The technology of radio frequency fingerprint identification based on deep learning for 5G application

User Equipment (UE) authentication holds paramount importance in upholding the security of wireless networks. A nascent technology, Radio Frequency Fingerprint Identification (RFFI), is gaining prominence as a means to bolster network security authentication. To expedite the integration of RFFI within fifth generation (5G) networks, this research undertakes the creation of a comprehensive link-level simulation platform tailored for 5G scenarios. The devised platform emulates various device impairments, including oscillator, IQ modulator, and power amplifier (PA) nonlinearities, alongside simulating channel distortions. Consequent to this, a plausibility analysis is executed, intertwining transmitter device impairments with 3rd Generation Partnership Project (3GPP) new radio (NR) protocols. Subsequently, an exhaustive exploration is conducted to assess the impact of transmitter impairments, deep neural networks (DNNs), and channel effects on RF fingerprinting performance. Notably, under a signal-to-noise ratio (SNR) of 15dB, the deep learning approach demonstrates the capability to accurately classify 100 UEs with a commendable 91% accuracy rate. Through a multifaceted evaluation, it is ascertained that the Attention-based network architecture emerges as the optimal choice for the RFFI task, serving as the new benchmark model for RFFI applications.


Introduction
Amidst the rapid development of beyond fifth generation (B5G) and low power wide area network (LPWA) technologies, the Internet of Things (IoT) technology has effectively bridged the gap between technological innovations and human interactions [1]. The extensive array of services offered by 5G has seamlessly integrated people, devices, and networks, heralding the arrival of a new era-the Internet of Everything [2]. Notably highlighted in the Ericsson Mobility Report, is the unparalleled deployment speed of 5G, making it the swiftest adopted mobile communication technology in history. Projections from this report indicate that the count of 5G user equipment will reach 4.4 billion by 2027 [3]. However, the pervasive concern of inherent safety and security (ESS) within wireless communication persists. As information propagates wireless free space through broadcasting, the structure of wireless networks remains susceptible to illegal attacks. The current security authentication method employed within the 5G network based on key technologies, such as methods reliant on USIM or memory-stored keys. Yet, this approach poses vulnerabilities wherein data leakage and network security breaches can transpire should these keys be compromised [4]. Given that the forthcoming 5G-driven vertical industries are poised to deploy a multitude of IoT devices, the necessity to devise more streamlined access authentication mechanisms tailored for IoT devices becomes evident. In addition, the 5G network confronts a distinctive challenge in the form of air interface denial-of-service (DOS) and distributed denial-of-service (DDoS) attacks. The attackers persistently initiate random access requests to deplete the resources of next generation NodeB (gNB) [5].
Radio frequency fingerprinting (RFF), a critical technology in wireless physical layer security, is considered as a promising candidate to complement the existing wireless network security problems [6][7]. Currently, RFF is widely used in protocols such as ZigBee [8][9], WiFi [10], Automatic Dependent Surveillance Broadcast (ADS-B) [11][12] and LoRa [13], and has achieved excellent performance. Due to the non-ideal nature of the device parameters, the actual transmitted wireless signal will be locally overlaid with smallscale RF fingerprint distortions. At the receiver side the unavoidable, stable and unique device hardware difference features coupled to the transmit signal are analyzed and extracted as the device identity. The RFFI method is lightweight and flexible, working at the physical layer. It not only works alone but can also be quickly extended to existing 5G network architectures to aid and enhance network security authentication.
The RFFI method can be roughly divided into feature engineering-based method and deep learning (DL)-based method. The latter utilizes state-of-the-art deep learning algorithms to identify transmitters, for example, convolutional neural network (CNN) [14][15], ResNet [16], long short-term memory (LSTM) [17], inception [18] etc. Liu et al. [19] proposed a distributed sensor fusion-based scheme for RF fingerprint recognition. The received signals are fused into a four-channel image representation and a convolutional neural network is trained. Subsequent incremental learning is achieved by fine-tuning. Zhang et al. [20] proposed a data-and-knowledge dual-driven scheme for RF fingerprint recognition using multi-scale attentional convolutional network. The protocol knowledge of the signal is exploited to provide higher-level signal semantic information and has the best performance in recognition accuracy at low SNR.
There are few studies on RFF-based cellular network security. On the one hand, due to the challenges of data acquisition in real mobile cellular networks, UEs need to access gNB and the communication parameters are limited by the high-level configuration of gNB. On the other hand, unlike WiFi systems, the frame structure of 5G does not have a preamble. The UE obtains uplink synchronization through the physical random access channel (PRACH) and uses the sounding reference signal (SRS) for uplink channel estimation. In [21], the author uses a triple loss convolutional neural network to perform RFFI on the base station data of the POWDER measured platform, and the accuracy rate reaches 99.86%. Yin et al. [22] extract differential constellation trajectory from PRACH preamble to identify 6 LTE UEs. Wu et al. [23] extract the wavelet coefficients of the LTE physical random access channel preamble and input the autoencoder to achieve rogue terminal detection.
In summary, this paper aims at the RFFI for 5G applications and constructs a 5G link-level simulation platform. This platform exhibits the capability to dynamically adjust component impairments, thereby enabling the generation of diverse UE. Specifically, the main RF impairments of direct conversion transmitters [24], including carrier frequency offset (CFO), phase noise (PN), in-phase (I) and quadrature (Q) imbalance, as well as power amplifier nonlinearity [25][26][27]. The overarching goal of this endeavor is to establish an effective and dependable RFFI simulation platform, fostering a comprehensive exploration of the distinct and interdependent impacts posed by various factors on both transmitters and channels. To the best knowledge of the authors, this is the first undertaking dedicated to the fusion of RFF-based methodologies with 5G UE authentication, concurrently with an evaluation of transmitter attributes. Our detailed contributions are as follows: • For 5G UE authentication, a comprehensive link-level simulation platform including transmitters and channels is proposed. This platform boasts the ability to independently manipulate transmitter component impairments and channel parameters. Furthermore, a quantitative assessment of the overall transmitter impairment characteristics is conducted, relying on metrics such as Error Vector Magnitude (EVM) and Adjacent Channel Power Ratio (ACPR); • Within the construction of the simulation dataset, meticulous attention is devoted to capturing both intra-class and inter-class disparities within transmitters. These differences are rooted in elements such as IQ imbalance, power amplifier nonlinearity, and phase noise, acting as distinguishing features for between-class UE impairments. Meanwhile, CFO is harnessed as a distinctive marker of within-class instability [ Figure 1. System overview The rest of this paper is organized as follows. Section 2 introduces the 5G link-level simulation platform, including overview, transmitter impairment, and transmitter characterization. In Section 3, we present the simulation setup for transmitter and channel impairment with 3GPP agreement. Section 4 describes the RFFI algorithm based on deep learning. Section 5 presents the RFFI performance analysis for the DNNs model and simulation dataset. Finally, the conclusions are drawn in Section 6.

