-analog conversion (DAC) (d(t)), and RF front-end processing to obtain RF signals and finally is emitted by the antenna:

$$\begin{array}{c}\hfill w_i(t)=H_T(A_k,{\phi }_T)\end{array}$$(1)

where H_T(⋅) represents the function of the RF front-end, such as up-conversion and power amplification, so that the signal has sufficient power and radiation through the antenna. The φ_T is the UE impairment vector of the RF front-end, that is, the RF fingerprint, and will be done in Section 2.2.

The transmitted signal is affected by the channel and reaches the receiver. The received signal can be given as:

$$\begin{array}{c}\hfill y(t)=w_i(t)\otimes h(t,\tau )+n(t)\end{array}$$(2)

where h(t, τ) is the time-varying impulse response of the channel and n(t) represents the additive white gaussian noise (AWGN), $n(t)\sim \mathrm{C}\mathrm{N}(0,{\sigma }_n^2)$. The channel effects are analyzed in Section 3.2, including multipath and doppler.

The received signal y(t) is captured by the gNB, down-converted to zero intermediate frequency (IF) signal y′(t) and transformed into a discrete signal y′[n]. It is comprised of the in-phase component ${\mathit{y}}_I\prime$ and the quadrature component ${\mathit{y}}_Q\prime$. Thus, the discrete signal y′[n] can be described as:

$$\begin{array}{c}\hfill y^{\prime }[n]=y_I^{\prime }[n]+j\ast y_Q^{\prime }[n]n\in [0,N_s-1]\end{array}$$(3)

where N_s is the sampling points.

Figure 2. Front-End with device impairments

According to the received signal y′[n], the DL-based RFFI leverages the intrinsic and distinct radio frequency attributes of transmitters to serve as UE identity information.

2.2. Transmitter impairments

The architecture of the direct conversion RF front-end is shown in Figure 2. It consists of oscillators, IQ modulators, bandpass filters (BPF), variable gain amplifiers (VGA), and power amplifiers. The main impairment modeling includes CFO, phase noise, IQ mismatch, and PA nonlinearity, as they are the main features studied for RFFI.

2.2.1. Oscillator impairment

A crystal local oscillator (LO) is a commonly used building block in electronic equipment, providing the time and frequency reference. Due to the defects of the crystal oscillator itself, LO has the CFO. Generally, parts per million (PPM) is used to quantify CFO, which satisfies the following formula:

$$\begin{array}{c}\hfill -\frac{f_c^0\times \mathrm{ppm}}{{10}^6}\le \mathrm{\Delta }f\le \frac{f_c^0\times \mathrm{ppm}}{{10}^6}\end{array}$$(4)

where $f_c^0$ represents the ideal frequency output by the LO, and the actual output frequency f_c of the LO is expressed:

$$\begin{array}{c}\hfill f_c=f_c^0+\mathrm{\Delta }f\end{array}$$(5)

In the communication system, due to factors such as the instability of the crystal oscillator of the transceiver and user movement, the UE transmitter will continuously compensate the oscillator, and the CFO of UE is time-varying and relatively small [28].

Besides the CFO, the LO is also affected by the phase noise φ_n(t). Phase noise is usually expressed as single-sideband (SSB) noise spectral density in units of dBc/Hz. For an actual oscillator, the PN should not be large. The output of transmitter LO can be mathematically expressed as:

$$\begin{array}{cc}\hfill W^{\mathit{tx}}(t)& =cos(w_{c}t+{\phi }_n(t))\hfill \\ \hfill & =cos(2\pi (f_c^0+\mathrm{\Delta }f)t+{\phi }_n(t))\hfill \end{array}$$(6)

The effect of CFO (50 Hz) and PN for a 16QAM system is illustrated in Figure 3. As shown in Figures 3a and 3b, both CFO and PN cause phase deviation, the former resulting in a linear cumulative phase shift and the latter causing phase jittering.

Figure 3. CFO and Phase Noise effect

As shown in Figure 4, when the CFO Δf of a transmitter is within [−260 260] Hz, the larger CFO can have a severe impact on the EVM and does not cause a severe impact on the bit error rate (BER) for a 16QAM system. The 16QAM EVM before and after CFO (50 Hz) compensation is 4.385% and 0.337%, respectively.

