FINGERPRINTING

CROSS REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of priority from U.S. Provisional Patent Application No. 62/740,486, filed on October 3, 2018, entitled“CARRIER FREQUENCY ESTIMATION FOR RADIO FREQUENCY FINGERPRINTING”, the contents of which are incorporated by reference herein in their entirety.

FIELD OF THE INVENTION

[0002] The invention relates generally to the field of wireless communication systems.

BACKGROUND

[0003] The use of wireless communication systems and their interconnections via networks have grown rapidly in recent years. Because radio frequency (RF) waves can penetrate obstacles, wireless devices can communicate with no direct line-of-sight between them. This makes RF communication easier to use than wired or infrared communication. For example, billions of Bluetooth devices, such as laptops, smartphones, computer peripherals, headsets, and handsfree devices, are widely used all over the world.

[0004] However, wireless RF communication is also easier to hack and disrupt than wired communication. Because wireless RF communication can suffer from these threats, additional countermeasures are needed to protect against them.

[0005] The foregoing examples of the related art and limitations related therewith are intended to be illustrative and not exclusive. Other limitations of the related art will become apparent to those of skill in the art upon a reading of the specification and a study of the figures. SUMMARY

[0006] The following embodiments and aspects thereof are described and illustrated in conjunction with systems, tools and methods which are meant to be exemplary and illustrative, not limiting in scope.

[0007] There is provided, in accordance with an embodiment, a system comprising: at least one hardware processor; and a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by said at least one hardware processor for: receiving, by a radio frequency (RF) receiver, an RF transmission from an RF transmitter, wherein the RF transmission (a) is modulated in accordance with a specified modulation scheme, and (b) comprises a digital data packet; demodulating the RF transmission to produce a time series of bits that form the digital data packet; and processing said time series of bits to estimate at least one of (i) CFO of the RF transmitter, and (ii) modulation index of the RF transmitter.

[0008] There is also provided, in an embodiment, a method comprising: receiving, by a radio frequency (RF) receiver, an RF transmission from an RF transmitter, wherein the RF transmission (a) is modulated in accordance with a specified modulation scheme, and (b) comprises a digital data packet; demodulating the RF transmission to produce a time series of bits that form the digital data packet; and processing said time series of bits to estimate at least one of (i) CFO of the RF transmitter, and (ii) modulation index of the RF transmitter.

[0009] There is further provided, in an embodiment, a computer program product comprising a non-transitory computer-readable storage medium having program instructions embodied therewith, the program instructions executable by at least one hardware processor to: receiving, by a radio frequency (RF) receiver, an RF transmission from an RF transmitter, wherein the RF transmission (a) is modulated in accordance with a specified modulation scheme, and (b) comprises a digital data packet; demodulating the RF transmission to produce a time series of bits that form the digital data packet; and processing said time series of bits to estimate at least one of (i) CFO of the RF transmitter, and (ii) modulation index of the RF transmitter.

[0010] In some embodiments, said processing comprises modulating a theoretical RF transmission from said time series of bits, wherein said modulating is in accordance with the specified modulation scheme; and said estimating is based, at least in part, on comparing the RF transmission and the theoretical RF transmission.

[0011] In some embodiments, said modulating is based on one of a frequency-shift keying (FSK) modulation and a Gaussian frequency-shift keying (GFSK) protocol.

[0012] In some embodiments, said said estimating further comprises solving a set of linear equations using a least squares method.

[0013] In some embodiments, said comparing further comprises calculating a derivative of said set of linear equations based on subtracting equation pairs.

[0014] In some embodiments, said processing comprises identifying, in said time series of bits, a plurality of bit sequences having a specified minimum number of identical bits; said estimating of said CFO of said RF transmitter is based, at least in part, on calculating a weighted average of CFO values of all said bit sequences; and said estimating of said modulation index of said RF transmitter is based, at least in part, on calculating a weighted average of modulation index values of all said bit sequences.

