<<

Science,Volume 36, Number 4, Pages585-597, July-August2001

Characteristics of radio fingerprints

K. J. Ellis and N. Serinken Research Centre, Ottawa, Ontario, Canada

Abstract. In this paper, the characteristicsof radio transmitterfingerprints will be examinedby analyzingboth the amplitudeand phaseinformation obtained from complex enveloperecordings of transmitterturn-on transients.The interest in the analysisof such transientsis related to the identificationof malfunctioningor illegally operated radio transmittersin supportof radio spectrummanagement practices. Of the 28 VHF consideredin this study,many were found to producefingerprints having uniquely distinctivefeatures which couldbe usedfor identificationpurposes. Unfortunately, some of theseradios were found to have fingerprintsthat were virtually indistinguishablefrom each other, making the identificationprocess more difficult, if not impossible.Details of the equipment,analyses, and data collectionprocedures will be presentedalong with a discussionof the experimentalresults. The merits of this techniqueover others currently in use will also be presented.

1. Introduction ried out using a variety of VHF radio . When a radio transmitteris activatedor "keyed,"it The objectivesof this studywere not only to catalog goesthrough a relativelyshort transient phase during features useful for transmitter identification but also which the emanating from the unit displays to gain some insight into the issue of fingerprint characteristicsthat are believed to be unique to the consistencyas well as those intentional or evolution- extent that they can be used to unambiguouslyiden- ary processeswhich might alter their characteristics. tify an individual transmitter [Toonstraand Kinsner, In a departurefrom existingtechniques, the method 1995]. These signaturesor transientsare often re- presentedhere involvesthe analysisof complexsignal ferred to as "fingerprints"and havebeen attributedto envelopesrecorded during a transmitter's turn-on a numberof potentialcauses (which will not be dealt interval. Descriptionsof this technique and experi- with in thispaper) suchas the lock-intimes associated mental resultsare presentedin sections2-3. with phase-lockedloop (PLL) frequencycontrol sys- tems [Toonstraand Kinsner,1996]. At presentthere 2. Experimental Setup and Data are two different approacheswhich have been studied Collection for the purposesof fingerprint identification:those involvingthe recordingand analysisof analogsignals One advantageof the complexenvelope technique from a receiver'sFM discriminatorcircuit [Toonstra is that , phase, and, consequently,fre- and Kinsner,1995, 1996] and thosewhich rely solely quency information can be extracted from the re- on the envelopeor amplitude characteristicsof the cordedfingerprints. By virtue of this additionalinfor- receivedsignal [Cboe et al., 1995; Payal, 1995, Hip- mation it is likely that a greater number of features penstieland Payal, 1996;Abdulla, 1995]. Of these,the can be found, which may aid in the identification FM discriminator technique appears to be more process.To obtain the complexenvelope, a quadra- ture demodulator unit was constructed for this series commonand is currentlyused by spectrummanage- ment personnelboth in Canada and in the United of experiments as shown in Figure la. Both the States. in-phase,i(t), and quadrature,q(t), channelswere To gain a better understandingof those character- sampledwith 16- resolutionat a rate of 44.1 kHz. The use of both these channels, which are band isticswhich may be useful for transmitteridentifica- limited from 20 Hz to 20 kHz, when combined tion, a seriesof fingerprintingexperiments were car- through complexanalysis, gives an overall recording of approximately40 kHz with a 40-Hz Copyright2001 by the American GeophysicalUnion. dead band centered about 0 Hz. A block diagram Paper number 2000RS002345. illustratingthe connectionsto the receiver and com- 0048-6604/01/2000RS002345 $11.00 puter/recordingequipment is shownin Figure lb.

585 586 ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS

• LoJ••"•.• i(t) 10.7 MHz Pwr IF Input Splitter

LO Input I. Lv;tPeraSt) 10.71 MI-Iz 50ø0 (a)

350 m •

Broadband Discone )J4 Groundplane ILoca 10.711•MI-Iz I •R Antenna +10.0 dBm G-58u I Demod./ IReceiver Icom[ [Coaxial CableCoaxialRG-58 Cable

I BPF I IComputer I I

(b)

Figure 1. (a) Quadraturedemodulator. (b) Experimentalsetup used for capturingfingerprints from the group 1 radios.For group 2 radiosthe transmitterswere connectedto a 5M8 antenna and were manually"keyed." Group 3 radioswere also manuallykeyed, but all were printed with their existing "rubber ducky" antennas.All testswere made with the sameseparation distance of 350 m.