Figure 4. CFO of oscillator impairment: (a) EVM versus CFO; (b) BER versus CFO

2.2.2. IQ modulator impairment

IQ modulators convert baseband signals to radio frequency signals for more efficient wireless channel transmission. Set as the complex baseband signal output by the DAC:

$$\begin{array}{c}\hfill d(t)=d_I(t)+j{d}_Q(t)\end{array}$$(7)

Regardless of the LO impairment, the IQ modulator output signal is:

$$\begin{array}{cc}\hfill Z(t)& =g_I{d}_I(t)cos(w_c^{0}t+\theta )-g_Q{d}_Q(t)sin(w_c^{0}t-\theta )\hfill \\ \hfill & =X_I(t)cos{w}_c^{0}t-X_Q(t)sin{w}_c^{0}t\hfill \end{array}$$(8)

$$\begin{array}{c}\hfill \left[\begin{array}{c}{X}_I(t)\hfill \\ X_Q(t)\hfill \end{array}\right]=\left[\begin{array}{c}{g}_{I}cos\theta g_{Q}sin\theta \hfill \\ g_{I}sin\theta g_{Q}cos\theta \hfill \end{array}\right]\left[\begin{array}{c}{d}_I(t)\hfill \\ d_Q(t)\hfill \end{array}\right]\end{array}$$(9)

where θ = 0.5θ_tx(π/180), θ_tx is the phase imbalance of the IQ modulator. g_I and g_Q are the magnitude gains of the in-phase and quadrature, and the transmitter IQ gain imbalance G_tx (dB) is expressed as follows:

$$\begin{array}{c}\hfill G_{\mathit{tx}}=20\times lg(\frac{g_I}{g_Q})\end{array}$$(10)

Further IQ imbalance manifests on an equivalent low-pass signal z(t):

$$\begin{array}{c}\hfill z(t)={\alpha }_{t}d(t)+{\beta }_t{d}^{\ast }(t)\end{array}$$(11)

where ${\alpha }_t=\frac{(g_I+g_Q)cos\theta +j(g_I-g_Q)sin\theta }{2}$, ${\beta }_t=\frac{(g_I-g_Q)cos\theta +j(g_I+g_Q)sin\theta }{2}$.

The complex baseband distortion signal after further adding the LO impairment can be expressed as:

$$\begin{array}{c}\hfill Z(t)=\mathfrak{R}\{({\alpha }_{t}d(t)+{\beta }_t{d}^{\ast }(t))e^{j(w_{c}t+{\phi }_n(t))}\}\end{array}$$(12)

It can be seen in Equation (12) that the IQ imbalance introduces the conjugate term of the original signal, that is, the image frequency interference [30]. The image interference causes the phase rotation and amplitude variation of the constellation, as shown in Figure 5.

Figure 5. IQ imbalance impairment: (a) Gtx = 1 dB EVM = 6.338%; (b) θtx = 10° EVM = 8.757%

2.2.3. Power amplifier nonlinearity

The low-power RF signal output by the IQ modulator is amplified by the power amplifier to obtain sufficient power and then fed to the antenna for radiation. The nonlinear distortion of the power amplifier in this process will generate new frequency components in the output signal, such as third harmonics, in-band intermodulation distortion, and out-of-band spectral growth [31]. Generally, PA is modeled as the amplitude modulation to amplitude modulation (AM/AM) characteristic, and the amplitude modulation to phase modulation (AM/PM) characteristic. The AM/AM and AM/PM characteristics of the cubic polynomial model can then be defined as:

$$\begin{array}{c}\hfill F_{\mathrm{AM}/\mathrm{AM}}(\left|Z(t)\right|)=a_1\times \left|Z(t)\right|+\frac{3}{4}{a}_3\times {\left|Z(t)\right|}^3\end{array}$$(13)

$$\begin{array}{c}\hfill F_{\mathrm{AM}/\mathrm{PM}}(\left|Z(t)\right|)=\{\begin{array}{cc}{k}_{\mathrm{AM}/\mathrm{PM}}(\left|Z(t)\right|-P_{\mathrm{Lower}})\hfill & \left|Z(t)\right|>P_{\mathrm{Lower}}\hfill \\ 0\hfill & \left|Z(t)\right|\le P_{\mathrm{Lower}}\hfill \end{array}\end{array}$$(14)

where a₁ and a₃ are linear power gain and cubic nonlinear gain constant, P_Lower is input power lower limit in dBm, k_AM/PM is linear AM/PM conversion factor. The coefficient a₃ can be obtained by Third-order input intercept point (IIP3) and 1 dB input compression point (IP1dB):

$$\begin{array}{c}\hfill a_3=-\frac{4a_1}{3\times {10}^{[(\mathrm{IIP}3-30)/10]}}\end{array}$$(15)

$$\begin{array}{c}\hfill a_3=-\frac{2a_1({10}^{\frac{19}{20}}-10)}{15\times {10}^{[(\mathrm{IP}1\mathrm{dB}-30)/10]}}\end{array}$$(16)

The AM/AM and AM/PM characteristics are shown in Figure 6. As the input signal power P_in increases, the PA gradually enters the nonlinear state. At this time, the efficiency of the PA is high, but the linearity is poor, and more out-of-band interference is easily generated, which should be avoided. The OFDM signal with a higher peak-to-average power ratio (PAPR) is amplified by the power amplifier to produce serious in-band distortion and out-of-band spectral growth, which increases the BER and interferes with adjacent channels. Power back-off is the simplest PA linearization way. The P1dB backs off by 6–10 dB to keep the PA away from the saturation point. Adjust the a_VGA to realize power back-off.

