PHY-Authentication Protocol

The protocol initiates a challenge-response handshake at the physical layer. The verifier transmits a specific waveform or sequence that forces the claimant to reveal its unique hardware impairments. Unlike cryptographic challenges, the response is not a computed secret but an inherent analog distortion pattern produced by the transmitter's power amplifier, oscillator, and DAC. The challenge is designed to stress specific components, making the resulting RF-DNA more distinguishable. This mechanism provides replay attack resistance because the challenge is nonce-based and the response is physically bound to the hardware.

Upon receiving the response signal, the protocol executes a real-time feature extraction pipeline:

• Synchronization: Precise alignment of the received waveform to remove channel-induced timing offsets.
• Channel Equalization: Mitigation of multipath effects to isolate hardware-specific distortions from environmental artifacts.
• Transform Domain Analysis: Application of cyclostationary processing, higher-order statistics (bispectrum), or wavelet decomposition to convert raw IQ samples into a compact RF feature vector.
• Dimensionality Reduction: Compression of the feature vector to retain only the most discriminative, device-specific components.

The extracted feature vector is compared against a stored enrollment template using a similarity metric. Common approaches include:

• Euclidean or Mahalanobis distance for statistical feature vectors.
• Cosine similarity for deep learning embeddings generated by a Siamese neural network.
• Likelihood ratio tests for probabilistic models. The protocol applies an adaptive threshold that balances false acceptance rate (FAR) and false rejection rate (FRR). The decision logic outputs a binary authentication result or a continuous confidence score for risk-based access control.

Unlike one-time login protocols, a robust PHY-authentication protocol operates as a persistent verification loop. Throughout the communication session, the verifier continuously monitors the transmitter's signal. This continuous authentication detects device substitution attacks where an adversary hijacks a session after initial authentication. The protocol can trigger a re-authentication challenge if the live fingerprint drifts beyond a tolerance window, providing impersonation attack mitigation for the entire session duration.

The protocol defines a secure enrollment phase where a device's fingerprint is first registered. This involves:

• Multi-frame averaging to capture a stable, high-SNR representation of the device's impairments.
• Template storage in a secure database, often protected by a hardware root of trust.
• Drift compensation models that track slow temporal variations due to temperature and component aging, preventing false rejections over time. The enrollment process is a critical trust-establishment step, often performed in a controlled environment to ensure the template is uncompromised.

To prevent man-in-the-middle attacks that separate physical layer identity from higher-layer data, the protocol cryptographically binds the PHY authentication result to the upper-layer session. A derived key or session token is generated from the verified physical layer identity and used to secure subsequent communication. This cross-layer authentication ensures that the device authenticated at the physical layer is the same device encrypting and transmitting the data payload, closing a critical security gap.

The core process of uniquely identifying a wireless transmitter by analyzing the subtle, hardware-specific imperfections in its emitted radio frequency signal. SEI forms the analytical backbone of any PHY-authentication protocol.

• Mechanism: Extracts features like I/Q imbalance, oscillator phase noise, and power amplifier non-linearity
• Output: A unique RF fingerprint matched against a known device library
• Challenge: Must remain robust against channel distortion and environmental drift

A physical hardware security primitive that exploits inherent manufacturing variations to generate a unique, unclonable identity for a semiconductor device. PUFs provide the immutable root of trust that PHY-authentication protocols rely upon.

• Types: SRAM PUFs, ring oscillator PUFs, arbiter PUFs
• Property: Challenge-response pairs are unique per chip and impossible to replicate
• Role: Serves as the hardware anchor that generates the unique signal impairments used for fingerprinting

A security process that persistently validates a transmitter's identity throughout an entire communication session, rather than performing a single check at login. This is the operational mode of advanced PHY-authentication protocols.

• Advantage: Detects session hijacking and device substitution in real-time
• Implementation: Analyzes every packet or frame for consistent RF fingerprint features
• Contrast: Traditional cryptographic authentication only verifies identity at session initiation

A compact, numerical representation of the salient identifying characteristics extracted from a raw RF signal for use in machine learning models. The feature vector is the mathematical bridge between raw waveform data and the authentication decision.

• Components: May include bispectrum coefficients, wavelet transform energies, and statistical moments
• Dimensionality: Typically reduced via PCA or autoencoders to optimize classification speed
• Requirement: Must capture device-unique variance while rejecting channel-induced variance

The process of providing a verifiable proof of a device's hardware integrity and identity based on its physical layer characteristics. Attestation extends beyond simple identification to include integrity verification.

• Scope: Confirms both device identity and that the hardware has not been tampered with
• Method: Compares current RF fingerprint against a trusted baseline stored during enrollment
• Application: Critical for supply chain security and anti-counterfeiting deployments

The property of an authentication system that prevents an adversary from gaining access by retransmitting a previously captured valid signal. PHY-authentication protocols achieve this inherently without additional cryptographic overhead.

• Mechanism: RF fingerprints are bound to the physical transmitter hardware, not the data content
• Result: A recorded and replayed signal from an attacker's radio will carry the attacker's own hardware fingerprint, not the victim's
• Advantage: Provides defense against sophisticated signal capture and replay threats