[0015] In some embodiments, said weighting is based, at least in part, on a length of each of said bit sequences.

[0016] In some embodiments, the method further comprises determining, and the program instructions are further executable to determine, whether a runtime RF transmission originates from said RF transmitter, by comparing at least one of (i) a CFO of the runtime RF transmission with said estimated CFO of said RF transmitter, and (ii) a modulation index of the runtime RF transmission with said estimated modulation index of said RF transmitter.

[0017] In some embodiments, said demodulating comprises sampling said RF transmission at a specified sampling rate to obtain a plurality of signal samples; identifying signal segments associated with each of said bits that form the digital data packet, based, at least in part, on detecting local phase signal maximums in said signal samples; and determining a logical value associated with each of said signal segments based, at least in part on the phase of each of said signal segments. [0018] In addition to the exemplary aspects and embodiments described above, further aspects and embodiments will become apparent by reference to the figures and by study of the following detailed description.

BRIEF DESCRIPTION OF THE FIGURES

[0019] Exemplary embodiments are illustrated in referenced figures. Dimensions of components and features shown in the figures are generally chosen for convenience and clarity of presentation and are not necessarily shown to scale. The figures are listed below.

[0020] Fig. 1 is a block diagram of an exemplary system for identification and authentication of a radio frequency (RF) device based on Carrier Frequency Offset (CFO) and/or modulation index, according to an embodiment;

[0021] Fig. 2A is a flowchart of a process for estimating a CFO and/or modulation index for an RF device, according to an embodiment;

[0022] Fig. 2B is a flowchart of a process for constant data estimating of a CFO and/or modulation index for an RF device, according to an embodiment; and

[0023] Fig. 3 schematically illustrate data acquisition for generating a CFO and/or modulation index profile of a radio frequency (RF) device, according to an embodiment.

DETAILED DESCRIPTION

[0024] Disclosed herein are a system, method, and computer program product for quick and reliable estimation of Carrier Frequency Offset (CFO) and/or modulation index values in radio frequency (RF) devices.

[0025] The term“RF” is used herein broadly, to include all signals transmitted as free- space electromagnetic radiation or emission in all frequency bands used in communications and according to a wide variety of RF communication protocols. In some embodiments, the present invention may be applied with respect to one or more local area networks and/or personal area network protocols, including, but not limited to, Bluetooth, Bluetooth Fow Energy (BEE), ZigBee, and/or Wi-Fi. [0026] “RF fingerprint” refers to idiosyncratic hardware-related traits, characteristics, and/or features of an individual RF device. These small differences are device-specific, even among devices of the same model, and manifest themselves as artifacts of emitted signals. They may be attributed to, e.g., component manufacturing tolerances, device age, etc. In some cases, these traits, characteristics, and/or features may be sufficiently unique, either individually or in combination, so as to form a radiometric identity of the transmitting device. Because RF fingerprints are difficult to clone, they may be exploited to obtain reliable and efficient electronic fingerprints and signatures from RF devices. These, in turn, may play a significant role in improving the security of many RF transmission protocols, e.g., for identification and authentication purposes. For example, by obtaining and storing the unique fingerprints of RF devices in a network, each device can be positively identified and authenticated within the network, thereby thwarting attempts to infiltrate the network with an unauthorized device attempting to impersonate an authorized device. In another example, RF fingerprints may also help to avoid relay attacks, because a relay device attempting to impersonate a legitimate device will, by necessity, have a slightly different RF fingerprint which may be detected by the receiving device.

[0027] CFO and modulation index are a common anomaly in transmitting devices, which often occurs when a local oscillator signal in the receiver does not synchronize with the carrier signal contained in the received signal. As a result, the received signal may be shifted in frequency. This phenomenon can be attributed to several factors, chief of which is clock drift in the transmitting device. Clock drift is a phenomenon caused by manufacturing variability of oscillators. To keep manufacturing costs low, typically a range of 7.5 - 100 ppm is assumed for commonplace wireless devices, such as consumer Bluetooth devices. This means that, for RF transmission in the 2.4GHz band, CFO may be in the range of 18kHz to 240kHz.