Figure 6. AM/AM and AM/PM characteristics of the Cubic Polynomial model [IIP3 = 47 dBm, kAM/PM = 10]

The effect of PA is given in Figure 7, using the cubic polynomial model in Figure 6. The constellation spreads due to the AM/AM effect and noise. As shown in Figure 8, the BER and EVM of the SNR = 15 dB 16QAM system decrease significantly with the back-off level, especially when the PA is far away from the nonlinear region.

Figure 7. PA impairment [IIP3 = 47 dBm, kAM/PM = 10], SNR=15 dB, EVM = 890%

Figure 8. BER and EVM versus the back-off level of PA

2.2.4. Summary

After the above RF front-end modulation and processing, the transmitted signal will be emitted by an antenna. Comprehensive consideration of the combined effects of the above impairments, we rewrite as:

$$\begin{array}{c}\hfill w(t)=\mathfrak{R}\{F_{\mathrm{AM}/\mathrm{AM}}(\left|z(t)\right|)e^{j(w^{\mathit{tx}}t+{\phi }_n(t)+F_{\mathrm{AM}/\mathrm{PM}}(\left|z(t)\right|))})\end{array}$$(17)

where z(t)=α_td(t)+β_td^*(t).

2.3. Transmitter characteristics

In 3GPP NR Release 17, the transmitter characteristics are clearly defined, mainly including the following two aspects:

• 1)

  Transmit signal quality

  • Frequency error: The mean value of basic measurements of UE modulated carrier frequency shall be accurate to within ±0.1 PPM.

  • Transmit modulation quality: transmit modulation quality defines the modulation quality for expected in-band RF transmissions from the UE.

Transmit modulation quality is generally expressed as EVM for the allocated resource blocks (RBs). EVM measures the in-band link quality, which macroscopically reflects the performance between gNB and UE. The error vector (Error Vector, EV) is the vector difference between the actual transmitted signal P_meas and the ideal signal P_ref, and EVM is the ratio of the magnitude of the error vector to the magnitude of the reference signal:

$$\begin{array}{c}\hfill \mathrm{EVM}=\frac{|EV|}{\left|P_{\mathrm{ref}}\right|}·100\%=\frac{\left|P_{\mathrm{meas}}-P_{\mathrm{ref}}\right|}{\left|P_{\mathrm{ref}}\right|}·100\%\end{array}$$(18)

EVM is applied to every transmitted and received symbol. Communication standards require measuring EVM on multiple symbols. For example, 3GPP requires measuring EVM at 10 slots for 15 KHz subcarrier spacing and measuring EVM at 20 slots for 30 KHz subcarrier spacing. Therefore, it usually refers to the root mean square (RMS) EVM or peak EVM, where RMS EVM is defined as follows:

$$\begin{array}{c}\hfill \mathrm{RMS}\mathrm{EVM}=\sqrt{\frac{1}{n}\sum _{i=1}^n{\mathrm{EVM}}_i^2}\end{array}$$(19)

where n is the number of slots corresponding to the calculation of RMS EVM.

The 3GPP standard stipulates that for QPSK modulation, the RMS EVM ≤ 17.5%, and for 16QAM modulation, the RMS EVM ≤ 12.5% [32].

• 2)

  Output RF spectrum emissions

Adjacent channel power ratio refers to the ratio of the average power of the adjacent frequency channel to the average power of the currently used channel, expressed in dBc. It is a common index to measure the linearity of the transmission system. The 3GPP protocol stipulates that the adjacent channel leakage ratio of UE ACPR1 ≤ –31 dBc, and the second adjacent channel leakage ratio ACPR2 ≤ –40 dBc. The ACPR was evaluated with a carrier frequency and frequency offset of 2.6 GHz and 40 MHz, and the measurement bandwidth of 18 MHz [27].

3. Simulation dataset setup

3.1. Transmitter

We configure N_UE UEs with different IQ imbalances, PA nonlinearity, and PN as relatively stable radio frequency fingerprint impairments. Consider further that the oscillator CFO is not stable and varies within the same UE.