Simulation System and Characteristics
This part is the description of the 5G simulation system. It first introduces the overview of system, then focuses on the modeling of common impairments in direct conversion transmitters, and finally illustrates the characteristics of the transmitters defined by the 3GPP protocol.

Overview
The RFF-based 5G User Equipment Identification system is shown in Figure 1. For research convenience, this system considers only Single-Input Single-Output (SISO) systems, which is consistent with most research [28][29] assumptions and facilitates us to better focus on the effect of device impairments on fingerprints. There are UE N UEs with different component impairments, such as PN, IQ imbalance, and PA nonlinearity. The th i UE will emit SRS signal, () i wt, which will be captured by gNB. Based on the received signal, () yt , the gNB performs the authentication key agreement (AKA) and uses RFFI for UE-assisted access authentication to further improve network security.
For the UE, the digital symbol k A undergoes orthogonal frequency division multiplexing (OFDM) modulation ( [] un ), digital-to-analog conversion (DAC) ( () dt ), and RF front-end processing to obtain RF signals and finally is emitted by the antenna: where () T H  represents the function of the RF front-end, such as up-conversion and power amplification, so that the signal has sufficient power and radiation through the antenna. The T  is the UE impairment vector of the RF front-end, that is, the RF fingerprint and will be done in Section 2.2.
The transmitted signal is affected by the channel and reaches the receiver. The received signal can be given as: where ( , ) ht is the time-varying impulse response of the channel and () nt represents the additive white gaussian noise (AWGN), where s N is the sampling points. According to the received signal ' [] yn, the DL-based RFFI leverages the intrinsic and distinct radio frequency attributes of transmitters to serve as UE identity information.