Fingerprintswere collectedfrom a variety of VHF All transmittersused in this experimentwere lo- FM transmitters, which were divided into three dif- cated in a positionedapproximately 350 rn ferent groups accordingto their operating frequen- away from the receiving location as indicated in cies.Ideally, it would have been desirableto have all Figure 1. In the caseof the group 1 radios all were radios operating on the same ; unfortu- connectedto a M4 groundplane antennamounted at nately, this was not practical as many of the radios a height of 3.66 m abovegroundand poweredfrom a were borrowedon a short-termbasis which precluded 12-V deep-cycle marine battery. A 5M8 antenna the modificationof their operatingfrequencies. The tuned to the desiredoperating frequency was at hand first group, group 1, contained11 radioswhich were andwas used for testswith the group2 radioswhereas fingerprintedat 147.775MHz; group 2 contained12 the group 3 radios were printed using their "rubber radioswhich were fingerprintedat 168.690MHz; and ducky" antennas.Radios from groups2 and 3 were group 3 contained5 radioswhich were fingerprinted powered from their own internal battery packs.For at 138.750MHz. In total, fingerprintsfrom 28 radios all radios, care was taken to maintain a constant were collectedfor analysis.All radios employedfre- ambient temperaturewithin the vehicle to mitigate quencymodulation (FM) andwere phase-locked loop anypossible thermal effectswhich could affect finger- (PLL) controlled,excluding those in group 3 which print consistency.All group 1 transmitterswere keyed employedcrystals. A summarylisting the particulars using a relay arrangementwhich automaticallycon- of these radios can be found in Table 1. For each trolled the push-to-talk(PTT) lines for each radio. radio a sampleof 20 fingerprintswas collected. Those transmittersin groups 2 and 3 were keyed ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS 587

Table 1. TransmitterSummary for Groups1, 2, and 3a

Radio Transmitter Number of Nominal Frequency, Power Group Make Type Name Units Power, W MHz Source

1 Motorola MCX100 Motorola 2 27.0 147.775 marine battery 1 Force CMH350 Force 3 35.0 147.775 marine battery 1 Kenwood TH-25AT Kenwood 3 0.2 147.775 marine battery 1 Kenwood TH-21AT Kenwood 1 0.1 147.775 marine battery 1 Yaesu FT208R Yaesu 2 0.1 147.775 marine battery 2 Motorola Visar Sec 3 5.0 168.690 battery pack 2 Motorola HT-1000 Sec 9 5.0 168.690 battery pack 3 Motorola SHA 274 Pol 5 5.0 138.750 battery pack

a Fingerprintswere recordedat the frequenciesindicated and are individuallyidentified by their transmittername and unit number. All transmitterslisted employ frequency (FM).

manually. The resultingtest transmissionswere ap- proximately0.5 s in duration and were repeated at O(t)=tan i-•-]' 1.0-s intervals; that is, the transmitter was on for 0.5 s -1(q(t) t and then off for the next 0.5 s. It should be noted that For analyticalpurposes the instantaneousphase 0 (t) someof the portable radiosincluded in group 1 had is unwrappedto removethe discontinuitiesproduced high- and low-powersettings and were printed under when the phaseangle passes through multiples of both conditions. rad and is denotedhere as the h (t). Once in At the receivinglocation an Icom R7100 or R9000 this form, the instantaneousfrequency fi(t) can be receiver, quadrature demodulator, and , determined accordingto equippedwith an analog-to-digital(A/D) card,were 1 d usedto captureand recordthe fingerprintsfrom each transmitter (see Figure lb). A broadbanddiscone f i(t)= 2-•d-• Sh (t) mz, antennamounted atop a 3.66-m mast and connected to the receiver through a length of RG-58U coaxial which can be used to further characterizethe finger- cable was used for reception. To ensure that the print. If frequency shifts are produced when the receivedpower levels from each of the transmitters transmitter is "keyed," this behavior will manifest were roughly equal, the receiver's internal 20-dB itself in the form of curvatureor slope variationsin attenuatorwas activatedwhen the high-powermobile the resulting phase profile. When the transmitter transmitters were in use. reaches steady state, the phase profile will be a straightline whoseslope is proportionalto the differ- encebetween the actualoperating frequency and that 3. Signal Processingand Print of the localoscillator (LO) in the quadraturedemod- Comparison ulator. For the equipmentused in this experimentthe Once capturedand savedto disk, the in-phaseand steady state frequency will be 10.0 kHz when the quadrature samplesrepresenting a transmitter'sfin- received signal is exactlyon its assignedfrequency, gerprint are mathematicallycombined to form the since the LO for the quadrature demodulator has complexenvelope s(t), givenby been offset by 10 kHz above the receiver'sinterme- diate frequency(IF) output at 10.7 MHz. This was s(t) = i(t) + jq(t). done in order to shift the steadystate frequency away from the cutoff frequencyat the lower end of the A/D From the complexenvelope the signalsa(t) and 0 (t), band-passfilter (BPF). which represent the instantaneousamplitude and Figure 2 showsthe amplitudeand phaseprofiles of phase of the fingerprint, can then be determined. a fingerprintprocessed according to the discussionin Specifically,the amplitudea(t) is givenby the previous paragraph. This distinctiveprint was a(t) = [i2(t) + q2(t)]l/2, taken from a VHF AM radio operating at 123.4 MHz and is presented here for illustrative and the instantaneousphase O(t) is givenby purposes,as its featuresspan the entire rangeof those 588 ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS

35000 profiles, althoughinstances have been found where 30000 25000 identificationmay prove to be a considerablechal- 20000 lenge. 15000 10000 Fingers 3.1.1. Radio fingerprints:Group 1. The ampli- 5000 tude and phaseprofiles for the set of group 1 radio 0 _••••f •i 'b•Thumb lOO transmitters can be found in Figures 3 through 8. ß o ,•, -lOO • While there are many general similaritiesbetween -200 • profiles,particularly among transmitters of the same -300•'• model type, a closerexamination reveals that all of -400• -500 • these radios have easily identifiable features which -6OO would allow them to be distinguishedfrom other 0 250 500 750 1000 1250 1500 1750 2000 radioswithin the group. SampleNumber In the caseof the Force radios(see Figures 3a-3c) Figure 2. Anatomy of a radio fingerprint.This print was all three possessa singleunderdeveloped finger which captured from a VHF AM aviation transmitter (123.4 is poorlyseparated from the thumb.In all cases,hair MHz) and showsa number anatomicalfeatures such as is presentfor varyinglengths of time. Althoughtheir fingers, webbing, thumb, hair, and swirls. Although not reported in this paper, prints having a similar range of amplitudeprofiles possess a great deal of similarity, features were observed in other aviation radios that were their phaseprofiles show easily distinguishable differ- printed under comparableconditions. encesin their swirlsas steady state is approached. This result is encouragingas the serial numbersof two of theseradios are very closetogether and were encounteredto date. The anatomyof this print is as probablyassembled during the sameproduction run illustratedin Figure 2 and can be described,qualita- with componentsfrom the samebatch. The ability to tively, in terms of its thumb, fingers,webbing, hair, identify transmitterswith nearly identical construc- color, length, and swirls,whose definitionsare given in Table 2. tion is further supportedby the easilydistinguishable amplitudeand phasefeatures of the Motorola 1 and 3.1. Uniqueness Motorola 3 radios (see Figures 4a and 4b), which Ideally, to be useful for identificationpurposes, possessconsecutive serial numbers. fingerprintsfrom a givenradio mustbe unique.That The amplitudeprofiles of both the Kenwood1 and is, they mustpossess a singlefeature or set of features Kenwood 2 radios (Figures 5a and 5b) also share which can be usedto unmistakablydistinguish a given features which are markedly similar. Both prints transmitterfrom all others.In this section,the ampli- possesswell-defined fingers and have hairy thumbs. tude and phase profiles from the three groups of Fortunately,despite the similaritiesin their ampli- transmitters will be presented for the purpose of tude profiles these two transmitterscan be easily assessingfingerprint uniqueness and for identifying distinguishedon the basisof the swirlsfound in their those featureswhich may be useful in establishinga phaseprofiles. Although the Kenwood3 radio (Fig- transmitter'sidentity. As will be seen, many of the ure 5c) is of the same model type as the first two radio fingerprintsobserved to date stronglysuggest Kenwoodradios, its fingerprintsare significantlydif- that transmitter identification can be made on the ferent and are easyto discernfrom the other two. basisof featuresobserved in the envelopeand phase Figure 6 showsthe amplitude and phaseprofiles

Table 2. Anatomy of a Fingerprint

Term Definition

Thumb portion of the amplitudeprofile duringwhich the transmitterachieves "steady state" conditions Fingers short-durationpulse-like appendages in the amplitudeprofile which precedethe thumb Webbing intervalsof lower signalamplitude that are found betweenfingers or betweena finger and the thumb Hair repeatablenoise bursts found (usually)on the thumb Color spectralcharacteristics of noisebursts or hair Length duration of the burst or hair Swirls changesin the curvatureor slopeof a phaseprofile; these changes are usuallyfound at the beginningof the thumb ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS 589