As shown in Table 1, we considered four transmitter parameter setups. Cases T1 ∼ 2 represent individual transmitter impairment, i.e., IQ imbalance, and PA nonlinearity, respectively, with 5526 sample points of the signal. Cases T3 ∼ 4 include all impairments: phase noise, CFO, IQ imbalance, and PA nonlinearity, with 1099 and 5526 sample points, respectively. The ranges and distribution of the impairments of the UE transmitter are as follows:

• Phase noise: In this part, we refer to the chip manuals of related IQ modulators, such as ADRF6720-27 and ADRF6703. The ADRF6720-27 is a wideband (400 MHz to 3 GHz) quadrature modulator with integrated phase-locked loops (PLL)/voltage-controlled oscillators (VCOs) for UE communication systems. Different UE phase noises randomly select one of the two types and vary within ± 15 of the default values. PNOffset1 = [10k 100k 1M 10M 100M] Hz, PNLevel1 = [–92.4 –111.4 –137.2 –148.9 –169.9] dBc/Hz, PNOffset2 = [10k 100k 1M 10M] Hz, PNLevel2 = [–98.8 –100.2 –129.2 –151.0] dBc/Hz.

• IQ imbalance: From the literature [28], we set the ranges of gain and phase imbalances as [−1 1] dB and [−10 10] degrees, respectively. Based on the transmitter characteristics, the IQ Imbalance in the above ranges meets 3GPP.

• PA nonlinearity: The power amplifier is modeled as a cubic polynomial model, adjusting the power amplifier P1dB and IP3, VGA gain, namely {IP1dB, IIP3, a_VGA}. Since the power amplifier in the actual UE adopts Digital Pre-Distortion (DPD), the actual PA shows weak nonlinearity, so IP1dB and IIP3 satisfy the chi-square distribution [33], and the ranges are 25 ∼ 35 dBm and 35~47 dBm respectively. a_VGA obeys uniform distribution in the range of 0–6 dB. Based on the transmitter characteristics simulation, the PA nonlinearity in the above ranges meets 3GPP.

• Carrier Frequency Offset: According to the frequency error PPM ± 0.1, when the carrier center frequency is 2.6 GHz, the CFO range can be obtained between −260 ∼ 260 Hz, and further narrowed down to −100 ∼ 100 Hz, the CFO follows the Gaussian distribution in this range.

The simulated 5G NR system bandwidth is 20 MHz, the subcarrier spacing (SCS) is 30 KHz, and the center frequency is 2.6 GHz (n41 frequency band). All data adopts the same sequence A_k.

Figure 9 shows the transmitter characteristics corresponding to the worst case for UE impairments, where RMS EVM = 10.986%, ACPR1 = −37.3dBC, ACPR2 = −53.9dB, BER = 0% meet 3GPP transmitter characteristics.

Figure 9. Transmitter characteristics measurement: (a) UE transmitter EVM measurement; (b) ACPR measurement

3.2. Channel

As shown in Equation (2), channel effects interfere with RF impairments, making existing RFFI systems not robust to channel variations, which has been experimentally verified by [34]. Channel effect can be addressed possibly by data preprocessing [35] or channel estimation. However, in real scenarios, various influencing factors of the channel (multipath, Line-of-Sight (LOS)∖Non-Line-of-Sight (NLOS), Doppler, noise, etc.) cannot be independently controlled. Therefore, the tapped delay line (TDL) model of TR 38.901 [36] and the AWGN channel are used.

• Multipath: The TDL-D and TDL-A model is selected for the LOS and NLOS scenario. LOS channel consists of 13 taps, and NLOS has 24 taps. Each TDL model has the flexibility to set the RMS delay spread. In the LOS case, the K-factor of the direct cluster is determined by the ratio of the direct cluster’s power to the first scattering cluster’s power. In the NLOS case, the K-factor is 0 dB.

• Doppler shift: The Doppler spectrum for each tap is characterized by a classical (Jakes) spectrum shape and a maximum Doppler shift $f_D=\frac{\overline{v}}{{\lambda }_0}=\frac{\overline{v}}{c}\times f_c^0$, where $f_c^0$ is the carrier frequency, c is the speed of light.

Regarding the channel effect in the simulated dataset, the cases in Table 2 were considered. Different SNR levels were simulated to evaluate the noise effects, ranging from 0–20 dB. We built a 5G simulation platform using the MATLAB 2021b 5G toolbox, RF block set toolbox, and Simulink toolbox, and based on a MATLAB example simulating a link-level system with RF impairments.

4. DL-based RFFI methodology

4.1. CNN-based RFFI model

As RFFI is a multi-class classification problem, we can leverage state-of-the-art deep learning algorithms to classify these UEs. Specifically, The CNN network has two inductive biases: local correlation and translation invariance. Its excellent classification ability is widely used in RFFI.