Transmitter Impairments
The architecture of the direct conversion RF front-end is shown in Figure 2. It consists of oscillators, IQ modulators, bandpass filters (BPF), variable gain amplifiers (VGA), and power amplifiers. The main impairment modeling includes CFO, phase noise, IQ mismatch, and PA nonlinearity, as they are the main features studied for RFFI.

Oscillator Impairment
A crystal local oscillator (LO) is a commonly used building block in electronic equipment, providing the time and frequency reference. Due to the defects of the crystal oscillator itself, LO has the CFO. Generally, parts per million (PPM) is used to quantify CFO, which satisfies the following formula: 00 66 10 10 where 0 c f represents the ideal frequency output by the LO, and the actual output frequency c f of the LO is expressed: 0 cc In the communication system, due to factors such as the instability of the crystal oscillator of the transceiver and user movement, the UE transmitter will continuously compensate the oscillator, and the CFO of UE is time-varying and relatively small [28].
Besides the CFO, the LO is also affected by the phase noise () n t  . Phase noise is usually expressed as single-sideband (SSB) noise spectral density in units of dBc/Hz. For an actual oscillator, the PN should not be large. The output of transmitter LO can be mathematically expressed as: The effect of CFO (50Hz) and PN for a 16QAM system is illustrated in Figure 3. As shown in Figure 3(a) and Figure 3(b), both CFO and PN cause phase deviation, the former resulting in a linear cumulative phase shift and the latter causing phase jittering.
As shown in Figure 4, when the CFO f  of a transmitter is within [-260 260] Hz, the larger CFO can have a severe impact on the EVM and does not cause a severe impact on the bit error rate (BER) for a 16QAM system. The 16QAM EVM before and after CFO (50Hz) compensation is 4.385% and 0.337%, respectively.

IQ Modulator Impairment
IQ modulators convert baseband signals to radio frequency signals for more efficient wireless channel transmission. Set () dt as the complex baseband signal output by the DAC: Regardless of the LO impairment, the IQ modulator output signal is:  is the phase imbalance of the IQ modulator. 20 lg( ) Further IQ imbalance manifests on an equivalent low-pass signal () zt : The complex baseband distortion signal after further adding the LO impairment can be expressed as: It can be seen in Eq. (12) that the IQ imbalance introduces the conjugate term of the original signal, that is, the image frequency interference [30]. The image interference causes the phase rotation and amplitude variation of the constellation, as shown in Figure 5.

Power Amplifier Nonlinearity
The low-power RF signal output by the IQ modulator is amplified by the power amplifier to obtain sufficient power and then fed to the antenna for radiation. The nonlinear distortion of the power amplifier in this process will generate new frequency components in the output signal, such as third harmonics, in-band intermodulation distortion, and out-of-band spectral growth [31]. Generally, PA modeled as the amplitude modulation to amplitude modulation (AM/AM) characteristic, and the amplitude modulation to phase modulation (AM/PM) characteristic. The AM/AM and AM/PM characteristics of the cubic polynomial model can then be defined as:  The AM/AM and AM/PM characteristics are shown in Figure 6. As the input signal power in P increases, the PA gradually enters the nonlinear state. At this time, the efficiency of the PA is high, but the linearity is poor and more out-of-band interference is easily generated, which should be avoided. The OFDM signal with a higher peak to average power ratio (PAPR) is amplified by the power amplifier to produce serious in-band distortion and out-of-band spectral growth, which increases the BER and interferes with adjacent channels. Power back-off is the simplest PA linearization way. The P1dB backs off by 6-10dB to keep the PA away from the saturation point. Adjust the VGA a to realize power back-off. The effect of PA is given in Figure 7, using the cubic polynomial model in Figure 6. The constellation spreads due to the AM/AM effect and noise. As shown in Figure 8, the BER and EVM of the SNR=15 dB 16QAM system decrease significantly with the back-off level, especially when the PA is far away from the nonlinear region.