[0028] Because CFO and modulation index are a device-specific trait, it may be leveraged for use in device fingerprinting authentication. Specifically, the frequency mismatch in the transmitter and the receiver oscillators can be measured and used in constructing a device RF fingerprint. [0029] Accordingly, in some embodiments, the present invention provides for one or more algorithms configured for calculating an estimated CFO value and/or modulation index for an RF device, based on at least one digital data packet received from the device. The estimated CFO value and/or modulation index calculated for the RF device may then be used, alone or with other elements, in constructing a more accurate RF fingerprint for identification and authentication of the device.

[0030] In some embodiments, the algorithm of the present invention may be based, at least in part, on receiving at least one digital data packet, demodulating the packet to obtain a time series of bits that form the digital data packet, and then re-modulating the packet using known relevant transmission protocol parameters. The re-modulated packet may then be used to estimate CFO and a modulation index for the transmitting device.

[0031] In some embodiments, a system of the present invention may use the CFO and/or modulation index estimations of one or more RF devices, to generate and store, in a dedicated database of profiles, CFO and/or modulation index profiles of the one or more RF devices. In some embodiments, a system of the present invention may be configured for using such CFO and/or modulation index profiles as part of fingerprinting authentication of an RF device. In some embodiments, the fingerprinting authentication may be based on the predicted CFO and/or modulation index values alone, or in combination with one or more other RF fingerprinting parameters.

[0032] A potential advantage of the present invention is, therefore, in that it may provide for a quick, reliable, and efficient identification and authentication of an RF device, based upon estimating an accurate CFO and/or modulation index values for the device from as little as a single digital data packet received from the device. The disclosed invention is easy to use and cost effective, does not require any additional hardware, and has no significant negative effect on the size, power consumption, and/or price of the RF device being authenticated.

[0033] Accordingly, a system of the present invention may be used, e.g., in the context of a wireless communications network, for identifying and authenticating authorized network devices. For example, when a new device first joins the network, one or more existing network devices may perform a learning stage for constructing a CFO and/or modulation index profile for the new device. The CFO profile may then be stored, together with all other existing network profiles, in a network-wide database of authorized CFO and/or modulation index profiles. Thereafter, whenever the device attempts to connect to the network, the stored CFO and/or modulation index profile of the device will be matched against runtime CFO and/or modulation index values acquired from the device, to permit or deny network service or login to the device.

[0034] Fig. 1 is a block diagram of an exemplary system 100 for identification and authentication of an RF device based, at least in part, on a calculated expected CFO and/or modulation index value for the device. System 100 as described herein is only an exemplary embodiment of the present invention, and in practice may have more or fewer components than shown, may combine two or more of the components, or a may have a different configuration or arrangement of the components. The various components of system 100 may be implemented in hardware, software or a combination of both hardware and software. In various embodiments, system 100 may comprise one or more dedicated hardware devices, or may form an addition to or extension of an existing device.

[0035] In some embodiments, system 100 may comprise a hardware processor 110, which may include an RF analyzer 110a and a estimation module 110b; a non-transitory computer- readable memory storage device 112; and an RF receiver 114 configured for handling both transmitted and received RF signals. System 100 may store in storage device 112 software instructions or components configured to operate a processing unit (also "hardware processor," "CPU," or simply "processor"), such as hardware processor 110. In some embodiments, the software components may include an operating system, including various software components and/or drivers for controlling and managing general system tasks (e.g., memory management, storage device control, power management, etc.), and facilitating communication between various hardware and software components. In addition, system 100 may include such other components as one or more antenna elements, digital-to-analog (DAC) converters, amplification modules, and the like. In other embodiments, system 100 may also contain one or more accelerometers, a Global Positioning System (GPS) receiver and related circuitry, and data transmission circuitry, such as a Wi-Fi transceiver. [0036] In some embodiments, system 100 may be any network device or node used to authenticate one or more devices as they communicate. For instance, system 100 can be a wireless access point or a cellular base station. The communication network or networks can include any wireless communication network such as a mobile data network, a cellular voice and data network, a wireless local area network (e.g., WiFi or an 802.xx network), a satellite communications network, a personal area network, or any other wireless network. The communication devices can include any network edge device, bridge device or home gateway, a mobile communication device, laptop computer, tablet, smartphone, smart watch, or any other communication device.