The CNN architecture is shown in Figure 10, which is designed based on the PyramidNet architecture [37]. Considering the great gap that exists between the signal waveform perturbation to the RF fingerprint features, the PyramidNet network enables slow feature channel change and extraction of stable fingerprint features. The CNN contains 9 convolutional layers, 5 maximum pooling layers, and 1 adaptive average pooling layer. The feature dimension of the network extraction is 300 and finally mapped to the class through the linear layer.

Figure 10. The CNN model architecture

4.2. ResNet-based RFFI model

To solve the degradation phenomenon existing in the CNN network, that is, as the depth of the CNN network increases, the performance of the network decreases, He et al. [38] proposed a residual network. Resnet learns the residual function and implements it through shortcut connections. Optimizing this residual mapping is easier than optimizing the original mapping. Hence, the residual function can be written as:

$$\begin{array}{c}\hfill y=F(x,\{W_i\})+W_{s}x\end{array}$$(20)

where, x represents network input feature map and y represents network output. F represents the nonlinear mapping corresponding to the network, and W represents the weight of the network.

The structure and parameters of the ResNet used in this paper are provided in Table 3.

4.3. Attention-based RFFI model

To compensate for the inability of CNN to effectively learn the fingerprint correlation features between IQ channels, the convolutional attention CBAM [39] (Convolutional Block Attention Module Network) is introduced. Specifically, the SAM (Spatial Attention Module) and the CAM (Channel Attention Module) are used to summarize the attention information of the space and the channel, respectively, and then give higher weight to the interest.

The CAM expression is as follows:

$$\begin{array}{c}\hfill M_{\mathrm{CAM}}(x)=\sigma (W_1(W_0(x_{arg}))+W_1(W_0(x_{max})))\end{array}$$(21)

where $x_{arg}\in R^C$ and $x_{max}\in R^C$ represent the C-dimensional feature maps after average pooling and maximum pooling respectively, $W_0\in R^{C/r\times C}$ and $W_1\in R^{C\times C/r}$ represent the full connected layer weight, and σ is the nonlinear activation function ReLU.

The SAM expression is as follows:

$$\begin{array}{c}\hfill M_{\mathrm{SAM}}(x)=\sigma (f([x_{\mathrm{avg}}^S;x_{max}^S]))\end{array}$$(22)

where $x_{arg}^S$ and $x_{max}^S$ respectively represent the feature map after average pooling and maximum pooling, f is the convolution operation, the symbol [;] is the feature fusion operation.

The structure and parameters of the Attention used in this paper are provided in Table 4.

4.4. CLDNN-based RFFI model

The CLDNN [41] builds a neural network model from Convolution, Recurrent, and Fully Connected structures for bridging the gap between CNNs in modeling signal time correlation information. The structure and parameters of the CLDNN used in this paper are provided in Figure 11, The convolutional layers adopt the first 4 layers of the CNN network, and the recurrent neural network adopts a bidirectional long-short-term memory network, and takes the output of the network at the last moment as the feature input DNN network.

Figure 11. The CLDNN model architecture

4.5. InceptionV4-based RFFI model

In 2017, CInception et al. [40] proposed the Inceptionv4 network. The core idea of the Inception module is to combine different convolutional layers in parallel and concatenate feature maps from different scales of analysis in the channel dimension to achieve multi-scale feature extraction. Further, the Inceptionv4 module introduces residual connectivity to solve the degradation problem of the network. The structure and parameters of the InceptionV4 used in this paper are provided in Table 5. The Inception module expression is as follows:

$$\begin{array}{c}\hfill M_{\mathrm{Inception}}(x)=\mathrm{Concat}(f^1(x);f^5(x);f^7(x);f^9(x))\end{array}$$(23)

where, x represents network input feature, fⁱ(⋅) is a convolutional network with a convolution kernel size i, Concat is a splicing of features of different scales.

5. RFFI performance analysis

5.1. Experimental setup

We generate 800 packets per UE, 80% of which are used for DNN training, 10% for validation, and 10% for DNN inferencing (classification). All DNN methods use the Adam optimizer with an initial learning rate 1 × 10⁻³ and batch size is 256. The learning rate scheduling method adopts exponential with an exponential decay factor of 0.85. In addition, to prevent the model from overfitting on the training set, we added early stopping in the training process. Use torch 1.7.1 to build the DNN model. Experiments run on NVIDIA GeForce RTX 3080Ti GPU.

5.2. RFFI performance with transmitter impairments

In this subsection, we simulate 100 UEs with different RF impairments and investigate the effect of the simulation dataset settings and the RFFI algorithm on the UE authentication performance, respectively. The former remains constant for the RFFI algorithm and varies the simulation dataset parameters: number of UEs (Case T3), signal sampling points (Case T4), and transmitter impairment (Case T1 and T2), respectively.