Summary
After the above RF front-end modulation and processing, the transmitted signal will be emitted by an antenna. Comprehensive consideration of the combined effects of the above impairments, we rewrite as:

Transmitter Characteristics
In 3GPP NR Release 17, the transmitter characteristics are clearly defined, mainly including the following two aspects: 1) Transmit signal quality • Frequency error: The mean value of basic measurements of UE modulated carrier frequency shall be accurate to within ± 0.1 PPM.
• Transmit modulation quality: transmit modulation quality defines the modulation quality for expected in-band RF transmissions from the UE. Transmit modulation quality generally expressed as EVM for the allocated resource blocks (RBs). EVM measures the in-band link quality, which macroscopically reflects the performance between gNB and UE. The error vector (Error Vector, EV) is the vector difference between the actual transmitted signal meas P and the ideal signal ref P , and EVM is the ratio of the magnitude of the error vector to the magnitude of the reference signal: EVM is applied to every transmitted and received symbol. Communication standards require measuring EVM on multiple symbols. For example, 3GPP requires measuring EVM at 10 slots for 15KHz subcarrier spacing and measuring EVM at 20 slots for 30KHz subcarrier spacing. Therefore, it usually refers to the root mean square (RMS) EVM or peak EVM, where RMS EVM is defined as follows: where n is the number of slots corresponding to the calculation of RMS EVM.
2) Output RF spectrum emissions Adjacent channel power ratio refers to the ratio of the average power of the adjacent frequency channel to the average power of the currently used channel, expressed in dBc. It is a common index to measure the linearity of the transmission system. The 3GPP protocol stipulates that the adjacent channel leakage ratio of UE ACPR1 ≤-31dBc, and the second adjacent channel leakage ratio ACPR2 ≤-40dBc. The ACPR was evaluated with a carrier frequency and frequency offset of 2.6 GHz and 40 MHz, and the measurement bandwidth of 18MHz [27].

Transmitter
We configure UE N UEs with different IQ imbalances, PA nonlinearity, and PN as relatively stable radio frequency fingerprint impairments. Consider further that the oscillator CFO is not stable and vary within the same UE.
As shown in Table I, we considered four transmitter parameter setups. Cases T1~2 represent individual transmitter impairment, i.e., IQ imbalance, and PA nonlinearity, respectively, with 5526 sample points of the signal. Cases T3~4 include all impairments: phase noise, CFO, IQ imbalance, and PA nonlinearity, with 1099 and 5526 sample points, respectively. The ranges and distribution of the impairments of the UE transmitter are as follows: • Phase noise: In this part, we refer to the chip manuals of related IQ modulators, such as ADRF6720- 27 [28], we set the ranges of gain and phase imbalances as [- 1 1] dB and [- 10 10] degrees, respectively. Based on the transmitter characteristics, the IQ Imbalance in the above ranges meets 3GPP. • PA nonlinearity: The power amplifier is modeled as a cubic polynomial model, adjusting the power amplifier P1dB and IP3, VGA gain, namely { 1 , 3, VGA IP dB IIP a .. Since the power amplifier in the actual UE adopts Digital Pre-Distortion (DPD), the actual PA shows weak nonlinearity, so IP1dB and IIP3 satisfy the chi-square distribution [33], and the ranges are 25~35dBm and 35~47dBm respectively. VGA a obeys uniform distribution in the range of 0-6dB. Based on the transmitter characteristics simulation, the PA nonlinearity in the above ranges meets 3GPP.
• Carrier Frequency Offset: According to the frequency error PPM ±0.1, when the carrier center frequency is 2.6GHz, the CFO range can be obtained between -260~260Hz, and further narrowed down to -100~100Hz, the CFO follows the Gaussian distribution in this range. The simulated 5G NR system bandwidth is 20MHz, the subcarrier spacing (SCS) is 30KHz, and the center frequency is 2.6GHz (n41 frequency band). All data adopts the same sequence k A .

Channel
As shown in Equation (2), channel effects interfere with RF impairments, making existing RFFI systems not robust to channel variations, which has been experimentally verified by [34]. Channel effect can be addressed possibly by data preprocessing [35] or channel estimation. However, in real scenarios, various influencing factors of the channel (multipath, Line-of-Sight (LOS)\Non-Line-of-Sight (NLOS), doppler, noise, etc.) cannot be independently controlled. Therefore, the tapped delay line (TDL) model of TR 38.901 [36] and the AWGN channel are used. u ra u ra a u ra 1 u ra 1 a u ra u ra a u ra u ra a u ra u ra a u ra u ra a u ra u ra a u ra u ra a u ra u ra  The TDL-D model is selected for the LOS scenario and the root mean square (RMS) delay spread is 20 ns, 30 ns and 59 ns. The doppler frequency shift parameter is 0. The K-factor is 9.0dB.
The TDL-A model is selected for the NLOS scenario, and the RMS delay spread is 20 ns, 59 ns and 100 ns. The doppler frequency shift parameter is 0.