35000 35000 GroupI CroupI (a) 30000 - Force 1 30000 Lx= R7100 25000- 25000 - Rx = R7100 20000- 20000 15000 -Motorola #1 1000015000 - 10000 5000 - 5000 0 6OO 0 ß 5O0 - 400 - 200 o •, -o -500• -2oo -1000 •_• -400 -1500 ø -600 -800 -2000 • -1000 -2500

250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber

35000l•o•p I 35000 GroupI 30000 25000oooo - Motorola #3 20000 25000 - Rx = R7100 20000

_ 1500010000 10000 5000 15000 5000 5OO 0 .._ I 5oo o - -500 - -500 -lOOO -lOOO -1500 -15oo -2000 -2000 { { I I { t t -2500 250 500 750 1000 1250 1500 1750 2000 SampleNumber 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber 35000•GroupI 30000• Force#3 Figure 4. (a and b) Amplitude and phaseprofiles for the 25000 Rx=R7100 Motorola seriesradios. In Figure 4a the thumb hair is in 20000 fact a consistentfeature and may be useful for identifica- tion. Both Figures4a and 4b have underdevelopedfingers, 1500010000 5000 and both achievesteady state fairly rapidly. 0 - ' ' 500

-500 for the other radios.Relative to the rest of this group, -1000 this print is uniquelyidentifiable from its amplitude -15oo profile alone. -2000 Profiles for the Yaesu 1 and Yaesu 2 radios are 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber shown in Figure 7. While the envelope profiles in Figures7a and 7b share commonfeatures such as a Figure 3. (a-c) Amplitude and phase profiles for the singlefinger and a hairy thumb, it is clear that they three Force series radios. Although all three envelope are from two distinct radios as evidenced by the profiles show some similarities,the profiles in Figures 3b and 3c are strikinglysimilar in that they both have under- differences in their swirls. These findings are not developedfingers and have thumb hair of roughlythe same unlike those observed for the Kenwood 1 and Ken- length. wood 2 radios,whose profiles can be foundin Figures 5a and 5b. A noteworthyphenomenon common to the porta- from the single Kenwood TH21-AT (Kenwood 4) ble transmitters, i.e., the Kenwood and Yaesu series transmitter.Of all the group1 radiosexamined, this is radios,is that both the amplitudeand phasecharac- the only one that was found to have more than a teristicsof their fingerprintscan be markedlyaltered singlefinger. It shouldbe noted that the five fingers by switchingthe transmitterfrom its low-powerto its are a repeatablefeature and that the overallduration high-powersetting. Examples of these changesare of this transientis much greater than thoseobserved illustratedin the profilesshown in Figures8a and 8b 590 ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS

35000 35000 [ GroupI GroupI 30000• Kenwood#1 30000 -- Kenwood • 25000 Rx= R7100 20000 20000 15000 -Low Power 10000 1500010000 5000 5000 250000 •;•;•;...... 1 500 0 400 200 - 0 0 -500 -200 -400 -1000 -600 -800 -1500 -lOOO -2000 -1200 • • I I I • I -2500 -1400 0 250 500 750 1000 1250 1500 1750 2000 0 500 1000 1500 2000 2500 3000 SampleNumber SampleNumber

35000 GroupI 30000 Figure 6. Amplitude and phase profiles for the lone Kenwood TH-21AT radio (Kenwood 4). Note the five 25000 Rx= R7100 20000 -LowKenwood Power#2 individual,well-separated fingers. 1500010000 5000 0 50O printsthat would be mostuseful for identificationare 0 the swirlsand fingersfound in the phaseand ampli- -500 tude profiles,respectively. Secondary features which -1000 may also prove useful are finger widths, interfinger -15oo duration, webbing levels, and, possibly,hair length -2000

0 250 500 750 1000 1250 1500 1750 2000 SampleNumber 35000 GroupI 30000 - Yae• #1 35000[CrroupI 25000 - LowPower 30000q•wood R• R7100 25000 •LowPower 20000- 20000- 15000 - 15000 10000 10000 5000 - 5000 0 200 0 5OO -•00 -400 -600 - -500• -8oo - -1000 •,• -lOOO -12oo - -1500 • -14oo - -2000 • I I -1600

I I I I I I I -2500 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber 350001 •o•p Figure 5. (a-c) Amplitude and phase profiles for the 30000• Y•m #2 Kenwood TH-25AT radios. It should be noted that in .ooo20000 Figures5a and 5b the webbingbetween the finger and the thumb is fairly low but is muchhigher in Figure 5c. Thumb 1500010000 5000 hair is commonto all three profiles,and in spite of all the 0 400 similaritiesthese profiles can be differentiatedon the basis 200 of their swirls.