5.2.1. RFFI performance under different numbers of UEs

Intuitively, the tolerance range in actual device production is limited due to the restrictions on transmitter characteristics by related protocols (3GPP and IEEE). As the number of UEs increases, the probability of overlapping impairment parameters of each UE increases, and the characteristics between UEs will be closer, making it more difficult to classify more UEs. We randomly select different numbers of devices from the data Case T3, and the results are shown in Table 6. It can be observed that when there are 100 UEs and 20 dB SNR, the CNN classification accuracy drops only slightly to 91.00%. As the number of devices increases, the more obvious the impact of the SNR on the recognition accuracy.

Further perform t-SNE feature dimension reduction visualization on 15 dB 10UE and 20UE, as shown in Figure 12. Different UEs are represented by different colors, and different samples of the same UE are represented by labels for 2-dimensional feature distribution. Due to the limited capacity of the feature space when the number of UEs increases, the probability of RFF feature overlap between devices further increases, which leads to RFFI model misclassification.

Figure 12. t-SNE dimension reduction visualization

5.2.2. RFFI performance at various sampling points

This part explores the relationship between sampling points and RFFI recognition accuracy, as shown in Table 7. The data set uses caseT4, and the T4 data set signals are down-sampled to 500, 1099, 2048, 3000, 4096, 5000, and 5526. Longer signals lead to higher RFFI performance. Because long signals contain more RFF features, CNNs can learn smooth and stable signal amplitude variation patterns to achieve more accurate estimates of RFF statistical features. Simulation results have verified this point. When the signal length reaches 4096 points, the SNR = 15 dB accuracy rate is 97.3452%, and then the accuracy increases slowly as the sampling points increase.

5.2.3. RFFI performance of different device impairments

In this part, we explored the effect of different device impairments on the RFFI accuracy, which includes IQ imbalance impairment (Case T1), PA nonlinearity impairment (Case T2), and the result of PA, IQ modulator, and phase noise coupling effects (Case T4). The signal length N_s is selected as 4096 points, the number of UEs N_UE = 100, and the CNN model recognition accuracy under different signal-to-noise ratios is shown in Figure 13. We can see that, under the same SNR, the accuracy of the mixed action results of All Impairments>IQ imbalance>PA nonlinearity. Among them, PA Nonlinearity shows particularly poor performance, with accuracy close to 1%, and the network does not learn any inter-UE fingerprint information. Considering the reasons, on the one hand, it is related to the range of our PA device coefficient setting. When most devices PA works in the linear region and PA nonlinearity is not obvious. On the other hand, due to the baseband signal using SRS signal, which is generated by constant amplitude Zadoff–Chu (ZC) sequence, the signal peak-to-average ratio and dynamic range are low.

Figure 13. Different device impairments recognition accuracy

Figure 14. Different DNN algorithm recognition accuracy

5.2.4. RFFI performance of different DNN

In this part, five different DNN models, including CNN, ResNet, CLDNN, Attention, and InceptionV4, are selected to compare their RFFI performance using the same simulation dataset (T4). The DNN model structure is introduced in Section 4. The sampling points N_s = 4096, and the number of UEs N_UE = 100. According to Figure 14, several observations can be made as follows:

• (a)

  When the SNR is high, the signal has better quality, the characteristics of RFF are more obvious, and DNN can learn them more easily, so the performance difference between different networks is smaller.

• (b)

  When the SNR is low, ResNet, InceptionV4, Attention, and CLDNN have greater improvements compared to CNN. The main reason is that the above network can learn richer I/Q data correlation information than CNN. ResNet can be regarded as an integration of multiple models, which improves the performance of RFFI tasks through feature fusion; Attention introduces channels and spatial attention to fully extract the fingerprint information between signal localization and IQ association; InceptionV4 can be regarded as a ResNet network for multi-scale analysis, integrating convolutional kernel features at different scales (1/5/7/9); CLDNN introduces LSTM networks to further model and analyze the distribution information of RFF in time dimensions.

• (c)

  As the SNR decreases, the model performance deteriorates more severely, especially below 10 dB, when the noise can further swamp the signal’s subtle local fingerprint features.

5.3. RFFI Performance with channel effects

This section will demonstrate the effect of channel effects on RFFI recognition accuracy. Specifically, in the simulation setup, we consider Line-of-Sight/Non-Line-of-Sight, RMS delay spread, and Doppler shift.

5.3.1. Multipath

We first study channel multipath effects, including both LOS and NLOS channel scenarios. Specifically, we chose dataset C1 with N_UE = 100 and set the channel Doppler shift to 0 to study the channel multipath effect independently. All channel datasets were obtained by undergoing channel effects underCase T4. The DNN model was a CNN with a training set: validation set: test set of 8:1:1, and the results of RMS delay spread on RFFI accuracy for both LOS and NLOS scenarios are shown in Figure 15.