[0037] In some embodiments, as noted above, system 100 may be implemented as software instructions embedded and being executed on one or more devices within a network, wherein each system 100 device may comprise any network device or node. In such cases, the computational tasks of constructing CFO and/or modulation index profiles for network devices may be shared by one or more of the system 100 devices, so as to divide overall computational load.

[0038] Overview of the functional steps in one or more processes for estimating a CFO value for an RF device, using a system such as system 100 in Fig. 1, will now be provided with reference to the block diagram in Fig. 2A. The following discussion will focus on applications of the present invention with respect to transmission protocols where data modulation is achieved by employing Gaussian frequency-shift keying (GFSK). However, as noted above, the present invention may be applied with respect to one or more local area networks and/or personal area network protocols, using other frequency-shift keying (FSK) and/or additional modulation techniques.

[0039] In some embodiments, as schematically illustrated in Fig. 3, at a learning stage, system 100 may be configured for receiving at least one digital data packet corresponding to an RF device, for example, smartphone 202, laptop computer 204, and/or router 206.

[0040] In some embodiments, RF analyzer 110a may be configured for processing and analyzing a variety of parameters and features with respect to the one or more digital data packets received by RF receiver 114. Such parameters and features may include, but are not limited to, CFO parameters, phase parameters, frequency parameters, and/or amplitude parameters.

[0041] In some embodiments, RF analyzer 110a is configured for performing packet alignment with respect to a received digital data packet, so as to be able to determine the starting point of each data bit in the packet. In some embodiments, packet bit alignment may be performed by sampling the signal at an appropriate oversampling rate, to identify local phase maximums:

where the packet local phases are denoted q ₁ , . . . , q _t .

[0042] The packet may be considered to be correctly aligned once the function

{Z _j % oversample rate : Z _; 6 M }

results in a string of zeros (however, small exceptions may occur due to noisy samples). The alignment process may be concluded by removing k samples from the beginning of the packet, where

Zc = median ({Z _j % oversample rate : Z _; 6 M }).

[0043] In some embodiments, once the digital data packet is properly aligned, estimation module 110b may be configured for demodulating the data bits to derive the underlying data, by examining the phase of the modulation samples corresponding to each data bit X ₁ , ... , X _n ( n = T / oversample rate), where k is the number of samples obtained per bit. In some embodiments, each data bit may be demodulated by determining the sign (i.e., positive or negative) of the derivative of the phase of the bit, where a positive phase corresponds to a logical‘G and a negative phase corresponds to a logical ‘O’. Accordingly, the bit may be expressed as:

Estimation Algorithm

[0044] With continued reference to Fig. 2A, in some embodiments, once the packet has been demodulated and the underlying data bits derived, estimation module 110b may be configured for re-modulating the data to create a theoretical perfect GFSK waveform, by using GFSK modulation with the known parameters defined in the relevant transmission protocol (e.g., BLE). The modulated data Gi, ..., G _T may then be used to get a set of linear equations derived from each phase sample:

where h is an unknown modulation index, CFO is the unknown carrier frequency offset, and Si is the noise for sample i. Both CFO and h may then be estimated by solving the linear equations using a least squares method.