-400 -600 -1000 for the Kenwood 1 and Kenwood 2 radios. The fact I • I I I I -1400-800 that this occursimplies that PLL transientsmay not 0 250 500 750 1000 1250 1500 1750 2000 be the dominant mechanismin fingerprint produc- SampleNumber tion. Figure 7. (a and b) Amplitude and phaseprofiles for the The key features found in this particular set of two Yaesu FT-208R (Yaesu 1 and Yaesu 2) radios. ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS 591

35000 25000 GroupI GroupII (a) Sec #1 30000 _ 20000 25000 20000 15000_ Rx= R7100 • 15000 _ 10000 10000 5000 _ 5000 0 5OO 5OO o -500• -5oo -1000 •., -1000 -1500• -1500 -2000 • -2000 -2500 I -2500 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber

25000 GroupII (b) 350001Group I See #8 30000•r.enwood#2 20000 25000 20000 15000 15000 10000 lOOOO 5000 5000 0 5OO o 500 _ _ 0 o -500 -500 -1000 -1000 -1500 -1500 -2000 -2000 -2500 -2500 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber Figure9. Amplitudeand phase profiles for the group2 (a) Figure 8. (a and b) Amplitude and phaseprofiles for two MotorolaVisar and (b) HT-1000 radios.It shouldbe noted of the KenwoodTH-25AT radiosillustrating the effectsof that the profilesin Figures9a and 9b are representativeof the power level setting on fingerprint characteristics.In all Visars and HT-1000s examined. It should also be noted Figures8a and 8b the radioshave been switchedto their that the phaseprofiles shown here are nearlyidentical and high-powersetting. See Figures5a and 5b for comparison will make identification between the two different models with low-powersetting. very difficult. and color, althoughit is not yet apparenthow these attributeswould be best quantified. 3.1.3. Radio fingerprints: Group 3. The ampli- 3.1.2. Radio fingerprints: Group 2. Unlike the tude and phase profiles for the group 3 radios are radiosin group 1, thosein group2 were found to have shownin Figures 10a-10e. As was the casewith the amplitudeand phaseprofiles with very few distinctive group 1 radios,these profiles share common charac- features.These profiles, as a whole, were found to teristicsbut alsopossess some features which appear have no fingers,no webbing,and no swirls,and from to be unique to each radio. In particular, the most all appearances,achieve steady state operatingcon- distinguishingfeatures are thosefound in the ampli- ditions nearly instantaneously.The envelope and tude profiles,although it shouldbe pointedout that in phaseprofiles for two suchradios, one of eachmodel the case of the Pol 1 and Pol 3 radios, marked type (Visar and HT-1000), are shownin Figures9a similarities exist if the presence of thumb hair is and 9b and are representativeof all the profilesfrom ignored.Unlike the group 1 radios,but similar to the radiosof that type.At first glancethere appearsto be group 2 radios, these phase profiles indicate that little difference between these profiles other than steady state operation is achievedquite rapidly, as someamplitude droop (see Figure 9a), a fact which indicatedby the linear nature of the profile and the stronglysuggests that the identificationof these ra- subtletyof the swirls.The identificationof transmit- dios,either by model type or individually,may posea ters from amongthis group will undoubtedlyrely on very difficult problem. the uniquenessof the amplitude features, although 592 ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS

35000 35000 GroupIII GroupIII 30000 - Pol #1 30000 - Pol//4 25000 - Rx = R7100 25000 - Rx = R7100 20000- 20000- 15000 - lOOOO15000 - 10000 5000 - 5000 -

o 3500 0 3500 - 3000._. - 3000• 2500• - 2500 - 2000• - 2000 - 15ooE - 1000 • - 15oo• - 1000 - 500 .• - 500 - 0 • - 0 I -500 I -500 0 250 5OO 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber

35000 GroupIII 30000 - Pol #2 35000lOroupli I (e) 30000 •Po15 25000 - Rx = R7100 25000 - 20000- • 20000 .,.• 15000- • 15000 lOOOO- < 10000 5000 - 5000 0 3500 0 - 3000• 3500 2500 - 3000• - 2000 2500 - 1500•,• - 2000 - 1000 - 15oo• - 50o - 1000 - 0 - 500 { i i { i { { -500 - 0 0 250 500 750 1000 1250 1500 1750 2000 [ { • { I I I -500 SampleNumber 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber 35000 GroupIII (c) 30000 - Pol #3 Figure 10. (continued) o 25000 - Rx=R7100 .•. 20000- • 15000- < lOOOO- 5000 - 3.2. Consistency 0 3500 While fingerprintuniqueness is a prime requisite - 3000 ,• 2500 for identificationpurposes, it is equallyimportant that 2000:6 1500 the prints emitted by a given transmitterbe nearly lOOO identical,i.e., consistent,irrespective of the elapsed