Case C2
The TDL-D model is selected for the LOS scenario and the RMS delay spread is 20 ns. The doppler frequency shift parameters are set to 0Hz, 7.23Hz, and 13.08Hz. The K-factor is 9.0dB. The TDL-A model is selected for the NLOS scenario, and the RMS delay spread is 100 ns. The doppler frequency shift parameters are set to 0Hz, 7.23Hz, and 13.08Hz. • Multipath: The TDL-D and TDL-A model is selected for the LOS and NLOS scenario. LOS channel consists of 13 taps, and NLOS has 24 taps. Each TDL model has the flexibility to set the RMS delay spread. In the LOS case, the K-factor of the direct cluster is determined by the ratio of the direct cluster's power to the first scattering cluster's power. In the NLOS case, the K-factor is 0dB.  Table 2 were considered. Different SNR levels were simulated to evaluate the noise effects, ranging from 0-20dB. We built a 5G simulation platform using the MATLAB 2021b 5G toolbox, RF blockset toolbox, and Simulink toolbox and based on a MATLAB example simulating a link-level system with RF impairments.

CNN-based RFFI Model
As RFFI is a multi-class classification problem, we can leverage state-of-the-art deep learning algorithms to classify these UEs. Specifically, The CNN network has two inductive biases: local correlation and translation invariance. Its excellent classification ability is widely used in RFFI.
The CNN architecture is shown in Figure 10, which is designed based on the PyramidNet architecture [37]. Considering the great gap that exists between the signal waveform perturbation to the RF fingerprint features, the PyramidNet network enables slow feature channel change and extraction of stable fingerprint features. The CNN contains 9 convolutional layers, 5 maximum pooling layers and 1 adaptive average pooling layer. The feature dimension of the network extraction is 300, and finally mapped to the class through the linear layer.  Figure 10. The CNN model architecture

ResNet-based RFFI Model
To solve the degradation phenomenon existing in the CNN network, that is, as the depth of the CNN network increases, the performance of the network decreases, He et al. [38] proposed a residual network. Resnet Page 11 of 3 learns the residual function and implements it through shortcut connections. Optimizing this residual mapping is easier than optimizing the original mapping. Hence, the residual function can be written as: where, x represents network input feature map and y represents network output. F represents the nonlinear mapping corresponding to the network, and W represents the weight of the network. The structure and parameters of the ResNet used in this paper are provided in Table 3.

Attention-based RFFI Model
To compensate for the inability of CNN to effectively learn the fingerprint correlation features between IQ channels, the convolutional attention CBAM [39] (Convolutional Block Attention Module Network) is introduced. Specifically, the SAM (Spatial Attention Module) and the CAM (Channel Attention Module) are used to summarize the attention information of the space and the channel, respectively, and then give higher weight to the of interest. The CAM expression is as follows: The structure and parameters of the Attention used in this paper are provided in Table 4.

CLDNN-based RFFI Model
The CLDNN [41] builds a neural network model from Convolution, Recurrent, and Fully-Connected structures for bridging the gap between CNNs in modeling signal time correlation information. The structure and parameters of the CLDNN used in this paper are provided in Figure 11, The convolutional layers adopt the first 4 layers of the CNN network, and the recurrent neural network adopts a bidirectional long-short-term memory network, and takes the output of the network at the last moment as the feature input DNN network. introduces residual connectivity to solve the degradation problem of the network. The structure and parameters of the InceptionV4 used in this paper are provided in Table 5. The Inception module expression is as follows: ( ) ( ( ); ( ); ( ); ( )) where, x represents network input feature, is a convolutional network with a convolution kernel size i , Concat is a splicing of features of different scales.

Experimental Setup
We generate 800 packets per UE, 80% of which are used for DNN training, 10% for validation, and 10% for DNN inferencing (classification). All DNN methods use the Adam optimizer with an initial learning rate 3 1 10 −  and batch size is 256. The learning rate scheduling method adopts exponential with an exponential decay factor of 0.85. In addition, to prevent the model from overfitting on the training set, we added early stopping in the training process. Use torch 1.7.1 to build the DNN model. Experiments run on NVIDIA GeForce RTX 3080Ti GPU.

RFFI Performance with Transmitters Impairments
In this subsection we simulate 100 UEs with different RF impairments and investigate the effect of the simulation dataset settings and the RFFI algorithm on the UE authentication performance, respectively. The former remains constant for the RFFI algorithm and varies the simulation dataset parameters: number of UEs (Case T3), signal sampling points (Case T4) and transmitter impairment (Case T1 and T2), respectively.