CFO Estimation Algorithm - Embedded Version

[0045] In some embodiments, the present invention provides for an embedded version of system 100, e.g., as software instructions embedded and executed on one or more devices, such as a mobile device. In some embodiments, an embedded system 100 may be configured for reducing computational time of the estimation algorithm. In some embodiments, an embedded version of system 100 may be configured to carry out the steps of packet alignment, packet demodulating and decoding, and data re-modulation, as described above with reference to Fig. 2A under "Estimation Algorithm." However, in some embodiments, in order to optimize running time, the linear equations builder step may provide for subtracting equation pairs. Accordingly, in some embodiments, the linear equations may be expressed as:

[0046] This way, there may be obtained a set of equations with only one explanatory variable h (modulation index), and an intercept which may be solved more efficiently than the original equations. The new linear equations may be denoted

Q ^* = a + G- * h + e ^* ,

where: 2 nj

a * CFO,

sampling frequency

• G ^* = G _i+j — Gi, and

• ^e ί — ^i+j— ^e i-

[0047] Based on the above, there can be obtained:

and a = mean

from which there can be derived the CFO value:

sampling frequency

CFO = a * -

2nj

[0048] In this example, j was selected as 4 * oversample rate. Note that by choosing a larger j, the total number of equations may decrease, while a smaller j may lead to correlations between the noise in different equations.

Estimation Algorithm - Constant Data Version

[0049] With reference to Fig. 2B, in some embodiments, a constant data variation of the estimation algorithm described above under "Estimation Algorithm" may be employed. In the disclosed constant data variation, estimation module 110b may be configured for calculating separately the CFO value for‘1’ and‘0’ bits in the received digital data packet. In this variation, the packet alignment and packet decoding stages are performed as described above under "Estimation Algorithm." Then, estimation module 110b may be configured for obtaining data segments having each a minimum-length sequence of identical decoded data bits (i.e., 0 or 1, respectively). These segments may be acquired as follows:

*i = {( ^x i ^x i+i - - - ^x i+i) ^{: x} i = ^x i+ 1 = = ^c i+i = 1 L Z > 4}

A ₀ = {(xi, x _i+1 , . . . , x _i+l ) : Xi = x _i+1 = . . . = x _i+l = 0 A I > 4} where l is the minimum length for consecutive identical bits.

[0050] For every acquired segment (x _L , x _{l+ 1} , x _L +i), the corresponding phase samples ( ; _*f c+i _{> >} 0 _(i +i+i _)*f e) ^ma y be considered, where k is the oversample rate. In some embodiments, two samples are removed from the edges of each phase segment, in order to cancel the modulation gaussian filter effect, to get the segments:

[0051] Then, for every segment in G _± , G ₀ there is assumed a constant CFO value, which may be found by solving the equations set:

{9 _s+j = j * CF 0 + 9 _S : 1 < j £ m}, where 9 _S is the first segment phase sample and m is the segment length. In some embodiments, these equations may be solved by using the linear equations solving method described above under "Estimation Algorithm - Embedded Version."

[0052] Given the calculated CFO for all segments, the RF device CFO values corresponding, respectively, to 1 data bits and to 0 data bits, may then be calculated in the following way:

where:

• t is the number of segments in G _± ;

• r is the number of segments in G ₀ ;

• f _{!> >} f _t are the frequencies corresponding to the segments in ;

• g ₁ , . . . , g _r are the frequencies corresponding to the segments in G ₀ ; m ₁ , are the length of the segments in G and • l _it . . . , l _r are the lengths of the segments in G ₀ .

[0053] The RF device total CFO may then be derived as the average of F o and F i .

[0054] As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a "circuit," "module" or "system." Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.

[0055] Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

[0056] A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0057] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0058] Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0059] Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a hardware processor of a general-purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

[0060] These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.

[0061] The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

[0062] The flowcharts and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

[0063] The descriptions of the various embodiments of the present invention have been presented for purposes of illustration but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein. [0064] In the description and claims of the application, each of the words "comprise" "include" and "have", and forms thereof, are not necessarily limited to members in a list with which the words may be associated. In addition, where there are inconsistencies between this application and any document incorporated by reference, it is hereby intended that the present application controls.