Replay Attack Resistance

The authentication decision is cryptographically or physically bound to the instantaneous Channel State Information (CSI) of the wireless link. The receiver measures the unique multipath characteristics—such as amplitude and phase distortions—of the current transmission. A replayed signal, even if identical in data content, will arrive through a different spatial channel or at a different time, resulting in a CSI mismatch that immediately invalidates the authentication attempt. This creates a form of location-bound authentication that a remote adversary cannot forge.

The physical fingerprint of a transmitter is not a static digital key but a stochastic process with time-varying characteristics. Features such as phase noise, carrier frequency offset (CFO) drift, and power amplifier thermal memory effects exhibit continuous, non-deterministic micro-fluctuations. A previously captured recording represents a frozen snapshot of a past hardware state. The live authentication system expects the natural, unpredictable temporal evolution of these impairments, causing a stale replay to fail the continuous authentication check.

The wireless channel itself acts as a physical unclonable function (PUF). The verifier can exploit channel reciprocity in a time-division duplex (TDD) system by sending a short challenge pulse. The legitimate transmitter's immediate response is convolved with the exact reciprocal channel, which the verifier can predict. An adversary attempting a replay attack cannot generate the correct response because they cannot predict the verifier's challenge or replicate the reciprocal channel's effect on the signal without being physically co-located.

This technique establishes a strict upper bound on the physical distance between the verifier and the prover by measuring the nanosecond-precision round-trip time (RTT) of a rapid, single-bit challenge-response exchange. The protocol is designed so that the prover must commit to a response before receiving the full challenge, preventing an adversary from using a 'wormhole' attack to relay the signal. A replay attack fails because the artificially introduced latency of capture and retransmission exceeds the speed-of-light distance bound, exposing the adversary's non-zero physical separation.

A Physical Unclonable Function (PUF) embedded in the transmitter's silicon generates a dynamic, device-unique response based on deep submicron manufacturing variations. The authentication protocol requires the transmitter to solve a live Challenge-Response Pair (CRP). An adversary's replay of a previously observed response is useless because the verifier issues a new, random challenge for each session. The PUF's unclonable nature ensures that only the specific physical hardware instance can generate the correct, instantaneous response.

The authentication system focuses on the transient turn-on signature—the brief, chaotic microsecond-duration interval when a transmitter's oscillators and power amplifiers are stabilizing. This signature is an extremely complex, device-specific, and non-repeatable physical phenomenon. An adversary's recording equipment introduces its own filtering and distortion, and the act of retransmission generates a new, distinct transient from the adversary's own hardware. The verifier detects this double-transient anomaly or the mismatch in the original transient's fine-grained structure, rejecting the replay.

A hardware security primitive that derives a unique, unclonable cryptographic key from the inherent, random physical variations introduced during the semiconductor manufacturing process. PUFs form the silicon root of trust that makes replay attacks fundamentally infeasible.

• Challenge-Response Pair (CRP): The core mechanism; a digital input stimulus produces a physically-derived, instance-specific output.
• Process Variation: Microscopic manufacturing differences ensure no two PUFs are identical, even from the same wafer.
• Replay Resistance: An attacker cannot clone the PUF's physical response, so capturing a valid CRP exchange is useless for future authentication.

A cryptographic protocol that establishes a precise upper bound on the physical distance between a verifier and a prover by measuring the nanosecond-scale round-trip time of a rapid challenge-response exchange. This directly defeats relay attacks and mafia fraud.

• Round-Trip Time (RTT): The verifier measures the exact time between sending a challenge bit and receiving the response.
• Speed of Light Constraint: An attacker cannot relay a signal faster than light, so a distant adversary is detected by the timing violation.
• Integration with RF-DNA: Combining distance bounding with RF fingerprinting provides both location and hardware identity verification.

A zero-trust security model where a device's physical-layer fingerprint is verified persistently throughout a communication session, not just at initial login. This ensures that a session cannot be hijacked after a single successful authentication.

• Persistent Verification: The receiver continuously extracts and validates the transmitter's RF-DNA from every packet or frame.
• Session Hijacking Prevention: If an adversary replaces the legitimate transmitter mid-session, the fingerprint mismatch triggers an immediate alert.
• Drift Compensation: Adaptive models update the stored fingerprint template to account for gradual environmental changes without requiring re-enrollment.

A deliberate, often imperceptible perturbation crafted by an adversary and added to a transmitted signal to fool a deep learning-based fingerprinting classifier. This is a sophisticated threat that goes beyond simple replay.

• Evasion Attack: The adversary modifies their own transmission to mimic the fingerprint of a legitimate device.
• Perturbation Crafting: Techniques like the Fast Gradient Sign Method (FGSM) are used to generate noise that causes misclassification.
• Adversarial Training: A defense mechanism where the classifier is trained on adversarially perturbed examples to improve its robustness against such attacks.

A covert device identification technique that relies solely on observing and analyzing the inherent signal characteristics of a transmitter's normal communication. It requires no special challenge or interrogation signal, making it invisible to the adversary.

• No Active Probing: The system extracts features like phase noise and I/Q imbalance from standard data transmissions.
• Covert Operation: The adversary is unaware that authentication is taking place, preventing them from attempting to modify their behavior.
• Replay Futility: Since the fingerprint is an intrinsic part of every transmission, a replayed signal carries the original device's fingerprint, not the attacker's, but timestamp or nonce checks at higher layers still prevent reuse.

The operating point on a biometric or fingerprinting system's performance curve where the rate of falsely rejecting a legitimate device (False Rejection Rate) equals the rate of falsely accepting an imposter (False Acceptance Rate). It is the primary metric for tuning replay resistance.

• Threshold Tuning: The system's decision threshold is adjusted to balance security (low FAR) against usability (low FRR).
• Replay Trade-off: A system with a very low FAR is highly resistant to replay attacks but may suffer from high FRR, causing legitimate users to be locked out.
• Receiver Operating Characteristic (ROC): The EER is a single point on the broader ROC curve used to evaluate overall system performance.