A robust, over-the-air test bed for radio-frequency fingerprinting of cellular devices

We provide a framework for transparently studying dominant uncertainties and sensitivities in data-driven cellular device fingerprinting. This study allows us to compare techniques for cellular fingerprinting from radiated radio-frequency outputs of wireless devices across different input types. We created a well-characterized and controlled testbed and algorithms for non-destructive, over-the-air (OTA) fingerprinting of commercial cellular user equipment. This testbed is designed to repeatably collect radiated fields from cellular devices in a 4G Long Term Evolution network configuration. Using this controlled measurement-based testbed, a library was created that can serve as a benchmark for comparing measurements and algorithms, as well as assigning uncertainty bounds to those comparisons. We describe a classification algorithm to determine the model of each cellular device, allowing for a direct correlation between input data (in either the time or frequency domain) from test cellular phones and identification accuracy. In addition, by controlling the radio channel conditions, we identify dominant error mechanisms in the fingerprinting that can impact comparisons across fingerprinting methods. The transparent algorithm performs classification with either error-vector-magnitude, a quantity derived from demodulated data, or the out-of-band frequency domain response of the cellular devices. We have investigated the robustness over time of this fingerprinting method and show over 95% accuracy in identifying phone models. Furthermore, the control provided over the communication link and the identification algorithm offers insight into parameters that can cause a reduction in accuracy, with a broader impact on data-driven OTA fingerprinting approaches generally.