• - 0500 time between them. The greater the variation, the I i I { { I { -500 greaterthe difficultyin positivelyidentifying a specific 0 250 500 750 1000 1250 1500 1750 2000 Sample Numb er emitter.Figures 11-17 showthe phaseprofiles for all three radio groups with each profile showingfive Figure 10. (a-e) Amplitude and phase profiles for the prints superimposedon a singleset of axes.Similar group 3 Motorola SHA-274 radios.Most of the uniquely identifyingfeatures are foundin the amplitudeas opposed graphsfor the envelopeprofiles, which were found to to the phaseprofiles. Also, the fact that the phaseprofiles be highly consistent,have not been included as the for these radios share similar characteristics could make observableresult of their superpositionis, at best, identification difficult. confusing.In all casesno effort has been made, other than to manuallyexcise similar regionsfrom the raw waveform, to align the profiles. It should be noted that in mostcases, all printswere foundto matchup additional distinguishingcharacteristics may be de- quite well: a fact indicatinga high degreeof finger- rived from the phaseprofiles. Clearly, the mechanism print consistency.While thismay not appearto be the responsiblefor the generation of these transients casefor the profiles of the Kenwood 3 radio (see cannotbe relatedto PLL settlingtimes since all group Figure12c), if one ignoresthe first450 samplesor so, 3 radios are crystalcontrolled. whichrepresent the noisebackground, and imagines ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS 593

400 400 0 400 -800Group -1200-800•00/KenwoodtGroup --•=••'• I #1 -12007Motorola # -1600 -•LowPower -1600 [Rx=R71,00 -2000[Rx= R71,00 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber

400 Co) 400 0 r _ -400 400 -1200-8001KenwoodGroup -1200-800-]Motorola Gro #1 •...• -1600--JLow Power - 16001Rx= R7100 x•--•x -2000/ 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber

400 (c) 1500 0 . 1000500 t (c) -400 -5oo -8oo -1000 GroupI -1500ø t -1200/Motorola #3 4Low ?ower I -16001 , , , , , , -2000-2500lRx=/ R7100I I I I 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber

Figure 11. (a-c) Set of superimposedphase profiles for Figure 12. (a-c) Superimposedphase profiles for the the Motorola radios. The profiles in Figures 11a and lib Kenwood seriesradios. All prints were found to be consis- were taken approximately3 min apart and serveto demon- tent throughoutthe recordingperiod. stratethat somefingerprint characteristics can changeover relativelyshort time periods.Profiles in Figure 11c appear to remain consistentthroughout the recordingperiod. measurementswill be required to fully appreciatethe issueof consistencyover much longer time periods. the bottomtwo curvestranslated up to the level of the The consistencyof the fingerprintsfor the remaining other three, it is clear that these prints do, in fact, group 2 radios is shown in Figures 13-16. In these have very similar characteristicsand are indeed con- cases, it should be recognized that these profiles sistent.Given these results,it is apparent that trans- indicate a good level of consistency.With respectto mitter fingerprintsdo exhibit short-termconsistency. An exceptionto this is the Motorola 1 radio, which wasfound to changequite noticeablyover a relatively 400 shorttime period (roughly3 min) as can be seenby comparingthe plots shownin Figures11a and lib. In -400

Figure 11c an assortmentof profiles from the Mo- -800•KenwoodGroup I g4 torola 3 radio is shown.These profileswere taken at -1200•Low Power intervalsspanning an identicaltime period to that of -1600/Rx:R71001 0 500 1000 1500 2000 2500 3000 the Motorola 1 radio, yet show little temporal vari- SampleNumber ability. The cause of such variations has not been thoroughlyinvestigated; however, it is speculatedthat Figure 13. Superimposedphase profiles for the lone Ken- these changesmay result from equipment heating. wood TH-21AT (Kenwood 4) radio. For the most part, theseprofiles are consistent;however, small variations can This is not an unreasonablebelief in this particular be easilyseen between the individualprints. These varia- case,since the radio in questionhas a relativelyhigh tions will likely make the task of identificationmore chal- outputpower level (Pout = 28 W). Clearly,additional lenging. 594 ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS

400 400 0 -400 -400 -800 -1200•ForceGroup#1 I -1200-800-]Low1GroupYaesu Power #1I -1600/ Rx=- R71,00 I © 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber

400 400 0 0 • Co)

-800 -8004ootGroup I Group -1200]Yaesu #2 -'•.•• I -400 -]LowPower •: I -1200-]Force #2 -1600/Rx=R71, -16001x-71 I00 I I I I I I 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber

Figure 15. (a-b) Superimposedphase profiles for the 400 (c) Yaesu radios.All prints appear to be consistent.

