Radio Science,Volume 36, Number 4, Pages585-597, July-August2001 Characteristics of radio transmitter fingerprints K. J. Ellis and N. Serinken Communications Research Centre, Ottawa, Ontario, Canada Abstract. In this paper, the characteristicsof radio transmitterfingerprints will be examinedby analyzingboth the amplitudeand phaseinformation obtained from complex enveloperecordings of transmitterturn-on transients.The interest in the analysisof such transientsis related to the identificationof malfunctioningor illegally operated radio transmittersin supportof radio spectrummanagement practices. Of the 28 VHF radios consideredin this study,many were found to producefingerprints having uniquely distinctivefeatures which couldbe usedfor identificationpurposes. Unfortunately, some of theseradios were found to have fingerprintsthat were virtually indistinguishablefrom each other, making the identificationprocess more difficult, if not impossible.Details of the equipment,analyses, and data collectionprocedures will be presentedalong with a discussionof the experimentalresults. The merits of this techniqueover others currently in use will also be presented. 1. Introduction ried out using a variety of VHF radio transmitters. When a radio transmitteris activatedor "keyed,"it The objectivesof this studywere not only to catalog goesthrough a relativelyshort transient phase during features useful for transmitter identification but also which the signal emanating from the unit displays to gain some insight into the issue of fingerprint characteristicsthat are believed to be unique to the consistencyas well as those intentional or evolution- extent that they can be used to unambiguouslyiden- ary processeswhich might alter their characteristics. tify an individual transmitter [Toonstraand Kinsner, In a departurefrom existingtechniques, the method 1995]. These signaturesor transientsare often re- presentedhere involvesthe analysisof complexsignal ferred to as "fingerprints"and havebeen attributedto envelopesrecorded during a transmitter's turn-on a numberof potentialcauses (which will not be dealt interval. Descriptionsof this technique and experi- with in thispaper) suchas the lock-intimes associated mental resultsare presentedin sections2-3. with phase-lockedloop (PLL) frequencycontrol sys- tems [Toonstraand Kinsner,1996]. At presentthere 2. Experimental Setup and Data are two different approacheswhich have been studied Collection for the purposesof fingerprint identification:those involvingthe recordingand analysisof analogsignals One advantageof the complexenvelope technique from a receiver'sFM discriminatorcircuit [Toonstra is that amplitude, phase, and, consequently,fre- and Kinsner,1995, 1996] and thosewhich rely solely quency information can be extracted from the re- on the envelopeor amplitude characteristicsof the cordedfingerprints. By virtue of this additionalinfor- receivedsignal [Cboe et al., 1995; Payal, 1995, Hip- mation it is likely that a greater number of features penstieland Payal, 1996;Abdulla, 1995]. Of these,the can be found, which may aid in the identification FM discriminator technique appears to be more process.To obtain the complexenvelope, a quadra- ture demodulator unit was constructed for this series commonand is currentlyused by spectrummanage- ment personnelboth in Canada and in the United of experiments as shown in Figure la. Both the States. in-phase,i(t), and quadrature,q(t), channelswere To gain a better understandingof those character- sampledwith 16-bit resolutionat a rate of 44.1 kHz. The use of both these channels, which are band isticswhich may be useful for transmitteridentifica- limited from 20 Hz to 20 kHz, when combined tion, a seriesof fingerprintingexperiments were car- through complexanalysis, gives an overall recording bandwidth of approximately40 kHz with a 40-Hz Copyright2001 by the American GeophysicalUnion. dead band centered about 0 Hz. A block diagram Paper number 2000RS002345. illustratingthe connectionsto the receiver and com- 0048-6604/01/2000RS002345 $11.00 puter/recordingequipment is shownin Figure lb. 585 586 ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS • LoJ••"•.