Channel State Information (CSI)

CSI provides a granular view of the wireless channel by measuring the amplitude and phase response across individual OFDM subcarriers. This is fundamentally different from Received Signal Strength Indicator (RSSI), which is a coarse, single-value power measurement.

• Resolution: Captures per-subcarrier channel response, revealing frequency-selective fading patterns.
• Phase Information: Includes the phase rotation of each subcarrier, which is highly sensitive to path length changes.
• Richness: A single CSI frame from an 802.11n/ac/ax device can contain measurements for dozens of subcarriers, forming a high-dimensional vector.

CSI is a function of the physical environment. The scattering, reflection, and diffraction of multipath components create a unique interference pattern at any given location. This pattern is effectively impossible for an attacker at a different location to replicate.

• Coherence Distance: The spatial correlation of CSI decays rapidly, typically within half a wavelength (e.g., ~6 cm at 2.4 GHz).
• Key Consequence: A CSI fingerprint is intrinsically bound to a specific physical position, providing a robust defense against relay attacks where a signal is captured and retransmitted from a different location.

CSI is not static; it fluctuates over time due to environmental dynamics. However, it exhibits a critical property known as channel reciprocity in Time Division Duplex (TDD) systems.

• Reciprocity: The CSI measured on the uplink is identical to the CSI on the downlink at the same time instant, assuming the channel is static between the two measurements.
• Temporal Coherence: The rate of change is bounded by the Doppler spread, which is determined by the velocity of objects in the environment.
• Drift Compensation: Authentication systems must employ adaptive models to track legitimate, gradual changes in the CSI fingerprint over time to avoid false rejections.

CSI is a channel-dependent feature, while RF-DNA and Specific Emitter Identification (SEI) are hardware-dependent features. They serve distinct and complementary security purposes.

• CSI: Identifies where a device is. Vulnerable to an attacker moving to the same location.
• SEI/RF-DNA: Identifies which device is transmitting. Vulnerable to a relay attack that faithfully retransmits the hardware signature.
• Fusion: A robust physical-layer authentication system fuses both CSI and hardware fingerprinting to verify both the device's identity and its claimed physical location, defeating both cloning and relay attacks.

Raw CSI is high-dimensional and noisy, requiring preprocessing to extract stable, discriminative features for a machine learning classifier.

• Amplitude Sanitization: Algorithms like Discrete Wavelet Transform (DWT) or Principal Component Analysis (PCA) are used to denoise CSI amplitude and remove outliers.
• Phase Sanitization: Raw CSI phase is often unusable due to random Carrier Frequency Offset (CFO) and Sampling Frequency Offset (SFO). A linear transformation is applied across subcarriers to calibrate and stabilize the phase.
• Deep Learning: Modern approaches bypass manual feature engineering by feeding sanitized CSI matrices directly into Convolutional Neural Networks (CNNs) or Long Short-Term Memory (LSTM) networks to learn optimal representations.

The primary challenge of CSI-based authentication is its sensitivity to environmental changes, which can cause false rejections if not properly managed.

• Static vs. Dynamic Environments: A CSI fingerprint is highly stable in a static office overnight but can change dramatically when people enter the room.
• Channel Frequency Response (CFR) vs. Channel Impulse Response (CIR): The CFR (frequency domain) is directly measured. The CIR (time domain), obtained via Inverse Fast Fourier Transform (IFFT), can sometimes provide more stable features by isolating specific multipath components.
• Mitigation: Continuous learning and context-aware models that correlate CSI changes with co-located sensors (e.g., a motion detector) are required for reliable operation in dynamic environments.

A biometric-like profile of a wireless device constructed from the aggregate of its hardware-intrinsic signal imperfections. RF-DNA combines multiple features—carrier frequency offset, I/Q imbalance, phase noise, and transient turn-on signatures—into a composite identity vector.

• Analogous to human DNA for device identification
• Requires feature extraction and dimensionality reduction (PCA, t-SNE)
• Enables passive fingerprinting without protocol interrogation

A zero-trust security model where a device's physical-layer fingerprint is verified persistently throughout a communication session. Unlike one-time login authentication, continuous authentication monitors for session hijacking or device substitution by tracking CSI variations and hardware signatures in real time.

• Detects anomalous channel changes indicating relay attacks
• Combines CSI with SEI for multi-factor physical verification
• Essential for mission-critical telemetry and autonomous vehicle links