TDMA Device Identification Using Continuity of Carrier Phase

Specific emitter identification provides the capability to distinguish radio emitters with the external features carried by the received waveforms. As existing features are not specific to time-division multiple access (TDMA) devices, it is yet intractable to discern the emitter in the case of low signal-to-noise rates or short durations. In this paper, we propose a novel characteristic based on the continuity of carrier phase and explore its application on TDMA device identification. The characteristic reflects a fact whether adjacent time slots are assigned to the same user terminal, which reveals a potential link between slots even if the protocol is unknown. To apply it to TDMA device identification, we augment the typical SEI scheme with two subsystems, Decision and Correction, in which the recognition results can be corrected to improve the accuracy. Simulation results demonstrate that the characteristic is resilient against the ambient noise, and it evidently improves the recognition accuracy.


Introduction
Specific emitter identification (SEI) is a technique to identify the individual emitters by extracting external features from a given signal [1]. Because the external features are unique for each emitter, SEI plays an important role in military and civil fields [2], [3]. A typical SEI system, as shown in figure 1, generally consists of several subsystems: Radio Frequency (RF) System, Signal Processing, Feature Estimation, Identification Classifier, Cluster Management and Database [1]. The key of SEI is a set of features that make identification possible. Features can be inferred or predefined [4]. We say that features are inferred when they are extracted from signals by means of some transformations, without a priori knowledge of a specific signal characteristic. For example, features are extracted using Wavelet Transform to identify the individual RF emitters [5]. Another approach is to exploit bispectrum characteristics with Fast Fourier Transform [6]. Furthermore, Hilbert-Huang Transform is also applied to extract the RF fingerprinting in [7], [8]. Differently from inferred features, the predefined ones relate to well-understood signal characteristics. In [9], Vladimir Brik creatively proposes a passive radiometric device identification system (PARADIS) differentiating 138 wireless CMVIT2019 IOP Conf. Series: Journal of Physics: Conf. Series 1229 (2019) 012047 IOP Publishing doi: 10.1088/1742-6596/1229/1/012047 2 devices with accuracy in excess of 99%. The proposed characteristics are imperfections in modulation domain, such as frequency offset, I/Q origin offset, magnitude and phase errors. Besides, phase noise of the oscillator is used as the device tags to identify individual emitters in [10].
However, the foregoing features are not specific to time-division multiple access (TDMA) devices. Especially, in the case of low signal-to-noise rates (SNRs) or short durations, the features are too unstable to be used for recognition. In this paper, we propose a novel characteristic based on the continuity of carrier phase and augment the typical SEI scheme with two subsystems to identify the TDMA devices. To be specific, the new characteristic reflects a fact whether adjacent time slots are assigned to the same user terminal. In other words, it reveals a potential link between slots, even if the protocol is unknown. Thus, SEI for each slot may be no longer independent. The potential link, as a priori knowledge, can further improve the accuracy by correcting the results. The main contributions are summarized as follows:  A novel characteristic of TDMA devices is proposed to detect whether the adjacent slots are assigned to the same user. Besides, we not only interpret the fingerprinting in terms of the transmitter structure, but also extract it with a defined metric.  For TDMA device, the typical SEI system is extended with two subsystems: Decision and Correction. In the Decision subsystem, an adaptive threshold is derived by modelling and analysing the distribution of the novel characteristic. In the Correction subsystem, a maximumconfidence approach is provided to correct the results. The remainder of this paper is organized as follows. Section 2 gives the background. Section 3 introduces the new characteristic. Section 4 presents the augmented system for TDMA device identification. Section 5 provides the numerical simulations. Finally, Section 6 concludes the paper.

Frame Structure
TDMA is frequently used in the multiuser communication systems. For a TDMA system, each user terminal transmits the information in bursts. As depicted in figure 2, bursts are organized within a periodic structure, called a TDMA frame. Each frame is divided into a number, say S, of non-overlapping time slots. A small time interval is reserved between adjacent slots for protection.

Transmitter Structure
In the TDMA system, each user terminal is equipped with an independent modem and antenna. This implies that each user is an individual radio emitter. Nowadays, direct complex modulation has increasingly become the architecture of choice for implementing transmitter signal chains for end applications [11]. This technique directly modulates the output I/Q signals of a digital-to-analog converter onto an RF carrier, which eliminates the need for an intermediate frequency stage and the associated filtering. A typical direct conversion transmitter is shown in figure 3.