Figure 15. Effects of RMS delay spread on CNN classification accuracy in LOS and NLOS scenarios

According to Figure 15, the CNN model achieved excellent performance in both the high SNR LOS and NLOS scenarios, with SNR = 15 dB, achieving over 92% for the LOS channel and over 90% for the NLOS channel. As the channel parameters of the training and test sets were maintained at the same settings during the experiments, the CNN accuracy of the same scenario varied less with the change of the channel delay spread. In addition, under the same SNR, the accuracy rate of the LOS channel is slightly higher than that of the NLOS channel, because there is a direct path in the LOS channel, and the signal quality is higher than that of the NLOS channel.

Figure 16. Effects of RMS delay spread on CNN classification accuracy in LOS and NLOS scenarios

5.3.2. Doppler

We also investigate the channel Doppler shift effect, including both LOS and NLOS channel scenarios. Specifically, dataset C2 is chosen with the channel RMS delay spread being fixed to independently study the channel Doppler effect. The CNN model was used to test different Doppler frequency shift data under LOS and NLOS, and the results are shown in Figure 16. When the data distribution of the training set and the test set are consistent, the change of channel Doppler parameter has a weak impact on the accuracy of the model. As the SNR increases, the recognition accuracy increases, and the accuracy of 15 dB reaches 90% in LOS and NLOS scenarios. Also, LOS channel performance is lower than NLOS channel performance.

5.4. Evaluation

5.4.1. Model confidence evaluation

In Section 5.2, the accuracy rates of the different models mentioned above are similar under the condition of a high SNR (15 dB), and they all reach 97% accuracy. Therefore, it is not sufficient to evaluate the merits of the models using only accuracy metrics. For this reason, we compared the prediction probabilities (confidence levels) of the models in the 15 dB test set, as shown in Figure 17 and Table 8. The horizontal axis represents the probability of the model predicting the correct classification sample, and the vertical axis is the total number of samples distributed around the probability. Undoubtedly, more samples around the probability of 1 means better performance of the model. The Attention model shows high prediction confidence and is more stable (low standard deviation of probability) for the test set. Combined with Figure 14, we find that this characteristic of the Attention model corresponds to higher accuracy at low SNR, further demonstrating that the Attention model is more suitable for the RFFI task.

Figure 17. Histogram of the predicted probability distribution of different models at SNR of 15 dB: (a) CNN; (b) ResNet; (c) InceptionV4; (d) CLDNN; (e) Attention

5.4.2. Comprehensive evaluation

Figure 18 shows a comprehensive comparison of the performance of different RFFI models, including model size (MB), SNR = 15 dB model confidence mean and standard deviation (T4), model inference time (ms), RMS delayed spread accuracy (NLOS 59ns 15 dB), and Doppler accuracy (LOS 13.08 Hz 15 dB). The different evaluation metrics have different dimensions, and we further normalized the model size and inference time. The multidimensional radar plot evaluation of the models leads to the following conclusions:

Figure 18. Comprehensive evaluation of different DNN models

• (a)

  A comparison purely in terms of model performance shows that the Attention model has the optimal performance, as reflected by the highest model prediction confidence and the smallest confidence standard deviation on the T4 dataset, and similar accuracy to other models in multipath and Doppler scenarios.

• (b)

  The performance of the model shows a positive correlation with the model size to a certain extent, i.e., the larger the model, the better the model performance is relative. The inference time of the model, on the other hand, shows a certain degree of negative correlation with the size of the model, except for InceptionV4. This is mainly due to the large number of feature concatenation processes in the InceptionV4 structure.

• (c)

  The Attention model has similar parameters and structure as the Resnet model but performs significantly better than Resnet, which to some extent illustrates the importance of Spatial Attention and Channel Attention for the RFFI task.

6. Conclusion

This paper presents the construction of a simulation platform tailored for 5G NR uplink scenarios. The platform’s focus lies in scrutinizing the ramifications of transmitter impairments and channel dynamics on RFFI, employing thorough testing and simulation. Specifically, stable component impairments encompassing phase noise, IQ imbalance, and PA nonlinearity, as well as variable impairments like carrier frequency offset. Transmitter characteristics (EVM and ACPR) as delineated by the 3GPP protocol are utilized to evaluate the rationality of transmitter impairments. We also model the channel impact, using the TDL channel model to independently manipulate the frequency-selective fading (RMS delayed spread) and time-selective fading (Doppler) of the channel. Remarkably, employing DNN, the model demonstrates its capability to discern 100 UE transmitters with an impressive 91% accuracy, holding constant an SNR of 15 dB. Finally, a comprehensive evaluation demonstrates the effectiveness of the Attention module in the model for RFFI.