• i(t) 10.7 MHz Pwr IF Input Splitter LO Input I. Lv;tPeraSt) 10.71 MI-Iz 50ø0 (a) 350 m • Broadband Discone )J4 Groundplane ILoca Antenna 10.711•MI-Iz I •R Antenna +10.0 dBm G-58u I Demod./ IReceiver Icom[ [Coaxial CableCoaxialRG-58 Cable I BPF I IComputer I I (b) Figure 1. (a) Quadraturedemodulator. (b) Experimentalsetup used for capturingfingerprints from the group 1 radios.For group 2 radiosthe transmitterswere connectedto a 5M8 antenna and were manually"keyed." Group 3 radioswere also manuallykeyed, but all were printed with their existing "rubber ducky" antennas.All testswere made with the sameseparation distance of 350 m. Fingerprintswere collectedfrom a variety of VHF All transmittersused in this experimentwere lo- FM transmitters, which were divided into three dif- cated in a vehicle positionedapproximately 350 rn ferent groups accordingto their operating frequen- away from the receiving location as indicated in cies.Ideally, it would have been desirableto have all Figure 1. In the caseof the group 1 radios all were radios operating on the same frequency; unfortu- connectedto a M4 groundplane antennamounted at nately, this was not practical as many of the radios a height of 3.66 m abovegroundand poweredfrom a were borrowedon a short-termbasis which precluded 12-V deep-cycle marine battery. A 5M8 antenna the modificationof their operatingfrequencies. The tuned to the desiredoperating frequency was at hand first group, group 1, contained11 radioswhich were andwas used for testswith the group2 radioswhereas fingerprintedat 147.775MHz; group 2 contained12 the group 3 radios were printed using their "rubber radioswhich were fingerprintedat 168.690MHz; and ducky" antennas.Radios from groups2 and 3 were group 3 contained5 radioswhich were fingerprinted powered from their own internal battery packs.For at 138.750MHz. In total, fingerprintsfrom 28 radios all radios, care was taken to maintain a constant were collectedfor analysis.All radios employedfre- ambient temperaturewithin the vehicle to mitigate quencymodulation (FM) andwere phase-locked loop anypossible thermal effectswhich could affect finger- (PLL) controlled,excluding those in group 3 which print consistency.All group 1 transmitterswere keyed employedcrystals. A summarylisting the particulars using a relay arrangementwhich automaticallycon- of these radios can be found in Table 1. For each trolled the push-to-talk(PTT) lines for each radio. radio a sampleof 20 fingerprintswas collected. Those transmittersin groups 2 and 3 were keyed ELLIS AND SERINKEN: RADIO TRANSMITTER FINGERPRINTS 587 Table 1. TransmitterSummary for Groups1, 2, and 3a Radio Transmitter Number of Nominal Frequency, Power Group Make Type Name Units Power, W MHz Source 1 Motorola MCX100 Motorola 2 27.0 147.775 marine battery 1 Force CMH350 Force 3 35.0 147.775 marine battery 1 Kenwood TH-25AT Kenwood 3 0.2 147.775 marine battery 1 Kenwood TH-21AT Kenwood 1 0.1 147.775 marine battery 1 Yaesu FT208R Yaesu 2 0.1 147.775 marine battery 2 Motorola Visar Sec 3 5.0 168.690 battery pack 2 Motorola HT-1000 Sec 9 5.0 168.690 battery pack 3 Motorola SHA 274 Pol 5 5.0 138.750 battery pack a Fingerprintswere recordedat the frequenciesindicated and are individuallyidentified by their transmittername and unit number. All transmitterslisted employ frequency modulation (FM). manually. The resultingtest transmissionswere ap- proximately0.5 s in duration and were repeated at O(t)=tan i-•-]' 1.0-s intervals; that is, the transmitter was on for 0.5 s -1(q(t) t and then off for the next 0.5 s. It should be noted that For analyticalpurposes the instantaneousphase 0 (t) someof the portable radiosincluded in group 1 had is unwrappedto removethe discontinuitiesproduced high- and low-powersettings and were printed under when the phaseangle passes through multiples of both conditions. rad and is denotedhere as the signalS h (t). Once in At the receivinglocation an Icom R7100 or R9000 this form, the instantaneousfrequency fi(t) can be receiver, quadrature demodulator, and computer, determined accordingto equippedwith an analog-to-digital(A/D) card,were 1 d usedto captureand recordthe fingerprintsfrom each transmitter (see Figure lb). A broadbanddiscone f i(t)= 2-•d-• Sh (t) mz, antennamounted atop a 3.66-m mast and connected to the receiver through a length of RG-58U coaxial which can be used to further characterizethe finger- cable was used for reception. To ensure that the print. If frequency shifts are produced when the receivedpower levels from each of the transmitters transmitter is "keyed," this behavior will manifest were roughly equal, the receiver's internal 20-dB itself in the form of curvatureor slope variationsin attenuatorwas activatedwhen the high-powermobile the resulting phase profile. When the transmitter transmitters were in use. reaches steady state, the phase profile will be a straightline whoseslope is proportionalto the differ- encebetween the actualoperating frequency and that 3. Signal Processingand Print of the localoscillator (LO) in the quadraturedemod- Comparison ulator. For the equipmentused in this experimentthe Once capturedand savedto disk, the in-phaseand steady state frequency will be 10.0 kHz when the quadrature samplesrepresenting a transmitter'sfin- received signal is exactlyon its assignedfrequency, gerprint are mathematicallycombined to form the since the LO for the quadrature