Continuity of carrier phase
RF fingerprinting is possible due to hardware imperfections in the analog circuitry introduced at the manufacturing process. As indicated in figure 3, the reserved time interval is very small. When adjacent slots are assigned to the same user, there is no enough time for local oscillator (LO) in the transmitter to adjust. This means that LO maintains the same operating state during the reserved time interval, which leads to a continuity of carrier phase between the adjacent slots. Obviously, this phenomenon will hardly exist when the adjacent slots are assigned to different users. Therefore, the continuity of carrier phase is a characteristic of TDMA signals, which can be used to detect the assignment of adjacent slots.
We assume that there are S time slots in a frame. Consider slot i, the complex envelope of the received waveform can be modelled as: Where f is the frequency offset,  is the carrier phase,  is the timing phase,   k c are information symbols, 0 T is the symbol period,   gt is the real-valued signalling pulse shape,   i t  is the complexvalued channel noise which is assumed to be white and Gaussian.
To measure the continuity of carrier phase, a new metric  named phase prediction error is defined. We first start with the phase difference Where , i act i   is the actual carrier phase of slot i, and , i pre  represents the predicted carrier phase inferred from slot 1 i  . We consider f as a fixed parameter, and then the predicted carrier phase can be expressed as , , where t  is the time difference between adjacent slots.
Substituting into equation (2) yields: In fact, there are phase ambiguities when estimating carrier phase of I/Q signals. Let  represent the minimum phase ambiguity. (e.g. 0.5

 
with QPSK modulation.) To sidestep its obstacle, we have: Where x mod y is the remainder after division of x by y. Finally, we derive phase prediction error i  :

TDMA device identification
Differently from the conventional features, the new characteristic seems not to be used to identify the individual radio emitters directly. Here, we propose an augmented system for TMDA device identification, as displayed in figure 4. In figure 4, f refers to the vector of conventional features, and  is the prediction phase error. In Decision subsystem, it is necessary to determine whether the adjacent slots are assigned to the same user terminal with  . Taking the slots assignment as a priori knowledge, Correction subsystem can correct some wrong results obtained by Identification Classifier.

Decision Subsystem
Assume that IDi is the user identity of slot i. Determining whether the adjacent slots are assigned to the same user terminal is a problem of detection, which can be formulated as a binary hypothesis test: In the test, we consider the detector i X   . Now, the issue is how to derive an adaptive threshold. From the foregoing discussion, it is clear that As is seen, X has a uniform distribution under H0; whereas X is Gaussian-distributed with zero mean and variance 2  under H1. Hence, we produce the probability density function of X: We notice that 2  is unknown in equation (8), which may relate to the characteristics of both channel and transmitter. To proceed, we concentrate on estimating 2  using a statistical method. Suppose that the received waveform is observed over L frames. Let j i  represent the phase prediction error of slot i in frame j. We organize them into a vector of length   1 LS , as follows :   1  1  1  2  2  2  2  3  2  3 , , , , , , , , , We compute the absolute value of each element in φ , and sort them in ascending order to produce a new vector φ . Figure 5 shows the vector φ of an actual signal. As is seen, φ has a length of 976, and takes value in the range    (7), the curve of φ achieves the cumulative distribution function of X when the vector length is sufficiently large. Furthermore, it is interesting to note that the curve is clearly divided into two parts under the two hypotheses. This reflects the fact that the value of the inflection point can be used as the test threshold. Assume that the inflection point is N0, thus, we have the test threshold: With these results at hand, the normalized mean square error of fitting can be expressed as: For the sake of simplicity,   Once N0 is available, threshold  is eventually derived by equation (10). Finally, our decision rule is:

Correction Subsystem
Here, we introduce a maximum-confidence correction approach concentrating on the following case: time slots assigned to the same user in a frame, whereas their original recognition results are not same.
With the incoming features, classifier returns the best-matching identity, along with the similarity of each identity. Here, we name the similarity as 'confidence'. Suppose that U user terminals are in a TDMA system. Let P , with the size of VU  , be the confidence matrix of the V slots. The  

Results
We demonstrate our technique on a collection of five TDMA transmitters with the same manufacturer. All devices operate at the 1.4 GHz center frequency and are digitized at a sampling rate of 800 KHz. Specifically speaking, QPSK modulation, 400 Kbps date rate, 122 L  , 9 S  , 5 U  . Because the SNRs of the received signals are measured to be more than 40 dB, which are considered as 'noise-free'. We add white Gaussian noise to the noise-free signals to simulate the different SNR scenarios.

Decision Performance
There are a total of      ).
In figure 7, both ,     8 We investigate the performance of Correction subsystem by comparing the recognition accuracies with and without correction. Figure 8 depicts the recognition accuracies with and without correction at different SNRs. In this simulation, PARADIS in [9] is employed to extract the features. 61 frames (a total of 549 slots) are used to train a support vector machine (SVM), and the remaining 61 frames are used to test. The SVM classifier, with the radial basis function, is implemented by the LIBSVM in [12]. As shown in figure 8, PARDIS with correction outperforms PARDIS without correction. The former achieves about 10% gain in recognition accuracy. The reason is that, SEI for each slot is no longer independent, and wrong results are effectively corrected in Correction subsystem.

Conclusion
In this letter, we propose a novel characteristic based on the continuity of carrier phase and explore it application on TDMA devices identification. The characteristic throws a light to the adjacent slots assignment even if the protocol is unknown. Taking it as a priori knowledge of the slot assignment, SEI for each slot may be no longer independent. Recognition accuracy can be improved by corrected the results. Simulation results are provided to demonstrate the effectiveness of our work.