In the future we refine this simulation platform and focus on the following aspects:

• (1)

  Refining the simulation platform. One is the lack of modeling of the practical receiver, which needs to be further incorporated. Additionally, the alignment of simulation component impairments with actual measured device parameters will be undertaken. Moreover, the existing WiFi and 5G systems are multiple-input and multiple-output (MIMO) transmission [42], and the system needs to be further expanded to MIMO. Constructing an RFFI simulation dataset for MIMO systems becomes imperative.

• (2)

  Exploring RF fingerprint mechanisms and capacity. The intricate nature of the transmitter’s internal structure, fraught with nonlinearity and complexity, challenges forward transmitter fingerprint modeling. Compared with the actual measurement data constrained by collection scenarios and device counts, the simulation offers the capacity to promptly generate many distinct UE transmitters. This facilitation proves advantageous for subsequent explorations of RFFI capacity via experimental methodologies.

• (3)

  Studying robust channel algorithms. The simulation platform’s ability to disentangle and autonomously regulate channel effects–such as RMS delay spread, Doppler, noise, and multipath (LOS/NLOS). The practical application of RFFI encounters complexities due to intricate electromagnetic device deployments and ever-changing channel conditions. Aiming to address this, future investigations will delve into cross-channel RFFI. An intriguing avenue of inquiry involves integrating prior knowledge such as channel estimation [29, 43], designing an apt RFFI frame structure, and thereby enhancing channel robustness.

Conflict of Interest

The authors declare no conflict of interest.

Data Availability

No data are associated with this article.

Authors’ Contributions

Yun Lin supervised the work and reviewed the paper. Hanhong Wang proposed the overall simulation platform, designed the algorithms and wrote this paper. Haoran Zha contributed to the experimental design and embellished the whole paper.

Acknowledgments

This work is also supported by the Key Laboratory of Advanced Marine Communication and Information Technology, Ministry of Industry and Information Technology, Harbin Engineering University, Harbin, China.

Funding

This work is supported by the National Natural Science Foundation of China (No: 62201172), and the National Key Research and Development Program of China (2022YFE0136800).

References

Yun Lin received a B.S. degree from Dalian Maritime University, Dalian, China, in 2003, an M.S. degree from the Harbin Institute of Technology, Harbin, China, in 2005, and a Ph.D. degree from Harbin Engineering University, Harbin, China, in 2010. Now, he is currently a full professor in the College of Information and Communication Engineering, Harbin Engineering University, China. His current research interests include machine learning and data analytics over wireless networks, signal processing and analysis, cognitive radio and software-defined radio, artificial intelligence, and pattern recognition.

Hanhong Wang is currently pursuing a master’s degree in Information and Communication Engineering at Harbin Engineering University, Harbin, China. His research interests include signal processing and few-shot learning.

Haoran Zha is currently pursuing a Ph.D. degree in Information and Communication Engineering at Harbin Engineering University, Harbin, China. His research interests include deep learning, signal processing, and software radio.

All Tables

All Figures

	Figure 1. System overview
In the text

	Figure 2. Front-End with device impairments
In the text

	Figure 3. CFO and Phase Noise effect
In the text

	Figure 4. CFO of oscillator impairment: (a) EVM versus CFO; (b) BER versus CFO
In the text

	Figure 5. IQ imbalance impairment: (a) Gtx = 1 dB EVM = 6.338%; (b) θtx = 10° EVM = 8.757%
In the text

	Figure 6. AM/AM and AM/PM characteristics of the Cubic Polynomial model [IIP3 = 47 dBm, kAM/PM = 10]
In the text

	Figure 7. PA impairment [IIP3 = 47 dBm, kAM/PM = 10], SNR=15 dB, EVM = 890%
In the text

	Figure 8. BER and EVM versus the back-off level of PA
In the text

	Figure 9. Transmitter characteristics measurement: (a) UE transmitter EVM measurement; (b) ACPR measurement
In the text

	Figure 10. The CNN model architecture
In the text

	Figure 11. The CLDNN model architecture
In the text

	Figure 12. t-SNE dimension reduction visualization
In the text

	Figure 13. Different device impairments recognition accuracy
In the text

	Figure 14. Different DNN algorithm recognition accuracy
In the text

	Figure 15. Effects of RMS delay spread on CNN classification accuracy in LOS and NLOS scenarios
In the text

	Figure 16. Effects of RMS delay spread on CNN classification accuracy in LOS and NLOS scenarios
In the text

	Figure 17. Histogram of the predicted probability distribution of different models at SNR of 15 dB: (a) CNN; (b) ResNet; (c) InceptionV4; (d) CLDNN; (e) Attention
In the text

	Figure 18. Comprehensive evaluation of different DNN models
In the text