RFFI performance under different numbers of UEs
Intuitively, the tolerance range in actual device production is limited due to the restrictions on transmitter characteristics by related protocols (3GPP and IEEE). As the number of UEs increases, the probability of overlapping impairment parameters of each UE increases, and the characteristics between UEs will be closer, Page 14 of 3 making it more difficult to classify more UEs. We randomly select different numbers of devices from the data Case T3, and the results are shown in Table 6. It can be observed that when there are 100 UEs and 20 dB SNR, the CNN classification accuracy drops only slightly to 91.00%. As the number of devices increases, the more obvious the impact of the SNR on the recognition accuracy. Further perform t-SNE feature dimension reduction visualization on 15dB 10UE and 20UE, as shown in Figure 12. Different UEs are represented by different colors, and different samples of the same UE are represented by labels for 2-dimensional feature distribution. Due to the limited capacity of the feature space when the number of UEs increases, the probability of RFF feature overlap between devices further increases, which leads to RFFI model misclassification.  Figure 12. t-SNE dimension reduction visualization

RFFI performance at various sampling points
This part explores the relationship between sampling points and RFFI recognition accuracy, as shown in Table 7. The data set uses caseT4, and the T4 data set signals are down-sampled to 500, 1099, 2048, 3000, 4096, 5000, and 5526. Longer signals lead to higher RFFI performance. Because long signals contain more RFF features, CNNs can learn smooth and stable signal amplitude variation patterns to achieve more accurate estimates of RFF statistical features. Simulation results have verified this point. When the signal length reaches 4096 points, the SNR=15dB accuracy rate is 97.3452%, and then the accuracy increases slowly as the sampling points increases. , and the CNN model recognition accuracy under different signal-to-noise ratios is shown in Figure 13. We can see that, under the same SNR, the accuracy of the mixed action results of All Impairments > IQ imbalance > PA nonlinearity. Among them, PA Nonlinearity shows particularly poor performance, with accuracy close to 1%, and the network does not learn any inter-UE fingerprint information. Considering the reasons, on the one hand, it is related to the range of our PA device coefficient setting. When most devices PA work in the linear region and PA nonlinearity is not obvious. On the other hand, due to the baseband signal using SRS signal, which is generated by constant amplitude Zadoff-Chu (ZC) sequence, the signal peak-to-average ratio and dynamic range is low.  Figure 14, several observations can be made as follows: a) When the SNR is high, the signal has better quality, the characteristics of RFF are more obvious, and DNN can learn them more easily, so the performance difference between different networks is smaller; b) When the SNR is low, ResNet, InceptionV4, Attention, and CLDNN have greater improvements compared to CNN. The main reason is that the above network can learn richer I/Q data correlation information than CNN. ResNet can be regarded as an integration of multiple models, which improves the performance of RFFI tasks through feature fusion; Attention introduces channels and spatial attention to fully extract the fingerprint information between signal localization and IQ association; InceptionV4 can be regarded as a ResNet network for multi-scale analysis, integrating convolutional kernel features at different scales (1/5/7/9); CLDNN introduces LSTM networks to further model and analyze the distribution information of RFF in time dimensions. c) As the SNR decreases, the model performance deteriorates more severely, especially below 10 dB, when the noise can further swamp the signal's subtle local fingerprint features.

RFFI Performance with Channel Effects
This section will demonstrate the effect of channel effects on RFFI recognition accuracy. Specifically, in the simulation setup, we consider Line-of-Sight /Non-Line-of-Sight, RMS delay spread, and Doppler shift.

Multipath
We first study channel multipath effects, including both LOS and NLOS channel scenarios. Specifically, we  Figure 15.
According to Figure 15, the CNN model achieved excellent performance in both the high SNR LOS and NLOS scenarios, with SNR=15dB, achieving over 92% for the LOS channel and over 90% for the NLOS channel. As the channel parameters of the training and test sets were maintained at the same settings during the experiments, the CNN accuracy of the same scenario varied less with the change of the channel delay spread. In addition, under the same SNR, the accuracy rate of the LOS channel is slightly higher than that of the NLOS channel, because there is a direct path in the LOS channel, and the signal quality is higher than that of the NLOS channel.