.,.• -4000 informationmay be more robustthan thoseemploy- • -1200-800•Vorce_JGroup #3I ing featuresderived from the amplitudeprofiles. 1Rx= R7100 -1600I 0 250 500 750 1000 1250 1500 1750 2000 3.3. Universality SampleNumber Because amplitude and phase relationshipsare Figure 14. (a-c) Superimposedphase profiles for the preservedthroughout the entireprocessing chain, i.e., Force seriesradios. These prints are clearlyconsistent. from RF input to quadrature output, the fingerprintsfrom a given transmittershould appear nearly identicalirrespective of the receiverby which the Kenwood 4 radio, however, there are small vari- ations visible within the ensembleof prints shown 500 (Figure 13). Thesevariations may make the task of 0 identificationmore challenging. -1000 Althoughthe phaseprofiles for the group3 radios -1500 GroupII (see Figures17a-17e) showeda high degreeof con- -2000-500 -tS ec#! 1Rx-- R7100 sistency,it shouldbe pointedout that their amplitude -2500/ I I I I I I ! profiles do not. In fact, over the course of several 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber secondsthese profiles (for all group 3 radios)were observedto exhibit quite significantchanges. The 5OO range of these fluctuationsis illustratedin the series 0 of envelope profiles for Pol 1 shown in Figures -500 18a-18e. It is believed that these variations are re- -1000 -1500 GroupII lated to the relativelypoor conditionof the battery -2000 •Sec #8 packs as these radios had been in servicefor many -2500lRx= R71, © I years and no DC power adapterswere available to 0 250 500 750 1000 1250 1500 1750 2000 power them from an externalsource. The fact that the SampleNumber resultingphase profiles remain consistent(as previ- Figure16. (a and b) Superimposedphase profiles for the ouslystated), in spiteof thesechanges, suggests that Motorola Visar and HT-1000 radios.All prints are clearly identificationstrategies based on phaseor frequency consistent. ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS 595

4000• Group III (a) 25000/Group liI 35001Pol #1 20000 7 0 25003000 Rx=R7 00 2000 15000 1oooo 5000

-500 o

0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber

4000•Group III 25000Ioro•p III Co) 3500•Pol #2 20000 Pol#1 Rx=R7100 2500 15000 •15002000 1000 m10000 5000 300050• Rx=Ri100 -500 / I I 0 • • 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber 26000/ o•o•p III (c)I 3500dGroupli I 20000-'-I Pøl#1 [ ,•, 25003000 ½x•1-•7 oo 15000Rx=R7100 1500 • 10000 1000 5000 500 20000 -500 I • • 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber 250001GroupnX (d) 4000•crouplII (d) 20000 •Vol#1 a. I ,•, 3500/Pol• 15000 2500 2000 1500 10000 1000 5000 • 300050• Rx=-R700 -500 I • I • • • 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber 250001Group III (e) 20000 •Pol #1 3500_jCroup _ 3000lPol #5 i 15000 2000 1500 10000 1000 5000 500 2500lRx=R7100 0 I I I I I I I I -500 0 250 500 750 1000 1250 1500 1750 2000 0 250 500 750 1000 1250 1500 1750 2000 SampleNumber SampleNumber Figure 18. (a-e) Amplitude profilesfor the Pol 1 radio. Figure17. (a-e) Superimposedphase profiles for the This seriesof profilesillustrates the variabilityof the group3 radios.In all instancesshown here, steady state is amplitudefeatures over short intervals of time:in thiscase, achievedrapidly with few swirlsthroughout. It shouldbe betweentransmissions. While there are significant changes notedthat the amplitudeprofiles are not consistentfor in the amplitudecharacteristics of the prints,the phase reasonsdiscussed in the text. profilesremain consistent,as discussed.This behaviorwas found to be typical of all five Pol radios. they were recorded. This is extremelyadvantageous be noted that this print "universality" cannot be sinceprints recordedusing one receivercan be com- achieved using current analog FM discriminator pared with prints collected from other receivers methods because of differences in the individual and/or thosestored in a commondatabase. It should responsecharacteristics of the associatedcircuitry. 596 ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS

35000lc•oup modulationbut different methodsof frequencycon- 30000 25000 qLowPower •/• trol (fixed-frequencycrystal and PLL) it wouldappear 20000- that radio fingerprintsare largely the result of bulk transienteffects that are producedwhen a transmitter 1000015000 5000 is "keyed." While in many radios the effectsof these 0 400 - 200 transientsare obviousand produceuniquely identifi- - 0 able prints, there are radios, however,whose finger- - -200 -400 prints are virtually indistinguishablefrom each other. -600 - •oo Of the prints presentedhere, it can be statedthat for tooo 1200 the most part, all possessedsome consistent features I I -1400 irrespectiveof whether or not they were unique. 0 250 500 750 1000 1250 1500 1750 2000 Sample Numb er Becauseboth amplitude and phase information is recordedusing the complexenvelope technique de- scribedherein, it is believedthat this approachoffers a number of distinct advantagesover other methods (FM discriminatorand envelopeonly techniques)in 35000l c•oup I 30000• Yaesu#2 use today. Specifically,these advantagesare as fol- lows:(1) Fingerprintquality factor or signal-to-noise 20000 15000 ratio can be easily estimated from the amplitude 10000 profile. (2) Featurescan be extractedfrom both the 5000 0 400 amplitudeand phaseprofiles to aid in the identifica- - 200 tion of individualfingerprints. These featuresinclude - 0 - -200 fingers,webbing, hair, color, length, and swirls.(3) -400 -600 Fingerprintsare universaland can be comparedwith - -800 -1000 those collected from other receivers and/or those -1200 I I I I { I I -1400 storedin a commondatabase. (4) No specialequip- 0 250 500 750 1000 1250 1500 1750 2000 ment modificationsare required as IF output ports SampleNumber are commonlyavailable on many off-the-shelfcom- Figure 19. Amplitude and phaseprofiles for the Yaesu 2 mercial receivers. Because transmitter identification radio. These were recorded using Icom R7100 and R9000 operationsare likely to be targetedat radiosfunction- receivers. ing under conditionsless controlled than those re- ported here, it remains to be determined how the characteristicsof radio fingerprintswill be alteredby Additionally, it should be noted that discriminator effectssuch as Doppler shift, , outputs are not commonlyfound on many commer- , temperaturevariation, battery condition,and cial receivers. "aging." It is believed that additional measurement As a simpletest of universality,a secondseries of campaignsare warranted,both to assessthe impactof fingerprintswas collected from the Yaesu 2 radio these "environmental" factors and to gain further usingan Icom R9000 receiver.Fingerprints captured insightinto fingerprintmutability by examiningprints usingboth the R7100 and R9000 receiversare com- from a greater variety of radio transmitters. pared in Figures19a and 19b. Clearly,the differences betweenthese pairs of prints are relativelysmall and would, in all likelihood, result in a certain match. Acknowledgments. The authors are indebted to Indus- While a singleexample does not constituteconclusive try Canada, SpectrumEngineering Branch, for their sup- port and fundingof this project. evidenceof universality,it does, however, lend con- siderablesupport to the notion that universalitycan be realized usingthe complexenvelope technique. References

Abdulla, A.M., Identificationof push-to-talktransmitters 4. Conclusions usingwavelets and spectralcorrelation, M.Sc. thesis,Nav. On the basisof the examinationof the fingerprint Postgrad.Sch., Monterey, Calif., 1995. specimenscollected from radiosemploying frequency Choe, H. C., C. E. Poole, A.M. Yu, and H. H. Szu, Novel ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS 597

identificationof interceptedsignals for unknown radio Toonstra, J., and W. Kinsner, A radio transmitter finger- transmitters,Proc. SPIE Int. Soc. Opt. Eng., 2491, 1995. printing systemODO-1, paper presentedat 1996 Cana- Hippenstiel,R. D., and Y. Payal,Wavelet basedtransmitter dian Conferenceon Electrical and Computer Engineer- identification,paper presentedat IEEE Fourth Interna- ing, Inst. of Electr. and . Eng., Calgary,Alberta, tional Symposiumon SignalProcessing and Its Applica- Canada, 1996. tions, Inst. Electr. and Electron. Eng., Gold Coast,Aus- tralia, Aug. 1996. K. J. Ellis and N. Serinken, Communications Research Payal, Y., Identificationof push-to-talktransmitters using Centre, 3701 Carling Avenue, Box 11490, Station H, Ot- wavelets,M.Sc. thesis,Dep. of Electr. and Comput.Eng., tawa, Ontario, CanadaK2H 8S2. ([email protected]). Nav. Postgrad.Sch., Monterey, Calif., 1995. Toonstra,J., and W. Kinsner,Transient analysis and genetic algorithmsfor classification,paper presented at IEEE WesternCanada Conference and Exhibition 1995 (WES- CANEX'95), Inst. Electr. and Electron.Eng., Winnipeg, (ReceivedMarch 2, 2000; revisedDecember 20, 2000; Manit., Canada, 1995. acceptedFebruary 5, 2001.)