Doppler
We also investigate the channel doppler shift effect, including both LOS and NLOS channel scenarios. Specifically, dataset C2 is chosen with the channel RMS delay spread being fixed to independently study the channel doppler effect. The CNN model was used to test different doppler frequency shift data under LOS and NLOS, and the results are shown in Figure 16. When the data distribution of the training set and the test set are consistent, the change of channel doppler parameter has a weak impact on the accuracy of the model. As the SNR increases, the recognition accuracy increases and the accuracy of 15dB reaches 90% in LOS and NLOS scenarios. Also, LOS channel performance is lower than NLOS channel performance. of a high SNR (15 dB), and they all reach 97% accuracy. Therefore, it is not sufficient to evaluate the merits of the models using only accuracy metrics. For this reason, we compared the prediction probabilities (confidence levels) of the models in the 15dB test set, as shown in Figure 17 and Table 8. The horizontal axis represents the probability of the model predicting the correct classification sample, and the vertical axis is the total number of samples distributed around the probability. Undoubtedly, more samples around the probability of 1 means better performance of the model. The Attention model shows high prediction confidence and is more stable (low standard deviation of probability) for the test set. Combined with Figure  14 we find that this characteristic of the Attention model corresponds to higher accuracy at low SNR, further demonstrating that the Attention model is more suitable for the RFFI task. a) A comparison purely in terms of model performance shows that the Attention model has the optimal performance, as reflected by the highest model prediction confidence and the smallest confidence standard deviation on the T4 dataset, and similar accuracy to other models in multipath and Doppler scenarios. b) The performance of the model shows a positive correlation with the model size to a certain extent, i.e., the larger the model, the better the model performance is relatively. The inference time of the model, on the other hand, shows a certain degree of negative correlation with the size of the model, except for InceptionV4. This is mainly due to the large number of feature concatenation processes in the InceptionV4 structure. c) The Attention model has similar parameters and structure as the Resnet model, but performs significantly better than Resnet, which to some extent illustrates the importance of Spatial Attention and Channel Attention for the RFFI task.

Conclusion
This paper presents the construction of a simulation platform tailored for 5G NR uplink scenarios. The platform's focus lies in scrutinizing the ramifications of transmitter impairments and channel dynamics on RFFI, employing thorough testing and simulation. Specifically, stable component impairments encompassing phase noise, IQ imbalance, and PA nonlinearity, as well as variable impairments like carrier frequency offset. Transmitter characteristics (EVM and ACPR) as delineated by the 3GPP protocol are utilized to evaluate the rationality of transmitter impairments. We also model the channel impact, using the TDL channel model to independently manipulate the frequency-selective fading (RMS delayed spread) and time-selective fading (Doppler) of the channel. Remarkably, employing DNN, the model demonstrates its capability to discern 100 UE transmitters with an impressive 91% accuracy, holding constant a SNR of 15dB. Finally, a comprehensive evaluation demonstrates the effectiveness of the Attention module in the model for RFFI.
In the future we refine this simulation platform and focus on the following aspects: (1) Refining the simulation platform. One is the lack of modeling of the practical receiver, which needs to be further incorporation. Additionally, the alignment of simulation component impairments with actual measured device parameters will be undertaken. Moreover, the existing WiFi and 5G systems are multipleinput and multiple-output (MIMO) transmission [42], and the system needs to be further expanded to MIMO. Constructing a RFFI simulation dataset for MIMO systems becomes imperative.
(2) Exploring RF fingerprint mechanisms and capacity. The intricate nature of the transmitter's internal structure, fraught with nonlinearity and complexity, challenges forward transmitter fingerprint modeling. Compared with the actual measurement data constrained by collection scenarios and device counts, the simulation offers the capacity to promptly generate many distinct UE transmitters. This facilitation proves advantageous for subsequent explorations of RFFI capacity via experimental methodologies.
(3) Studying robust channel algorithm. The simulation platform's ability to disentangle and autonomously regulate channel effects-such as RMS delay spread, Doppler, noise, and multipath (LOS/NLOS). The practical application of RFFI encounters complexities due to intricate electromagnetic device deployments and ever-changing channel conditions. Aiming to address this, future investigations will delve into cross-channel RFFI. An intriguing avenue of inquiry involves integrating prior knowledge such as channel estimation [29] [43], design an apt RFFI frame structure, and thereby enhancing channel robustness.

Conflicts of interest
The author declares no conflict of interest.

Data availability
No data are associated with this article.